Best possible solution:

Keep the server-derived viewId authority model, but establish whether any released or independently updated client can send the retired descriptor before accepting the incompatible protocol removal; preserve or version the old request contract if that upgrade path exists.

Do we have a high-confidence way to reproduce the issue?

No high-confidence current-main reproduction is available from the supplied material. The PR describes a stale or client-forged authority boundary, but does not provide a runnable before-fix exploit sequence against the current base.

Is this the best way to solve the issue?

Unclear but directionally strong: resolving authority from the authenticated live view and rechecking it at each interactive operation is the narrowest safe design, provided the removed protocol shape is confirmed unreleased or receives an explicit transition path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a22ede72e494.

Label changes:

• add P2: This is a targeted security/authority hardening follow-up with meaningful but not currently demonstrated user-facing urgency.
• add merge-risk: 🚨 compatibility: The PR removes an exported Gateway protocol descriptor and several fields from the pinning contract, which may affect upgraded clients if the prior shape shipped.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a repository MEMBER, so the external-contributor proof gate does not apply; the PR nevertheless links exact-head Testbox and successful real-behavior-proof evidence.

Label justifications:

• P2: This is a targeted security/authority hardening follow-up with meaningful but not currently demonstrated user-facing urgency.
• merge-risk: 🚨 compatibility: The PR removes an exported Gateway protocol descriptor and several fields from the pinning contract, which may affect upgraded clients if the prior shape shipped.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a repository MEMBER, so the external-contributor proof gate does not apply; the PR nevertheless links exact-head Testbox and successful real-behavior-proof evidence.

PR surface:

Source -6, Tests +37, Other -38. Total -7 across 23 files.

What I checked:

• Authority boundary in the proposed gateway path: The PR resolves the supplied live view in the authenticated board session rather than trusting a client-supplied descriptor, then materializes canonical content for storage. (src/gateway/server-methods/board.ts:145, fcff010a6828)
• Interactive operations are rechecked: The proposed MCP App operation helper makes read-only and missing-tool leases non-interactive and invokes the current authorization callback before model-context updates, tool listing, and tool calls. (src/gateway/mcp-app-operations.ts:67, fcff010a6828)
• Protocol compatibility surface: The patch removes originSessionKey from BoardMcpAppDescriptor, removes BoardMcpAppPinDescriptor, and narrows the mcp-app put payload to viewId; this is an intentional incompatible protocol evolution that needs release-scope confirmation. (packages/gateway-protocol/src/schema/board.ts:120, fcff010a6828)
• Merged feature provenance: The related merged PR introduced durable pinned MCP App widgets at commit 64c82812a5e52f4a03d2b89b8132c068a048a81b; this PR is a narrowly scoped authority follow-up rather than a duplicate implementation. (src/gateway/server-methods/board.ts:145, 64c82812a5e5)
• Available authored proof: The PR body reports an exact-head Blacksmith Testbox focused run covering protocol, store, reconstruction, Gateway/MCP, and UI producer behavior, while GitHub’s supplied check state also includes a successful Real behavior proof check. (fcff010a6828)

Likely related people:

• steipete: Authored the merged durable pinned-MCP-App feature that established the board-widget and lease-reconstruction paths this follow-up hardens. (role: feature introducer; confidence: high; commits: 64c82812a5e5; files: src/gateway/server-methods/board.ts, src/gateway/mcp-app-reconstruction.ts, src/boards/board-store.ts)
• fuller-stack-dev: Authored the superseded backend-focused predecessor and the current authority-hardening follow-up, giving them direct continuity on the protocol/store boundary. (role: adjacent owner; confidence: high; commits: 7ed78c78627c, fcff010a6828; files: packages/gateway-protocol/src/schema/board.ts, src/boards/sqlite-board-store.ts, src/gateway/mcp-app-operations.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.