trunk-merge/pr-87346/2c072ef9-b7fa-4ff7-877e-f48418c7cc6b-bisection - #90042

Closed

trunk-io[bot] wants to merge 51 commits into

trunk-merge/pr-87346/2c072ef9-b7fa-4ff7-877e-f48418c7cc6b-bisection

Commits on Aug 20, 2026

feat(access-control): let orgs restrict MCP access to read-only

a-lider
and
claude
committed
bdb8973
feat(access-control): keep the whole ceiling decision in the facade

a-lider
and
claude
committed
d2acaa5
feat(access-control): enforce channel ceilings as their own permission class

a-lider
and
claude
committed
7fabd47

Commits on Aug 21, 2026

feat(access-control): rename the model family to surface access limits

a-lider
and
claude
committed
0e7177d
chore(access-control): rewrite docstrings in simplified technical english

a-lider
and
claude
committed
8559e39
chore(access-control): say why SurfaceAccessLimit skips CreatedMetaFields

a-lider
and
claude
committed
72f1f05
feat(access-control): make the all-resources wildcard explicit

a-lider
and
claude
committed
24129cb
chore(access-control): finish the simplified-english pass on the facade modules

a-lider
and
claude
committed
321e7c4
chore(access-control): rename the permission class to SurfaceAccessLimitPermission

a-lider
and
claude
committed
0d14d46
chore(access-control): register SurfaceAccessLimit in the org-scoped IDOR rules

a-lider
and
claude
committed
bbbb6a8
fix(access-control): drop a stale resource=None from the wildcard test

a-lider
and
claude
committed
1f3922b
fix(access-control): a none limit denies reads too, and drop Any from signatures

a-lider
and
claude
committed
59a7de1

Commits on Aug 25, 2026

refactor(access-control): store the MCP read-only flag as an organization column

a-lider
and
claude
committed
fc2d5ab
fix(access-control): evaluate the MCP cap after membership permissions

a-lider
and
claude
committed
d9a83b9
Merge remote-tracking branch 'origin/master' into alex/feat/access-ceilings
a-lider
committed
3c3a2a0
chore(access-control): track the renumbered hot-table migration acknowledgment

a-lider
and
claude
committed
a525196
fix(access-control): satisfy the facade import contract and the test annotation

a-lider
and
claude
committed
f5e4460
fix(access-control): apply the target org MCP policy to connection forwards

a-lider
and
claude
committed
dd14a1d
test(backend): update query snapshots
tests-posthog[bot]
authored
d003640
chore(access-control): simplified-english pass on the refactored comments

a-lider
and
claude
committed
3d2c581
fix(access-control): cap unclassified actions by method and restore the ack header

a-lider
and
claude
committed
6a95042
fix(access-control): declare the protocol headers member as a read-only property

a-lider
and
claude
committed
99ff58e
refactor(access-control): split the MCP cap into classifier, policy and enforcement

a-lider
and
claude
committed
a6e0dc0
chore(access-control): simplified-english pass on the moved comments and docstrings

a-lider
and
claude
committed
dd42bef
fix(access-control): cap MCP writes against the URL org, not the current org

a-lider
and
claude
committed
d9b4020
Merge remote-tracking branch 'origin/master' into alex/feat/access-ceilings
a-lider
committed
48de8c6
refactor(access-control): always mark connection forwards as MCP

a-lider
and
claude
committed
6d8f3ef
fix(access-control): stop over-denying connection forwards and cap root creates

a-lider
and
claude
committed
b499f9f
test(access-control): make the enforcement tests prove the cap, not membership gates

a-lider
and
claude
committed
bd2dd0d
fix(access-control): classify ID-JAG tokens as MCP so the cap applies

a-lider
and
claude
committed
931dc92
feat(access-control): add the MCP read-only toggle to org security settings

a-lider
and
claude
committed
5b5278c

Commits on Aug 26, 2026

refactor(access-control): rename the flag to read_only_mcp_access

a-lider
and
claude
committed
da6285a
Merge remote-tracking branch 'origin/master' into alex/feat/access-ceilings
a-lider
committed
7a18fa2
Merge branch 'alex/feat/access-ceilings' into alex/feat/mcp-access-settings-ui
a-lider
committed
aa42fc3
refactor(access-control): rename the flag to read_only_mcp_access in the API and UI

a-lider
and
claude
committed
5accd51
fix(access-control): allow read_only_mcp_access in the organization update payload

a-lider
and
claude
committed
532819e
test(backend): update query snapshots
tests-posthog[bot]
authored
91ab38a
fix(access-control): clarify the MCP read-only setting copy

a-lider
and
claude
committed
a16ab0d
fix(access-control): say PostHog MCP without server in the setting copy

a-lider
and
claude
committed
17b1edd
chore(access-control): delete a leftover half-line comment

a-lider
and
claude
committed
688c2ed
chore(access-control): delete a leftover half-line comment

a-lider
and
claude
committed
15fd27f
fix(access-control): rename the settings section to MCP access

a-lider
and
claude
committed
a60c2ab
test(backend): update query snapshots
tests-posthog[bot]
authored
f705005

Commits on Aug 27, 2026