Anonymous public evidence for isolated Chat

An isolated project Chat can read static public articles and actual image pixels without inheriting personal MCP servers, browser cookies or account history. The optional bundled loopx.extensions.public_source_reader provider performs anonymous HTTPS GETs only. It owns external IO, not Session, grant, material, delegation or publication authority. It is a fallback for static sources; Ego's rendered reader remains useful on an explicitly authorized personal host when a page needs browser rendering.

Install the optional dependency in the existing Chat host's environment:

python -m pip install 'loopx[public-source-reader]'

On that trusted host, set LOOPX_CHAT_PUBLIC_SOURCE_READ=on and restart the idle service through its existing lifecycle. off is the default and rollback. Only native workspace_only Chat processes consume this setting; ordinary personal Chat keeps its existing MCP configuration. Existing Sessions resume in their original native store. Workspace grants, shell network restrictions, model authentication, audience and history do not change.

The host first disables all effective personal/project MCP entries, then admits one provider with a fixed interpreter and current-release file, minimal environment and no caller credentials. Isolated Python excludes the writable workspace and PYTHONPATH from provider module lookup. Source-only and bundled releases use their own provider file for both MCP startup and observation workers; they do not need a second site-installed LoopX package, and cannot silently use an older one. The optional dependencies must still be installed in that host interpreter. The reserved name loopx_public_source_read must not appear in a lower native configuration layer: a collision fails before model dispatch rather than merging its command, environment or headers. Project files and model input cannot enable this provider. Missing dependencies are an installation failure, not authority to enable a personal reader or widen the shell sandbox.

read_public_url(url) returns static text, image indices, observed URL, source digest and explicit truncation/coverage. read_public_image(url, index) reads that article again and returns one PNG image-content block with its source digest. A changed article may have changed image indices; verify the returned digest and URL. Text/alt labels do not prove pixels were read, and static HTML does not prove a dynamic article or a verification wall was fully read. The Agent must report missing coverage and inspect rendered labels and arrows.

Long text can be read without raising the per-response limit. Start with read_public_url(url), then call read_public_url(url, offset=next_offset, expected_sha256=sha256) using the previous response's values. Offsets count decoded text characters, including Unicode characters. text_start and text_end describe the returned range; next_offset=null means there is no later page. A nonzero-offset response is still truncated=true because it omits the prefix. Only contiguous ranges from zero through characters, all with the same source digest, establish complete text coverage. Every call independently performs the existing anonymous fetch and address checks. A changed digest returns public_source_changed without text; restart from zero instead of mixing revisions. Invalid offsets, missing continuation digests and out-of-range positions fail without a text result. The MCP entry validates original JSON values before the SDK can coerce them: offsets and image indices must be integers, excluding booleans, numeric strings and floats. A supplied digest must be a lowercase 64-character SHA-256 string or JSON null for an initial read; the string "null" is rejected. Invalid parameter types, digest formats and static ranges are rejected before a network observation or worker starts. An offset beyond the actual source length or an image index absent from that source requires reading the source before rejection. Qualification exercises the production MCP registration with a real SDK client, including these rejected values, valid text continuation, changed-source rejection and image content.

The provider sends no cookies, account headers, proxy settings or caller-defined headers. Every destination and redirect must resolve entirely to globally routable addresses; the checked address is pinned to the TLS connection while the original hostname is used for certificate validation. File URLs, credentials in URLs, nonstandard ports, local/private/link-local addresses and mixed DNS answers are rejected. The whole observation, including DNS and rendering, runs in a minimal-environment worker with a 30-second deadline. Responses are bounded to 4 MB, text to 100,000 characters, image inventories to 128 and image edges to 4,096 pixels. Errors return no private interpreter paths or resolver output.

PNG/JPEG/WebP and self-contained SVG images are supported. SVG geometry and aspect ratio are preserved; active elements, external references and stylesheet blocks are rejected. The bundled resvg renderer uses only standard OS font directories, skipping the account's font database; no additional native Cairo installation is required. This provider never reads a local source file supplied by the caller or navigates an authenticated browser.

Qualification must separately demonstrate native Session tool/image consumption, an original-topic answer with actual provider readback, outside/private-resource rejection, unchanged grants/history and source completeness. A successful host MCP probe or unit suite alone does not qualify the community Bot's golden pack. Keep admission on hold while mandatory cases remain failed, blocked or untested.