Summary

Fixes the MCP HTTP quickstart so it exercises the real MCP path, modernizes the MCP tool-call example to the current _meta evidence carrier with explicit tamper-detection checks, and updates plugin-pack pins to the published 0.15.0 server. Examples and configuration pins only; no package source, wire format, schema, or runtime behavior changes.

Scope

• examples/mcp-http-quickstart/quickstart.ts
• examples/mcp-tool-call/demo.ts, examples/mcp-tool-call/README.md, examples/mcp-tool-call/package.json
• surfaces/plugin-pack/{claude-code/.mcp.json, cursor/mcp.json, codex/codex-config.pinned.json, vscode/mcp.json}

Explicitly not changed: any published package source, tool schemas, the carrier format, transports.

Changes

• HTTP quickstart: calls peac_verify with the correct jws input field (was receipt) plus the public key (offline verification) and an issuer expectation (issuer binding), captures the Mcp-Session-Id header from initialize and reuses it on subsequent requests, sends the current 2025-11-25 protocol version with an Accept header covering JSON and SSE responses, sends notifications/initialized as a proper JSON-RPC notification (no id) via a dedicated helper that drains the response body, applies a 10s request timeout to all fetch calls, and labels local verification explicitly as a fallback when the MCP path did not verify (no more silent fallback).
• MCP tool-call example: replaces the legacy top-level peac_receipt helper with the current carrier (computeReceiptRef + attachReceiptToMeta + extractReceiptFromMetaAsync, top-level _meta keys), and adds two tamper checks: a modified receipt_jws is rejected by the receipt_ref consistency check, and a modified payload fails Ed25519 verification with E_INVALID_SIGNATURE. The type_unregistered warning for integrator-defined type URI values remains documented and asserted.
• Plugin-pack pins: @peac/[email protected] -> @peac/[email protected] across the four client configs.
• Example package description updated to match the current example scope.

Validation

• @peac/mappings-mcp tests: 81 passed. @peac/mcp-server tests: 289 passed.
• examples/mcp-tool-call: tsc --noEmit clean; pnpm demo runs end-to-end with both tamper checks failing as expected.
• examples/mcp-http-quickstart: verified against a locally started --transport http server (session header honored, peac_verify returns PASSED through the MCP path) and against an unreachable server (fallback clearly labeled, exit reflects state).
• Prettier and whitespace checks pass on all touched files.