R23: Secure MCP Tunnel transport R2

[bitmaster162]

Scope

R2 on top of merged R1. R1 merged to master as c184ff7280a6e310cdaa2b6903b45209bfc4e8f0.

Adds:

• server-side chatgpt-pro-readonly profile
• fail-closed filtering for both tools/list and direct tools/call
• explicit MCP read-only safety annotations
• truthful capability status: mutating execution unavailable in Pro profile
• Windows wrapper for official OpenAI tunnel-client stdio mode
• no public MCP listener / no public MCP endpoint
• tunnel health/UI explicitly pinned to loopback 127.0.0.1:8080
• no API key on command line or in repo/profile command
• strict OpenAI tunnel id validation: tunnel_ + 32 lowercase hex
• bounded local tunnel profile identifier
• Linux/Windows tests including credential-free PowerShell Plan execution
• end-to-end stdio JSON-RPC test proving hidden write tools cannot be called
• source-tree-only launcher tests skipped in wheel-only isolation by contract
• R2 runbook

Authority invariant

Secure MCP Tunnel is transport only. It does not create a second execution path. The Pro profile advertises and accepts only capability_status, system_info, fs_list, and fs_read.

Final R2 evidence

• base/master: c184ff7280a6e310cdaa2b6903b45209bfc4e8f0
• R2 head: c29b3c881d3785ebab33c3a0c7e1afc1700f82d0
• compare: ahead 26 / behind 0
• functional diff: 6 R2 files
• review-gates Ubuntu: PASS
• review-gates Windows: PASS
• CodeQL: PASS
• P0 Unified Shadow Continuity: PASS
• review threads: 0
• submitted reviews: 0

Runtime qualification boundary

CI validates code, stdio MCP dispatch, PowerShell Plan mode, packaging, and security invariants without Pro or tunnel credentials. End-to-end Init -> Doctor -> Run remains a later Windows runtime qualification using the official OpenAI tunnel-client and operator-provided credentials.

Merge boundary

Merge remains subject to the project human merge gate on the exact base/head SHAs above.