[adrianwebb]

Outcome

An authorized coordinator on a stateless MCP2025 connection can receive and return the existing signed confirmation as tool data. Previously real workdays.start failed because the per-request transport cannot perform server-to-client elicitation.

Work authority

• Work item / Issue: Complete accounting transition observations for strict Agent acceptance #553 and Continue coached Atlas team delivery and persistent agent improvements from #428 sdk#429
• Proposal / decision: Real API proposal 12b52c0e-05a8-48b6-91cd-c4898bd534aa v1; not yet approved.
• Assignment / checkpoint: Native workdays.start failed before activation on preflight a98135d9-94ae-4935-ba06-9f6eb7c72fee; no workday created.
• Actor: Codex coordinator
• Human authority: adrian; explicit MCP repair and standing workflow approval.
• Agent / capacity provider: Coordinator boundary repair, no fabricated TreeSeed assignment.
• Exact base ref: staging 41e51cd; depends on Allow native coordinator MCP protocol clients #591, Adopt coordinator MCP catalog and derive its advertised scopes #592 and Preserve read-only POST input through MCP #593.
• Exact head ref: codex/mcp-legacy-confirmation553 289d2f4

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Reuse ConfirmationService, signed argument binding, nonce store and the existing REST confirmation header. Advertise that optional header only on confirmation-requiring MCP tools. Legacy first calls return an input_required error containing the signed receipt; authorized retries supply its existing encoding. Modern multi-round elicitation remains supported.

Changes and commits

0d0a0cf implements the data exchange without a new endpoint, session store, runner, identity or unsigned confirmation flag. Confirmation data is excluded from its own argument digest; idempotency, version, principal, client, operation and request arguments remain bound.

Verification

Regression reproduced the real Cannot request input confirm failure before repair. Five focused files / 29 tests pass: legacy confirmation, schema dialect, protocol contract, authorization equivalence, confirmation service. Legacy HTTP proves no dispatch before receipt, changed preflight/idempotency, wrong principal, malformed receipt and nonce reuse rejection; valid retry invokes the handler once. Existing modern multi-round and expiry/client/operation binding remain covered. Build/declarations and file policies pass after correcting a strict-TypeScript spread error.

An additional PostgreSQL mutation test failed its explicit disposable-database prerequisite; 14 accompanying checks passed. PostgreSQL confirmation settlement and full workflow acceptance remain unproven locally; required Actions pending.

• I ran the narrowest relevant package verification and documented any checks that could not be run.

Risk and rollback

The same signed confirmation can be transported as an explicit tool header after approval; it grants no new operation authority. Revert this commit to remove data exchange. Existing REST and modern confirmation paths and persistent history remain.

Completion summary

Small unblock for real MCP simulation admission. Live native signed-receipt start succeeded for simulation workday-cb95624a-1861-4d9a-8102-34b572352403: group-driven A/E/R planning and separate E/R estimates all five completed; proposal v3 votingReady and executionPlanReady. Native signed-receipt stop entered closing with five completed, zero failed/unfinished assignments and zero settlement errors. Reporter/end-state read-back, approval, independent implementation/review and simulated release remain pending.

289d2f4 consumes merged SDK439 staging ee3d869cb38a5e74485da58553db4057e5cdcdd6 in manifest/lock/exact Actions installer. Its source tree equals tested a0defe6e; local tarball cb98bc1aa863513b88b60b1c3b3743a20b4696dd7630c43845fa18b7b1a46bf7. Five focused files/29 checks, strict build/declarations and file policies pass with that dependency. This is local development evidence, not a sealed release artifact.

AGPL committer authorization

Existing provider-authenticated approved-author workflow applies; no allowlist changes.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.

Superseded candidate

Consolidated into #595 at 8747a50. This PR's source changes, focused checks and failed observations remain retained. The complete current MCP candidate runs the unchanged required verification/996-step component scene; do not merge this older partial candidate or rerun its redundant campaign. No implementation/product evidence is replaced.