vantage-peers-mcp 2.16.0 → 2.18.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [2.18.0] — 2026-08-11
+
+### Changed
+- **Expose only the CORE tool surface (mission `vp-mcp-alias-cleanup-v1`, S8).** A data-driven allowlist (`mcp-server/tool-exposure.json`, `{"core":[...]}`) masks every tool whose `T2_verdict` is not `CORE` in `analysis/vantagepeers/vp-restructuring/vp-by-tool-day158.csv`. Masking ≠ deletion: non-CORE tools stay registered + handler-wired and are `disable()`d so `tools/list` does not advertise them; reverting = removing a line from the data file. Exposed = CORE ∩ registered = **66** tools; masked = **43** (registered 109). The exposure list is derived from the CSV, never typed; a name in the file matching no registered tool makes the server refuse to start, naming it. Applied at the single shared `registerTools` surface, so both stdio and HTTP transports (online clients) inherit the reduced surface. 5 CORE names from the day158 CSV are #1169-removed aliases whose CORE survivors stay exposed (zero capability lost). Tests: `test/tool-exposure.test.ts` 2/2, full suite 1071 passed / 0 failed, tsc 0.
+
+## [2.17.0] — 2026-08-11
+
+### Removed
+- 14 duplicate alias tools removed (mission `vp-mcp-alias-cleanup-v1`, S2, merged in #1169), keeping the fleet-used survivor of each pair — decided by call-site usage, never the code's `DEPRECATED ALIAS` label. Registered tool count 123→109. Context-token saving 1347 (11.1%) of the tool-list surface. Full list + arbitration in the root `CHANGELOG.md` and `elpi-corp/.../S1-arbitrated-pairs-day159.md`.
+
+## [Unreleased] — final refus-total sweep (8 tools) → remaining: 0
+
+### Security
+
+- **Close the last 8 same-class refus-total instances on the client MCP surface.** `get_profile`, `list_peers`, `list_repo_mappings`, `get_repo_mapping`, `get_message` fed `scopeFilterList`/`scopeFilterGet` rows lacking `createdBy`/`namespace` → named remap of the real ownership field (`profiles.orchestratorId`, `githubRepoMapping.orchestrator`, `messages.from`) → `createdBy` before the filter, synthetic field stripped (the `list_broadcast_status` precedent). `list_issues`, `get_issue`, `issue_stats` have no client-owner field (fleet routing/aggregate data; sibling mutations already master-only) → `defineTool` scope `{ kind: "master" }`, structural removal from the client surface. Per tool RED→GREEN with four independent poles; 37 new tests (4 files) + updated `scope-aware-filter-wave-c2`/`c3` (stale fixtures that asserted the old leak as acceptable, aligned to the merged `list_errors` template). RED without fix: 18 owner-pole failures; full CI-scoped suite 2679/2679 green; tsc + scope-typecheck exit 0. **Final class sweep: `remaining: 0`** — every remaining `scopeFilterList`/`scopeFilterGet` site operates on a table with native `createdBy`/`namespace` or already remaps its non-native owner; `check_messages`/`mark_as_read`/`list_tasks`/`list_missions`/`list_diaries` use dedicated non-`scopeFilterList` gates (out of this defect class). Closes VP `k1759mg282aqy6t7c91gnk10598bn4sv`; completes mission `vp-multitenant-zero-hole-v1`.
+
+## [Unreleased] — list_bus / list_mandates / list_errors refus-total close
+
+### Security
+
+- **Scope `list_bus`/`get_bu`, `list_mandates`/`get_mandate` to their owner; move `list_errors`/`get_error` to master-only.** These six handlers fed `scopeFilterList`/`scopeFilterGet` rows whose shape carried neither `createdBy` nor `namespace`, so the guard refused **every** non-master caller including the owner (the refus-total form measured in the S0 campaign). Per-table remedy, decided by measurement: `businessUnits` is owned by `orchestratorId` → named remap to `createdBy` before the filter (the `list_broadcast_status` precedent); `mandates` has two owners `requestedBy`/`fulfilledBy` → dual remap unioned by `_id` (a single remap would hide one party's own mandates); `errorLogs` has no client owner (fleet-ops monitoring) → its `defineTool` scope becomes `{ kind: "master" }`, a structural removal from the client surface (non-master now gets an explicit Forbidden instead of a silent empty list). Per tool: RED (owner refused) → GREEN with owner/deny/master poles moving independently; 28 new tests + updated `scope-aware-filter-wave-c3`; full CI-scoped suite green, tsc + scope-typecheck exit 0. Class sweep found 8 further same-class instances (`get_profile`, `list_peers`, `list_issues`, `get_issue`, `issue_stats`, `list_repo_mappings`, `get_repo_mapping`, `get_message`) — tracked as a follow-up, out of this PR's named scope. Closes VP `k177617dqg6z5c099p1rdp5rqn8b2rp0`.
+
+## [Unreleased] — content-search multi-tenant scope (refus-total close)
+
+### Security
+
+- **Scope three content-rendering MCP tools to their caller.** `list_messages`, `search_messages_by_keyword`, and `search_tasks_by_keyword` fed `scopeFilterList` rows whose rendered shape carried neither `createdBy` nor `namespace`, so the naive guard wrap would have refused **every** caller including the owner (the refus-total defect PR #1122 deliberately avoided for the two search tools; `list_messages` already exhibited it). Fix: message-shaped tools (`from` field) get a named `from`→`createdBy` remap before `scopeFilterList` with the synthetic field stripped on output (the `list_broadcast_status` precedent); `search_tasks_by_keyword` requests `fields=full` internally, filters against the real `createdBy`, then reprojects to the public `lite` shape (avoids changing the public tool shape). Per-tool RED→GREEN with four independent poles (cross-tenant reproduction, owner-only, deny-only, master-all): RED 8-fail without fix → GREEN 17/17. tsc exit 0. Unremapped-shape audit: all 22 `scopeFilterList` sites checked, only the two message sites needed the remap. Closes VP `k175j2jems5deccegp4p0fy4x98b4ypn` + `k1780azk7n8fdb7bpnx5n91sx18b5vjf`.
+
 ## 2.14.2 — 2026-06-30
 
