M03 RECON: execute real read-only official MCP GitHub operation

[GBOGEB]

Mission

M03_GITHUB_MCP_SERVER / P_M03_OFFICIAL_LIVE_READ_02

Objective

Advance from upstream representation smoke proof to one real GitHub API operation through the official MCP server.

Execution path

1. checkout exact official github/github-mcp-server@7d13a7ad6f2a17f351a6d77ce280c85ae1821f4d;
2. build the official server and its mcpcurl client;
3. launch the official server in stdio mode with the workflow token;
4. invoke get_file_contents against github/github-mcp-server:README.md;
5. require a non-empty response with expected MCP content;
6. hash the response and upload an exact-source operation receipt.

Authority boundary

A GREEN run proves a real read-only operation over official MCP transport. It still does not prove every QPS operation, auth/permission mode, or downstream evidence semantic. QPS remains the control/evidence plane.

FIRST RED

If the runner never starts, Dockmaster owns it. If build/server/tool discovery/API execution runs and fails, recurse on the first observed application failure only.

Source separation

No upstream merge or 270-commit fast-forward is performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T15:49:59.858371Z	2c6a2bc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[GBOGEB]

FIRST RED receipt → repair pulse

Run: 34618058825
Job: 103324816844
Official source: github/github-mcp-server@7d13a7ad6f2a17f351a6d77ce280c85ae1821f4d

Observed execution reached the application layer: runner setup, exact-source checkout, Go setup, and both official binaries all completed successfully. The first failing step was the live MCP invocation. mcpcurl returned unknown flag: --owner, while showing only the parent tools help, so get_file_contents had not been materialized as a dynamic subcommand under the initial server invocation.

Classification: application/invocation-tool-discovery RED, not Dockmaster/runtime.
Owner: Engineer + Architect.
BG: repos toolset not explicitly enabled/proven before live call.
CG: tools --help exposes get_file_contents with --owner/--repo, then the same read-only call succeeds and an exact-source response digest receipt is uploaded.

Narrow repair commit: e4253fd5a225966ffe15c70f4173d47af091a72d. It changes only this FIRST RED path: starts the exact official server with stdio --toolsets=repos, proves dynamic tool discovery/help first, then retries the same read-only operation. No upstream sync or broader transport rewrite is included.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2c6a2bc876

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Capture the embedded file before grepping for README text

On every successful get_file_contents call, the pinned server returns a plain success TextContent followed by an EmbeddedResource, but mcpcurl's printResponse attempts to parse that success message as JSON/JSONL, reports failed to parse text content as a list, and never writes the embedded README to stdout; its generated command handler only prints the error to stderr and still exits successfully. Consequently this redirected file remains empty and the new workflow always fails at test -s (and could never find github mcp here), so the raw MCP response or embedded resource must be captured with a client that preserves resource content.

Useful? React with 👍 / 👎.