feat: add source config ownership policy

tests/wf_mcp/service/test_connection_service.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from pathlib import Path
+
 from wf_mcp.broker import WfMcpService
 from wf_mcp.broker.service.connection_service import ConnectionService
 from wf_mcp.broker.service.events import BrokerEventRecorder
@@ -258,6 +260,118 @@ def test_connection_service_sync_registry_disabled_entry_hydrates_disabled_sourc
     assert catalog.capability_sources["demo.registry"].enabled is False
 
 
+def test_connection_service_sync_locked_config_shadows_registry_entry(
+    tmp_path: Path,
+) -> None:
+    service = ConnectionService(events=BrokerEventRecorder(EventBus()))
+    _source_catalog(service)
+    store = FileSourceRegistryStore(tmp_path / "locked_shadow")
+    store.save_registry(
+        SourceRegistryFile(
+            sources=[
+                McpSourceRegistryEntry(
+                    id="demo.default",
+                    provider="registry",
+                    account="stored",
+                    transport=StdioSourceTransport(command="demo-server"),
+                )
+            ]
+        )
+    )
+    config = BrokerConfig(
+        store_root=local_temp_root(),
+        connections=[
+            ConnectionConfig(
+                id="demo.default",
+                server="config",
+                account="locked",
+                source_config_ownership="locked",
+            )
+        ],
+    )
+
+    service.sync_connections_from_config(config, source_registry_store=store)
+
+    connection = service.get("demo.default")
+    assert connection.server == "config"
+    assert connection.account == "locked"
+    assert any(
+        event.kind == "source_registry_ignored_config_shadow"
+        for event in service.events.list_events()
+    )
+
+
+def test_connection_service_sync_seed_config_materializes_registry_entry(
+    tmp_path: Path,
+) -> None:
+    service = ConnectionService(events=BrokerEventRecorder(EventBus()))
+    _source_catalog(service)
+    store_root = tmp_path / "seed_materialized"
+    store = FileSourceRegistryStore(store_root)
+    config = BrokerConfig(
+        store_root=local_temp_root(),
+        connections=[
+            ConnectionConfig(
+                id="demo.default",
+                server="demo",
+                account="default",
+                metadata={"transport": {"kind": "stdio", "command": "demo-server"}},
+                source_config_ownership="seed",
+            )
+        ],
+    )
+
+    service.sync_connections_from_config(config, source_registry_store=store)
+
+    registry = store.load_registry()
+    assert registry.sources[0].id == "demo.default"
+    assert registry.sources[0].provider == "demo"
+    assert service.get("demo.default").metadata["source_registry"] is True
+    all_events = service.events.list_events()
+    assert any(
+        event.kind == "source_registry_seeded_from_config"
+        for event in all_events
+    )
+
+
+def test_connection_service_sync_seed_existing_registry_entry_wins(
+    tmp_path: Path,
+) -> None:
+    service = ConnectionService(events=BrokerEventRecorder(EventBus()))
+    _source_catalog(service)
+    store = FileSourceRegistryStore(tmp_path / "seed_existing")
+    store.save_registry(
+        SourceRegistryFile(
+            sources=[
+                McpSourceRegistryEntry(
+                    id="demo.default",
+                    provider="registry",
+                    account="stored",
+                    transport=StdioSourceTransport(command="demo-server"),
+                )
+            ]
+        )
+    )
+    config = BrokerConfig(
+        store_root=local_temp_root(),
+        connections=[
+            ConnectionConfig(
+                id="demo.default",
+                server="config",
+                account="seed",
+                metadata={"transport": {"kind": "stdio", "command": "config-server"}},
+                source_config_ownership="seed",
+            )
+        ],
+    )
+
+    service.sync_connections_from_config(config, source_registry_store=store)
+
+    connection = service.get("demo.default")
+    assert connection.server == "registry"
+    assert connection.account == "stored"
+
+
 def test_wfmcpservice_sync_connections_delegates_registry_store() -> None:
     service = WfMcpService(store=FileStore(local_temp_root() / "facade_registry"))
     store = FileSourceRegistryStore(local_temp_root() / "facade_registry_store")

tests/wf_mcp/service/test_source_registry_admin.py

@@ -48,12 +48,16 @@ def _provider(
     tmp_path: Path,
     entries: list[McpSourceRegistryEntry] | None = None,
     config_ids: frozenset[str] | None = None,
+    config_connections: list[ConnectionConfig] | None = None,
 ) -> SourceRegistryAdminProvider:
     store = _store_with_entries(tmp_path / "reg", *(entries or []))
-    connections = [
-        ConnectionConfig(id=cid, server="s", account="a")
-        for cid in (config_ids or frozenset())
-    ]
+    if config_connections is not None:
+        connections = config_connections
+    else:
+        connections = [
+            ConnectionConfig(id=cid, server="s", account="a")
+            for cid in (config_ids or frozenset())
+        ]
     return SourceRegistryAdminProvider(
         source_registry_store=store, config_connections=connections
     )
@@ -120,12 +124,30 @@ def test_add_persists_and_round_trips(tmp_path: Path) -> None:
 def test_add_rejects_config_shadowed_id(tmp_path: Path) -> None:
     provider = _provider(tmp_path, config_ids=frozenset({"config.server"}))
 
-    with pytest.raises(ValueError, match="shadowed by a config connection"):
+    with pytest.raises(ValueError, match="locked by a config connection"):
         provider.add_registry_entry(_entry_dict("config.server"))
 
     assert provider.list_registry_entries() == []
 
 
+def test_add_allows_seed_config_shadow_when_registry_missing(tmp_path: Path) -> None:
+    provider = _provider(
+        tmp_path,
+        config_connections=[
+            ConnectionConfig(
+                id="github.work",
+                server="github",
+                account="work",
+                source_config_ownership="seed",
+            )
+        ],
+    )
+
+    result = provider.add_registry_entry(_entry_dict("github.work"))
+
+    assert result.id == "github.work"
+
+
 def test_add_rejects_duplicate_registry_id(tmp_path: Path) -> None:
     provider = _provider(tmp_path, entries=[_entry("existing.server")])