@withpica/mcp-server 2.72.0 → 2.73.0

package/CHANGELOG.md

@@ -11,8 +11,44 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.73.0] - 2026-06-12
+
+ADR-264 WS2 verify-before-assert + the WS4 front-door prerequisite (bulk
+recording credits) + ADR-268 WS1 party claims / WS2 identifier-based party
+dedup / WS5 ownership transfer types + the ADR-267 calibrated-question voice
+contract. Also removes the never-functional `pica_team_*` tools and the
+long-deprecated `pica_dashboard_pulse`.
+
 ### Added
 
+- **`pica_party_claim_invite` + `pica_party_claim_status`** — ADR-268 WS1
+  party org claim spine. `pica_party_claim_invite` sends an artist-anchored
+  claim invite for an unclaimed label/distributor/publisher organisation
+  (the user-supplied recipient email is the consent + identity anchor; the
+  single-use link redeems on the public claim landing — redemption makes the
+  claimant the org's owner, flips verification pending→verified and billing
+  hibernated→trial, and mints an active org-to-org connection with the
+  inviting catalog, never membership). Concurrent claims freeze both sides
+  as `disputed` for founder adjudication, and the tool says so instead of
+  pretending the email went out. `pica_party_claim_status` lists the claims
+  the calling org has sent with their lifecycle status. Registered in the
+  `labels` discovery category; tool count tripwire 282 → 284.
+- **`pica_recording_credits_bulk_update`** — ADR-264 WS4 prerequisite. Apply
+  one credit set across many recordings in a single call: target a release
+  (`release_id` — every recording on its tracklist) or an explicit
+  `recording_ids` list, plus a `credits[]` batch (`credited_name` + `role`
+  per entry, optional `person_id` / `split_percentage` / `split_type` /
+  `notes`). One album's production credits stops being 30 sequential
+  per-recording calls. Existing (recording, credited name, role) rows are
+  skipped, never overwritten — re-running is safe; `dry_run: true` previews
+  the exact per-row `would_create` / `would_skip_existing` decision set the
+  execute path uses. Validation is all-or-nothing with per-problem detail
+  (invalid input applies NOTHING); application returns per-row
+  `created` / `skipped_existing` results. Caps: 100 recordings, 50 credits,
+  500 total rows per call. Backed by the new
+  `POST /api/admin/recording-credits/bulk` route (org-scoped at every step:
+  release, tracklist, recordings, and person_ids must all belong to the
+  caller's organisation).
 - **`pica_works_verify_registrations`** — ADR-264 WS2 truthful diagnosis. Verify
   the registration status of up to 25 works. `mode: "check"` looks each work up
   at the MLC (ISWC → title + writer IPI → title + primary-artist name) and
@@ -26,6 +62,94 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   now carry an `evidence` block (`unverified_absent` / `verified_absent` /
   `user_confirmed_absent` with `verified_via` + `checked_at`) reflecting these
   assertions.
+- **`unconnected_collaborators`** attention class (taxonomy gap, f0266f09
+  gap #6): people credited on the org's works with no linked PICA account now
+  appear on `pica_dashboard_attention` / briefing totals / `pica_count_explain`
+  — one shared compute with `briefing.unconnected_collaborators` so the
+  surfaces structurally cannot drift. drill_down_skill null until a skill
+  covers collaborator connection.
+- **Decision blocks (calibrated questions)** — `pica_find_duplicates` groups,
+  the `pica_merge_duplicates` MERGE_BLOCKED_PROVENANCE error, and
+  `pica_works_verify_registrations` mode:"check" (when works couldn't be
+  verified) now carry a `decision` field: a question with 2-3 options,
+  plain-language consequences, and a safe default — no UUIDs in any decision
+  text (a UUID-shaped title degrades by omitting the block, never failing the
+  call). Always additive: the structured payload carries everything the block
+  says. `pica_dashboard_briefing` now carries `user_message` — one
+  ready-to-say lowercase sentence in the curiosity register (no loss framing
+  on unverified counts).
+
+### Changed
+
+- **`pica_recording_custody_assign`** — ownership transfer types are live
+  (ADR-268 WS5, the ADR-262 fast-follow): `transfer_type` now accepts
