MCP 2026-07-28 readiness: Waves 0-2 + adversarial review round (16 defects found and fixed)

[Weegy]

MCP 2026-07-28 readiness — Waves 0, 1, 2 (+ Wave 3 investigated and deliberately excluded)

Consolidated PR for the MCP issue cluster #540–#547. Twelve independently built and independently verified units, merged in collision order. No SDK change — everything runs on the installed @modelcontextprotocol/sdk@1.29.0; see the Wave 3 section for why that is now a deliberate, evidence-backed decision rather than a deferral.

133 files, +24652/−2664, 83 commits. Migrations 0031, 0032, 0033.

An adversarial codex review (GPT-5.x, high effort) was run over the finished branch and found four security defects and twelve correctness defects. All are fixed in this PR — see "Review round" below. Two of them change what this PR means, so they are stated up front rather than buried.

Caution

This PR silently switched the Privacy Shield v4 data plane ON for streaming turns — it was previously inert.
dispatchToolDeadlined reads turnContext.current()?.privacyHandle. Because the streaming turnContext store was empty (the enterWith-in-an-async-generator defect fixed here), that handle was always undefined on chatStream. Consequence: no v4_* tools were served, no raw-result capture, no canvas tap, no sub-agent dataset bridge — and no masking or interning of tool results at all. An operator running a privacy.redact@1 provider has been sending unmasked tool results to the LLM on every streaming turn.
The fix closes a real pre-existing hole. It also changes observable behaviour for anyone tuned against the old state, and MCP audit attribution flips from unattributed/null to real values at the deploy boundary, so persisted telemetry changes shape. This was found by the review, not by the implementing unit — it is the "fifth consumer" that the four accounted-for behaviour changes missed.

Caution

Correction to an earlier claim in this PR: masking did NOT fail closed on the public endpoint's error path.
Both dispatch branches returned this.errMsg(error) directly, skipping afterDispatch and therefore skipping masking entirely; the endpoint's maskingFailed() check could not catch it, because masking never ran and so never "failed". A tool raising Fault: Invalid field 'x' on record {'id':42,'name':'Jane Doe','email':'jane@acme.de','vat':'DE811234567'} returned that string verbatim to an external caller. Fixed below. The "fails closed" claim was true for the intern path only.

Why the issues' dependency graph does not apply

Seven of the eight issues declare "depends on #540". Verified against the shipped packages, six are nominal: sessionIdGenerator: undefined, experimental/tasks/, outputSchema/structuredContent, and even resultType/inputRequests (via a passthrough ResultSchema) are all available in the installed 1.29.0. Several issue bodies also carry premises that do not match the code — corrections are noted per unit and should be folded back into the issues.

---

Wave 0 — live defects found during analysis (in no issue)

W0-1 — MCP OAuth: RFC 9207 iss validation, explicit delegation, single-flight refresh. The callback trusted state alone; iss is now validated before exchangeCode, with reject tests asserting the code was never exchanged, zero token rows, zero vault writes. The silent 'operator' userKey fallback was a confused deputy — a channel turn with no mapped identity acted with the operator's authority at the customer's MCP server; all three call sites now fail closed, and onAuthFailure fails closed before starting a flow (starting one would bind a token to whoever clicks through). getValidAccessToken single-flights per (serverId, userKey) so a lost race cannot revoke a rotating refresh token.

Warning

Operator-visible. Migration 0031 is deliberately asymmetric: every existing mcp_servers row holding a stored operator token is set to delegation = 'service', preserving today's behaviour; only new servers default to the safe per_user. A fail-closed default for every row would break installed deployments whose channel users reach MCP servers today because of the fallback. Operators must review each grandfathered server in the MCP Control Center.

W0-2 — per-tool dispatch deadline. There was no per-tool timeout anywhere, and because the batch is Promise.allSettled, one slow sub-agent blocked the whole parallel batch for the entire turn. Every dispatch now races an AbortSignal deadline with a late-result firewall. callTool passes explicit RequestOptions. -32001 was classified transient, contradicting looksTransient()'s own doc comment, so a genuine Unauthorized was retried — fixed; the once-retry mitigation for the flaky hosted proxy is untouched.

