feat(aauth): MCP tool-level grant authorization + enforcement proxy (#26)

[markmhendrickson]

Closes #26.

Stacked PR. Base is feat/aauth-keypair-revocation (PR #41), since this builds on the grant_checker.py introduced there. Merge #41 first, or retarget this to main after #41 lands.

What

Extends agent_grant to gate arbitrary MCP tool calls — across any server, not just Neotoma entity operations.

grant_checker.py

• Bug fix: _parse now matches the live agent_grant schema — identity via match_sub (was filtering on a nonexistent aauth_sub snapshot field) and capabilities as an object-array (was assuming strings). Without this, GrantChecker would never have matched a real grant.
• Normalizes capabilities into ops (set of op strings) + tool_grants (map of <server>:<tool> → constraint dict).
• AgentGrant.tool_constraints(server, tool) with tool:<server>:* and tool:* wildcard support.
• GrantChecker.check_tool(server, tool) → (allowed, constraints), permissive fallback when no grant declares any tool capability (un-migrated agents keep working; migrated agents get hard enforcement).
• check_param_constraints(constraints, params) — enforces tables, max_amount_sats, to_allowlist, max_<field>, allowed_<field>; unknown keys ignored (forward-compatible).

mcp_tool_grant_proxy/proxy.py

• Generic stdio MCP interceptor between claude --print and a downstream MCP server.
• Forwards all JSON-RPC except tools/call, which it gates against the grant. Denied calls get a synthesized isError result and never reach the downstream tool.
• Emits tool_call_observation (result: allowed | denied) to Neotoma for a unified cross-MCP audit trail.
• README + launch config in the directory.

docs/aauth.md

• New "Tool-level authorization (issue Generalize tool-level authorization: extend agent_grant to MCP tool calls #26)" section: grant shape, enforcement architecture, permissive-fallback semantics.

Grant op format

{ "op": "tool:<server>:<tool>", "param_constraints": { "max_amount_sats": 500000 } }

Absent = denied. {} = unconstrained. tool:<server>:* / tool:* wildcards.

Verification

• lib/daemon_runtime/test_grant_checker.py — 13/13 passing (parsing, tool lookup, wildcards, all constraint types, suspended-grant deny).
• execution/mcp/mcp_tool_grant_proxy/test_proxy_smoke.py — 3/3 passing (advisory passthrough, non-tool passthrough, in-process deny path incl. constraint violation + deny-response shape).
• All modules pass ast.parse. HEAD commit GPG-signed.

Follow-ups (from the issue's task list, not in this PR)

• Register tool_call_observation schema in Neotoma (proxy writes it best-effort today; schema registration formalizes it).
• Wire Anthus to pass ATELES_AGENT_SUB / ATELES_AGENT_GRANT_ID through dispatch subprocess env.
• Instrument the owned parquet MCP server with option-A enforcement for defence-in-depth.
• Derive/tighten capabilities.tools from allowed_tools for the 12 product-panel agents.

🤖 Generated with Claude Code