mcp-warden-cli 2.2.0__tar.gz → 2.3.0__tar.gz

mcp_warden_cli-2.3.0/.github/workflows/normalization.yml

@@ -0,0 +1,43 @@
+name: Normalization qualification
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: normalizer-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  qualify:
+    name: Linux isolated normalization
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Install coordinator and standalone parser test closure
+        run: |
+          pip install --require-hashes -r requirements-dev.lock
+          pip install --require-hashes -r components/normalizer/requirements.lock
+          pip install --no-deps -e .
+      - name: Build exact immutable worker
+        run: |
+          docker build --iidfile "$RUNNER_TEMP/normalizer-image" -f components/normalizer/Dockerfile .
+          echo "NORMALIZER_TEST_IMAGE=$(cat "$RUNNER_TEMP/normalizer-image")" >> "$GITHUB_ENV"
+      - name: Audit independent parser closure
+        run: |
+          python -m venv "$RUNNER_TEMP/parser-audit"
+          "$RUNNER_TEMP/parser-audit/bin/pip" install "pip-audit==2.9.0"
+          "$RUNNER_TEMP/parser-audit/bin/python" -m pip_audit --disable-pip --require-hashes -r components/normalizer/requirements.lock
+      - name: Qualify actual sandbox and every ingress
+        run: bash scripts/qualify_normalizer.sh "$NORMALIZER_TEST_IMAGE"
+      - name: Deterministic normalization property corpus
+        run: pytest -q tests/fuzz/test_fuzz_normalization.py --hypothesis-seed=0

{mcp_warden_cli-2.2.0 → mcp_warden_cli-2.3.0}/CHANGELOG.md

@@ -30,6 +30,28 @@ Streamable HTTP; the v0.3 `guard` proxy adds deterministic runtime *result* insp
 
 ## [Unreleased]
 
+## [2.3.0] — 2026-11-14
+
+### Added
+
+- DSE-718 opt-in Linux supplied-content normalization: independent isolated parser
+  worker; all nine ingress kinds; bounded text/web/data, MIME, ZIP and conservative
+  text-PDF extraction; raw and normalized inspection, labeled provenance, immutable
+  worker IDs, atomic guard/offline refusal, `normalize` evidence CLI and dedicated
+  real-sandbox qualification. Office/OCR, external retrieval and non-Linux worker
+  execution are unsupported. No whole-ATK or arbitrary-format claim is made.
+
+### Fixed
+
+- Both dependency locks pin `opentelemetry-api` 1.45.2 to address
+  GHSA-mf5v-w3w3-f6cg (quadratic-time traceparent parsing).
+- `auth audit` accepts 26-character lowercase alphanumeric 1Password vault/item
+  IDs in exact `op://vault/item/field` references. Field and fragment token checks
+  and checks for other URI schemes and filesystem paths remain in force (DSE-2124).
+- `check` no longer passes when `overall_digest` differs but no per-entry drift fires
+  (e.g. a baseline lock with duplicate tool/resource/prompt keys): it now reports
+  `digest-mismatch-unexplained` (high) and exits non-zero (DSE-2125).
+
 ## [2.2.0] — 2026-10-24
 
 ### Community corpus layout (DSE-2143)
@@ -571,7 +593,8 @@ v1-strong foundation. Highlights of the 0.3.0 → 1.0.0 arc:
   declared surface, RFC 8785 (JCS) + SHA-256 canonicalization, SARIF output, and a live
   integrity-gate workflow with committed `clean.warden.lock`.
 
-[Unreleased]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v2.2.0...HEAD
+[Unreleased]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v2.3.0...HEAD
+[2.3.0]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v2.2.0...v2.3.0
 [2.2.0]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v2.1.0...v2.2.0
 [2.1.0]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v2.0.0...v2.1.0
 [1.1.0]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v1.0.1...v1.1.0

{mcp_warden_cli-2.2.0 → mcp_warden_cli-2.3.0}/DOCUMENTATION_INDEX.md

@@ -1,6 +1,6 @@
 # Documentation Index — mcp-warden
 
-Last Updated: 2026-10-22
+Last Updated: 2026-11-14
 
 Master index of every document in this repository. The `docs/` files are the
 **security contract and source of truth** for all algorithms; the three core docs
@@ -12,7 +12,7 @@ describe and visualize the implementation that satisfies that contract.
 
 | # | Doc | Purpose |
 |---|-----|---------|
-| 1 | [`README.md`](README.md) | Project overview, install, the pin/check CI demo (full walkthrough archived to [`docs/PIN_CHECK_DEMO.md`](docs/PIN_CHECK_DEMO.md) to hold the 500-line core-doc limit), CLI reference (incl. v0.3 `lock rotate`, DSE-1530 `lock sign`, DSE-1539 `--max-pages` + redacted offline `diff` viewer), GitHub Action usage section (Issue #18), **pre-commit hook section (Issue #22)** |
+| 1 | [`README.md`](README.md) | Project overview, install, the pin/check CI demo (full walkthrough in [`docs/PIN_CHECK_DEMO.md`](docs/PIN_CHECK_DEMO.md)), CLI reference (incl. v0.3 `lock rotate`, DSE-1530 `lock sign`, DSE-1539 `--max-pages` + redacted offline `diff` viewer), GitHub Action usage section (Issue #18), **pre-commit hook section (Issue #22)** |
 | 2 | [`SYSTEM_CONTEXT_DIAGRAM.md`](SYSTEM_CONTEXT_DIAGRAM.md) | System context + pin/check sequence (mermaid); trust boundary; `conclave` as dev-time reviewer only; composite GitHub Action + **pre-commit hook** as consumer delivery vehicles |
 | 3 | [`DOCUMENTATION_INDEX.md`](DOCUMENTATION_INDEX.md) | This file |
 
