chore(specs): gardener checkbox sync

[Dumbris]

chore(specs): gardener checkbox sync — 2026-09-14

2 ticks applied · 1 un-tick proposed (not applied) · 172 tick-candidates dropped · 66 un-tick-candidates dropped (artifact actually exists) · run date 2026-09-14

Ran scripts/check-spec-evidence.py against all specs/*/tasks.md (73 specs). It reported 66 UNRESOLVED, 2 REMOVED, 30 RELOCATED (informational, no action needed — work exists, just a stale cited path), and 174 possibly_built (unchecked tasks whose cited artifacts exist). Every one of the 174 + 68 candidates was checked against the actual code by hand, applying the TICK TEST (behavior promised, code that produces it, cited as file:line, confirmed real/wired/tested) plus an adversarial pass. Only 2 tick candidates and 1 un-tick candidate survived — the overwhelming majority of the checker's candidates were false positives caused by shared/generic files, renamed artifacts, or partially-built features.

ROADMAP.md was also regenerated via scripts/gen-roadmap.py (required — the pre-commit hook rejects a stale roadmap after a checkbox change) and committed separately as chore(roadmap): regenerate ROADMAP.md after gardener checkbox sync. It was not hand-edited; only the two affected specs' progress numbers changed (007-oauth-e2e-testing 93→94/103, 044-diagnostics-taxonomy 59→60/106).

Testing

• No behavior changed — only checkbox characters in specs/*/tasks.md and the regenerated ROADMAP.md table. Nothing to run.
• Both applied ticks were independently verified against the live code (file:line + test) before being applied — see the table below.
• N/A — no new tests added; this PR only reconciles existing checkboxes with already-shipped, already-tested code.

Applied ticks

spec/task	file:line	decisive line of code
044-diagnostics-taxonomy / T090	internal/server/diagnostics_fixers.go:70 (registration), :86-162 (fixShowLastServerLogs); test internal/server/diagnostics_fixers_test.go:121	diagnostics.Register("stdio_show_last_logs", s.fixShowLastServerLogs) → entries, err := s.GetServerLogs(req.ServerID, diagnosticsLogTailLines), rendered into FixResult.Preview; covered by TestDiagnosticFixer_StdioShowLastLogs_ReturnsRealTail. (Task names internal/diagnostics/fixers.go; the real, wired implementation is the runtime-backed override in internal/server/diagnostics_fixers.go, installed by registerDiagnosticFixers() called from NewServerWithConfigPath.)
007-oauth-e2e-testing / T080	cmd/mcpproxy/auth_cmd.go:680-694 (printDaemonOAuthLoginResult); test cmd/mcpproxy/auth_cmd_test.go:272	fmt.Fprintf(w, " %s\n", result.AuthURL) — printed both as the primary path when the browser couldn't open and as a fallback hint when it did; covered by TestPrintDaemonOAuthLoginResult_BrowserNotOpened / _BrowserOpened.

Proposed un-ticks (NOT applied)

spec/task	evidence	why the artifact is absent
044-diagnostics-taxonomy / T071 — "Create native/macos/MCPProxy/Menu/FixIssuesMenu.swift: 'Fix Issues (N)' submenu populated from failing servers; each entry opens web UI at server's detail page"	Searched all of native/macos for FixIssuesMenu, the string "Fix Issues", and every consumer of AppState.serversWithDiagnostic (native/macos/MCPProxy/MCPProxy/State/AppState.swift:330). No such file, no NSMenu/MenuBarExtra item, and no URL-opening code referencing it exists anywhere in production Swift.	The backing property exists and is unit-tested, but its own doc comment states: "Nothing consumes this today, which is exactly why the drift would have gone unnoticed until something did." That's first-party confirmation the menu was never built — currently marked [x] but the described UI does not exist.

Dropped by verification

Tick candidates rejected (172 of 174 possibly_built)

All failed the TICK TEST: cited file exists (why the checker flagged it) but the specific promised behavior — the exact test, field, method, or doc content — is not actually present. Grouped by spec.

