Record merged MCP preview CI evidence

DESIGN.md

@@ -596,7 +596,7 @@ Findings that change the backlog:
 - **V4b Auto-mode disclosure review (2026-10-03, `1729220`).** Adversarial review confirmed that Auto mode also approves configured MCP tool calls, not only shell commands. The footer tooltip, command-permissions explainer, and Code task system prompt now state that MCP tools run without approval unless an exact project server/tool deny rule blocks them, and warn that they may affect external services. Regression checks cover the tooltip and prompt wording. Windows CI [#37148187560](https://github.com/jay23606/codev/actions/runs/37148187560) passed 936 portable tests (2 opt-in skips), 35 Avalonia headless UI tests on Windows/Linux/macOS, 8 Windows UI tests, and native credential-vault smoke checks. Desktop preview [#37148187564](https://github.com/jay23606/codev/actions/runs/37148187564) passed app/CLI build, launch, and packaging on all four RIDs; publishing was skipped for the PR. This review found no additional policy-routing bypass, but it does not satisfy Q3's full manual security review.
 - **V4c. Real-use log (first pass, 2026-10-09).** The first Codev dogfood reports have been read and triaged in [`docs/real-use-log-release-2.md`](docs/real-use-log-release-2.md). They map to B1 (Auto prompts), B15 (local-model cold load), P2/P6 (saved hosted-key reconnect), collapsed activity/readability, sidebar ordering, and the existing Windows hidden-process follow-up. The [PR #62 Windows package preview #37991522656](https://github.com/jay23606/codev/actions/runs/37991522656) ran the reported deletion-plus-Git-status command in Auto without a prompt, then verified an exact Deny after switching back to Auto; PR #65 records the evidence. Confirm the behavior again after the public Release 2 install; native manual items remain open.
 
-- **V4d. Release 2 cross-platform MCP preview coverage (2026-10-09, packaged run pending).** The existing Linux and macOS packaged-app scripts now configure a loopback Streamable HTTP MCP server and the deterministic mock-model MCP turn. They assert tool discovery, the expected echo call, the bounded untrusted result path, and a completed Auto turn; cleanup tracks the mock server process. Git Bash syntax validation, embedded Python compilation (32 blocks), Node syntax checks, and `git diff --check` pass. The scheduled October 11 four-RID preview is the first runtime check of these additions. Until that run passes, this is coverage added, not a verified cross-platform runtime result; native macOS/Linux interaction remains separately open.
+- **V4d. Release 2 cross-platform MCP preview coverage (2026-10-09, merged at `fcf366a`; packaged run pending).** PR #82 adds loopback Streamable HTTP MCP scenarios to the existing Linux and macOS packaged-app scripts. They assert tool discovery, the expected echo call, the bounded untrusted result path, and a completed Auto turn; cleanup tracks the mock server process. Git Bash syntax validation, embedded Python compilation (32 blocks), Node syntax checks, and `git diff --check` passed before merge. PR CI [#38007296765](https://github.com/jay23606/codev/actions/runs/38007296765) and post-merge Windows/Linux/macOS CI [#38007627029](https://github.com/jay23606/codev/actions/runs/38007627029) passed. The scheduled October 11 four-RID preview is the first runtime check of these additions. Until that run passes, this is coverage added, not a verified cross-platform runtime result; native macOS/Linux interaction remains separately open.
 
 **Done when:** V4a stays green, the checklist is committed and has been run at least once, and the first real-use log has been read and its items triaged.
 

docs/release-plan-2026-10.md

@@ -40,7 +40,7 @@ The Release 1 ledger leaves 65 manual workflows open, including native macOS/Lin
 