@@ -34,6 +34,22 @@ implementations (Python reference, zero-dependency TypeScript) prove it in CI.
 | [`packages/lock-ts/`](packages/lock-ts/README.md) | `@mcp-warden/lock` — verify-only TypeScript: hand-written JCS, SHA-256, capability + skeleton derivation, drift classifier; `npm test` runs the same corpus |
 | [`.github/workflows/integrity-gate.yml`](.github/workflows/integrity-gate.yml) `conformance` job | Runs both harnesses; mutation proof flips one hex char and requires BOTH to fail |
 
+## Supplied-content normalization (DSE-718)
+
+| Artifact | Purpose |
+|---|---|
+| [`docs/CONTENT_NORMALIZATION.md`](docs/CONTENT_NORMALIZATION.md) | Finite nine-ingress supplied-content contract, format/provenance limits, Linux sandbox, budgets, refusal/migration and qualification |
+| [`components/normalizer/README.md`](components/normalizer/README.md) | Standalone parser component, independent hash lock, pinned runtime and conservative format profiles |
+| [`src/mcp_warden/normalization_models.py`](src/mcp_warden/normalization_models.py) | Frozen finite profiles and evidence types |
+| [`src/mcp_warden/normalization.py`](src/mcp_warden/normalization.py) | Trusted coordinator validates worker evidence and derives untrusted envelopes |
+| [`src/mcp_warden/normalization_sandbox.py`](src/mcp_warden/normalization_sandbox.py) | Fixed immutable-image Linux Docker supervisor; bounded IPC and fail-closed cleanup |
+| [`src/mcp_warden/normalization_ingress.py`](src/mcp_warden/normalization_ingress.py) | All nine supplied-payload adapters; no external retrieval |
+| [`src/mcp_warden/normalization_inspection.py`](src/mcp_warden/normalization_inspection.py) | Raw/normalized shared catalog and supplied MCP container checks |
+| [`src/mcp_warden/normalization_guard.py`](src/mcp_warden/normalization_guard.py) | Atomic opt-in live frame mediation before legacy handling |
+| [`src/mcp_warden/normalization_trace.py`](src/mcp_warden/normalization_trace.py) | Bounded, explicit-direction offline trace loading |
+| [`scripts/qualify_normalizer.sh`](scripts/qualify_normalizer.sh) | Actual-image qualification with independent builder QA claims |
+| [`.github/workflows/normalization.yml`](.github/workflows/normalization.yml) | Dedicated Python 3.12 Linux parser/sandbox/every-ingress/fuzz qualification |
+
 ## Agent gates (`deploy-gate` + `auth audit` — DSE-1257 / DSE-1258)
 
 Two fail-closed gates extending warden past MCP-surface integrity into the adjacent
@@ -47,10 +63,11 @@ is the MCP auth posture sound. Both reuse the `check` exit-code contract (0 clea
 | [`src/mcp_warden/deploy_gate.py`](src/mcp_warden/deploy_gate.py) | `WRD-GATE-*` engine: eval thresholds, guardrail presence, budget, approval receipt |
 | [`src/mcp_warden/cli_deploy_gate.py`](src/mcp_warden/cli_deploy_gate.py) | `deploy-gate` command body (register idiom) |
 | [`src/mcp_warden/auth_audit.py`](src/mcp_warden/auth_audit.py) | `WRD-AUTH-*` static config audit; reuses `checks_secret.scan_field` for vendor patterns (vendor hits are never downgraded); template fill-me-ins are `WRD-AUTH-PLACEHOLDER-SECRET` (low), matched on whole tokens |
-| [`src/mcp_warden/auth_refs.py`](src/mcp_warden/auth_refs.py) | Reference / locator / placeholder heuristics behind `WRD-AUTH-*`: `${VAR}` forms, secret-manager URIs and credential paths, token-shaped segments (incl. `-`/`_`-joined tokens, DSE-1540), placeholder bounds |
+| [`src/mcp_warden/auth_refs.py`](src/mcp_warden/auth_refs.py) | Reference / locator / placeholder heuristics behind `WRD-AUTH-*`: `${VAR}` forms, secret-manager URIs and credential paths, token-shaped segments (incl. `-`/`_`-joined tokens, DSE-1540), position-scoped 1Password IDs (DSE-2124), placeholder bounds |
 | [`src/mcp_warden/cli_auth.py`](src/mcp_warden/cli_auth.py) | `auth audit` sub-app command body |
 | [`tests/test_deploy_gate.py`](tests/test_deploy_gate.py) | Engine per-control pass/fail + CLI exit codes + fail-closed on malformed evidence |
 | [`tests/test_auth_audit.py`](tests/test_auth_audit.py) | Every rule, the deliberate non-flags (loopback, `${VAR}` refs, stdio), redaction, CLI/JSON/SARIF |
+| [`tests/test_auth_refs_op_ids.py`](tests/test_auth_refs_op_ids.py) | 1Password ID references and field, fragment, scheme, length, case and malformed-path regression controls (DSE-2124) |
 | [`tests/test_agent_gates_examples.py`](tests/test_agent_gates_examples.py) | Pins the shipped examples to the per-server verdicts their README claims, so a rule change cannot silently make the docs wrong; also asserts the planted fake credentials never reach a finding field |
 | [`examples/agent-gates/`](examples/agent-gates/) | Runnable demos — a 6-server config (4 flagged / 2 deliberately clean, incl. the `Bearer ${VAR}` embedded-reference shape from #94) and pass/fail deploy evidence, with expected verdicts documented and verified |
 