001-code-execution (13/13 dropped)

• T020 — no test configures two mock upstream servers (cfg.Servers is empty in every test in mcp_code_execution_test.go).
• T032 — mockToolCaller.errors map defined but never populated/used; no test exercises a genuine failing call_tool().
• T033 — same as T032; no test continues execution after a real tool failure.
• T034 — no integration test with a failing upstream tool and real upstream servers configured.
• T051 — no test with nested objects/arrays for input; existing tests use flat fields only.
• T052 — no test asserting complex/nested result serialization.
• T079 — ExecutionID exists but no test asserts uniqueness/UUID format.
• T080 — no integration test checks log content for execution_id/truncated_code/tools_called/duration_ms.
• T092 — no --code inline-flag test in code_cmd_test.go.
• T093 — no --file flag test.
• T094 — no --input/--input-file flag test.
• T095 — no syntax-error/non-zero-exit-code test.
• T096 — no timeout-flag test.

001-oas-endpoint-documentation (6/6 dropped)

• T003, T005, T006, T007 — actually ACTUALLY-EXISTS (all four contract types live in internal/contracts/types.go, consolidated into one file instead of four the checker expected) — see un-tick-side note below; not proposed here since already correctly ticked.
• T013 — handleGetSecretRefs (server.go:4159) has no swag @Summary/@Router annotation.
• T014 — handleGetConfigSecrets (server.go:4241) has no swag annotation.
• T015 — handleMigrateSecrets (server.go:4205) has no swag annotation.
• T025 — internal/httpapi/code_exec.go has zero swag comments.
• T026 — handleSSEEvents (server.go:3843) has no swag annotation.
• T027 — HEAD /events handler still has no swag annotation.

001-update-version-display (6/6 dropped)

• T012 — no tray test references the version menu item.
• T019 — no test for the startup-check path specifically (only CheckNow() is tested).
• T020 — default interval is 24h (DefaultCheckInterval), not 4h as claimed; no such ticker test exists.
• T024 — scripts/test-api-e2e.sh checks .data.version but never asserts on the update field.
• T028 — no tray test asserts update-menu-item visibility.
• T029 — no tray test asserts removal of "Check for Updates..." menu item.

003-tool-annotations-webui (3/3 dropped)

• T046 — no SessionsTable component; Dashboard.vue renders "Recent Sessions" inline instead.
• T050 — getToolCalls in frontend/src/services/api.ts:628 takes no sessionId param.
• T058 — no sessions.created/updated/closed SSE events anywhere in server.go.

004-management-health-refactor (9/9 dropped)

• T022 — no test exercises upstream restart CLI→REST→Service flow.
• T039 — doctor_cmd_test.go tests are unit tests of formatters, not an E2E test of the doctor command.
• T069 — no --all restart test.
• T083 — logHTTPRequest does not exist anywhere in the repo.
• T085 — code explicitly does the opposite: monitoring.go:288-306 says "we intentionally do NOT stream container logs."
• T086 — no redactToken/sanitizeAuthHeader functions exist.
• T087 — cited tests cover the pre-existing generic sanitizer, not functions built for this task.
• T091 — docs have a daemon/standalone availability table but no REST-endpoint mapping table.
• T092 — plan.md only lists the diagram as a compliance bullet; no actual diagram present.

006-oauth-extra-params (8/8 dropped)

• T039 — extra params printed with no masking at all, despite the task requiring it.
• T040 — scopes/PKCE shown but redirect URI is never displayed.
• T042 — token expiration shown but "last refresh" isn't tracked or displayed anywhere.
• T043 — no configuration-preview output before triggering OAuth in runAuthLoginClientMode.
• T044 — no pre-browser-open summary (provider/scopes/PKCE/extra_params).
• T045 — only the raw AuthURL is printed after the fact; no structured breakdown.
• T046 — printDaemonOAuthLoginResult prints a generic hint, not a verification summary.
• T054 — doctor's resolution text is a plain sentence, not an example config snippet.

007-oauth-e2e-testing (4/5 dropped — T080 applied above)

• T082 — no masking/redaction code in auth_cmd.go at all.
• T084 — no structured logging fields for provider URL/scopes/grant_type in connection.go.
• T086 — diagnostics has OAuth health checks but no discovery-endpoint reachability check.
• T088 — no test exercises displayAuthStatusPretty.

