@marsnme/mcp-gateway 0.2.1 → 0.3.1

package/deploy/phase2/build_release_artifact.sh

@@ -31,15 +31,15 @@ ARTIFACT_PATH="${OUTPUT_DIR}/${ARTIFACT_BASENAME}.tar.gz"
 MANIFEST_PATH="${OUTPUT_DIR}/${ARTIFACT_BASENAME}.manifest.json"
 
 tar -C "${REPO_ROOT}" -czf "${ARTIFACT_PATH}" \
-  --exclude='soul-memory/deploy/artifacts' \
-  --exclude='soul-memory/deploy/phase0/ct101-baseline-*' \
+  --exclude='marsnme-supabase/deploy/artifacts' \
+  --exclude='marsnme-supabase/deploy/phase0/ct101-baseline-*' \
   README.md \
-  soul-memory \
+  marsnme-supabase \
   supabase/config.toml \
   supabase/migrations
 
 ARTIFACT_SHA256="$(shasum -a 256 "${ARTIFACT_PATH}" | awk '{print $1}')"
-SERVER_SHA256="$(shasum -a 256 "${REPO_ROOT}/soul-memory/server.mjs" | awk '{print $1}')"
+SERVER_SHA256="$(shasum -a 256 "${REPO_ROOT}/marsnme-supabase/server.mjs" | awk '{print $1}')"
 
 cat > "${MANIFEST_PATH}" <<EOF
 {
@@ -47,7 +47,7 @@ cat > "${MANIFEST_PATH}" <<EOF
   "commit_hash": "${COMMIT_HASH}",
   "artifact_path": "${ARTIFACT_PATH}",
   "artifact_sha256": "${ARTIFACT_SHA256}",
-  "server_path": "soul-memory/server.mjs",
+  "server_path": "marsnme-supabase/server.mjs",
   "server_sha256": "${SERVER_SHA256}"
 }
 EOF

package/deploy/phase2/pre_deploy_schema_gate.sh

@@ -151,7 +151,7 @@ for profile in "${PROFILE_LIST[@]}"; do
   profile_ident="$(quote_ident "${profile}")"
 
   check_sql "${profile}.memories required columns" \
-    "SELECT id,body,source,session_id,tags,agent_body,environment,promoted,promoted_at,created_at,expires_at FROM ${profile_ident}.memories LIMIT 0;"
+    "SELECT id,body,source,session_id,tags,agent_body,environment,promoted,promoted_at,created_at,expires_at,recipient_body,note,read_at FROM ${profile_ident}.memories LIMIT 0;"
 
   check_sql "${profile}.marsvault_chunks required columns" \
     "SELECT id,content,source_file,section,body,visibility,tags,type,date,origin,source_memory_id,source_session_id,source_tool,source_user_note,agent_body,environment,created_at,updated_at FROM ${profile_ident}.marsvault_chunks LIMIT 0;"

package/deploy/phase3/smoke_gate.sh

@@ -112,9 +112,9 @@ mcp_jsonrpc() {
 if [[ "${SPAWN_LOCAL}" == "true" ]]; then
   COCO_LOG="/tmp/mars-memory-coco-smoke.log"
   TOTO_LOG="/tmp/mars-memory-toto-smoke.log"
-  MCP_PROFILE=coco PORT=18790 SUPABASE_BASE_URL="${SUPABASE_BASE_URL_FOR_LOCAL}" MCP_REQUIRE_BEARER=false node "${REPO_ROOT}/soul-memory/server.mjs" >"${COCO_LOG}" 2>&1 &
+  MCP_PROFILE=coco PORT=18790 SUPABASE_BASE_URL="${SUPABASE_BASE_URL_FOR_LOCAL}" MCP_REQUIRE_BEARER=false node "${REPO_ROOT}/marsnme-supabase/server.mjs" >"${COCO_LOG}" 2>&1 &
   COCO_PID="$!"
-  MCP_PROFILE=toto PORT=18791 SUPABASE_BASE_URL="${SUPABASE_BASE_URL_FOR_LOCAL}" MCP_REQUIRE_BEARER=false node "${REPO_ROOT}/soul-memory/server.mjs" >"${TOTO_LOG}" 2>&1 &
+  MCP_PROFILE=toto PORT=18791 SUPABASE_BASE_URL="${SUPABASE_BASE_URL_FOR_LOCAL}" MCP_REQUIRE_BEARER=false node "${REPO_ROOT}/marsnme-supabase/server.mjs" >"${TOTO_LOG}" 2>&1 &
   TOTO_PID="$!"
   sleep 2
 fi
@@ -131,7 +131,8 @@ COCO_TOOLS_JSON="$(mcp_jsonrpc "${COCO_URL}" '{"jsonrpc":"2.0","id":"coco-tools-
 TOTO_TOOLS_JSON="$(mcp_jsonrpc "${TOTO_URL}" '{"jsonrpc":"2.0","id":"toto-tools-list","method":"tools/list","params":{}}')"
 
 COCO_TOOLS_CHECK="$(TOOLS_PAYLOAD="${COCO_TOOLS_JSON}" node -e '
-const expected = ["insert_memory", "list_memories", "search_memories", "recall", "health_check", "session_boot", "session_close", "dream_ingest", "memory_ingest"];
+const expected = ["insert_memory", "list_memories", "search_memories", "reload_source_registry", "recall", "get_summary", "get_full", "health_check", "session_boot", "session_close", "dream_ingest", "memory_ingest", "demote_memory", "soft_forget", "explain_memory", "batch_promote"];
+const prdTools = ["save_prd", "get_prd", "list_prds", "score_prd", "spawn_to_linear"];
 const payload = JSON.parse(process.env.TOOLS_PAYLOAD || "{}");
 if (payload.error) throw new Error("tools/list error: " + JSON.stringify(payload.error));
 const tools = payload.result?.tools;
@@ -139,11 +140,14 @@ if (!Array.isArray(tools)) throw new Error("tools/list missing result.tools");
 const names = tools.map((item) => item?.name).filter(Boolean);
 const missing = expected.filter((name) => !names.includes(name));
 if (missing.length > 0) throw new Error("missing tools: " + missing.join(","));
+const leaked = names.filter((name) => prdTools.includes(name));
+if (leaked.length > 0) throw new Error("PRD tools must not be exposed: " + leaked.join(","));
 process.stdout.write(JSON.stringify({ tool_count: names.length, tools: names }));
 ')"
 
