chore(specs): gardener checkbox sync

ROADMAP.md

@@ -683,7 +683,7 @@ Legend: `shipped` ≥95% checked · `in-flight` 1–94% · `drafted` 0% · `—`
 | [006-oauth-extra-params](./specs/006-oauth-extra-params/) | `in-flight` | 43/65 (66%) |
 | [007-oauth-e2e-testing](./specs/007-oauth-e2e-testing/) | `in-flight` | 93/103 (90%) |
 | [008-oauth-token-refresh](./specs/008-oauth-token-refresh/) | `in-flight` | 57/64 (89%) |
-| [009-proactive-oauth-refresh](./specs/009-proactive-oauth-refresh/) | `in-flight` | 43/87 (49%) |
+| [009-proactive-oauth-refresh](./specs/009-proactive-oauth-refresh/) | `in-flight` | 47/87 (54%) |
 | [010-release-notes-generator](./specs/010-release-notes-generator/) | `in-flight` | 24/36 (67%) |
 | [011-resource-auto-detect](./specs/011-resource-auto-detect/) | `shipped` | 38/39 (97%) |
 | [012-docusaurus-docs-site](./specs/012-docusaurus-docs-site/) | `in-flight` | 74/89 (83%) |
@@ -716,14 +716,14 @@ Legend: `shipped` ≥95% checked · `in-flight` 1–94% · `drafted` 0% · `—`
 | [039-security-scanner-plugins](./specs/039-security-scanner-plugins/) | — | — |
 | [040-server-ux](./specs/040-server-ux/) | `in-flight` | 28/35 (80%) |
 | [041-quarantine-invariants](./specs/041-quarantine-invariants/) | — | — |
-| [042-telemetry-tier2](./specs/042-telemetry-tier2/) | `in-flight` | 60/91 (66%) |
+| [042-telemetry-tier2](./specs/042-telemetry-tier2/) | `in-flight` | 65/91 (71%) |
 | [043-linux-package-repos](./specs/043-linux-package-repos/) | `shipped` | 41/41 (100%) |
 | [044-diagnostics-taxonomy](./specs/044-diagnostics-taxonomy/) | `in-flight` | 59/106 (56%) |
-| [044-retention-telemetry-v3](./specs/044-retention-telemetry-v3/) | `in-flight` | 54/70 (77%) |
+| [044-retention-telemetry-v3](./specs/044-retention-telemetry-v3/) | `in-flight` | 55/70 (79%) |
 | [045-paperclip-cockpit](./specs/045-paperclip-cockpit/) | `in-flight` | 40/47 (85%) |
 | [046-local-first-onboarding](./specs/046-local-first-onboarding/) | — | — |
 | [046-local-launcher-for-http-sse](./specs/046-local-launcher-for-http-sse/) | — | — |
-| [047-cpu-hotpath-fix](./specs/047-cpu-hotpath-fix/) | `in-flight` | 25/46 (54%) |
+| [047-cpu-hotpath-fix](./specs/047-cpu-hotpath-fix/) | `in-flight` | 26/46 (57%) |
 | [048-tray-refetch-elimination](./specs/048-tray-refetch-elimination/) | `in-flight` | 18/31 (58%) |
 | [049-agent-discoverable-disabled-tools](./specs/049-agent-discoverable-disabled-tools/) | `shipped` | 18/18 (100%) |
 | [050-global-tools-page](./specs/050-global-tools-page/) | `in-flight` | 24/26 (92%) |
@@ -752,6 +752,6 @@ Legend: `shipped` ≥95% checked · `in-flight` 1–94% · `drafted` 0% · `—`
 | [080-telemetry-v7-churn](./specs/080-telemetry-v7-churn/) | — | — |
 | [081-release-qa-gate](./specs/081-release-qa-gate/) | — | — |
 | [082-work-sessions](./specs/082-work-sessions/) | — | — |
-| [083-discovery-profiler](./specs/083-discovery-profiler/) | `drafted` | 0/41 (0%) |
+| [083-discovery-profiler](./specs/083-discovery-profiler/) | `in-flight` | 4/41 (10%) |
 | [084-toon-output](./specs/084-toon-output/) | `in-flight` | 40/43 (93%) |
 | [085-compact-router](./specs/085-compact-router/) | `shipped` | 44/46 (96%) |