 - fix(oauth): DCR `/register` rejects empty/missing/malformed `redirect_uris` (RFC 7591 §3.2.2 `invalid_redirect_uri`). Closes zombie-client class — clients with empty `redirectUris` arrays can no longer be created. Defense-in-depth: same guard at Convex `registerPublicClient`. TDD-strict RED-then-GREEN.
@@ -319,7 +347,7 @@ across audit, docs, hooks, security, and consistency dimensions. 15 PRs merged t
 
 ### Scope-aware filtering
 - `list_tasks` `fromAllowList[]` + case-insensitive matching (PR #654, #661).
-- 3 admin endpoints reinstated for Marie cohort (prior session).
+- 3 admin endpoints reinstated for Nadia cohort (prior session).
 
 ### Tenant trio
 - Persistent test tenant trio (alpha/beta/gamma) seeded on prod with bearers, scope_profiles, and seed data for cross-orchestrator E2E.
@@ -337,7 +365,7 @@ No runtime / API / schema changes. Documentation + metadata only.
 
 What changed since v2.4.12:
 - `mcp-server/package.json`: author restructured to "VantageOS AI Orchestrator Team" with contributors block (Pi, Laurent Perello, ElPi Corp). Dependency `@vantageos/mosaic@^0.1.2` added for Phase 1 Mosaic groundwork (PR #605, server-side createMosaicResource API ready for Phase 2 primitive swap).
-- `mcp-server/CHANGELOG.md`: version headers simplified to `X.Y.Z — YYYY-MM-DD` (Day N anchors dropped per Laurent verdict 2026-06-02 — dates are self-explanatory, day numbers added noise). Narrative client-name mentions (Marie/Iris RH/Cédric Delport) genericized to "early-access RH cohort" / "self-host incident" per RULE #7 pre-public scrub.
+- `mcp-server/CHANGELOG.md`: version headers simplified to `X.Y.Z — YYYY-MM-DD` (Day N anchors dropped per Laurent verdict 2026-06-02 — dates are self-explanatory, day numbers added noise). Narrative client-name mentions (Nadia/<client-org>/Cédric Delport) genericized to "early-access RH cohort" / "self-host incident" per RULE #7 pre-public scrub.
 - Root README rework (PR #611 + PR #610 + PR #616 chain): TL;DR + Mermaid architecture diagram + 5 hero features + 22-features collapsed details + 84-tools 8-groups + Backend: Convex 3-paths + attribution Credits section. README /team 404 hotfix landed in PR #616.
 
 Merged PRs in this republish window:

package/README.md

@@ -3,10 +3,10 @@
 [![npm version](https://img.shields.io/npm/v/vantage-peers-mcp)](https://www.npmjs.com/package/vantage-peers-mcp)
 [![npm downloads](https://img.shields.io/npm/dm/vantage-peers-mcp)](https://www.npmjs.com/package/vantage-peers-mcp)
 [![License: FSL-1.1-Apache-2.0](https://img.shields.io/badge/license-FSL--1.1--Apache--2.0-blue)](https://github.com/vantageos-agency/vantage-peers/blob/main/LICENSE)
-[![MCP tools: 116+](https://img.shields.io/badge/MCP_tools-116+-green)]()
+[![MCP tools: 109+](https://img.shields.io/badge/MCP_tools-109+-green)]()
 
 > **Package:** `vantage-peers-mcp` (plain — NOT `@vantageos/vantage-peers-mcp`)
-> **Current version:** `2.13.1` (Day-114 release — `list_memories` + `list_episodes` silent `items:[]` fix)
+> **Current version:** `2.18.0` (S8 CORE tool-exposure filter release — server now advertises only 66 CORE tools of 109 registered; masking is data-driven (`tool-exposure.json`) and reversible, non-CORE tools stay registered/handler-wired but are not listed)
 > **License:** FSL-1.1-Apache-2.0
 > **Repo:** https://github.com/vantageos-agency/vantage-peers (full monorepo README at `/README.md`)
 > **Docs:** https://vantagepeers.com/docs
@@ -14,7 +14,7 @@
 
 MCP server for [VantagePeers](https://vantagepeers.com) — shared memory, messaging, and task coordination for AI agent teams.
 
-116+ tools across 20 categories: memory, episodes, profiles, tasks, missions, mission templates, messages, diary, briefing notes, search (RAG), issues, fix patterns, error monitoring, deployments, business units, components, mandates, recurring tasks, OKF bundles, observability, and session. All tools ship with ChatGPT Apps SDK annotations (`readOnlyHint`, `openWorldHint`, `destructiveHint`) for native UX in ChatGPT custom connectors.
+109+ tools across 20 categories: memory, episodes, profiles, tasks, missions, mission templates, messages, diary, briefing notes, search (RAG), issues, fix patterns, error monitoring, deployments, business units, components, mandates, recurring tasks, OKF bundles, observability, and session. All tools ship with ChatGPT Apps SDK annotations (`readOnlyHint`, `openWorldHint`, `destructiveHint`) for native UX in ChatGPT custom connectors.
 