 TOTO_TOOLS_CHECK="$(TOOLS_PAYLOAD="${TOTO_TOOLS_JSON}" node -e '
-const expected = ["insert_memory", "list_memories", "search_memories", "recall", "health_check", "session_boot", "session_close", "dream_ingest", "memory_ingest"];
+const expected = ["insert_memory", "list_memories", "search_memories", "reload_source_registry", "recall", "get_summary", "get_full", "health_check", "session_boot", "session_close", "dream_ingest", "memory_ingest", "demote_memory", "soft_forget", "explain_memory", "batch_promote"];
+const prdTools = ["save_prd", "get_prd", "list_prds", "score_prd", "spawn_to_linear"];
 const payload = JSON.parse(process.env.TOOLS_PAYLOAD || "{}");
 if (payload.error) throw new Error("tools/list error: " + JSON.stringify(payload.error));
 const tools = payload.result?.tools;
@@ -151,6 +155,8 @@ if (!Array.isArray(tools)) throw new Error("tools/list missing result.tools");
 const names = tools.map((item) => item?.name).filter(Boolean);
 const missing = expected.filter((name) => !names.includes(name));
 if (missing.length > 0) throw new Error("missing tools: " + missing.join(","));
+const leaked = names.filter((name) => prdTools.includes(name));
+if (leaked.length > 0) throw new Error("PRD tools must not be exposed: " + leaked.join(","));
 process.stdout.write(JSON.stringify({ tool_count: names.length, tools: names }));
 ')"
 
@@ -261,7 +267,7 @@ if [[ -z "${OUTPUT_PATH}" ]]; then
 fi
 
 COMMIT_HASH="$(git -C "${REPO_ROOT}" rev-parse HEAD)"
-LOCAL_SERVER_SHA256="$(shasum -a 256 "${REPO_ROOT}/soul-memory/server.mjs" | awk '{print $1}')"
+LOCAL_SERVER_SHA256="$(shasum -a 256 "${REPO_ROOT}/marsnme-supabase/server.mjs" | awk '{print $1}')"
 
 if [[ -n "${REMOTE_SERVER_SHA256}" ]]; then
   REMOTE_SERVER_SHA256_VALUE="\"${REMOTE_SERVER_SHA256}\""

package/deploy/systemd/memory-mcp-gateway@.service

@@ -6,19 +6,19 @@ Requires=docker.service
 
 [Service]
 Type=simple
-WorkingDirectory=/opt/mars-memory-mcp/current-%i/soul-memory
+WorkingDirectory=/opt/mars-memory-mcp/current-%i/marsnme-supabase
 EnvironmentFile=-/opt/mars-memory-mcp/shared/.env
 EnvironmentFile=-/opt/mars-memory-mcp/shared/.env.%i
-EnvironmentFile=-/opt/mars-memory-mcp/current-%i/soul-memory/.env
-EnvironmentFile=-/opt/mars-memory-mcp/current-%i/soul-memory/.env.%i
-EnvironmentFile=-/opt/mars-memory-mcp/current/soul-memory/.env
-EnvironmentFile=-/opt/mars-memory-mcp/current/soul-memory/.env.%i
+EnvironmentFile=-/opt/mars-memory-mcp/current-%i/marsnme-supabase/.env
+EnvironmentFile=-/opt/mars-memory-mcp/current-%i/marsnme-supabase/.env.%i
+EnvironmentFile=-/opt/mars-memory-mcp/current/marsnme-supabase/.env
+EnvironmentFile=-/opt/mars-memory-mcp/current/marsnme-supabase/.env.%i
 Environment=MCP_PROFILE=%i
 Environment=MCP_REQUIRE_BEARER=true
 Environment=JINA_EMBEDDING_API_URL=https://api.jina.ai/v1/embeddings
 Environment=JINA_EMBEDDING_MODEL=jina-embeddings-v3
 Environment=JINA_EMBEDDING_DIMENSIONS=1024
-ExecStart=/usr/bin/node /opt/mars-memory-mcp/current-%i/soul-memory/server.mjs
+ExecStart=/usr/bin/node /opt/mars-memory-mcp/current-%i/marsnme-supabase/server.mjs
 Restart=always
 RestartSec=3
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marsnme/mcp-gateway",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "mcpName": "io.github.Marsmanleo/marsnme",
   "private": false,
   "description": "Agent-agnostic, LLM-agnostic memory backend for MCP-compatible tools",
@@ -49,4 +49,4 @@
   "engines": {
     "node": ">=20"
   }
-}
+}

package/scripts/tests/test_auth_guard.mjs

@@ -0,0 +1,74 @@
+// MARS-422: bearer bypass guard (RED first — see scripts/tests/test_auth_guard.mjs)
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { shouldRequireBearer } from '../../lib/auth-guard.mjs';
+
+const base = { requireBearer: true, bypassForPrivate: true };
+
+test('public request via Cloudflare edge must require bearer even with private X-Forwarded-Host', () => {
+  const headers = {
+    'cf-ray': '8b1f9c2d4e5f-HKG',
+    'cf-connecting-ip': '203.0.113.7',
+    'x-forwarded-host': '127.0.0.1',
+    host: 'coco-mcp.marsgroup.asia',
+  };
+  assert.equal(
+    shouldRequireBearer({ ...base, headers, remoteAddress: '127.0.0.1' }),
+    true,
+    'spoofed X-Forwarded-Host from the internet must NOT bypass auth'
+  );
+});
+
+test('edge request from a LAN socket peer still requires bearer', () => {
+  const headers = { 'cf-ray': 'x', 'x-forwarded-host': '192.168.100.102' };
+  assert.equal(shouldRequireBearer({ ...base, headers, remoteAddress: '192.168.100.102' }), true);
+});
+
+test('request with cf-connecting-ip only (no cf-ray) is also treated as edge', () => {
+  const headers = { 'cf-connecting-ip': '203.0.113.7', 'x-forwarded-host': '10.0.0.5' };
+  assert.equal(shouldRequireBearer({ ...base, headers, remoteAddress: '127.0.0.1' }), true);
+});
+
+test('loopback caller without edge headers keeps the private bypass', () => {
+  assert.equal(
+    shouldRequireBearer({ ...base, headers: { host: '127.0.0.1:18790' }, remoteAddress: '127.0.0.1' }),
+    false
+  );
+});
+
+test('LAN caller without edge headers keeps the private bypass (SSH tunnel case)', () => {
+  // Pi's coco-memory-local reaches the CT as 192.168.100.x over ssh -L.
+  const headers = { host: '192.168.100.102:18790', 'x-forwarded-host': '127.0.0.1' };
+  assert.equal(shouldRequireBearer({ ...base, headers, remoteAddress: '192.168.100.102' }), false);
+  assert.equal(shouldRequireBearer({ ...base, headers, remoteAddress: '10.4.5.6' }), false);
+  assert.equal(shouldRequireBearer({ ...base, headers, remoteAddress: '172.20.1.9' }), false);
+});
+
+test('public peer without edge headers must NOT bypass', () => {
+  const headers = { 'x-forwarded-host': '127.0.0.1', host: '127.0.0.1:18790' };
+  assert.equal(
+    shouldRequireBearer({ ...base, headers, remoteAddress: '203.0.113.7' }),
+    true,
+    'a public client reaching the port directly must not be trusted'
+  );
+});
+
+test('requireBearer=false disables auth entirely (unchanged behaviour)', () => {
+  const headers = { 'cf-ray': 'x', 'x-forwarded-host': '127.0.0.1' };
+  assert.equal(
+    shouldRequireBearer({ requireBearer: false, bypassForPrivate: true, headers, remoteAddress: '127.0.0.1' }),
+    false
+  );
+});
+
+test('bypassForPrivate=false always requires bearer', () => {
+  assert.equal(
+    shouldRequireBearer({
+      requireBearer: true,
+      bypassForPrivate: false,
+      headers: { host: '127.0.0.1:18790' },
+      remoteAddress: '127.0.0.1',
+    }),
+    true
+  );
+});

