[rhein1]

When a caller supplied context.authentication, the MCP host adapter included that capability in the frozen context passed to the trusted plan resolver before authorization, including when no portable-handle boundary was installed. This fixes the post-merge finding in #451: #451 (comment).

Planning now receives only signal, timeout_ms, deadline_at, and operation. The original authentication capability travels separately and is added only to the frozen portable-handle authorization context. Plan validation still precedes handle admission, and admission still precedes provider allocation. The reviewed hosted bundle and integrity manifest are regenerated from this source.

Validation:

• Three authentication-isolation regressions failed against the original source and pass with the fix. They check property, reference, and serialized-marker absence during discovery, an accepted session request, rejected authentication, and boundary-absent operation; authenticate retains the exact capability and bounded signal/timing context.
• Invalid-plan regression confirms zero authentication, registry lookup, or provider operations before rejection.
• Focused host/portable-handle suites: 19 passed, 20 existing skips, 0 failed; includes identity, expiry, replay, contract, and receipt checks.
• Full Risk Fork suite: 584 passed, 150 existing platform/database skips, 0 failed (Windows, Node 24.13.0).
• Hosted artifact suite: 16/16 passed; exact source-integrity verification passed.
• Source syntax (64 files), integrations schema/counts, rename-preflight content, and git diff whitespace checks passed. Rename-preflight needed local LF normalization; no documentation content changes are included.

Local dependencies were reused from an existing qualification checkout without downloading or changing installed environments. No live PostgreSQL test target was configured for this run, so database integration and POSIX-only cases require CI evidence. This is a source-only repair; production qualification and activation gates remain unchanged. The parallel SkillSpector repair is intentionally separate.

Exact-head CI: all 23 checks passed at ead883d. This includes the PostgreSQL/TLS authority suite, core Node 20/22/24 matrix, managed-service matrix, hosted bundle, conformance, CodeQL, and Linux/macOS/Windows artifact extraction. Risk Fork run, artifact matrix, contract validation.

Current-main refresh by the owner-authorized local coordinator:

• Signed head dce682149083c287ea2b227ffe90a5cb2345fa60 preserves main a1ebf825816e9695f479cfc057c3bee9ef062238 through normal merge ancestry, without rebase/force push.
• Only the two generated hosted files conflicted; rebuilt from the combined reviewed source. The final diff remains four scoped paths.
• Linux focused host/portable-handle suite: 35/35 passed, zero skips; Windows focused suite: 16 passed, 19 explicit filesystem-platform skips, zero failures.
• Hosted bundle/packed consumer: 16/16; source integrity sha256:1bbc14bc4b6a32fe9a0b9ef057f3b95baf58a4bf7e04c1d8bdfe49837cc2e697.
• Core/hosted npm audits: zero vulnerabilities. Docs/count/preflight, syntax and staged credential/private-boundary checks pass.
• Independent read-only AI review found no remaining authentication-containment/source blocker. All operational qualification and activation gates remain open.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T03:26:23.626686Z	ead883d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[jmborden1112-beep]

Owner-controlled secondary-account approval authorized by the solo maintainer, not independent human review. Exact signed head dce6821: independent read-only AI review found no remaining auth-containment blocker; Linux focused suite35/35 zero skips; hosted/packed16/16; all23 refreshed-head CI checks pass. Production/default-off authority gates remain unchanged. Normal protected merge only, no bypass requested.