specs/009-proactive-oauth-refresh/tasks.md

@@ -152,8 +152,8 @@
 ### Implementation for User Story 4
 
 - [ ] T054 [US4] Add oauthExpired computed property to ServerCard.vue in frontend/src/components/ServerCard.vue
-- [ ] T055 [US4] Update Login button v-if condition to include oauthExpired in frontend/src/components/ServerCard.vue
-- [ ] T056 [US4] Ensure Login button styling is consistent in frontend/src/components/ServerCard.vue
+- [x] T055 [US4] Update Login button v-if condition to include oauthExpired in frontend/src/components/ServerCard.vue
+- [x] T056 [US4] Ensure Login button styling is consistent in frontend/src/components/ServerCard.vue
 
 **Checkpoint**: Login button should now appear for connected servers with expired tokens
 
@@ -174,9 +174,9 @@
 ### Implementation for User Story 5
 
 - [ ] T060 [US5] Add isAuthenticated computed property to ServerCard.vue in frontend/src/components/ServerCard.vue
-- [ ] T061 [US5] Add Logout button with v-if="isAuthenticated" in frontend/src/components/ServerCard.vue
+- [x] T061 [US5] Add Logout button with v-if="isAuthenticated" in frontend/src/components/ServerCard.vue
 - [ ] T062 [US5] Implement handleLogout method with confirmation dialog in frontend/src/components/ServerCard.vue
-- [ ] T063 [US5] Connect handleLogout to serversStore.triggerOAuthLogout in frontend/src/components/ServerCard.vue
+- [x] T063 [US5] Connect handleLogout to serversStore.triggerOAuthLogout in frontend/src/components/ServerCard.vue
 
 **Checkpoint**: Logout button should work with confirmation dialog
 

specs/042-telemetry-tier2/tasks.md

@@ -26,10 +26,10 @@ Single Go module project. All Go source under `internal/` and `cmd/`. New tests
 
 **Purpose**: Verify baseline and identify exact integration points before touching any code.
 
-- [ ] T001 Read `internal/telemetry/telemetry.go` end-to-end and confirm the v1 `Service`, `HeartbeatPayload`, `Start()`, `send()`, and config fields match what `data-model.md` and `research.md` describe. Note any drift.
-- [ ] T002 Read `internal/httpapi/middleware.go` and `internal/httpapi/server.go` to identify the existing middleware chain and confirm the Chi router is `chi.Router`. Note the file/line where new middleware should be wired.
-- [ ] T003 Read `internal/server/mcp.go` to find the entry point of every built-in MCP tool handler (`handleRetrieveTools`, the call_tool variants, `upstream_servers`, `quarantine_security`, `code_execution`). List file:line for each.
-- [ ] T004 Read `internal/cliclient/client.go` (or wherever the CLI HTTP client is defined) to find the HTTP request construction site. Locate where to inject the `X-MCPProxy-Client` header.
+- [x] T001 Read `internal/telemetry/telemetry.go` end-to-end and confirm the v1 `Service`, `HeartbeatPayload`, `Start()`, `send()`, and config fields match what `data-model.md` and `research.md` describe. Note any drift.
+- [x] T002 Read `internal/httpapi/middleware.go` and `internal/httpapi/server.go` to identify the existing middleware chain and confirm the Chi router is `chi.Router`. Note the file/line where new middleware should be wired.
+- [x] T003 Read `internal/server/mcp.go` to find the entry point of every built-in MCP tool handler (`handleRetrieveTools`, the call_tool variants, `upstream_servers`, `quarantine_security`, `code_execution`). List file:line for each.
+- [x] T004 Read `internal/cliclient/client.go` (or wherever the CLI HTTP client is defined) to find the HTTP request construction site. Locate where to inject the `X-MCPProxy-Client` header.
 - [ ] T005 Locate the macOS tray's Swift HTTP request builder under `native/macos/MCPProxy/` (grep for `URLRequest` and `URLSession.shared`). Record the file path.
 - [ ] T006 Locate the web UI fetch wrapper under `frontend/src/api/` (grep for `fetch(` and existing `X-API-Key` injection). Record the file path.
 - [ ] T007 Confirm baseline: run `go test ./internal/telemetry/... -race` and `go build ./cmd/mcpproxy` from the worktree root. Both must pass before any code change.
@@ -298,7 +298,7 @@ Single Go module project. All Go source under `internal/` and `cmd/`. New tests
 - [ ] T088 Run `go build ./cmd/mcpproxy` (personal edition) and `go build -tags server ./cmd/mcpproxy` (server edition). Both must compile clean.
 - [ ] T089 Run `./scripts/test-api-e2e.sh` and confirm no regressions.
 - [ ] T090 Manually verify the quickstart in `quickstart.md` end-to-end on the worktree binary: build, run `mcpproxy telemetry show-payload`, assert output contains `schema_version: 2` and all required fields.
-- [ ] T091 Update `cmd/mcpproxy/edition.go` or wherever the version constant lives if needed (no change expected, but verify version string is plumbed into the headers in T032/T033/T034).
+- [x] T091 Update `cmd/mcpproxy/edition.go` or wherever the version constant lives if needed (no change expected, but verify version string is plumbed into the headers in T032/T033/T034).
 