package/scripts/tests/test_dream_runner_modes.py

@@ -8,8 +8,8 @@ from typing import Optional
 
 
 ROOT = Path(__file__).resolve().parents[3]
-DREAM_RUNNER = ROOT / "soul-memory" / "scripts" / "dream_runner.py"
-HERMES_WRAPPER = ROOT / "soul-memory" / "scripts" / "hermes_digest_runner.py"
+DREAM_RUNNER = ROOT / "marsnme-supabase" / "scripts" / "dream_runner.py"
+HERMES_WRAPPER = ROOT / "marsnme-supabase" / "scripts" / "hermes_digest_runner.py"
 
 
 class DreamRunnerModeTests(unittest.TestCase):

package/server.mjs

@@ -5,6 +5,7 @@ import { execFileSync } from 'node:child_process';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { shouldRequireBearer as guardShouldRequireBearer } from './lib/auth-guard.mjs';
 
 const PROFILE_CONFIGS = {
   coco: {
@@ -13,7 +14,7 @@ const PROFILE_CONFIGS = {
     defaultPort: 18790,
     gatewayDir: 'coco-mcp-gateway',
     publicHostSuffix: 'coco-mcp.marsgroup.asia',
-    sourceWhitelist: ['perplexity', 'cursor', 'warp', 'openclaw', 'hermes'],
+    sourceWhitelist: ['perplexity', 'cursor', 'warp', 'openclaw', 'hermes', 'draft', 'grok', 'omp'],
     recallBodyEnum: ['coco', 'toto', 'system'],
     digestDefaultOrigin: 'hermes-coco-digest',
     memoryIngestToolName: 'memory_ingest',
@@ -24,6 +25,7 @@ const PROFILE_CONFIGS = {
       'perplexity-coco',
       'cursor-coco',
       'warp-coco',
+      'omp-coco',
       'leo-manual',
       'hermes-coco-digest'
     ],
@@ -35,7 +37,7 @@ const PROFILE_CONFIGS = {
     defaultPort: 18791,
     gatewayDir: 'toto-mcp-gateway',
     publicHostSuffix: 'toto-mcp.marsgroup.asia',
-    sourceWhitelist: ['perplexity', 'cursor', 'warp', 'openclaw'],
+    sourceWhitelist: ['perplexity', 'cursor', 'warp', 'openclaw', 'grok'],
     recallBodyEnum: ['toto', 'system'],
     digestDefaultOrigin: 'hermes-toto-digest',
     memoryIngestToolName: 'memory_ingest',
@@ -190,9 +192,13 @@ const ANON_ALLOWED_TOOL_NAMES = new Set([
   'search_memories',
   'reload_source_registry',
   'recall',
+  'get_summary',
+  'get_full',
   'health_check',
   'explain_memory'
 ]);
+const RECALL_PREVIEW_MAX_CHARS = 80;
+const CHUNK_SUMMARY_MAX_CHARS = 300;
 const SUPABASE_REQUEST_CONTEXT = new AsyncLocalStorage();
 const OAUTH_ENABLED = process.env.MCP_OAUTH_ENABLED !== 'false';
 const REQUIRE_BEARER = process.env.MCP_REQUIRE_BEARER === 'true';
@@ -256,7 +262,9 @@ const SOURCE_TO_AGENT_BODY_MAP = new Map([
   ['cursor', 'cursor'],
   ['warp', 'warp'],
   ['openclaw', 'desktop'],
-  ['hermes', 'desktop']
+  ['hermes', 'desktop'],
+  ['draft', 'desktop'],
+  ['omp', 'omp']
 ]);
 const DEFAULT_AGENT_BODY = String(process.env.MCP_AGENT_BODY || '')
   .trim()
@@ -386,7 +394,7 @@ function buildTools() {
     },
     {
       name: 'recall',
-      description: `Semantic recall from long-term memory (${DB_PROFILE}.marsvault_chunks) using Jina embeddings. Searches across promoted insights, digests, and archived knowledge using vector similarity. Use this to retrieve established patterns, past decisions, documented workflows, or any knowledge that was previously promoted to long-term storage. This is the primary tool for accessing institutional memory.`,
+      description: `Semantic recall from long-term memory (${DB_PROFILE}.marsvault_chunks) using Jina embeddings. Returns preview snippets (~${RECALL_PREVIEW_MAX_CHARS} chars) per match by default — use get_summary for a longer excerpt or get_full for complete chunk text. Searches promoted insights, digests, and archived knowledge using vector similarity.`,
       inputSchema: {
         type: 'object',
         properties: {
@@ -417,6 +425,30 @@ function buildTools() {
         additionalProperties: false
       }
     },
+    {
+      name: 'get_summary',
+      description: `Fetch a medium-length excerpt (~${CHUNK_SUMMARY_MAX_CHARS} chars) of a long-term memory chunk by ID. Use after recall when a preview match looks relevant. For complete text, call get_full.`,
+      inputSchema: {
+        type: 'object',
+        properties: {
+          id: { type: 'string', description: 'UUID of the marsvault_chunks row' }
+        },
+        required: ['id'],
+        additionalProperties: false
+      }
+    },
+    {
+      name: 'get_full',
+      description: `Fetch the complete text of a long-term memory chunk by ID. Use sparingly after recall/get_summary when you need the full institutional memory entry.`,
+      inputSchema: {
+        type: 'object',
+        properties: {
+          id: { type: 'string', description: 'UUID of the marsvault_chunks row' }
+        },
+        required: ['id'],
+        additionalProperties: false
+      }
+    },
     {
       name: 'health_check',
       description: `Run comprehensive ${PROFILE.displayName} memory system diagnostics. Returns chunk counts by type and visibility, identifies expiring short-term memories that need promotion, detects timeline coverage gaps, and finds conflicting or redundant long-term chunks. Use this regularly to maintain memory hygiene and before batch promotion.`,
@@ -554,6 +586,10 @@ function buildTools() {
             default: 5,
             description: 'Maximum recall results per category (identity/workflow/status, default 5)'
           },
+          body: {
+            type: 'string',
+            description: 'Recipient body name — check for 便條 (handoff notes) addressed to this body and surface them at the top of boot output. Defaults to current profile (e.g. "coco") so any CoCo body receives CoCo-addressed notes without passing an explicit body.'
+          },
           alert_window_hours: {
             type: 'number',
             minimum: 1,
@@ -580,7 +616,7 @@ function buildTools() {
     {
       name: 'session_close',
       description:
-        `Save a ${PROFILE.displayName} session close summary before ending a conversation. The summary is stored as a short-term memory with 7-day retention, providing context for the next session boot. Include what was accomplished, what is still pending, and any important context for continuity.`,
+        `Save a ${PROFILE.displayName} session close summary before ending a conversation. The summary is stored as a short-term memory with 7-day retention, providing context for the next session boot. After saving, automatically promotes up to 5 soon-expiring short-term memories to long-term storage (alert window 48h); promote failures never fail the close. Also auto-posts a session-close broadcast to the CoCo family board (board_posts) so other bodies see what was accomplished/pending on next session_boot; board post failures never fail the close. Include what was accomplished, what is still pending, and any important context for continuity.`,
       inputSchema: {
         type: 'object',
         properties: {
@@ -597,6 +633,34 @@ function buildTools() {
           mood: {
             type: 'string',
             description: 'Optional mood marker'
+          },
+          to: {
+            type: 'string',
+            description: 'Recipient body name — leave a 便條 (handoff note) for another body, surfaced on that body next session_boot'
+          },
+          note: {
+            type: 'string',
+            description: 'Short context handoff for the recipient body (used with `to`)'
+          },
+          body_name: {
