Publish curated ITWorx_MCP_Hub source from 9ec6419178e8ddc76a698e84bde72d5ff4472411

services/control_api/contextforge/fake.py

@@ -9,6 +9,49 @@ from uuid import UUID, uuid4
 
 import httpx
 
+APPOPS_INPUT_SCHEMAS: dict[str, dict[str, Any]] = {
+    "server.appops.deployment.status": {
+        "type": "object",
+        "additionalProperties": False,
+    },
+    "server.appops.self_upgrade.preflight": {
+        "type": "object",
+        "additionalProperties": False,
+        "properties": {
+            "repository": {"type": "string", "const": "jens/unraid-appops-gateway"},
+            "revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+            "reason": {"type": "string", "minLength": 8, "maxLength": 500},
+            "expected_current_revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+        },
+        "required": ["repository", "revision", "reason"],
+    },
+    "server.appops.self_upgrade.apply": {
+        "type": "object",
+        "additionalProperties": False,
+        "properties": {
+            "repository": {"type": "string", "const": "jens/unraid-appops-gateway"},
+            "revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+            "reason": {"type": "string", "minLength": 8, "maxLength": 500},
+            "expected_preflight_fingerprint": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+            "idempotency_key": {"type": "string", "pattern": "^[A-Za-z0-9._:-]{8,128}$"},
+            "expected_current_revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+        },
+        "required": [
+            "repository",
+            "revision",
+            "reason",
+            "expected_preflight_fingerprint",
+            "idempotency_key",
+        ],
+    },
+    "server.appops.self_upgrade.status": {
+        "type": "object",
+        "additionalProperties": False,
+        "properties": {"operation_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"}},
+        "required": ["operation_id"],
+    },
+}
+
 
 class FakeContextForge:
     """Fake REST gateway for offline adapter and reconciliation tests."""
@@ -201,6 +244,10 @@ class FakeContextForge:
             "server.deployment.status",
             "server.deployment.verify",
             "server.deployment.rollback",
+            "server.appops.deployment.status",
+            "server.appops.self_upgrade.preflight",
+            "server.appops.self_upgrade.apply",
+            "server.appops.self_upgrade.status",
         ),
         "itworx-opencode": (
             "opencode.capabilities.get",
@@ -251,7 +298,9 @@ class FakeContextForge:
     @staticmethod
     def _tool_payload(tool_name: str) -> dict[str, Any]:
         payload: dict[str, Any] = {"id": str(uuid4()), "name": tool_name}
-        if tool_name == "gitea.repository.create":
+        if tool_name in APPOPS_INPUT_SCHEMAS:
+            payload["inputSchema"] = deepcopy(APPOPS_INPUT_SCHEMAS[tool_name])
+        elif tool_name == "gitea.repository.create":
             payload["inputSchema"] = {
                 "type": "object",
                 "properties": {

services/runtime/connector_appops.py

@@ -45,6 +45,10 @@ UPSTREAM_TO_PUBLIC = {
     "deployment.status": "server.deployment.status",
     "deployment.verify": "server.deployment.verify",
     "deployment.rollback": "server.deployment.rollback",
+    "appops.deployment.status": "server.appops.deployment.status",
+    "appops.self_upgrade.preflight": "server.appops.self_upgrade.preflight",
+    "appops.self_upgrade.apply": "server.appops.self_upgrade.apply",
+    "appops.self_upgrade.status": "server.appops.self_upgrade.status",
 }
 PUBLIC_TO_UPSTREAM = {value: key for key, value in UPSTREAM_TO_PUBLIC.items()}
 MAX_BODY_BYTES = 1024 * 1024

services/runtime/connector_gitea.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import os
 import re
 from collections.abc import Callable
-from typing import Any, Literal, ParamSpec, TypeVar, cast
+from typing import Annotated, Any, Literal, ParamSpec, TypeVar, cast
 
 from mcp.server.mcpserver import MCPServer
 from mcp.server.mcpserver.context import Context
@@ -87,6 +87,14 @@ class ResearchFetchOutput(BaseModel):
     metadata: dict[str, Any] | None = None
 
 
+class PortfolioGovernanceApplyPlan(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    repositoryRef: str
+    planHash: str = Field(pattern=r"^[0-9a-f]{64}$")
+    applyScope: Literal["all", "protection_only"] = "all"
+
+
 def _repository_ref(name: str) -> str:
     value = re.sub(r"[^a-z0-9]+", "-", name.casefold()).strip("-")
     if not value:
@@ -655,9 +663,12 @@ def build_server() -> MCPServer[Any]:
         repositoryRef: str,
         expectedPlanHash: str,
         context: Context[Any, Any],
+        applyScope: Literal["all", "protection_only"] = "all",
     ) -> dict[str, Any]:
-        """Apply one unchanged governance preview and verify the stored result."""
-        return connector.branch_protection_ensure(current(context), repositoryRef, expectedPlanHash)
+        """Apply one unchanged governance preview with its explicitly hashed scope."""
+        return connector.branch_protection_ensure(
+            current(context), repositoryRef, expectedPlanHash, apply_scope=applyScope
+        )
 
     @write_tool(
         name="gitea.portfolio.governance.apply",
@@ -665,10 +676,15 @@ def build_server() -> MCPServer[Any]:
         structured_output=True,
     )
     async def portfolio_governance_apply(
-        plans: list[dict[str, str]], context: Context[Any, Any]
+        context: Context[Any, Any],
+        plans: Annotated[
+            list[PortfolioGovernanceApplyPlan], Field(min_length=1, max_length=5)
+        ],
     ) -> dict[str, Any]:
         """Apply at most five exact governance plans; every item is independently verified."""
-        return connector.portfolio_governance_apply(current(context), plans)
+        return connector.portfolio_governance_apply(
+            current(context), [plan.model_dump() for plan in plans]
+        )
 
     @write_tool(name="gitea.branch.create", annotations=SAFE_WRITE_TOOL, structured_output=True)
     async def branch_create(