MCP 2026-07-28 readiness (waves 0-6) + #571 binding fix + two-pass security review - #550

Merged

Weegy merged 137 commits into

mainfrom

feat/mcp-2026-07-28-wave0-wave1

Aug 7, 2026

Commits on Jul 30, 2026

Commits on Jul 31, 2026

refactor(tasks): describe the task seam by contract, not by its first implementor
Weegy
committed
d20d993
chore(470): raise decoupling baseline to 3441 for the W2-2 task seam
Weegy
committed
3fbdd6f
chore(470): re-base decoupling baseline onto main (#552, #553)
Weegy
committed
ed4cebf
fix(mcp): anchor 0031 constraint guard to the relation and drop the hardcoded public. schema
Weegy
committed
e780ab5
fix(mcp): produce the mcpUserKey the per_user delegation path consumes (W4-1)
Weegy
committed
deef5cc
feat(mcp): operator surface for public MCP key bindings (W5-1, server half)
Weegy
committed
4875175
feat(web-ui): client fns + types for public MCP key bindings (W5-1)
Weegy
committed
8fc9dd0
test(mcp): cover the W4-1 mcpUserKey producer on both chat and channel paths
Weegy
committed
07f88fe
test(middleware): bound the suite with --test-timeout=120000 (W4-3)
Weegy
committed
8254757
test(mcp): cover interleaved channel turns from different users (W4-1)
Weegy
committed
ebeba90
feat(web-ui): Public API keys tab in the MCP Control Center (W5-1)
Weegy
committed
827f00d
test(mcp): close throwaway servers in a finally so a failed assertion cannot hang
Weegy
committed
b7e55e4
merge(mcp): public MCP key-binding admin surface (W5-1)
Weegy
committed
ccdbb1e
test(mcp): prove #547 structured sidecar bypasses the privacy boundary (W5-2)
Weegy
committed
ac0186d
test(mcp): import the #547 privacy proof from source, not the dist barrel
Weegy
committed
b698891
merge(mcp): pin the #547 structured-content privacy bypass (W5-2)
Weegy
committed
1d1ba38
docs(changelog): record the wave 4-6 fixes and the #547 privacy limit
Weegy
committed
3c5c53c
chore: escape raw NUL bytes as \0 in composite map-key separators
Weegy
committed
03ce967
merge(hygiene): escape the raw NUL bytes that made ripgrep truncate eight files
Weegy
committed
9b21fa3
fix(memory): the NUL guard blamed a space, and had no coverage at all
Weegy
committed
652ae11
fix(web-ui): raise the vitest timeout above the honest cost of the RTL suites
Weegy
committed
a502db3
chore(470): correct the decoupling baseline that raw NUL bytes had understated
Weegy
committed
f628625
fix(mcp): close three findings from the cross-vendor review of W4-1
Weegy
committed
a290566
docs(changelog): correct the #547 privacy framing and record the replay bypass
Weegy
committed
81addfc
fix(mcp): an omitted field must never widen a public MCP key binding
Weegy
committed
d68245d
docs(changelog): record the W5-1 review fixes as operator-visible behaviour
Weegy
committed
e811198
merge(mcp): close the cross-vendor review findings on the binding admin surface
Weegy
committed
8b18983
fix(privacy): intern MCP input-replay results before they reach the LLM wire
Weegy
committed
04ea85c
docs(test): name the sidecar mechanism instead of a verdict in #547 coverage
Weegy
committed
88cc087
merge(mcp): intern the replay result before it reaches the LLM wire
Weegy
committed
942fc0a
merge(main): pick up #558 (macOS installer signing)
Weegy
committed
8e01c1f
test(memory): widen the path-validation coverage the review found too narrow
Weegy
committed
b715f14
fix(migrations): run the 0031 delegation backfill only when the column is introduced
Weegy
committed
ee814f7
merge(mcp): gate 0031's backfill on the column's introduction
Weegy
committed
68b04e0

Commits on Aug 3, 2026

merge(main): pick up #574 (macOS x64 installer) and #583 (competitive analysis doc)
Weegy
committed
4cb411d

Commits on Aug 7, 2026