+            type: 'string',
+            description: 'Optional posting body name for the auto board_post (e.g. "四哥", "三哥"). Defaults to profile name.'
+          },
+          auto_board_post: {
+            type: 'boolean',
+            default: true,
+            description: 'When true (default), auto-post a session-close broadcast to the family board. Set false to skip.'
+          },
+          board_type: {
+            type: 'string',
+            enum: ['stuck', 'turn', 'collide', 'gate'],
+            default: 'turn',
+            description: 'Board post type for the auto broadcast (default "turn")'
+          },
+          board_topic: {
+            type: 'string',
+            default: 'session-close',
+            description: 'Board topic tag for the auto broadcast (default "session-close")'
           }
         },
         required: ['source', 'summary'],
@@ -775,6 +839,80 @@ function buildTools() {
         },
         additionalProperties: false
       }
+    },
+    // ── MARS-318: Board v0 ─────────────────────────────────────
+    {
+      name: 'board_read',
+      description: 'Read unread board posts (the CoCo family wall). Returns posts not yet acknowledged by the calling body. Called automatically by session_boot, but can also be called manually.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          body: { type: 'string', description: 'The body name reading the board (e.g. "三哥", "四哥", "大家姐", "leo")' },
+          limit: { type: 'number', minimum: 1, maximum: 50, default: 10, description: 'Maximum posts to return' },
+          topic: { type: 'string', description: 'Optional topic filter' },
+          include_acked: { type: 'boolean', default: false, description: 'Include already-acknowledged posts' }
+        },
+        required: ['body'],
+        additionalProperties: false
+      }
+    },
+    {
+      name: 'board_post',
+      description: 'Post a message to the CoCo family board (wall). to="all" broadcasts to the wall; to="<body>" is a private note.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          from_source: { type: 'string', description: 'Source platform (warp / cursor / perplexity / grok / hermes / draft)' },
+          from_body: { type: 'string', description: 'Posting body name (e.g. "三哥", "leo")' },
+          to: { type: 'string', default: 'all', description: '"all" for wall broadcast; specific body name for private note' },
+          topic: { type: 'string', description: 'Topic tag (e.g. "board-v0", "egress")' },
+          type: { type: 'string', enum: ['stuck', 'turn', 'collide', 'gate'], default: 'turn', description: 'Post type' },
+          text: { type: 'string', description: 'Post content (max 2000 chars)' },
+          expires_at: { type: 'string', description: 'Optional expiry in ISO 8601. null = permanent.' }
+        },
+        required: ['from_source', 'from_body', 'text'],
+        additionalProperties: false
+      }
+    },
+    {
+      name: 'board_ack',
+      description: 'Acknowledge (mark as read) one or more board posts for a specific body.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          body: { type: 'string', description: 'The body acknowledging (e.g. "三哥")' },
+          ids: { type: 'array', items: { type: 'string' }, minItems: 1, maxItems: 50, description: 'Board post UUIDs to acknowledge' }
+        },
+        required: ['body', 'ids'],
+        additionalProperties: false
+      }
+    },
+    // MARS-327: board_get_full — retrieve full text of a single board post
+    {
+      name: 'board_get_full',
+      description: 'Get the full untruncated text of a single board post. Use when board_read or session_boot shows truncated=true and you need the complete content.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          id: { type: 'string', description: 'Board post UUID' }
+        },
+        required: ['id'],
+        additionalProperties: false
+      }
+    },
+    // board_resolve — mark posts as globally resolved
+    {
+      name: 'board_resolve',
+      description: 'Resolve one or more board posts globally. Resolved posts are hidden from board_read and session_boot for ALL bodies (unlike ack which is per-body). Use to close out stuck/gate posts that have been addressed.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          body: { type: 'string', description: 'The body resolving (e.g. "三哥")' },
+          ids: { type: 'array', items: { type: 'string' }, minItems: 1, maxItems: 50, description: 'Board post UUIDs to resolve' }
+        },
+        required: ['body', 'ids'],
+        additionalProperties: false
+      }
     }
   ];
 }
@@ -1055,6 +1193,8 @@ function listAvailableToolsForAuthMode(authMode) {
 function buildSupabaseCapabilityPayload() {
   return {
     mode: SUPABASE_AUTH_MODE,
+    tool_surface: 'coco',
+    prd_tools_enabled: false,
     anon_allowed_tools: listAvailableToolNamesForAuthMode('anon'),
     effective_tools: listAvailableToolNamesForAuthMode(SUPABASE_AUTH_MODE)
   };
@@ -1382,6 +1522,46 @@ function normalizeOptionalText(value, maxLength = 200) {
   if (!text) return '';
   return text.slice(0, Math.max(1, maxLength));
 }
+
+function truncateChunkContent(text, maxChars) {
+  const raw = String(text ?? '');
+  if (raw.length <= maxChars) {
+    return { content: raw, preview_truncated: false, content_chars: raw.length };
+  }
+  return {
+    content: raw.slice(0, maxChars),
+    preview_truncated: true,
+    content_chars: raw.length
+  };
+}
+
+function applyRecallPreviewToItem(item) {
+  const fullContent = String(item?.content ?? '');
+  const preview = truncateChunkContent(fullContent, RECALL_PREVIEW_MAX_CHARS);
+  return {
+    ...item,
+    content: preview.content,
+    preview_truncated: preview.preview_truncated,
+    content_chars: preview.content_chars
+  };
+}
+
+function buildChunkToolFields(chunk) {
+  return {
+    id: chunk.id,
+    source_file: chunk.source_file || null,
+    section: chunk.section || null,
+    body: chunk.body || null,
+    visibility: chunk.visibility || null,
+    tags: chunk.tags ?? [],
+    type: chunk.type || null,
+    date: chunk.date || null,
+    origin: chunk.origin || null,
+    agent_body: chunk.agent_body || null,
+    environment: chunk.environment || null,
+    created_at: chunk.created_at || null
+  };
+}
 function normalizeOptionalSourceTool(value) {
   const normalized = String(value || '').trim();
   if (!normalized) return '';
@@ -1518,10 +1698,16 @@ function estimateToolUsageTokens(toolName, args = {}) {
       appendTokenCharCount(safeArgs.query, state);
       appendTokenCharCount(safeArgs.type, state);
       break;
+    case 'get_summary':
+    case 'get_full':
+      appendTokenCharCount(safeArgs.id, state);
+      break;
     case 'session_close':
       appendTokenCharCount(safeArgs.summary, state);
       appendTokenCharCount(safeArgs.topics, state);
       appendTokenCharCount(safeArgs.mood, state);
+      appendTokenCharCount(safeArgs.body_name, state);
+      appendTokenCharCount(safeArgs.board_topic, state);
       break;
     case 'session_boot':
       appendTokenCharCount(safeArgs.topic, state);
@@ -2089,6 +2275,64 @@ async function upsertMemoryBySession({
   return fetched || null;
 }
 