008-oauth-token-refresh (6/6 dropped)

• T020, T021, T022, T023, T026, T027 — no correlation_id anywhere in internal/oauth/config.go, connection.go (handleCallback), discovery.go, persistent_token_store.go, or internal/upstream/managed/client.go; feature entirely absent.

009-proactive-oauth-refresh (21/21 dropped)

• T011 — SSEEventType has no oauth.token_refreshed/oauth.refresh_failed.
• T031–T034 — no TestTriggerOAuthLogout* tests exist; only the earlier Login-variant test and an unasserted mock method.
• T041 — authLogoutCmd has no --all flag (only on authLoginCmd/authStatusCmd).
• T044, T045 — no test asserts 400/404 on the logout endpoint for non-OAuth/not-found servers.
• T054 — no oauthExpired computed property; Login visibility uses the pre-existing healthAction === 'login'.
• T060 — no isAuthenticated computed; Logout visibility uses the broader pre-existing canLogout.
• T062 — triggerLogout() calls the store directly with no confirmation dialog.
• T067–T070 — no oauthError computed, no "Token Expired"/"Auth Error" badges, no badge markup at all.
• T071, T074 — no relative-time-formatting test or FormatRelativeTime function exists.
• T076–T078 — no expiration-time display, no "expiring soon" warning, no "EXPIRED" formatting in ServerCard.vue.
• T082 — scripts/verify-oas-coverage.sh currently exits 1 (74.3% coverage) — does not pass clean.
• (Note: reviewing agent also flagged that already-checked T061 in this same file cites v-if="isAuthenticated" but the real code uses v-if="canLogout" — outside this run's scope since T061 wasn't flagged by the checker, noted here for a human to look at separately.)

011-resource-auto-detect (1/1 dropped)

• T033 — doctor_cmd.go never mentions "resource"; no diagnostic added.

014-cli-output-formatting (1/1 dropped)

• T035 — doctor_cmd.go doesn't import or use internal/cli/output.

016-activity-log-backend (1/1 dropped)

• T035 — cited tests only exercise the export helper, never CSV format or handleExportActivity directly.

017-activity-cli-commands (8/8 dropped)

• T028 — no ULID-format validation exists anywhere.
• T029 — cited test never calls runActivityShow; only checks a raw HTTP 404.
• T035 — no distinct "invalid ID format" handling (only a "not found" substring match).
• T037 — no GetActivitySummary() method in internal/storage/activity.go; computed inline elsewhere.
• T041 — no test calls runActivitySummary or asserts formatted table output.
• T047 — no export file-path validation test.
• T059, T060 — checklist tasks ("run the E2E/lint gate") with no artifact proving this spec's gate specifically was run.

019-activity-webui (1/1 dropped)

• T046 — ActivityWidget.vue exists but is never imported anywhere (classic unwired component).

021-request-id-logging (1/1 dropped)

• T030 — cited test only covers the API query param, not the CLI --request-id flag.

026-pii-detection (3/3 dropped)

• T104 — no custom-pattern-detection test.
• T108 — scripts/test-api-e2e.sh has zero sensitive-data-detection scenarios.
• T109 — no SSE-emission-on-detection test.

028-agent-tokens (1/1 dropped)

• T023 — token_cmd_test.go only covers list/create; missing JSON-list, revoke, and regenerate behavior tests.

029-mcpproxy-teams (1/1 dropped)

• T020 — Teams Linux matrix entries in .github/workflows/release.yml are still commented out.

040-server-ux (4/4 dropped)

• T016 — no preview=true/checkbox-based server list; import is a one-click action.
• T017 — no per-server imported/skipped/failed display; only an aggregate count.
• T018 — no NSOpenPanel/"Browse Other File..." button.
• T019 — default timeout is still 30s; no 120s import-specific override.

042-telemetry-tier2 (12/12 dropped)

• T009, T028, T035, T036, T037, T054, T056, T073, T076, T077 — none of the named tests exist anywhere in the repo.
• T057 — internal/oauth/coordinator.go has zero references to RecordError/ErrCatOAuthRefreshFailed/ErrCatOAuthTokenExpired; not wired.
• T083 — docs/features/telemetry.md has no DO_NOT_TRACK mention at all.

