Issue #130 — live MCP clients

Executed 2026-08-02 JST against the public two-instance MCP endpoint. The machine-readable summary is live-client-matrix.json, the sanitized state log is client-state-transcripts.jsonl, and raw Git-external artifacts are bound by SHA-256 in raw-artifact-manifest.json.

Server identity

• LXC repository HEAD: b44e26afdb8f5194da2b4d71b571b67d006da0fa
• Both MCP replicas used image digest sha256:ab811fea61d917472367ccf6edcf7f1b9b0db87af063c009a9609c925fa1f6cf.
• MCP initialize reported server version 1.26.0; the OCI image version label was 0.1.0. The OCI revision label was absent and is recorded as unknown, rather than inferred from the checkout.

Real-client evidence

• Codex CLI 0.146.0: native remote Streamable HTTP enumerated 26 tools, one concrete resource, and nine resource templates; read openface://api/openapi; passed a bounded search_catalog read; rejected a random invalid credential during startup; and returned the expected missing-catalog:read denial for a repository-only credential. Raw JSONL remains outside Git.
• Claude Desktop 1.19367.0.0: the packaged Windows application launched the installed stdio adapter. A repository-only credential initialized and listed tools, prompts, and resources; a random invalid credential failed initialize with MCP error -32001; and the valid credential was restored and rechecked. No Claude prompt was sent. A representative native read remains pending separate user permission, while the same client identity passed the secret-safe protocol read.
• VS Code 1.129.1: the native MCP manager reported Running and Discovered 17 tools. Browse Resources listed the OpenFace resource templates and opened openface://api/openapi in a read-only editor, without an AI prompt. The existing QA window was then reloaded with a repository-only credential and discovered 26 tools without sending a prompt. A random invalid credential was rejected during initialize with MCP error -32001 / HTTP 401.

Authentication and instance evidence

At the protocol layer, three independent client identities each exercised all five states. Valid credentials initialized and read successfully. Expired, revoked, and random invalid credentials returned 401. A repository-only credential initialized but its catalog read was denied for missing catalog:read. No credential value was printed or serialized. These protocol results complement native-client evidence; they do not replace missing native coverage.

The follow-up capture at 2026-08-02T18:23:25+09:00 used the repository's CLI-only run_live_client_protocol.py runner for all three identities; no Claude Desktop or other desktop UI was used. Every successful state recorded notifications/initialized HTTP 202 with an empty body before Tools, Resources, and the representative read. The expired, revoked, and invalid states were rejected at initialize with HTTP 401. The sanitized follow-up summary is hash-bound as cli-protocol-follow-up in the artifact manifest and stored outside Git.

The same protocol-client configuration, identified by SHA-256 d365d8681228785514a74882446cee22ef28c78f1844224df89196eb63f76653, was used while openface-openface-mcp-1 (f14ef08fec1e) was the sole backend and again while openface-openface-mcp-2 (323690d04363) was the sole backend. In each phase the peer was stopped, four seconds were allowed for gateway resolution, and initialize, Tools, Resources, and the representative read all returned only the named replica. No client reconfiguration, MCP session header, or sticky cookie was used. The two sanitized captures are hash-bound as ha-replica-1-only and ha-replica-2-only.

The follow-up isolation capture at 2026-08-02T18:45:02+09:00 repeated both sole-backend phases with the CLI runner's completed handshake. Replica 1 returned instance f14ef08fec1e, and replica 2 returned 323690d04363; each recorded notifications/initialized HTTP 202 with an empty body before the Tools, Resources, and representative read checks. Each stopped peer was restored and both final health checks passed. The updated captures remain hash-bound under the same artifact IDs.

The workers were recreated once before isolation solely to load the newly issued short-lived registry credential. After capture both final workers were healthy, used the same image digest, and could read the registry at mode/owner/ group 0640 root:10001.

Evidence boundary

This directory contains sanitized results only. Token files, raw client logs, Claude configuration, VS Code user configuration, and screenshots remain outside Git. Thirteen stable raw snapshots were scanned against all 22 unique known QA credentials and then recorded only by byte count and SHA-256. Automated tests validate the provisioner, execute the runner against a behavioral HTTP fixture, and validate the evidence schemas; they do not claim desktop UI coverage.

After capture, all thirteen credentials issued during the follow-up runs were revoked and the registry reported zero active follow-up credentials. Claude's configuration and original token file were restored byte-for-byte, and the temporary VS Code server entry was removed. The original VS Code server configuration and token file were restored after the state-switch checks. The Codex enumeration used ephemeral command-line configuration overrides and did not rewrite the user's Codex configuration. No Claude prompt was sent; its representative native read remains pending.