+// ─── 便條 (Body-to-Body handoff notes) ────────────────────────────────────────
+// Stored as memories rows with recipient_body/note/read_at columns.
+// session_close(to, note) writes; session_boot(body) reads + marks read.
+// If the note columns are not yet deployed, these degrade gracefully (caller wraps in try/catch).
+
+const NOTE_SELECT_COLUMNS =
+  'id,body,source,session_id,tags,agent_body,environment,created_at,expires_at,recipient_body,note,read_at';
+
+async function insertNoteMemory({ source, to, note, body, tags, expires_at }) {
+  const resolvedAgentBody = resolveWriteAgentBody({ source });
+  const resolvedEnvironment = resolveWriteEnvironment({});
+  const createdId = crypto.randomUUID();
+  const payload = {
+    id: createdId,
+    body,
+    source,
+    session_id: `note:to:${to}:${createdId.slice(0, 8)}`,
+    tags: normalizeMemoryTagsWithContext(tags, resolvedAgentBody, resolvedEnvironment),
+    agent_body: resolvedAgentBody,
+    environment: resolvedEnvironment,
+    recipient_body: to,
+    note,
+    read_at: null
+  };
+  if (expires_at) payload.expires_at = expires_at;
+  const inserted = await supabaseRequest(`/rest/v1/memories?select=${NOTE_SELECT_COLUMNS}`, {
+    method: 'POST',
+    profile: DB_PROFILE,
+    prefer: 'return=representation',
+    body: [payload]
+  });
+  return Array.isArray(inserted) && inserted.length > 0 ? inserted[0] : null;
+}
+
+async function listUnreadNotes(bodyName, limit = 3) {
+  const query = new URLSearchParams();
+  query.set('select', NOTE_SELECT_COLUMNS);
+  query.set('recipient_body', `eq.${bodyName}`);
+  query.set('read_at', 'is.null');
+  query.set('order', 'created_at.desc');
+  query.set('limit', String(Math.min(limit, 10)));
+  const rows = await supabaseRequest(`/rest/v1/memories?${query.toString()}`, {
+    profile: DB_PROFILE
+  });
+  return Array.isArray(rows) ? rows : [];
+}
+
+async function markNoteRead(id) {
+  const query = new URLSearchParams();
+  query.set('id', `eq.${id}`);
+  await supabaseRequest(`/rest/v1/memories?${query.toString()}`, {
+    method: 'PATCH',
+    profile: DB_PROFILE,
+    prefer: 'return=minimal',
+    body: { read_at: new Date().toISOString() }
+  });
+}
+
 async function ensureDailyCloseRecovery(source, nowTs) {
   const yesterdayDate = new Date(toUtcStartOfDay(nowTs).getTime() - 86400000);
   const yesterdayDateKey = formatDateOnly(yesterdayDate);
@@ -2180,6 +2424,7 @@ async function runDailyBoot(args = {}) {
   const source = normalizeDailySource(args.source);
   const topic = normalizeOptionalText(args.topic, 200);
   const mood = normalizeOptionalText(args.mood, 80);
+  const bodyName = normalizeOptionalText(args.body, 60) || DB_PROFILE;
   const queries = buildDailyBootQueries(args);
   const inferredSourceAgentBody = inferAgentBodyFromSource(source);
   const recallScopeArgs = {
@@ -2273,12 +2518,85 @@ async function runDailyBoot(args = {}) {
       }
     : await ensureDailyCloseRecovery(source, nowTs);
 
