Remote-safe: traditional automation read & log tools

[mocha06]

Closes #439. Part of migrating the default-deny remote profile to expose the read tools that meet the remote-safe criteria (milestone: Hosted-safe tool surface). Stacked on rc-dev/feat/remote-safe-kb-provider-reads.

Motivation

Under --profile remote the server exposes only tools carrying meta=REMOTE (tracked by REMOTE_SEED); many pure read tools that reach the API with the request-scoped bearer and are fully governed by API permissions were still withheld. This exposes the traditional automation read, log, and job-export status surface.

Outcome

Marks 11 automation read/log tools remote-safe: get_automation, get_automations, get_automation_actions, get_automation_events, get_automation_event_attributes, get_automation_execution_metrics, get_automation_logs, get_automation_logs_by_repo, get_automations_usage, get_automation_jobs_export, get_automation_jobs_export_csv. Of the two export tools, get_automation_jobs_export is a GraphQL status poller returning status/fileUrl (no download), and get_automation_jobs_export_csv downloads in-memory with a per-call size cap; neither writes a local file nor reads a per-user process-global setting. Each tool carries meta=REMOTE and a matching REMOTE_SEED entry; the drift-guard test keeps the two in lockstep. No new tools, no behavior change under the local profile.

Remote-profile validation

The remote-safe read migration (this PR is part of the stack #437→#441) was verified end-to-end by running the code in --profile remote --transport http locally — behaving as a deployed instance — and connecting an MCP HTTP client with a valid RS256 Keycloak bearer. Measured on an integration branch that also carried the in-flight provider-write work (#434), so the withheld count includes those write tools:

#	Scenario	Observed	Verdict
1	Server in --profile remote --transport http	exposed 76, withheld 106 (default-deny)	✅
2	Unauthenticated request	401 (bearer required)	✅
3	tools/list with a valid RS256 bearer	exactly the 76 remote-safe tools	✅
4	Remote-safe reads present	get_organization, get_pipe, get_llm_providers, get_ai_agents	✅
5	Writes / local-file / raw GraphQL withheld	create_card, create_llm_provider, delete_card, upload_attachment_to_card, execute_graphql absent — 0 leaked	✅
6	Live authenticated tool call (per-request bearer → outbound)	get_organization executed (isError=false)	✅

The 76 remote-safe tools are the 23 pre-existing plus the 53 read tools this migration set (#437–#441) adds. Registration-time filtering is also covered by the test_remote_profile.py drift-guard and test_on_exposes_seed_and_withholds_the_rest.

[adriannoes]

Summary

LGTM for #439. Marks the 11 traditional automation read/log tools with meta=REMOTE and matching REMOTE_SEED entries (tip seed 43 to 54). Mutations and export_automation_jobs stay unmarked. Local drift-guard and MCP unit suite were green on cac828b6. Review mode: checkout+tests+subagents.

What worked well

• Exact issue checklist, lockstep with sibling allowlist PRs.
• Seed comment correctly scopes in-memory caps to get_automation_jobs_export_csv only.
• Security pass clean; Bugbot "missing REMOTE import" was a false positive (import already on the stacked base).

Also noted

• PR Outcome says both export tools "stream in-memory with caps." Only the CSV tool downloads with caps; get_automation_jobs_export is a GraphQL status/fileUrl poller. Seed comment already has this right. Optional PR-body polish only.

Review path

• Stack order: merge after #444; #446/#447 sit on this head.
• Empty GitHub checks on the stacked ref are process noise given local green.
• Cross-stack calibration with sibling reviews (#443 to #447) kept zero findings and APPROVE.

The base branch was changed.

[adriannoes]

LGTM