chore(specs): gardener checkbox sync

[Dumbris]

Spec-gardener run: 2026-07-20. Applied 15 checkbox ticks, proposing 1 un-tick candidate (NOT applied), across 34 specs with tick/un-tick candidates surfaced by scripts/check-spec-evidence.py.

Applied ticks

Spec / Task	File:Line	Decisive code
009-proactive-oauth-refresh T055	frontend/src/components/ServerCard.vue:163 + internal/health/calculator.go:211-217	v-if="healthAction === 'login'"; CalculateHealth sets Action:ActionLogin when OAuthStatus=="expired"
009-proactive-oauth-refresh T056	frontend/src/components/ServerCard.vue:156,166,176	Login button uses class="btn btn-sm btn-primary", identical to sibling Enable/Restart buttons
009-proactive-oauth-refresh T061	frontend/src/components/ServerCard.vue:208-215	v-if="canLogout" gates on server.authenticated===true (canLogout, line 575-576) plus sensible UX refinements
009-proactive-oauth-refresh T063	frontend/src/components/ServerCard.vue:708	await serversStore.triggerOAuthLogout(props.server.name)
042-telemetry-tier2 T001	internal/telemetry/telemetry.go:76,290,569,677	Service/HeartbeatPayload/Start() confirmed at cited lines, send() is actually named sendHeartbeat() (the noted drift)
042-telemetry-tier2 T002	internal/httpapi/middleware.go:29, internal/httpapi/server.go:605-606	SurfaceClassifierMiddleware wired into chi router chain
042-telemetry-tier2 T003	internal/server/mcp.go:1254,1701,815,854,914	handleRetrieveTools/call_tool variants/code_execution/upstream_servers/quarantine_security handler entry points confirmed at cited locations
042-telemetry-tier2 T004	internal/cliclient/client.go:55,64	X-MCPProxy-Client header injection site located, matches later T091/T032 usage
042-telemetry-tier2 T091	cmd/mcpproxy/main.go:524 (cliclient.SetClientVersion), frontend/src/services/api.ts:182 ('webui/web' constant with documented rationale)	version string genuinely plumbed into CLI/tray/webui headers
044-retention-telemetry-v3 T001	internal/telemetry/telemetry.go:129	"// Spec 044 additions. schema_version stays at 3 (set by spec 042); these"
047-cpu-hotpath-fix T001	internal/server/server.go:2094-2124	mux.Handle("/debug/pprof/", pprofGated)
083-discovery-profiler T009	scripts/gen-corpus-v2.sh; specs/083-discovery-profiler/datasets/corpus_v2.tools.json; datasets/README.md:20	"Tool count: 45 (all 7 servers connected; no reduced-corpus caveat)."
083-discovery-profiler T026	scripts/fetch-toolret.sh	pinned-revision uv download of mangopy/ToolRet-Tools + mangopy/ToolRet-Queries, parquet→JSON conversion
083-discovery-profiler T039	.github/workflows/bench.yml:68,74,152	npm ci --prefix bench/tscg; make bench-discovery; uvx --from lap-score==0.8.0 lap lint
083-discovery-profiler T040	bench/README.md:142-260	dashboard shows provenance badge + tokenizer caveat

All 15 were independently re-verified by the gardener session (reading the cited files directly) in addition to the sub-agent that originally proposed each.

Proposed un-ticks (NOT applied)

Spec / Task	Why the artifact is absent
044-diagnostics-taxonomy T080	--server flag exists (doctor_cmd.go:79) but no test anywhere exercises it or asserts its formatted output

All other 85 UNRESOLVED/REMOVED/RELOCATED findings from the checker were investigated and found to be RELOCATED-NOT-ABSENT — the cited evidence path was stale (file renamed/consolidated/moved), but the actual behavior exists elsewhere in the current codebase (e.g. internal/contracts/config.go → consolidated into internal/contracts/types.go; cmd/mcpproxy/teams_register.go → renamed to serveredition_register.go as part of a deliberate Teams→Server-Edition rename). These are correctly left ticked and are not proposed as un-ticks.

Dropped by verification

130 possibly_built candidates (unchecked tasks where every cited file happens to exist) were investigated and dropped — the file existed but the specific promised behavior was absent, differently implemented without meeting the task's bar, an unwired component, a stub, or an untested claim. Grouped by spec:

001-code-execution — 12 dropped

• T020: no test exercises two mock upstream servers
• T032: mockToolCaller.errors map never populated by any test
• T033: no test has JS call failing tool then continue to second tool
• T034: no integration test with failing upstream tool
• T051: tests only pass flat input, no nested objects/arrays
• T052: no test asserts complex/nested result serialization
• T071: zero matches for EnableCodeExecution/code_execution in mcp_test.go
• T072: no rejection-when-disabled integration test
• T073: no true-includes-tool integration test
• T074: no config-defaults-apply-when-omitted test
• T079: no test asserts uniqueness/format of execution_id
• T080: no test asserts logs contain execution_id/truncated_code/tools_called/duration_ms

