Restrict update calls to canisters an app declares (service discoverability)

crates/imcp2-core/src/calls.rs

@@ -167,6 +167,15 @@ pub struct CanisterUpdateCallArgs {
     /// Arguments in textual Candid syntax, e.g. `()` or `(record { owner = principal "..." })`.
     #[serde(default = "default_args")]
     pub args: String,
+    /// The WEBSITE URL of the app that owns `canister_id` (e.g.
+    /// "https://app.example.com") — open_app returns it as `app_url`. An update
+    /// call is only made to a canister the app DECLARES in its
+    /// service-discoverability manifest (`/.well-known/ic-architecture`), and this
+    /// is the origin that manifest is read from. Omit it only when
+    /// `derivation_origin` is the same origin as the app's website (the common
+    /// case); if the check fails, pass this explicitly.
+    #[serde(default)]
+    pub app_url: Option<String>,
     /// Call AS the user's account at an app, identified by its exact canonical
     /// Internet Identity derivation origin — NOT necessarily the visible URL (do
     /// not infer it from an alternativeOrigins list). Get it from open_app /
@@ -221,6 +230,14 @@ pub struct CanisterUpdateCallOutput {
     /// Always present so a text-only client can tell an anonymous call from an
     /// authenticated one.
     pub is_anonymous: bool,
+    /// The app origin whose service-discoverability manifest DECLARES this
+    /// canister — the app whose published manifest authorized this write. Always
+    /// present on a successful call: without a declaration the call is refused.
+    pub declared_by: String,
+    /// The well-known path that declaration was read from:
+    /// `/.well-known/ic-architecture` (the protocol) or `/.well-known/ic-app.json`
+    /// (this server's legacy pre-protocol path).
+    pub declared_at: String,
 }
 
 /// Arguments for `canister_query` — a READ that runs EITHER a Candid `query` method

crates/imcp2-core/src/lib.rs

@@ -38,6 +38,7 @@ pub mod tools;
 mod calls;
 mod compliance;
 mod discover;
+mod discoverability;
 mod management;
 
 pub use identities::{IiInstance, SessionGauges};

crates/imcp2-core/src/management.rs

@@ -487,6 +487,16 @@ async fn management_agent(ids: &Identities, session_id: &str) -> Result<(Agent,
 
 /// A management-canister (`aaaaa-aa`) update call with the effective canister id
 /// set to the TARGET — the boundary node requires this for lifecycle methods.
+///
+/// NOTE — these writes do NOT go through the service-discoverability gate that
+/// `canister_update_call` runs (see [`crate::discoverability`]). That is correct
+/// as things stand: these tools act on the USER'S OWN canisters as their
+/// management principal, not on a third party's app, and an app manifest has
+/// nothing to say about them. It is also currently moot — [`crate::IcProtocolTools`]
+/// is not part of the served composition. If that group is ever composed back
+/// in, revisit whether any of it can reach a canister the user does not control;
+/// the gate's premise is that a write to someone else's app needs that app's
+/// published consent.
 async fn mgmt_call(
     agent: &Agent,
     target: Principal,

docs/openai-directory-submission.md

@@ -137,8 +137,8 @@ Positive:
 2. "Does the canister behind https://opencloud.org expose an API doc, and
    what does its interface look like?" → interface + capability flags via
    get_canister_candid / get_canister_api_doc.
-3. "What canisters are behind https://opencloud.org?" → App Connect
-   discovery returns the app's canisters with provenance.
+3. "What canisters are behind https://opencloud.org?" → discovery returns
+   the app's canisters with provenance.
 4. "Open opencloud.org and list my accounts there" (signed in) → resolves
    the derivation origin, lists II accounts.
 5. "Resolve https://opencloud.org to its Internet Identity derivation