[abrichr]

Wrapped task replies now bind the reserved request context to the verifier receipt and its retained bytes. Generated MCP tools carry that context separately from business arguments. WrappedTask.verify_reply checks the expected request and arguments against the RunStore record, terminal reply, producer context and current receipt bytes. Changed, substituted or unbound receipts fail the binding check. Effect verification remains separate.

The shared checks preserve JSON types, reset request context after failures and read bounded receipt paths without following symlinks.

Validation: 2,608 normal-profile cases passed (368 unit, 2,218 import-layer and 22 size-ratchet), with 7,824 passing phases. Native MCP SDKs 1.28 and 2.3 each passed 54 compatibility cases, 113 binding cases and the isolated property in fresh environments, with 504 passing phases per SDK. These cohorts overlap. No candidate case failed or skipped. Ruff, formatting, Mypy and Python 3.10 syntax checks passed. This qualifies local request-to-receipt association; native child-process, Windows and signing-issuer behavior were not tested.

No per-app engine code: yes; one shared context and receipt-byte model covers SDK, CLI, compiler, MCP and verifier entry points.

Fix the class: request/receipt misassociation and observation lifetime, with property, stateful and integration controls across those entry points.

Held-out application evidence: not yet shown.

[abrichr]

Claude cross-vendor review at d53eefc: APPROVE on safety. 14 adversarial probes found no path where a receipt from another request or run, or altered bytes, passes verify_reply as BOUND. The probes covered same-outcome swaps, cross-request fields, context reuse and reset, JSON type coercion, symlinks, missing or empty context, and concurrency.

Not mergeable yet. Two required fixes:

1. 41 tests in tests/test_generated_parameter_binding.py fail, all on the signature-length guard (len(inspect.signature(function).parameters) == len(parameters)), because of the injected MCP Context parameter. Replace it with an equivalent check: the business parameters plus exactly one Context-annotated parameter that is absent from the schema. Don't drop the guard.
2. test_emitted_context_symbols_never_add_or_replace_business_parameters fails with Hypothesis FailedHealthCheck: nested_given. Restructure it with st.data().

Then mark the PR ready. The non-blocking findings are filed as issues.

[abrichr]

Claude recheck at febe2b7: APPROVE on safety. The delta weakens no assertion or guard, and test_generated_parameter_binding.py is byte-identical and passes 76/76. All 14 adversarial probes still refuse.

One remaining test fix: test_emitted_context_symbols_never_add_or_replace_business_parameters hits Hypothesis DeadlineExceeded (about 360 ms against 200 ms), because its first example emits and imports a server module. Add @settings(deadline=None) on the inner check, or warm the import up first. The gitleaks scan of this PR's own commits finds nothing; the branch is updated to rerun CI. A concurrency race in existing code, found while reviewing, is filed separately.