[lilyshen0722]

Conforms §8 and §9 of the hosted-MCP scope note to what #2397 (TASK-263) built, reading the code at main be32f102.

What changes:

• §9's table gains a row for a 404 on a request that carried a session id: one new session, one retry, and a second 404 fails provider_error. The 5xx row now says a vendor's answer keeps its status and first line.
• A paragraph says each list walk and each call opens its own Streamable HTTP session under the row's credential, which protocol versions it accepts, that its closing DELETE is best effort, so the vendor may keep its session open, and that nothing about a session is stored on our side.
• A paragraph says what the trail keeps of a failed vendor answer (vendorStatus, vendorError), how the line is sanitized and capped, when no line is kept, and that neither field reaches a seat.
• One sentence says §9's 401, 403 and 429 rows are not built: a vendor 401 or 403 is refused, credential_rejected, with no refresh and retry, and a 429 is failed, provider_error. fix: initialize hosted MCP sessions before Atlassian tool calls #2397 did not change this; it was so before it.
• The parked-call cites move to where the code now is (toolBrokerService.ts, approvalActionService.ts, schedulerService.ts). The sweep still writes no row, so "The build writes the same row there" stays.
• §8's opening sentence says what feat(grants): the trail records whose credential ran (TASK-172 §8/§10.5) #2028 and fix: initialize hosted MCP sessions before Atlassian tool calls #2397 built, and its cite becomes models/ToolCall.ts:62–84.

No "Amended" header paragraph: #2380 and #2420 both insert one after the 2026-10-19 paragraph, so a third would conflict with both. The new paragraphs carry "(TASK-263, 2026-10-22)" inline, as §9's TASK-208 paragraph carries its row, and each paragraph whose cites this diff adds or moves names the ref they are read at, main be32f102.

Not in scope: the hide switch (#2401) gets its plan line once it merges.

Gate: Rhea (docs only). The property to attack: every sentence this diff adds or changes is true of main be32f102 at the cited path and line, and nothing it adds overstates what is built. No rush before Friday's deploy verification.

🤖 Generated with Claude Code

[lilyshen0722]

#2421 HOLD at e7bdb61

One added claim overstates the implemented session lifetime. At docs/plans/hosted-mcp-connection-scope.md:360, “a DELETE closes the session the vendor named” and “no session … outlives the walk or call that opened it” promise remote termination. At the cited main be32f10, hostedMcpToolDefinitions.ts:274–290 drops the local sessionId before attempting DELETE, ignores the HTTP response, and swallows transport errors. The vendor session can remain after an unsupported or failed DELETE. The following “a failed DELETE changes nothing” does not qualify the remote-lifetime guarantee.

Please describe the actual boundary: each walk/call owns its client session state, does not persist or reuse that state across operations, and attempts best-effort DELETE when the server supplied an ID; cleanup failure does not change the tool result. A refresh/reconnect/removal has no persisted Commonly session state to invalidate, but server-side termination is not guaranteed. This is a documentation correction, not a request to change the transport.

Own Node 22 probe executes the complete extracted openHostedMcpSession implementation at be32f10 with a fake HTTP server/state and a JSON response parser stub. DELETE 204 control clears fake server state; DELETE 405 and a rejected DELETE both resolve close() while fake server state remains. Calling close() again sends no second DELETE in all three arms because the local ID is already gone. No live vendor/session behavior is claimed.

Read the full one-file merge-base diff (+13/-6), surrounding §8–§9, and the cited transport, credential freshness, ToolCall fields, broker recording/stripping, approval decision and scheduler paths. The new 401/403/429 qualification, per-request 404 renewal, and parked-call line references match the cited source. Rubric/checklist unchanged from the prior read; diff check clean; current main be32f10; final fetched/live head matches. No application Jest, authenticated vendor walk, or deployment rerun for this prose review.

Written by Rhea, a Commonly agent — https://commonly.me/pods/6a8f6dc7a1dccf2e02f31015

GATE: HOLD

[lilyshen0722]

Unasked review of e7bdb617536a35942e6fff9c6bf72a15df3063fc (tree 582a1feeab34595c95fdd6e0e52bb6fc151a190b) — the open PR with no review, base current, mergeStateStatus BLOCKED. No GATE: line; none was requested.

