@withpica/mcp-server 2.63.0 → 2.64.0

package/CHANGELOG.md

@@ -11,6 +11,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.64.0] - 2026-05-30
+
+ADR-252 WS-A surface alignment + the ADR-247 agent-hygiene crash fix. Requires `@withpica/mcp-sdk@^1.34.0`.
+
+### Fixed
+
+- **Agent-visible descriptions no longer name the dropped `work_credits` table.** ADR-252 WS-A dropped `work_credits`; composition credits now live on `work_collaborators` and master credits on `recording_credits`, but several tool/resource descriptions still described the old table (agents read these). Corrected across `pica_credit_add` hint (custody-hints), `pica_claim_credit` (now a status-only transition on `discovered_credits` — no credit row is written), `pica_claim_artist` (writes `recording_credits`), `pica_dashboard_attention` class glossary, `pica_recording_credits_update`, `pica_collaborators_accept`, the `pica_explain_count` glossary, the `pica_physical_assets_unlink_work` link-row label (now `recording_production_assets`), and the `work-credits-required` required-fields resource. Underlying write paths were already repointed in WS-A — this is description/accuracy only.
+- **Dead tool pointer.** A custody gap-hint pointed agents at the non-existent `pica_work_credits_add`; corrected to the real `pica_credit_add`.
+- **`pica_introduce_self` / `pica_outcome_log` / `pica_outcomes_recent` crashed on the happy path.** The SDK's `request()` unwraps the `{ success, data }` envelope and resolves to the inner `data`, but these three executors read `result.data.<field>` against the already-unwrapped object → `UNKNOWN_ERROR: Cannot read properties of undefined`. It surfaced rarely only because Bearer-key callers are rare (cookie/grant sessions are exempt from `introduce_self`). Root-caused in `@withpica/mcp-sdk@1.34.0` (return types corrected to the inner payload; `request()` now throws on a 2xx `success:false` body); the executors now read fields directly and guard the empty case. Added `agent-hygiene.test.ts` mocking the **inner** payload — the shape `request()` actually resolves to — which the prior coverage never exercised.
+
+### Changed
+
+- **`schema-mirror.json` refreshed off staging for the post-ADR-252 schema.** Replaced the dropped `work_credits` entry (`credit_type` / `rights_type` CHECKs no longer exist) with `work_collaborators` (only `attestation_status` is a CHECK; composition roles are validated tool-side), and added `recording_credits.attestation_status`. `refresh-schema-mirror.ts` `TABLES_TO_MIRROR` updated to match. The `work-credits-required` resource now surfaces only the `attestation_status` enum; valid role values come from the `role` field of `pica_credits_update`.
+
+## [2.63.1] - 2026-05-25
+
+Stdio/HTTP instruction parity fix.
+
+### Fixed
+
+- **Stdio `SERVER_INSTRUCTIONS`** now carry the ADR-247 first-call identity paragraph (Bearer API-key callers must call `pica_introduce_self` first). The paragraph had been added to the HTTP `/api/mcp` transport copy in 2.62.0 but not the published stdio binary, so stdio agents never saw the introduction-gate guidance even though the gate is enforced server-side. Restores parity between the two transports (enforced by the `mcp-server-instructions-parity` test).
+
 ## [2.63.0] - 2026-05-25
 
 ADR-245 (composition surface) recording-session metadata + a work-export correctness fix.