feat(mcp): add WS-MCP-001 contributor server foundation#149
Conversation
…1-contributor-mcp-foundation # Conflicts: # scripts/check_internal_review_evidence.py
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds the WS-MCP-001 contributor-facing MCP server with a closed v0.1 catalogue, authenticated HTTP forwarding, fail-closed unavailable surfaces, deterministic temporary fixtures, secret redaction, runtime safety controls, comprehensive test coverage, and CI/review evidence integration. ChangesContributor MCP foundation
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant FastMCP
participant Tools
participant Gateway
participant WorkstreamAPI
Client->>FastMCP: Call resource or lifecycle tool
FastMCP->>Tools: Validate request and create RequestContext
Tools->>Gateway: Forward authenticated operation
Gateway->>WorkstreamAPI: Send HTTP with authorization headers
WorkstreamAPI-->>Gateway: Return data or error response
Gateway-->>Tools: Return structured result or mapped error
Tools-->>Client: Return redacted MCP result with error code
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🧹 Nitpick comments (1)
mcp_server/workstream_mcp/schemas.py (1)
147-190: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAdd maximum bounds to unconstrained strings and lists.
Several fields (e.g.,
notes,summary,worker_attestation,artifact_hash_manifest, andevidence_items) currently accept unbounded input lengths or sizes. Bounding these inputs at the MCP adapter edge protects the server from excessive memory allocation when processing deliberately oversized payload submissions.Consider applying safe
max_lengthconstraints to these textual strings and collections. For example:summary: str = Field(min_length=1, max_length=10000) worker_attestation: str = Field(min_length=1, max_length=20000) artifact_hash_manifest: list[ArtifactHashEntryInput] = Field(min_length=1, max_length=1000) evidence_items: list[EvidenceItemInput] = Field(default_factory=list, max_length=1000)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@mcp_server/workstream_mcp/schemas.py` around lines 147 - 190, Add explicit maximum bounds to the unconstrained fields in ArtifactHashEntryInput, EvidenceItemInput, and SubmissionInput: constrain notes, summary, and worker_attestation with appropriate max_length values, and constrain artifact_hash_manifest and evidence_items with collection max_length values. Preserve the existing minimum bounds, defaults, and nested model validation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/backend.yml:
- Around line 10-16: Add least-privilege token permissions for the mcp-server
job by declaring contents: read at workflow or job scope near the mcp-server
definition. Preserve the existing checkout and test steps while preventing
inherited write permissions.
- Around line 32-34: Update the “MCP tests” workflow step to run pytest with
coverage measurement and enforce a minimum total coverage of 90%, while
preserving the existing quiet test execution and mcp_server working directory.
In `@mcp_server/workstream_mcp/auth.py`:
- Around line 126-135: Update redact_secrets to handle set values by recursively
redacting each member and returning a set of the transformed members, matching
the existing list and tuple behavior while preserving non-collection values
unchanged.
In `@mcp_server/workstream_mcp/scenario_gateway.py`:
- Around line 536-550: Update the submit_review flow before _store_replay to
handle a valid needs_revision decision: persist the review findings and
transition the associated task from review_pending to needs_revision. Ensure
get_task_status can report this persisted lifecycle state so the contributor can
submit a revision, while preserving the existing replay result storage.
- Around line 580-598: Update _replay to add an idempotent_replay marker to the
deep-copied result before returning it, while leaving the cached result stored
in _replays unchanged. Preserve the existing conflict validation and return
behavior for matching retries.
- Around line 347-355: Update the review retrieval logic around the state check
in the scenario gateway so any review with state "none_available" returns only
the minimal source, project_id, and state response. Ensure the completed
review’s routing reference, lease data, review reference, and context URI are
not exposed, while preserving the existing leased-to-other-actor behavior and
normal review response.
- Around line 421-434: Move the _replay call and its early return in the
claim_review flow before the project_id and review_routing_ref fixture-match
validation. This ensures reused request IDs are checked first and can return
idempotency_conflict for differing inputs, while preserving the existing
REVIEW_NOT_AVAILABLE validation for non-replayed requests.