@@ -306,3 +323,9 @@ review/signature CLI. Tests are `tests/test_artifact_trust.py`,
 | `tests/fixtures/poison_server.py` | **(v0.2)** result-poisoning fixture server (ANSI/secret-echo/exfil/inject/clean tools) |
 | `tests/fixtures/crash_server.py` · `listchange_server.py` · `clean_listchange.warden.lock` | **(v0.3)** raw-stdio lifecycle fixtures: crash-mid-call (`-32002`) and `tools/list_changed` rug-pull + its pinned clean lock |
 | `tests/fixtures/fault_guard_launcher.py` | **(#21)** test-only launcher that monkeypatches ONE inspection function (`inspect_result` / `evaluate_call` / `diverges_from_lock` / `_hash_live_tools`) to raise inside the spawned guard child, then runs the real CLI — drives the `--strict` terminate-site tests without any test branch in production code; `FAULT_SECRET` plants a secret for the redaction test |
+
+## Version history
+
+| Date | Change |
+|------|--------|
+| 2026-11-06 | Recorded TheDataExperts PyPI ownership, Active organization billing, normal company publisher and removal of the obsolete personal publisher; linked successful authentication-only run 42224199909. Account-wide token revoked; project-only manual fallback retained. No upload today; 2.2.0 unchanged and next normal release upload/provenance proof outstanding. |

{mcp_warden_cli-2.2.0 → mcp_warden_cli-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcp-warden-cli
-Version: 2.2.0
+Version: 2.3.0
 Summary: CI-first MCP supply-chain integrity gate: pin and verify the declared tool/resource/prompt surface of an MCP server, plus runtime tool-result inspection (guard/inspect).
 Project-URL: Homepage, https://github.com/DataScience-EngineeringExperts/mcp-warden
 Project-URL: Repository, https://github.com/DataScience-EngineeringExperts/mcp-warden
@@ -34,7 +34,7 @@ Description-Content-Type: text/markdown
 
 # mcp-warden
 
-Last Updated: 2026-10-22
+Last Updated: 2026-11-14
 
 [![CI](https://github.com/DataScience-EngineeringExperts/mcp-warden/actions/workflows/integrity-gate.yml/badge.svg)](https://github.com/DataScience-EngineeringExperts/mcp-warden/actions/workflows/integrity-gate.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
@@ -53,6 +53,11 @@ Older locks stay readable, but require review and re-pinning for this coverage.
 Hints are server claims, not proof of safety, and schemas do not certify content. Release
 operators can check production OIDC without uploading via [`RELEASING.md`](RELEASING.md).
 
+`mcp-warden-cli` is owned by the [TheDataExperts PyPI organization](https://pypi.org/org/TheDataExperts/).
+The company-repository publisher passed an authentication-only check on 2026-11-06;
+that check uploaded no package. The next normal release must prove OIDC upload
+and provenance; see the [publishing status](RELEASING.md#ownership-and-publishing-status--2026-11-06).
+
 The proposed next direction is a protocol-neutral **Warden**: human-approved tool versions and bounded actions, with untrusted inputs kept separate from authority.
 The [upgrade plan and checkpoint proposal](docs/plans/2026-10-02-tool-integrity-upgrade.md)
 maps prompts, retrieval, code execution, and serverless adapters to existing Agent
@@ -212,6 +217,21 @@ automatically — so the use cases are sequenced by leverage:
 - **Agent-framework integrator** *(post-launch).* Enforce that only warden-locked servers
   register in a LangGraph-style orchestrator — one integration locks an entire downstream ecosystem.
 
+### Isolated supplied-content inspection (DSE-718)
+
+The opt-in Linux normalizer processes supplied text/web/data, email, ZIP and a
+conservative text-PDF subset through one engine across all nine declared ingress
+families. A separately hash-locked parser image runs without network, credentials
+or host-data mounts. The coordinator preserves raw-byte evidence and creates
+untrusted derived envelopes with labeled source precision; it grants no delivery
+authority. Office/OCR, external retrieval and non-Linux worker execution refuse.
+
+`normalize <file> --media-type <MIME> --source-kind <kind> --normalizer-image <sha256:id>`
+emits evidence and redacted findings. `guard` and `inspect` accept the same
+`--normalizer-image` option for atomic, fail-closed inspection using a qualified
+immutable local image. Without it, their narrower legacy contracts remain.
+See [the supported profiles, sandbox qualification and limits](docs/CONTENT_NORMALIZATION.md).
+
 ---
 