001-oas-endpoint-documentation — 6 dropped

• T013: handleGetSecretRefs has no swag @Summary/@router comment block
• T014: handleGetConfigSecrets same absence
• T015: handleMigrateSecrets same absence
• T025: code_exec.go has zero swag annotations
• T026: handleSSEEvents has no swag annotation block
• T027: same handler, same absence

001-update-version-display — 6 dropped

• T012: tray_test.go has no test referencing version menu item
• T019: no test verifies immediate pre-ticker check fires on startup
• T020: no test exercises periodic 4-hour ticker firing
• T024: e2e script never asserts .data.update exists
• T028: no test toggling/asserting visibility of updateMenuItem
• T029: no test verifies removal of Check for Updates menu item

003-tool-annotations-webui — 3 dropped

• T046: SessionsTable.vue does not exist and no integration into Dashboard.vue
• T050: frontend/src/services/api.ts:607 getToolCalls has no sessionId parameter
• T058: server.go has no SSE emission of sessions.created/updated/closed events

004-management-health-refactor — 9 dropped

• T022: no restart-related test in cmd/mcpproxy/upstream_cmd_test.go
• T039: doctor_cmd_test.go has no E2E test running mcpproxy doctor against live daemon
• T069: no --all/bulk-restart E2E CLI test exists
• T083: client.go has no logHTTPRequest method or HTTP-request-logging code
• T085: monitoring.go intentionally does NOT stream container logs (comment confirms opposite of task)
• T086: no redactToken/sanitizeAuthHeader functions exist anywhere in repo
• T087: sanitizer_test.go tests pre-existing functions only, not T086's (nonexistent) deliverables
• T091: cli-management-commands.md table is Command|Daemon|Standalone, not a REST endpoint mapping
• T092: plan.md has only a checklist sentence claiming a diagram, no actual diagram

006-oauth-extra-params — 8 dropped

• T039: cmd/mcpproxy/auth_cmd.go:500-523 displays extra params raw with no masking applied; maskExtraParams/maskOAuthSecret unexported, never called from auth_cmd.go
• T040: scopes and PKCE shown at auth_cmd.go:485-497 but redirect URI never displayed anywhere in the file
• T042: token expiration shown (auth_cmd.go:549-558) but "last refresh" display does not exist anywhere in codebase
• T043: runAuthLoginClientMode (auth_cmd.go:624-668) has no configuration preview printed before OAuth call
• T044: no pre-browser-open summary of provider/scopes/PKCE/extra_params; only generic "Using daemon mode" message
• T045: no authorization URL is ever printed by the CLI in auth_cmd.go
• T046: post-success output (auth_cmd.go:663-665) is generic "flow initiated" message, not a verification summary
• T054: doctor_cmd.go has no example config/JSON snippets; only plain-text resolution string in diagnostics.go:104-106

007-oauth-e2e-testing — 5 dropped

• T080: neither runAuthLoginClientMode nor runAuthLoginStandalone prints authorization-URL preview before opening browser
• T082: same as T039 - no secret masking applied to any auth status field in auth_cmd.go
• T084: internal/upstream/core/connection.go has zero occurrences of grant_type/provider_url/scope logging fields
• T086: diagnostics.go has no discovery-endpoint reachability check
• T088: auth_cmd_test.go exists but tests never exercise displayAuthStatusPretty or assert on printed auth-status text

008-oauth-token-refresh — 6 dropped

• T020: config.go CreateOAuthConfig/CreateOAuthConfigWithExtraParams take no correlation_id-bearing context param
• T021: handleCallback (config.go:1105) has no correlation_id in its logging
• T022: internal/oauth/discovery.go has zero references to correlation/CorrelationLogger
• T023: internal/oauth/persistent_token_store.go has zero references to correlation
• T026: handleOAuthAuthorization/handleOAuthAuthorizationWithResult contain no correlation_id logging
• T027: internal/upstream/managed/client.go has zero references to correlation

