chore(harness): make repository agent-ready

Add concise routed context, task-aware agent roles, focused skills, and structured learning promotion.\n\nUnify local development and workspace tooling, add layered test and E2E verification, harden MCP authentication, and gate deployment behind verification and explicit production promotion.

apps/mcp/AGENTS.md

@@ -0,0 +1,11 @@
+# Internal MCP service
+
+Hono service exposing privileged administrative tools.
+
+- Treat the service-role key and `SAUCI_MCP_API_KEY` as secrets.
+- Fail closed when MCP authentication is missing outside explicit local mode.
+- Every mutation validates inputs, authorizes the operation, and writes audit
+  evidence where the product contract requires it.
+- Read operations preserve least privilege and avoid excessive user data.
+- Add unit/API coverage for tool contract or auth changes.
+- Verify lint, tests, typecheck, build, and `/health` locally.

apps/mcp/package.json

@@ -5,10 +5,13 @@
   "scripts": {
     "dev": "tsx watch src/index.ts",
     "build": "tsup src/index.ts src/bridge.ts --format esm --clean",
+    "lint": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests",
     "start": "node dist/index.mjs",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@hono/node-server": "^1.13.7",
     "@hono/mcp": "^0.1.1",
     "@modelcontextprotocol/sdk": "^1.0.1",
     "@supabase/supabase-js": "^2.45.0",

apps/mcp/src/lib/auth.test.ts

@@ -0,0 +1,32 @@
+import { Hono } from 'hono';
+import { afterEach, describe, expect, it } from 'vitest';
+import { authMiddleware } from './auth.js';
+
+function app() {
+  const instance = new Hono();
+  instance.use('/mcp', authMiddleware);
+  instance.get('/mcp', (c) => c.json({ ok: true }));
+  return instance;
+}
+
+afterEach(() => {
+  delete process.env.SAUCI_MCP_API_KEY;
+});
+
+describe('MCP authentication', () => {
+  it('fails closed when the server key is missing', async () => {
+    const response = await app().request('/mcp');
+    expect(response.status).toBe(503);
+  });
+
+  it('requires and validates a bearer token', async () => {
+    process.env.SAUCI_MCP_API_KEY = 'local-test-key';
+    expect((await app().request('/mcp')).status).toBe(401);
+    expect((await app().request('/mcp', {
+      headers: { Authorization: 'Bearer wrong' },
+    })).status).toBe(401);
+    expect((await app().request('/mcp', {
+      headers: { Authorization: 'Bearer local-test-key' },
+    })).status).toBe(200);
+  });
+});

apps/mcp/src/lib/auth.ts

@@ -1,24 +1,20 @@
 import { Context, Next } from 'hono';
 
 export const authMiddleware = async (c: Context, next: Next) => {
-  const authHeader = c.req.header('Authorization');
   const apiKey = process.env.SAUCI_MCP_API_KEY;
 
   if (!apiKey) {
-    // If no API key is set in env, allow access (warn in logs)
-    // Ideally this should default to deny, but for dev ease we might want to warn
-    console.warn('SAUCI_MCP_API_KEY not set in environment - allowing all requests');
-    return next();
+    console.error('SAUCI_MCP_API_KEY is not configured; refusing MCP access');
+    return c.json({ error: 'Service authentication is not configured' }, 503);
   }
 
-  let token = c.req.header('Authorization')?.replace('Bearer ', '');
-  
-  if (!token) {
-    token = c.req.query('apiKey');
-  }
+  const authHeader = c.req.header('Authorization');
+  const token = authHeader?.startsWith('Bearer ')
+    ? authHeader.slice('Bearer '.length)
+    : undefined;
 
   if (!token) {
-    return c.json({ error: 'Unauthorized: Missing or invalid Authorization header or apiKey query param' }, 401);
+    return c.json({ error: 'Unauthorized: Bearer token required' }, 401);
   }
 
   if (token !== apiKey) {