Backend core of the MCP trust redesign:
- Risk floor: every mcp__ tool classifies EXTERNAL, always — category-keyed,
fails closed on missing metadata; user overrides may only tighten (loader
and writer both refuse loosening rules, pointing at trust rules instead).
Closes the name-collision path where a server named like a catalog
connector inherited softer classification (and the reverse, via the
backed-connector category relabel at wiring).
- Durable per-tool trust replaces the server-wide requires_approval:false
trapdoor: "Always allow this tool" writes a named, visible, revocable rule
to the user-local override store; the legacy flag stays honored but gets a
one-click migration to per-tool rules. Server-side validated in
_grant_offered — cards cannot mint what the server won't honor (the
always_trust outcome also joins the approval_outcome validation tuple).
- Remove server revokes its trust rules (exact names and server-scoped
globs): they lived in a separate store keyed by name, so a future server
added under the same name inherited don't-ask rules sight unseen.
Sign-out deliberately keeps trust — tokens only.
- Run grants ("Allow for this request"): ApprovalOutcome.THIS_RUN covers the
exact tool for the remainder of the current run — in-memory, cleared at
the run boundary (finish, interrupt, teardown) plus a fresh-run belt;
never skips the auto-approve reviewer; offered for EXTERNAL risk only
(EXEC keeps command-scoped grants, EGRESS its domain grant). Covered
calls carry a run_grant transcript origin and auto_allowed audit rows.
- Honest evidence plumbing: PermissionRequest carries the MCP destination
(stamped from the user's own server config at registration, never from
server claims); parked approvals store category/destination/reason so a
redelivered card shows the live card's evidence; approval bodies stop
baking in the "requires approval" boilerplate.
- Connect-time tool review backend: include_tools is an include-list
(unchecked tools are never registered — fail-closed growth), and
exclude_tools records explicit declines so "new" can only ever mean the
server's menu grew.
- Trusted-origin split: the engine distinguishes a user's trust rule from
the legacy server flag so the transcript chip can name the right source.
