feat(mcp): add isolated protocol replay verifier

docs/LOGBOOK.md

@@ -1,3 +1,26 @@
+## 2026-07-15 — P0 MCP Playwright offline protocol/schema compatibility replay
+
+**完成內容**：
+- 新增 high-risk replay policy，固定 artifact policy checksum、`mcp-artifact-receipts` commit `9c08ada5c0f15bb6924304af29cd13c8376182ff`、controller/verifier receipt checksum、Harbor artifact digest與 internal runtime image digest；policy 有 owner、expiry、exit condition、replacement、rollback 與獨立 post-verifier。
+- replay controller 重新驗證 artifact receipt chain、manifest、CycloneDX SBOM、3 個 tarball SHA-512 與 package identity，再以 non-root、network none、read-only root、no-new-privileges、cap-drop ALL、bounded CPU/memory/PID/tmpfs/timeout 啟動 MCP。只送 `initialize`、`notifications/initialized`、`tools/list`，不啟動 browser、不呼叫 tool。
+- adapter contract 只允許 `browser_navigate`、`browser_snapshot`、`browser_take_screenshot`、`browser_close` 4 個未來 public verifier 能力；`browser_run_code_unsafe`、file upload、form/click/type/evaluate/network 等其餘 20 個工具明確 denied。Direct Gateway registration、adapter registration、shadow、canary、promotion、RAG write與 production write仍全部停用。
+- 獨立 verifier 完全不 import controller，重新 pull/readback exact artifact/runtime digest、重新解包並再次執行 protocol replay；controller/verifier 都要求 MCP stdin EOF clean exit與 ephemeral container removal terminal。
+- 新增 Gitea-only `mcp-external-replay.yaml`：每週三 10:43 Asia/Taipei、manual/push、non-110 host runner、host pressure guard、Harbor password-stdin/logout、pinned artifact audit commit、同 run/trace/work-item receipts，成功後只 normal push `mcp-replay-receipts` audit branch。
+- Gitea workflow runner-health snapshot納入第 15 條 workflow；scheduled workflow `6 -> 7`，non110 host mapped `4 -> 5`，沒有新增 runner attestation gap。
+
+**source/test evidence**：
+- controller/verifier 本機真實雙 replay 皆通過：MCP `Playwright@1.62.0-alpha-1783623505000`、protocol `2025-06-18`、24 tools、tool-name hash `12d23fea9d8d1a1de3f44863dc00cf393f0a2165323838cf93fed30a6a4cc237`、schema hash `c3737ced21147d0512b0400df5885c95a545bc915892b5c8f928cee78428ac99`，兩次均 clean exit/container removed。
+- 新 replay tests `32 passed`；artifact + replay supply-chain tests與 MCP control-plane/federation/version lifecycle/runner-health 聚焦回歸合計 `84 passed`。Ruff、py_compile、JSON/YAML parse、source-control owner guard與 `git diff --check` 通過。
+- global security mirror guard另抓到 latest main 既有 `apps/web/src/app/[locale]/iwooos/page.tsx` 的 `raw_blocked_waiting_state` 敏感字樣；本 work item未修改該檔，保留為獨立 drift blocker，不以 replay source 綠燈覆蓋。
+
+**尚未完成 / 不誤報**：
+- 目前是 source + 本機真實 replay證據；Gitea replay workflow、audit branch receipt、main CD/deploy marker與 production runtime/UI readback尚未產生，因此 production compatibility仍不得標 completed。
+- Browser binary/runtime immutable supply chain、public-origin egress proxy與 private-network denial、prompt-injection replay、accessibility/latency shadow、canary、Gateway adapter registration、rollback execution與正式 KM/RAG learning acknowledgement仍是 promotion blocker。
+- 未讀 secret value、`.env`、raw session、SQLite/auth；未連線或下載 GitHub/Actions/hosted artifact，未使用 `npx -y`、`@latest`、`:latest`、force push、外部 RAG write或 production mutation。
+
+**下一步**：
+- normal push Gitea main並取得 replay workflow controller + standalone verifier audit receipts；再更新 MCP production read model/UI為 compatibility verified但 promotion disabled，之後才建立 immutable browser runtime與隔離 public-origin shadow/canary/rollback lane。
+
 ## 2026-07-15 — P0 MCP Playwright immutable mirror 與獨立供應鏈 verifier
 