 ## What it does
@@ -424,6 +444,7 @@ run the gate only on push:
 | `mcp-warden policy eval <file> <sample.json> [--lock F]` | Evaluate one sample call | **non-zero on a deny verdict** (CI assertion) |
 | `mcp-warden guard <server-cmd...> [--lock F] [--policy F] [--no-block-* / --allow-exfil-domain] [--block-inject-phrase] [--audit-only] [--strict] [--sarif F] [--record T]` | **(v0.3)** Transparent stdio proxy: inspects `tools/call` results + arguments at runtime. **Deterministic tier blocks by default**; opt out per-category with `--no-block-<category>` or fully with `--audit-only`. `--strict` fails CLOSED on an internal inspection error (exit `3`) | child's exit code; `3` on a `--strict` abort; otherwise never breaks the session |
 | `mcp-warden inspect <trace.jsonl> [--lock F] [--sarif F]` | **(v0.2)** Offline analyzer over a recorded JSON-RPC session — same `WRD-RES-*` catalog as `guard` (always report-only) | non-zero on any BLOCK-tier finding; 2 on read error |
+| `mcp-warden normalize <file> --media-type MIME --source-kind KIND --normalizer-image sha256:ID` | Linux supplied-content normalization/inspection through an independently qualified isolated worker; emits evidence, not extracted content. `guard`/`inspect` also accept `--normalizer-image`; see [`docs/CONTENT_NORMALIZATION.md`](docs/CONTENT_NORMALIZATION.md) | 0 no blocking finding; 1 blocking finding; 2 refusal/error |
 | `mcp-warden lock rotate <lock> [--approver ID] [--actor ID] [--note T] [--json]` | **(v0.3)** Re-attest provenance on an existing baseline without re-capturing the surface; `overall_digest` stays **byte-identical** (WARDEN_LOCK_SCHEMA §8.2). Fails closed on a tampered/inconsistent lock | 0 on success, 2 on missing/invalid/tampered lock |
 | `mcp-warden lock sign <lock> [--coordinate C] [--identity-token T]` | **(DSE-1530)** Sigstore-sign an existing **unsigned** lock and write `<lockname>.sigstore` beside it — for attesters that capture offline and sign afterwards. v2 statement (binds the coordinate) with `--coordinate`, v1 otherwise; `overall_digest` unchanged. Refuses an existing sidecar or an already-signed lock | 0 on success; **1 on signing failure (fail closed, no partial sidecar)**; 2 on missing/tampered lock, bad coordinate, existing signature, or missing `mcp-warden[sigstore]` |
 | `mcp-warden diff <lock-a> <lock-b> [--json] [--sarif F] [--no-provenance] [--exit-code]` | **(v0.3)** Offline, **redacted** viewer over the drift engine: renders integrity drift between two existing locks (A=baseline, B=current) + a separate informational provenance section. Never re-captures and never prints raw `server.command`/`args` (secret-safe) | 0 (viewer); with `--exit-code`, 1 on **integrity** drift only; 2 on missing/invalid lock |

{mcp_warden_cli-2.2.0 → mcp_warden_cli-2.3.0}/README.md

@@ -1,6 +1,6 @@
 # mcp-warden
 
-Last Updated: 2026-10-22
+Last Updated: 2026-11-14
 
 [![CI](https://github.com/DataScience-EngineeringExperts/mcp-warden/actions/workflows/integrity-gate.yml/badge.svg)](https://github.com/DataScience-EngineeringExperts/mcp-warden/actions/workflows/integrity-gate.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
@@ -19,6 +19,11 @@ Older locks stay readable, but require review and re-pinning for this coverage.
 Hints are server claims, not proof of safety, and schemas do not certify content. Release
 operators can check production OIDC without uploading via [`RELEASING.md`](RELEASING.md).
 
+`mcp-warden-cli` is owned by the [TheDataExperts PyPI organization](https://pypi.org/org/TheDataExperts/).
+The company-repository publisher passed an authentication-only check on 2026-11-06;
+that check uploaded no package. The next normal release must prove OIDC upload
+and provenance; see the [publishing status](RELEASING.md#ownership-and-publishing-status--2026-11-06).
+
 The proposed next direction is a protocol-neutral **Warden**: human-approved tool versions and bounded actions, with untrusted inputs kept separate from authority.
 The [upgrade plan and checkpoint proposal](docs/plans/2026-10-02-tool-integrity-upgrade.md)
 maps prompts, retrieval, code execution, and serverless adapters to existing Agent
@@ -178,6 +183,21 @@ automatically — so the use cases are sequenced by leverage:
 - **Agent-framework integrator** *(post-launch).* Enforce that only warden-locked servers
   register in a LangGraph-style orchestrator — one integration locks an entire downstream ecosystem.
 
+### Isolated supplied-content inspection (DSE-718)
+
+The opt-in Linux normalizer processes supplied text/web/data, email, ZIP and a
+conservative text-PDF subset through one engine across all nine declared ingress
+families. A separately hash-locked parser image runs without network, credentials
+or host-data mounts. The coordinator preserves raw-byte evidence and creates
+untrusted derived envelopes with labeled source precision; it grants no delivery
+authority. Office/OCR, external retrieval and non-Linux worker execution refuse.
+
+`normalize <file> --media-type <MIME> --source-kind <kind> --normalizer-image <sha256:id>`
+emits evidence and redacted findings. `guard` and `inspect` accept the same
+`--normalizer-image` option for atomic, fail-closed inspection using a qualified
+immutable local image. Without it, their narrower legacy contracts remain.
+See [the supported profiles, sandbox qualification and limits](docs/CONTENT_NORMALIZATION.md).
+
 ---
 
