chore(specs): gardener checkbox sync

[Dumbris]

Pull Request

Description

Automated spec-gardener run (2026-08-17): syncs specs/*/tasks.md checkboxes against real code, per this repo's spec-gardener automation. Applied 26 checkbox ticks, proposing 0 un-tick candidates, across 1 spec with tick candidates surfaced by scripts/check-spec-evidence.py (69 specs scanned: 64 unresolved, 1 removed, 25 relocated-informational, 162 possibly-built). Only - [ ]/- [x] checkbox characters in specs/*/tasks.md were changed, plus a required ROADMAP.md regeneration — no task prose, no other files.

Note: claude/spec-gardener had been fully merged since the last gardener run (PR #870), so this run restarted the branch from the latest main (force-with-lease push of already-merged history, per the gardener's merged-PR restart rule) before doing any new work.

Testing

• I have tested these changes locally (diff is checkbox-only + regenerated ROADMAP.md; verified with git diff that no other content changed)
• I have added/updated tests that prove my fix is effective or my feature works — N/A, this PR only edits spec tracking checkboxes
• All existing tests pass — no application code was touched; the 26 ticked tasks were independently verified against passing tests by four parallel research agents (see evidence table below)

Applied ticks

All 26 are in specs/098-tools-preflight/tasks.md (spec 098, "Required-Tools Preflight" — landed via PR #996 / commit f3748106, since the last gardener run). Verified independently by four parallel research passes, each reading the cited source and, where the task promised a test, reading the test body to confirm it actually asserts the behavior (not a stub or t.Skip).