 ## Quick start
 
@@ -94,6 +94,8 @@ The same loop works verbatim for every `list_*` tool (`list_memories`, `list_epi
 
 **Never** a CSV string (`"todo,in_progress"`) — no handler parses it; the call will reject with `invalid_union`.
 
+The task/mission enum includes a terminal **`cancelled`** status for retiring an erroneously-created row. Set it via `update_task` / `update_mission` with `status="cancelled"` + a mandatory `cancelReason` (creator-only). A cancelled row is **excluded** from the `open` and `active` aliases (present only under `"all"`) and is never counted as `done`; an already-`done` task or `complete` mission cannot be cancelled (`CANNOT_CANCEL_DONE`).
+
 ### Day-114 fixes (shipped in v2.13.1)
 
 - **CRITICAL — `list_memories` + `list_episodes` were silently returning `items: []` on every call.** Both handlers read `memories?.page` from the Convex `listMemories` paginate-shape `{value, continueCursor, isDone}`. `.page` is `undefined`, so the envelope shipped empty regardless of seeded data — and `nextCursor` was never emitted. **Pre-2.13.1 callers consuming these two tools MUST upgrade**: any logic that branched on "no memories found" was wrong.
@@ -184,7 +186,7 @@ VantagePeers ships a built-in OAuth 2.1 authorization server so Claude.ai web ca
 | Layer | Token type | scopeProfile | Namespace access |
 |-------|-----------|-------------|-----------------|
 | 1 | `BEARER_SECRET_MASTER` static token | `master` | Full — all namespaces |
-| 2 | Admin-provisioned OAuth access token (`oauth_access_tokens` table) | varies (e.g. `marie-iris-rh`) | Per-profile prefix list |
+| 2 | Admin-provisioned OAuth access token (`oauth_access_tokens` table) | varies (e.g. `<client-profile>`) | Per-profile prefix list |
 | 2.5 | **Clerk JWT** (org session, `org_id` claim present) | `team-member` | `team/<orgId>/*` only |
 | 3 | DCR auto-registered client (`oauthTokens` table) | `client-generic` | Deny-by-default (empty prefixes) |
 | 4 | Legacy internal bearer (`mcpTenants` table) | unscoped | Tenant deployment URL routing |
@@ -207,8 +209,8 @@ The full registered list ships in `mcp-server/src/tools.ts` and is enumerated be
 
 ### Memory (8)
 - `store_memory` — write a memory to a namespace
-- `search_memories_by_semantic` (alias `recall`) — vector-search memories; VP-Sources doctrine applies
-- `search_memories_by_keyword` (alias `text_search`) — BM25 keyword search over memories
+- `recall` — semantic vector-search over memories; VP-Sources doctrine applies
+- `text_search` — BM25 keyword search over memories
 - `list_memories` — page through memories in a namespace
 - `get_memory` — fetch a single memory by id
 - `soft_delete_memory` — mark a memory deleted (recoverable)
@@ -230,13 +232,13 @@ The full registered list ships in `mcp-server/src/tools.ts` and is enumerated be
 - `list_tasks` — page through tasks with filters + `excludeAutoGenerated`
 - `list_tasks_by_mission` — page through tasks for a single mission
 - `get_task` — fetch a single task by id
-- `update_task` — patch task fields
+- `update_task` — patch task fields (incl. cancel: `status="cancelled"` + `cancelReason`, creator-only)
 - `start_task` — transition to `in_progress`
 - `complete_task` — close with evidence-bound `completionNote`
 - `checkout_task` — claim a task without starting
-- `delete_task` — destructive delete (master-gated; prefer `complete_task`)
+- `delete_task` — destructive delete (master-gated, blocked in prod; to retire an erroneous task use `update_task status="cancelled"` + `cancelReason`, not `complete_task`)
 - `block_task` — mark blocked with reason
-- `add_task_dependency` (alias `create_task_dependency`) — add a predecessor
+- `add_task_dependency` — add a predecessor
 - `bulk_complete_tasks` — dry-run-default bulk close (cron-spam cleanup)
 - `validate_task_payload` — client-side payload validation
 - `search_tasks_by_keyword` — BM25 keyword search over tasks
@@ -324,7 +326,7 @@ Returns `{ count, sampleIds, bulkRunId, executedAt? }`:
 - `create_mission` — create a mission with `agents` + `createdBy` + `project` (all required)
 - `list_missions` — page through missions; accepts `status` array OR alias
 - `get_mission` — fetch a single mission by id
-- `update_mission` — patch mission fields
+- `update_mission` — patch mission fields (incl. cancel: `status="cancelled"` + `cancelReason`, creator-only)
 - `update_mission_status` — transition mission state
 - `get_mission_template` — read a mission template
 
@@ -343,10 +345,10 @@ Returns `{ count, sampleIds, bulkRunId, executedAt? }`:
 - `search_messages_by_keyword` — BM25 keyword search over messages
 
 ### Diary (4)
-- `write_diary` (alias `create_diary`) — append a diary entry
+- `write_diary` — append a diary entry
 - `get_diary` — fetch a single diary entry
 - `list_diaries` — page through diary entries
-- `update_summary` (alias of `set_summary`) — update session summary
+- `set_summary` — update session summary
 
 ### Briefing Notes (5)
 - `create_briefing_note` — write a structured briefing note
@@ -368,9 +370,9 @@ Exports `SEARCH_BRIEFING_NOTES_BY_KEYWORD_TOOL_DESCRIPTION` from `mcp-server/src
 Same two advisory VP-Sources doctrine paragraphs appended after the existing description (identical strings, see `recall` in Search / RAG above).
 
