g8e v1.6.7

[1.6.7] - 2026-07-30

Overview

Security hardening and demo realism release. Removes the mock L3 notary bypass (G8E_L3_MOCK), making the gateway always require real WebAuthn proof for L3 notary approval. Introduces per-member consensus seeds so BFT quorum is cryptographically meaningful — each member signs with its own distinct Ed25519 key, and a single compromised key can no longer forge enough votes to satisfy quorum. Demo scenarios now use MCPToolsCall (Path A) with human browser approval via WaitForHumanApproval instead of mock cryptographic actors. Adds Devin CLI as a supported agent and introduces command-scoped credential flags for g8e mcp stdio IDE integration.

Security

• G8E_L3_MOCK removed — The gateway always requires real WebAuthn proof for L3 notary approval. The demoL3Notary / NewDemoL3Notary auto-approve bypass has been deleted. G8E_L3_MOCK=true env var is no longer respected. A fail-closed regression test (TestGatewayModeService_GetGovernanceDeps_AlwaysUsesRealNotary) verifies the gateway never instantiates a mock notary. Affected files: internal/services/gateway/gateway_service.go, internal/services/governance/l3_notary.go, internal/services/governance/l3_notary_test.go (deleted).
• Per-member consensus keys — Consensus bootstrap now supports member_seeds in the config file, a map of member app IDs to individual hex-encoded Ed25519 seeds. Each member gets its own derived key pair, making RequireDistinct and quorum cryptographically meaningful. A single compromised key cannot forge enough votes to satisfy a multi-member quorum. The regression test TestL4Warden_SingleKeyCannotSatisfyQuorum proves this at the warden level. Affected files: internal/cli/serve/gateway.go, internal/tools/agent_harness/client/envelope.go, internal/services/governance/l4_warden_consensus_edge_test.go.
• MCP stdio credential pair validation — Cert and key must be supplied as pairs per tier (app or client). Supplying only one half (e.g. --app-cert without --app-key) fails closed with ErrIncompleteCredentialPair instead of silently mixing tiers. --gateway-url validates https scheme and non-empty host. Affected files: internal/cli/cmd/mcp.go, internal/constants/errors.go.

Added

• Devin CLI agent support — g8e mcp agent run devin launches Devin CLI with g8e as the only MCP server in ~/.config/devin/config.json. Governance is enforced by making g8e the only MCP server (Devin does not support CLI flags to disable native tools). verifyDevinInterception verifies the g8e MCP server entry exists. New constants: AgentBinaryDevin, AgentConfigDirDevin, AgentConfigFileMCPDevin. New paths in AgentConfigPaths: DevinConfigDir, DevinConfigPath. Affected files: internal/constants/agents.go, internal/constants/paths.go, internal/paths/paths.go, internal/cli/cmd/mcp.go.
• MCP stdio credential flags — g8e mcp stdio accepts --client-cert, --client-key, --ca-bundle, --gateway-url, --app-cert, --app-key flags for direct IDE MCP config integration. Credentials resolve in order: flag → G8E_* env var → enrolled CLI credential on disk. Flags are command-scoped to mcp stdio, not root-persistent. Affected files: internal/cli/cmd/mcp.go, internal/constants/errors.go.
• member_seeds bootstrap config field — New optional field in consensus-bootstrap.json. Takes precedence over seed_hex. When present, each member gets its own derived Ed25519 key pair. Affected files: internal/cli/serve/gateway.go, internal/cli/serve/consensus_bootstrap_test.go.
• commitment_ledger table — New SQLite table in the audit store schema for commitment ledger entries with hash uniqueness and a committed-at index. Affected files: internal/services/storage/audit_store.go.
• approvals_verify_action API path — New /verify path constant in APIPaths and protocol/constants/api_paths.json. Affected files: internal/constants/api_paths.go, protocol/constants/api_paths.json.
• WaitForHumanApproval client method — Drives the real out-of-band L3 notary flow: prints the approval URL to stderr, subscribes to the gateway's SSE stream for approval.completed events matching the transaction hash, blocks until a human completes the WebAuthn passkey ceremony in their browser, then verifies the approval status via the mTLS status endpoint. Affected files: internal/tools/agent_harness/client/client.go.
• NewEnsembleFromMemberSeeds constructor — Creates an ensemble with distinct per-member Ed25519 keys from a map of member seeds. HasPerMemberKeys() method reports whether per-member keys are in use. Affected files: internal/tools/agent_harness/client/envelope.go.
• shellCommandMap helper — Map-based args for MCPToolsCall (parallel to existing shellCommandArgs JSON helper). Affected files: internal/tools/agent_harness/scenarios/shell_command.go.
• fs_list scenario file — New fs_list.go in scenarios package. Affected files: internal/tools/agent_harness/scenarios/fs_list.go.