Task	File:Line	Decisive code
T002	internal/server/toolslist_snapshot_test.go:20-24	TestToolsListSnapshot_MatchesMergeBaseGoldens passes for all 3 routing modes, goldens captured from merge-base bfd43e7ce
T003	internal/preflight/reasons.go:88-164	15-entry reasonTable; reasons_test.go:41-56 TestFR003Table asserts all 15 rows, TestReasonTable_CoversExactlyTheClosedEnum enforces closure
T004	internal/preflight/evaluator.go:36,45,90,97,119-123,183	IndexReader/ApprovalReader/StateReader/ConfigPolicy, EvalContext, Evaluate(...) ([]Result, error) returning real error on infra failure
T005	internal/toolannotations/toolannotations.go:49, internal/server/mcp_annotations.go:273-274	ExcludeReason extracted; mcp_annotations.go delegates via return toolannotations.ExcludeReason(...)
T006	internal/preflight/classify.go:85-115,120-122	ClassifyTool distinguishes ToolClassChanged from ToolClassPendingApproval, honors AutoApproveToolChanges
T007	internal/preflight/evaluator.go:203-352,307-311,409-416,435	evaluateOne walks FR-004 precedence chain; PendingAuth→oauth_required, server_initializing, sha256/v{N}:{hex} pin check; 657-line table-driven evaluator_test.go
T008	internal/preflight/scope.go:7-8,100	Byte-indistinguishable notFoundResult reused for out-of-scope agent-token cases; zero ForProfile calls anywhere in the new code (grep-confirmed)
T009	internal/preflight/suggest.go:29-80	Suggest — prefix + Levenshtein ≤2, capped at MaxSuggestions=3; covered by suggest_test.go
T010	internal/auth/agent_token.go:46,64, internal/httpapi/server.go:536	ProfilePin field propagated through REST auth; auth_profile_pin_test.go (99 lines) covers intersection cases
T011	internal/preflight/contracts_drift_test.go:20-76	TestContractsMirrorsTheReasonEnum + TestGeneratedTypeScriptCarriesEveryReason reads committed frontend/src/types/contracts.ts; cmd/generate-types/main.go +88 lines
T012	internal/server/preflight_glue.go:44,576-580,30	RunPreflight exposed on MCPProxyServer/Server; no serverToolNames fallback; preflight_glue_test.go:173-221 TestRunPreflightPerformsNoUpstreamIOAndNoMutation (instrumented transport + before/after state snapshot)
T013	internal/server/tool_gate.go:11-26	Shared toolGate/evaluateToolGate consumed by mcp.go call_tool variants, mcp_direct_callability.go:182, mcp_code_execution.go:754; preflight_dispatch_parity_test.go has 10 passing contract tests
T014	internal/storage/activity_models.go:48, internal/runtime/activity_preflight.go:107	ActivityTypePreflight; RecordPreflight bypasses the async channel (doc comment confirms); TestRecordPreflightPropagatesWriteFailure passes
T015	internal/httpapi/preflight.go:200	handlePreflight — full validation, tier detection, sync RecordPreflight before 200; route at server.go:866; 4 handler tests cover every 400/503 rule + no-record-on-reject
T016	internal/httpapi/preflight.go:291, server.go:315,387	runPreflightWithWait — 250ms floor, dedicated preflightWaitSem (size 4); 3 tests cover deadline, early-termination, semaphore-exhausted degrade
T017	cmd/mcpproxy/exit_codes.go:58,94, main.go:787-798, cliclient/client.go:2203	Typed preflightVerdictError/preflightGeneralError; classifyError dispatch; Client.Preflight; tests incl. TestPreflightGeneralError_NotReclassifiedByStringHeuristics
T018	cmd/mcpproxy/tools_cmd.go:844,202	newToolsPreflightCmd with all flags, registered; TestPreflightExitVerdict_WorstClassWins (12>11>10), format/env-var tests, TestToolsPreflightCommand_FlagsAndHelpJSON
T019	internal/preflight/bench_test.go:97-143, internal/httpapi/preflight_bench_test.go:175-213	Three BenchmarkEvaluate*; runPreflightBenchmark calls handlePreflight directly (includes encoding + activity-record build)
T020	server.go:3096-3098,3045,3164, contracts/types.go:294-304	enrichServerTools emits Hash only when discloseHash (operator tier); TestToolHash_NeverDisclosedToAgentToken, TestToolHash_OperatorTierSeesPin
T021	live-verified	make swagger-verify reports up to date; go build -tags server ./cmd/mcpproxy succeeds; go test -tags server ./internal/serveredition/... -race passes; golangci-lint --config .github/.golangci.yml --build-tags server reports 0 issues on preflight-touching packages
T022	cmd/mcpproxy/activity_cmd.go:90,686-768	Allowlist entry + preflightActivitySummary/preflightDetailLines; activity_preflight_test.go covers rendering + type-filter acceptance
T023	frontend/src/types/api.ts:733, frontend/src/views/Activity.vue:831,637-674	'preflight' added to ActivityType; filter menu entry + verdict rendering; activity.ts rollup helpers
T026	internal/server/testdata/preflight_sabotage_matrix.json (38 scenarios), internal/server/preflight_e2e_test.go	TestPreflightSabotageMatrixE2E/TestPreflightIncidentDiagnosisE2E drive a real binary + fixture upstreams; assertCell independently asserts reason/retryable/action/verdict/exit-code + activity list --request-id lookup; sibling preflight_matrix_test.go supplies the every-code-appears-once-in-≥1-row reflection check
T028	docs/api/rest-api.md:616-767	Full POST /api/v1/preflight reference: schema, 15-reason table, 200/400/401/503 rules, dedicated wait_ms semantics paragraph
T029	docs/cli-management-commands.md:741-838	tools preflight section with exit-code table (0/10/11/12/1) + cron recipe (:801-822) + GitHub Actions recipe (:824-838)
T030	docs/features/tools-preflight.md (370 lines, new)	Concept, 15-code taxonomy + precedence table, disclosure tiers, transparency/activity section, Cron/systemd + GitHub Actions + n8n recipes, code_execution/stored-scripts composition section

Proposed un-ticks (NOT applied)

None. A separate investigation of 7 tasks the checker flagged as UNRESOLVED (ticked, but their cited evidence path never existed in git history) found all 7 were RELOCATED, not actually missing — the code/test lives under a renamed or consolidated file, or (in two cases) the cited path was a templated placeholder / an N/A-with-explanation in the task text itself. None warranted an un-tick candidate:

