The evaluation pack

A governed access layer for MCP: one endpoint, one identity, every tool call authenticated, authorized, metered, audited, and schema-verified before it reaches a backend. The pipeline runs the same order for every call, on every client: auth → view → schema-pin → policy → rate-limit → breaker → credentials → trace → backend → redact → audit.

No token passthrough, structurally: the downstream credential cannot reach an upstream request because no API exists through which it could.

Kill switch: disable a tool or backend and it is dead on the issuing replica immediately, cluster-wide ≤2s via NOTIFY in the healthy case, ≤30s guaranteed via the poll backstop; per-replica epoch lag is visible in ready-detail — a lagging replica can never be silent.

Rate/quota honesty: hard caps enforced within a +5%-per-replica local-allowance tolerance (worst case N×5% overshoot); allowance: 0 buys exact per-call accounting at a latency cost; strict limits fail closed on store outage, non-strict fail open with alarm — a documented choice, not an accident.

The ID-JAG federation seam is locked in the design corpus, not yet verified against a real customer identity provider: the jwt-bearer grant on /token honestly returns unsupported_grant_type until a customer's IdP tenant exercises it.

The property this seam guarantees: humans authenticate at your IdP; ToolHost's authorization-server facade remains the sole mint for agent tokens; the IdP never mints gateway tokens. The resource server is unchanged by federation.

Visibility (private/team/org) and role (view/execute/approve/manage) are independent axes — a visibility check passing contributes nothing to an action check.

Every governed row is org-keyed through a store layer that composes the filter itself; cross-tenant reads 404 indistinguishably from nonexistence; forged team claims are rejected; audiences never cross.

Revocation and staleness, exactly: key revocation and principal status-flip bind ≤30s (hot-path liveness). Team membership is a mint-time snapshot bounded by token TTL — 1h default, 15m compliance profile; removal keeps allows up to one TTL, leaving sheds team denies at re-mint; durable prohibitions belong at org level; the hard cut is key revocation or status flip.

The 85-minute rotation mechanics and failure-mode tests exist for the local signing provider. KMS/HSM signing, persisted rotation state, and a production custody boot gate are not yet wired; ToolHost therefore makes no production KMS/HSM, crypto-custody, or HA signing claim today.

No call without evidence: no code path reaches a backend without a sealed envelope; an ok call carries all stages, a denial carries executed stages with the denying record last; a ring overflow is itself an evidenced gap record in the export.

Rate/quota honesty: hard caps enforced within a +5%-per-replica local-allowance tolerance (worst case N×5% overshoot); allowance: 0 buys exact per-call accounting at a latency cost; strict limits fail closed on store outage, non-strict fail open with alarm — a documented choice.

Decision metadata (stage outcomes, taxonomy, timings) is stored plaintext for mandatory-retention obligations; tenant-identifying payload is encrypted per-org. Deleting an org's key is designed to render its encrypted rows permanently unrecoverable.

Legal sign-off on this posture is deferred to pre-launch (DN-ARCH-1). Until it clears, the default operating posture is retain-everything within your org's retention window — the crypto-shred mechanism is built and tested, but the deletion step of the offboarding runbook is marked legal-gated, not executed by default.

Three first-class supported shapes on one config schema: single binary + local dev, Docker Compose + Postgres (reference production), and Kubernetes manifests (enterprise).

Until the shared-store cutover passes its conformance tests, the product claims single-replica + fast restart — never high availability. Listing a Kubernetes manifest is not the same claim as multi-replica HA; the two are decoupled on purpose, and this page will say so plainly the day they converge.