009-proactive-oauth-refresh — 19 dropped

• T011: contracts.ts SSEEventType has no oauth.token_refreshed/oauth.refresh_failed variants
• T031: no TestTriggerOAuthLogout_* test exists in service_test.go
• T032: no unit test for TriggerOAuthLogout+disable_management
• T033: no unit test for TriggerOAuthLogout with non-OAuth server
• T034: no unit test for TriggerOAuthLogout with non-existent server
• T041: authLogoutCmd has no --all flag (unlike authLoginCmd)
• T054: no oauthExpired computed property exists; specific named artifact never created (behavior achieved differently via backend health.action, judged too indirect to tick this specific subtask even though the sibling task T055 — which promises the outcome rather than the artifact — was ticked)
• T060: no isAuthenticated computed property exists; canLogout (line 566) bundles several unrelated conditions beyond simple auth status
• T062: triggerLogout() (line 705-723) calls store action directly with no window.confirm/modal - no confirmation dialog exists
• T067: no oauthError computed property exists anywhere in ServerCard.vue
• T068: no standalone Token Expired badge; overridden to generic Sign-in required text
• T069: no distinct Auth Error badge; collapses into generic Sign-in required chip
• T070: no such distinct badges exist to style
• T071: status_test.go has no relative-time-formatting test
• T074: status.go has no FormatRelativeTime function
• T076: no expiration-time display element added to server details
• T077: no 5-minute warning indicator element
• T078: no EXPIRED text formatting element
• T082: verify-oas-coverage.sh sed regex bug (\U without \E) breaks route extraction; script produces false failures, does not verify OAS coverage

010-release-notes-generator — 1 dropped

• T021: docs has no releases/ directory structure section; actual mechanism is flat RELEASE_NOTES file, not documented as such

011-resource-auto-detect — 1 dropped

• T033: doctor_cmd.go has zero occurrences of "resource"; no resource-parameter diagnostic added

014-cli-output-formatting — 1 dropped

• T035: doctor_cmd.go still hand-rolls output; never calls internal/cli/output

016-activity-log-backend — 1 dropped

• T035: no unit test for handleExportActivity json+csv exists

017-activity-cli-commands — 9 dropped

• T028: no ULID-format validation exists in activity_cmd.go
• T029: no test exercises actual show table-formatting code path
• T035: no client-side invalid-ID-format handling, only not-found case
• T037: no GetActivitySummary() in internal/storage/activity.go; computed inline in httpapi
• T041: test only decodes mock JSON, never invokes CLI summary table-formatting output
• T047: no export file path validation tested, only --format value
• T055: docs/cli-management-commands.md has zero occurrences of "activity"
• T059: CI process action, not verifiable statically
• T060: CI process action, not verifiable statically

019-activity-webui — 1 dropped

• T046: ActivityWidget.vue exists but never imported/rendered in Dashboard.vue (unwired)

021-request-id-logging — 1 dropped

• T030: E2E test covers REST API directly, none invoke CLI activity list --request-id

026-pii-detection — 3 dropped

• T104: no custom-pattern-detection test in e2e_test.go
• T108: no sensitive/pii/detection scenarios in test-api-e2e.sh
• T109: no SSE emission test for detection in e2e_test.go

028-agent-tokens — 1 dropped

• T023: token_cmd_test.go only tests scaffolding, not list/revoke/regenerate behavior

029-mcpproxy-teams — 1 dropped

• T020: server-edition Linux matrix entries commented out in release.yml

040-server-ux — 4 dropped

• T016: no import preview step; ImportServerForm goes straight to single Import button, no checkboxes
• T017: only aggregate "N imported, M skipped" string, no per-server breakdown/failure reasons
• T018: no NSOpenPanel/Browse button anywhere in AddServerView.swift
• T019: no timeoutInterval/120 setting in APIClient.swift importFromPath

042-telemetry-tier2 — 12 dropped

• T009: no TestTelemetryConfigTier2Roundtrip or equivalent roundtrip test in config_test.go
• T028: no TestMCPRequestCountedAsSurfaceMCP test exists
• T035: no TestBuiltinToolCounterIncrementsPerCall test exists
• T036: no TestUpstreamToolCallIncrementsBucket test exists
• T037: no TestUpstreamToolNameNotInSnapshot privacy test exists
• T054: no TestOAuthRefreshFailureRecordsErrorCategory test exists
• T056: no TestToolQuarantineBlockedRecordsErrorCategory test exists
• T057: coordinator.go has zero RecordError/ErrCat references; ErrCatOAuthTokenExpired never called anywhere; required T054 test also absent
• T073: no TestDoctorCommandFeedsRegistry test exists
• T076: no TestShowPayloadPrintsValidJSON test exists
• T077: no TestShowPayloadMakesNoNetworkCall test exists
• T083: docs/features/telemetry.md missing DO_NOT_TRACK/CI env docs, first-run notice text, ID rotation policy