W0-3 — deterministic tool ordering. Prompt caching is live, but the tool block was assembled in plugin-load and created_at order with no sort — stable within one process, divergent across Fly machines and deploys, silently dropping the cache for the whole block. Dynamic segments are now name-sorted; collision precedence is asserted by name, not position. cache_control turned out not to be observable where expected (llmProviderSeam collapses it into a request-level cacheHints.tools boolean), so tests assert that plus a deterministic last element and golden-snapshot LlmRequest.tools. #545 rescoped: its caching half rests on a false premise — hydration reads discovered_tools JSONB and never calls listTools, so steady state is ~4 wire calls per server per day, and a TTL cache would re-advertise repurposed tools inside exactly the window #454's scan-verdict gate exists to close. Not built, by decision.

W0-4 — CI actually applies middleware/migrations. MIGRATION_DOMAINS omitted the domain holding 0001–0030 — the entire MCP schema plus every dev-platform migration had shipped without ever being applied or idempotency-checked in CI. No latent defect was exposed, and that is verified, not assumed: all 30 apply and re-apply cleanly in both domain orderings and with rows present, and a deliberately non-idempotent CREATE TABLE was injected as a negative control and was caught on pass 2. Adds mcpRegistrySchema.pg.test.ts, the first pg coverage for MCP at all, isolated in a dedicated schema — the first version used CREATE/DROP DATABASE, which is cluster-wide and deterministically cancelled 29 tests in concurrent suites.

W0-5 — first real McpManager round-trip test. The repo had zero tests of a successful client→server round-trip: one stub dialled a refused port, another stubbed listTools, a third stubbed the whole loopback. The single real-protocol test exercised the server, not the client.

---

Wave 1 — stateless-ready, no SDK change

W1-1 — deprecate the legacy HTTP+SSE transport. Canonical marker, additive transportDeprecated on the serializer (no migration, DB CHECK untouched), operator picker gates sse behind a toggle with a badge on existing rows. Never hard-blocked. 'sse' stays in every union including the published plugin-api contract — narrowing it would be a semver break. The issue missed a second registration path: the marketplace importer mapped catalog remote.type containing sse straight through, so a UI-only change would not have achieved the stated goal. pickRemoteCandidate() now scans all remotes[] and prefers a non-deprecated one.

W1-2 — genuinely stateless loopback server. #540's one-line framing is wrong: sessionIdGenerator: undefined is supported, but the SDK throws 'Stateless transport cannot be reused across requests' on second use — a bare flag flip makes only the first request work and 500s everything after. Server + transport are now built per request with teardown in a finally. Non-POST returns 405, because the per-request transport leaks on GET (an SSE stream never ends, so handleRequest never resolves).

W1-3 — preserve structuredContent, capture outputSchema. Both are preserved via an out-of-band sidecar sink, deliberately not a widened return type: NativeToolHandler: Promise<string> is a published contract every tool implements including private plugins, and the privacy branch guards on typeof result === 'string', so widening would bypass Privacy Shield entirely. The sink's union was pre-shaped for 'input_required' — which is exactly how W2-1 docked onto it. #547's canvas framing is stale: omadia-ui-orchestrator (3075 LOC) and canvas-core (2041 LOC) already do deterministic payload→column binding; MCP tools simply could not feed it.

---

Wave 2 — capabilities

W2-1 — MRTR resultType: "input_required". Client-side, riding the existing ask_user_choice drain as a two-turn flow. Turn suspension was ruled out: there is no per-turn suspend/resume store, and parking mid-tool-loop would blow through every proxy and Teams idle timeout. The store is keyed {userId, sessionId, correlationId} — sessionScope alone is a known cross-user hole (#445). The card carries mandatory server attribution, because a server can now request arbitrary free text mid-call and a hostile one could otherwise phish credentials through a card that looks like omadia's own UI.

The replay is a NEW tools/call in a LATER turn against a possibly reconnected transport, not the in-flight retry MRTR describes. Indistinguishable for a stateless HTTP server; not equivalent for a stdio server holding process state tied to the original call.

