fix(ticket-assistant): édition de ticket via les tools MCP idea_ticket_* (#27)

L'assistant IA d'édition de ticket éditait les fichiers du ticket en direct,
hors de tout contrôle. Il passe désormais par les tools MCP idea_ticket_* :
préparation d'un environnement structuré dédié et policy d'enforcement scopée
au ticket courant, de sorte que l'assistant ne peut agir que sur son ticket
via la surface MCP plutôt que sur le système de fichiers.

Couvert par de nouveaux tests QA (mcp_server, assistant_context_store).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/infrastructure/tests/mcp_server.rs

@@ -830,6 +830,129 @@ async fn ticket_update_on_other_issue_is_rejected_before_ticket_provider() {
     assert_eq!(ticket_tools.mutation_attempts(), 0);
 }
 
+#[tokio::test]
+async fn bounded_ticket_mutation_tools_reject_other_issue_before_ticket_provider() {
+    for (id, tool, arguments) in [
+        (
+            21,
+            "idea_ticket_update_status",
+            json!({ "ref": "#8", "expectedVersion": 1, "status": "closed" }),
+        ),
+        (
+            22,
+            "idea_ticket_update_priority",
+            json!({ "ref": "#8", "expectedVersion": 1, "priority": "high" }),
+        ),
+        (
+            23,
+            "idea_ticket_link",
+            json!({ "ref": "#8", "targetRef": "#9", "kind": "blocks", "expectedVersion": 1 }),
+        ),
+        (
+            24,
+            "idea_ticket_unlink",
+            json!({ "ref": "#8", "targetRef": "#9", "kind": "blocks", "expectedVersion": 1 }),
+        ),
+    ] {
+        let (service, _s) = build_service(FakeContexts::new());
+        let registry = Arc::new(ToolPolicyRegistry::new());
+        registry.set(
+            "assistant-req",
+            AgentToolPolicy::new(
+                vec![tool.to_owned()],
+                Some(IssueRef::from_str("#7").unwrap()),
+                true,
+            ),
+        );
+        let ticket_tools = Arc::new(FakeTicketTools::default());
+        let server = server(service)
+            .with_ticket_tools(ticket_tools.clone())
+            .with_tool_policies(registry)
+            .for_requester("assistant-req");
+
+        let raw = tools_call(id, tool, arguments);
+        let response = server.handle_raw(&raw).await.expect("reply owed");
+        let error = response.error.expect("policy rejection expected");
+        assert_eq!(error.code, error_codes::INVALID_PARAMS, "tool {tool}");
+        assert!(
+            error.message.contains("#8"),
+            "message should name the rejected issue for {tool}; got {}",
+            error.message
+        );
+        assert!(
+            ticket_tools.calls().is_empty(),
+            "policy rejection for {tool} must happen before ticket provider dispatch"
+        );
+        assert_eq!(
+            ticket_tools.mutation_attempts(),
+            0,
+            "no mutation attempt expected for rejected {tool}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn bounded_ticket_mutation_tools_allow_bound_issue_to_reach_ticket_provider() {
+    for (id, tool, arguments) in [
+        (
+            31,
+            "idea_ticket_update_status",
+            json!({ "ref": "#7", "expectedVersion": 1, "status": "closed" }),
+        ),
+        (
+            32,
+            "idea_ticket_update_priority",
+            json!({ "ref": "#7", "expectedVersion": 1, "priority": "high" }),
+        ),
+        (
+            33,
+            "idea_ticket_link",
+            json!({ "ref": "#7", "targetRef": "#9", "kind": "blocks", "expectedVersion": 1 }),
+        ),
+        (
+            34,
+            "idea_ticket_unlink",
+            json!({ "ref": "#7", "targetRef": "#9", "kind": "blocks", "expectedVersion": 1 }),
+        ),
+    ] {
+        let (service, _s) = build_service(FakeContexts::new());
+        let registry = Arc::new(ToolPolicyRegistry::new());
+        registry.set(
+            "assistant-req",
+            AgentToolPolicy::new(
+                vec![tool.to_owned()],
+                Some(IssueRef::from_str("#7").unwrap()),
+                true,
+            ),
+        );
+        let ticket_tools = Arc::new(FakeTicketTools::default());
+        let server = server(service)
+            .with_ticket_tools(ticket_tools.clone())
+            .with_tool_policies(registry)
+            .for_requester("assistant-req");
+
+        let raw = tools_call(id, tool, arguments);
+        let response = server.handle_raw(&raw).await.expect("reply owed");
+        assert!(
+            response.error.is_none(),
+            "bound issue should pass policy for {tool}, got {:?}",
+            response.error
+        );
+        let result = response.result.expect("tool result");
+        assert_eq!(
+            result["isError"],
+            json!(true),
+            "fake provider intentionally returns a tool error after policy passes"
+        );
+        assert_eq!(ticket_tools.calls(), vec![tool.to_owned()]);
+        assert_eq!(
+            ticket_tools.mutation_attempts(),
+            1,
+            "bound {tool} should reach the ticket provider exactly once"
+        );
+    }
+}
+
 // ---------------------------------------------------------------------------
 // 3. Inter-agent delegation is exposed through MCP; reply protocol is not
 // ---------------------------------------------------------------------------