Repo-wide arch/robustness/completeness pass: 26 verified fixes (2 HIGH mcp bugs)

[RNT56]

What this is

A full repo-wide architecture / robustness / completeness pass over main (post #91 mcp-upgrade + #92 audit-remediation), then remediation of every confirmed finding. The review ran 17 reviewers (13 subsystem areas + 4 cross-cutting lenses) with every finding adversarially re-verified against the cited code. The 7 invariants lens found zero structural breaks — I1–I7 still hold. 29 issues surfaced → 26 distinct fixes, each with a focused test.

HIGH — both in the freshly-merged #91 mcp code

1. stdio transport could deadlock every caller. A server that accepts a request but never replies wedged the per-server mutex under an uninterruptible blocking Decode — a boot hang and, in serve, a cross-session lock-hold. Fixed: each Decode runs in a goroutine selected against ctx, closing the connection on cancel so the Manager evicts + reconnects; plus a bounded setupMCP Discover timeout so a stalled server can't hang boot. (My B8 batch originally had this fix; I dropped it during the Deep subsystem audit: remediate all 89 shipped-gaps (14 areas) + selfeval wiring #92 rebase judging feat(mcp): close the container gap + HTTP/SSE transport + opt-in resources/prompts #91's transport handled it — it didn't. Re-applied.)
2. Untrusted MCP tool name → host path-traversal write. t.Name + ".json" (untrusted tools/list output) written via filepath.Join could escape the worktree. Now slug()-sanitized like resources/prompts; the descriptor keeps the original name so the model still invokes the right tool.

MEDIUM/LOW highlights

• Live token streaming restored — Resilient.Stream buffered all chunks (streaming was dead in every production run); now forwards live on attempt 0 (buffers only on retry) and preserves the partial Response on ctx-cancel (steer interrupt-but-preserve).
• Experience Fold off the eventlog append mutex — a single ordered background drainer (non-blocking send, drop-and-warn under overload, drained on Close) so a slow SQLite projection can't stall the authoritative log.
• Kill-switch actually works in daemon/build — WithRoot threaded through wrapAutoApprove so .nilcore/AUTOAPPROVE_OFF resolves against the run root, not process CWD.
• Fixes to my own Deep subsystem audit: remediate all 89 shipped-gaps (14 areas) + selfeval wiring #92 work — browser Enter-to-submit now gated; desktop stale-ref versioned (mirrors the browser); secret reflow scrubbed for all field types; flywheel RotatedLogPaths wired.
• Plus: mcp list discovery action, Manager.get ctx-select, internal/mcp leaf deps_test.go; per-day rate-cap TOCTOU; project SWITCH *State; code.test_passes → ./...; LSP Content-Length cap; semantic-index prune; keychain fail-closed; native web-search on non-container backends; session-compaction splice; Telegram poller restartable; meter charge on cancel; channel deps kernel parity; host-/tmp shred.

How it was built

9 fixes by me (the security-critical mcp cluster + core eventlog + shared cmd wiring); the rest by 8 parallel worktree-isolated agents over disjoint packages, each verified in isolation, then integrated. Full grounded finding list + verified file:line in the commit.

Verification

• make verify — 119 packages, exit 0
• make tui-verify — green
• golangci-lint — clean
• go test -race — clean on every touched concurrency package (eventlog drainer, mcp, graapprove, session, telegram, model, experience)

🤖 Generated with Claude Code