fix(docs): honest auth model + version metadata sync

[simons-plugins]

Closes #20, closes #21.

• README Authentication section now states the real security model: IWS enforces the Bearer token in front of the plugin; the plugin performs no Authorization check. Added an explicit warning against exposing IWS unauthenticated.
• pyproject.toml version now tracks the Info.plist YYYY.R.P scheme (2026.1.1).
• Refreshed stale test/tool counts in README/CLAUDE.md.
• PluginVersion 2026.1.0 → 2026.1.1 (patch: docs/metadata only).

🤖 Generated with Claude Code

https://claude.ai/code/session_01EYAGXd4bE9D9Z5kZeSHeo7

Summary by CodeRabbit

• Documentation

  • Updated workspace role documentation to reflect support for 33 deterministic tools.
  • Clarified authentication responsibilities and warned against exposing IWS without the local secret.
  • Updated test-suite documentation to omit the fixed test count while retaining the approximate runtime.

• Chores

  • Incremented the plugin and project versions to 2026.1.1.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR clarifies that IWS enforces authentication, updates documented MCP and test counts, and aligns project and plugin versions at 2026.1.1.

Changes

Documentation and release metadata alignment

Layer / File(s)	Summary
Authentication model documentation README.md	Documents IWS-enforced Bearer-token access, notes that the plugin performs no authorization checks, and warns against exposing IWS without local-secret protection.
Release metadata and documented counts pyproject.toml, Indigo MCP Lite.indigoPlugin/Contents/Info.plist, CLAUDE.md, README.md	Aligns project and plugin versions at 2026.1.1, updates the documented MCP tool count to 33, and removes the stale test-count figure.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• simons-plugins/indigo-mcp-lite#6: Introduced the plugin metadata and documentation files updated here.
• simons-plugins/indigo-mcp-lite#12: Also updated the plugin version in Info.plist.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the docs/auth and version-metadata changes.
Linked Issues check	✅ Passed	The README auth model, version sync, and stale counts were updated to match issues #20 and #21.
Out of Scope Changes check	✅ Passed	The changes stay within the linked docs and version-metadata updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/metadata-auth-docs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Line 39: Update the authentication description in the README to state that the
plugin does not validate or use credentials, rather than claiming it never sees
them. Preserve the explanation that IWS enforces authentication before invoking
the MCP endpoint.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b3ba2de6-34b2-4b71-94a1-c93425a3e254

📥 Commits

Reviewing files that changed from the base of the PR and between 2672758 and 281a39a.

📒 Files selected for processing (4)

• CLAUDE.md
• Indigo MCP Lite.indigoPlugin/Contents/Info.plist
• README.md
• pyproject.toml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not claim the plugin “never sees” credentials.

plugin.py forwards the complete headers dictionary to mcp_handler.handle_request, which passes normalized headers into _dispatch. The plugin does not validate Authorization, but it does receive the header. Change this to “does not validate or use your credentials” to preserve the intended IWS boundary without misstating the data flow.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` at line 39, Update the authentication description in the README to
state that the plugin does not validate or use credentials, rather than claiming
it never sees them. Preserve the explanation that IWS enforces authentication
before invoking the MCP endpoint.