044-diagnostics-taxonomy — 10 dropped

• T004: no go:generate directive in registry.go; no codegen tool exists anywhere in repo
• T019: no RecordFixAttempt on activity_service.go writing to activity log; same-named function is unrelated in-memory telemetry counter
• T034: test-diagnostics-e2e.sh only runs go test twice + docs-link checker, no broken-stdio-server E2E scenario
• T045: check-errors-docs-links.sh exists but never invoked from run-all-tests.sh (unwired)
• T083: script has no doctor fix dry-run invocation, no dry-run/rate-limit assertions
• T090: stdio_show_last_logs fixer is an explicit stub string, does not tail logs
• T162: telemetry_payload_test.go tests never reference diagnostics sub-object despite struct field existing
• T201: docs/architecture.md has no internal/diagnostics reference
• T202: rest-api.md doesn't document new server-scoped diagnostics/diagnostics-fix endpoints
• T203: docs/errors/README.md hand-maintained and stale (33 vs 37 codes), no generator tooling exists

044-retention-telemetry-v3 — 3 dropped

• T003: docs/features/telemetry.md has no Environment Classification/Activation Tracking/Launch Source sections
• T063: docs/features/telemetry.md never documents env_kind/env_markers/activation block/autostart_enabled/decision tree/token-bucketing
• T069: manual quickstart-verification task with no recorded deviations/results artifact

056-output-schema-validation — 1 dropped

• T019: e2e/stubs/outputschema/main.go exists but never invoked anywhere - unwired

057-in-proxy-profiles — 1 dropped

• T022: CLAUDE.md and README.md missing profile slug documentation (2 of 3 required doc updates missing)

073-activity-size-retention — 1 dropped

• T012: docs/configuration.md has no mention of activity_max_size_mb or any Activity* field

076-deterministic-tool-scanner — 1 dropped

• T023: gofmt -l reports unformatted files still within task's own scope

077-scanner-simplification — 2 dropped

• T040: no recorded quickstart-scenario results, manual verification task
• T041: go test -race ./internal/runtime/... ./internal/config/... fails (2 pre-existing tests, unrelated read-only-directory assumptions that don't hold when run as root in the audit sandbox)

083-discovery-profiler — 1 dropped

• T041: go test ./bench/... -race fails (tiktoken network fetch 403 in sandbox), can't confirm green gate

Methodology note

Given the volume (147 possibly_built candidates + 88 UNRESOLVED/REMOVED/RELOCATED findings across 34 specs), verification was fanned out across 8 parallel research sub-agents (one per group of specs), each applying the tick test from this repo's spec-gardener instructions: state the promised behavior, cite file:line, confirm it's real (not a stub/comment/unwired component/skipped test), and default to not-ticking when uncertain. The gardener session then independently re-verified every candidate the sub-agents recommended ticking by reading the cited source directly before applying any checkbox change, and dropped two of a sub-agent's proposed ticks where the task named a specific artifact (a named computed property) that did not actually exist in the code even though the surrounding behavior worked via a different mechanism (009-proactive-oauth-refresh T054, T060 — dropped despite sibling tasks T055/T056/T061/T063 for the same feature area being ticked, since those name outcomes rather than specific artifacts).

ROADMAP.md was regenerated via scripts/gen-roadmap.py in a separate commit after the checkbox sync, per the pre-commit hook's staleness check.

[cloudflare-workers-and-pages]

Deploying mcpproxy-docs with    Cloudflare Pages

Latest commit:	6e2030a
Status:	✅  Deploy successful!
Preview URL:	https://bef6578f.mcpproxy-docs.pages.dev
Branch Preview URL:	https://claude-spec-gardener.mcpproxy-docs.pages.dev

View logs

[Dumbris]

The failing Analyze (go) (CodeQL) check is unrelated to this PR's diff (which only touches checkbox characters in specs/*/tasks.md and the generated ROADMAP.md). The autobuild step errors with:

We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. Loaded a configuration file for version '4.37.0', but running version '4.37.1'

This looks like a version-skew regression introduced by #863 (chore(ci): bump docker/login-action from 4.2.0 to 4.4.0) or a related recent CodeQL Action bump — main's most recent successful CodeQL run predates that dependabot merge, and this PR is based off current main. Fixing .github/workflows/codeql.yml is out of scope for a checkbox-only spec-gardener PR, so flagging here rather than pushing a workflow change.

---

Generated by Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

📦 Build Artifacts

Workflow Run: View Run
Branch: claude/spec-gardener

Available Artifacts

• archive-darwin-amd64 (28 MB)
• archive-darwin-arm64 (25 MB)
• archive-linux-amd64 (16 MB)
• archive-linux-arm64 (15 MB)
• archive-windows-amd64 (28 MB)
• archive-windows-arm64 (25 MB)
• frontend-dist-pr (0 MB)
• installer-dmg-darwin-amd64 (22 MB)
• installer-dmg-darwin-arm64 (20 MB)

How to Download

Option 1: GitHub Web UI (easiest)

1. Go to the workflow run page linked above
2. Scroll to the bottom "Artifacts" section
3. Click on the artifact you want to download

Option 2: GitHub CLI

gh run download 29719229804 --repo smart-mcp-proxy/mcpproxy-go

Note: Artifacts expire in 14 days.