feat(shadow-ai): add cMCP audit adapter with trusted session bindings

[carloshvp]

Shadow AI could not attribute native cMCP audit records because they contain a session ID rather than an agent ID. This adds CmcpAuditAdapter, which uses explicit operator-controlled (source_id, session_id) -> agent_id bindings while retaining the existing scanner APIs and reports.

The adapter snapshots bindings, rejects duplicate source/session keys, and reports missing mappings or conflicting record identities as unavailable. Strict scan methods raise instead of returning an apparently complete result. Tool catalogs and record-supplied identity claims cannot supply a missing binding. The caller must authenticate the audit source and establish the session identity; this adapter does not perform that authentication or verify gateway/TEE evidence.

Tests use genuine catalog fixtures and SQLite audit payloads from the published cmcp-runtime==0.2.0 and 0.7.0 audit APIs, plus freshly generated records. A new CI matrix covers both releases on Python 3.11–3.13. These producer tests install the audit modules without the full gateway dependency stack. Timestamp normalization remains separate, as requested in the issue.

Validation:

• nox -s shadow_ai shadow_ai_cmcp: 126 unit tests passed without cMCP; 130 passed with each pinned producer release on Python 3.12.
• Hosted Shadow AI matrix: 130 passed in each of six jobs (cMCP 0.2.0/0.7.0 on Python 3.11/3.12/3.13).
• Repository Ruff scope, compileall, actionlint and diff checks passed.
• Integration validation: 47 integrations, zero failures; compatibility and generated catalog/index checks passed.

Fixes #215.

[noah-ing]

Reviewed ef1756b53ebf51c0acd9c9f68c731436359b2a86 in an isolated local checkout; no blocking findings.

Reproduced nox -s shadow_ai shadow_ai_cmcp: 126 passed with the expected missing-cMCP skip, then 130 passed with each released producer. Independently ran the 130-test suite on Python 3.11, 3.12 and 3.13 against cMCP 0.2.0 and 0.7.0: all six combinations passed without skips. An additional 55 local controls passed in each environment, covering source/session namespace substitution, missing and conflicting identities, duplicate bindings, snapshot/input preservation, both strict/report APIs, and freshly generated AuditChain/SQLite records.

The failure behavior is consistent: unavailable identities retain valid findings in reports, and strict methods raise rather than silently dropping those records. Record claims cannot supply or override a trusted binding. Source authentication remains the caller's responsibility; these checks do not establish gateway/TEE verification or prove a tool executed. Keeping timestamp normalization separate matches #215.

Repository-scope Ruff, actionlint 1.7.12, compilation, 28 repository validation tests, manifest/compatibility and generated-index/catalog checks, diff checks, and a merge simulation against af507cb also passed. DCO sign-off is present. Thanks for keeping the released-package coverage and limitations explicit.

[imran-siddique]

@rajnisht7 as integrations backup, could you review and merge this by Friday 17 October? noah-ing's approval covers the testing, but the gate needs a maintainer's approval of ef1756b.

[dinakarjs]

Independent bounded review at ef1756b: no blocking finding in the new trusted-mapping adapter.

Reproduced the 130-test suite on Python 3.12.14 against each installed released producer, cmcp-runtime 0.2.0 and 0.7.0, using the repository's hashed validation requirements and no dependency substitution from a gateway checkout. This exercises freshly generated AuditChain/SQLite payloads and the checked-in genuine fixtures. Hosted checks cover all six Python/release combinations successfully; I did not independently rerun Python 3.11 or 3.13.

Four isolated source weakenings were caught while both valid in-memory/JSONL controls passed: bypassing missing-session lookup fails the no-record-identity-fallback control; removing record identity conflict detection fails all 8 cases; allowing duplicate bindings fails both duplicate cases; ignoring source scope fails the caller-selected source control. The last weakening triggers a lookup error rather than a false-clean scan, which still demonstrates the scoped key is required. Original source restored; no mutation committed.

Bindings are copied into a read-only source/session-keyed mapping; record fields cannot select a source, invent a binding or override its identity. Unavailable records preserve valid findings and make strict APIs raise. Syntax checks and diff checks pass. The reviewed commit is DCO signed off.

This is identity attribution from caller-trusted inputs, not authentication of the audit source, gateway/TEE verification, proof of execution or a completeness claim about the source stream. The documented skipped non-tool records and timestamp_utc non-normalization remain outside the claim. Noah's existing approval and the request to Rajnish remain; this technical COMMENT does not claim integrations maintainer or merge authority.

[rajnisht7]

the changes looks good, the adapter correctly uses the operator-controlled bindings, doesn’t fall back to record identity, and tests cover the important cases.