Harden M7.6/7.7: recursive restriction accumulation, MCP server enforcement, fast-fail authorization

AGENTS.md

@@ -20,9 +20,11 @@ cf                                   # Interactive tool picker
 ## Architecture Quick Reference
 
 - `cli/` - Routes all subcommands (list, create, run, test, providers, registry, collections, deps, install, etc.)
-- `tool.py` - Tool/step dataclasses, YAML loading, wrapper generation
-- `runner.py` - Step execution, variable substitution (`{input}`, `{varname}`)
-- `providers.py` - AI provider abstraction (subprocess, API, PTY types; auto-discovery; fallback chains)
+- `tool.py` - Tool/step dataclasses, including delegated `ToolStep` context and `McpStep`
+- `runner.py` - Step execution, variable substitution, nested authorization and delegation
+- `providers.py` - AI providers, auto-discovery, fallback chains, and tool/MCP allowlists
+- `skills.py` - Per-provider Agent Skills loading and validation
+- `mcp_client.py`, `mcp_server.py` - Stdio MCP client/server support
 - `gui/` - PySide6 desktop GUI with page-based navigation
 - `web/` - Flask web UI and forum
 - `registry/` - Flask registry API (search, publish, moderation)