chore(specs): gardener checkbox sync

[Dumbris]

Pull Request

Description

Automated spec-gardener run (2026-07-10): 5 checkbox ticks applied, 2 un-ticks proposed for human review. Ran scripts/check-spec-evidence.py across all 57 specs, then adversarially verified every possibly_built (tick candidate) and unresolved/removed (un-tick candidate) finding against the actual code before touching anything. Only - [ ]/- [x] checkbox characters in specs/*/tasks.md were changed — no prose, no ROADMAP.md, no roadmap.yaml.

Testing

• I have tested these changes locally (diff is checkbox-only; verified with git diff that no other content changed)
• I have added/updated tests that prove my fix is effective or my feature works — N/A, this PR only edits spec tracking checkboxes
• All existing tests pass — no code was touched

Applied ticks (5)

Spec / Task	Evidence
006-oauth-extra-params / T041	cmd/mcpproxy/auth_cmd.go:578-584 — runAuthStatusClientMode prints Auth URL: / Token URL: lines
006-oauth-extra-params / T050	internal/transport/http.go:200-203 — logger.Debug("🔧 Using custom HTTP client with OAuth extra params wrapper", ...) when extra-params wrapper is active
007-oauth-e2e-testing / T083	internal/oauth/config.go:956-964 — "OAuth config created successfully" log includes structured fields scopes, redirect_uri, auth_server_metadata_url, registration_mode, discovery_mode, token_store
021-request-id-logging / T021	cmd/mcpproxy/upstream_cmd_test.go:1375 — TestOutputError_WithRequestID (labeled // T021)
021-request-id-logging / T022	cmd/mcpproxy/upstream_cmd_test.go:1454 — TestOutputError_WithoutRequestID (labeled // T022)

Of the 147 possibly_built candidates the checker surfaced, the other 142 were dropped on verification (see below) — most were genuinely unimplemented, not just relocated.

Proposed un-ticks (NOT applied)

Spec / Task	Currently	Evidence for absence
026-pii-detection / T031	[x]	internal/security/detector_integration_test.go does not exist; no deletion in git log --diff-filter=D; no equivalent end-to-end secret-detection integration test exists anywhere under internal/security/ (the file's unit tests in detector_test.go and the scanner e2e tests under internal/security/scanner cover different specs, 076/077, not this one).
044-diagnostics-taxonomy / T080	[x]	Task claims a Cobra test for doctor --server invoking the REST/socket client and validating table/JSON/YAML output. cmd/mcpproxy/doctor_test.go does not exist; doctor_cmd_test.go only has output-formatting unit tests (TestOutputDiagnostics_*); doctor_fix_cmd_test.go only has filtering tests (TestFilterDiagnosticsByServer_KeepsMatchingEntries). No single test (or combination) covers the --server flag plus REST invocation plus all three output formats together.

A human should confirm these two are genuinely missing (vs. covered by a test I didn't find) before un-ticking.

Dropped by verification

142 possibly_built and 61 unresolved/removed findings were investigated and dropped — i.e. the checkbox state was left as-is because either (a) the unchecked task genuinely isn't done despite cited files existing (stub, skipped test, missing wiring), or (b) the checked task's artifact was found alive under a renamed/relocated file and the current checkbox is correct. Representative examples:

• 026-pii-detection (21 of 24 unresolved dropped): sensitive-data-detection functionality is real and tested, just consolidated into different files than the task prose cites — e.g. internal/security/paths.go instead of internal/security/patterns/files.go; internal/httpapi/activity.go instead of activity_handlers.go; frontend/src/views/Activity.vue instead of ActivityLogView.vue; cmd/mcpproxy/activity_cmd.go/activity_cmd_test.go instead of cmd/mcpproxy/commands/activity.go. 3 possibly-built tasks (T104/T108/T109 — E2E tests for custom patterns/SSE/API scenarios) remain genuinely unimplemented.
• 009-proactive-oauth-refresh (26 of 26 dropped): almost all cited UI computed properties (oauthExpired, isAuthenticated, oauthError), badges ("Token Expired", "Auth Error"), and CLI flags/tests for OAuth logout simply don't exist in ServerCard.vue / auth_cmd.go — the task prose describes work that was never done. One (T005) was a false-positive un-tick: the fields exist in internal/contracts/types.go under a different filename than cited.
• 042-telemetry-tier2 (25 of 25 dropped): most cited unit tests (e.g. TestBuiltinToolCounterIncrementsPerCall, TestOAuthRefreshFailureRecordsErrorCategory) were never written, even though the underlying feature code exists; several investigative/"read and note" tasks (T001-T004) have no artifact to verify by nature.
• 004-management-health-refactor, 017-activity-cli-commands, 001-code-execution, 008-oauth-token-refresh (possibly-built, all dropped): consistent pattern of missing E2E/unit test coverage for features whose production code exists — restart flows, doctor E2E, code-execution failure-path tests, and OAuth correlation-ID logging were never actually added despite adjacent files existing.
• 029-mcpproxy-teams / T009 (un-tick candidate, dropped): cmd/mcpproxy/teams_register.go was renamed to serveredition_register.go as part of a repo-wide Teams→Server rename (confirmed via git log); still gated by //go:build server and imports internal/serveredition — correctly still checked.
• 047-cpu-hotpath-fix / T001: cited as a possible tick by the verification agent (pprof endpoint preserved), but this task is a one-time git-workflow instruction ("confirm working tree clean... preserve for PR"), not a durable, greppable artifact — dropped per the "default to dropping when uncertain" rule rather than ticking a process step.

Everything else in the 032, 040, 044-retention-telemetry-v3, 003-tool-annotations-webui, 019-activity-webui, 073-activity-size-retention, 057-in-proxy-profiles, 016-activity-log-backend, 022-oauth-redirect-uri-persistence, 012-docusaurus-docs-site, 010-release-notes-generator, 056-output-schema-validation, 011-resource-auto-detect, 005-rest-management-integration, 077-scanner-simplification, 076-deterministic-tool-scanner, and 044-diagnostics-taxonomy groups followed the same two patterns (genuinely unbuilt, or alive-but-relocated) and were dropped with no checkbox change.

---

Cap: 40 applied ticks per run — this run found only 5 that survived verification, well under the cap.

[cloudflare-workers-and-pages]

Deploying mcpproxy-docs with    Cloudflare Pages

Latest commit:	bbe0b08
Status:	✅  Deploy successful!
Preview URL:	https://32cf01b0.mcpproxy-docs.pages.dev
Branch Preview URL:	https://claude-spec-gardener.mcpproxy-docs.pages.dev

View logs

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

📦 Build Artifacts

Workflow Run: View Run
Branch: claude/spec-gardener

Available Artifacts

• archive-darwin-amd64 (28 MB)
• archive-darwin-arm64 (25 MB)
• archive-linux-amd64 (16 MB)
• archive-linux-arm64 (15 MB)
• archive-windows-amd64 (28 MB)
• archive-windows-arm64 (25 MB)
• frontend-dist-pr (0 MB)
• installer-dmg-darwin-amd64 (22 MB)
• installer-dmg-darwin-arm64 (19 MB)

How to Download

Option 1: GitHub Web UI (easiest)

1. Go to the workflow run page linked above
2. Scroll to the bottom "Artifacts" section
3. Click on the artifact you want to download

Option 2: GitHub CLI

gh run download 29077489930 --repo smart-mcp-proxy/mcpproxy-go

Note: Artifacts expire in 14 days.