W2-2 — generalize long-running tools (#543, rescoped). MCP Tasks does nothing for the stated motivation — internal sub-agent dispatches never cross an MCP boundary — and SEP-2663 is absent even from SDK v2. So the goal was taken as "sub-agents stop blocking turns": a generic lease-fenced TaskStore seam plus defineLongRunningTool(), with dev_job as first implementor unchanged and a genuine second consumer (deferred sub-agent dispatch, tested against a real LocalSubAgent). A chat turn is never parked — always handle plus streaming card. Deferred-result privacy is solved for the data path: a result reaches the model only via <tool>_status, an ordinary tool call inside a live turn, so interning moves from completion time to poll time.

W2-3 — public stateless MCP endpoint (#542). Merged dark: there is no UI or API to create key→agent bindings yet, so an operator would have to insert public_mcp_key_bindings rows by hand. Safe to merge, not yet operable — the admin surface is the obvious follow-up.

Scopes: mcp:list / mcp:invoke / mcp:write:<tool>. The wildcard exclusion lives inside hasScope rather than in a parallel matcher, because a parallel matcher gets forgotten and still returns true for *. Bare mcp:write is rejected at mint time. Isolation comes from the binding column plus per-row filtering; no row ⇒ zero tools. Masking fails CLOSED here (internToolResultV4 never throws, so the dispatcher's fail-open branch is unreachable) — a deliberate divergence from the chat path, which fails open. Intern-exempt tools are permanently unservable, since the exemption is checked before the handle.

W2-4 — CIMD as a third client-acquisition mode (#546). The issue's premise is false — the registry does not support only static headers; a full OAuth 2.1 + PKCE stack shipped in #459 W9. Chain: stored → cimd → dcr (deprecated, warns) → manual. Entra and Okta do not support CIMD; they use pre-registered app registrations, for which the correct path is the existing manual client. Both paths are therefore permanent and first-class. The metadata URL derives from FLOW_PUBLIC_BASE_URL alone, deliberately not the ?? PUBLIC_BASE_URL fallback the redirect URI uses — that defaults to http://localhost:3979, precisely the shape that is not inbound-reachable. Unset → 501 naming the knob and the manual alternative; CIMD requires the IdP to fetch omadia, which is impossible behind a corporate firewall.

---

Cross-cutting fixes (found while building the above)

W3-B — dispatch privacy seam + idempotency. The SEAM comment misattributed its own subject: masking lives in dispatchToolDeadlined, not dispatchToolInner (84 lines of pure branch selection with zero privacy code). Routing through the orchestrator would therefore not have masked anything, and cliSubAgent builds a ToolDispatchService with an intentionally empty registry where an Orchestrator dependency is unsatisfiable — and would have widened that sub-agent's tool surface. So the privacy-relevant subset was replicated in the orchestrator's exact order, with an explicit privacy dependency plus ambient fallback, and an optional ALS-propagated caller context. WriteCapability existed but had never been wired; it is now the write source of truth, not name-derived. Two real defects fixed en route: a cache key that collided (("a:b","t") and ("b","t:a") mapped to one entry, letting one caller replay another tool's stored write result), and writeCapabilities being unreachable from the plugin-facing accessor — without which every real Odoo/M365 write would have stayed unprotected while unit tests passed.

W3-A — four pre-existing defects.

1. turnContext was empty inside tool handlers on the streaming path. Sharpened diagnosis: enterWith in an async generator survives until the generator's first suspension, so readers before the first yielded event worked by accident — everything at or after tool dispatch got an empty store. Fixed with turnContext.runGenerator. Four behaviours now activate on every streaming turn: skill-bound MCP tools were previously refused unconditionally; chat-launched dev jobs failed closed on missing userId; MCP→KG ingestion now attributes aclOwners; and — note this one — plugin memory writes landed under the default Agent namespace instead of the acting one, so there will be a seam between older and newer entries. Gap reported, not closed: no production code sets mcpUserKey on a chat turn, so a per_user server there still audits unresolved. That is a product decision.
2. embeddingGateWriteFence.pg.test.ts — a test bug, not a product bug. An unqualified DROP TABLE IF EXISTS in the only suite with public on its search_path fell through to public.*; two of those tables have no dependents, so the same fall-through was silently dropping sibling suites' tables. It only surfaced because a third table had a foreign key.
3. DevJobStore.findStalled gained a scope predicate, restoring a pg sweep test that had been downgraded to a unit test.
4. Timeout hierarchy: the dispatch deadline sat inside the MCP ceiling, so the outer bound was tighter than the inner one. Now 240 s, with an invariant test that fails from both directions if a future edit re-inverts them.