 **Final Checkpoint**: All tests pass, both editions build, e2e smoke is green, docs updated.
 

specs/044-retention-telemetry-v3/tasks.md

@@ -32,7 +32,7 @@ description: "Task list for feature 044-retention-telemetry-v3"
 
 **Purpose**: Minor scaffolding. The existing `internal/telemetry` package already has v3 schema version and the build system is mature — no structural setup needed.
 
-- [ ] T001 Confirm `SchemaVersion = 3` constant in `internal/telemetry/telemetry.go` remains 3 (spec 044 extends v3, does not re-bump); add a short comment noting spec 044 additions above the constant.
+- [x] T001 Confirm `SchemaVersion = 3` constant in `internal/telemetry/telemetry.go` remains 3 (spec 044 extends v3, does not re-bump); add a short comment noting spec 044 additions above the constant.
 - [x] T002 Add a new BBolt bucket-name constant `ActivationBucketName = "activation"` in `internal/telemetry/activation.go` (file created in Phase 2).
 - [ ] T003 [P] Extend `docs/features/telemetry.md` skeleton with placeholder sections "Environment Classification", "Activation Tracking", and "Launch Source" (content filled in polish phase).
 

specs/047-cpu-hotpath-fix/tasks.md

@@ -22,7 +22,7 @@ US1 alone delivers the core CPU win even before US2-5 ship. US2+US4+US5 together
 
 ## Phase 1 — Setup
 
-- [ ] T001 Confirm working tree clean except for the in-progress pprof endpoint at `internal/server/server.go` (already on branch); preserve those changes for the PR.
+- [x] T001 Confirm working tree clean except for the in-progress pprof endpoint at `internal/server/server.go` (already on branch); preserve those changes for the PR.
 
 ## Phase 2 — Foundational
 

specs/083-discovery-profiler/tasks.md

@@ -17,7 +17,7 @@
 - [ ] T006 Implement Arm interface + registry in bench/arms/arm.go per contracts/arm-interface.md: `Name()`, `IndexAltering()`, `EncodeTool`, `EncodeListing`, `EncodeIndexMetadata`, `ErrArmUnavailable`, `LowerBound` self-report; registry rejects duplicate names
 - [ ] T007 Implement `baseline_json` arm in bench/arms/baseline.go (canonical full-definition renderer: name + description + canonical-JSON schema) making T005 pass; export the renderer for naive-menu/break-even reuse
 - [ ] T008 [P] Define ReportV2 Go types in bench/reportv2.go mirroring contracts/report-v2.schema.json (flat RetrievalScore DTO + mapping from existing `RetrievalMetrics`; provenance map; arms/corpora/response_cost/break_even/session_estimates/lap/subset sections) with a schema-validation test in bench/reportv2_test.go validating a sample report against the contract file
-- [ ] T009 [P] Create corpus_v2 generator script scripts/gen-corpus-v2.sh (boot snapshot proxy per quickstart, export GET /api/v1/tools with full input schemas, canonicalize ordering, write specs/083-discovery-profiler/datasets/corpus_v2.tools.json) and run it once; commit the generated corpus with tool count recorded in datasets/README.md
+- [x] T009 [P] Create corpus_v2 generator script scripts/gen-corpus-v2.sh (boot snapshot proxy per quickstart, export GET /api/v1/tools with full input schemas, canonicalize ordering, write specs/083-discovery-profiler/datasets/corpus_v2.tools.json) and run it once; commit the generated corpus with tool count recorded in datasets/README.md
 - [ ] T010 Extend bench/tokens.go to load corpus_v2 (schema-bearing) alongside corpus_v1, with validation test in bench/tokens_test.go (every corpus_v2 tool has non-empty schema; count matches datasets/README.md)
 