In `@mcp_server/workstream_mcp/schemas.py`:
- Around line 267-278: Reorder the checks in normalize_stable_ref so the
normalized value is compared against "." and ".." before applying
STABLE_REF_PATTERN.fullmatch. Preserve the existing blank validation and
specific relative-path error, while leaving the regex validation unchanged for
all other values.
In `@mcp_server/workstream_mcp/server.py`:
- Around line 93-100: Update the AuthSettings configuration used by the server
setup to require WORKSTREAM_MCP_AUTH_ISSUER_URL explicitly and reject missing or
non-HTTPS values by default. Remove the implicit http://workstream.local
fallback; if a local insecure issuer is supported, gate it behind an explicit
development-only override while preserving WorkstreamForwardingTokenVerifier for
external token verification.
---
Nitpick comments:
In `@mcp_server/workstream_mcp/schemas.py`:
- Around line 147-190: Add explicit maximum bounds to the unconstrained fields
in ArtifactHashEntryInput, EvidenceItemInput, and SubmissionInput: constrain
notes, summary, and worker_attestation with appropriate max_length values, and
constrain artifact_hash_manifest and evidence_items with collection max_length
values. Preserve the existing minimum bounds, defaults, and nested model
validation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 9853d225-4b01-47a5-9aa8-e20d45359b1d
📒 Files selected for processing (34)
.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/CHUNK_MAP.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/DISCOVERY.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/INTENT.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/PLAN.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/RISKS.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/STATUS.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/chunks/WS-MCP-001-01-contributor-mcp-foundation.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-external-review-response.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-internal-review-evidence.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-pr-trust-bundle.md.agent-loop/merge-intents/WS-MCP-001-01.json.github/workflows/backend.ymlmcp_server/pyproject.tomlmcp_server/tests/test_auth.pymcp_server/tests/test_catalogue.pymcp_server/tests/test_http_gateway.pymcp_server/tests/test_protocol_journeys.pymcp_server/tests/test_runtime_safety.pymcp_server/tests/test_scenario_gateway.pymcp_server/workstream_mcp/__init__.pymcp_server/workstream_mcp/__main__.pymcp_server/workstream_mcp/auth.pymcp_server/workstream_mcp/config.pymcp_server/workstream_mcp/errors.pymcp_server/workstream_mcp/gateway.pymcp_server/workstream_mcp/http_gateway.pymcp_server/workstream_mcp/observability.pymcp_server/workstream_mcp/resources.pymcp_server/workstream_mcp/scenario_gateway.pymcp_server/workstream_mcp/schemas.pymcp_server/workstream_mcp/server.pymcp_server/workstream_mcp/tools.pyscripts/check_internal_review_evidence.pyscripts/test_agent_gates.py
| auth=AuthSettings( | ||
| issuer_url=os.environ.get( | ||
| "WORKSTREAM_MCP_AUTH_ISSUER_URL", | ||
| "http://workstream.local", | ||
| ), | ||
| resource_server_url=None, | ||
| ), | ||
| token_verifier=WorkstreamForwardingTokenVerifier(), |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Fail closed when the external authentication issuer is missing.
Defaulting to http://workstream.local lets HTTP mode start with an implicit cleartext authentication trust configuration. Require an explicitly configured HTTPS issuer, with any local insecure override made deliberate and development-only.
As per coding guidelines, Workstream must verify external Flow authentication tokens and must not own primary authentication sessions.
🧰 Tools
🪛 ast-grep (0.44.1)
[warning] 95-95: Do not make http calls without encryption
Context: "http://workstream.local"
Note: [CWE-319] Cleartext Transmission of Sensitive Information.
(requests-http)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@mcp_server/workstream_mcp/server.py` around lines 93 - 100, Update the
AuthSettings configuration used by the server setup to require
WORKSTREAM_MCP_AUTH_ISSUER_URL explicitly and reject missing or non-HTTPS values
by default. Remove the implicit http://workstream.local fallback; if a local
insecure issuer is supported, gate it behind an explicit development-only
override while preserving WorkstreamForwardingTokenVerifier for external token
verification.