+  // 便條: surface unread handoff notes addressed to this body, then mark read
+  let notes = [];
+  if (bodyName) {
+    try {
+      const unread = await listUnreadNotes(bodyName);
+      for (const n of unread) {
+        notes.push({
+          id: n.id,
+          from: normalizeOptionalText(n.source, 60) || 'unknown',
+          to: bodyName,
+          note: normalizeOptionalText(n.note, 1000) || '',
+          created_at: n.created_at
+        });
+        await markNoteRead(n.id);
+      }
+    } catch (error) {
+      // note columns may not be deployed yet — degrade gracefully, boot itself still succeeds
+      notes = [];
+    }
+  }
+
+  // MARS-318: Board v0 — auto-fetch unread wall posts for this body
+  let boardUnread = [];
+  const boardBody = bodyName || inferAgentBodyFromSource(source) || DB_PROFILE;
+  try {
+    const bQuery = new URLSearchParams();
+    bQuery.set('select', 'id,from_source,from_body,to,topic,type,text,acked_by,created_at');
+    bQuery.set('order', 'created_at.desc');
+    bQuery.set('limit', '5');
+    bQuery.set('archived_at', 'is.null');
+    bQuery.set('resolved_at', 'is.null');
+    bQuery.set('or', `(to.eq.all,to.eq.${boardBody})`);
+    const bResult = await supabaseRequest(`/rest/v1/board_posts?${bQuery.toString()}`, { profile: DB_PROFILE });
+    const bPosts = Array.isArray(bResult) ? bResult : [];
+    const BOOT_BOARD_PREVIEW_MAX = 160;
+    // MARS-328: priority types surface first
+    const BOARD_PRIORITY_TYPES = new Set(['gate', 'stuck']);
+    boardUnread = bPosts
+      .filter(p => {
+        const ab = p.acked_by && typeof p.acked_by === 'object' ? p.acked_by : {};
+        return !ab[boardBody];
+      })
+      .map(p => {
+        const fullText = p.text || '';
+        const preview = fullText.slice(0, BOOT_BOARD_PREVIEW_MAX);
+        return {
+          id: p.id,
+          from: `${p.from_body}@${p.from_source}`,
+          to: p.to,
+          topic: p.topic || null,
+          type: p.type,
+          text: preview,
+          truncated: fullText.length > BOOT_BOARD_PREVIEW_MAX,
+          full_length: fullText.length,
+          preview_length: preview.length,
+          created_at: p.created_at
+        };
+      })
+      .sort((a, b) => {
+        const aPri = BOARD_PRIORITY_TYPES.has(a.type) ? 0 : 1;
+        const bPri = BOARD_PRIORITY_TYPES.has(b.type) ? 0 : 1;
+        if (aPri !== bPri) return aPri - bPri;
+        return new Date(b.created_at).getTime() - new Date(a.created_at).getTime();
+      });
+  } catch {
+    // board_posts table may not exist yet — degrade gracefully
+    boardUnread = [];
+  }
+
   return {
     ok: true,
     profile: DB_PROFILE,
     mode: existingHeartbeat ? 'welcome_back' : 'new_day',
     source,
     date: dateKey,
+    notes,
+    board_unread: boardUnread,
+    // MARS-328: remind body to post stuck/gate when blocked mid-session
+    board_reminder: '中途卡住請用 board_post type=stuck 上牆，唔好等到 session_close。',
     heartbeat_id: savedHeartbeat?.id || null,
     agent_name: queries.agent_name,
     last_topic: previousTopic || null,
@@ -2313,6 +2631,8 @@ async function runDailyClose(args = {}) {
   }
   const topics = normalizeDailyTopics(args.topics);
   const mood = normalizeOptionalText(args.mood, 80);
+  const to = normalizeOptionalText(args.to, 60);
+  const note = to ? normalizeOptionalText(args.note, 1000) : null;
   const nowTs = new Date();
   const dateKey = dailyDateKey(nowTs);
   const toolUsageDailySummary = await fetchToolUsageDailySummary(dateKey);
@@ -2344,6 +2664,23 @@ async function runDailyClose(args = {}) {
     expires_at: expiresAt,
     existing: existingClose
   });
+
+  // Auto-promote soon-expiring short-term memories (replaces Hermes dream schedule).
+  // Failure must never break session_close — summary is already stored.
+  let promotedCount = 0;
+  try {
+    const promoteResult = await runBatchPromote({
+      alert_window_hours: 48,
+      max_promote: 5
+    });
+    promotedCount = Math.max(0, Number(promoteResult?.promoted_count) || 0);
+  } catch (error) {
+    console.warn(
+      `[session_close] auto batch_promote failed: ${String(error?.message || error)}`
+    );
+    promotedCount = 0;
+  }
+
   const expirySnapshot = await runHealthExpiryCheck({
     alert_window_hours: 48
   });
@@ -2356,11 +2693,87 @@ async function runDailyClose(args = {}) {
     Number(expirySnapshot?.expiry_alert?.recommended_for_promotion_count) || 0
   );
   const expiryAction =
-    recommendPromoteCount > 0
-      ? '建議叫 Hermes 或三哥 promote'
-      : soonExpiringCount > 0
-        ? '有短記憶即將到期，建議先做 health_check 檢視'
-        : null;
+    promotedCount > 0
+      ? `auto-promoted ${promotedCount} expiring memor${promotedCount === 1 ? 'y' : 'ies'}`
+      : recommendPromoteCount > 0
+        ? 'expiring memories remain — call batch_promote or wait for next session_close'
+        : soonExpiringCount > 0
+          ? 'short-term memories approaching expiry — review with health_check if needed'
+          : null;
+
+  // 便條: optional handoff note addressed to another body
+  let noteResult = null;
+  if (to) {
+    try {
+      const noteTags = buildLifecycleMemoryTags(['note', `to:${to}`], source, dateKey);
+      const notePayload = {
+        type: 'note',
+        profile: DB_PROFILE,
+        source,
+        to,
+        note,
+        date: dateKey,
+        created_at: nowTs.toISOString()
+      };
+      const savedNote = await insertNoteMemory({
+        source,
+        to,
+        note: note || '',
+        body: JSON.stringify(notePayload),
+        tags: noteTags,
+        expires_at: expiresAt
+      });
+      noteResult = { to, note_id: savedNote?.id || null, delivered: Boolean(savedNote) };
+    } catch (error) {
+      // note columns may not be deployed yet — degrade gracefully, close itself still succeeds
+      noteResult = { to, delivered: false, error: String(error?.message || error) };
+    }
+  }
+
+  // Auto-post a session-close broadcast to the CoCo family board.
+  // Mirrors board_post insert; failures never break session_close (summary already stored).
+  let boardPostResult = null;
+  const autoBoardPost = args.auto_board_post !== false;
+  if (autoBoardPost) {
+    try {
+      const boardFromSource = source;
+      const boardFromBody = normalizeOptionalText(args.body_name, 60) || DB_PROFILE;
+      const boardTo = 'all';
+      const boardType = ['stuck', 'turn', 'collide', 'gate'].includes(args.board_type)
+        ? args.board_type
+        : 'turn';
+      const boardTopic = normalizeOptionalText(args.board_topic, 60) || 'session-close';
+      const boardText = String(summary || '').slice(0, 2000);
+      if (boardText) {
+        const boardPayload = {
+          from_source: boardFromSource,
+          from_body: boardFromBody,
+          to: boardTo,
+          topic: boardTopic,
+          type: boardType,
+          text: boardText
+        };
+        const boardInserted = await supabaseRequest(
+          '/rest/v1/board_posts?select=id,from_source,from_body,to,topic,type,text,created_at',
+          {
+            method: 'POST',
+            profile: DB_PROFILE,
+            prefer: 'return=representation',
+            body: [boardPayload]
+          }
+        );
+        boardPostResult = { posted: true, id: boardInserted?.[0]?.id || null };
+      } else {
+        boardPostResult = { posted: false, reason: 'empty summary' };
+      }
+    } catch (error) {
+      // board_posts table may not exist yet, or insert failed — degrade gracefully.
+      console.warn(`[session_close] auto board_post failed: ${String(error?.message || error)}`);
+      boardPostResult = { posted: false, error: String(error?.message || error) };
+    }
+  } else {
+    boardPostResult = { posted: false, skipped: true };
+  }
 