 ## What it does
@@ -390,6 +410,7 @@ run the gate only on push:
 | `mcp-warden policy eval <file> <sample.json> [--lock F]` | Evaluate one sample call | **non-zero on a deny verdict** (CI assertion) |
 | `mcp-warden guard <server-cmd...> [--lock F] [--policy F] [--no-block-* / --allow-exfil-domain] [--block-inject-phrase] [--audit-only] [--strict] [--sarif F] [--record T]` | **(v0.3)** Transparent stdio proxy: inspects `tools/call` results + arguments at runtime. **Deterministic tier blocks by default**; opt out per-category with `--no-block-<category>` or fully with `--audit-only`. `--strict` fails CLOSED on an internal inspection error (exit `3`) | child's exit code; `3` on a `--strict` abort; otherwise never breaks the session |
 | `mcp-warden inspect <trace.jsonl> [--lock F] [--sarif F]` | **(v0.2)** Offline analyzer over a recorded JSON-RPC session — same `WRD-RES-*` catalog as `guard` (always report-only) | non-zero on any BLOCK-tier finding; 2 on read error |
+| `mcp-warden normalize <file> --media-type MIME --source-kind KIND --normalizer-image sha256:ID` | Linux supplied-content normalization/inspection through an independently qualified isolated worker; emits evidence, not extracted content. `guard`/`inspect` also accept `--normalizer-image`; see [`docs/CONTENT_NORMALIZATION.md`](docs/CONTENT_NORMALIZATION.md) | 0 no blocking finding; 1 blocking finding; 2 refusal/error |
 | `mcp-warden lock rotate <lock> [--approver ID] [--actor ID] [--note T] [--json]` | **(v0.3)** Re-attest provenance on an existing baseline without re-capturing the surface; `overall_digest` stays **byte-identical** (WARDEN_LOCK_SCHEMA §8.2). Fails closed on a tampered/inconsistent lock | 0 on success, 2 on missing/invalid/tampered lock |
 | `mcp-warden lock sign <lock> [--coordinate C] [--identity-token T]` | **(DSE-1530)** Sigstore-sign an existing **unsigned** lock and write `<lockname>.sigstore` beside it — for attesters that capture offline and sign afterwards. v2 statement (binds the coordinate) with `--coordinate`, v1 otherwise; `overall_digest` unchanged. Refuses an existing sidecar or an already-signed lock | 0 on success; **1 on signing failure (fail closed, no partial sidecar)**; 2 on missing/tampered lock, bad coordinate, existing signature, or missing `mcp-warden[sigstore]` |
 | `mcp-warden diff <lock-a> <lock-b> [--json] [--sarif F] [--no-provenance] [--exit-code]` | **(v0.3)** Offline, **redacted** viewer over the drift engine: renders integrity drift between two existing locks (A=baseline, B=current) + a separate informational provenance section. Never re-captures and never prints raw `server.command`/`args` (secret-safe) | 0 (viewer); with `--exit-code`, 1 on **integrity** drift only; 2 on missing/invalid lock |

{mcp_warden_cli-2.2.0 → mcp_warden_cli-2.3.0}/RELEASING.md

@@ -50,6 +50,28 @@ The workflow uses **OIDC Trusted Publishing**, without a stored GitHub upload to
 The repo variable `PYPI_TRUSTED_PUBLISHER=true` permits an attempt; it does not prove
 that a matching PyPI publisher exists. Verify the exchange before cutting a new release.
 
+### Ownership and publishing status — 2026-11-06
+
+Both `conclave-cli` and `mcp-warden-cli` now belong to the
+[TheDataExperts PyPI organization](https://pypi.org/org/TheDataExperts/),
+transferred from `z3usalmighte` direct ownership. Organization billing is Active;
+Ernest (`z3usalmighte`) remains its sole human owner. Both projects have a normal
+Trusted Publisher for their respective `DataScience-EngineeringExperts` repository,
+`release.yml`, with a blank environment matching the workflows. No pending
+publishers remain in the inspected account.
+
+The company-repository publisher was registered before the obsolete
+`ernestprovo23` publisher was removed. [Verification run 42224199909](https://github.com/DataScience-EngineeringExperts/mcp-warden/actions/runs/42224199909)
+succeeded at `42e08c505eb28f82b01d3fa81a7696c56f6e6383`: PyPI accepted the OIDC
+exchange; build, signing and upload jobs were skipped. This establishes authentication,
+not project upload permission or successful release publication.
+
+The account-wide upload token was revoked. A `mcp-warden-cli`-only manual fallback
+is retained pending the next normal release's successful OIDC upload and provenance
+verification. It is not a workflow fallback. No upload or release was performed on
+2026-11-06; the published version remains **2.2.0**. Keep the next-release proof
+outstanding until section 2 confirms the new version and attestations.
+
 ### New projects only — pending publisher
 
 1. Log in to <https://pypi.org> as the account that will own `mcp-warden-cli`.
@@ -160,17 +182,11 @@ The same exchange error occurred on the prior 1.2.0 release. The authorized manu
 [PyPI 2.0.0](https://pypi.org/project/mcp-warden-cli/2.0.0/). That recovery proves
 publication, not that OIDC automation was repaired.
 
-After the publisher is aligned and authentication succeeds, rerun only the failed
-job from the original release run, using its retained build artifacts:
-
-```bash
-gh run rerun 36960647544 --failed
-```
-
-Do not rebuild/re-sign/replace the released assets as a repair attempt. If the
-original artifacts expired, stop and plan a fix-forward release. Success means
-OIDC authentication passes and the existing immutable files are handled by
-`skip-existing`; verify the public wheel/sdist hashes remain unchanged.
+The 2026-11-06 authentication-only check above supersedes the earlier unknown
+publisher-alignment status. The old 2.0.0 run is historical evidence, not the next
+verification target. Do not rebuild, re-sign, re-upload or rerun that release as
+part of this closeout. Prove end-to-end OIDC upload on the next normal release,
+then verify its new PyPI files and provenance under section 2.
 
 ### (Optional) TestPyPI dry-run publisher
 

{mcp_warden_cli-2.2.0 → mcp_warden_cli-2.3.0}/SYSTEM_CONTEXT_DIAGRAM.md

@@ -1,8 +1,8 @@
 # mcp-warden — System Context Diagram
 
-Last Updated: 2026-10-22
+Last Updated: 2026-11-14
 
-**CLI 2.0.0 / schema level 4** extends capture/lock/check to complete tool annotations and output
+**CLI 2.3.0 / schema level 4** includes complete tool annotations and output
 schemas, with structural output drift and Python/TypeScript parity. The existing
 tools/list gate compares those commitments for v4 locks; legacy locks retain narrower
 runtime coverage and require re-pin for the new fields. Annotations grant no authority.
@@ -60,6 +60,27 @@ logic) plus a separate informational provenance section. It never prints raw
 > enter an existing code-scanning pipeline with no new plumbing. Runtime capability
 > brokering remains out of scope (DSE-725). See [`docs/AGENT_GATES.md`](docs/AGENT_GATES.md).
 
