[dezren39]

Root cause

Semantic merge conflict between PR #2673 and PR #2619 (merged 12 minutes apart, 2026-10-30):

• PR docs(mcpx): split authorization conformance rows along accepts/refuses (#1972 step 1) #2673 added authsplit.json and made LoadAuthSplit require a verdict for every bound authorization row-side, refusing a side whose catalogue applicability carries the n/a: prefix ("does not bind mcpx").
• PR docs(mcpx): conformance matrix expresses the #1950 OAuth decision per row #2619 then honoured each authorization row's own not-implemented-by-choice note (the mcpx: OAuth authorization for remote servers and for /mcp (61 conformance rows) #1950 decision), which re-derived most authorization sides as n/a: optional feature mcpx does not implement — including every validation side.

authsplit.json was never reconciled, so 74 of its 82 entries (61 permissive + 13 validation, measured at current main) judged sides the catalogue had judged n/a, and TestMatrix/TestAuthSplit have failed on main since.

Fix (per the correction recorded on #2695, 2026-10-30)

The catalogue is right and the split was stale — reverting #2619's applicability would re-open the #1950 decision (client OAuth deferred; /mcp resource server planned at #1975) and make mcpx claim authorization obligations it has not accepted. So:

• authsplit.json: removed all 74 verdicts on catalogue-n/a sides; the split now judges only the 8 bound sides (7 rows, all permissive). The about text records why. LoadAuthSplit's "does not bind mcpx" guard is unchanged, so the two sources cannot drift apart again silently.
• authsplit_test.go: pinned counts re-derived 61/82/69/13 → 7 rows / 8 sides / 8 permissive / 0 validation (per-check counts all 0), with a comment recording that mcpx: the permissive auth interface authorizes everyone — real validation for the conformance rows that require refusal #1972's validation target now lives with the mcpx: optional bearer token for /v1 and /mcp #1975 work.
• conformance-matrix.md: regenerated (MCPX_UPDATE_MATRIX=1); a second regeneration is a no-op.

Verification (laptop, worktree at origin/main 7d3dbd0 + this change)

• go test ./internal/conformance/ -run TestMatrix -count=1 — PASS (was FAIL on clean main)
• go test ./internal/conformance/ -run TestAuthSplit -count=1 — PASS
• Matrix regeneration completes; second run produces no diff (stable golden)
• Full go test ./internal/conformance/: TestMessagesClient and TestUtilitiesServer fail identically on clean main — pre-existing, unrelated to this change (the mcpx: internal/settings (scriptenv) and internal/conformance (TestAuthSplit, TestMatrix) failing on clean main #2716 roll-up area), not addressed here

Fixes #2695. Queue task 8650 (lane code-p).

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 41 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9729f8aa-980f-43aa-ab71-fe89851fbb2a

Commits

Reviewing files that changed from the base of the PR and between d94b895 and 06fd6f2.

Files selected for processing: 3

• pkgs/mcpx/docs/spec/conformance-matrix.md
• pkgs/mcpx/internal/conformance/authsplit.json
• pkgs/mcpx/internal/conformance/authsplit_test.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T20:53:33.285769Z	06fd6f2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[dezren39]

agent-note:v1
state: awaiting CI
task 8650 (lane code-p): Codex review on head 06fd6f2 completed with NO findings. Basic checks (mcpx fix carries a test; production line limit) still pending in the runner queue after the 5-minute poll window, so the queue task is parked 20 minutes rather than holding the claim. Resume: checks green → merge (targeted tests already verified on the laptop: TestMatrix + TestAuthSplit pass, matrix regen stable; the two full-package failures are pre-existing on clean main).