P0: Ship the first Hermes-native Muster MCP vertical slice

[jusso-dev]

Decision

Muster is no longer an end-user chat workspace or a general-purpose agent harness. Hermes owns the agent loop, model/provider routing, Slack sessions, context compression, general memory, delegation and cron. Slack is the human interface.

Muster is the governed security-operations control plane: an authenticated MCP server, durable policy/audit/evidence backend, connector broker, and versioned Hermes skill pack. Kelpie remains authoritative for formal incident cases.

P0 outcome

Ship the first production-shaped Hermes-native vertical slice:

Slack -> Hermes -> authenticated Muster MCP -> governed broker -> Kelpie mock/connector

Required implementation

1. Expose a remote Streamable HTTP MCP endpoint from Muster using the repository's existing service boundaries.
2. Authenticate each Hermes installation with a revocable server-side credential bound to exactly one organisation and policy subject. Never accept organisationId or capability claims from model-supplied tool arguments.
3. Implement MCP discovery and these initial read-only tools with stable JSON schemas:
   • muster_get_status
   • muster_list_capabilities
   • muster_search_kelpie_cases
   • muster_get_kelpie_case
4. Route Kelpie access through the existing governed connector path. No direct credentials may reach Hermes, prompts, skills or tool output.
5. Validate every input and output; bound result count/size; classify external text as untrusted evidence; redact secrets and disallowed fields.
6. Persist an organisation-scoped invocation/audit record containing tool/version, actor/installation, timestamps, outcome, result hash and evidence references. Do not store hidden reasoning.
7. Add a starter Hermes skill under skills/muster-soc-operations/SKILL.md explaining when and how to use the tools, evidence/citation requirements, refusal boundaries and Kelpie escalation. The skill must contain no secrets and must not be treated as an authorisation boundary.
8. Add operator documentation showing remote MCP configuration without embedding a real credential.

Explicit non-goals

• No LangGraph or replacement model runtime.
• No Muster chat UI, rooms, Inbox, composer, threads or reactions.
• No custom Slack gateway or Slack app management.
• No arbitrary MCP server registration from chat.
• No write, destructive or external-communication tools in this first slice.
• No browser admin UI beyond preserving existing compatibility.

Acceptance criteria

• A clean local stack exposes an MCP endpoint and tools/list returns exactly the intended initial Muster tools.
• A valid installation credential can call tools only in its bound organisation.
• Missing, revoked, malformed and cross-organisation credentials fail closed without leaking existence.
• Model-supplied tenant/capability fields cannot change server-side scope.
• Kelpie mock contract tests prove search and get behavior through the governed connector path.
• Input/output schema failures, oversized results, prompt-injection text, SSRF attempts and secret canaries are covered by tests.
• Repeated read-only calls remain attributable; no ungoverned external action path is introduced.
• The starter Hermes skill passes repository validation and accurately references only available MCP tools.
• A real Hermes MCP discovery smoke test is run against the local endpoint after the 13:00 Australia/Sydney provider reset; report local/mock/live status separately.
• pnpm check and focused unit/integration/contract tests pass.

Delivery

Implement in an isolated worktree from current origin/main, inspect existing code before adding packages, and salvage only still-relevant governance ideas from closed PRs #80 and #81. Open one non-draft PR linked to this issue. Do not merge or deploy automatically.