 ## Release 2: early stabilization
 
-**Release 2 checkpoint (verified 2026-10-09 at main `80c911e`; product code through PR #77, documentation through PR #80).** Subsequent product changes include the exact-Deny Auto regression, persisted sidebar reorder, profile and hosted-key fixes, and a clarification in the Auto/MCP tooltips when saved MCP permissions cannot be read. PR #77's Windows/Linux/macOS CI [#38003412218](https://github.com/jay23606/codev/actions/runs/38003412218) and post-merge CI [#38003676335](https://github.com/jay23606/codev/actions/runs/38003676335) passed. PR #79 documented the Auto/profile/MCP denial-composition review and focused test evidence in `DESIGN.md`; its Windows/Linux/macOS CI [#38004723785](https://github.com/jay23606/codev/actions/runs/38004723785) and post-merge CI [#38004977342](https://github.com/jay23606/codev/actions/runs/38004977342) passed. PR #80 refreshed this checkpoint; its main-branch Windows/Linux/macOS CI [#38005530614](https://github.com/jay23606/codev/actions/runs/38005530614) passed. PR #74 added the eight-archive prepublish gate; PR #76 changed the release preview workflow to run packaged interaction checks only on manual dispatch or version-tag pushes. Their PR CI [#38001121514](https://github.com/jay23606/codev/actions/runs/38001121514) [#38002345137](https://github.com/jay23606/codev/actions/runs/38002345137) and post-merge CI [#38001372222](https://github.com/jay23606/codev/actions/runs/38001372222) [#38002651235](https://github.com/jay23606/codev/actions/runs/38002651235) passed. The last exact-head packaged preview remains PR #62 [#37991522656](https://github.com/jay23606/codev/actions/runs/37991522656); run one new four-target preview by manual dispatch against the frozen October 11 candidate. Do not run packaged previews for ordinary PRs or local desktop smokes during routine work. Clean-machine installation, physical accessibility, and native macOS/Linux interaction remain explicit limitations. Keep the October 11 freeze and October 13 Release 2 target below.
+**Release 2 checkpoint (verified 2026-10-09 at main `fcf366a`; product code through PR #82, documentation through PR #81).** Subsequent product changes include the exact-Deny Auto regression, persisted sidebar reorder, profile and hosted-key fixes, and a clarification in the Auto/MCP tooltips when saved MCP permissions cannot be read. PR #77's Windows/Linux/macOS CI [#38003412218](https://github.com/jay23606/codev/actions/runs/38003412218) and post-merge CI [#38003676335](https://github.com/jay23606/codev/actions/runs/38003676335) passed. PR #79 documented the Auto/profile/MCP denial-composition review and focused test evidence in `DESIGN.md`; its Windows/Linux/macOS CI [#38004723785](https://github.com/jay23606/codev/actions/runs/38004723785) and post-merge CI [#38004977342](https://github.com/jay23606/codev/actions/runs/38004977342) passed. PR #80 refreshed the checkpoint; its main-branch Windows/Linux/macOS CI [#38005530614](https://github.com/jay23606/codev/actions/runs/38005530614) passed. PR #82 adds Streamable HTTP MCP Auto scenarios to the existing Linux/macOS packaged checks; its cross-platform PR CI [#38007296765](https://github.com/jay23606/codev/actions/runs/38007296765) and post-merge CI [#38007627029](https://github.com/jay23606/codev/actions/runs/38007627029) passed. The new packaged scenarios are not yet runtime-verified; run the one scheduled four-target preview on the frozen October 11 candidate. PR #74 added the eight-archive prepublish gate; PR #76 changed the release preview workflow to run packaged interaction checks only on manual dispatch or version-tag pushes. Their PR CI [#38001121514](https://github.com/jay23606/codev/actions/runs/38001121514) [#38002345137](https://github.com/jay23606/codev/actions/runs/38002345137) and post-merge CI [#38001372222](https://github.com/jay23606/codev/actions/runs/38001372222) [#38002651235](https://github.com/jay23606/codev/actions/runs/38002651235) passed. The last exact-head packaged preview remains PR #62 [#37991522656](https://github.com/jay23606/codev/actions/runs/37991522656). Do not run packaged previews for ordinary PRs or local desktop smokes during routine work. Clean-machine installation, physical accessibility, and native macOS/Linux interaction remain explicit limitations. Keep the October 11 freeze and October 13 Release 2 target below.
 
 Target Release 2 for **Tuesday, October 13, 2026** (Day 5 after the October 8 publication; acceptable window: Day 3–5). On October 9–10 (Days 1–2), collect install reports, triage reproducible issues, and fix release blockers. On October 11 (Day 3), freeze the candidate and run exact-head Windows/Linux/macOS CI plus all four packaged desktop/CLI checks by manually dispatching the desktop-preview workflow once against the frozen main commit. The four-RID preview will also run the new Linux/macOS Streamable HTTP MCP Auto scenarios, which were added to the existing packaged checks without changing the preview cadence. The workflow runs only on manual dispatch and version-tag pushes; pull requests and ordinary merges use the Windows/Linux/macOS CI workflow without packaged interaction smokes. Use a local desktop smoke only if a release-critical interaction remains uncovered by hosted checks and focused tests; routine local runs stay disabled. Publish on October 12–13 only if exact-head checks pass, update the release notes for verified changes and remaining limitations, and confirm all eight README latest-download links. If a blocker moves the candidate, move Release 2 to Day 3–5 after the verified fix.