Sources: Coding guidelines, Linters/SAST tools
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@mcp_server/workstream_mcp/server.py`:
- Around line 54-72: Update the request buffering and replay logic around the
receive loop and replay_receive so memory is bounded by both body data and the
number of ASGI frames, including repeated zero-length more_body frames. Prefer
coalescing request bodies into a bounded bytearray and replaying through a
constant-time queue/deque, or enforce an explicit frame limit while retaining
all required message semantics; preserve rejection through self._reject(send)
when limits are exceeded.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: a8e4e0cd-5bf3-4263-9c92-68162040dd68
📒 Files selected for processing (19)
.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/DISCOVERY.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/STATUS.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-external-review-response.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-internal-review-evidence.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-pr-trust-bundle.md.github/workflows/backend.ymlmcp_server/README.mdmcp_server/pyproject.tomlmcp_server/tests/test_auth.pymcp_server/tests/test_catalogue.pymcp_server/tests/test_http_gateway.pymcp_server/tests/test_runtime_safety.pymcp_server/tests/test_scenario_gateway.pymcp_server/workstream_mcp/auth.pymcp_server/workstream_mcp/config.pymcp_server/workstream_mcp/http_gateway.pymcp_server/workstream_mcp/scenario_gateway.pymcp_server/workstream_mcp/schemas.pymcp_server/workstream_mcp/server.py
🚧 Files skipped from review as they are similar to previous changes (10)
- .agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/STATUS.md
- .github/workflows/backend.yml
- .agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/DISCOVERY.md
- mcp_server/pyproject.toml
- .agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-internal-review-evidence.md
- .agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-pr-trust-bundle.md
- mcp_server/workstream_mcp/auth.py
- mcp_server/workstream_mcp/schemas.py
- mcp_server/workstream_mcp/http_gateway.py
- mcp_server/workstream_mcp/scenario_gateway.py
|
@ChuloWay fix the conflict |
…1-contributor-mcp-foundation
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@mcp_server/tests/test_protocol_journeys.py`:
- Line 16: Declare sse-starlette as a direct test dependency in
mcp_server/pyproject.toml so the AppStatus import in test_protocol_journeys.py
does not rely on a transitive installation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4f3c2ee9-17cd-43a6-9ee3-309e8cf9e680
📒 Files selected for processing (9)
.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/STATUS.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-external-review-response.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-internal-review-evidence.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-pr-trust-bundle.mdmcp_server/README.mdmcp_server/tests/test_protocol_journeys.pymcp_server/tests/test_runtime_safety.pymcp_server/workstream_mcp/server.pyscripts/test_agent_gates.py
🚧 Files skipped from review as they are similar to previous changes (7)
- mcp_server/README.md
- .agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/STATUS.md
- .agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-external-review-response.md
- .agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-pr-trust-bundle.md
- scripts/test_agent_gates.py
- .agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-internal-review-evidence.md
- mcp_server/workstream_mcp/server.py
|
Requesting changes on the MCP agent-facing contract. The issue is that the current Please update all seven tools as follows:
The server architecture, closed catalogue, transport security, redaction, and gateway boundaries are strong. These changes are needed because the MCP schema and descriptions are the primary interface through which an agent understands and safely invokes the tools. |
Thanks @Abiorh001 , I’ve addressed the requested changes and updated the PR. |
…1-contributor-mcp-foundation
…1-contributor-mcp-foundation
…1-contributor-mcp-foundation
There was a problem hiding this comment.
🧹 Nitpick comments (1)
mcp_server/workstream_mcp/http_gateway.py (1)
249-254: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winConsider sharing one
httpx.AsyncClientacross the composed requests.