 ### Search / RAG (4)
-- `search_fix_patterns_by_semantic` (alias `search_fix_patterns`) — vector-search fix patterns
-- `search_memories_by_keyword` (alias `text_search`) — BM25 keyword search; VP-Sources doctrine applies
-- `search_components_by_keyword` (alias `search_components`) — keyword search over components
+- `search_fix_patterns` — semantic vector-search over fix patterns
+- `text_search` — BM25 keyword search over memories; VP-Sources doctrine applies
+- `search_components` — keyword search over components
 - `hybrid_search` — RRF-fused vector + BM25 search; VP-Sources doctrine applies
 
 Knowledge Base document upload is a two-step flow (see `docs/cloud/kb-ingest.md`):
@@ -381,7 +383,7 @@ Ingested documents are then fully retrievable through `recall`, `text_search`, a
 
 #### `recall` — VP-Sources doctrine (PR-H)
 
-Alias of `search_memories_by_semantic`. Exports `RECALL_TOOL_DESCRIPTION` from `mcp-server/src/tools.ts`.
+Canonical semantic memory-search tool. Exports `RECALL_TOOL_DESCRIPTION` from `mcp-server/src/tools.ts`.
 
 The description now embeds two advisory VP-Sources doctrine paragraphs appended after the existing text:
 
@@ -393,7 +395,7 @@ Doctrine is advisory-only — no hook blocks on absence. Client LLMs read the do
 
 #### `text_search` — VP-Sources doctrine (PR-H)
 
-Alias of `search_memories_by_keyword`. Exports `TEXT_SEARCH_TOOL_DESCRIPTION` from `mcp-server/src/tools.ts`.
+Canonical BM25 keyword memory-search tool. Exports `TEXT_SEARCH_TOOL_DESCRIPTION` from `mcp-server/src/tools.ts`.
 
 Same two advisory VP-Sources doctrine paragraphs appended after the existing description (identical strings, see `recall` above).
 
@@ -415,8 +417,8 @@ Same two advisory VP-Sources doctrine paragraphs appended after the existing des
 - `create_fix_pattern` — write a validated fix pattern to the KB
 - `list_fix_patterns` — page through fix patterns
 - `get_fix_pattern` — fetch a single fix pattern
-- `add_fix_attempt` (alias `create_fix_attempt`) — log an attempt against a pattern
-- `validate_fix` (alias `check_fix`) — promote a candidate fix to validated
+- `add_fix_attempt` — log an attempt against a pattern
+- `validate_fix` — promote a candidate fix to validated
 - `link_issue_to_pattern` — link a VP issue id to a fix pattern
 
 #### `create_fix_pattern`
@@ -522,11 +524,11 @@ Example:
 - `get_error` — fetch a single error event
 
 ### Deployments & Repos (6)
-- `add_deployment` (alias `register_deployment`) — register a deployment URL
-- `remove_deployment` (alias `delete_deployment`) — deregister a deployment
+- `add_deployment` — register a deployment URL
+- `remove_deployment` — deregister a deployment
 - `list_repo_mappings` — page through orchestrator ↔ repo mappings
-- `add_repo_mapping` (alias `register_repo_mapping`) — register a repo mapping
-- `remove_repo_mapping` (alias `delete_repo_mapping`) — deregister a repo mapping
+- `add_repo_mapping` — register a repo mapping
+- `remove_repo_mapping` — deregister a repo mapping
 - `get_repo_mapping` — fetch a single repo mapping
 
 #### `list_repo_mappings` — args schema + defaults (PR-C)
@@ -572,7 +574,7 @@ Returns `{ items: BusinessUnit[], nextCursor: string | null }`. `nextCursor` is
 - `get_component` — fetch a single component
 - `update_component` — patch component fields
 - `delete_component` — destructive delete (master-gated)
-- `search_components_by_keyword` (alias `search_components`) — keyword search
+- `search_components` — keyword search over components
 
 #### `list_components` — args schema + defaults (PR-B)
 
@@ -596,7 +598,7 @@ Returns `{ items: Component[], nextCursor: string | null }`. `nextCursor` is `nu
 - `get_mandate` — fetch a single mandate
 - `accept_mandate` — counterparty acceptance
 - `update_mandate` — patch mandate fields
-- `validate_mandate_spending` (alias `check_mandate_spending`) — verify spend is within cap
+- `validate_mandate_spending` — verify spend is within cap
 - `settle_mandate` — close a mandate with settlement note
 
 ### Recurring Tasks (7)
@@ -617,7 +619,7 @@ Returns `{ items: Component[], nextCursor: string | null }`. `nextCursor` is `nu
 - `whoami` — returns `suggested_orchestrator_id`, `scope_profile`, `namespace_read_prefixes` for skill auto-resolution
 
 ### Session (1)
-- `set_summary` (alias `update_summary`) — write the session summary
+- `set_summary` — write the session summary
 
 ### Observability (1)
 - `improvisation_digest` — weekly advisory scan for fleet-state claims missing VP-Sources footers
@@ -742,13 +744,13 @@ A fix pattern is a validated learning extracted from a resolved bug — symptom,
 
 The cycle runs as follows:
 
-1. **Agent encounters a bug.** Before touching any code, call `search_fix_patterns_by_semantic` (alias `search_fix_patterns`) with a plain-language description of the symptom. The KB returns ranked matches using semantic vector search.
+1. **Agent encounters a bug.** Before touching any code, call `search_fix_patterns` with a plain-language description of the symptom. The KB returns ranked matches using semantic vector search.
 2. **KB hit.** If a validated pattern is returned, apply the known fix directly. Log the reuse via `add_fix_attempt` (`worked: true`) so confidence scores stay current.
 3. **KB miss.** If no pattern matches, the agent fixes the bug manually using standard debugging. Once resolved, the learning is captured immediately via `create_fix_pattern` — symptom, root cause, severity, stack, and the working fix.
 4. **Validation.** After the fix holds in production (or after a second independent confirmation), call `validate_fix` to promote the pattern to validated status. This is the signal that downstream agents can trust the pattern without verification.
 5. **Issue linkage.** Call `link_issue_to_pattern` to attach the VantagePeers issue ID to the pattern. This creates a bidirectional reference: the issue record points to the pattern, and the pattern's `linkedIssueIds` list points back.
 
