From 239bec74c41768f9af2fc37e317a21c5da7a2183 Mon Sep 17 00:00:00 2001 From: gsxdsm Date: Mon, 15 Jun 2026 11:21:43 -0700 Subject: [PATCH] =?UTF-8?q?docs(acp):=20record=20U11=20tool-flow=20verific?= =?UTF-8?q?ation=20PASS=20=E2=80=94=20enablement=20gate=20cleared?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Live run: forwarded MCP tools and native Bash both refuse to execute when we return cancelled to session/request_permission (no TOCTOU). streamViaAcp's deny-by-default + break-early is verified safe. Env allow-list (incl. XDG/USER) validated as required for the bridged claude to authenticate. Co-Authored-By: Claude Opus 4.8 --- docs/acp-contract.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/acp-contract.md b/docs/acp-contract.md index c0b7508fb9..394e39c1d5 100644 --- a/docs/acp-contract.md +++ b/docs/acp-contract.md @@ -207,3 +207,25 @@ Keychain access; the ACP bridge's `claude` inherits the same session and authent **R17 is satisfied for the supported (login-session) daemon.** Residual (documented, not blocking): detached/headless launchd daemons would still need a credential-delivery solution — out of scope for the supported setup. **Route A (U10–U13) is cleared to build.** + +### U11 tool-flow verification PASSED (2026-06-15): enablement gate cleared + +Live run against pinned `claude-code-cli-acp` 0.1.1 in an authenticated session, +returning `cancelled` to every `session/request_permission` (what `streamViaAcp` +does). Two tests, fresh session each: + +- **Forwarded MCP tool (`fn_task_list`):** Claude fired `ToolSearch` first + (internal, completed), then `mcp__custom-tools__fn_task_list` — a permission + request fired, we cancelled, the call went to `failed`, and the schema server's + `tools/call` was NEVER reached (no execution marker). Forwarded tools do not + execute when cancelled. +- **Native Bash:** permission request fired, we cancelled, `Bash` went to + `failed`, the side-effect file was never created. Native tools do not execute + when cancelled. + +Conclusion: the bridge gates tool execution BEHIND `session/request_permission` +(no TOCTOU window); `streamViaAcp`'s deny-by-default handler + break-early on +pi-known tools is SAFE. Also validated: the bridged `claude` authenticates only +with the richer env allow-list (HOME/PATH + USER/SHELL/LANG/XDG_*) that +`streamViaAcp` forwards — a thin {HOME,PATH} env fails with "Not logged in". +The Route A enablement gate is CLEARED. Harness: /tmp/acp-toolflow/verify2.mjs.