[ak5]

Summary

Allow the 15 reviewed Herdr observation MCP tools to be explicitly selected in Charon-Hermes policy. Previously, Operation.create classified them as unknown and Policy rejected the names, preventing the approved observation adapters from loading.

Motivation and scope

Add a separate built-in external catalog for Mac, mule and dev, each with exactly ping, agent_list, agent_get, agent_read and agent_wait, all read. Operation creation and policy loading share classify_tool. The core inventory and its review digest, version 2 policy schema, recommended policy, Hermes upstream pin and gateway behavior remain unchanged. No wildcard matching, argument-based classification or trust in MCP annotations is introduced.

Bump the integration to 0.2.2. The existing release image contains the matching wheel at /opt/charon-hermes/wheels/charon_hermes-0.2.2-py3-none-any.whl; downstream builds must copy it from the same digest-pinned companion image. No new release mechanism or runtime dependency is needed.

Security impact

• Trust boundary changed: the reviewed admission catalog now supports explicit opt-in to these external observation tools; no gateway or transport boundary change.
• Credential flow changed: no
• Threat model updated: fixed-host, forced-command, read-only remote enforcement belongs to Infra, including reads <=120 lines and waits <=30 seconds. Observation output can contain sensitive data; read classification does not imply non-sensitive results. Unknown, mutating, session-operation, alternate-host and lookalike MCP names remain denied.

Documentation

Updated the integration README, versioned compatibility contract, tool-integration contract, integration boundaries and threat model. Documented opt-in policy generation/validation and the matching 0.2.2 wheel path. Relative Markdown file links pass.

Verification

• Reproduced all 15 unknown classifications and policy rejection before the fix.
• mise run check, sequential with nice -n 10, including all 35 Hermes tests against the exact pinned upstream source.
• Built and installed the wheel in an isolated venv; its policy/plugin/socket/receipt regressions and CLI validation passed.
• Exact external-catalog review digest and tests preserve the core inventory, core digest and default policy.
• Explicit opt-in, all 15 calls and metadata-only receipts, forged classifications, unknown/mutating names, annotations, lookalikes and omitted tools covered.

Risk and rollback

• Risk: correctness of the external read classification depends on Infra binding these exact names to its reviewed observation adapters. Charon does not validate remote argument values. Live remote behavior and Infra activation are outside this PR.
• Rollback: restore the previous companion plus matching Hermes wheel/image and remove the external policy entries. Older admission rejects policies containing these names. Do not deploy mixed plugin/companion releases.

No Infra files, live services, session operations, production deployment or Charon gateway changes are included.

Published artifact verification

Merged main: 3ee8aeacff7074eed07670d5a8516859bde116b7. Main CI and Release run 40940132154 succeeded.

• Companion: ghcr.io/ak5/charon-hermes:sha-3ee8aeacff7074eed07670d5a8516859bde116b7@sha256:a09c81222d96079994ceaaddcef3d6319ceb446071b5fe5999918a3df6553e68
• Linux/amd64 manifest: sha256:00df2d3dbac625e076f62fc1c0d018c7ed603ea7f613e03c89bbc84ec8bd2192
• Wheel in that image: /opt/charon-hermes/wheels/charon_hermes-0.2.2-py3-none-any.whl
• Wheel SHA-256: 1c26c46381390c1dcd3c32cbfe446bc28a0c18585f67e1812ccfc2667396f6ed

Verified GHCR manifest and layer digests, extracted the exact wheel from the published image, and confirmed byte-for-byte equality with the locally installed/tested wheel. Infra owns the downstream Hermes rebuild and rollout; this PR performed no live activation.