Browser Game Control and Video MCP Candidate Enters Acceptance
The local candidate adds semantic browser bridges for 2048, Hextris, A Dark Room, and Life Restart, plus owner-OAuth pairing, observation, action, pause, and close tools. Video phase one only manages and atomically publishes YouTube/Bilibili external-link records. The new Worker is not deployed or production-accepted;
# Browser Game Control and Video MCP Candidate Enters Acceptance
The repository now contains a local candidate for the next capability phase. It has not been deployed to the production Worker and has not completed production OAuth, Durable Object, or real-browser end-to-end acceptance.
## Browser game-control candidate
- 2048, Hextris, A Dark Room, and Life Restart now each expose an audited semantic bridge. AI clients may use only opaque `actionId` values offered by the page at the current revision; selectors, scripts, raw keys, coordinates, URLs, and arbitrary DOM commands are rejected.
- Candidate remote tools cover `game_browser_pair`, `game_browser_observe`, `game_browser_actions`, `game_browser_act`, `game_browser_pause`, and `game_browser_close`. They require a separate `games:play` scope, a current administrator recheck, one-time browser pairing, and revision CAS. The page accepts only one pending command at a time and gives the player visible lock, pause, take-back, and close controls.
- These tools are not yet present in `availableTransports`. They can be declared available only after the new Worker is deployed and production OAuth consent, Durable Object relay, and real-browser end-to-end acceptance all pass.
- Kittens Game remains `NO_AGENT`. Its WET PAWS LICENSE requires explicit permission or legal confirmation, and the four other bridges do not justify bypassing that boundary.
## Video MCP phase one
The candidate video tools provide management list/get, atomic publish, CAS update, metadata refresh, and confirmed delete for YouTube, Bilibili, and b23.tv external-link records only. Publish, update, and delete retain unique `operationId` values, durable idempotency receipts, audit records, and a current administrator recheck. Update/delete require `expectedUpdatedAt`, and delete also requires literal `confirm: true`.
This is not hosted video-file upload. The remote MCP does not read local paths, Base64, raw bytes, or files from the MCP client's machine, and true file upload is not configured. A future hosted-upload phase needs a separate private R2 binary data plane with bounded multipart, quota, scanning, commit, and cleanup protocols.
## Shared Quick Transfer governance version
The shared `lib/capabilities/registry.mjs` change falls within Quick Transfer's governed paths, so the subproject advances exactly from v1.0.8 to v1.0.9 and refreshes its visible version and lazy-load cache chain. This patch records governance impact from the shared capability surface only; rooms, password derivation, AES-GCM text, private R2 files, quotas, multipart, authorization, and the 24-hour post-publication lifecycle are unchanged.
## Release boundary
The nine-tool knowledge acceptance completed on 2026-08-09 applies only to historical Worker bundle `fa295db6-302a-4a20-a2b1-ffe1ddafd75b`; it cannot cover this candidate. The current result means only that the repository implementation has entered local checks. Game remote tools and video management tools must not be marked production-available until the D1 migration, new Worker deployment, production OAuth, DO pairing, and real-browser act/pause/close lifecycle all pass.