---

Wave 3 — the v2 SDK port: investigated, and deliberately NOT included

The port was attempted last, after everything above was green. It was stopped before a line was written, on evidence.

• Porting to v2 does not give you 2026-07-28. v2's LATEST_PROTOCOL_VERSION is still 2025-11-25 and SUPPORTED_PROTOCOL_VERSIONS contains no 2026-07-28. It is a separate "modern era" negotiated via server/discover + versionNegotiation, deliberately kept out of the initialize list. A real round-trip negotiated era=legacy — protocol-identical to v1. The port alone buys zero protocol capability.
• Blocking silent behaviour change: in v2's legacy era the client unconditionally strips resultType from every decoded tools/call result, while other unknown keys pass through. The strip happens in the codec's inbound decode, before any caller-supplied schema, so a lenient schema cannot recover it. isInputRequiredResult() would return false for every result — MRTR (W2-1) would silently stop parking calls, audit them as ok, and hand the model an empty result. No repo test would catch it: after a port the MRTR tests use a v2 Server that rejects our inputRequests shape server-side for an unrelated reason, masking the real failure.
• Also wrong in Upgrade @modelcontextprotocol/sdk to MCP 2026-07-28 (stateless core): McpManager + LoopbackMcpServer #540 and in the port plan: McpError/ErrorCode do not exist in v2; setRequestHandler takes a method string, not a Zod schema; callTool lost its schema parameter; PerRequestHTTPServerTransport returns a Web Response while both servers are Node http, so it would mean more hand-rolling, not less; and there are 8 importers, not 2.

Recommendation: split #540 into a spike for the resultType strip (likely needs an upstream question — it gates MRTR) and a separate PR for the mechanical port. Never fold it into this PR: it would swap the foundation under twelve green units for zero protocol gain until modern-era negotiation is also adopted.

---

Review round — adversarial codex pass over the finished branch

Two codex exec reviews (gpt-5.x, reasoning_effort=high, read-only sandbox) were run against the completed branch, deliberately prompted to falsify the implementers' own claims rather than to summarise the diff. Both initially timed out on the 300 s cap; re-running them one narrow target at a time, with source inlined so codex verified instead of exploring, is what produced results.

Security findings, all fixed:

1. HIGH — unmasked tool error text reached public callers (the disclosure above). Fixed with a dedicated maskErrorText, deliberately not by reusing afterDispatch: raw capture is documented as receiving "the tool result" and its consumers treat it as business data, so feeding a driver stack trace in writes query fragments into row-shaped sinks; and the operator bypass is consent about a tool's declared output shape, which arbitrary exception text is not. Only the intern exemption and internToolResultV4 transfer. A new origin: 'tool' | 'dispatcher' field lets the assertion distinguish handler-authored content from the dispatcher's own refusal strings — absent ⇒ treated as 'tool', i.e. fails closed.
2. MEDIUM — the control that would have caught chore(deps,ci): Bump docker/build-push-action from 6 to 7 #1 was dead code. publicMcpPrivacy.masked() existed, documented as "lets the endpoint assert that the boundary was actually crossed rather than skipped", and was never called anywhere. It is now a required assertion on the public response path — this is the structural fix that makes chore(deps,ci): Bump docker/build-push-action from 6 to 7 #1 unrepeatable.
3. MEDIUM — migration 0031's backfill was broader than its own header. It tested for any mcp_oauth_tokens row rather than an operator token, so a server holding only e.g. user_key='alice@corp.com' was flipped to delegation='service'. Immediate effect is fail-closed breakage, but it silently converts a per-user server to shared identity with no operator decision. Predicate narrowed; 0031 had never been applied anywhere, so it was corrected in place.
4. LOW — tools/list and tools/call used different predicates, so a tool named in a binding but not advertised by the agent was hidden from list yet accepted by call, and the differing error shapes were a weak oracle for binding contents. One predicate now, uniform rejection message.

