rreichel3-oai c7e80f873f Preserve executor MCP credential boundaries across reconnects (#48143) ...

## Why

Cached executor MCP declarations must not gain access to host environment credentials when reconnecting to an executor that lacks environment credential resolution.

## What changed

- Retain credential policy through MCP registration, catalog materialization, and runtime setup. Derive selected HTTP plugin policy from the plugin's source environment.
- Reject host bearer-token fallback and transports requiring host environment headers or helpers for executor-owned declarations. Preserve host-configured credential resolution.
- Include credential policy in connection and tool catalog cache identities, and avoid reading host environment values for executor-only identities.

## Testing

Add regression coverage for legacy executors, cached declarations after a capability downgrade, policy preservation through catalog rebuilds, and connection and tool cache isolation.

GitOrigin-RevId: 2d5b85e4e98668c637c538cbe528914c936bd831

2026-09-25 17:15:29 +00:00

..

src

Preserve executor MCP credential boundaries across reconnects (#48143)

2026-09-25 17:15:29 +00:00

tests

Preserve executor MCP credential boundaries across reconnects (#48143)

2026-09-25 17:15:29 +00:00

BUILD.bazel

Route hosted Apps MCP through extensions (#27191)

2026-06-09 22:44:16 +02:00

Cargo.toml

Add turn-start cloud plugin discovery to the MCP extension (#46572)

2026-09-19 02:07:58 +00:00