Make fresh ERC-8004 policy executable from MCP alone

infra/clockchain-mcp/RUNBOOK.md

@@ -44,9 +44,14 @@ stakeholder capabilities are never stored in SSM.
 2. Install the matching Handshake commit in the host checkout, keep the checkout
    clean, load the active host-root private key from SSM, and record its public
    fingerprint in the release pin.
-3. Install the matching MCP commit, rotate the active/previous role-access key
-   pair if required, then run `compose-up.sh`. It verifies the exact Handshake
-   SHA before Docker starts and atomically replaces the private host files.
+3. Install the matching MCP commit and rotate the active/previous role-access
+   key pair if required. From that exact checkout, run
+   `sudo infra/scripts/install-clockchain-mcp-deploy-assets.sh`. The installer
+   first refreshes the out-of-checkout `compose-up.sh` and systemd unit, then
+   restarts the service. The refreshed wrapper verifies the exact Handshake SHA
+   before Docker starts and atomically replaces the private host files. Never
+   restart the service directly after changing the checkout: systemd deliberately
+   executes `/opt/clockchain-mcp/compose-up.sh`, not the copy inside the repo.
 4. Deploy Research only after the production MCP manifest reports the same
    helper digest and host-root ring that Research pins.
 

infra/clockchain-mcp/compose-up.sh

@@ -148,7 +148,7 @@ validate_mcp_runtime_config() {
 
 validate_v2_server_config() {
   local release_filter access_filter active_kid previous_kid
-  release_filter='type == "object" and (keys | sort) == ["allowedAssetPrefix","hostRoots","manifestDigest","sourceCommit","version"] and .version == "2.1.0" and (.sourceCommit | test("^[0-9a-f]{40}$")) and (.manifestDigest | test("^[0-9a-f]{64}$")) and .allowedAssetPrefix == "https://github.com/thetangstr/clockchain-handshake-v2/releases/download/v2.1.0/" and (.hostRoots | type == "array" and length >= 1 and length <= 2 and all(.[]; type == "object" and (keys | sort) == ["fingerprint","kid"] and (.kid | test("^[a-z0-9][a-z0-9-]{0,63}$")) and (.fingerprint | test("^[0-9a-f]{64}$"))))'
+  release_filter='type == "object" and (keys | sort) == ["allowedAssetPrefix","hostRoots","manifestDigest","sourceCommit","version"] and .version == "2.1.2" and (.sourceCommit | test("^[0-9a-f]{40}$")) and (.manifestDigest | test("^[0-9a-f]{64}$")) and .allowedAssetPrefix == "https://github.com/thetangstr/clockchain-handshake-v2/releases/download/v2.1.2/" and (.hostRoots | type == "array" and length >= 1 and length <= 2 and all(.[]; type == "object" and (keys | sort) == ["fingerprint","kid"] and (.kid | test("^[a-z0-9][a-z0-9-]{0,63}$")) and (.fingerprint | test("^[0-9a-f]{64}$"))))'
   access_filter='type == "object" and (keys | sort) == ["kid","secretBase64"] and (.kid | test("^[a-z0-9][a-z0-9-]{0,63}$")) and (.secretBase64 | @base64d | length >= 32)'
 
   if ! jq -e "$release_filter" >/dev/null 2>&1 <<<"$AGENT_HANDSHAKE_RELEASE_PIN"; then

