Delegate scoped supervisor tools to remote Git agents

[adityathebe]

Goal

Allow a Captain supervisor to delegate a restricted subset of its caller-supplied tools (including Clicky/Cobra tools) to a remote Git agent. Tool handlers stay on the supervisor: the remote agent receives an authenticated MCP endpoint, discovers only the delegated tools, and calls them back on the supervisor.

This should be generic Captain functionality; embedding applications such as Merivo only supply tools and optionally choose which tools to delegate.

Current gap

Captain already has most of the local caller-tool runtime: policy resolution, filtered MCP definitions, input validation, bearer credentials, expiry/revocation, and approval brokerage. However:

• the caller-tool MCP endpoint is loopback-only;
• Git-agent task payloads do not carry a caller-tool endpoint/capability;
• the remote task runner does not configure caller tools for Codex/Claude;
• the existing Git-agent relay only returns Git results/verdicts to the supervisor—it is not an interactive MCP talkback channel.

Implementation outline

1. Authenticated talkback

• Provide an HTTPS/relayed MCP path from the remote Git agent back to the supervisor, reusing existing Git-agent reachability/TLS infrastructure where practical.
• Issue a short-lived, task-scoped caller-tool capability bound to the task/run and remote agent, with expiry and revocation.
• Deliver the endpoint and credential to the remote runtime through a secret channel. Never serialize the plaintext credential into task.json, control commits, Git refs, argv, events, or logs.
• Keep this capability separate from the durable Git-agent enrollment/dispatch token: Git transport identity must not automatically grant tool authority.

2. Expose supervisor tools to the remote runtime

• Build the endpoint from the supervisor run's already-resolved ToolDefinitions; do not serialize handlers or recreate application commands remotely.
• Pass the resulting CallerToolEndpoint to the remote task runner and configure it as MCP for supported agent backends.
• Execute tool calls through the original handlers in the supervisor process.
• Revoke/close the capability when the task completes, is cancelled, or expires.

3. Enforce delegated permissions

• Resolve the delegated tool set as an intersection with the supervisor's effective tool policy. A child task must never widen its parent's authority.
• Filter tools/list so the remote model only sees authorized tool definitions.
• Re-authorize every tools/call against the capability, tool name, expiry/revocation state, and input schema; calls to undelegated tools must be rejected even if attempted manually.
• Preserve allow/deny semantics. For ask, either broker approval back to the supervisor or fail closed when no live approval path exists.
• Audit capability issuance, tool calls, denials, expiry, and revocation without recording secrets.

Acceptance criteria

• Given 100 supervisor tools and a five-tool grant, the remote model discovers exactly those five caller tools.
• A direct call to any of the other 95 tools is rejected by the supervisor.
• Expired, revoked, wrong-task, or wrong-agent credentials cannot list or call tools.
• No caller-tool credential appears in Git objects, task/control payloads, command arguments, events, or logs.
• Runs without delegated tools retain the current behavior.
• A real remote Git-agent run can invoke an authorized supervisor tool and receive its result.