[dan-petty]

The ops role published 70 path-like parameters across 61 tools that a model could set. This change drops the write paths and the certificate, SSH key and template options that have a configured store. It confines every remaining read path with safe_resolve_subpath under the server work tree, refuses an escape before the command starts, and records each non-file value with a reason. A new audit covers every published tool, so a new path parameter cannot escape the rule in silence.

Closes #3300

Change: openspec/changes/archive/2026-11-04-3300-the-ops-role-publishes-60-tools/

[dan-petty]

Evaluation: selected and refined

Selected over #3466 for issue #3300. Both branches pass the full CI checks, the MCP suite and the audit.

Why this one wins:

1. Correct parameter classification. sandbox_exec.workdir is a container directory, not a host path, so it belongs in NOT_A_FILE_PATH. fix(mcp): confine every published path parameter #3466 confines it and refuses valid container values such as /app.
2. Stronger write-path handling. output_path, output_dir, output_file, output, cert_path, key_path, tls_dir and key_dir leave the published schema. Each command keeps its configured default, so the model cannot choose where the server writes or which key it reads.
3. No collateral change. It delivers the confinement tables that fix(mcp): read-only tools take paths that reach the server file system #3236 plans without deleting openspec/changes/3236-read-only-tools-take-paths-that/.
4. Cleaner audit. The audit lives in tests/ai/mcp/test_path_confinement.py, checks the full published catalogue (including hand-written scan_uv_audit), and requires a reason of 30 characters and a live entry.

Refinement in 00b5277d:

• The confinement root is now find_worktree_root(Path.cwd()), which is the boundary that the issue names, instead of the launch directory.
• Each kept value is resolved and written back, so the command runs with the resolved absolute path. Without that, switching the root to the work tree would make a relative value name a different file when the server starts below the root.
• Added two tests: a relative value from the repository root and a relative value from a nested directory resolve to the same work-tree path.
• Updated the archived spec, design, proposal and tasks to match the resolved-path decision.

Verification on the refined head:

• pytest -q tests/ai/mcp tests/roadmap/test_roadmap_intake.py tests/tf/test_tf_cost.py -> 797 passed.
• devops ci lint --check, devops ci typecheck, devops ci docs -> pass.
• Pre-push fast static checks -> pass.