infra/test/deploy-assets.test.mjs

@@ -39,7 +39,7 @@ const expectedEnv = {
   CLOCKCHAIN_API_KEY: "api-key-line-1\napi-key-line-2\n",
   MCP_AUTH_TOKENS: "token-a,token-b\n",
   MCP_TOKEN_SIGNING_SECRET: "signing-secret\nwith-newline\n",
-  AGENT_HANDSHAKE_RELEASE_PIN: '{"version":"2.1.0","sourceCommit":"0123456789abcdef0123456789abcdef01234567","manifestDigest":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","allowedAssetPrefix":"https://github.com/thetangstr/clockchain-handshake-v2/releases/download/v2.1.0/","hostRoots":[{"kid":"root-2026-08","fingerprint":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}]}\n',
+  AGENT_HANDSHAKE_RELEASE_PIN: '{"version":"2.1.2","sourceCommit":"0123456789abcdef0123456789abcdef01234567","manifestDigest":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","allowedAssetPrefix":"https://github.com/thetangstr/clockchain-handshake-v2/releases/download/v2.1.2/","hostRoots":[{"kid":"root-2026-08","fingerprint":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}]}\n',
   AGENT_HANDSHAKE_ROLE_ACCESS_ACTIVE: '{"kid":"role-active","secretBase64":"YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE="}\n',
   AGENT_HANDSHAKE_ROLE_ACCESS_PREVIOUS: '{"kid":"role-previous","secretBase64":"YmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmI="}\n',
 };
@@ -187,7 +187,7 @@ case "$name" in
   /clockchain/mcp/CLOCKCHAIN_API_KEY) value=$'api-key-line-1\\napi-key-line-2\\n' ;;
   /clockchain/mcp/MCP_AUTH_TOKENS) value=$'token-a,token-b\\n' ;;
   /clockchain/mcp/MCP_TOKEN_SIGNING_SECRET) value=$'signing-secret\\nwith-newline\\n' ;;
-  /clockchain/mcp/AGENT_HANDSHAKE_RELEASE_PIN) value=$'{"version":"2.1.0","sourceCommit":"0123456789abcdef0123456789abcdef01234567","manifestDigest":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","allowedAssetPrefix":"https://github.com/thetangstr/clockchain-handshake-v2/releases/download/v2.1.0/","hostRoots":[{"kid":"root-2026-08","fingerprint":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}]}\\n' ;;
+  /clockchain/mcp/AGENT_HANDSHAKE_RELEASE_PIN) value=$'{"version":"2.1.2","sourceCommit":"0123456789abcdef0123456789abcdef01234567","manifestDigest":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","allowedAssetPrefix":"https://github.com/thetangstr/clockchain-handshake-v2/releases/download/v2.1.2/","hostRoots":[{"kid":"root-2026-08","fingerprint":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}]}\\n' ;;
   /clockchain/mcp/AGENT_HANDSHAKE_ROLE_ACCESS_ACTIVE) value=$'{"kid":"role-active","secretBase64":"YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE="}\\n' ;;
   /clockchain/mcp/AGENT_HANDSHAKE_ROLE_ACCESS_PREVIOUS) value=$'{"kid":"role-previous","secretBase64":"YmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmI="}\\n' ;;
   /clockchain/host/FUNDING_WALLET_JSON) value=$'{"wallet":"line-1\\\\nline-2"}\\n' ;;
@@ -297,10 +297,10 @@ async function resolvedComposeConfig() {
       MCP_AUTH_TOKENS: "dummy-token",
       MCP_TOKEN_SIGNING_SECRET: "dummy-signing",
       AGENT_HANDSHAKE_RELEASE_PIN: JSON.stringify({
-        version: "2.1.0",
+        version: "2.1.2",
         sourceCommit: expectedHandshakeSha,
         manifestDigest: "a".repeat(64),
-        allowedAssetPrefix: "https://github.com/thetangstr/clockchain-handshake-v2/releases/download/v2.1.0/",
+        allowedAssetPrefix: "https://github.com/thetangstr/clockchain-handshake-v2/releases/download/v2.1.2/",
         hostRoots: [{ kid: "root-2026-08", fingerprint: "b".repeat(64) }],
       }),
       AGENT_HANDSHAKE_ROLE_ACCESS_ACTIVE: "dummy-role-active",
@@ -753,6 +753,20 @@ test("installer enables and restarts the systemd unit", async () => {
   assert.match(install, /systemctl restart clockchain-mcp\.service/);
 });
 
+test("release runbook reinstalls deploy assets before every MCP restart", async () => {
+  const runbook = await readFile(path.join(deployDir, "RUNBOOK.md"), "utf8");
+  assert.match(
+    runbook,
+    /infra\/scripts\/install-clockchain-mcp-deploy-assets\.sh/,
+    "deploys must refresh the out-of-checkout systemd wrapper before restart",
+  );
+  assert.doesNotMatch(
+    runbook,
+    /then run `compose-up\.sh`/,
+    "the copied wrapper must not be invoked without first reinstalling it",
+  );
+});
+
 test("provisioning IAM policy is limited to MCP and host SSM prefixes", async () => {
   const provision = await readFile(path.join(repoRoot, "infra", "scripts", "provision-clockchain-mcp-host.sh"), "utf8");
   assert.match(provision, /parameter\/clockchain\/mcp\/\*/);