# Reported issues for kcp-harness — KCP compliance proxy

Pod holds 10 of 10 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [kcp-harness — KCP compliance proxy](/mcp/kcp-harness-kcp-compliance-proxy).

## Most discussed

### Governance plane — org-scale governance across agent fleets

## Problem statement (discussion first)

Everything in kcp-harness today is **per-session, per-proxy**: one agent, one stdio proxy, one budget ledger, one temporal watcher. The industry is moving to fleets — many agents, long-running, operating for one org under one policy. That needs a **governance plane**:

- **Shared approval queue** — one review surface for tickets from every agent (the file-based `ApprovalProvider` from #28 is accidentally the first step: it's already cross-process and rest

[Read the thread](https://github.com/Cantara/kcp-harness/issues/36) · 2026-07-21 · open · 2 comments

### Pending governance decisions — support human-approval gates, not just synchronous approve/block

## Problem

Same governance pilot as the companion kcp-agent issue (Cantara/kcp-agent#93 — cross-referencing there for the fuller context). Part of the org's policy model requires that certain task types — not knowledge access, but *actions an agent proposes to take* — need a specific named human's sign-off before they proceed, not just an automated allow/deny. Example from the pilot: an agent may *suggest* changes to a customer record freely, but *changing its formal status* requires a named "a

[Read the thread](https://github.com/Cantara/kcp-harness/issues/28) · 2026-07-20 · closed · 2 comments

### Add Pi as a kcp-harness integration target

> **TL;DR:** kcp-harness supports several MCP-capable coding agents but not Pi. Add a native Pi integration generator so projects can receive the correct MCP configuration and operating guidance without hand-authoring glue.

## Acceptance criteria
- Add `kcp-harness integrate pi`.
- Generate the appropriate project-local Pi MCP configuration.
- Generate concise agent operating guidance/skill content without duplicating governance logic.
- Support dry-run and idempotent regeneration.
- Add fixtur

[Read the thread](https://github.com/Cantara/kcp-harness/issues/20) · 2026-07-14 · closed · outside contributor · 2 comments

### Procedural conformance gate — "grounding for actions" (new ConformanceVerdict, into the #34 chain)

## Problem

Grounding (`ClaimVerdict`) adjudicates what the agent *asserted* — each claim must trace to a loaded knowledge unit, content-hash matched; a hallucinated citation "proposes into a void." There is **no analog that adjudicates what the agent *did*** against the procedure it was authorized to follow.

An agent can claim "I followed the approved deployment procedure" and no deterministic layer checks whether its actual tool-call sequence stayed within that procedure's declared scope. Thi

[Read the thread](https://github.com/Cantara/kcp-harness/issues/39) · 2026-07-22 · closed · 1 comment

### Classify skill/procedure invocation as a governed call + emit procedural audit events

## Problem

The proxy's five-stage pipeline — `RECEIVE → CLASSIFY → GOVERN (13 gates) → EXECUTE → AUDIT` — classifies whether an MCP tool call targets governed **knowledge** (e.g. `Read("docs/api.md")` where `docs/` is governed → planner; `Read("package.json")` → pass-through), and always governs KCP tool calls. It does **not** recognize an agent *loading a procedure* — a `SKILL.md`, a slash-command, a workflow definition — as a governed event.

So the fifth audit question — *"what playbooks did

[Read the thread](https://github.com/Cantara/kcp-harness/issues/38) · 2026-07-22 · closed · 1 comment

### Signed approval resolutions — non-repudiable reviewer identity

## Problem

Approval resolutions (#28/#29) require a named `reviewer` and `policyRef` — but nothing verifies the person running `kcp-harness approvals approve` *is* that person, or holds the `required_role`. Today's resolutions are honest-system evidence, not non-repudiable evidence. Auditors of the governance pilot will eventually ask "prove Kari N. approved this."

## Direction

We already have ed25519 signing infrastructure (manifest signing, `src/verify.ts` in kcp-agent). Reuse it:

- Review

[Read the thread](https://github.com/Cantara/kcp-harness/issues/35) · 2026-07-21 · closed · 1 comment

### Sign knowledge.yaml and declare a serving binding (KCP 0.26 §3.12)

Follow-up from #17, which upgraded to kcp-agent 0.13.0 / KCP 0.26 but deliberately deferred the `serving` block.

## Why deferred
Our dogfood `knowledge.yaml` is unsigned. The 0.13.0 validator warns that a serving binding without a signing block can be stripped or altered by a re-hoster — and `test/manifest.test.ts` requires zero validation issues. An unsigned binding is theatre; signing comes first.

## Plan
1. Generate a signing keypair for the manifest (`kcp-agent sign` workflow), publish the

[Read the thread](https://github.com/Cantara/kcp-harness/issues/18) · 2026-07-14 · closed · 1 comment

### Add governance.conformance.route_to_role / policy_ref for conformance holds

When the conformance gate (#39) holds an out-of-scope action, it opens a `pending_review` ticket but borrows `governance.confidence.route_to_role`/`policy_ref` for the reviewer role + policy reference. Without a confidence block configured, a conformance hold defaults to role `governance-reviewer` and no `policyRef` (the failed `ConformanceVerdict` is still pinned as evidence).

Ask: a dedicated `governance.conformance.route_to_role` + `policy_ref` so conformance holds route to their own reviewe

[Read the thread](https://github.com/Cantara/kcp-harness/issues/43) · 2026-07-22 · closed · 0 comments

## Most recent

### Harden the Claude Code PreToolUse hook — 5 governance bypasses (red-team)

Follow-up to #23. That fix made the hook *fire* (it read `process.env.TOOL_INPUT` which is never set); this issue is about how much the now-firing hook actually **covers**. I red-teamed the merged hook by executing it the way Claude Code does (payload on stdin) with evasion payloads.

Governed paths in the test: `["docs/", "fragments/"]`. Baselines correctly **deny** (`docs/api.md`, `./docs/api.md`, `/abs/…/docs/api.md`, `docs//api.md`, `src/../docs/api.md`). These slip through:

| Payload | Res

[Read the thread](https://github.com/Cantara/kcp-harness/issues/25) · 2026-07-20 · closed · 0 comments

### Emit decision traces (kcp_trace gate cascade) for dashboard ingestion

Cross-repo companion to Cantara/kcp-dashboard#2 (agent thought-graph, decision layer). Design doc: `docs/thought-graph-phase2.md` in kcp-dashboard.

## Context

kcp-harness already computes a `DecisionTrace` (the deterministic 13-gate cascade per unit) on demand via `kcp_trace` (`src/kcp-bridge.ts` → `traceDecision`). But the audit log **strips** it (`src/audit.ts:241` — *"Omit full trace from audit (it's large); the trace is available via kcp_trace"*), so nothing persists the *why* behind a gov

[Read the thread](https://github.com/Cantara/kcp-harness/issues/19) · 2026-07-14 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/Cantara/kcp-harness/issues).