Add create and update support for IDP entities, scorecards, and checks.

[harjas27]

Expose write operations in the idp toolset so agents can manage catalog entities via YAML and scorecards/checks via JSON bodies round-tripped from harness_get.

Description

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other

Checklist

• pnpm test passes
• pnpm typecheck passes
• pnpm build passes
• pnpm standards:check passes (architecture guardrails — see docs/coding-standards.md)
• pnpm docs:check passes (if registry/tool counts changed)

Coding Standards (registry-driven MCP model)

If this PR adds or changes Harness API coverage:

• No new server.registerTool() calls — only toolset definitions in src/registry/toolsets/
• Toolset registered in ALL_TOOLSETS and ToolsetName union
• operationPolicy on every new/changed endpoint
• Shared response extractors from src/registry/extractors.ts (no raw passthrough on real endpoints)
• identifierFields and scope declared on new resources
• No console.log() in src/ (stdio JSON-RPC safety)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

PR Risk Assessment — Low

Decision: Approved (no reviewer assignment required)

Evidence from diff

Area	Assessment
Files changed	3 — src/registry/toolsets/idp.ts (+286/−32), 2 new test files (+448)
Core systems	No changes to dispatch, auth, transport, or consolidated tool handlers
Behavior	Adds create/update for idp_entity, scorecard, and scorecard_check via declarative toolset definitions
Risk controls	All write ops use operationPolicy: { risk: "low_write" } with elicitation; skipScopeBodyInjection set correctly
Tests	Comprehensive unit tests for path builders, body validation, HTTP method/path, and policy metadata
Infra / security	None

Rationale

This follows the established registry-driven pattern used across 20+ toolsets (connectors, pipelines, governance, etc.) for adding write coverage. Changes are isolated to the IDP toolset with mechanical extraction of buildIdpEntityScopePath. Blast radius is limited to IDP catalog mutations, which are gated by the server's existing elicitation and low_write policy. The author (harjas27) is the primary contributor to idp.ts.

Reviewers

None assigned — risk is below Medium threshold. No CODEOWNERS file in repo. No existing reviewers on PR.

  

_{Sent by Cursor Automation: Assign PR reviewers}