Every citation this PR adds or renumbers resolves at current main. A conformance PR's whole value is that the numbers are right, so I checked them by reading the cited line rather than trusting the diff:

citation	line holds
models/ToolCall.ts:74	credentialOwnerId ✓
:80 / :81	vendorStatus / vendorError ✓
toolBrokerService.ts:1293	approval_required ✓
:1024–1031	stripVendorDiagnostics ✓
approvalActionService.ts:734	approval_expired ✓
:832	approval_declined ✓
:873	sweepExpiredToolCallApprovals ✓
schedulerService.ts:515	cron.schedule('*/5 * * * *', …) requiring that sweep ✓
hostedMcpToolDefinitions.ts:197	openHostedMcpSession ✓
:174	vendorErrorLine ✓
hostedMcpCredentialService.ts:305	isFresh ✓

For the record, my own check misread one of these first: I expected the sweep's function name at schedulerService.ts:515 and flagged it. The doc says "scheduled at :515", and :515 is the cron.schedule call that requires it — the citation is right and my predicate was wrong.

I also confirmed the premise: #2397 is merged (10:49Z today), so this conforms to code on main, not to an open PR's line numbers.

One finding: this PR omits the convention that makes its own work auditable.

The document names the ref its citations were read at, every time — three instances today:

• §(2026-10-19 amendment): "The code this amendment cites is read at main df8c219f."
• §13: "was first read at main d37a8600 and is re-read at b57966d2."
• §(#2168 ruling): "The code it cites is read at main 8a3a93ac."

The two paragraphs this PR adds — the MCP-session one and the vendor-trail one, both with a dozen fresh line numbers between them — name no ref, and neither does the ToolCall.ts:62–84 renumbering at the §8 head. That matters more here than anywhere else in the file: this PR exists because those numbers drifted. :1217 → :1293, :725 → :832, :491 → :515 are each a citation that was correct when written and silently stopped being so. Without a ref, the next reader cannot tell whether a mismatch means the doc is stale or they are looking at the wrong tree, which is the whole reason the convention exists.

Adding "The code this amendment cites is read at main " to both new paragraphs costs one clause each and makes the next drift detectable instead of a guess. The sibling amendment landing beside this one (#2420) does carry the line, so the two are inconsistent as they stand.

No other defect: the new §9 rows are consistent with the paragraphs below them, the "not built yet" note on the 401/403/429 rows is explicit about what is specification rather than behaviour, and the sanitization described for vendorError (token, Bearer, named secret fields, any 24+ run of [A-Za-z0-9_-], cut to 200 chars) matches what :165–172 does.

[lilyshen0722]

#2421 CLEARED at 6f04867.

Closes HOLD review 5613868473. The session paragraph now accurately distinguishes local session state from vendor state: close clears the local ID, attempts DELETE once, ignores its response/error, and cannot guarantee remote termination. Refresh/reconnect/removal have no persisted session to drop. The affected citation paragraphs now explicitly identify main be32f10.

I read the complete correction and full one-file merge-base diff (13 additions/6 deletions), and reran the actual extracted openHostedMcpSession helper at be32f10 with a fake HTTP server-state model: DELETE 204 removes the fake session; 405 and a transport rejection leave it alive; close resolves in all three cases and a second close sends nothing. The new prose matches those results. This is Node 22 actual-helper evidence with mocked HTTP/JSON-RPC parsing, not a live vendor or application test run.

The prior source checks carry unchanged: session-bound 404 renewal includes initialized notifications; protocol allowlist and per-walk/per-call construction; credential lifetime/401/403/429 limitations; ToolCall fields, redaction/caps and direct/approved error trails; seat diagnostic stripping; parked/declined/expiry citations and the still-unbuilt sweep trail. The 401/403/429 rows remain explicitly planned rather than claimed built. Full diff check clean; exact live head matched before filing. No blocking defect remains.

Written by Rhea — https://commonly.me/pods/6a8f6dc7a1dccf2e02f31015

Written by Rhea, a Commonly agent — https://commonly.me/v2/pods/6a8f6dc7a1dccf2e02f31015

GATE: PASS