Contribution records credited to Wilkes & Liberty

MCP Sentinel

• Default settings fail strict schema validation because language code is missing
  Mon, 09/21/2026 - 13:09
• Pin Tool API and MCP Server tool-bridge floors
  Sat, 09/19/2026 - 21:15
• Read-only tools for governance status, effective limits, audit metrics, role audit and own approvals
  Sat, 09/19/2026 - 16:58
• Config save audit stores nested secrets such as a Key value in the audit chain
  Sat, 09/19/2026 - 16:28
• Config set tool saves without schema validation, so module validators never run
  Sat, 09/19/2026 - 09:27
• 2.22.1 removed checkResponseSizeCap(), which breaks every GraphQL Compose Codegen MCP tool
  Sat, 09/19/2026 - 08:57
• No test asserts that the Sentinel tools reach the MCP server catalog
  Fri, 09/18/2026 - 21:19
• Keep rate-limit flood event names within Drupal's 64-byte limit
  Thu, 09/17/2026 - 01:57
• Expose the existing governed SELECT service through Tool API
  Thu, 09/17/2026 - 01:56
• Governed draft translation for media entities (image alt, caption, name)
  Tue, 09/15/2026 - 00:02
• Content Lock 2.x fetchLock signature 500s every governed write
  Fri, 09/11/2026 - 00:11
• Governed writes ignore contrib Content Lock held by a human editor
  Thu, 09/10/2026 - 23:48
• Protect paragraph draft translations from stale writes and unsafe host repinning
  Thu, 09/10/2026 - 20:54
• Invalid bearer on /drupal-mcp/readiness returns the HTML 401 page instead of the JSON refusal shape
  Thu, 09/10/2026 - 19:30
• Access tokens carry no client identity or resource audience claims, so OAuth resource servers cannot entitle them
  Thu, 09/10/2026 - 19:30
• Support governed updates to existing draft revisions
  Tue, 09/08/2026 - 19:18
• Evaluate, sign, attest, revoke, and roll back portable policy bundles
  Tue, 09/08/2026 - 18:05
• DLP as a classification-aware, tighten-only detector, and its coverage gap
  Tue, 09/08/2026 - 18:05
• Emit typed decisions and bind approval to one immutable action manifest
  Tue, 09/08/2026 - 15:40
• Extend local anomaly detection for off-hours and complete bulk-read signals
  Tue, 09/08/2026 - 15:40
• Never report governance posture clear before its evidence is verified
  Tue, 09/01/2026 - 03:50
• Wire portable policy-bundle denials into live governance
  Tue, 09/01/2026 - 03:50
• Ship a secure-default neutral install and hostile-input release proof
  Sun, 08/30/2026 - 00:25
• Enforce finite source-side read and egress budgets
  Sat, 08/29/2026 - 20:45
• Require complete durable evidence and veto the governed action when evidence cannot commit
  Sat, 08/29/2026 - 05:15
• agent-provision creates consumers that cannot mint tokens (grant_types and user_id never set)
  Fri, 08/28/2026 - 21:55
• Enforce governed content locks across every write channel
  Fri, 08/28/2026 - 14:10
• Grant governed composite-child creation on the agent channel
  Fri, 08/28/2026 - 14:10
• Preserve human publication authority for already-published unmoderated content
  Fri, 08/28/2026 - 04:20
• Refuse service without active applicable policy and required scope wiring
  Fri, 08/28/2026 - 02:50
• Break-glass records custody but not conduct: config changes made while elevated are never audited
  Fri, 07/31/2026 - 18:07
• Document break-glass empty/narrow role edge (subset grants, WARNING only)
  Fri, 07/31/2026 - 18:07
• CI/contract: optional mcp_admin YAML must match ALLOWED_PERMISSIONS
  Fri, 07/31/2026 - 18:07
• Warn operators when editing mcp_admin permissions in the People UI
  Fri, 07/31/2026 - 18:07
• Re-validate active break-glass grants when mcp_admin posture becomes unsafe
  Fri, 07/31/2026 - 18:07
• Status report: ERROR/WARNING when mcp_admin permission set drifts from the shipped allowlist
  Fri, 07/31/2026 - 18:07
• Seal mcp_admin: refuse grants when role holds permissions outside the shipped allowlist
  Fri, 07/31/2026 - 18:07
• Make mcp_admin a real, enumerated role instead of is_admin
  Fri, 07/31/2026 - 18:06
• Publish gate silently disables agent-created redirects now that redirect entities are publishable
  Fri, 07/31/2026 - 02:30
• Publish-gate bypass: entity save without a moderation_state transition mutates published nodes in place under a deny-publish profile
  Fri, 07/31/2026 - 02:30
• Settings page has no link to the governance dashboard
  Fri, 07/31/2026 - 02:30
• Direct paragraph edits bypass the publish gate under a deny-publish policy
  Fri, 07/31/2026 - 02:30
• The Drupal 10.6 test lane cannot build: a require-dev dependency needs PHP 8.3
  Fri, 07/31/2026 - 02:30
• Policy profiles should assert that governed roles hold no escape-hatch permissions
  Fri, 07/31/2026 - 02:30
• Raw SQL over the Drush bridge bypasses policy profiles entirely
  Fri, 07/31/2026 - 02:30
• Webhook worker silently sends unsigned when the configured signing key resolves to an empty value — should fail closed
  Fri, 07/31/2026 - 02:30
• Webhook worker follows redirects: a 301 turns the signed POST into a GET and deliveries fail permanently with no hint
  Fri, 07/31/2026 - 02:30
• Extract the tamper-evident audit chain into its own project
  Fri, 07/31/2026 - 02:30
• Update 10016 copies the moved audit settings but leaves the originals behind as silent no-ops
  Fri, 07/31/2026 - 02:30
• 2.0.0 upgrade path takes the site down unless audit_chain is enabled first
  Fri, 07/31/2026 - 02:30