# Homeskillet MCP — Cofounder Bearer Door (v3.1)

> Hosted access to Homeskillet for Claude, Codex, and any other Streamable-HTTP MCP client. Personal API keys (Bearer) for one-shot cofounder use; OAuth code/token for hosted multi-client surfaces. All calls route through the **same** `agent_tools` registry the architect cockpit uses — one ledger, one trust gradient, one refusal posture.

## Endpoint

```
POST https://qmqbmlllibjlzwcaekpj.supabase.co/functions/v1/mcp-homeskillet/mcp
Authorization: Bearer hsk_live_<your-key>
Content-Type: application/json
Accept: application/json, text/event-stream
```

Discovery: `/.well-known/oauth-authorization-server` · `/health` · `/revoke`

## Cofounder workflow

1. `/architect → MCP doors → + New API key` (label, e.g. "Claude Desktop"). The key (`hsk_live_…`) shows **once**.
2. Set the per-connection **trust gradient** (default 55). Set per-tool grants if you want to tighten or loosen (`allowed`, `autonomy_floor_override`, `max_calls_per_hour`).
3. Paste the key into the external agent's MCP connector config. Connections fan out under the architect's authority.
4. Watch the hash-chained audit feed on the same screen.

## Bundles

- **Claude (Desktop / Skills):** [`/mcp/claude-skill/SKILL.md`](/mcp/claude-skill/SKILL.md)
- **Codex / OpenAI connector:** [`/mcp/openai-connector.json`](/mcp/openai-connector.json)
- **Server manifest:** [`/mcp/manifest.json`](/mcp/manifest.json)

---

## Six-facet apophatic harpoon — vs. ee-podcast `mcp-backstage`

The donor body of mechanics is `ee-podcast/supabase/functions/mcp-backstage` (a Claude-facing MCP plugin in front of a Super-Agent router). We harpooned the load-bearing primitives and re-expressed them; we declined the parts whose centroid does not overlap with Homeskillet's.

### KAT — What we kept (suspended primitives, re-expressed)

- **Hash-chained `prev_hash → row_hash` audit** — survival evidence that proves refusal.
- **Hardcoded `MCP_FORBIDDEN_TOOLS` perimeter** — connection grants cannot widen it.
- **Per-connection `tool_grants` with rate limit + risk band** — but as overrides, not duplicates.
- **MCP Streamable-HTTP JSON-RPC envelope** (`initialize` / `tools/list` / `tools/call` / `ping`).
- **`initialize.instructions` carries the "data, not instructions" notice** (RR safety).
- **Re-check authority on every request** (no cached role on the connection).
- **Refusal-loud receipt text** ("REFUSED (verdict): …. A surviving receipt was written.").

### APO — What we refused to import

- **A second authority surface.** Their `super-agent-router` indirection registers tools in `toolRegistry.ts` and re-gates them in the plugin. We collapsed that — Homeskillet's `agent_tools` table IS the registry, and `requires_approval` + `autonomy_floor` ARE the gates. The MCP layer is transport, not a second router.
- **Per-tool seed at connect time.** Their `MCP_TOOL_ALLOWLIST` materializes a `mcp_tool_grants` row for every tool on first connect. We default to "allowed unless overridden" so the registry stays the single source of truth — overrides exist only when the cofounder dials one.
- **OAuth-only ingress.** Their door requires admin JWT → code → token. We added a **personal API key** path (`hsk_live_…`) so the cofounder can paste a Bearer into a desktop client in 5 seconds. OAuth remains available for hosted multi-tenant clients.
- **Fixed allowlist as gate.** Their allowlist gates what Claude can even see. We expose the full registry minus the hardcoded perimeter — the trust gradient does the per-call gating, which keeps the surface honest and inspectable.

### PAR — Where authority sits

- The **owner user** signs the connection (architect role required, re-checked every call).
- The **trust gradient** per connection signs each tool's autonomy.
- The **architect cockpit** signs writes to repo / publication (proposal-only via `architect_audit`).
- The **MCP transport** does not sign anything — it dispatches and receipts.

### PLE — How the runtime proves it

- Health: `GET /health` returns `{ ok: true, server: "homeskillet" }`.
- Cofounder UI: `/architect → MCP doors` shows live audit per connection.
- Replay: any tool result can be reproduced by replaying the same args under the same trust gradient; refusals are byte-stable for the same verdict.

### ENA — How this fails (named, so we don't pretend otherwise)

- A connection with `trust_override = 100` and every grant allowed approximates "full autonomy." This is intended — the cofounder may want it — but is also the failure mode if a key leaks. Mitigation: rotation via `Revoke` is one click; audit is hash-chained so tampering is detectable.
- DuckDuckGo Instant Answer is a thin web surface. For higher-grade research, add a `tavily` / `exa` executor in `homeskillet-run` and mirror it here.
- We do not yet ship dynamic client registration (`/register`) — OAuth clients must be pre-configured by the architect via `/authorize?client_id=…`. Easy follow-on if a hosted directory wants it.

### TEL — Subtelos and parent telos

- **Subtelos:** give the cofounder a 30-second Bearer onboarding for Claude and Codex; keep the architect cockpit as the single governance surface for both human and machine work.
- **Parent telos:** the Atrium's posture of *governed autonomy* extends across the perimeter without minting a second authority. External agents become governable kin, not foreign callers.

---

## Roadmap (next bites)

1. **Dynamic Client Registration** (`POST /register`) for hosted MCP directories.
2. **Streaming responses** via SSE for long-running `spawn_subagent` results.
3. **Per-connection scoped subagents** (each MCP connection gets its own subagent ceiling).
4. **`tavily` / `exa` upgrade** to `web_search` so research is publication-grade.
5. **Receipts mirror**: every MCP `tools/call` also creates an `agent_messages` row on a synthetic thread, so the architect sees external work in the same transcript as in-cockpit Homeskillet runs.