diff --git a/docs/superpowers/plans/2026-09-17-webmcp-research-note.md b/docs/superpowers/plans/2026-09-17-webmcp-research-note.md new file mode 100644 index 0000000..2b3089d --- /dev/null +++ b/docs/superpowers/plans/2026-09-17-webmcp-research-note.md @@ -0,0 +1,25 @@ +# WebMCP Research Note Implementation Plan + +> **For agentic workers:** Execute inline with validation checkpoints. + +**Goal:** Add a sourced WebMCP research note and assess its Cloud Foundry relevance. + +**Architecture:** Describe WebMCP as a browser-local tool exposure layer in which a page declares imperative JavaScript or declarative form tools, the browser mediates agent access, and the web application retains its current UI/session context. + +**Tech Stack:** Markdown, YAML frontmatter, Devbox, Git, GitHub CLI. + +--- + +### Task 1: Write `research/webmcp.md` + +- [ ] Add valid frontmatter with WebMCP sources, tags `[inter-agent-comms, ecosystem-survey, governance]`, and `cf_areas: [capi, uaa]`. +- [ ] Explain WebMCP's motivation, browser-local tool model, imperative API, declarative form API, and fallback to ordinary browser automation. +- [ ] Cover shared browser state/authentication, tool descriptions/schemas, implementation status, and security-minded design. +- [ ] Assess CF relevance for applications exposing agent actions through existing browser sessions, while distinguishing WebMCP from server-side MCP gateways. +- [ ] Add questions about browser support, user consent, session identity, tool authorization, CSRF/security boundaries, and CF application guidance. + +### Task 2: Validate and publish + +- [ ] Run `devbox run validate`, `devbox run test`, and `git diff --check`. +- [ ] Stage only the note and approved spec/plan, commit `docs: add WebMCP research note`, push `research/webmcp`, and open a checklist-complete PR targeting `main`. +- [ ] Verify the PR metadata and CI status with `gh pr view`. diff --git a/docs/superpowers/specs/2026-09-17-webmcp-research-note-design.md b/docs/superpowers/specs/2026-09-17-webmcp-research-note-design.md new file mode 100644 index 0000000..31b47a6 --- /dev/null +++ b/docs/superpowers/specs/2026-09-17-webmcp-research-note-design.md @@ -0,0 +1,26 @@ +# WebMCP Research Note Design + +## Goal + +Capture a sourced research note on WebMCP as a browser-native way for web applications to +expose page functionality as agent tools. + +## Scope + +Cover WebMCP's imperative JavaScript and declarative HTML form APIs, the browser as the +execution and identity context, the distinction from backend MCP integrations, implementation +status, and security-minded tool design. Assess Cloud Foundry relevance for applications that +want agents to act through existing authenticated web sessions without duplicating backend +integrations. + +## Structure and evidence + +Create `research/webmcp.md` with the required four sections and frontmatter. Use the WebMCP +repository, README, explainer, implementation status, and security guidance. Distinguish the +proposal/experimental status from deployed browser behavior and label CF analysis as proposed +integration. + +## Validation + +Run Devbox validation and tests, inspect whitespace/staged files, commit the note and plan on +`research/webmcp`, push, and open a PR targeting `main` without unrelated artifacts. diff --git a/generated/research-map.html b/generated/research-map.html index 709aef2..d59a346 100644 --- a/generated/research-map.html +++ b/generated/research-map.html @@ -23,9 +23,9 @@

Focus use cases

Attested Workload Authority and Mediated Tool AccessExchange platform-attested workload identity for scoped authority while credentials and outbound tool access remain mediated by the platform.Strategic decision: Decide whether CF should become the portable trust and policy layer between agent workloads and the tools they invoke.
Gap, experiments, and evidence
Current CF gap
CF issues workload identity certificates but does not exchange them for scoped tool authority, keep third-party credentials out of workloads, mediate off-platform access, or record delegation-aware audit events.
Candidate POC
Exchange a Diego instance identity certificate for a short-lived scoped token, invoke one allowed tool through a credential proxy and egress mediator, deny another, and emit attributable audit events.
Candidate RFC scope
Define workload token exchange, authority and delegation claims, credential brokering, outbound mediation and policy enforcement, audit events, revocation, and integration boundaries for UAA, routing, and service brokers.

Core

Supporting

-
Gap, experiments, and evidence
Current CF gap
CF can stage apps and run ephemeral tasks but cannot cheaply compose a reusable environment with per-session workspace state, select stronger isolation, constrain session networking, or resume the session lifecycle.
Candidate POC
Start two isolated sessions from one content-addressed staged environment, attach separate mutable workspaces, apply per-session egress policy, stop one session, and resume it on fresh compute.
Candidate RFC scope
Define environment and workspace references, session identity and lifecycle, isolation classes, network policy, workspace persistence and cleanup, scheduling, quotas, and compatibility with existing CF staging and task APIs.

Core

Supporting

ResearchIdea

Platform Impact x Maturity

Emerging < Maturity > EstablishedLocal concern < Platform Impact > Platform-wide concern
Unplaced notes (0)
+
Gap, experiments, and evidence
Current CF gap
CF can stage apps and run ephemeral tasks but cannot cheaply compose a reusable environment with per-session workspace state, select stronger isolation, constrain session networking, or resume the session lifecycle.
Candidate POC
Start two isolated sessions from one content-addressed staged environment, attach separate mutable workspaces, apply per-session egress policy, stop one session, and resume it on fresh compute.
Candidate RFC scope
Define environment and workspace references, session identity and lifecycle, isolation classes, network policy, workspace persistence and cleanup, scheduling, quotas, and compatibility with existing CF staging and task APIs.

Core

Supporting

ResearchIdea

Platform Impact x Maturity

Emerging < Maturity > EstablishedLocal concern < Platform Impact > Platform-wide concern
Unplaced notes (0)
 -