[wangtsiao]

Summary

Correctness/diagnostics slice of the MCP connection-experience work, based on main 4228c9d. This is not a claim that native OAuth login/refresh migration is complete.

• Replace Native host mcp.refresh / mcp.config successful no-ops with actionable unsupported-contract errors. Native discovery refresh cannot rotate the authored integrations' separate auth.json grants.
• Add rlm.mcp.list_servers() over the existing session manager's observed states, without returning transport configuration or credentials. Require a ready state for discovery success.
• Preserve Linear/Notion's authored endpoint and parsed-result contract. Validate explicit credential endpoint binding, reject malformed expiry/access, serialize refresh, and require persisted usable credentials after success.
• Explicit authored list_tools() rechecks the connection and clears stale schemas on failure. No fallback transport for native calls and no replay of failed writes.
• Document ownership boundaries and remaining work in docs/mcp-connection-lifecycle.md.

Verification

• Python runtime suite: 92 tests run, 89 passed and 3 platform-specific skips (dill 0.4.1 in isolated test dependency directory).
• MCP tests include actual REPL subprocess/JSONL simulation with synthetic refresh/discovery/denial replies.
• cargo fmt --all -- --check and git diff --check: passed.
• Rust host bridge: 27 passed; the normally ignored real Rust dispatcher → Python kernel test was explicitly run and passed. Host dispatcher: 11 passed. These 39 relevant tests pass with one build job and debug info disabled (the first concurrent full build was SIGKILLed).
• Broader devo-server --lib: 553 passed, 3 failed, 3 ignored. The failures are unchanged non-Git workspace/worktree tests (plain_folders_have_no_worktrees_but_missing_folders_are_errors, non_git_finalized_turn_view_is_stable_after_later_changes, staged_and_unstaged_unsupported_without_head_and_outside_git). This container emits Git's mount-boundary error wording, which those paths do not classify as not_git_repository; the isolated worktree test also fails. This is not a full-suite pass.
• Follow-up head d55f48b preserves the existing behavior when another host reconnects while refresh fails: re-read and revalidate the persisted grant, without exposing the failed provider response. Two new regression cases and the real Rust→Python test pass locally.
• Exact-head CI for d55f48b80dd707c90c8754a388b40dc1f024c4d0: all 23 checks succeeded, including the full workspace Test job, Linux/Windows Check and Clippy, Desktop/TUI, Python 3.11/3.13 on Windows, native kernel builds, and all six runtime bundles. CI run: 42497452286. Runtime bundles run: 42497452295. This includes a passing remote full-suite result despite the three local environment-specific Git-detection failures described above.
• No live provider OAuth/browser login, user credentials, or paid model calls used. Native login UI, credential-store migration, and live Linear/Notion validation remain out of scope for this slice.

Review notes

The useful Prime pattern is that stored tokens are not equivalent to verified connection state. This change reuses Devo's existing manager states instead of copying a second catalog/transport system. It deliberately does not reroute authored credentials or calls to same-named user MCP servers.