Defense-in-depth check for the 2026-06-24 MCP regression: verifies that
the 2 MCP-config files (opencode.json + mcp_paths.toml) are present on
a tier-2 branch. If either is missing, the audit fails (exit 1) with
a clear diagnostic and the exact commands to restore the files.
The pre-commit hook (conductor/tier2/githooks/pre-commit, hardened in
eae75877) auto-unstages these files on commit, but does not prevent
the deletion from being in the commit's diff. The 2026-06-24 MCP
regression was exactly this: commit 6956676f deleted both files,
and the empty fix commit (2b7e2de1) was a no-op.
This audit catches that pattern 1 step earlier than the user noticing:
on push, on pre-merge, on manual review. It checks the branch's index
via 'git cat-file -e ref:file' (not the working tree) so it works in
CI without a checked-out working tree.
Usage:
# Audit the current HEAD
uv run python scripts/audit_branch_required_files.py
# Audit a specific ref
uv run python scripts/audit_branch_required_files.py --ref origin/tier2/foo
# JSON output for CI integration
uv run python scripts/audit_branch_required_files.py --json
The script's REQUIRED_FILES list has 2 entries (the actual MCP
regression targets), not 4. The 2 .opencode/agents/... files in
conductor/tier2/githooks/forbidden-files.txt are tier-2 sandbox-only
working tree files that are NEVER tracked in any branch (per commit
fab2e55b 'undo sandbox file leaks'); they live only in the tier-2
clone's working tree, copied there by setup_tier2_clone.ps1.
Exit codes:
0 - all required files present
1 - one or more required files missing (CI gate failure)
2 - usage error
Verified:
- HEAD: OK (files restored by user commits 71b51674 + cb1b0c1c)
- master: OK (files exist on master)
- 6956676f: FAIL (correctly detects the MCP regression commit)
- --json output is valid JSON
- --help shows clean usage
CI integration (when the project gets CI):
Add to .github/workflows/ci.yml (or equivalent):
- name: Verify tier-2 required files
run: uv run python scripts/audit_branch_required_files.py --strict
Or as a per-PR check on tier-2 branches:
- name: Verify required files on tier-2 PR
if: startsWith(github.head_ref, 'tier2/')
run: uv run python scripts/audit_branch_required_files.py --strict
ed
8ec0a30bf4