_requestopens and closes a newAsyncClienton every call. Forget_task_context(4 sequential calls) andget_task_status(up to 3 calls) this means repeated TCP/TLS handshakes to the same host with no connection pooling. Consider constructing the client once per gateway operation (or per gateway instance) and reusing it across the composed sub-requests.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@mcp_server/workstream_mcp/http_gateway.py` around lines 249 - 254, Update the request flow around _request, get_task_context, and get_task_status to reuse a single httpx.AsyncClient for all sub-requests within one gateway operation instead of creating one per call. Preserve the existing base_url, timeout, transport, and trust_env configuration, and ensure the shared client is closed after the composed operation completes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@mcp_server/workstream_mcp/http_gateway.py`:
- Around line 249-254: Update the request flow around _request,
get_task_context, and get_task_status to reuse a single httpx.AsyncClient for
all sub-requests within one gateway operation instead of creating one per call.
Preserve the existing base_url, timeout, transport, and trust_env configuration,
and ensure the shared client is closed after the composed operation completes.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c0687e1c-e395-47e9-8b83-d789cd9a76ee
📒 Files selected for processing (22)
.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/STATUS.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-external-review-response.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-internal-review-evidence.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-pr-trust-bundle.md.github/workflows/backend.ymlmcp_server/README.mdmcp_server/tests/test_auth.pymcp_server/tests/test_catalogue.pymcp_server/tests/test_http_gateway.pymcp_server/tests/test_protocol_journeys.pymcp_server/tests/test_scenario_gateway.pymcp_server/workstream_mcp/auth.pymcp_server/workstream_mcp/errors.pymcp_server/workstream_mcp/gateway.pymcp_server/workstream_mcp/http_gateway.pymcp_server/workstream_mcp/observability.pymcp_server/workstream_mcp/resources.pymcp_server/workstream_mcp/scenario_gateway.pymcp_server/workstream_mcp/schemas.pymcp_server/workstream_mcp/server.pymcp_server/workstream_mcp/tools.pyscripts/test_agent_gates.py
🚧 Files skipped from review as they are similar to previous changes (10)
- mcp_server/README.md
- .agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/STATUS.md
- .github/workflows/backend.yml
- mcp_server/workstream_mcp/gateway.py
- mcp_server/workstream_mcp/observability.py
- mcp_server/workstream_mcp/resources.py
- scripts/test_agent_gates.py
- mcp_server/workstream_mcp/errors.py
- mcp_server/tests/test_catalogue.py
- mcp_server/workstream_mcp/schemas.py
…1-contributor-mcp-foundation # Conflicts: # .github/workflows/backend.yml
…1-contributor-mcp-foundation
2 participants
Workstream PR Trust Bundle
This PR body follows
.github/pull_request_template.mdand.agent-loop/templates/PR_TRUST_BUNDLE.md.Chunk
WS-MCP-001-01-Contributor MCP FoundationMerge intent:
.agent-loop/merge-intents/WS-MCP-001-01.jsonGoal
Add the WS-MCP-001 contributor MCP foundation without duplicating Workstream
authority or exposing backend lifecycle endpoints with incompatible contributor
semantics. This PR does not claim that the complete Sections 18 and 20 gate is
closed.
Human-Approved Intent
Link the initiative and chunk contract:
.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/INTENT.md.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/chunks/WS-MCP-001-01-contributor-mcp-foundation.mdWhat Changed
claim_task,release_task, andsubmit_taskfail closed until atomic claim-to-work, contributor release, and durable idempotency APIs exist./api/v1/auth/mevalidation before unavailable production surfaces, stable-reference/path hardening, and safe backend error-code preservation.sse-starlettetest dependency ownership and strict MCP error signaling at the official SDK boundary.Why It Changed
The original adapter could use backend endpoints whose lifecycle and authority
semantics did not match the contributor MCP specification. Failing closed is
the only correct MCP-side behavior until Workstream supplies compatible APIs.
