Resource contribution architecture audit
Date: 2026-10-12. Reviewer: independent contribution architecture agent. Scope: the draft contribution specification and automation JSON artifact, existing Bindle preference/resource/grant contracts, current federation dispatch and stack ethos. This is agent review evidence, not human sign-off. Human reviewer: ___ / date: ___ / outcome: ___. Production remains disabled.
Outcome
The reviewed draft correctly separated state placement from compute, preserved owner/producer/consumer authority, and identified the missing MCP/Bindle authorization bridge. It did not create an implemented contribution capability. The user's subsequent three-option comparison changed the recommended default: use an app connection resource with ordinary individually granted methods, optionally implemented by an existing MCP endpoint. See the decision comparison. The specification now reflects that provisional choice, and the old automation artifact is explicitly deprecated, has no canonical $id, and remains a historical experimental fixture.
Findings and minimal changes
| ID | Severity and evidence | Minimal resolution |
|---|---|---|
| RC-01 | High architecture mismatch. resource-contributions.md mandates one resource per operation despite Bindle already supporting exact per-method grants. A generic invoke contract creates the need for those extra resource IDs. |
Prefer one app connection resource plus an immutable contract of separately granted methods. Retain independent resources for independently selected domain objects. An MCP adapter can compile exact tool bindings into those methods; a generic tools/call grant must not authorize arbitrary tool names. |
| RC-02 | High lifecycle gap. The optional callback section reserves slots and checks expiry, but does not explicitly close them at parent completion or prevent successful parent output while dependent writes remain in flight. An endpoint can return early and redeem a remaining write slot afterward. | Atomically close unused slots at completion/deadline; account for reserved operations before the parent outcome; journal unknown required effects as indeterminate. Release authority and reconcile costs separately. No automatic retry/refund on unknown outcomes. |
| RC-03 | High implementation boundary. Existing FederationService grants pin fragment/resource/contract/method, not an executable descriptor revision; current MCP grants are separate collection/function records. A manifest or generic adapter label cannot establish either missing link. |
Keep contribution discovery disabled until the gateway resolves a reviewed immutable contract/implementation binding and checks live Bindle plus MCP authority on every dispatch and cached-result delivery. Document exact generated preference metadata; preserve current exact-contract rules. |
| RC-04 | Medium external trust limit. A content-pinned descriptor cannot prove a remote endpoint continues executing the reviewed code or obeying declared effects. Staging catches announced changes only. | State this limit directly. Treat the connection as trust in an external service, conservatively disclose effects, suspend on detected drift, and never infer storage/calendar semantics from MCP protocol compatibility. |
| RC-05 | Medium wording conflict. The original automation scope paragraph excludes “callbacks” while the same document defines verified app callback execution. | Distinguish a bounded synchronous app compute request from deferred callback workflows, schedules and resumable jobs. Only the latter are excluded from the first execution profile. |
| RC-06 | Medium schema-policy gaps. The artifact structurally bounds values but the prose does not specify consistent minLength <= maxLength, minItems <= maxItems, or minimum <= maximum checks. processorOrigin accepts any HTTPS URI-shaped string, including paths/userinfo, rather than proving a canonical origin. |
Validate schema satisfiability bounds and canonical credential-free origins in the importer/runtime; document which checks exceed JSON Schema. The artifact alone is not executable policy. |
| RC-07 | Medium economics boundary. Per-resource invocation rate and finite slots do not themselves cap aggregate account/service cost, nested dependent work or upstream bills after timeout. | Reuse account/service work and spend reservation owners; charge/reserve aggregate dependent attempts, enforce a finite total slot bound, and retain uncertain obligations. Keep expensive unknown-cost adapters disabled until an enforceable policy exists. |
The findings above describe the originally reviewed draft. Specification reconciliation addressed RC-01, RC-02 and RC-04–RC-07 in prose: ordinary per-method app resources, explicit completion closure/uncertain outcomes, external-code trust limits, synchronous callback wording, schema cross-bound/origin checks and aggregate budgets. RC-03 remains an explicitly disabled implementation boundary. None is a claim that the proposed adapters already run or that a live vulnerability was demonstrated. The historical JSON fixture is not a validator for the selected importer design.
Reuse and constraints verified from source
FederationService already checks exact resource/contract/method grants against current assignments. Its method request grammar and 32-method-per-contract bound differ from MCP's upstream tool naming rules, so the importer needs stable internal method IDs and an explicit bounded catalog. The protocol requires immutable contract URLs; a newly discovered tool cannot be appended silently to an approved contract. Preferences expose only approved resource references and provide no wildcard contract selection.
The federation runtime provides transaction fingerprints, cached outcomes and an external-mutation capability gate, but its journal records expire after 24 hours. The baseline protocol already forbids relying on deduplication outside advertised retention. An invocation adapter needs its own durable ownership of any unresolved external operation; reusing a journal API cannot erase that obligation.
No runtime source code was changed in this audit. Review consisted of reading local implementation/specification and checking official MCP primary sources linked in the comparison. Reconciliation verification: git diff --check passed; the historical schema parses as JSON, is marked deprecated and has no canonical $id. This is not a runtime test report, independent provider conformance or deployment approval.