Spec / Task	Why it's a false alarm
005-rest-management-integration T013/T014/T015/T037	internal/management/service_impl.go never existed; code lives in internal/management/service.go (GetServerTools :957 tagged (T013), TriggerOAuthLogin :993 tagged (T014), checkWriteGates() tagged (T015))
022-oauth-redirect-uri-persistence T007	Task text itself says (N/A - uses *BoltDB directly, no interface); methods live directly on *BoltDB in internal/storage/bbolt.go:584,623,646, tested in manager_oauth_test.go
040-server-ux T002	internal/httpapi/server_test.go never existed; tests live in patch_server_test.go / server_config_patch_test.go
090-tray-glance-v2 T024	internal/storage/manager_test.go never existed; the described test is TestGetRecentSessions_OrdersByLastActivityBeforeTruncation in sessions_filter_test.go:97
090-tray-glance-v2 T032	Checker cited .json, task text specifies .jsonl; the fixture exists at specs/090-tray-glance-v2/fixtures/activity-replay.jsonl
012-docusaurus-docs-site T067	docs/topic.md is a templated placeholder describing a doc-link format, not a real target file; that format is used 5+ times in CLAUDE.md
047-cpu-hotpath-fix T029	Neither cited frontend path ever existed (task text hedges "or the existing equivalent path"); the actual SSE handler is handleServersChanged in frontend/src/stores/servers.ts:364-375 with an explicit // Spec 047: comment
029-mcpproxy-teams T009 (REMOVED)	cmd/mcpproxy/teams_register.go was renamed (not deleted) to cmd/mcpproxy/serveredition_register.go as part of the Teams→ServerEdition rename; still //go:build server, still imports internal/serveredition

Dropped by verification

098-tools-preflight T032, 096-batched-call-tools T016, 097-stored-scripts T014 (3 dropped) — all three are "run the full gate suite and confirm green" tasks. GitHub Actions check-runs on the relevant merge commits show Lint (golangci-lint v2, .github/.golangci.yml), Server Edition, Unit Tests, Build, and (for 098) Verify OpenAPI Artifacts all green — strong partial evidence. However, every one of these tasks explicitly names ./scripts/test-api-e2e.sh as a required gate, and that script only runs via release-qa-gate.yml, a workflow_call-only reusable workflow invoked exclusively from prerelease.yml/release.yml — confirmed by grepping .github/workflows/*.yml for callers. It does not run on ordinary PR CI. The PR bodies self-report having run it locally, but that's not independently verifiable for these specific commits. Per the tick test's "when uncertain, do not tick" rule, left unticked.

098-tools-preflight T001, T024, T025, T027, T031, T033 — not investigated this run: the deterministic checker did not surface them as possibly_built candidates (at least one cited evidence path doesn't exist verbatim for each), so per the gardener's step 3 scope ("judge only the residue the script cannot decide") they weren't in scope for this pass. Left unticked; a future run's checker pass over an updated tasks.md may surface them.

7 un-tick candidates across 5 other specs — investigated and dropped (all RELOCATED, not false ticks) — see table above.

Notes

• ROADMAP.md was regenerated via python3 scripts/gen-roadmap.py in a separate commit after the checkbox-sync commit, per the pre-commit staleness check (2 lines changed: 098-tools-preflight progress percentage).
• The claude/spec-gardener branch was reset to the tip of main before this run (force-with-lease push of already-merged history) because the prior gardener PR (chore(specs): gardener checkbox sync #870) had merged and the branch carried no unmerged work beyond that — per the gardener's merged-PR restart instructions.

---

Cap: 40 applied ticks per run — this run found 26 that survived verification, under the cap.

[github-actions]

Auto-approved by spec-gardener-auto-approve: diff is confined to specs/ and ROADMAP.md. Merge fires only when all required checks are green.

[cloudflare-workers-and-pages]

Deploying mcpproxy-docs with    Cloudflare Pages

Latest commit:	e996b81
Status:	✅  Deploy successful!
Preview URL:	https://161e92da.mcpproxy-docs.pages.dev
Branch Preview URL:	https://claude-spec-gardener.mcpproxy-docs.pages.dev

View logs

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!