-The four tools that power this cycle are: `create_fix_pattern`, `add_fix_attempt`, `validate_fix`, and `link_issue_to_pattern`. The fifth tool, `search_fix_patterns_by_semantic` (alias `search_fix_patterns`), is in the Search / RAG category and is the entry point agents should call first.
+The four tools that power this cycle are: `create_fix_pattern`, `add_fix_attempt`, `validate_fix`, and `link_issue_to_pattern`. The fifth tool, `search_fix_patterns`, is in the Search / RAG category and is the entry point agents should call first.
 
 On the agent side, the `/capitalize-fix` skill and the `inject-fix-patterns` hook automate steps 3-5: the hook fires on task completion events and prompts the orchestrator to capture the learning before closing the task. The cycle is designed to be low-friction — one tool call per step, all via MCP, no `npx convex run` required.
 

package/dist/server-http.d.ts

@@ -11,7 +11,12 @@
  *       · master bearer (admin shortcut, scopeProfile=master)
  *       · OAuth access_token (scoped, persisted in oauth_access_tokens)
  *       · legacy mcpTenants bearer (internal orchestrators on their own deployment)
- *   - Per-request ConvexHttpClient pointed at the resolved deployment
+ *   - Per-request ConvexHttpClient pointed at the resolved deployment, with
+ *     the CALLER'S identity attached (see selectConvexClientForRequest in
+ *     src/authenticatedConvexClient.ts) — the caller's own Clerk JWT on the
+ *     Clerk-team path, the MCP server's service-account identity otherwise.
+ *     Never a plain, identity-less client (P0 fix 2026-08-07: Convex's
+ *     withOrgScope fail-closed on null identity, RBAC_DENIED for everyone).
  *   - Stateless mode: fresh McpServer + transport per request (no session state)
  *
  * OAuth state (clients, codes, access/refresh tokens, scope profiles) is

package/dist/server-http.js

@@ -11,7 +11,12 @@
  *       · master bearer (admin shortcut, scopeProfile=master)
  *       · OAuth access_token (scoped, persisted in oauth_access_tokens)
  *       · legacy mcpTenants bearer (internal orchestrators on their own deployment)
- *   - Per-request ConvexHttpClient pointed at the resolved deployment
+ *   - Per-request ConvexHttpClient pointed at the resolved deployment, with
+ *     the CALLER'S identity attached (see selectConvexClientForRequest in
+ *     src/authenticatedConvexClient.ts) — the caller's own Clerk JWT on the
+ *     Clerk-team path, the MCP server's service-account identity otherwise.
+ *     Never a plain, identity-less client (P0 fix 2026-08-07: Convex's
+ *     withOrgScope fail-closed on null identity, RBAC_DENIED for everyone).
  *   - Stateless mode: fresh McpServer + transport per request (no session state)
  *
  * OAuth state (clients, codes, access/refresh tokens, scope profiles) is
@@ -28,10 +33,10 @@ import { readFileSync } from "node:fs";
 import { McpServer, ResourceTemplate, } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { timingSafeEqual } from "@vantageos/cloud-identity";
-import { ConvexHttpClient } from "convex/browser";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 import { bearerAuthMiddleware, internalClient, masterOnlyMiddleware, sha256Base64Url, sha256Hex, } from "./src/auth.js";
+import { selectConvexClientForRequest } from "./src/authenticatedConvexClient.js";
 import { registerTools } from "./src/tools.js";
 import { listUiResources, readUiResource } from "./src/ui-resources/index.js";
 let pkg;
@@ -655,13 +660,21 @@ app.get("/health", (c) => c.json({
     status: "ok",
     service: "vantage-peers-mcp-http",
     version: pkg.version,
+    // Day 145: /health could not discriminate which commit was actually
+    // serving traffic during the Railway silent-failure incident (10
+    // deploys failed 2026-07-14..2026-07-21 while the old container kept
+    // answering). RAILWAY_GIT_COMMIT_SHA is set by Railway's build system
+    // at build time — never hand-typed. Fallback is an honest "unknown"
+    // string, never a value shaped like a SHA (would be indistinguishable
+    // from a real commit and defeat the whole point of this field).
+    commit: process.env.RAILWAY_GIT_COMMIT_SHA ?? "unknown",
     transport: "streamable-http",
     oauth: "supported",
     scopes: ["mcp:full"],
 }));
 // ─────────────────────────────────────────────────────────────────────────────
 // Admin endpoints — master token only
-// Used by Pi to provision OAuth clients for external users (Marie, VIP).
+// Used by Pi to provision OAuth clients for external users (Nadia, VIP).
 // ─────────────────────────────────────────────────────────────────────────────
 const admin = new Hono();
 admin.use("*", masterOnlyMiddleware());
@@ -1129,8 +1142,16 @@ app.route("/admin", admin);
 app.all("/mcp", bearerAuthMiddleware(), async (c) => {
     const tenant = c.get("tenant");
     const oauthCtx = c.get("oauthContext");
-    // Per-request Convex client bound to the resolved deployment
-    const convex = new ConvexHttpClient(tenant.convexUrl);
+    // Per-request Convex client bound to the resolved deployment, carrying
+    // the IDENTITY matching how this caller authenticated — never a plain,
+    // identity-less client. Fixes the P0 regression where every /mcp call
+    // (fleet AND legitimate external clients) reached Convex with
+    // ctx.auth.getUserIdentity() === null after #1156 removed the
+    // allowNoIdentityMaster fail-open carve-out (which had been the actual
+    // cross-tenant security hole). See selectConvexClientForRequest's doc
+    // comment (authenticatedConvexClient.ts) for the full identity-selection
+    // rationale per auth path.
+    const convex = selectConvexClientForRequest(tenant.convexUrl, oauthCtx);
     // Fresh McpServer per request — stateless mode, no session leakage
     const server = new McpServer({
         name: "vantage-peers",

