[httpsphl]

Second and last slice of M3 (spec 17): bots message each other and hand off tasks through MCP tools. This PR is built on #3. Merge #3 first (merge commit); this diff then shrinks to the five commits below.

With this PR, M3's acceptance test passes with real Claude Code: two bots exchange a task and its result without anyone stepping in.

What changes

• POST /mcp gives each bot four tools: crew_roster, send_message, complete_task and my_tasks. It is authenticated with the bot token of a live generation.
• Both MCP eras are supported. Claude Code 2.1.284 first sends server/discover (MCP 2026-07-28, no handshake). If that fails, it falls back to initialize (2025-11-25). The server answers both:
  • 2026-07-28 side: header/body checks (-32020), unsupported versions (-32022), 404 for unknown methods, and the caching hints (ttlMs, cacheScope). Without those hints, Claude Code rejects the tool list.
  • initialize side: version negotiation, notifications get 202, and GET/DELETE get 405.
• Tasks (spec 9.4):
  • Chains: a task continues the chain the sender is working on (its open task with the most hops), and is refused past max_hops with an explanation.
  • Deadlines: from 1 minute to a week.
  • Completion: only the assignee can complete a task, even after the deadline. The result goes back to the requester as a message, in the same transaction.
  • Expiry: the courier expires overdue tasks and tells the requester.
• Errors the model can fix (unknown handle, bad argument, hop limit, someone else's task) come back as isError results with a sentence it can act on.
• Crew boundaries: a bot cannot reach bots or tasks of another crew.
• Generated settings allow mcp__botloft, so a bot on its own is never stuck at a permission prompt. The trust dialog shows this rule. The bot rules now ask bots to close every task with complete_task.
• tasks.list is available to the app.
• Debug log has one line per MCP request, with the method name only, never arguments.

Tests

• tests/mcp.rs:
  • discovery, caching hints and the tool list;
  • the initialize path;
  • 401, 403 and 405 responses;
  • version and header mismatches, including the base64 Mcp-Name form;
  • unknown methods and tools;
  • token revoked after a restart.
• tests/tasks.rs, bot to bot through the tools with FakeRuntime and FakeInbox:
  • exact envelopes both ways;
  • my_tasks;
  • the hop limit, with origin and hops checked;
  • an overdue task expiring, then completed late;
  • tool errors;
  • crew isolation.
• Store: listing, overdue tasks, and settling together with the report.
• Every commit builds and passes clippy and fmt on its own. Full suite: 137 tests, plus pnpm check.

Real Claude Code checks (done, 2.1.284)

1. MCP handshake, without spending tokens. claude -p --mcp-config ... --model <unknown> connects its MCP servers before failing on the model. A logging server showed server/discover with the 2026-07-28 headers, then initialize with 2025-11-25, and the Authorization header with ${VAR} expanded.
2. Tool list accepted. In a running bot, /mcp first showed "botloft · tools fetch failed". The cause was the missing caching hints. After the fix it shows "botloft · 4 tools", with a single tools/list per bot.
3. Acceptance test (dev daemon, bots @probe and @helper in one crew, folders trusted):
   • The owner asked @probe via messages.send to send @helper a task: the sum of 17 and 25.
   • @probe called send_message.
   • @helper got [botloft] from @probe · crew Real Test · task tsk_... · due in 2 h and called complete_task with "17 + 25 = 42".
   • @probe got the result and answered RESULTADO 42.
   • The task shows done with hops: 1, and all 5 deliveries are sent with 0 failed attempts. The daemon log has no message bodies or tokens.

Notes

• Bot environments load the owner's user-level Claude Code settings, including user hooks and claude.ai connectors. The bots here also saw the owner's connectors. This behavior was not changed in this PR; it may deserve a decision before M5.