Correctness findings, all fixed: crossed claims stranding two same-kind tasks for 15 min under dead leases; a successful result discarded when the lease had been reaped; the orphan reaper force-failing tasks legitimately parked on a human; the once-retry making the effective MCP ceiling 2 × 180 s = 360 s and thereby re-creating the very timeout inversion this PR set out to remove; assertOuterIsLooser() existing only in a test file so OMADIA_TOOL_DISPATCH_TIMEOUT_MS=90000 re-created the inversion with green CI (now enforced at boot); teardown errors replacing the original exit reason; a reaper setInterval that did not await its previous sweep (36 concurrent sweeps observed without the guard); in-flight idempotency entries that never expired; and three comments asserting invariants the code did not hold.

Claims that survived the review, listed because a review that only reports failures is not evidence of anything: * genuinely cannot grant mcp:write:<tool>; a missing/malformed/NULL binding row yields zero tools with no permissive default; iss is validated before exchangeCode and a mismatch persists nothing; no token, code or code_verifier reaches a log line; the idempotency cache key is provably injective; replayDepth is capped; the terminal guard does stop a zombie worker; looksTransient correctly excludes auth errors.

One SUSPECTED finding was refuted rather than patched: pendingMcpInput.claim() is trust-on-first-claim, but the record carries no userId/sessionId to compare against — binding at claim time is how it acquires them, the correlationId is a random UUID learned only from the parking call's own result inside the same turn batch, and replay is enforced by take() on the full triple.

Known-limitation honesty: a parked task cannot currently be resumed through the seam at all (requireInput releases the lease, claimNextPending only picks working), so finding 3's reaper bug was latent rather than live — nothing calls requireInput in production yet. Worth its own issue. Likewise the sub-agent dataset-registration leak after a dispatch abort is bounded by turn lifetime and needs a new published @omadia/plugin-api method to unwind properly; the comment now states that precisely instead of overclaiming.

Verification

Gate	Result
middleware build / lint / typecheck	PASS · 0 errors, 1 warning (pre-existing unused eslint-disable, present on main)
middleware test	5740 tests / 5736 pass / 0 fail / 4 skipped, 1215 suites
web-ui lint / typecheck	PASS · 0 errors, 40 warnings (known baseline)
web-ui test	57 files / 427 pass
web-ui i18n:check	PASS — en/de parity (not in CI, run locally)

The final run is fully green on an idle machine (load ~17). Earlier runs at load ~214 produced a failure and once an outright kill — npm test forks a Node process per test file, so results under heavy load are noise. That retroactively explains most of the "disjoint failure sets" several units reported: it is largely a load artefact, not a test-design problem. Note the total differs between runs (5740 here vs 5884/5920 in unit reports) because those runs had a Postgres container up and these pg suites are skipped without one — not a silent skip.

Run with a real npm ci, not a symlinked node_modules: symlinking makes @omadia/orchestrator resolve against the main checkout, so orchestrator edits are silently not loaded and tests pass without exercising them.

~120 mutation checks across the twelve units and the review round, every one verified by deliberately breaking the invariant, rebuilding and re-running until a real assertion failed — not by counting mock invocations. Several survived first attempt and were treated as findings rather than explained away: the buffered runTurn path had no coverage at all; chat/page.tsx's strip logic was untested; and a terminal-immutability guard was unreachable because finish cleared the lease — fixed by correcting the semantics so the guard became load-bearing.

Caution

A mutation harness committed sabotaged production code and it was caught by audit, not by tests. A git add -A raced a mutation run and shipped toolTimeoutMs as return 2_147_483_647 — the per-tool timeout disabled. Found by auditing every mutation target against HEAD rather than trusting the harness's own revert, fixed, and guards added (refuse dirty tree, non-zero exit on leftovers). The merged tree was independently re-checked: no such value and no mutation markers remain in production code.