Changed

• Demo scenarios use MCPToolsCall (Path A) — All governance scenarios now call the MCP tools/call endpoint instead of SubmitMaximal. The gateway builds the GovernanceEnvelope internally, runs L2 consensus deliberation via LocalDeliberator, and suspends transactions requiring L3 notary approval. The harness waits for human browser approval via WaitForHumanApproval. SubmitMaximal/Ensemble remain as conformance testing infrastructure only. Affected files: internal/tools/agent_harness/scenarios/governance.go, dhs_sovereign.go, fedramp_governance.go.
• setupGovKit simplified — No longer creates ensemble/principal or registers signers. Sets GovKit with {OperatorID, OperatorSessionID} only. Signer registration is handled by the gateway's consensus bootstrap. Affected files: internal/cli/cmd/scenarios_run.go.
• Harness config fields removed — EnsembleSize, ConsensusKeyID, ConsensusSeed, ConsensusID, PrincipalKeyID, L3Mode removed from config.Config. CLI flags --l3-mode, --ensemble, --consensus-seed, --consensus-id removed from demos scenarios run. Affected files: internal/tools/agent_harness/config/config.go, internal/cli/cmd/scenarios_run.go.
• agentMCPConfig.ExcludeTools moved to per-agent — omitempty added to JSON tag. ExcludeTools is now only set for Claude/Codex (which use --disallowed-tools), not for Gemini/Devin. Affected files: internal/cli/cmd/mcp.go.
• verifyMCPServerEntry shared helper — Extracted common MCP server entry verification for Gemini and Devin configs. verifyGeminiInterception now calls it first. Affected files: internal/cli/cmd/mcp.go.
• Demo compose files updated — G8E_L3_MOCK=true env var removed. --public-base-url flag added. ensemble-seed.hex volume mount removed. Affected files: demos/dhs/compose.yml, demos/fedramp/compose.yml.
• Demo bootstrap configs switched to member_seeds — Both DHS and FedRAMP consensus-bootstrap.json files now use member_seeds instead of seed_hex. Affected files: demos/dhs/config/consensus-bootstrap.json, demos/fedramp/config/consensus-bootstrap.json.

Removed

• demoL3Notary / NewDemoL3Notary — Demo L3 notary that auto-approved all proofs. Deleted from internal/services/governance/l3_notary.go.
• Principal type — Mock L3 principal (Ed25519 signature) removed from harness client. SubmitMaximal no longer attaches L3 proof. Deleted from internal/tools/agent_harness/client/envelope.go.
• l3_notary_test.go — Tests for removed demo L3 notary. Deleted.
• --l3-mode, --ensemble, --consensus-seed, --consensus-id CLI flags — Removed from demos scenarios run.
• G8E_L3_MOCK env var — Removed from gateway and demo compose files.
• ensemble-seed.hex volume mount — No longer mounted in demo compose files.
• dhs-cue-veto scenario — Removed from DHS demo (veto testing is now covered by the L4 Warden regression test).

Fixed

• Vacuous quorum bug — Under the old single-key ensemble pattern, one Ed25519 key was registered as the trusted signer for every member, so a single compromised key could sign all votes and satisfy a multi-member quorum. Per-member consensus keys fix this at the configuration level by registering a distinct public key per member. The L4 Warden regression test proves forged votes fail signature verification against distinct public keys.
• ExcludeTools serialization — omitempty added to agentMCPConfig.ExcludeTools JSON tag so agents that don't use --disallowed-tools (Gemini, Devin) don't get an empty excludeTools array in their config.

Tests

• TestL4Warden_SingleKeyCannotSatisfyQuorum — Regression test proving per-member keys prevent vacuous quorum. Tests forged votes with one key fail, correct distinct-key votes pass, and 2-of-3 quorum works. (internal/services/governance/l4_warden_consensus_edge_test.go)
• TestGatewayModeService_GetGovernanceDeps_AlwaysUsesRealNotary — Fail-closed regression test verifying the gateway always uses NewGatewayL3Notary, never a mock. (internal/services/gateway/gateway_service_governance_test.go)
• Consensus bootstrap test — New test for consensusPolicyBootstrap with per-member seeds, covering per-member key derivation, single-key fallback, and idempotency. (internal/cli/serve/consensus_bootstrap_test.go)
• MCP prepare launch test — New test file for MCP agent launch preparation. (internal/cli/cmd/mcp_prepare_launch_test.go)
• MCP run error paths test — Expanded from 7 to 240 lines covering error paths in MCP stdio run. (internal/cli/cmd/mcp_run_error_paths_test.go)
• MCP tool interception test — Expanded coverage for tool interception verification. (internal/cli/cmd/mcp_tool_interception_test.go)
• PKI authority test — Refactored and simplified. (internal/services/gateway/pki_authority_test.go)
• Harness client/envelope tests — Refactored for per-member keys and removed mock L3. (internal/tools/agent_harness/client/client_test.go, envelope_test.go)
• Scenario tests — New scenario_test.go and shell_command_test.go added. Governance and DHS sovereign tests refactored for MCPToolsCall path. (internal/tools/agent_harness/scenarios/)

Documentation

• Architecture docs — docs/architecture/agents.md (MCP stdio credential resolution), docs/architecture/auth.md (human browser approval flow), docs/architecture/consensus.md (per-member seeds, gateway-internal deliberation, human browser approval), docs/architecture/network.md (MCP stdio credential flags table).
• Guide docs — docs/guides/docker_gateway.md (consensus bootstrap files updated for member_seeds).
• Developer docs — docs/devs/codemap.md (updated for refactored code), docs/devs/tests.md (governance testing description updated).
• Demo docs — demos/README.md, demos/dhs/README.md, demos/fedramp/README.md updated for MCPToolsCall path, per-member seeds, and removed mock L3.