+> **Supplied-content normalization (DSE-718)** is an opt-in Linux worker path,
+> separate from the base CLI parser dependencies. All nine input families use
+> the same engine over supplied bytes; no external connectors fetch content.
+> The coordinator creates digest-bound untrusted lineage/maps and validates
+> bounded output; PDP/PEP remains the delivery authority. The optional guard
+> wrapper inspects every complete server frame before legacy delivery, forces
+> strict refusal, and has no in-process fallback. See
+> [`docs/CONTENT_NORMALIZATION.md`](docs/CONTENT_NORMALIZATION.md).
+
+```mermaid
+flowchart LR
+    supplied[Supplied bytes: nine ingress families] --> capture[Exact-byte ingress envelope]
+    capture --> coord[normalization.py: trusted evidence coordinator]
+    coord --> sandbox[normalization_sandbox.py: Linux isolated immutable worker]
+    sandbox --> parser[components/normalizer: bounded recursive parsers]
+    parser --> validate[Bounded untrusted manifest validation]
+    validate --> evidence[Derived untrusted envelope and source-map digest]
+    evidence --> inspection[Raw and normalized shared inspection]
+    inspection --> gate[Existing policy and delivery boundary]
+```
+
 > **`doctor` (DSE-1516)** is the zero-config entry point and sits at the far left of the
 > picture: it reads the MCP client configs already on the developer's machine (Claude
 > Code, Claude Desktop, Cursor, VS Code, Windsurf, Codex — a documented, closed set with a
@@ -101,7 +122,11 @@ logic) plus a separate informational provenance section. It never prints raw
 > Minting can change PyPI pending-publisher records; it is not universally read-only.
 > Successful exchange is not proof of project upload permission. CLI 2.0.0's
 > failed OIDC exchange was recovered with an authorized manual upload of the signed bytes;
-> publisher alignment must be verified independently. See [`RELEASING.md`](RELEASING.md).
+> the company-repository publisher subsequently passed the 2026-11-06
+> authentication-only check ([run 42224199909](https://github.com/DataScience-EngineeringExperts/mcp-warden/actions/runs/42224199909)).
+> `mcp-warden-cli` now belongs to the [TheDataExperts PyPI organization](https://pypi.org/org/TheDataExperts/).
+> That authentication-only check uploaded no package. End-to-end OIDC upload
+> and provenance require proof from the next normal release. See [`RELEASING.md`](RELEASING.md).
 
 ---
 

{mcp_warden_cli-2.2.0 → mcp_warden_cli-2.3.0}/action/requirements.lock

@@ -231,9 +231,9 @@ mdurl==0.1.2 \
     --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
     --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
     # via markdown-it-py
-opentelemetry-api==1.45.1 \
-    --hash=sha256:aa38ed19bcc084ba42782a73255b3582283eced7ad6dddbd6695189e69adfb75 \
-    --hash=sha256:b31553efa588ae44bc306f863c785c5333a9ecc091248c6ee68b4b6c87fdedfb
+opentelemetry-api==1.45.2 \
+    --hash=sha256:2cbd737377e710ee740d261c94e93fa0f08e6d037c18f17513cc0a2d94479a34 \
+    --hash=sha256:d7b0008e21e5fd61cbe7a7f34ca3b6905a78ab677d9bc395e299359c75cda6b4
     # via mcp
 pycparser==3.0 ; implementation_name != 'PyPy' and platform_python_implementation != 'PyPy' \
     --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \

mcp_warden_cli-2.3.0/components/normalizer/Dockerfile

@@ -0,0 +1,13 @@
+# Official Python 3.12.16 slim-bookworm linux/amd64 manifest, reviewed 2026-11-14.
+FROM python:3.12.16-slim-bookworm@sha256:0f086103b026048cc50cb5da25ec435c023c5241a83fc44daea593377abc61c4
+
+COPY components/normalizer/requirements.lock /worker/requirements.lock
+RUN python -m pip install --no-cache-dir --no-compile --require-hashes \
+      --only-binary=:all: --no-deps -r /worker/requirements.lock
+COPY components/normalizer/*.py /worker/
+COPY src/mcp_warden/normalization_ipc.py /worker/normalization_ipc.py
+COPY LICENSE /worker/LICENSE
+COPY components/normalizer/THIRD_PARTY_NOTICES.md /worker/THIRD_PARTY_NOTICES.md
+WORKDIR /worker
+USER 10001:10001
+ENTRYPOINT ["/usr/bin/env", "-i", "/usr/local/bin/python3", "-I", "-B", "/worker/worker.py"]