   return {
     ok: true,
@@ -2372,6 +2785,9 @@ async function runDailyClose(args = {}) {
     topics,
     mood: mood || null,
     tool_usage_daily_summary: toolUsageDailySummary,
+    note: noteResult,
+    board_post: boardPostResult,
+    promoted_count: promotedCount,
     expiry_alert: {
       soon_expiring_count: soonExpiringCount,
       recommend_promote_count: recommendPromoteCount,
@@ -2440,6 +2856,15 @@ function evaluatePromotionCandidate(memory, nowTs, longTermTagSet) {
       reason: '已 promoted'
     };
   }
+  // Heartbeat / session_close lifecycle memories should never be promoted —
+  // they contain query strings that pollute recall results with high similarity.
+  if (isLifecycleMemoryRow(memory)) {
+    return {
+      recommend: 'N',
+      score: 0,
+      reason: 'lifecycle memory (heartbeat/session_close) 唔應升級'
+    };
+  }
   const reasons = [];
   let score = 0;
 
@@ -3439,6 +3864,45 @@ function buildPromoteTimeline(chunk, sourceMemory) {
     source_to_promoted_seconds: sourceToPromotedSeconds
   };
 }
+
+async function runGetSummary(args = {}) {
+  const chunkId = normalizeOptionalUuid(args.id, 'id');
+  if (!chunkId) {
+    throw new Error('id is required');
+  }
+  const chunk = await fetchChunkById(chunkId);
+  if (!chunk) {
+    throw new Error(`memory chunk not found: ${chunkId}`);
+  }
+  const preview = truncateChunkContent(chunk.content, CHUNK_SUMMARY_MAX_CHARS);
+  return {
+    ok: true,
+    ...buildChunkToolFields(chunk),
+    content: preview.content,
+    preview_truncated: preview.preview_truncated,
+    content_chars: preview.content_chars,
+    drill_down: 'Use get_full for complete chunk text.'
+  };
+}
+
+async function runGetFull(args = {}) {
+  const chunkId = normalizeOptionalUuid(args.id, 'id');
+  if (!chunkId) {
+    throw new Error('id is required');
+  }
+  const chunk = await fetchChunkById(chunkId);
+  if (!chunk) {
+    throw new Error(`memory chunk not found: ${chunkId}`);
+  }
+  const fullContent = String(chunk.content ?? '');
+  return {
+    ok: true,
+    ...buildChunkToolFields(chunk),
+    content: fullContent,
+    content_chars: fullContent.length
+  };
+}
+
 async function runExplainMemory(args = {}) {
   const chunkId = normalizeOptionalUuid(args.id, 'id');
   if (!chunkId) {
@@ -3765,9 +4229,15 @@ async function callTool(name, args = {}) {
               }
             }
           : {}),
-        items: explained.items
+        items: explained.items.map(applyRecallPreviewToItem)
       };
     }
+    if (toolName === 'get_summary') {
+      return await runGetSummary(args);
+    }
+    if (toolName === 'get_full') {
+      return await runGetFull(args);
+    }
     if (toolName === 'explain_memory') {
       return await runExplainMemory(args);
     }
@@ -3993,6 +4463,204 @@ async function callTool(name, args = {}) {
       };
     }
 
