@withpica/mcp-server 2.95.1 → 2.95.3

package/CHANGELOG.md

@@ -11,6 +11,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.95.3] - 2026-08-18
+
+### Fixed
+
+- **`tools/list` no longer publishes this package's own authoring metadata.** `ToolDefinition` is two types wearing one name — the MCP `Tool` a client consumes, and the compile-time declarations our lint reads — and `listTools()` spread the whole object, so every field of the second kind crossed the wire. `vernacular_kind`, `vernacular_reason` and `annotationOverrides` are now stripped at the wire boundary. **Not a breaking change:** none of the three is part of the MCP `Tool` schema, no documented behaviour read them, and everything a client acts on (`name`, `description`, `inputSchema`, `annotations`, `tier`, `scope`, `audiences`, `workflows`) is untouched. The registry's own view is untouched too, so tooling that reads definitions in-process still sees them.
+- **The handshake and the skill bodies no longer cite internal decision records.** `vernacular_reason` on ~30 tools read "Specialist context; not yet covered by the Creator Question Atlas — pending telemetry-driven addition per ADR-226 Phase 4 substrate writes"; five `SKILL.md` bodies, two prompt bodies and the server instructions carried similar citations. An ADR number is a coordinate into a repository the reader cannot open, and an agent handed one repeats it to a user as if it were vocabulary they should already know — which is exactly what happened in a real connector session on 2026-08-18.
+- **The handshake's URI-shape pointer now names something reachable.** It read `docs/mcp-source-uri-conventions.md` — a path in the app repository, handed to agents that have no checkout. It now names `pica_skill_get("enrich-from-peer-mcps")`, the skill that actually carries the scheme table, which an agent can follow in one call.
+
+> Patch, not minor, on purpose: `2.96.0` stays reserved for the WS5 deprecated-alias removals, which `src/tools/deprecations.ts` enforces as its removal target. Bumping the minor here would bring that deadline forward by accident.
+
+> Scope note for anyone tracing this: the stripped-metadata leak affected the **stdio** surface — this package's flat `tools/list`. The app's HTTP transport serves layered discovery, where `tools/list` returns only the meta tools and `pica_discover` / `pica_tool_details` build responses by picking fields explicitly, so a connector was never reading it. The handshake and skill-body fixes reach both surfaces.
+
+## [2.95.2] - 2026-07-28
+
+### Added
+
+- **`pica_consent_readiness` (ADR-300)** — the read side of ADR-292's consent ledger. Returns an org-scoped readiness verdict: a `rungs` map giving cleared / partial / blocked / unset asset counts at each consent level, a `blockers` list naming credited people with no decision recorded or an explicit refusal (refusals first, then by catalogue reach), and `blockedAssets`. `truncated` reports honestly when a list was capped. An asset is cleared at a level only when EVERY credited contributor has granted at least that level; one live revocation blocks it at every level. Read tier, free, all three audiences. Deliberately read-only — consent WRITES stay human-session only, because a consent decision has to be made by the person whose rights it binds, not by an agent acting for them.
+
+### Changed
+
+- **`pica_export_ai_consent` description corrected.** It claimed to show "which works are human-made, AI-assisted, or AI-generated" — that is `works.ai_disclosure_level` (ADR-086), a different field the AI-consent service has never read. Agents were being pointed at the wrong feature. The description now says what the tool does (produces the consent FILE) and routes intent for the ANSWER to `pica_consent_readiness`.
+- The consent file's per-asset `use_cases_allowed` now reflects the consent LEVEL, and `assets.csv` gains a `cleared_level` column. This narrows what the export claims: a work whose contributors granted only `tracking_only`, or where any contributor has not answered, no longer reports training/generation/commercial as permitted. See the app repo's FIX_LOG 2026-07-27 entry — a previously downloaded ZIP will disagree with the next one, and the next one is right.
+
+> Patch, not minor, on purpose: `2.96.0` stays reserved for the WS5 deprecated-alias removals.
+
 ## [2.95.1] - 2026-07-27
 
 ### Added