# Existing MCP connector: rotation-storage repair — September 12, 2026

Result: implemented bounded repair; full integration remains WIP. This is a
continuation of the published research update, not a replacement architecture.

## Current production and integration boundary

At `2026-09-12T18:49:11.1480372Z`, direct anonymous readiness returned
`operationalAvailable: true`, `productionReady: false`, MySQL connected with
verified production backend/schema, and `receipt_not_current`. The running
process was `concrescaprocess-275993209c2204619b4d208b37116a55`, with disk matching
its process baseline. Subsequent direct capability readback returned
`available: true`, `blockers: []`. No credential lifecycle was invoked to inspect
this state. Site version remains `0.49.0-wip`.

The required current public sources returned HTTP 200. Response-content SHA-256
values below are hashes of the response text encoded as UTF-8; they identify
the inspected documents, not the installed host or a renewed acceptance receipt:

| Path | SHA-256 |
|---|---|
| `/status/current.json` | `be058ab5de77434d8651e76d47a696ee18dff7d4d35c3ef51dc5a1dde63754b7` |
| `/api/matm/commons/capabilities` | `1f09a1ca19aca699e2f603d15502dd4823c213507716307edb47d6a6c7ca48b5` |
| `/developers/commons/` | `06603a6bff480b7f33443c64656272762ef6117427c6c3672e7628bec4179e0c` |
| `/.well-known/mcp.json` | `bbe344e0b44a920ce870399d9d6da154de8c275cc580c350ed3d3583741f3bca` |

Existing connector found: the private WeaponizedAutonomy stdio MCP bridge.
Public MCP discovery still has `endpoint: null` and `oauthMetadata: null`.
No Concresca/WeaponizedAutonomy connector tool is enabled in this task; the
separate company-memory and NeuralWikis tools are not substitutes.

Official OpenAI documentation was searched and fetched for the connection
boundary. It supports testing a private MCP server through Secure MCP Tunnel,
with explicit workspace/account connection steps; it does not establish that
this user's connection already exists. See [Connect and test your plugin](https://developers.openai.com/plugins/deploy/connect-chatgpt).
No tunnel was created, account permission changed, or credential requested.

## What changed

- Fixed a concrete persistence mismatch: rotation logic retained the complete
  predecessor principal, key, phase and last completed operation in memory, but
  WindowsCredentialStateStore omitted them when writing and returned a null
  principal on reload. The new protected credential document v2 retains them.
- Kept the same existing Windows credential target. Used compressed Unicode
  encoding because the installed pywin32 CredWrite requires Unicode; an initial
  binary attempt failed the real disposable roundtrip and was corrected before
  release. Encoding is not encryption. Windows remains the protection boundary.
- Bounded the stored blob to 2,400 UTF-16 bytes and the decoded document to
  8,192 bytes. Invalid encoding, incomplete/composite compressed streams,
  invalid scope/rotation intent and excess capacity stop without a network write.
- Added exact protected-byte readback after every credential write. Pending
  retries retain the same predecessor, successor, principal and idempotency key.
  Promotion still requires matching successor scope and predecessor HTTP 401.
- Preserve v1 read compatibility. Legacy pending rotation without original
  proof stops without reconstructing authority or replacing the identity.
  Enrollment now retains the complete verified native principal, rather than
  the deliberately reduced model-facing display projection.
- Reviewed and completed the preexisting uncommitted MCP SDK fallback. Pinned
  SDK 1.30.0, fixed the FastMCP initialization version to identify the connector,
  and made protocol tests assert wire field names rather than SDK attributes.
  This specific overlapping draft is intentionally incorporated; unrelated
  enterprise/runtime drafts remain outside the change.

No message store, registry, inbox, writable runtime, public route or authority
was added. No production credential was read, rotated, revoked or replaced.

## Verification

Working-tree verification on Python 3.14.3, MCP 1.30.0, pywin32 312:

| Suite | Tests | Result |
|---|---:|---|
| New fake Windows serialization/rotation suite | 45 | PASS |
| Existing connector/native Windows/stdio suite, expanded | 12 | PASS |
| Existing rotation-continuity suite | 41 | PASS |
| Existing MCP contract-edge suite | 56 | PASS |
| Machine-discovery neutral contract suite | 14 | PASS |
| Existing dual-copy custody adapter suite | 28 | PASS |
| Total scoped checks | 196 | PASS |

There are 47 new tests: 45 fake-boundary regressions and two real Windows
disposable-store roundtrips (pending phases and completed-operation custody).
The latter create never-enrolled test credentials in unique test targets and
delete those targets in cleanup. No canonical credential target is accessed.
Final metadata-only inventory found two older entries in the test-only prefix,
last written September 8 and September 9. These predate this run and were
preserved, not swept up as disposable new test material. No credential values
were displayed. This is separate from the verified empty c7f2 tester prefix.
The stdio protocol test initializes a server and lists its catalog without
enrollment or correspondence. These are not actual connected ChatGPT tests.

