Repository navigation
REQ 129
The native guest relay shall expose only the pinned Actor MCP capabilities and bounded active-capture resources through a loopback-only, VM-bound host endpoint.
The host-side broker must read frames from the Windows guest while the Actor owns capture storage. Reading guest paths directly or exposing a generic remote shell would bypass the Actor contract and enlarge authority beyond the sealed run.
The guest launches only the pinned Actor stdio entry with LBA_CAPTURE_ROOT derived from that user's Global Storage. The relay permits initialization/capability discovery, resource list/template/read, and explicitly approved read-only tools; it rejects arbitrary commands, tools, oversized URIs/bodies/responses, foreign capture IDs, and wrong VM/source bindings. The host endpoint binds to loopback, the guest port is admitted only from a verified VirtualBox NAT source, and frame/image sizes remain within the Actor contract. No raw capture bytes or host paths are written to public logs or artifacts.
TEST-130 exercises method allowlisting, server/revision/run/VM binding, loopback/firewall source, size limits, timeout behavior, and refusal of cross-run resource reads. A local stdio fixture is not a native Windows relay proof.
SYS-REQ-033; REQ-126; epic #250; P2 #255; Actor #45
High
Planned relay protocol fixtures plus a native Windows check proving exact Actor server identity, fixed operation allowlist, opaque capture binding, host-loopback endpoint, source-restricted guest firewall, bounded frame read, and no direct storage crawl.
Proposed guest-side stdio relay and host MCP client; the already integrated Actor resource consumer remains the sole evidence admission layer.
Planned; relay network source and native Windows behavior remain unverified.