Verify and lock the recovery MCP contract against current clients

[lynnswap]

Parent: #96

Compatibility policy

The latest published release is v0.6.2. Its MCP contract remains the compatibility baseline unless a real current client requires an additive alias or field.

The unreleased main-only rename from jobId/output/logs to runId/review/log is not automatically a recovery requirement because MCP clients discover tool schemas.

Acceptance criteria

• Exercise review_start, review_await, review_read, review_list, and review_cancel from current Codex.
• Exercise the same tools from current Claude Code.
• Cover multiple MCP sessions, concurrent reviews, cancel, terminal polling/await, paged logs, server stop, and restart.
• Preserve the published v0.6.2 schema and add aliases only when a live consumer proves they are needed.
• One stable identifier is accepted consistently by all five tools.
• Long review timeout/idle-timeout setup is documented, including the Claude client idle timeout.
• HTTP/protocol shutdown awaits in-flight request handlers and leaves no session/task after stop.
• Final review data comes from the same canonical terminal/history owner as UI and Persist ReviewMonitor-owned review history and logs locally #102.

Historical evidence

Post-v0.6.2 main changed MCP vocabulary during the unreleased rearchitecture. PR #79 documents Claude idle timeout behavior; codex/mcp-protocol-stop-integration@59ebacd contains shutdown proof worth referencing if the live probe requires it.

[lynnswap]

Design-gate clarification: durable SQLite history does not broaden MCP authorization. UI history is app-wide, while each active MCP session owns the review IDs it may list/read/await/cancel; after app/MCP restart a new session starts empty. The additive terminal field is lifecycle.terminal with completed/failed/interrupted cause, and Claude-identified review_start / review_await use bounded 540-second waits. Live client probes remain the gate for any alias beyond the published v0.6.2 schema.

[lynnswap]

Live recovery evidence on 2026-08-20: exact-base review run 77FBBC61-634C-469F-9D99-4E93A5D3B20E remained running past 787 seconds. The client advertised review_await, but invoking it returned Unknown tool: review_await. A single review_read confirmed the run was still active and producing progress, with no terminal findings yet. No duplicate review or cancellation was issued. This is now a required current-client compatibility case: advertised tools must be routable end to end, and a known running job must support bounded await/retrieval without polling or replacement runs.

[lynnswap]

Progress: PR #115 merged as main commit 0f6ddb5. Main now runs a dedicated Xcode 27 consumer/API/MCP compatibility job plus the Xcode 26 package/app job. The v0.6.2 tools/list golden and public API baseline are enforced in CI. This issue remains open because advertised review_await is still unroutable for live running jobs.