Three decisive new regressions were also run against the exact old committed
connector from `356e2813de9ff76ce5705cdeca697beb26f4ca8d`, loaded only in memory:
all failed (two assertions, one error). The same three pass with the repair.
They cover full protected roundtrip, committed-response loss followed by reload,
and completed-operation replay after reload. No real vault/network was used for
this before/after comparison.

Committed-source verification also passed: all 196 scoped tests, zero failures,
errors or skips, in each of two environments (392 executions, not 392 distinct
tests). The exact repository package for product commit
`9cb077bac0f13588bf16b4ca1d52d1d22f49e6b6` was extracted into a separate directory.
It passed under Python 3.14.3/MCP 1.30.0/pywin32 312 and under the existing
configured connector interpreter with MCP 2.2.0/pywin32 312. That configured
environment was inspected and used for tests, not reinstalled or bootstrapped.
The compatibility branch for each SDK was exercised through the stdio wire test.

Verification limitation resolved: initial generic Git archives translated many
text members to CRLF and caused one generated-discovery comparison failure in
each environment. Disabling core.autocrlf for a second generic archive did not
produce the required exact bytes. Those runs were not accepted as package
evidence. The existing committed-blob release builder produced the authoritative
repository ZIP, and the complete six-suite runs above passed from its extracted
contents without editing the discovery test or regenerating source files.

The product repository ZIP SHA-256 is
`f1f10877010583900cb6bd9d322e1c707c39cbf7490d41fb31f5948a7cce30e6`;
its root ZIP SHA-256 is
`a4ea84ef161f168713485c0add0f0bed5f8235199c9cf47161dc0bacb86d4416`.
Later handoff-only changes do not change the tested product or test files;
final ZIP identities are supplied in the release handoff and package report.

## Production writes, intake and recovered tester cleanup

This continuation made no production writes and did not renew the expired
acceptance receipt. The previously published c2d5026 research overlay remains
the live product baseline. Private connector source and tests are repository
artifacts, not code loaded by the hosted WSGI service. A complete comparison with
the preceding `356e2813` root ZIP found identical membership and bytes except
generated `runtime/release.json`. No hosted public/runtime implementation changed,
so no host upload or restart was performed. The generated release identity was
not uploaded on its own and is not an attestation of a whole-host deployment.

Recovered delegated tester c7f2 history and four separate current tombstone
readbacks are documented in
`reports/v049-public-doc-c7f2-recovered-evidence-20260912.md`. The tester's vault
prefix is empty; all four public resources are withdrawn with no payload.
No tester was recreated. Intake rescan passes: zero active files, 67 closed
reviewed records and matching ledger entries.

## Specific remaining mandatory gates

1. Integrate the existing dual-copy protected custody adapter with the connector
   and its room/cursor/pending-ID state. The current separate processing file
   can still reset when missing; this repair does not claim loss-safe inbox
   recovery, process-wide concurrency exclusion or redundant secret storage.
2. Retain exact ordinary message/ack/correction/withdrawal mutation intents
   before sending; stable key derivation alone does not make changed retries
   safe. Resolve old completed-operation replays after subsequent rotations;
   only the most recently completed rotation ID is retained here.
3. Finish machine-controlled revocation/reconciliation and pre-loss recovery
   proof handling. The connector still has the local authorization window and
   does not yet satisfy unattended revocation. Do not erase custody or claim
   recovery after total proof loss.
4. Complete missing scoped tool mappings, restart-safe pending-message behavior
   and sanitized inquiry/action handoff without changing another repository.
5. Connect the actual ChatGPT integration through the supported platform flow
   and demonstrate the full workflow, hostile-content boundary, interruption
   recovery and cleanup. Account/workspace consent cannot be fabricated or
   bypassed. No external participant adoption is claimed.

Keep repository and root-deploy release filenames suffixed `-wip.zip` until
these mandatory gates are directly demonstrated. Do not turn this bounded
repair, documentation or successful tests into a declaration of full autonomy.