[02:43:20.981] INFO (#2): Running database migrations
[02:43:21.099] INFO (#2): Migrations ran successfully {
  migrations: [
    '1_OrchestrationEvents',
    '2_OrchestrationCommandReceipts',
    '3_CheckpointDiffBlobs',
    '4_ProviderSessionRuntime',
    '5_Projections',
    '6_ProjectionThreadSessionRuntimeModeColumns',
    '7_ProjectionThreadMessageAttachments',
    '8_ProjectionThreadActivitySequence',
    '9_ProviderSessionRuntimeMode',
    '10_ProjectionThreadsRuntimeMode',
    '11_OrchestrationThreadCreatedRuntimeMode',
    '12_ProjectionThreadsInteractionMode',
    '13_ProjectionThreadProposedPlans',
    '14_ProjectionThreadProposedPlanImplementation',
    '15_ProjectionTurnsSourceProposedPlan',
    '16_CanonicalizeModelSelections',
    '17_ProjectionThreadsArchivedAt',
    '18_ProjectionThreadsArchivedAtIndex',
    '19_ProjectionSnapshotLookupIndexes',
    '20_AuthAccessManagement',
    '21_AuthSessionClientMetadata',
    '22_AuthSessionLastConnectedAt',
    '23_ProjectionThreadShellSummary',
    '24_BackfillProjectionThreadShellSummary',
    '25_CleanupInvalidProjectionPendingApprovals',
    '26_CanonicalizeModelSelectionOptions',
    '27_ProviderSessionRuntimeInstanceId',
    '28_ProjectionThreadSessionInstanceId',
    '29_ProjectionThreadDetailOrderingIndexes',
    '30_ProjectionThreadShellArchiveIndexes',
    '31_AuthAuthorizationScopes',
    '32_AuthPairingProofKeyThumbprint',
    '33_ProjectionThreadsSettled',
    '34_ProjectionThreadsSnoozed',
    '35_ProjectionThreadTitleRegeneration',
    '36_ProjectionThreadsPinned',
    '37_ProjectionTurnsKeysetIndex',
    '38_ProjectionThreadsPinOrderKey',
    '39_ProjectionProjectsDefaultThreadEnvMode',
    '40_ProjectionProjectFaviconPath',
    '41_AuthSessionClientConnection',
    '42_ProjectionThreadLinkedPullRequest',
    '43_ProjectionThreadsUnsettledAt',
    '44_ClearAutomaticProjectModelDefaults',
    '45_ProjectionProjectsAutoPull',
    '46_RepairAutomaticSettlementTimestamps',
    '47_ProjectionProjectIcon',
    '48_ProjectionThreadBranchPullRequest',
    '49_ProjectionThreadsActiveOrderKey',
    '50_ProjectionThreadPullRequests',
    '51_ProjectionThreadMessageContext',
    '52_ProjectionThreadTitleState',
    '53_PullRequestFilesViewed',
    '54_ProjectionThreadsAutoSettleDisabledAt',
    '55_OrchestrationV2',
    '56_RemoveRedundantProjectionIndexes',
    '57_ScheduledTaskWebhooks',
    '58_WebhookRelayDeliveries',
    '59_McpAppModelContext',
    '60_ThreadSnapshotWindowIndexes',
    '61_PullRequestReviewGuides',
    '62_ThreadFailureLookupIndex',
    '63_DropUnusedV1Projections',
    '64_CanonicalizeThreadPullRequestLinks',
    '65_CodexUsageNativeTurnIndex',
    '66_RepairClientSettlementTimestamps',
    '67_WebhookDedupe',
    '68_ShellStopRequestIndex',
    '69_ThreadMessageSearch',
    '70_PeerLinks',
    '71_PeerLinkFence',
    '72_WaitingLinkRequestIndex',
    '73_ActiveTurnItemIndexes',
    '74_ExcludeAttachmentPlaceholdersFromSearch',
    '75_SubagentDeliveryState',
    '76_ProjectionProjectsPinArchive',
    '77_RepairBooleanSettledOverride',
    '78_DropOrchestrationEventCorrelationIndex',
    '79_DelegatedRecoveryIndexes',
    '80_ScheduledTaskThreadMode',
    '81_ProjectionMessageSearchText',
    '82_TurnItemConversationIndex',
    '83_CommandReadIndexes',
    '84_LastExecutedRunIndex',
    '85_TurnItemCounts',
    '86_QueuedTurnInputIndex',
    '87_ProjectionProjectsCustomTitle'
  ]
}
Commit: 6f21b0f02a8e128374e2a44a48f8b45b270be9f7
Runtime: v26.12.1; Effect 4.1.3
Surface: real Node HTTP MCP server, loopback; fresh in-memory SQLite; synthetic sessions.
Credentials and session identifiers omitted.

{
  "caller": "reader",
  "tool": "probe_read",
  "status": 200,
  "wwwAuthenticate": null,
  "body": "{\"jsonrpc\":\"2.0\",\"id\":2,\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"{\\\"ok\\\":true}\"}],\"structuredContent\":{\"ok\":true},\"isError\":false}}\n"
}
{
  "caller": "writer",
  "tool": "probe_write",
  "status": 200,
  "wwwAuthenticate": null,
  "body": "{\"jsonrpc\":\"2.0\",\"id\":2,\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"{\\\"ok\\\":true}\"}],\"structuredContent\":{\"ok\":true},\"isError\":false}}\n"
}
{
  "caller": "reader",
  "tool": "probe_write",
  "status": 200,
  "wwwAuthenticate": null,
  "body": "{\"jsonrpc\":\"2.0\",\"id\":2,\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"{\\\"_tag\\\":\\\"OrchestratorMcpFailure\\\",\\\"code\\\":\\\"capability_denied\\\",\\\"message\\\":\\\"This tool changes the environment, and this MCP client was approved for read-only access.\\\"}\"}],\"isError\":true}}\n"
}
[02:43:21.225] WARN (#447): rejected MCP request with an unusable credential { reason: 'unknown_or_expired_token' }
{
  "caller": "invalid",
  "tool": "probe_read",
  "status": 401,
  "wwwAuthenticate": "Bearer resource_metadata=\"http://127.0.0.1:34643/.well-known/oauth-protected-resource/mcp\", error=\"invalid_token\"",
  "body": "{\"error\":\"invalid_mcp_credential\",\"message\":\"A valid T3 Code MCP credential is required.\"}"
}
Write handler executions: 1 (writer only)
RESULT: defect reproduced — denial lacks HTTP scope challenge; denied write did not execute