Deliver Mjolnir's MCP servers to Muse through muse-acp 0.8.1

[foundev]

Summary

Muse sessions now receive Mjolnir's MCP servers, and a Muse profile can act as a turn reviewer.

• Pin: muse-acp 0.8.1 with Muse Code 1.4.1-R4503.1, for managed installs and for the agent-dev image. Both install from mj-worker/assets/muse/runtime.json, which carries verified SHA-256s for all four platforms. muse-acp 0.8.0 forwards ACP MCP servers to Muse through typed session MCP.
• One owner for MCP delivery:
  • HarnessKind::supports_injected_mcp, which was false only for Muse, is removed.
  • So is the worker's separate hard-coded Muse check in project_memory_mcp.
  • Muse sessions now get the mj-memory tools, and Muse can be selected as a reviewer. Auto review still skips it, because Muse has no Auto policy.
• Withheld servers are visible: muse-acp drops MCP servers with only a log line when the Muse host withholds the sessionMcp grant. It advertises mcpCapabilities.http exactly when the grant was given; HarnessKind::mcp_servers_need_advertised_http records that rule.
  • A session whose runtime withholds the servers continues without them and shows a warning with the remedy. This is typically a container created from an older image, and containers are not replaced on upgrade (Version the agent-dev image per release, bake the worker into it, and replace containers on upgrade #1139).
  • A reviewer fails instead, because it needs its analyzer tools.
  • The check counts the servers the opening request actually carried. It runs after the open, so a host that could not start reports its own diagnostic.
• Reviewer authority: Muse always runs unconstrained. Reviewer staging refuses a reviewer that would run unconstrained for a session that runs with approvals. A Muse reviewer can review sessions that already run unconstrained: container targets and Muse sessions.
• Reviewer launch fixes: these surfaced once Muse could review.
  • The worker set the harness home variable straight to the role's profile copy. Muse reads $XDG_CONFIG_HOME/muse and needs its own XDG_DATA_HOME, so it reported "Muse is not logged in". Reviewers now use home_from_environment and configure_home_environment, as sessions do. Each refresh replaces the whole directory the home variable names.
  • Reviewer staging now also writes the enforced Muse permission profile into the staged settings.json, as session staging already does.

Sub-agent delegation tools remain Claude and Codex only (supports_delegation_tools). This PR does not change that.

Follow-up issues found during live testing: #1188 and #1189.

Test plan

• cargo test: all crates pass. The only local failures are three move_session::transfer tests that need rsync, which the test host lacks.
• cargo clippy --all-targets -- -D warnings
• Ignored real-adapter Muse scenario against the checksum-verified muse-acp 0.8.1 binary
• New behavior tests:
  • MCP delivery
  • warning when the grant is withheld
  • reviewer failure without its tools
  • host diagnostic not masked
  • the reviewer's Muse home, replaced as a whole
  • the reviewer authority refusal
  • the staged reviewer permission profile
• Live runs in an isolated instance:
  • A managed local Muse session called the mj-memory tools.
  • The published agent-dev image (muse-acp 0.5.0) failed with the first revision's message. It now continues with a warning; the fake-adapter tests cover that path.
  • An image built from this runtime.json used mj-memory and completed an automatic Muse turn review.
• Code review of the PR: the upgrade break, reviewer authority, the recomputed server list, the stale reviewer home, the message remedy, and the harness property are addressed in the second commit.

After merge, publish-agent-dev-image.yml republishes the image with the new pin.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XMubswjnr331JWDXctkFz5