[leseb]

Summary

End-to-end acceptance for issue #1673: stand up a real Kuadrant MCP Gateway and
prove per-user MCP tool authorization (discovery filtering + per-call authorization)
through Praxis's OpenAI Responses agentic loop.

This is acceptance of already-delivered courier behavior — there are no Praxis
product-code changes (git diff --stat touches only tests/, examples/, a
Makefile target, examples/README.md, and a new CI workflow).

The gateway runs as a minimal, no-full-Kubernetes container stack (proven feasible
by spike): static Envoy → ext_proc(MCP router) → ext_authz(Authorino, backed by a
bare etcd+kube-apiserver, no operator) → broker → fake MCP backend, plus a
static-JWKS IdP. Praxis's own rmcp client drives it unchanged.

What's proven (18 cases, buffered + streaming, all green locally)

Matrix item	Result
1 authorized user discovers + invokes	tool discovered, agentic loop dispatches, backend exec==1
2 unauthorized user	tool filtered from discovery, exec==0
3a Praxis won't dispatch an undiscovered tool	no mcp_call, exec==0
3b gateway denies a discovered-but-forbidden call	403 → mcp_call.error, exec==0 (open-discovery variant forces the call to the gateway)
4a invalid Bearer	forwarded opaquely, rejected at gateway (502), exec==0
4 missing credential slot	fails closed at Praxis before any dial
4b invalid forwarded x-mcp-authorized	explicitly uncovered in Topology A (Authorino mints its own) — documented, not falsely "rejected"
5 approval does not bypass authz	require_approval:never still denied; an approved resume re-dials the gateway and is still denied
6a/6b live-policy revocation	revoke between discovery/dispatch and between approval-create/resume; denial confirmed (polls the decision, never races a sleep)
7 same forwarded identity reaches discovery + dispatch	one-way digest parity observed at gateway ingress; raw credentials never logged

Topology A: the per-user OAuth Bearer is the enforcement carrier (gateway Authorino
validates it, mints the discovery wristband, authorizes each call); the
x-mcp-authorized courier is asserted separately for correctness.

How to run

make test-kuadrant-acceptance   # builds praxis-ai (full,store-sqlite), stacks up, runs the matrix, tears down

Needs a container engine (CONTAINER_ENGINE, podman/docker), kubectl, uv, openssl.
See tests/integration/kuadrant/README.md.

CI

New gated lane .github/workflows/kuadrant.yaml, modeled on postgres.yaml: path-filtered
(only MCP-courier / harness / example-config changes trigger it), merge_group changes
gate, pinned image tags, auto-registered as a required check by ci-status.yaml.

Follow-ups (deferred, non-blocking)

• Add an explicit kubectl setup step to the lane (ubuntu-24.04 ships it today).
• trap-based teardown around the whole make target for local robustness.
• Confirm the setup-rust composite caches cargo (30-min timeout has headroom).

Draft: opening for CI signal on the new lane.

Closes #1673

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}