feat(mcp): add OpenShell-managed MCP servers

.github/actions/resolve-hermes-base-image/action.yaml

@@ -26,6 +26,16 @@ runs:
           [[ -n "$have" ]] && [[ "$(printf '%s\n%s\n' "$min_glibc" "$have" | sort -V | head -n 1)" == "$min_glibc" ]]
         }
 
+        # Build-time package/import guard only. Authenticated HTTPS execution is
+        # validated by test/e2e/live/mcp-bridge.test.ts against a
+        # final Hermes sandbox image and OpenShell policy.
+        mcp_client_imports_ok() {
+          local ref="$1"
+          docker run --rm --entrypoint /opt/hermes/.venv/bin/python "$ref" -c \
+            'import mcp; from tools import mcp_tool; assert getattr(mcp_tool, "_MCP_AVAILABLE", False); assert getattr(mcp_tool, "_MCP_HTTP_AVAILABLE", False)' \
+            >/dev/null 2>&1
+        }
+
         layout_ok() {
           local ref="$1"
           docker run --rm --entrypoint sh "$ref" -lc '
@@ -44,18 +54,22 @@ runs:
           if ! docker pull "$ref" >/dev/null 2>&1; then
             return 1
           fi
-          version="$(glibc_version "$ref" || true)"
+          digest_ref="$(docker image inspect "$ref" --format '{{range .RepoDigests}}{{println .}}{{end}}' | grep -F -m 1 "${image}@sha256:" || true)"
+          if [[ -z "$digest_ref" ]]; then
+            echo "::warning::Hermes sandbox base image ${ref} did not expose an immutable GHCR repo digest (may be a fresh tag); building locally"
+            return 1
+          fi
+          version="$(glibc_version "$digest_ref" || true)"
           if ! glibc_ok "$version"; then
             echo "::warning::Hermes sandbox base image ${ref} has glibc ${version:-unknown}; need >= ${min_glibc}"
             return 1
           fi
-          if ! layout_ok "$ref"; then
+          if ! layout_ok "$digest_ref"; then
             echo "::warning::Hermes sandbox base image ${ref} contains retired sandbox state; trying another candidate"
             return 1
           fi
-          digest_ref="$(docker image inspect "$ref" --format '{{range .RepoDigests}}{{println .}}{{end}}' | grep -F -m 1 "${image}@sha256:" || true)"
-          if [[ -z "$digest_ref" ]]; then
-            echo "::warning::Hermes sandbox base image ${ref} did not expose an immutable GHCR repo digest (may be a fresh tag); building locally"
+          if ! mcp_client_imports_ok "$digest_ref"; then
+            echo "::warning::Hermes sandbox base image ${ref} lacks the packaged MCP Streamable HTTP client imports"
             return 1
           fi
           echo "HERMES_BASE_IMAGE=${digest_ref}" >> "$GITHUB_ENV"
@@ -85,4 +99,8 @@ runs:
           echo "::error::Local Hermes sandbox base image contains retired sandbox state"
           exit 1
         fi
+        if ! mcp_client_imports_ok nemoclaw-hermes-base-local; then
+          echo "::error::Local Hermes sandbox base image lacks the packaged MCP Streamable HTTP client imports"
+          exit 1
+        fi
         echo "HERMES_BASE_IMAGE=nemoclaw-hermes-base-local" >> "$GITHUB_ENV"

.github/workflows/brev-nightly-e2e.yaml

@@ -9,17 +9,14 @@ name: E2E / Brev Nightly
 # Suites:
 #   all                 credential-sanitization + telegram-injection
 #   messaging-providers Telegram + Discord provider/L7 proxy validation
+#   messaging-compatible-endpoint local compatible-endpoint Telegram validation
 #   full                install/onboard/inference/CLI path
 
 on:
   schedule:
     - cron: "0 6 * * *"
   workflow_dispatch:
     inputs:
-      branch:
-        description: "Branch to test (default: ref used for this dispatch; schedule always tests main)"
-        required: false
-        default: ""
       keep_alive:
         description: "Keep Brev instances alive after tests (for SSH debugging)"
         required: false
@@ -28,6 +25,12 @@ on:
 
 permissions:
   contents: read
+  # GitHub validates a reusable workflow's complete permission ceiling before
+  # evaluating skipped jobs. The called workflow explicitly downgrades its
+  # secret-bearing validation job to read-only; only its no-checkout reporter
+  # may use these write grants when a different caller supplies pr_number.
+  checks: write
+  pull-requests: write
 
 concurrency:
   group: brev-nightly-e2e-${{ github.event_name }}-${{ github.event_name == 'workflow_dispatch' && github.ref || 'schedule' }}
@@ -39,10 +42,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        test_suite: [all, messaging-providers, full]
+        test_suite: [all, messaging-providers, messaging-compatible-endpoint, full]
     uses: ./.github/workflows/e2e-branch-validation.yaml
     with:
-      branch: ${{ github.event_name == 'schedule' && 'main' || inputs.branch || github.ref_name }}
+      # Bind tested code to the ref that supplied this reviewed workflow. Do
+      # not let a write-scoped trusted caller select a second arbitrary branch.
+      branch: ${{ github.ref_name }}
       test_suite: ${{ matrix.test_suite }}
       use_launchable: true
       keep_alive: ${{ github.event_name == 'workflow_dispatch' && inputs.keep_alive || false }}

.github/workflows/cloudflared-update-check.yaml

@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Dependencies / cloudflared Update Check
+
+on:
+  schedule:
+    - cron: "23 13 * * 1"
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cloudflared-update-check
+  cancel-in-progress: false
+
+jobs:
+  check-cloudflared:
+    name: Check cloudflared release pin
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Compare reviewed pin with the latest upstream release
+        run: bash scripts/checks/check-cloudflared-update.sh