adt-server binary cannot run with ADT_SERVER_MCP_SAFE_EXECUTE_ENABLED=true

[devin-ai-integration]

The adt-server createAdtServerMcpOptions correctly rejects an incomplete safe_execute configuration when the deployment does not supply consumeExecutionAuthorization and reportExecutionOutcome hooks.

However, the shipped packages/adt-server/src/bin/adt-server.ts startup only passes executeWithDeadline and leaves both hooks undefined. Enabling ADT_SERVER_MCP_SAFE_EXECUTE_ENABLED=true in the binary therefore always aborts startup.

We need a supported way for deployments to register these hooks, or sensible default implementations wired from environment variables (e.g. an authorization consumer URL and an outcome reporter URL) so the binary can run with safe_execute enabled.

Related to PR #143 (review thread PRRT_kwDOM80YYc6TfskC).

[devin-ai-integration]

Picking this up. Will investigate the safe-execute hook wiring in and report back.

[devin-ai-integration]

Triage

Cause: createAdtServerMcpOptions rejected safe_execute when consumeExecutionAuthorization and reportExecutionOutcome were undefined. The shipped adt-server.ts binary only passed executeWithDeadline, so enabling ADT_SERVER_MCP_SAFE_EXECUTE_ENABLED=true always aborted startup.

Fix: Draft PR #146 wires default HTTP hooks from two new environment URLs:

• ADT_SERVER_MCP_AUTHORIZATION_CONSUMER_URL
• ADT_SERVER_MCP_OUTCOME_REPORTER_URL

Both endpoints receive the hook payload as a JSON POST plus an Authorization: Bearer <authorizationToken> header. Non-2xx responses are treated as denied/rejected outcomes. The docker entrypoint also unsets these variables when ADT_SERVER_MCP_ENABLED=false.

Verification: mcp-runtime.test.ts 13/13 passed, bunx nx lint adt-server passed, bunx nx build adt-server passed.