Design Chosen
The MCP is a thin contributor protocol adapter. It forwards the issuer token to
Workstream, validates stable inputs, redacts outputs, logs only safe operation
metadata, verifies HTTP identity through existing Workstream Auth, and holds no workflow or business state. The scenario fixture exists
only for tests that exercise the public MCP contract while backend APIs are
unavailable or incompatible.
Alternatives Rejected
lifecycle, or idempotency semantics.
production truth.
Scope Control
Allowed Files Changed
.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/**.agent-loop/merge-intents/WS-MCP-001-01.json.github/workflows/backend.ymlmcp_server/**scripts/check_internal_review_evidence.pyscripts/test_agent_gates.pyFiles Outside Contract
Product Behavior
workstream_temporarily_unavailablefor surfaces that current backend APIs cannot safely implement.Evidence
Commands Run
Result Summary
Acceptance Criteria Proof
The checked items below prove the foundation chunk criteria, not complete
WS-MCP-001 Sections 18 and 20 acceptance.
mcp_server/tests/test_catalogue.py.test_auth.py,test_http_gateway.py, andtest_runtime_safety.py.test_http_gateway.py.test_catalogue.py.test_scenario_gateway.py.test_scenario_gateway.py.test_protocol_journeys.py.test_catalogue.py.run_pre_submit_checkas read-only and the six lifecycle tools as state-changing:test_catalogue.py.test_auth.py,test_runtime_safety.py.401:test_catalogue.py,test_runtime_safety.py.tools/list:test_runtime_safety.py,test_protocol_journeys.py.needs_revisionpersists findings and reviewed submission version, permits resubmission, and requeues review:test_scenario_gateway.py.test_http_gateway.py.tools/list:test_catalogue.pyandtest_protocol_journeys.py.test_protocol_journeys.py.test_protocol_journeys.py.test_protocol_journeys.py..agent-loop/merge-intents/WS-MCP-001-01.json.WS-MCP-001 Sections 18 And 20
This foundation does not yet prove complete v0.1 conformance or acceptance.
Authoritative production APIs are still required for project/task lists,
contributions, contributor claim/release/submission, and review operations.
Role/revocation coverage, revision and status outcomes, authoritative
concurrency/retry behavior, end-to-end transport equivalence, and the required
Inspector/client capture remain follow-up evidence.
Test Delta
Tests Added
mcp_server/tests/test_auth.pymcp_server/tests/test_catalogue.pymcp_server/tests/test_http_gateway.pymcp_server/tests/test_protocol_journeys.pymcp_server/tests/test_runtime_safety.pymcp_server/tests/test_scenario_gateway.pyTests Modified
scripts/test_agent_gates.pyTests Removed Or Skipped
Internal Reviewer Results
Reviewed code SHA: 785336e
Reviewed at: 2026-07-20T07:10:23Z
Reviewer run IDs: 019f7cca-7065-7fc3-a102-100773738da9, 019f7cca-7137-7471-a6c9-87703eb97476, 019f7cca-71c0-7301-8f89-f54e37ae8f96, 019f7cca-72d3-7da0-9447-f01a0a08b2f8, 019f7cca-73d2-74e0-ada5-91b8f8c75fc3, 019f7cca-758c-7871-9c3f-8a5a1d28fa83, 019f7ccc-9823-7552-9941-0e5747ba8640, 019f7ccc-98e7-7021-9da3-a5cb3d343db8, 019f7ccc-998c-7420-bed8-92bee8378219
mainat42a89b2is integrated without changing MCP files.External Review
External review response file:
.agent-loop/initiatives/WS-MCP-001-contributor-mcp-server/reviews/WS-MCP-001-01-external-review-response.md785336e.785336e; rerun after push.CI And Gate Integrity
Remaining Risks
WORKSTREAM_TEST_DATABASE_URL; local focused backend contract tests pass.Follow-Up Work
Replace every test-only scenario method with real HTTP gateway calls when the
required contributor-list, lifecycle, contribution, and review API contracts
land, then close the remaining Sections 18 and 20 evidence.
Human Review Focus
Please inspect:
Human Merge Ownership
Summary by CodeRabbit