[kinqsradio]

Summary

• The ACP stdio bridge reads the run's MCP endpoint from an owner-only file (acp-mcp-endpoint) in the run folder, named by ORBYN_ACP_MCP_ENDPOINT_FILE; the endpoint is no longer in any argv or environment.
• The file goes with the run folder at run end; the token is revoked then too.
• Audit: Claude gets a path to mcp.json (0600, run folder), Codex gets its endpoint over stdin; neither exposes the token. Docs updated; the "known limit" sentence is removed, the one about command lines and environment stays.

Closes #528

Parity rows

none

Frames built

Frames built: none

Testing

• Review fixes: a warm-started Claude lead's mcp.json now lives in <data>/runs/warm-<id> (0700, removed when Orbyn drops the process or at the run's end, swept at start-up) instead of the temp folder; open_raw takes an explicit run folder; SPEC section 11 updated. The real-service test asserts the warm token file is under runs/warm-*/ and that no new orbyn-probe-* folder holds /mcp/.
• CI covers the rest.
• Real orbynd + fake ACP agent: the bridge's live argv and environment (read by sysctl KERN_PROCARGS2 on macOS, /proc on Linux) hold the file path and no token; the bridge lists tools and acp-mcp-call works from the file; the file is mode 0600; the run folder is gone after the run.
• Unit tests for the file, the stdio entry and the Claude args; CLI tests refuse a missing or empty file and the old variable.
• Not tested: Windows file ACL (inherits the app-data folder ACL); no real third-party ACP agent; the Claude test builds its file the way launch does rather than starting Claude.

Co-authors

none

AI usage

• Written by hand, with no AI
• Harness and version: Claude Code 2.1.321
• Models: claude-sonnet-5-5 (implementation)
• Effort: medium
• Human role: assigned the task and its boundaries; review pending
• Sources: none

Checklist

• Works on Windows and macOS
• docs/architecture.md with any rule change
• No copied source, secrets, credentials or personal data; no AI attribution in commits, title or branch