rust-panosmcp v0.2.0

rust-panosmcp v0.2.0

v0.2.0 adds a guarded multi-action change-set and independent approval layer
above the existing PAN-OS candidate lifecycle.

Highlights

• Plan and persist 1–64 ordered set/delete actions without changing PAN-OS.
• Require approval by a different authenticated token identity.
• Bind approval to the exact owner, device, candidate fingerprint, ordered
  actions, XML payloads, and SHA-256 digest.
• Enforce token-specific XPath/action grants and optional token expiration.
• Serialize mutations by canonical PAN-OS endpoint across inventory aliases.
• Apply an approved set once under a PAN-OS configuration lock, with automatic
  admin-scoped revert after partial failure.
• Persist change-set and operation state across restarts; in-flight work becomes
  indeterminate and requires explicit offline reconciliation.
• Add state resolve for recording a manually proven terminal outcome.

New MCP tools:

• create_panos_change_set
• get_panos_change_set
• approve_panos_change_set
• apply_panos_change_set

Upgrade notes

• Configure --state-file /var/lib/rust-panosmcp/mutation-state.json in
  production.
• Token-store v1 remains readable and is written as v2 on the next update.
• The legacy stage_panos_config tool remains for compatibility. Revoke old
  writer tokens and omit that tool when v0.2 approval must be mandatory.
• Protect the state file like sensitive candidate configuration because it
  contains exact planned XML payloads.

Validation

• Full CI, Rust 1.88 MSRV, supply-chain policy, fuzz-target compilation,
  reproducible archive, and hardened multi-architecture container gates pass.
• PAN-OS 12.1.5 lab: independently approved two-action stage/validate/discard,
  followed by committed address-object add/delete cleanup. Final candidate
  fingerprint matched the starting baseline.