Add governed MCP federation for v0.11.0

[xeonvs]

Problem and result

OCR previously received external MCP servers through direct composition, while executable context adapters created a second acquisition path without one enforceable admission, accounting, and cleanup boundary. This change replaces those paths with a governed registry-v2 federation gateway, keeps the toolkit evidence MCP mandatory and independent, and leaves OCR as the only model loop.

The gateway negotiates qualified SDK-v1/v2 peers independently from OCR, enforces allowlists, schemas, origins, DLP, byte/time/call/run budgets, cache/single-flight rules, teardown, and content-free receipt accounting. Legacy policy v1-v3 references remain parse-only migration input and never execute; receipt v9 records actual federation use and stage-aware DLP source attribution.

OCR_DLP_ENABLED is a strict default-on control. Setting it to false bypasses only DLP checks, emits prominent local/GitLab warnings, records the unsafe mode in the receipt, and makes approval ineligible; structural, identity, cleanup, evidence, and publication gates remain enforced. Operators should use this escape hatch only for controlled diagnosis because upstream content can leave the normal DLP boundary.

M7 governed MCP federation is now established in the roadmap. This feature covers issues #188, #189, #190, #191, #192, #193, and #203, together with OCR compatibility work tracked in #201, #202, #204, #205, #206, #207, #209, and #210. It does not close those issues or perform stable delivery.

Compatibility and dependencies

• Official Python MCP SDK v2 is the primary toolkit integration; qualified external servers may use SDK v1 or v2 and negotiate their wire protocol independently.
• OCR 1.10 remains deprecated, versions below 1.10 are rejected, and exact qualified patches in the active 1.11/1.12 window are accepted.
• OCR 1.12.0 through 1.12.7 have checksum-backed evidence; the local qualification binary and GitLab example now use 1.12.7.
• Python, build, development, and GitHub Actions dependencies and immutable action pins are refreshed.

Validation

• scripts/quality.sh check: 1761 passed, 2 skipped, 339 subtests; 86.17% total coverage and all scoped floors passed.
• Actual checksum-verified OCR 1.12.7 with SDK-v1/v2 federation peers: 53 passed.
• Compatibility/public-contract scope: 273 passed and 40 subtests.
• Independent full-diff architecture/security review found five issues; all were fixed and the affected 92 tests and 40 subtests were independently rechecked.
• Fresh wheel and sdist builds pass twine check; pip-audit reports no known vulnerabilities.
• Ruff, mypy, Bandit, OCR manifest validation, staged/tree/history Gitleaks, privacy scans, and diff checks pass.
• The implementation commit is SSH-signed and locally verified.

Codex Security completed the immutable feature range with complete changed-file coverage and no reportable findings. The final local OCR review completed 61/61 selected reviews, exercised the mandatory evidence MCP 22 times, passed DLP admission, and produced four findings that were fixed with focused regression coverage.

Release handoff

The feature implementation plan is closed before the final push. Hosted checks on the exact final SHA gate readiness and protected merge. TestPyPI verification, the separate v0.11.0 release PR, immutable stable publication, external readback, and issue/milestone closure remain distinct release-lifecycle states under docs/release.md.