Authentication and enrolment

The two planes

MCP transport authentication is unsupported and unused: the platform advertises no generic MCP Auth capability (Auth: Unsupported), and that is a statement about the transport mechanism, not about security. All authentication happens one layer up, in the SHAMPOO spoke/daemon plane: bootstrap secrets, one-time tickets, hybrid handshakes, short-lived session credentials, profile binding. A client that cannot do the SHAMPOO handshake cannot use the endpoint at all.

Joining: tickets and bootstrap

A conductor creates a one-time ticket (issue_enrollment_ticket) fixing user, role, and projects server-side. The secret shows once and must travel out-of-band.
The new spoke opens handshake_challenge (one-time challenge plus the server's ephemeral key material) and answers handshake_complete with its ephemeral key plus the credential envelope. Challenge and completion run on the same connection; the challenge is single-use; every failure denies generically.
Success provisions the principal, opens a one-hour session, and seals the session credential back. The ticket burns exactly once even under races; post-commit failures revoke the just-made session rather than orphaning it.

The bootstrap secret then lives in a 0600 file the spoke owns. Rotation means re-issuing for the same principal and confirming re-handshake, never editing secrets in place.

Living: sessions and renewal

Session credentials live one hour. Spokes renew on a deterministic jittered schedule (about 42–48 minutes, derived per session so fleets never stampede), drain in-flight calls across the swap (ten seconds), and retire the old session best-effort. Handshake failure backs off (30/60/120/240 seconds) and, past the point of no return, serves out the expiry and exits loudly for the supervisor rather than limping on stale credentials.

Profiles at the handshake

handshake_complete takes an optional profile naming the requested boundary (absent means the configured default). The credential check runs against that profile's own grants; the opened session is bound to it permanently. Unknown profile, unknown client, bad credential: identical generic denial. Replay a session credential against another profile and it dies the same way.

Leaving: revocation

revoke_agent ends a principal everywhere in the profile (generation bump kills every live session on next use); kill_session ends one session; revoke_ticket cancels an unused ticket; close_session retires one of your own. list_sessions shows the live registry (identifiers and audit metadata only, never key material). Revocation in one profile never touches another, by design.