Important

MANUAL VERIFICATION REQUIRED BEFORE MERGE. The stateless loopback (W1-2) could not be verified against the real claude CLI — spawning a nested session is blocked in the build environment. Installed CLI here is 2.1.220. If that CLI refuses to proceed when the server issues no mcp-session-id, the bridge yields a server with zero tools and the turn degrades to a toolless answer instead of erroring — no automated test catches this.

Needs sign-off before the public endpoint is ever enabled

1. Write tools on a public endpoint at all — the implementing agent recommends read-only for v1 and describes every mitigation as a compensating control for a decision it would reverse.
2. PUBLIC_MCP_ALLOW_WITHOUT_PRIVACY_MASKING — arguably should not exist.
3. Keys share a vault namespace with the chat ingress; scopes separate the surfaces, but a compromised key is compromised for both.
4. No key rotation or expiry — revoke-only.
5. Rate limits are in-memory per process; a restart or a second instance multiplies the effective write budget.
6. Idempotency is not distributed — two instances both execute a write.
7. captureRawToolResult logs pre-masking byte counts to stdout.

Follow-ups this PR creates or leaves open

Admin surface for public_mcp_key_bindings (endpoint is unusable without it) · a producer for mcpUserKey on chat turns · plugin-memory namespace seam (existing notes stay under default) · omadia-as-MCP-server input_required · a durable second TaskStore implementor and an MCP-Tasks projection · mcp_call_log.outcome column · #540 split per the Wave 3 section · #547's canvas half (needs a paired omadia-ui PR and a policy decision on whether a third-party server may drive the canvas) · #540's pooling simplification (the pool is also the OAuth-invalidation unit and holds stdio child processes).

Closes #541
Closes #546

Refs #540, #542, #543, #544, #545, #547

#543 and #545 are complete against their decided scope but not their literal titles; #542's endpoint is merged dark pending an admin surface; #544 and #547 have their client/plumbing halves done here. Recommend retitling or closing rather than leaving them ambiguous.

---

Wave 4–6 — closing the gaps (2026-07-31)

A second pass over this branch, planned as six units and reviewed cross-vendor with
gpt-5.6-sol. Two findings came out of the review that neither the implementers nor I had
looked for, and one of them is a live production defect that was never in this PR's diff.

Ship-blockers found and closed

per_user MCP delegation was unreachable from chat

Migration 0031 made delegation explicit and gave new servers a fail-closed per_user default.
resolveMcpUserKey reads turnContext.current()?.mcpUserKey — and the only thing that ever set
it was the operator discover route. routes/chat.ts did not import turnContext at all. Every
newly created per_user server was dead from chat out of the box; existing installs were masked
only because 0031 backfills token-holding servers to service.

Both HTTP entries now open a turn scope carrying the identity. The streaming one uses
turnContext.runGenerator, not enter — enterWith binds to the async resource executing at that
instant and an async generator resumes in the caller's context, so the identity would be gone by the
orchestrator's first yield.

The value is sessionIdentity(req), deliberately not resolveUserId(req), which falls through
to the client-sent x-user-id header. Keying MCP tokens on a client-controlled header would let any
caller act as any user. The channel-side producer is gated on channelIdentity for the same reason.

⚠️ Known limit: channel turns resolve the canonical omadia uuid while /authorize stores tokens
under the session-shaped key, so an affected user still fails closed rather than reaching their
server. Closing it needs a new method on the KnowledgeGraph contract. Narrower than it sounds — a
per_user token can only exist for someone who completed /authorize, which requires a session, so
a channel-only user has no token and failing closed is correct for them.

The MCP input replay put raw tool output on the LLM wire

Found by cross-vendor review. Live in any deployment with a graph pool, and not in this PR's
original diff.

Privacy Shield v4's boundary is server ↔ LLM provider, not server ↔ browser. The replay that
runs after a user answers an MCP input card called mcpManager.callTool directly rather than going
through dispatchTool, so its result was never interned — and was then interpolated verbatim into
the note folded into the turn's ingested text. A replayed HR or accounting tool returning a
personnel row sent that row to the model in cleartext.

The comment above the interpolation shows this was a near-miss rather than a decision: it reasons
explicitly about the LLM wire, but only about the user's typed values, and overlooks the tool result
two lines below.

