fix: native MCP Skills transport and capability-aware artifact controls

[jmagar]

Summary

• Preserve native Skills responses in the production capped HTTP client.
• Pin both workspace and auth rmcp dependencies to the published SDK fixes in fix(rmcp): preserve raw responses through OAuth and header caching rust-sdk#2 (f94e8fa).
• Add required CI coverage for real-process HTTP/stdio server and federation, OAuth wrapper compatibility, manifest reads/digests, and fail-closed exposure policy.
• Gate Artifact Control Plane on registered runtime services: disabled or unavailable services show guidance and retry rather than controls that call absent endpoints. No user configuration changed.

Verification

• Native Skills end-to-end: 6/6 passed using the published pin with --locked, no local override.
• Gateway suite: 1213/1213 passed with four workers against the SDK fixes; five skipped. A one-second process-output test timed out at high concurrency and passed at four workers.
• UI unit tests: 617 passed; installer tests: 2 passed; focused Artifact control tests: 6 passed.
• UI static export, TypeScript, targeted ESLint, actionlint and diff checks passed.
• Playwright rendered desktop 1365x900 and mobile 390x844: unavailable guidance, retry, no authority requests, no console/page errors. Controlled auth/service fixtures, not production acceptance.
• Independent SDK and UI review completed; SDK review follow-up strengthened worker-level tests.

Boundaries

No deployment, service restart, configuration toggle, ingestion, or PR merge. The SDK dependency PR remains open for human review.

[jmagar]

Review completed across correctness, errors/types, tests, comments/docs/config, and simplification. No remaining actionable findings. Both rmcp pins and lockfile entries resolve to published SDK f94e8fa with no patch override. Latest native Skills E2E: 6/6 passed with --locked. Earlier full gateway suite against the same production SDK fixes: 1213/1213 with four workers (five skipped), not claimed as a final-pin rerun. UI: 617 unit + 2 installer tests, six focused cases, static export/TypeScript, targeted ESLint, actionlint, and diff checks passed. Playwright desktop/mobile validated unavailable-state guidance and retry with zero authority endpoint requests and zero console/page errors under controlled fixtures. Narrow-screen action clipping was found and fixed. Live config, service, installation, and ingestion were not changed.

[jmagar]

Follow-up 7c23f44 adds a controlled authorization-server E2E: production OAuth manager metadata discovery, code exchange, PKCE verifier assertion, proactive refresh, and native Skills list/get/resource reads from a real Labby server without a static client bearer. Consent is simulated; browser/external-provider acceptance and reactive 401 refresh are not claimed. Independent delta review found no actionable findings. Final local Skills suite 7/7 passed (30538607), strict focused Clippy passed. Prior d464eeb conformance and focused MCP CI passed; new head requires fresh CI. Mac service enablement was separately authorized and performed; no production TOOTIE deployment or merge.

[jmagar]

Additional final-pin verification: full labby-gateway suite passed 1213/1213 (5 skipped) on7c23f44e8 using published SDKf94e8fa, --all-features --locked and four test threads. Nextest run03dc1a66-a620-4cbb-978f-9cd4f60d9035,130s. This supersedes the earlier local-SDK-only full gateway evidence. Final-head CI34268847229 remains in progress; no CI completion claim yet.

[jmagar]

User-approved follow-up95bf4c795 addresses the sole failing prior CI test: concurrent installation identity publication on Windows returned sharing violation32 rather than AlreadyExists. Recovery accepts only collision errors and reads the winner through existing secure validation; unrelated publication/durability errors remain errors. Original concurrency test retained; held-reader winner,invalid winner,and error-preservation tests added. Review found broad fallback could mask directory-sync errors; narrowed and re-reviewed clean. Local bootstrap group18/18passed f47e36e3;strict libraryClippy passed. Native Windows validation is pending new CI; no retry/suppression or merge.