 ## Phase 3: User Story 1 — Measure live retrieve_tools response cost (P1) 🎯 MVP
@@ -56,7 +56,7 @@
 **Goal**: ToolRet retrieval-quality end-to-end; LiveMCPTool token/scale.
 **Independent test**: fetch → load → subset → score ToolRet; load committed LiveMCPTool snapshot → arm tokens.
 
-- [ ] T026 [P] [US3] Create scripts/fetch-toolret.sh: `uv run --with huggingface_hub,pyarrow` download of mangopy/ToolRet-Tools + mangopy/ToolRet-Queries at pinned `--revision` (default recorded in script), parquet→JSON into bench/results/cache/toolret/<revision>/ with actionable errors (FR-013, research D5)
+- [x] T026 [P] [US3] Create scripts/fetch-toolret.sh: `uv run --with huggingface_hub,pyarrow` download of mangopy/ToolRet-Tools + mangopy/ToolRet-Queries at pinned `--revision` (default recorded in script), parquet→JSON into bench/results/cache/toolret/<revision>/ with actionable errors (FR-013, research D5)
 - [ ] T027 [US3] Write failing loader tests in bench/corpusio/toolret_test.go on a small committed synthetic fixture matching ToolRet's field shape (NOT real ToolRet data): per-record validation errors, stable-ID sort, seeded subset determinism (same revision+seed+size ⇒ same subset), missing-ID failure
 - [ ] T028 [US3] Implement bench/corpusio/toolret.go making T027 pass, mapping tools→Corpus and queries→GoldenSet with corpus/version stamping (FR-011/012/014)
 - [ ] T029 [P] [US3] Create LiveMCPTool committed snapshot under specs/083-discovery-profiler/datasets/livemcptool_snapshot/ with ATTRIBUTION.md (Apache 2.0, ICIP/LiveMCPBench, arXiv:2508.01780) via a documented one-time download; implement + test loader bench/corpusio/livemcptool.go (Corpus for token/scale; relevance-label derivation from task annotations as stretch — if labels not derivable, record explicit absence per FR-011)
@@ -89,8 +89,8 @@
 
 ## Phase 9: Polish & CI
 
-- [ ] T039 Extend .github/workflows/bench.yml: setup-node + `npm ci --prefix bench/tscg`, run `make bench-discovery`, live run with response-cost measurement, `uvx --from lap-score==0.8.0 lap lint --json` step (pinned; failure → skip with reason), upload lap.json + report.json + dashboard.html artifacts; job stays `continue-on-error: true` (FR-022); add optional `workflow_dispatch` ToolRet-subset job (< 30 min, SC-007)
-- [ ] T040 [P] Update bench/README.md: new modes/flags, arm descriptions, dataset provenance + license notes (ToolRet unstated-license rationale), tokenizer caveat, quickstart parity with specs/083-discovery-profiler/quickstart.md
+- [x] T039 Extend .github/workflows/bench.yml: setup-node + `npm ci --prefix bench/tscg`, run `make bench-discovery`, live run with response-cost measurement, `uvx --from lap-score==0.8.0 lap lint --json` step (pinned; failure → skip with reason), upload lap.json + report.json + dashboard.html artifacts; job stays `continue-on-error: true` (FR-022); add optional `workflow_dispatch` ToolRet-subset job (< 30 min, SC-007)
+- [x] T040 [P] Update bench/README.md: new modes/flags, arm descriptions, dataset provenance + license notes (ToolRet unstated-license rationale), tokenizer caveat, quickstart parity with specs/083-discovery-profiler/quickstart.md
 - [ ] T041 Run full verification: `go test ./bench/... -race`, `/opt/homebrew/bin/golangci-lint run --config .github/.golangci.yml ./bench/...`, `./scripts/test-api-e2e.sh`, `make bench-discovery` wall-clock < 15 min budget check (SC-007/SC-008)
 
 ## Dependencies