 **完成內容**：

docs/evaluations/gitea_workflow_runner_health_2026-06-05.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "gitea_workflow_runner_health_v1",
-  "generated_at": "2026-07-15T09:57:22+08:00",
+  "generated_at": "2026-07-15T11:01:19+08:00",
   "program_status": {
     "overall_completion_percent": 100,
     "current_priority": "P1",
@@ -22,9 +22,11 @@
     ".gitea/workflows/e2e-health.yaml",
     ".gitea/workflows/harbor-110-local-repair.yaml",
     ".gitea/workflows/mcp-external-artifact-mirror.yaml",
+    ".gitea/workflows/mcp-external-replay.yaml",
     ".gitea/workflows/run-migration.yml",
     ".gitea/workflows/type-sync-check.yaml",
     "config/mcp/playwright-mcp-artifact-policy.json",
+    "config/mcp/playwright-mcp-replay-policy.json",
     "docs/evaluations/ai_agent_version_lifecycle_update_proposal_2026-07-10.json",
     "scripts/ci/check-gitea-step-env-secrets.js",
     "scripts/ci/cleanup-host-runner-workspace.sh",
@@ -34,16 +36,16 @@
     "scripts/ops/stop-stale-gitea-actions-jobs.sh"
   ],
   "rollups": {
-    "total_workflows": 14,
+    "total_workflows": 15,
     "by_workflow_status": {
-      "manifest_mapped": 14
+      "manifest_mapped": 15
     },
     "by_runner_evidence_status": {
       "non110_runner_mapped": 10,
-      "non110_host_runner_mapped": 4
+      "non110_host_runner_mapped": 5
     },
-    "workflows_with_schedule": 6,
-    "workflows_with_workflow_dispatch": 14,
+    "workflows_with_schedule": 7,
+    "workflows_with_workflow_dispatch": 15,
     "workflows_with_notify_bridge": 6,
     "workflows_with_actionable_or_failure_quiet_policy": 3,
     "workflow_ids_requiring_runner_attestation": [],
@@ -369,6 +371,36 @@
       ],
       "next_action": "維持 bounded capacity wait、獨立 verifier 與 mcp-artifact-receipts audit branch；不得啟動 artifact、寫 RAG、切 production route 或推回 deploy main。"
     },
+    {
+      "workflow_id": "mcp_external_protocol_replay",
+      "file_ref": ".gitea/workflows/mcp-external-replay.yaml",
+      "display_name": "MCP External Protocol Replay",
+      "scope": "讀取 pinned artifact receipt commit，以 immutable artifact/runtime digest 在 network none、non-root、read-only container 只執行 MCP initialize 與 tools/list；獨立 verifier 重跑後只寫專用 audit branch。",
+      "status": "manifest_mapped",
+      "risk_level": "high",
+      "triggers": [
+        "push:main",
+        "workflow_dispatch",
+        "schedule"
+      ],
+      "schedule_cadence": "每週三 10:43 Asia/Taipei；cron=43 2 * * 3 UTC；排在 artifact mirror 後。",
+      "runner_labels": [
+        "awoooi-non110-host"
+      ],
+      "runner_evidence_status": "non110_host_runner_mapped",
+      "job_count": 1,
+      "notification_policy": "read_only_no_notify",
+      "notify_bridge_calls": 0,
+      "secrets_policy_status": "只使用 workflow secret references 登入 Harbor 與 normal-push Gitea audit branch；controller/verifier 不讀取、保存或顯示 secret value。",
+      "evidence_refs": [
+        ".gitea/workflows/mcp-external-replay.yaml",
+        "config/mcp/playwright-mcp-replay-policy.json",
+        "scripts/security/external_mcp_replay_controller.py",
+        "scripts/security/verify_external_mcp_replay_receipt.py",
+        "scripts/ci/wait-host-web-build-pressure.sh"
+      ],
+      "next_action": "先取得 mcp-replay-receipts 獨立 verifier receipt；browser runtime、public-origin egress proxy、shadow、canary、Gateway adapter registration、RAG 與 production route 仍保持停用。"
+    },
     {
       "workflow_id": "run_migration",
       "file_ref": ".gitea/workflows/run-migration.yml",