[afourniernv]

Summary

Expose an inspection stage under the HTTP request with bounded message kinds, allowed identifiers and counts. Preserve privacy by excluding structured arguments, payloads and responses, and never present an inspected method as proof that the remote tool executed.

Stacked review 5/6. This draft targets the request-revisions draft in this fork; its diff contains only this layer, not the whole stack. The HTTP core is reviewed upstream in NVIDIA#5214; this dependent draft is on the author fork because upstream base branches are not available.

Related Issue

Closes NVIDIA#5397.
Tracking: NVIDIA#5210 (remains open).

Changes

• The local layer instruments existing JSON-RPC/MCP inspection points without expanding what the policy engine can authorize.
• Allowed and denied inspections and multi-message counts correlate to the correct HTTP request.
• Arguments, payloads and response content are not exported; identifiers and counts remain bounded.

Testing

• Exact MCP layer: mise run pre-commit passed; 1,657 network tests passed.
• Behavior tests added or retained for this layer; DCO-signed commit 5416e48.
• Cumulative native Hermes/Relay live validation on source 0764c1c4c: 13 selected workflows, 1,552 spans and 433 OCSF records; protected synthetic APIs and authenticated GitHub. The agent executed actual tools; no span parents were rewritten. This is cumulative evidence, not isolated-layer E2E qualification.
• Cumulative mise run test rerun passed with four test threads. Initial unchanged VM cleanup and gateway fixture flakes passed isolated reruns and the final full run. Full mise run ci is not claimed.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Relevant crate and observability documentation updated.
• Maintainer acceptance and upstream promotion, after the parent layer lands.

Tested upstream snapshot: 638974575 (merged NVIDIA#4789). Newer main has advanced; this draft does not claim validation against today's main. It is for incremental code review, not merge readiness. No Relay dependency or reverse workload-reporting endpoint is introduced.