Publish curated Unraid-AppOps-Gateway source from aaf7d11821a86be65c91fead97a6a4758c4fbacd

backend/app/mcp_server.py

@@ -792,6 +792,38 @@ def appops_projectbrain_delivery_revalidate(
     ))
 
 
+@appops_mcp.tool(name="appops.hub_delivery.preflight", annotations=_READ_ONLY_TOOL)
+@_tracked("appops.hub_delivery.preflight")
+def appops_hub_delivery_preflight(revision: str) -> dict[str, Any]:
+    """Read fixed MCP Hub delivery evidence without importing or deploying a candidate."""
+    if not isinstance(revision, str) or not re.fullmatch(r"[0-9a-f]{40}", revision):
+        raise ValueError("Hub delivery revision is invalid")
+    return _json(DeploymentBrokerClient().hub_delivery_operation(
+        "preflight", {"revision": revision},
+    ))
+
+
+@appops_mcp.tool(name="appops.hub_delivery.revalidate", annotations=_OPERATION_RUN_TOOL)
+@_tracked("appops.hub_delivery.revalidate")
+def appops_hub_delivery_revalidate(
+    revision: str, expected_preflight_sha256: str, idempotency_key: str,
+) -> dict[str, Any]:
+    """Queue one fixed MCP Hub delivery only after its exact native evidence fingerprint is rechecked."""
+    if (not isinstance(revision, str) or not re.fullmatch(r"[0-9a-f]{40}", revision)
+            or not isinstance(expected_preflight_sha256, str)
+            or not re.fullmatch(r"[0-9a-f]{64}", expected_preflight_sha256)
+            or not isinstance(idempotency_key, str)
+            or not re.fullmatch(r"[A-Za-z0-9._:-]{8,128}", idempotency_key)):
+        raise ValueError("Hub delivery revalidation contract is invalid")
+    return _json(DeploymentBrokerClient().hub_delivery_operation(
+        "revalidate", {
+            "revision": revision,
+            "expectedPreflightSha256": expected_preflight_sha256,
+            "idempotencyKey": idempotency_key,
+        },
+    ))
+
+
 @appops_mcp.tool(name="server.operation.execute", annotations=_LEGACY_APPROVAL_EXECUTION_TOOL)
 @_tracked("server.operation.execute")
 def execute_operation(