+    // ── MARS-318: Board v0 handlers ──────────────────────────
+    if (toolName === 'board_read') {
+      const body = String(args.body || '').trim();
+      if (!body) throw new Error('body is required');
+      const limitRaw = Number(args.limit ?? 10);
+      const limit = Number.isFinite(limitRaw) ? Math.max(1, Math.min(50, Math.trunc(limitRaw))) : 10;
+      const includeAcked = Boolean(args.include_acked);
+      const topic = args.topic ? String(args.topic).trim() : '';
+
+      const query = new URLSearchParams();
+      query.set('select', 'id,from_source,from_body,to,topic,type,text,acked_by,expires_at,archived_at,created_at');
+      query.set('order', 'created_at.desc');
+      query.set('limit', String(limit));
+      query.set('archived_at', 'is.null');
+      query.set('resolved_at', 'is.null');
+      // Wall posts (to=all) + posts addressed to this body
+      query.set('or', `(to.eq.all,to.eq.${body})`);
+      if (topic) query.set('topic', `eq.${topic}`);
+      // Exclude expired
+      query.set('or', `(expires_at.is.null,expires_at.gt.${new Date().toISOString()})`);
+
+      const result = await supabaseRequest(`/rest/v1/board_posts?${query.toString()}`, { profile: DB_PROFILE });
+      const posts = Array.isArray(result) ? result : [];
+
+      // Filter out already-acked posts unless include_acked
+      const filtered = includeAcked
+        ? posts
+        : posts.filter(p => {
+            const ackedBy = p.acked_by && typeof p.acked_by === 'object' ? p.acked_by : {};
+            return !ackedBy[body];
+          });
+
+      const BOARD_PREVIEW_MAX = 160;
+      // MARS-328: gate/stuck surface first
+      const BOARD_READ_PRIORITY_TYPES = new Set(['gate', 'stuck']);
+      const mapped = filtered.map(p => {
+        const fullText = p.text || '';
+        const preview = fullText.slice(0, BOARD_PREVIEW_MAX);
+        return {
+          id: p.id,
+          from: `${p.from_body}@${p.from_source}`,
+          to: p.to,
+          topic: p.topic || null,
+          type: p.type,
+          text: preview,
+          truncated: fullText.length > BOARD_PREVIEW_MAX,
+          full_length: fullText.length,
+          preview_length: preview.length,
+          created_at: p.created_at,
+          acked: !!(p.acked_by && p.acked_by[body])
+        };
+      }).sort((a, b) => {
+        const aPri = BOARD_READ_PRIORITY_TYPES.has(a.type) ? 0 : 1;
+        const bPri = BOARD_READ_PRIORITY_TYPES.has(b.type) ? 0 : 1;
+        if (aPri !== bPri) return aPri - bPri;
+        return new Date(b.created_at).getTime() - new Date(a.created_at).getTime();
+      });
+      return {
+        ok: true,
+        count: mapped.length,
+        body,
+        posts: mapped
+      };
+    }
+
+    if (toolName === 'board_post') {
+      const fromSource = String(args.from_source || '').trim();
+      const fromBody = String(args.from_body || '').trim();
+      const to = String(args.to || 'all').trim();
+      const topic = args.topic ? String(args.topic).trim() : null;
+      const type = args.type || 'turn';
+      const text = String(args.text || '').trim();
+      const expiresAt = args.expires_at ? String(args.expires_at).trim() : null;
+
+      if (!fromSource) throw new Error('from_source is required');
+      if (!fromBody) throw new Error('from_body is required');
+      if (!text) throw new Error('text is required');
+      if (text.length > 2000) throw new Error('text too long (max 2000 chars)');
+
+      const payload = {
+        from_source: fromSource,
+        from_body: fromBody,
+        to,
+        topic,
+        type,
+        text
+      };
+      if (expiresAt) payload.expires_at = expiresAt;
+
+      const result = await supabaseRequest(
+        '/rest/v1/board_posts?select=id,from_source,from_body,to,topic,type,text,created_at',
+        {
+          method: 'POST',
+          profile: DB_PROFILE,
+          prefer: 'return=representation',
+          body: [payload]
+        }
+      );
+      const inserted = result?.[0] ?? null;
+      return {
+        ok: true,
+        inserted,
+        text_length: text.length
+      };
+    }
+
+    if (toolName === 'board_ack') {
+      const body = String(args.body || '').trim();
+      const ids = Array.isArray(args.ids) ? args.ids.map(id => String(id).trim()).filter(Boolean) : [];
+      if (!body) throw new Error('body is required');
+      if (!ids.length) throw new Error('ids is required (at least 1)');
+
+      const now = new Date().toISOString();
+      let acked = 0;
+      const notFoundIds = [];
+      for (const id of ids) {
+        // Read current acked_by, merge, write back
+        const rows = await supabaseRequest(
+          `/rest/v1/board_posts?id=eq.${id}&select=id,acked_by`,
+          { profile: DB_PROFILE }
+        );
+        const row = rows?.[0];
+        if (!row) { notFoundIds.push(id); continue; }
+        const ackedBy = row.acked_by && typeof row.acked_by === 'object' ? { ...row.acked_by } : {};
+        ackedBy[body] = now;
+        await supabaseRequest(
+          `/rest/v1/board_posts?id=eq.${id}`,
+          {
+            method: 'PATCH',
+            profile: DB_PROFILE,
+            prefer: 'return=minimal',
+            body: { acked_by: ackedBy }
+          }
+        );
+        acked++;
+      }
+      return { ok: true, acked, body, not_found_ids: notFoundIds };
+    }
+
+    // board_resolve — mark posts as globally resolved (hidden for all bodies)
+    if (toolName === 'board_resolve') {
+      const body = String(args.body || '').trim();
+      const ids = Array.isArray(args.ids) ? args.ids.map(id => String(id).trim()).filter(Boolean) : [];
+      if (!body) throw new Error('body is required');
+      if (!ids.length) throw new Error('ids is required (at least 1)');
+
+      const now = new Date().toISOString();
+      let resolved = 0;
+      const notFoundIds = [];
+      for (const id of ids) {
+        const rows = await supabaseRequest(
+          `/rest/v1/board_posts?id=eq.${id}&select=id,resolved_at`,
+          { profile: DB_PROFILE }
+        );
+        const row = rows?.[0];
+        if (!row) { notFoundIds.push(id); continue; }
+        if (row.resolved_at) continue; // already resolved
+        await supabaseRequest(
+          `/rest/v1/board_posts?id=eq.${id}`,
+          {
+            method: 'PATCH',
+            profile: DB_PROFILE,
+            prefer: 'return=minimal',
+            body: { resolved_at: now }
+          }
+        );
+        resolved++;
+      }
+      return { ok: true, resolved, body, not_found_ids: notFoundIds };
+    }
+
+    // MARS-327: board_get_full — single post full text retrieval
+    if (toolName === 'board_get_full') {
+      const id = String(args.id || '').trim();
+      if (!id) throw new Error('id is required');
+
+      const query = new URLSearchParams();
+      query.set('id', `eq.${id}`);
+      query.set('select', 'id,from_source,from_body,to,topic,type,text,acked_by,expires_at,archived_at,created_at');
+      const rows = await supabaseRequest(`/rest/v1/board_posts?${query.toString()}`, { profile: DB_PROFILE });
+      const post = rows?.[0];
+      if (!post) throw new Error(`board post not found: ${id}`);
+
+      return {
+        ok: true,
+        post: {
+          id: post.id,
+          from: `${post.from_body}@${post.from_source}`,
+          to: post.to,
+          topic: post.topic || null,
+          type: post.type,
+          text: post.text || '',
+          full_length: (post.text || '').length,
+          created_at: post.created_at
+        }
+      };
+    }
+
     throw new Error(`Unknown tool: ${name}`);
   } finally {
     await writeToolUsageTelemetry({
@@ -4054,15 +4722,14 @@ function isPublicHost(host) {
 }
 
 function shouldRequireBearer(req) {
-  if (!REQUIRE_BEARER) return false;
-  const host = extractRequestHost(req);
-  if (BYPASS_BEARER_FOR_PRIVATE && isPrivateHost(host)) {
-    return false;
-  }
-  if (isPublicHost(host)) {
-    return true;
-  }
-  return true;
+  // MARS-422: never trust client-supplied X-Forwarded-Host on edge traffic.
+  // See lib/auth-guard.mjs and scripts/tests/test_auth_guard.mjs.
+  return guardShouldRequireBearer({
+    headers: req.headers,
+    remoteAddress: req.socket?.remoteAddress,
+    requireBearer: REQUIRE_BEARER,
+    bypassForPrivate: BYPASS_BEARER_FOR_PRIVATE
+  });
 }
 
 function oauthProtectedResourceMetadata(baseUrl) {
@@ -4565,6 +5232,25 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
+  // Streamable HTTP: this server is POST-only (no SSE streaming of
+  // server-initiated notifications). Per MCP spec, respond to GET /mcp with
+  // 405 Method Not Allowed + an `allow` header so compliant clients (Cursor,
+  // Claude Desktop, etc.) fall back to POST-only request/response instead
+  // of treating the missing stream as a fatal transport error (404 would
+  // cause Cursor's V2 FSM to tombstone the transport after 5 retries).
+  if (
+    req.method === 'GET' &&
+    ['/mcp', '/mcp/', '/'].includes(url.pathname)
+  ) {
+    res.writeHead(405, {
+      'access-control-allow-origin': '*',
+      allow: 'POST',
+      'cache-control': 'no-store'
+    });
+    res.end();
+    return;
+  }
+
   if (req.method !== 'POST' || !['/mcp', '/mcp/', '/'].includes(url.pathname)) {
     json(res, 404, { error: 'not_found' });
     return;