044-diagnostics-taxonomy (9/10 dropped — T090 applied above)

• T004, T203 — no go generate directive exists in internal/diagnostics/registry.go.
• T019 — RecordFixAttempt/FixAttempt don't exist in activity_service.go/models.go.
• T034 — test-diagnostics-e2e.sh never starts mcpproxy or exercises a real broken server.
• T045 — the link-checker script exists but is never invoked from run-all-tests.sh.
• T083 — no doctor fix dry-run / rate-limit assertion in the e2e script.
• T162 — no test references "diagnostics" in telemetry_payload_test.go.
• T201, T202 — docs/architecture.md has no Diagnostics section; docs/api/rest-api.md doesn't document the new per-server endpoints.

044-retention-telemetry-v3 (3/3 dropped)

• T003, T063 — docs/features/telemetry.md has no Environment Classification/Activation Tracking/Launch Source sections despite the underlying code existing.
• T069 — manual quickstart-verification task with no recorded evidence it was run.

056-output-schema-validation (1/1 dropped)

• T019 — no outputSchema mention in scripts/test-api-e2e.sh.

057-in-proxy-profiles (1/1 dropped)

• T022 — README.md/CLAUDE.md doc updates missing (only docs/features/profiles.md was done).

058-mcp-2026-upgrade (40/40 dropped)

• T023–T076 (full Phase 3+ list) — the Phase-1/2 era-testing harness is real and working, but every Phase 3+ symbol/behavior the candidates cite (resolveActiveProfileForList, list-only resolver gating, cross-client cancellation guard, identity-capture-in-AddBeforeAny, corrected session_store.go comment, era docs, decided "open product decision" items, dual-era discovery+call test, lifted legacy-protocol pin, modern-era health probes, MCP-* header emission, -32020/-32022 validation, input_required handling, cache-hints, tool-ordering determinism, $ref rejection, trace-context capture, per-request log level, architecture docs, idle-session sweeper) is genuinely absent — none of the 40 candidates survived, all matched only via shared/reused files.

073-activity-size-retention (1/1 dropped)

• T012 — activity_max_size_mb documented in docs/features/activity-log.md but not in docs/configuration.md (task requires both).

076-deterministic-tool-scanner, 077-scanner-simplification (×2), 083-discovery-profiler, 096-batched-call-tools, 097-stored-scripts, 098-tools-preflight (7/7 dropped)

• Each is a "run the full lint/test/e2e gate and confirm green" checklist task matched only via the shared .github/.golangci.yml config file — no artifact proves this specific spec's gate was executed.

Un-tick candidates rejected (66 of 68 UNRESOLVED/REMOVED — artifact confirmed to still exist, just relocated/renamed)

These were already correctly ticked; the checker's path-matching just couldn't find the renamed/consolidated artifact. No action needed, listed here per the process so nothing looks silently skipped.

