Infrastructure: Attenuate desktop driver grants and isolate MCP connections #4440

Goal

Supervisors publish one shared agent grant, so two MCP connections that read the same descriptor share authority, and grant labels do not isolate clients. Separate permission scopes and, if delegation is introduced, give each connection an attenuated child principal.

Part of #4435 (plan item F12).

Scope

• Owner: driver authority and MCP adapter connection lifetime.
• Paths (under packages/agentic/): desktop-driver/src/authority, grant routing in desktop-driver/src/server, desktop-driver-mcp/src/controller.ts, and the security references.
• Separate driver-control, declared-workload, and operator-recovery permissions.
• If delegation is introduced, each connection gets a child principal with equal or narrower authority, and parent revocation propagates.
• Hold a permission design review before expanding scopes.
• Session resume stays out of scope unless a grace and ownership protocol is separately specified and reviewed.

Dependencies

• Blocked by: nothing. The MCP lifetime fixes from Desktop driver: bounded agent operations, protected service, and MCP adapter #4434 are in place.
• Unblocks: F13 Infrastructure: Add the generalized desktop-mcp management facet #4450.
• Parallel with: F1 Infrastructure: Unify desktop driver-service composition and wire durable recovery #4436, F4 Infrastructure: Settle Storybook story-provider cancellation and reconnect epochs #4437, F7 Infrastructure: Guard neutral desktop package dependency and import boundaries #4438, F8 Infrastructure: Expose bounded persisted desktop test-run and artifact queries #4439, and F15 Infrastructure: Live-qualify the desktop driver and MCP foundation on macOS, Windows, and Win32 #4441.
• Coordination: SessionManager.ts and grant routing share one integration owner with drain (F11 Infrastructure: Add scoped runner grants and drain-confirmed desktop controller handoff #4448) and exit and identity work (F10-M Infrastructure: Implement neutral macOS desktop application ownership and identity recovery #4446, F10-W Infrastructure: Implement neutral Windows desktop application ownership and containment #4447). Do not collide with F1 recovery exports or F5 Infrastructure: Authorize and settle every controlled Storybook mutation entrance #4443 routes.

Acceptance

• Two clients cannot use each other's sessions or permissions.
• A child scope cannot exceed its parent.
• Revocation drains descendants, and callers can await the drain rather than a scheduled callback.
• No token appears in logs, status, or model output.

Validation

• Iterate with focused yarn test <name> in each changed package, then run its yarn format, yarn lint, yarn build, and yarn test. Finish with yarn clean-lage-cache then yarn lage buildci; run yarn lage test-links --verbose --grouped after markdown changes.
• Add a patch changeset for each changed published package. Update the owning references/current-status.md rows (done, work in progress, unsupported) and affected README/AGENTS guidance in the same change.
• Native, provider, or process-topology changes need matching-OS native contracts and the affected consumer lane. JavaScript tests and bundles do not qualify native behavior; hosted capability skips are not passes. Report each check as passed, failed, skipped, not run, or unsupported.

Evidence

• Current state: "Per-connection attenuated grants and resumable sessions" in packages/agentic/desktop-driver-mcp/references/current-status.md; grant and revocation behavior in packages/agentic/desktop-driver/references/security.md.
• Retired plan: driver-next.md at 0569e1b86, section 8 (F12).