package/dist/server.js

@@ -57,7 +57,7 @@ const convexUrl = loadConvexUrl();
 const convex = new ConvexHttpClient(convexUrl);
 const server = new McpServer({
     name: "vantage-peers",
-    version: "2.12.0",
+    version: "2.18.0",
 });
 // stdio transport has no OAuth identity → pass oauthCtx=undefined to opt into
 // the legacy bearer / system-scope code path inside registerTools (same path

package/dist/src/auth.d.ts

@@ -12,12 +12,16 @@
  *      middleware also sets the tenant to the internal deployment because
  *      OAuth tokens always target the VantagePeers core deployment.
  *   3. Legacy bearer — falls through to mcpTenants table lookup (Pi/Tau/Phi
- *      internal orchestrators on their own Convex deployments).
+ *      internal orchestrators on their own Convex deployments). Resolves a
+ *      deny-by-default oauthContext (scopeProfile="legacy-tenant-generic",
+ *      empty allowlist/prefixes) — the mcpTenants table has no per-tenant
+ *      scope config, so this is fail-closed until a tenant is provisioned
+ *      through the OAuth scoped-token path with explicit prefixes.
  *
  * 401 is returned with a WWW-Authenticate header per RFC 6750 §3 so Claude.ai's
  * OAuth connector can bootstrap discovery.
  */
-import { ConvexHttpClient } from "convex/browser";
+import type { ConvexHttpClient } from "convex/browser";
 import type { MiddlewareHandler } from "hono";
 export type TenantContext = {
     tenantName: string;
@@ -34,6 +38,18 @@ export type OAuthContext = {
     expiresAt: number;
     /** True when this request came in on the master bearer token (admin path). */
     isMaster: boolean;
+    /**
+     * The raw, already-verified Clerk session JWT presented by the caller —
+     * set ONLY on the Clerk-team path (2.5, tryVerifyClerkJwt succeeded).
+     * server-http.ts forwards this exact token to Convex via
+     * ConvexHttpClient.setAuth() so `ctx.auth.getUserIdentity()` resolves to
+     * THIS caller's own org, never the MCP server's service-account identity.
+     * Every other path (master / OAuth / DCR / legacy) leaves this undefined
+     * and gets the service-account (master) Convex identity instead — see
+     * server-http.ts's per-request client selection and the P0 fix note
+     * there for why that is fail-closed-safe.
+     */
+    clerkJwt?: string;
 };
 declare module "hono" {
     interface ContextVariableMap {
@@ -52,14 +68,27 @@ export declare function sha256Base64Url(input: string): Promise<string>;
 /**
  * Returns true when the scope profile grants full, wildcard access. Master
  * admin sessions skip every downstream enforcement check.
+ *
+ * Delegates the actual master/wildcard decision to
+ * `@vantageos/cloud-identity`'s `isMasterScope` (0.3.0+) via `toPackageOAuthCtx`
+ * above — this repo no longer reimplements that check locally. `undefined` is
+ * handled here (returns false) because several call sites in tools.ts pass an
+ * optional `OAuthContext` (legacy bearer path has no oauthContext at all);
+ * the package's own guard requires a non-null `OAuthCtx` and throws otherwise
+ * (0.3.0's "never grant by absence" contract), so the undefined check must
+ * happen before delegating, not be silently absorbed by the package call.
  */
 export declare function isMasterScope(ctx: OAuthContext | undefined): boolean;
 /**
  * Checks that `from` is allowed by the current OAuth context.
  * Returns null when allowed, an error message string otherwise.
  *
- * If no oauthContext is set (legacy bearer from mcpTenants), all `from` values
- * are allowed — legacy path is unscoped.
+ * `ctx` is only undefined in tests that call these predicates directly
+ * without going through bearerAuthMiddleware — every real auth path
+ * (master, OAuth, Clerk, DCR, legacy mcpTenants bearer) sets an oauthContext.
+ * The legacy mcpTenants bearer path resolves to a deny-by-default
+ * "legacy-tenant-generic" scope (empty allowlist/prefixes) — see auth.ts
+ * path (4).
  */
 export declare function checkFromAllowed(ctx: OAuthContext | undefined, from: string): string | null;
 /**

