chore(harness): make repository agent-ready

Add concise routed context, task-aware agent roles, focused skills, and structured learning promotion.\n\nUnify local development and workspace tooling, add layered test and E2E verification, harden MCP authentication, and gate deployment behind verification and explicit production promotion.

apps/mcp/src/lib/auth.test.ts

@@ -0,0 +1,32 @@
+import { Hono } from 'hono';
+import { afterEach, describe, expect, it } from 'vitest';
+import { authMiddleware } from './auth.js';
+
+function app() {
+  const instance = new Hono();
+  instance.use('/mcp', authMiddleware);
+  instance.get('/mcp', (c) => c.json({ ok: true }));
+  return instance;
+}
+
+afterEach(() => {
+  delete process.env.SAUCI_MCP_API_KEY;
+});
+
+describe('MCP authentication', () => {
+  it('fails closed when the server key is missing', async () => {
+    const response = await app().request('/mcp');
+    expect(response.status).toBe(503);
+  });
+
+  it('requires and validates a bearer token', async () => {
+    process.env.SAUCI_MCP_API_KEY = 'local-test-key';
+    expect((await app().request('/mcp')).status).toBe(401);
+    expect((await app().request('/mcp', {
+      headers: { Authorization: 'Bearer wrong' },
+    })).status).toBe(401);
+    expect((await app().request('/mcp', {
+      headers: { Authorization: 'Bearer local-test-key' },
+    })).status).toBe(200);
+  });
+});

apps/mcp/src/lib/auth.ts

@@ -1,24 +1,20 @@
 import { Context, Next } from 'hono';
 
 export const authMiddleware = async (c: Context, next: Next) => {
-  const authHeader = c.req.header('Authorization');
   const apiKey = process.env.SAUCI_MCP_API_KEY;
 
   if (!apiKey) {
-    // If no API key is set in env, allow access (warn in logs)
-    // Ideally this should default to deny, but for dev ease we might want to warn
-    console.warn('SAUCI_MCP_API_KEY not set in environment - allowing all requests');
-    return next();
+    console.error('SAUCI_MCP_API_KEY is not configured; refusing MCP access');
+    return c.json({ error: 'Service authentication is not configured' }, 503);
   }
 
-  let token = c.req.header('Authorization')?.replace('Bearer ', '');
-  
-  if (!token) {
-    token = c.req.query('apiKey');
-  }
+  const authHeader = c.req.header('Authorization');
+  const token = authHeader?.startsWith('Bearer ')
+    ? authHeader.slice('Bearer '.length)
+    : undefined;
 
   if (!token) {
-    return c.json({ error: 'Unauthorized: Missing or invalid Authorization header or apiKey query param' }, 401);
+    return c.json({ error: 'Unauthorized: Bearer token required' }, 401);
   }
 
   if (token !== apiKey) {