Add explicit MCP setup grants, typed calls and confirmed restart

[frahlg]

Owners can grant an assistant setup access as a separate choice. Typed MCP calls read the complete setup schema, resume a draft, edit a field or list entry, validate, save the exact confirmed revision and request a separately confirmed restart. Everyday status, history and control keep their direct tools.

Keep the caller an agent. Recheck its live grant and request deadline after preparation, before every durable draft write and immediately before the Settings/receipt transaction. Revocation returns403; an ended request returns408. Both leave settings and receipts unchanged. A pending restart stays bound to the saved receipt, current configuration and live grant; an interrupted request cannot schedule it twice.

Use the running API through its late binding, including startup-unavailable behavior. Return the build's driver catalogue, price areas and runtime time zone. Maintain the product vision, roadmap and ADR 0011. Passive fresh-box claiming, vendor sign-in, guided interview metadata and forecast priors remain later increments; this PR does not claim them.

Pairs: srcfl/ftw-cloud#37, srcfl/ftw-webapp#99 and srcfl/ftw-app#92. Merge the canonical registry copy immediately after Core. Sharing follows in #1735. The base includes the merged sessions fix and 0.152.1 release source.

Validation: full make verify passes on combined head499d5de6, including this exact setup commit. Complete config/onboarding/API race suites and final gateway race regressions pass, covering late revocation, timeout during authority lookup, normalization, lost replies, credential identities and exact numbers. Production API-wrapper tests pass. The rendered Core consent view received the owner's approval; native tests/build and simulator review pass. No physical commissioning or actual client grant was tested.

[chatgpt-codex-connector]

Summary

• Extracted the setup-access warning into a single reusable, testable value while preserving the rendered Access dialog’s wording about equipment settings, exact-draft confirmation, separate restart confirmation, and Core safety checks. web/settings/tabs/access.jsL41-L43 web/settings/tabs/access.jsL607-L610
• Exposed the warning through the tab’s existing pure-test interface and added regression coverage preventing setup consent from being conflated with restart confirmation. web/settings/tabs/access.jsL1013-L1016 web/settings/tabs/access.test.mjsL72-L77
• Committed the changes as e3af2fb (Test setup consent restart distinction) and created the follow-up PR metadata titled “Test the separate setup and restart consent copy.”

Testing

• ✅ node --test web/settings/tabs/access.test.mjs
• ✅ git diff --check
• ✅ make verify — all tests, vet, and builds passed; the suite reported its expected Docker release-context skip because no Docker daemon was available.

View task →

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T18:07:50.863424Z	1ec36be	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1ec36be479

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".