mcp_warden_cli-2.3.0/components/normalizer/README.md

@@ -0,0 +1,93 @@
+# Isolated normalization parser
+
+This component is a one-request, supplied-content worker. It does not retrieve
+URLs, use credentials, write files, grant delivery authority, or provide an
+in-process fallback. The trusted coordinator must validate its entire output.
+The Dockerfile and supervisor provide the separately qualified Linux isolation
+boundary; importing this worker directly is only a parser test seam.
+
+Runtime identity is Python 3.12, Unicode 15.0.0 and the parser closure
+`pypdf==7.1.0;markdown-it-py==4.3.0;mdurl==0.1.2`. Every request checks all
+installed package versions. `requirements.lock` independently hash-locks all
+three third-party wheels.
+Install with `pip install --require-hashes --only-binary=:all: -r requirements.lock`.
+The immutable image contains `worker.py`, `formats*.py`, and the coordinator's
+standalone `normalization_ipc.py` under `/worker`. The entrypoint adds only its
+immutable own directory to Python's isolated-mode import path.
+
+The framed protocol accepts exactly one root and emits exactly one success or
+input-free `NRM-*` refusal. Frames and aggregate wire bytes are bounded by the
+shared IPC module. Nothing is delivered until the full root succeeds.
+
+Supported formats are strict UTF-8 plain text/Markdown, JSON, XML, HTML, CSV,
+RFC822/MIME, ZIP and conservative text PDF. MIME can explicitly declare ASCII,
+UTF-8 or ISO-8859-1. ZIP members require a supported suffix or PDF/ZIP signature;
+conflicting signatures, traversal, duplicate names, directories, links,
+encryption, unsupported compression/extra fields/descriptors, unknown members and empty
+entries refuse.
+Only stored/DEFLATE ZIP compression is supported; all traversal remains in memory.
+MIME decodes strict base64/quoted-printable and traverses supported attachments.
+Every MIME part rejects duplicate Content-Type, Content-Transfer-Encoding,
+Content-Disposition or MIME-Version headers, including case variants; no
+first-header interpretation of those ambiguous inputs is accepted.
+JSON rejects duplicate keys/nonfinite constants and recursively inspects supplied
+MCP `{mimeType, blob|data|text}` carriers, while retaining their encoded source
+and all surrounding keys/metadata. XML rejects DTD/entities. HTML retains hidden
+content, attributes, comments and an entity-decoded syntax view; non-void tags
+require explicit balanced closing tags under this conservative profile. CSV includes all
+fields. Source syntax is retained alongside structured decoded inspection views.
+Markdown uses markdown-it-py's CommonMark preset without plugins or rendering.
+Decoded text/code tokens, link/image attributes, fence info, unused/duplicate
+reference definitions, and embedded HTML/comment/attribute evidence are all
+inspected. Code tokens retain CommonMark's literal escape semantics. A dedicated
+combined decoded token view reconstructs instructions split across emphasis,
+links or embedded HTML tags. Unknown tokens and unbalanced embedded HTML refuse;
+the parser's internal nesting cap exceeds the worker's rejecting depth limit so
+it cannot silently discard a deep tail before an ancestor triggers refusal.
+HTML and XML also concatenate decoded character data across tags into a dedicated
+inspection segment. JSON adds a depth-first, input-order string-value concatenation
+view without inserting keys between values. These additional views reconstruct
+split text within one supplied root and consume the same output/map/work budgets;
+they do not replace syntax, attribute, comment, key or individual-value evidence.
+
+PDF uses strict pypdf parsing and checks every referenced cross-reference object,
+including unreachable objects. It retains textual metadata and UTF-8 decoded
+stream syntax, then extracts page text including invisible text. Only no-filter
+and bounded DEFLATE streams are accepted. Encryption, image/form XObjects,
+embedded fonts, byte strings, object streams, active content, XMP, unsupported
+operators/filters, unknown fonts and empty/unexplained pages refuse. Office, OCR,
+other archives and arbitrary octet streams are outside the profile. This is a
+conservative text-PDF subset; normal PDFs outside it can legitimately refuse.
+
+Every nested parser shares one root ledger. `input_bytes` is the root length;
+`expanded_bytes` counts decoded ZIP/MIME/embedded payload and PDF-stream bytes;
+`output_bytes` sums inspection UTF-8 bytes; `nodes`, `members`, `spans`, and `work`
+are cumulative. `work` charges inspected/decoded bytes, traversal nodes and PDF
+operations. `depth` and `combining_run` are high-water marks. `map_bytes` equals
+the canonical JSON full segment-list size, including raw and normalized text.
+Budgets never reset for members, pages or alternate views. Repeated evidence can
+therefore reach the map/output cap before the root input cap.
+
+Inspection text applies NFKC then removes Unicode Cf and Cc controls except
+TAB/LF/CR; original extracted text remains in `raw_text` for raw inspection.
+Only unchanged UTF-8 root plain text has exact attribution. All other segments
+use conservative root byte ranges and explicit page/member/view locators.
+Structural completeness describes this finite parser profile, never semantic
+extraction completeness. Parser omissions and dependency compromise remain
+residual risks; worker evidence stays untrusted and cannot remove taint.
+
+Parser corpus command (on builder):
+`PYTHONPATH=src .venv/bin/pytest -q tests/test_normalizer_formats.py`.
+Sandbox qualification, coordinator validation, guard parity and final artifact
+identity require their separate integration tests.
+
+Dependency review (2026-11-14): official PyPI JSON selected markdown-it-py 4.3.0
+and mdurl 0.1.2; the only non-extra Markdown dependency is `mdurl~=0.1`.
+Both installed wheel license files contain the MIT grant (markdown-it-py also
+includes its upstream markdown-it license). Version-specific PyPI advisory
+lists were empty and exact PyPI/version queries to OSV returned no findings at
+review time. These are point-in-time advisory checks, not proof of absence.
+Sources: https://pypi.org/pypi/markdown-it-py/4.3.0/json ,
+https://pypi.org/pypi/mdurl/0.1.2/json ,
+https://markdown-it-py.readthedocs.io/en/latest/using.html ,
+https://google.github.io/osv.dev/post-v1-query/ .