package/dist/src/auth.js

@@ -12,14 +12,18 @@
  *      middleware also sets the tenant to the internal deployment because
  *      OAuth tokens always target the VantagePeers core deployment.
  *   3. Legacy bearer — falls through to mcpTenants table lookup (Pi/Tau/Phi
- *      internal orchestrators on their own Convex deployments).
+ *      internal orchestrators on their own Convex deployments). Resolves a
+ *      deny-by-default oauthContext (scopeProfile="legacy-tenant-generic",
+ *      empty allowlist/prefixes) — the mcpTenants table has no per-tenant
+ *      scope config, so this is fail-closed until a tenant is provisioned
+ *      through the OAuth scoped-token path with explicit prefixes.
  *
  * 401 is returned with a WWW-Authenticate header per RFC 6750 §3 so Claude.ai's
  * OAuth connector can bootstrap discovery.
  */
-import { validateMasterBearer } from "@vantageos/cloud-identity";
-import { ConvexHttpClient } from "convex/browser";
+import { isMasterScope as packageIsMasterScope, validateMasterBearer, } from "@vantageos/cloud-identity";
 import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createServiceAccountConvexClient } from "./authenticatedConvexClient.js";
 // ─────────────────────────────────────────────────────────────────────────────
 // Internal Convex client (reads mcpTenants + oauth_* tables)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -29,7 +33,13 @@ function buildInternalClient() {
         throw new Error("CONVEX_URL_INTERNAL is required for HTTP transport. " +
             "Set it to your internal VantagePeers Convex deployment URL.");
     }
-    return new ConvexHttpClient(url);
+    // Every outgoing call from this client carries the MCP server's
+    // service-account Clerk identity (see authenticatedConvexClient.ts /
+    // serviceAccountAuth.ts). It never proceeds unauthenticated: if the
+    // identity cannot be minted, the call throws instead of silently
+    // falling back to an anonymous request that Convex's withOrgScope()
+    // would treat as master/unfiltered.
+    return createServiceAccountConvexClient(url);
 }
 // Lazily instantiated so the module can be imported without env vars in tests
 let _internalClient = null;
@@ -72,37 +82,66 @@ export async function sha256Base64Url(input) {
 // ─────────────────────────────────────────────────────────────────────────────
 // Scope enforcement helpers — used by MCP tool guards
 // ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Adapts this module's local `OAuthContext` shape onto the package's
+ * framework-agnostic `OAuthCtx` (`@vantageos/cloud-identity`). This is a
+ * field-renaming adapter only — no master/wildcard DECISION is made here,
+ * that decision is entirely delegated to the package's `isMasterScope`. Local
+ * `OAuthContext` carries an extra `isMaster` boolean (set explicitly by the
+ * master-bearer-token middleware branch) alongside `scopeProfile`; the
+ * package's `OAuthCtx.scope` field consolidates both prior conditions
+ * (`ctx.isMaster || ctx.scopeProfile === "master"`) into the single `scope`
+ * field the package checks — the union of conditions is preserved exactly,
+ * only the representation changes.
+ */
+function toPackageOAuthCtx(ctx) {
+    return {
+        scope: ctx.isMaster ? "master" : ctx.scopeProfile,
+        fromAllowList: ctx.fromAllowList,
+        namespaceReadPrefixes: ctx.namespaceReadPrefixes,
+        namespaceWritePrefixes: ctx.namespaceWritePrefixes,
+    };
+}
 /**
  * Returns true when the scope profile grants full, wildcard access. Master
  * admin sessions skip every downstream enforcement check.
+ *
+ * Delegates the actual master/wildcard decision to
+ * `@vantageos/cloud-identity`'s `isMasterScope` (0.3.0+) via `toPackageOAuthCtx`
+ * above — this repo no longer reimplements that check locally. `undefined` is
+ * handled here (returns false) because several call sites in tools.ts pass an
+ * optional `OAuthContext` (legacy bearer path has no oauthContext at all);
+ * the package's own guard requires a non-null `OAuthCtx` and throws otherwise
+ * (0.3.0's "never grant by absence" contract), so the undefined check must
+ * happen before delegating, not be silently absorbed by the package call.
  */
 export function isMasterScope(ctx) {
     if (!ctx)
         return false;
-    if (ctx.isMaster)
-        return true;
-    if (ctx.scopeProfile === "master")
-        return true;
-    return ctx.fromAllowList.includes("*");
+    return packageIsMasterScope(toPackageOAuthCtx(ctx));
 }
 /**
  * Checks that `from` is allowed by the current OAuth context.
  * Returns null when allowed, an error message string otherwise.
  *
- * If no oauthContext is set (legacy bearer from mcpTenants), all `from` values
- * are allowed — legacy path is unscoped.
+ * `ctx` is only undefined in tests that call these predicates directly
+ * without going through bearerAuthMiddleware — every real auth path
+ * (master, OAuth, Clerk, DCR, legacy mcpTenants bearer) sets an oauthContext.
+ * The legacy mcpTenants bearer path resolves to a deny-by-default
+ * "legacy-tenant-generic" scope (empty allowlist/prefixes) — see auth.ts
+ * path (4).
  */
 export function checkFromAllowed(ctx, from) {
     if (!ctx)
-        return null; // legacy bearer — unscoped
+        return null; // no context (direct predicate call, e.g. unit tests)
     if (isMasterScope(ctx))
         return null;
     if (ctx.fromAllowList.includes(from))
         return null;
     // Day 88 friction capitalize: surface the allowed values so the LLM caller
     // can self-correct on the next attempt instead of guessing identifiers.
-    // Marie onboarding case (2026-06-01): Claude.ai guessed "Greek letter" when
-    // the actual allowlist was ["marie"].
+    // Nadia onboarding case (2026-06-01): Claude.ai guessed "Greek letter" when
+    // the actual allowlist was ["nadia"].
     const allowed = ctx.fromAllowList.length === 0
         ? "(none — this client has no allowed 'from' identities)"
         : ctx.fromAllowList.join(", ");
@@ -327,6 +366,11 @@ export function bearerAuthMiddleware() {
                 namespaceWritePrefixes: [`team/${orgId}`],
                 expiresAt: clerkResult.exp * 1000,
                 isMaster: false,
+                // Forward the caller's own verified Clerk JWT to Convex — see
+                // OAuthContext.clerkJwt doc comment. This is the P0 fix: without
+                // this, server-http.ts had no way to attach any identity to the
+                // per-request Convex client for this path.
+                clerkJwt: token,
             });
             await next();
             return;
@@ -411,6 +455,26 @@ export function bearerAuthMiddleware() {
             tenantName: tenant.tenantName,
             convexUrl: tenant.convexUrl,
         });
+        // SECURITY FIX (k17dt8pq4zkafsvt162z9qzgsn8abs0r): legacy bearer tokens
+        // used to leave oauthContext unset, which made every guard in tools.ts
+        // (guardRead/guardWrite/guardMasterOnly) and every checkNamespace*/
+        // checkFromAllowed predicate here treat the request as unscoped/allowed.
+        // A legacy bearer could therefore read/write any namespace and call any
+        // master-only tool. The mcpTenants table carries no per-tenant scope
+        // config (no namespacePrefixes field), so there is nothing to honor —
+        // deny-by-default (empty prefixes/allowlist) is the only defensible
+        // scope until tenants are re-provisioned with explicit prefixes.
+        c.set("oauthContext", {
+            clientId: `legacy:${tenant.tenantName}`,
+            userId: `legacy:${tenant.tenantName}`,
+            scopes: [],
+            scopeProfile: "legacy-tenant-generic",
+            fromAllowList: [],
+            namespaceReadPrefixes: [],
+            namespaceWritePrefixes: [],
+            expiresAt: Date.now() + 3600 * 1000,
+            isMaster: false,
+        });
         // Fire-and-forget lastUsedAt update (non-blocking)
         internalClient()
             // biome-ignore lint/suspicious/noExplicitAny: Convex string API