+  `assignment` (title transfers) and `full_transfer` (ownership AND control)
+  alongside the v1 control/possession types. An ownership leg also moves the
+  recording's master ownership splits append-only in the same transaction —
+  the transferor's active era closes (`end_date`), the transferee's opens —
+  and the credit layer never moves. Honest-gap refusals (400, typed codes):
+  a partial percentage with more than one active owner
+  (`PARTIAL_TRANSFER_AMBIGUOUS`), a transfer exceeding the transferor's
+  share (`INSUFFICIENT_TRANSFEROR_SHARE`), or a percentage outside (0,100]
+  (`INVALID_PERCENTAGE`) — nothing is ever silently lost.
+- **`pica_labels_create`** accepts an optional `identifiers` object
+  (`musicbrainz_label_id` / `isni` / `label_code` / `discogs_label_id` /
+  `wikidata_id` / `deezer_label_id`) — ADR-268 WS2. Dedup is now
+  identifier-first: supplied identifiers resolve to the global label identity
+  and an org already bridged to that identity is returned
+  `already_existed: true` EVEN when the supplied name differs;
+  case-insensitive name matching (ADR-265 behaviour) stays as the fallback,
+  and a name-matched org missing the bridge is backfilled when an identity
+  was resolved. Param addition only — no new tool.
+- **`first-session` skill** now carries the calibrated-question library (ADR-267
+  Step 1): open-over-closed decision questions, diagnosis labels, no-oriented
+  phrasing for destructive moves, options-with-consequences, evidence-gated
+  stakes, and a no-UUIDs-in-user-facing-text contract. Specialist skills adopt
+  the same grammar incrementally; the WS4 front-door skill embeds it at birth.
+- **`pica_works_create` / `pica_works_update` `mood` param description** now
+  states the value is stored on the work's primary recording's audio traits
+  (recording-grain, ADR-266 Stage 2c) — caller contract unchanged.
+
+### Fixed
+
+- **Review-link contract** — server instructions told every agent to share
+  `withpica.com/workspace?type=<entity>&id=<id>` after writes; now the
+  schema-direct `/inspect/<feature>/<id>` shape (both byte-parity copies).
+  uploads/audio/exports tool descriptions point users at `/inspect`.
+
+### Deprecated
+
+- **`pica_import_from_spotify`** — use `pica_import_streaming_link` (same
+  two-step flow, also supports Deezer). Structured
+  `{deprecated, removal_target: "2.74.0"}` in TOOL_METADATA; the new
+  lint-mcp-tools deprecation-expiry check BLOCKS any publish at or past the
+  removal target, so this cannot overstay like pulse did.
+- **`briefing.unverified_writers`** count source — `briefing.unenriched_writers`
+  is the canonical name (matches the actionable-issues taxonomy class); the
+  alias shares one definition and is accepted until 2.74.
+
+### Removed
+
+- **`pica_team_*` (all 5: `pica_team_list` / `pica_team_get` / `pica_team_invite`
+  / `pica_team_update_role` / `pica_team_remove`)** — founder decision
+  2026-06-11. The backing routes (`/api/admin/team/*`) are session-only BY
+  DESIGN (ADR-248: team membership is human-only), so every bearer/MCP caller
+  has always received a hard 401 — the tools never worked for any agent and
+  never could. Removing them is honesty, not a regression: agents stop being
+  advertised a capability that structurally cannot succeed. Team membership
+  stays managed by humans in `/settings`. Also removed: the `team` discovery
+  category, the `pica_team_remove` destructive-confirmation case, recovery
+  hints, cost-model entries, and the `set-up-workspace` skill's Block 5 now
+  points users at `/settings` instead of the tools. Tool count tripwire
+  287 → 282; destructive tripwire 20 → 19.
+- **`pica_dashboard_pulse`** — deprecated since ADR-247 with a removal window
+  that passed (prod telemetry: 3 calls all-time, exploratory).
+  `pica_dashboard_briefing` is the canonical attention surface; pulse's
+  revenue-at-risk/deadline predicates retired with it (they disagreed with
+  the briefing coherence contract). Tool count tripwire 288 → 287.
+- **`suggested_skill`** alias dropped from `pica_dashboard_attention` rows
+  (deprecated 2026-05-22; soak window long passed; zero non-test consumers).
+  `drill_down_skill` is the canonical field.
 
 ## [2.72.0] - 2026-06-10