mcp_warden_cli-2.3.0/components/normalizer/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,18 @@
+# Parser image notices
+
+MCP-Warden worker and shared framing code are distributed under the MIT license
+copied from this repository to `/worker/LICENSE` in the image.
+
+The image installs original hash-verified wheels and retains their bundled
+copyright and license files under Python's `site-packages` distribution metadata:
+
+| Distribution | Version | License |
+|---|---|---|
+| pypdf | 7.1.0 | BSD-3-Clause |
+| markdown-it-py | 4.3.0 | MIT |
+| mdurl | 0.1.2 | MIT |
+
+Keep those original notices with any redistribution. The Python interpreter and
+base operating-system components retain the notices supplied by the pinned
+official Python image. This file identifies dependencies; it does not replace
+their complete license texts.

mcp_warden_cli-2.3.0/components/normalizer/formats.py

@@ -0,0 +1,110 @@
+"""Root-cumulative semantic budgets and deterministic inspection transforms."""
+from __future__ import annotations
+
+import unicodedata
+
+from normalization_ipc import NormalizationError, canonical
+
+PROFILE = "mcp-warden.normalizer.v1"
+PARSER_ID = "pypdf==7.1.0;markdown-it-py==4.3.0;mdurl==0.1.2"
+CEILINGS = dict(input_bytes=16*1024*1024, expanded_bytes=64*1024*1024,
+                output_bytes=16*1024*1024, depth=8, nodes=4096, members=256,
+                spans=100_000, map_bytes=8*1024*1024, combining_run=64, work=100_000_000)
+SUPPORTED = frozenset({"text/plain", "application/json", "application/xml", "text/xml",
+                       "text/html", "text/markdown", "text/csv", "message/rfc822",
+                       "application/zip", "application/pdf"})
+
+
+def fail(code="NRM-MALFORMED"):
+    raise NormalizationError(code)
+
+
+def decode(data, charset="utf-8"):
+    if charset.lower().replace("_", "-") not in {"utf-8", "utf8", "us-ascii", "ascii", "iso-8859-1"}:
+        fail("NRM-UNSUPPORTED")
+    try:
+        text = data.decode(charset, errors="strict")
+        text.encode("utf-8", errors="strict")
+        return text
+    except (UnicodeError, LookupError):
+        fail()
+
+
+class Context:
+    """A single budget ledger is shared by every nested parse and decoding view."""
+
+    def __init__(self, raw, budget):
+        if (type(budget) is not dict or budget.keys() != CEILINGS.keys()
+                or any(type(v) is not int or not 0 < v <= CEILINGS[k] for k, v in budget.items())):
+            fail("NRM-PROFILE")
+        self.budget, self.raw, self.segments = budget, raw, []
+        self.usage = dict.fromkeys(budget, 0)
+        self.charge("input_bytes", len(raw))
+        self.charge("map_bytes", 2)
+
+    def charge(self, key, amount):
+        self.usage[key] += amount
+        if self.usage[key] > self.budget[key]:
+            fail("NRM-OVER-CAP")
+
+    def node(self, depth):
+        if depth > self.budget["depth"]:
+            fail("NRM-OVER-CAP")
+        self.usage["depth"] = max(self.usage["depth"], depth)
+        self.charge("nodes", 1)
+        self.charge("work", 1)
+
+    def emit(self, raw_text, locator, exact=False):
+        if not raw_text:
+            return
+        if len(locator.encode("utf-8")) > 1024:
+            fail("NRM-OVER-CAP")
+        run = 0
+        for char in raw_text:
+            run = run + 1 if unicodedata.combining(char) else 0
+            self.usage["combining_run"] = max(self.usage["combining_run"], run)
+            if run > self.budget["combining_run"]:
+                fail("NRM-OVER-CAP")
+        text = unicodedata.normalize("NFKC", raw_text)
+        text = "".join(c for c in text if unicodedata.category(c) not in {"Cf", "Cc"}
+                       or c in "\n\r\t")
+        run = 0
+        for char in text:
+            run = run + 1 if unicodedata.combining(char) else 0
+            self.usage["combining_run"] = max(self.usage["combining_run"], run)
+            if run > self.budget["combining_run"]:
+                fail("NRM-OVER-CAP")
+        if not text:
+            fail("NRM-EMPTY")
+        self.charge("work", len(raw_text.encode("utf-8")) + len(text.encode("utf-8")))
+        self.charge("output_bytes", len(text.encode("utf-8")))
+        segment = dict(text=text, raw_text=raw_text, locator=locator,
+                       precision="exact" if exact and text == raw_text else "container",
+                       source_start=0, source_end=len(self.raw))
+        self.charge("spans", 1)
+        self.charge("map_bytes", len(canonical(segment)) + bool(self.segments))
+        self.segments.append(segment)
+
+    def parse(self, data, media, locator="root", depth=0, charset="utf-8"):
+        from formats_containers import parse_email, parse_zip
+        from formats_pdf import parse_pdf
+        from formats_structured import parse_structured
+        self.node(depth)
+        self.charge("work", len(data))
+        if not data:
+            fail("NRM-EMPTY")
+        if media not in SUPPORTED:
+            fail("NRM-UNSUPPORTED")
+        if media == "application/zip":
+            parse_zip(self, data, locator, depth)
+        elif media == "message/rfc822":
+            parse_email(self, data, locator, depth)
+        elif media == "application/pdf":
+            parse_pdf(self, data, locator, depth)
+        else:
+            if data.startswith((b"%PDF-", b"PK\x03\x04", b"PK\x05\x06", b"\x00", b"\xff\xfe", b"\xfe\xff")):
+                fail("NRM-AMBIGUOUS")
+            text = decode(data, charset)
+            self.emit(text, locator, exact=depth == 0 and media == "text/plain"
+                      and data == text.encode("utf-8"))
+            parse_structured(self, text, media, locator, depth)