package/dist/src/authenticatedConvexClient.d.ts

@@ -0,0 +1,60 @@
+/**
+ * ConvexHttpClient factory that attaches the MCP server's Clerk
+ * service-account identity to every request.
+ *
+ * ConvexHttpClient.setAuth() takes a static token string (unlike
+ * ConvexReactClient, it has no fetchToken callback), so a client that lives
+ * across multiple tool calls (the stdio server's single long-lived client,
+ * server.ts) would otherwise present a stale/expired JWT after ~60 seconds.
+ * This wrapper intercepts .query()/.mutation()/.action() and re-attaches a
+ * freshly-minted (or still-cached, non-expired) token immediately before
+ * every call, so callers of registerTools() never need to think about token
+ * refresh.
+ *
+ * Fail-closed: if the service-account credential is not configured
+ * (getServiceAccountToken returns null) or minting fails for any reason, the
+ * call is aborted BEFORE it reaches the wire — it never falls back to
+ * .clearAuth() / an unauthenticated request. "I could not authenticate" and
+ * "I am the system" must never produce the same outgoing call: the former
+ * throws loudly, the latter is simply not a code path this client has.
+ */
+import type { ConvexHttpClient } from "convex/browser";
+/**
+ * Selects the per-request Convex client identity to attach to a /mcp call.
+ *
+ * P0 fix (2026-08-07): before this, server-http.ts's /mcp handler built a
+ * PLAIN `new ConvexHttpClient(tenant.convexUrl)` for every request — no
+ * identity was ever attached, so `ctx.auth.getUserIdentity()` was always
+ * null on the Convex side and convex/lib/auth.ts's withOrgScope fail-closed
+ * branch (post-#1156, correctly) rejected every caller, fleet-internal and
+ * external alike, with RBAC_DENIED.
+ *
+ * Two outcomes, selected purely by whether `oauthCtx.clerkJwt` is present
+ * (set ONLY by the Clerk-team org-scoped auth path, auth.ts case 2.5):
+ *
+ *   - `clerkJwt` present  → forward the CALLER'S OWN verified Clerk JWT via
+ *     `.setAuth()`. Convex resolves the caller's own org — genuine,
+ *     Convex-layer multi-tenant isolation, never cross-tenant.
+ *   - `clerkJwt` absent (master / OAuth-scoped / DCR / legacy mcpTenants) →
+ *     the MCP server's own Clerk service-account identity
+ *     (`createServiceAccountConvexClient`). Convex's withOrgScope
+ *     service-account carve-out (CLERK_SERVICE_ACCOUNT_USER_ID) grants
+ *     isMaster=true for this identity. Isolation for the non-master-bearer
+ *     variants among these (OAuth scoped tokens, DCR clients, legacy
+ *     tenants) is enforced at the MCP tool layer instead
+ *     (guardRead/guardWrite/checkNamespaceRead/checkNamespaceWrite in
+ *     tools.ts, run BEFORE any Convex call) — exactly the enforcement layer
+ *     these paths already relied on before this fix (Convex itself
+ *     previously granted them master via the now-removed
+ *     `allowNoIdentityMaster` fail-open carve-out). This fix does not widen
+ *     access for any of these paths; it restores the master-identity access
+ *     they already had at the Convex layer while leaving the MCP-layer
+ *     guard as the (unchanged) isolation boundary for them.
+ */
+export declare function selectConvexClientForRequest(convexUrl: string, oauthCtx: {
+    clerkJwt?: string;
+} | undefined, deps?: {
+    createServiceAccountClient?: (url: string) => ConvexHttpClient;
+    createPlainClient?: (url: string) => ConvexHttpClient;
+}): ConvexHttpClient;
+export declare function createServiceAccountConvexClient(url: string): ConvexHttpClient;