[dan-petty]

The ops role publishes path-like parameters that a model can set. Every kept path now resolves under the work tree of the server process through safe_resolve_subpath, the output options of ai_ast_graph and k8s_security_stream are gone, and a new audit fails on an unconfined parameter, a short reason or a stale entry. The #3236 plan is folded in because its tables were unbuilt.

Closes #3300

Change: openspec/changes/archive/2026-11-04-3300-the-ops-role-publishes-60-tools-with/

[dan-petty]

Evaluation: not selected

This implementation is strong: it uses the work tree root, resolves each kept argument to an absolute path, audits the full catalogue, and all CI checks pass. I compared it with #3467 against issue #3300.

Blocking differences:

1. sandbox_exec.workdir is misclassified. PATH_CONFINEMENTS treats it as a host path, but the option is a directory inside the sandbox container (--workdir, help text: "Working directory inside the container"). Verified on the branch: workdir="/app" raises ValidationError. fix(mcp): confine every MCP path parameter to the work tree #3467 records it in NOT_A_FILE_PATH and keeps the tool usable.
2. The change deletes openspec/changes/3236-read-only-tools-take-paths-that/. The proposal says it folds fix(mcp): read-only tools take paths that reach the server file system #3236, but fix(mcp): read-only tools take paths that reach the server file system #3236 is still open and Planned. Removing its plan leaves that issue without an artifact and breaks the one-issue-one-pull-request rule. fix(mcp): confine every MCP path parameter to the work tree #3467 delivers the prerequisite tables without deleting another change folder.

Minor: the audit lives in product code (audit_path_parameters) although only tests call it.

No code change is needed on this pull request for the evaluation itself. #3467 is selected and refined in 00b5277d.