[abruption]

Summary

Raise the optional MCP extra from mcp>=1.12,<2 to mcp>=1.30,<2, preserving the Python 3.10 marker and dependency-free Python 3.9 core. The reviewed application explicitly uses stdio; this is dependency-policy hardening, not remediation of a demonstrated exploitable HTTP/OAuth/client issue in session-peer.

Expand the existing release-gated MCP job to macOS/Linux × Python 3.10/3.13 × minimum/latest:

• Minimum constrains the SDK to exactly 1.30.0; latest resolves the manifest's compatible 1.x range. Transitive dependencies resolve normally, rather than at their individual minima.
• Record and verify the resolved SDK/profile and complete environment. The floor is read from the constraint file and checked without optimization-sensitive assertions.
• Exercise the existing actual stdio initialization/tool/results/policy tests and timeout, cancellation, unknown/no-resend and owned-child cleanup fixtures.
• Audit each isolated runtime graph, including its pip/setuptools bootstrap packages. Pinned build/audit requirements are installed in the outer tooling environment. Audits still run after test failures when installation/profile verification succeeded; advisory/service failures stay nonzero. Always retain unique per-cell install/version/audit artifacts for 30 days.
• Preserve scheduled, latest full-extra and release-time audits and the existing aggregate release gate.

Update the MCP guide in four languages and add executable workflow regressions for exact installation branches, failure propagation, installed-SDK-independent metadata checks, wrong/missing versions and audit exit/report retention. No product transport, policy, timeout or retry behavior changes.

Closes #346.

Local validation

• macOS arm64, clean Python 3.10.22 and 3.13.7 runtime environments: minimum and latest profiles each pass all 28 MCP integration tests and pip check; each resolved graph has no known vulnerabilities according to pip-audit 2.10.1 at this checkpoint. SDK package metadata and clean resolution confirm Python 3.10 compatibility.
• Both profiles currently resolve MCP 1.30.0 because it is the latest compatible 1.x at the checkpoint. The minimum and unconstrained-latest installation branches are independently exercised; this is not evidence of testing a newer SDK.
• Documentation/workflow tests: 69 pass; fixture record checks also run with optimization enabled and with a real SDK installed in the host interpreter. YAML parsing, generated standalone and diff checks pass.
• Remote eight-cell outcomes and artifacts must pass at this exact PR head before merge. Local Mac results do not establish Linux/Windows/live-agent acceptance.

Independent review

Before PR creation, Claude Code 2.1.310 (requested and response-confirmed claude-opus-5-5) and Codex CLI 0.164.0 (isolated default model; actual model ID not exposed) ran non-interactively in parallel on the same immutable input SHA-256 0d8f9ef478f399cd2d2add9745c9869e1bd5209b3d37e0f9aa478f599ec7f39d. Both completed successfully, without tools, writes, tests or network. Claude required correction of the tooling/environment claim; Codex recommended that clarification. Codex checked source facts and clarified the included bootstrap packages, then addressed report-after-test-failure, host-SDK contamination, optimization-sensitive assertions and installation-branch coverage. These follow-up changes were validated by Codex's executable regressions; the initial frozen reviews are not claimed to cover unchanged final bytes.

Antigravity CLI 1.4.8, explicit gemini-3.8-flash-medium, read-only translation QA (structured success, 100.272 seconds) compared all four MCP guides. Codex verified and applied narrow terminology, bounded-cleanup and framing corrections; no new runtime or platform claim was introduced. The final small bootstrap clarification was checked by Codex, not a claimed second Gemini review.

No native model calls, credentials, service deployment, global installation or permission/settings changes. v1.3.2 publication remains subject to final source/CI/artifact verification and the required human PyPI environment approval.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T01:32:45.903681Z	1fc594e	PR opened
🔒 Security Review	✅ Completed 2026-10-28T01:33:42.620143Z	1fc594e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

Exact-head verification

Reviewed head: 1fc594e7b473a11b479c6c4a69fc035b9daa9ee7.
Normal merge: ef7748a78e6b466f67074708f5c14decf37f31d7.

All 32 checks succeeded, including release gate and the eight MCP cells, in CI run 40615540692. Automatic Codex code and security reviews completed at the exact head with no findings and no review threads. No admin/protection bypass was used.

Downloaded all eight mcp-* artifacts and independently parsed each profile.json, install/runtime report, audit JSON and audit exit status. Every minimum profile reports MCP 1.30.0; latest compatible 1.x also currently resolves 1.30.0. Every audit exits 0 with no known vulnerabilities in its 32- or 33-package environment, including bootstrap packages. Recorded runner Python versions: macOS 3.10.11/3.13.16; Ubuntu 3.10.22 and 3.13.16/3.13.17 (per-cell records retained). Local independent clean environments were 3.10.22/3.13.7.

This validates the SDK lower bound and latest-compatible resolution, not every transitive dependency's minimum. It does not prove a remotely exploitable issue in the stdio-only application, native-agent delivery, live OAuth or Windows process-tree acceptance. Final integrated release/main checks and publication verification remain separate gates.