Report and canvas MCP tools reject the system agent's system-scoped key #2975

Summary

mcp__trinity__report and mcp__trinity__set_canvas / patch_canvas reject calls made with a system-scoped MCP API key, returning "requires an agent-scoped API key (it publishes a report as the calling agent)". This blocks the platform's own trinity-system agent from publishing reports or maintaining a canvas.

Context

trinity-system runs with the system-scoped MCP key (the one in its ~/.mcp.json; TRINITY_MCP_API_KEY is empty in its container). That key works for every read surface (list_agents, executions, schedules, operator queue, reports metadata) and for the REST API, but the report and canvas tools refuse it because they resolve the publishing agent from an agent-scoped key, and the system key carries no agent identity.

Impact

• The daily /fleet-health run on trinity-system (07:40 UTC, Sonnet) skips its health card and its trinity_system.fleet_health report, falling back to ~/reports/ and the operator queue only.
• The weekly ops review (Sundays 20:15 UTC) is designed to publish a ranked decisions brief as a report plus a canvas block; it falls back to files and the queue instead.
• Any instance whose system agent is expected to surface fleet status on the Reports tab or a canvas hits the same wall.

Reproduction

Trigger any trinity-system execution and call:

mcp__trinity__report(report_type="trinity_system.test", title="t", payload={"markdown":"x"}, display_hint="markdown")

Observed on trinity.ability.ai, 2026-09-21 through 2026-09-23 (e.g. the scheduled fleet-health executions on trinity-system at 07:40 UTC each day).

Acceptance Criteria

• mcp__trinity__report succeeds when called with a system-scoped key, publishing under the system agent's identity (trinity-system) — OR the system agent is issued an agent-scoped key alongside its system key so the existing tool works unchanged.
• mcp__trinity__set_canvas / patch_canvas succeed under the same condition.
• A trinity-system execution can publish a trinity_system.fleet_health report end to end (verified against the scheduled 07:40 UTC run).
• Fix is covered by a case exercising the system-scoped key path, not just an agent-scoped key.

Technical Notes

Likely fix point: the publishing-agent resolution in the report/canvas MCP tool handlers currently assumes an agent-scoped key and has no fallback for a system-scoped key with a known agent identity (trinity-system).

Provenance

Requested by the operator (GitHub @vybe). Reported via trinity-system, execution MdPvBwmXEHmN4RieIQcCSQ.