Support public environment-origin MCP through shared Harness bindings

[SaladDay]

Change

Public HTTP MCP with explicit connection_origin=environment now reaches the existing Runtime bindings and native Harness adapters in managed and self-hosted workspaces. Previously the public entrypoint rejected this origin even though installed Plugin MCP already used that execution path.

Core validates each Harness's declared MCP origins and keeps frozen Project/Vault credential selection. Codex and Claude preserve null/empty/named allowlists and required initialization. MiniMax accepts null/omitted allowlists and required=false, rejecting unsupported policies. Native observations include public MiniMax calls, tool errors and cancellation. Credentials remain transient.

Service-origin stays on service execution hosts with environment:none. There is no network proxy, model-loop fallback, new framework or compatibility layer. The private Runtime wire is 0.10.0 and requires an exact match.

Validation

• Real Linux self-hosted and Docker-managed calls through the official SDK for Codex/Kimi K3, Claude/Kimi K3 and MiniMax Code/MiniMax-M2.7: anonymous and selected bearer, cold continuation, cancellation and failed MCP Items.
• Raw HTTP and official SDK configuration, saved/retrieved origins, frozen snapshots, unauthorized Vault selection, service relocation and unsupported MiniMax policy rejection.
• Native-state credential scans; adapter tests cover exact tool identity, allowlists, required initialization, tool/transport errors and cancellation.
• Focused Go tests, 170 Claude adapter tests and the complete pinned official-client workflow pass. Two fresh independent full-diff reviews are complete; the final review found no substantiated in-scope issues. All final-head CI checks pass for 0e51958: complete make check, official-client, and Linux/macOS/Windows native checks.

Qualification evidence records revisions, Sessions, test conditions and limits. One blind-review documentation finding was corrected in the authored guides and regenerated; the second review covers the complete 70-file diff.

Local make check was run: an initial database naming error was corrected; the later run passed Go/database/adapter checks but encountered an occupied browser fixture port. A separate browser run passed 83/86 with three UI timeouts/assertion failures on the shared host. These runs are not reported as full passes; the subsequent clean final-head CI full gate passed. No tests were removed or weakened.

Limits

Real macOS/Windows model runs and E2B/microsandbox are not qualified here; native CI is separate from live model evidence. Public stdio, literal headers/metadata, service-origin workspace forwarding, public functions and Subagent/MCP combinations remain outside scope. MiniMax allowlists and required initialization remain explicitly unsupported.

Only isolated acceptance infrastructure was changed; histories and data are retained. No production deployment, tag or Release.

Final-head CI: make check, official client, native platforms.