A revoked public-MCP key binding was silently re-armed

Revoke is the incident-response lever on an internet-facing surface, and any upsert that omitted
enabled undid it — answering 201 Created for what overwrote a deliberately parked row.

The real bug was at the validation layer, not the router: enabled: input.enabled ?? true turned
absence into assertion before the store could tell the difference. The field now stays absent
through validation and is resolved only where the current row is known, via COALESCE against the
table-qualified column — not EXCLUDED, which holds the row this statement proposed and resolves
straight back to the insert's true.

Making revoke sticky removed the only un-park path from the UI, so this adds POST /:keyId/restore
and a confirmed Restore button: un-parking is now an explicit act in an access log.

Also fixed

• Migration 0031 built neither of its guards reliably. A conname lookup with no relation
  filter is cluster-wide, so a same-named constraint in any other schema silently skipped the
  ALTER TABLE. A hardcoded to_regclass('public.…') in an otherwise unqualified file answered
  about a table the statement never touches. The backfill test previously rewrote the migration
  to make it apply; it now applies verbatim.
• An operator surface for public MCP key bindings. The endpoint's authorization is driven
  entirely by public_mcp_key_bindings rows, which could previously only be created in psql. The
  public endpoint still receives only the read-only store — it gains no write path to its own
  authorization table.
• A routine ran under the wrong MCP identity. The templated branch opened a fresh turn scope and
  the untemplated one did not, so a routine fired from inside a chat turn inherited the invoking
  user's identity — and behaved differently depending only on whether an output template happened to
  be configured.
• Test-suite timeouts in both directions. The middleware suite had none at all (Node defaults to
  Infinity, so a hang burned the 15-minute CI wall with no attribution); web-ui's was 5 s, below
  the honest 5–13 s cost of its heavier RTL suites, which manufactured failures rather than catching
  hangs. Four runs of an unchanged tree gave 0, 9, 25 and 0 failures purely as load varied.
• Raw NUL bytes in eight source files. Fifteen literal 0x00 separators made ripgrep classify
  those files as binary and stop reading partway through — silently truncating every audit that
  crossed them. Proven no-op: none is followed by an ASCII digit, and every changed literal was read
  back off disk and evaluated. This also turned out to be under-counting the decoupling ratchet by
  seven references.
• A NUL guard that blamed a space, and had no effective coverage — disabling it left the whole
  suite green.

Deliberately not done

• Pass through structuredContent + outputSchema from external MCP tools for canvas synthesis (omadia's answer to MCP Apps) #547's renderer. An earlier reading of the structured sidecar as a browser-bound PII leak was
  refuted by the review: the browser is the trusted side and receives real values by design. The
  renderer is deferred for ordinary reasons instead — a full-stack change on an already-large PR, and
  the sidecar bypasses Privacy Shield's receipt and dataset accounting even where masking is not
  owed, which wants a decision first.
• An exemption for the MRTR sentinel. MRTR is dead in any Shield-enabled deployment: the
  [mcp_input_required:…] marker is itself interned, so the card never renders. The obvious fix is
  worse than the bug — callTool returns server text verbatim, so a prefix-shaped exemption is
  server-forgeable: any MCP server could prefix an ordinary result and opt itself out of
  interning, silently. A safe exemption must key on provenance, which is a design decision with an
  owner. Filed rather than guessed.
• Durable TaskStore and resume path, reaper fencing, the @modelcontextprotocol/*@2 port, MCP
  pooling simplification, and a keyId/agentId existence check — all filed as follow-ups.

Verification

Every new assertion was mutation-checked: break the production line it claims to cover, rebuild,
re-run, confirm it fails for the stated reason, restore. That discipline earned its keep three
times — a suite that hung instead of going red because a throwaway server was closed after its
assertions rather than in a finally; a mutation run that passed over deliberately broken code
because the test imported through a package barrel; and a mutation harness that corrupted the module
under test and would have reported "caught" for the wrong reason.

Gates: middleware 5831/5835 (4 skipped, 0 failed), web-ui 427/427, typecheck clean, lint 0
errors, i18n 3335 keys in both locales, decoupling ratchet held.