Description
The Assistant resources are a policy surface a platform team can own declaratively, verified against the provider schemas:
- assistant Rule carries ruleContent injected into the Assistant system prompt, a scope of tenant or user, a priority where lower applies first, and an applications list including assistant, loop and infrastructure_memory.
- assistant MCPServer controls which external tool servers the Assistant may call, with toolApprovalPolicies keyed by tool name taking auto_approve or always_ask, plus customHeaders and an enabled flag.
- assistant TermsAcceptance is a per-stack singleton whose accepted boolean gates Assistant usage; setting it false withdraws acceptance.
Together these let the platform ship standing instructions, an allow-list of reachable tool servers, mandatory human approval on destructive tools, and an org-wide off switch.
Ordering trap: terms acceptance gates the rest and nothing enforces that dependency automatically, so the function must gate on it the way access claims already gate on stack readiness.
TermsAcceptance is one of the ten kinds absent from the current pin, hence the dependency.
Do not put rule text in this repository beyond inert examples; real standing instructions are environment-owned.
Acceptance Criteria
- #1 Terms acceptance is rendered and gated before any other Assistant child is admitted
- #2 MCP server entries carry per-tool approval policies and default to the more restrictive option where unspecified
- #3 Rule content is selected from platform-owned configuration, with only inert examples in this repository
- #4 Withdrawing acceptance is a supported, documented path rather than an accident
- #5 A catalog example renders with a rule and an MCP server allow-list
Definition of Done
- #1 ./scripts/validate.sh passes locally
- #2 hosted Validate workflow passes on the completing commit
Implementation Plan
Wave 2: implement and validate terms-gated Assistant governance, restrictive tool approvals, withdrawal, and inert examples; root wires and gates.
Implementation Notes
Wave 1 lane E disposition, 2026-09-08: Not started and Parked because the mandatory root pre-fan-out pass did not produce a pushed seam SHA after route metadata was unavailable. Resume after GCV-0032 completes the section 5.0 pass, then spawn EXECUTION on gpt-5.6-luna at max effort with fork_turns none and the pushed pre-pass SHA. No acceptance criterion or Definition of Done item was checked.
Wave 2 verification: focused Assistant race tests proved the observed acceptance gate, withdrawal pruning, restrictive approval defaults, platform-owned rule profiles, and fatal validation of malformed MCP configuration. Catalog, integrated local gate, and hosted Validate run 34233686654 passed.
Final Summary
Delivered terms-gated Assistant governance with platform rule profiles, MCP allow-listing, restrictive approval defaults, and supported withdrawal. Completing SHA 83f81afee7526fd6e7c4ec0a47675774d00036b8; hosted Validate run 34233686654 succeeded.