Provide authenticated MCP skill execution for the website catalogue #113

Purpose

Close the remaining execution boundary of website PR #87. The website can now browse every registered skill and invoke actual advertised MCP tools. The public registry service intentionally stays read-only; a0 is the appropriate potential execution owner because it already implements python/services/spawn_executor.py for agent runs and python/services/tool_executor.py for per-tool approval scope. Do not duplicate those mechanisms.

FROM → TO

From skill selection and an MCP envelope with no trusted tiw_execute_skill tool → to an authenticated a0 executor with an evidence-bearing run receipt, backed by its existing agent, tool approval and run-lifecycle machinery.

Exact input from website

tiw_execute_skill({
  target_repository: {name, canonical_url, observed_head_sha, default_branch, status, category, identity_source},
  skill: {name, kind, description, depends_on, human_title, canonical_path, canonical_url},
  required_skills: [dependency_first_skill_records],
  skill_registry: {registry_version, skill_count, source_skill_count, public_scope, source: {repository, commit, path, sha256}, fallback, hmmm},
  human_request: string
})

Implementation boundaries

• MCP Streamable HTTP tools/list and tools/call, with explicit tiw_execute_skill declared only when the executor is actually operational. Don't place execution in the public Render registry service.
• Validate authenticated user and per-repository scope; authorize tools via existing tool_executor approval scopes. All writes require explicit authority beyond skill selection or an observed repository head. A public anonymous call must be denied.
• Fetch each canonical SKILL.md and dependency closure at the pinned skill-lib commit; verify registry digest, skill identity, closure integrity, and repo HEAD freshness before spawning. The website's summary is not the full skill.
• Reuse existing spawn_executor/agent run queue and log/receipt lifecycle; no parallel fake runner. Bind provider/model and budget/caps deterministically from the user authorization, with explicit errors for unavailable providers, missing skills, stale repo head, or tool refusal.
• If execution is asynchronous, return accepted with authenticated run_id and status readback. accepted and running must never be displayed or emitted as completed.
• Include final receipts: resulting repo commit/ref or named artifact, actor/permission evidence, tools attempted, gates and independent verification, unresolved hmmm. Protect credentials, audit access, and enforce request/rate limits.
• Browser must connect through trusted HTTPS and approved CORS; no bearer token placed into URLs, logs or source. Integrate under existing a0 auth, not an unauthenticated WebMCP proxy.

DONE WHEN

From the live /webmcp/ page, select a real repository and skill, authorize a test-safe a0 invocation, obtain a live run_id, and verify the resulting change/evidence through a second observation. The public registry endpoint remains unchanged/read-only.

PROVEN BY

Success case with an intentionally failing canary skill and a successful bounded skill; denied unauthenticated, wrong-scope, stale-head, altered-closure, absent-provider, duplicate, canceled and exceeded-budget cases. Check that job accepted does not masquerade as completed.

FAILS IF

Returning a prepared prompt, invoking a model without tool authority, or emitting a fabricated receipt is classified as execution.

hmmm

No current a0-hosted Streamable HTTP executor or publicly reachable authenticated endpoint for this exact contract was established in the repository audit; deployment identity, network exposure, allowed origins and authorization policy must be verified before a real invocation can be claimed.