feat: expose authenticated Global Ask over MCP (v2.18.0)

.env.example

@@ -23,6 +23,16 @@ OIDC_CLOCK_SKEW_SECONDS=5
 
 BACKEND_PORT=18420
 
+# Optional dedicated MCP resource server. The localhost URI is development
+# only; production must publish the externally reachable HTTPS /mcp URI and
+# configure the authorization server to issue tokens for that exact resource.
+LINEAGEWEAVE_MCP_PORT=18421
+LINEAGEWEAVE_MCP_RESOURCE_URI=http://localhost:18421/mcp
+# Browser Origins are denied unless explicitly listed. Non-browser MCP clients
+# may omit Origin. Comma-separated exact origins; never use `*`.
+LINEAGEWEAVE_MCP_ALLOWED_ORIGINS=
+LINEAGEWEAVE_MCP_REQUESTS_PER_MINUTE=30
+
 # Optional. Empty = every LLM/vision channel is unavailable (Null client,
 # dropped and renormalized -- never a placeholder score). Point these at a
 # running contextual-orchestrator to turn the channels on.

CHANGELOG.d/2.18.0-authenticated-global-ask-mcp.md

@@ -0,0 +1,23 @@
+# 2.18.0 — Authenticated Global Ask MCP
+
+## Added
+
+- Added a separately deployable, stateless MCP 2026-07-28 Streamable HTTP resource server with one read-only `global_ask` tool.
+- Added `server/discover`, per-request MCP `_meta`, required routing headers, deterministic private/no-cache tool-list hints, `resultType=complete`, and server identity metadata.
+- Added RFC 9728 protected-resource metadata, exact MCP resource audience validation, non-empty exact JWKS `kid` selection, and browser Origin allow-listing.
+- Reused the existing Global Ask authorization/evidence assembler and contextual-orchestrator channel without bearer-token passthrough.
+- Added structured tool output containing answer text, citations, provenance-bearing citation evidence, bounded source ids, and explicit no-evidence next action.
+- Added distributed per-account invocation rate limiting through the existing Valkey service without logging question or answer text.
+
+## Security
+
+- MCP access is denied unless the OIDC subject maps to a provisioned LineageWeave account with `post_read`; per-row corporate-entity ABAC remains in force before source normalization.
+- Inbound MCP bearer credentials are never forwarded to contextual-orchestrator or the browser-facing REST API.
+- Unknown browser Origins fail closed; header/body protocol mismatches and unsupported revisions fail closed; JSON-RPC batching is rejected.
+- Non-loopback MCP resource identifiers require HTTPS.
+
+## Known prerequisite blockers
+
+- This change is stacked on PR #264 and must not merge before the #258 → #260 → #261 → #262 → #263 → #264 prerequisite chain is ready.
+- PR #258 still has an unresolved review thread in the accumulated base.
+- PR #264 still has an unresolved analysis-run cutoff propagation review finding.