MCP approval requests are omitted from the serialized client response

[leseb]

Clawpatch finding

• Severity: high
• Category: api-contract
• Confidence: high
• Feature: feat_custom_apis_openai_responses_mcp_tools_agentic
• Finding ID: fnd_sig-feat-custom-apis-openai-resp_87c89eb6b9
• Run ID: 20260831T084522-15333f
• Reviewer model: gpt-5.6-sol via the local Codex provider at xhigh
• Prior overlap: Re-reported from the immediately preceding run (fnd_sig-feat-custom-apis-openai-resp_3e0e77df68). Related to approval lifecycle work in feat(openai): complete MCP approval request/response round trip #637, but this is a concrete response-serialization bug.

Evidence

• apis/src/openai/responses/agentic_loop/mod.rs:45-48
• apis/src/openai/responses/agentic_loop/mod.rs:488-503 (finalize_response_body)
• apis/src/openai/responses/mcp_dispatch/mod.rs:117-145 (McpDispatchFilter::handle_approval_required)
• apis/src/openai/responses/mcp_dispatch/mod.rs:220-241 (McpDispatchFilter::on_response_body)
• apis/src/openai/responses/mcp_dispatch/tests.rs:1008-1033 (on_response_body_approval_emits_correct_arguments)

Description

AgenticLoopFilter runs first on the response path and serializes the current accumulated output into the body. McpDispatchFilter subsequently discovers that approval is required, appends an mcp_approval_request only to ResponsesState, and ends the loop without modifying or reserializing the actual response body. The default approval policy is fail-closed, so this affects MCP tools unless require_approval is explicitly never.

Reproduction

Send an MCP tool declaration without require_approval: "never" and have the model return the corresponding encoded function_call. Inspect the final response body: the state contains an mcp_approval_request, but the body returned to the client does not.

Recommendation

Ensure approval synthesis occurs before final response serialization, or give McpDispatchFilter read-write response access and rebuild the response body after appending the approval event. Preserve accumulated usage and output while doing so.

---

Reported from a Clawpatch review of apis/src at commit 543259683b9ff9a3f42772703a6d9ca134948475.

[leseb]

This issue requires human review before any work can begin. Do not self-assign and Do not submit a PR before the issue has been validated.

[Artemon-line]

Looks legit, I'll take a look.