Gate source-file downloads and verify registry paths and content hashes. Stream multipart uploads with bounded limits, supervise OpenCode jobs with explicit result markers and timeouts, and preserve managed endpoint security settings. Document the trusted-client boundary and add focused regression coverage.
Validation: PYTHONPATH=<staged-tree> python -m unittest discover -s tests (182 tests)
Use the Python module entrypoint in the user service, prepare the MCP optional runtime before restart, and serve the configured vault path instead of the repo root.
Verify binary asset resources use an octet-stream MIME type and cover service vault resolution in tests.
Add Streamable HTTP transport for the source-file MCP server with bearer-token auth, configurable HTTP runtime options, and user-level systemd service helpers.
Document remote client setup and cover auth/service behavior with unit tests.
Track the source-of-truth code, skills, bootstrap rules, docs, and packaging files before adding new features.
Exclude local vault config, generated skill mirrors, temporary exports, virtual environments, and business data files from version control.
Validation: inspected staged file list and git ignored status before commit.
Codex