POST /mcp — Streamable HTTP JSON-RPC 2.0 (MCP spec 2024-11-05)
11 governance tools for consortia builders:
request_ac — AC issuance (wraps /governance/authorize/)
validate_ac — AC validation (wraps /governance/authorize/{token}/)
post_cr — CR posting (wraps /governance/complete/)
query_accord — AccordTemplate lookup
request_delegation — proxy to LLM Principal Broker
revoke_delegation — proxy to LLM Principal Broker
get_delegation — proxy to LLM Principal Broker
list_agents — proxy to LLM Principal Broker
get_posture — DEFCON level and restrictions (30s cache)
check_operation — dry-run operation check against posture
session_info — current session context
Tool handlers call existing broker internals — no logic duplication.
Delegation tools proxy to LLM Principal Broker via HTTP.
Every tool call recorded in Chronicle (MCP_TOOL_CALL 0x3020).
Any MCP-compatible agent can discover and use governance operations
through standard protocol — no Capstone, no Django required.
All 7 smoke tests pass (init, list, posture, check_op, session, accord, error).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Reference implementation of GCAP-SPEC-SHELLBOUND-BROKER-0001
in FastAPI. Designed for ISVs and enterprises implementing
the governed shell authorization protocol.
Architecture:
FastAPI + SQLModel + Pydantic + async SQLite
Single container deployment: Dockerfile included
OpenAPI schema at /docs is the machine-readable GSAP contract
Broker Interface (§5):
POST /governance/authorize/ — Issue AC
GET /governance/authorize/{p}/ — Poll elevation
POST /governance/complete/ — Receive CR
GET /governance/session/{id}/ — View chain of custody
POST /governance/elevate/ — JIT elevation
GET /governance/drivers/ — List drivers
Identity Driver Interface (§2.2):
IdentityDriver — abstract base (ISV extension point)
KeycloakDriver — Keycloak implementation
DriverRegistry — driver lookup and registration
Chronicle integration (§1.4):
Optional CloudEvents emission via CHRONICLE_WEBHOOK_URL
Forgejo push event format for receiver compatibility
Models:
Pydantic schemas for AC, CR, Principal, Accord, Operation
SQLModel DB models for persistence
Tests: 6 async tests including full AC→CR cycle
695 lines across 27 files.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>