[shipmill-romamo]

Summary

On a project, cloudfall mcp serve served operator approve as the operator_approve tool, so an agent could run and verify its own proposal with no person in the loop.

• operator approve gets mcp=False with the same comment as decisions approve ("A person approves; no agent tool stands in for it"); the CLI command itself is unchanged
• "operator.approve" is removed from PROJECT_COMMANDS; operator_list and operator_show stay tools
• The --gateway-url, --gateway-ca, --gateway-cert and --gateway-key flags of cloudfall mcp serve are removed. Only operator_approve took them, and treaty refuses to start a server that binds a field no served tool has (MCP_BIND_UNKNOWN)
• The project server's MCP instructions, docs/operator-guide.md ("The record", "Through an agent") and sdk/README.md now say a person approves from a shell with cloudfall operator approve
• CHANGELOG: a ### Security entry under Unreleased

Tests

• New test_a_project_call_cannot_approve_its_own_proposal: calling operator_approve on a project server returns UNKNOWN_TOOL
• --list-tools test: operator_list and operator_show are listed, operator_approve is not
• The project tool-list test moves operator_approve from the expected tools to the never-tools set
• The gateway_url binding assertion is gone from the secrets/URL test, since the tool no longer exists
• uv sync, uv run ruff check ., uv run mypy, uv run pytest (396 passed), uv run cloudfall config validate --project config/examples and uv lock --check all pass

Part of #35

🤖 Generated with Claude Code

[shipmill-romamo]

@romamo Decision needed: with operator_approve off the MCP surface, what happens to the --gateway-url, --gateway-ca, --gateway-cert and --gateway-key flags of cloudfall mcp serve?

They existed only to be passed to operator_approve so its verify step could reach the alerts gateway. With the tool gone, treaty refuses to start the server while they are bound to nothing (MCP_BIND_UNKNOWN), so they can't stay as they are.

1. Remove them (recommended; this is what the PR does): anyone who starts mcp serve with them, as the old operator guide showed, gets an argument error until they drop them. 0.6.0 is still a release candidate, and the CHANGELOG entry names the removal
2. Keep them accepted but unused for one release, with a deprecation note in their help text and the CHANGELOG, then remove them: nothing breaks now, but they are flags that do nothing

operator approve and operator run keep their own gateway flags either way. The person-only confirmation for operator approve comes after #37, as planned on #35.

Checks pass locally (396 tests); CI was still running when this was posted. Reply here with a number or your own answer; shipmill takes this up on the tick after your reply.

[romamo]

Decision by @romamo, given in chat; posted by Claude on his behalf.

1. Remove the --gateway-url, --gateway-ca, --gateway-cert and --gateway-key flags of cloudfall mcp serve, as this PR does, with the removal named in the CHANGELOG. 0.6.0 is still a release candidate, so no stable release has promised them.