Hermes steward review / Phase 4E status

Opened this as the fork PR because chipoto69 cannot push directly to garrytan/gbrain.

Review checks completed:

• Scope enforcement: focused tests verify all MCP operations declare fine-grained required scopes, missing remote bearer auth is rejected before handler execution, read-only cannot write, writer cannot call admin, and legacy read/write/admin normalize without granting accidental admin content access.
• Token/log secrecy: gitleaks detect --no-git --redact --source . reports no leaks. Diff review found no real cleartext bearer tokens; apparent hits are docs/test identifiers/env forwarding, not token material.
• Operation names: audit tests verify tools/call logs real operation names like get_page, not generic transport labels.
• RLS posture: schema/migration tests verify service-role-only tables are RLS-disabled/commented and the legacy auto-RLS trigger/function is removed.
• Hot-row cooling: token-last-used tests verify one write per key per cooldown window plus LRU behavior while preserving request audit rows.

Commands run:

• bun run typecheck — pass
• bun test test/scoped-tokens.test.ts test/http-transport.test.ts test/serve-http-audit.test.ts test/token-last-used.test.ts test/rls-posture-migration.test.ts — 56 pass
• gitleaks detect --no-git --redact --source . — no leaks
• Full bun test attempted; timed out at the 600s worker cap after broad progress. test/cli-options.test.ts also has an environment-sensitive spawn issue in this Hermes profile (bun missing from PATH unless prepended, then skillpack-check times out). Treat focused Phase 4 suites as the reliable gate here.

Blocked items:

• PR is currently GitHub CONFLICTING against origin/master. I attempted a normal merge from origin/master; it produced conflicts across the hardening surface plus broad upstream churn, so I aborted to avoid leaving a dirty/conflicted branch.
• Live multi-agent MCP smoke against Rudy's real GBrain Postgres was blocked by upstream DB auth circuit breaker: (ECIRCUITBREAKER) too many authentication failures, new connections are temporarily blocked. No tokens were printed, and the temporary smoke script was removed.

Verdict: implementation surface looks sane from focused review, but do not merge until a conflict-resolution pass rebases/merges current master and live MCP smoke can run against valid DB credentials.

Status comment — the v0.41.3.0 security/MCP fix wave (#1403) ran a deliberate scope review of this PR and decided to keep it open as a parking lot rather than cherry-pick wholesale. Three independent wins from your design are filed as TODOS:

• T13a (P1): Extract deny-by-default fine-grained scope wiring — the per-op requiredScope metadata + dispatch-time gate. Today the OAuth scope string is validated at registration but doesn't actually constrain which ops a token can call. Real security win when landed.
• T13b (P2): Extract real operation names in mcp_request_log — pre-fix every MCP request logs tools/call generically; your PR carries the real op name (get_page, put_page, etc.). Standalone win, low risk, candidate for next minor.
• T13c (P2): Extract access_tokens.last_used_at LRU debounce — useful on multi-agent fleets sharing tokens at high rate.

The reason for not cherry-picking the whole PR: your Phase 4 work includes an RLS posture rewrite that drops the v0.26.7 auto-RLS event trigger. That trigger is treated as load-bearing by gbrain doctor's rls_event_trigger check and is the canonical posture for service-role-only deployments. Reversing it deserves its own plan-eng-review + doctor-check rewrite + a breaking-change CHANGELOG note — not a bundle inside a small fix wave.

v0.41.3.0 picks up some adjacent territory you helped surface: the OAuth CORS lockdown (Express server defaulted to cors() wide-open), GBRAIN_HTTP_TRUST_PROXY env unification across both transports, and the ALLOWED_TOKEN_ENDPOINT_AUTH_METHODS validator with client_secret_basic in the allowed set.

Happy to discuss splitting #1316 into the three TODOS above as separate PRs if you want to drive them — that would unbundle the architectural risk and keep the wins.