• 001-oas-endpoint-documentation T003/T005/T006/T007 — contracts consolidated into internal/contracts/types.go (not 4 separate files).
• 001-update-version-display T013 — version-field test lives in internal/httpapi/contracts_test.go:625.
• 005-rest-management-integration T013/T014/T015/T037 — all live in internal/management/service.go, not a separate service_impl.go.
• 009-proactive-oauth-refresh T005 — fields live in internal/contracts/types.go:52-53.
• 011-resource-auto-detect T039 — test is internal/server/e2e_oauth_resource_injection_test.go.
• 012-docusaurus-docs-site T021 — file renamed .md→.mdx, content intact.
• 012-docusaurus-docs-site T067 (listed twice) — checker false-matched an in-text doc-link example, not a real path.
• 016-activity-log-backend T017/T026 — coverage lives in internal/server/e2e_test.go and internal/httpapi/sse_activity_test.go.
• 022-oauth-redirect-uri-persistence T007 — task's own text says "N/A"; not a missing artifact.
• 026-pii-detection T031 — covered by internal/security/detector_test.go:363.
• 026-pii-detection T049–T053 — implemented in internal/security/paths.go, not a patterns/files.go.
• 026-pii-detection T061/T062/T063 — logic lives in internal/httpapi/activity.go.
• 026-pii-detection T065–T068 — merged into frontend/src/views/Activity.vue rather than separate components.
• 026-pii-detection T069–T079 — real files are cmd/mcpproxy/activity_cmd.go/activity_cmd_test.go (no commands/ subpackage).
• 028-agent-tokens T011 — split across mcp_auth_scope_test.go and scope_reveal_test.go.
• 028-agent-tokens T028 — test is internal/runtime/activity_service_test.go.
• 028-agent-tokens T034 — methods live on the shared client in frontend/src/services/api.ts.
• 028-agent-tokens T036 — dialog behavior inlined in frontend/src/views/AgentTokens.vue.
• 029-mcpproxy-teams T009 — file renamed teams_register.go→serveredition_register.go (Teams→ServerEdition rename, refactor(config): rename Teams→ServerEdition (internal/teams→serveredition, teams→server_edition key + alias) (MCP-1086) #603).
• 040-server-ux T002 — test is internal/httpapi/patch_server_test.go.
• 042-telemetry-tier2 T050 — test is in cmd/mcpproxy/startup_outcome_test.go.
• 042-telemetry-tier2 T051/T052 — CLI consolidated into main.go; recordStartupOutcome lives in startup_outcome.go.
• 042-telemetry-tier2 T061/T062 — tests are internal/telemetry/payload_v2_test.go:155,185.
• 042-telemetry-tier2 T063 — helpers live in internal/telemetry/telemetry.go.
• 042-telemetry-tier2 T070 — rotation logic + test in internal/telemetry/telemetry.go/id_rotation_test.go.
• 042-telemetry-tier2 T078 — test is internal/telemetry/notice_test.go:11.
• 044-diagnostics-taxonomy T070 — standard Codable conformance in native/macos/MCPProxy/MCPProxy/API/Models.swift.
• 044-diagnostics-taxonomy T072 — wired in MCPProxyApp.swift:935-974, not a separate StatusBarController.swift.
• 044-diagnostics-taxonomy T080 — test is cmd/mcpproxy/doctor_fix_cmd_test.go:54.
• 044-diagnostics-taxonomy T095 — file renamed doctor_list_codes.go→doctor_listcodes_cmd.go.
• 044-retention-telemetry-v3 T052 — called from internal/runtime/runtime.go:3180.
• 044-retention-telemetry-v3 T053 — implemented as native/macos/MCPProxy/MCPProxy/Services/AutoStartService.swift.
• 047-cpu-hotpath-fix T029 (×2) — implemented in frontend/src/stores/servers.ts:429-445.
• 058-mcp-2026-upgrade T014 — harness is internal/server/protocol_era_test.go.
• 090-tray-glance-v2 T024 — test is internal/storage/sessions_filter_test.go:97.
• 090-tray-glance-v2 T032 — checker looked for .json; real fixture is .jsonl (matches the task text itself).
• 102-schema-deferred T021 — test is internal/server/mcp_direct_catalog_publish_test.go:65.

Method

For every candidate: read the exact task text at its cited line in tasks.md, located the code that would produce the promised behavior (not just a keyword match), confirmed it's real/wired/tested (not a stub, comment, skipped test, or unwired component), then ran a one-sentence adversarial counter-argument before accepting a TICK or UNTICK-CANDIDATE verdict. Work was parallelized across six independent verification passes (five over the 174 possibly_built tick candidates, one over the 68 UNRESOLVED/REMOVED un-tick candidates); this body consolidates all six.

---

Generated by Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

📦 Build Artifacts

Workflow Run: View Run
Branch: claude/spec-gardener

Available Artifacts

• archive-darwin-amd64 (30 MB)
• archive-darwin-arm64 (27 MB)
• archive-linux-amd64 (18 MB)
• archive-linux-arm64 (16 MB)
• archive-windows-amd64 (29 MB)
• archive-windows-arm64 (26 MB)
• frontend-dist-pr (0 MB)
• installer-dmg-darwin-amd64 (24 MB)
• installer-dmg-darwin-arm64 (21 MB)
• smart-mcp-proxymcpproxy-goE70YO3.dockerbuild (0 MB)

How to Download

Option 1: GitHub Web UI (easiest)

1. Go to the workflow run page linked above
2. Scroll to the bottom "Artifacts" section
3. Click on the artifact you want to download

Option 2: GitHub CLI

gh run download 34809637677 --repo smart-mcp-proxy/mcpproxy-go

Note: Artifacts expire in 14 days.