Summary

• hardens GBrain multi-agent MCP access with fine-grained token scopes and named Ryde token presets
• logs real MCP tool/operation names and adds request-log indexes / pg_partman partitioning guardrails
• replaces legacy auto-RLS posture with explicit service-role-only docs, doctor checks, and rollback/runbook notes

Test Plan

• git diff --check
• bun run typecheck
• bun run build:schema
• bun test test/oauth.test.ts test/scoped-tokens.test.ts test/migrate.test.ts test/rls-posture-migration.test.ts test/http-transport.test.ts test/token-last-used.test.ts test/doctor.test.ts — 197 pass
• multi-client MCP stdio smoke using MCP SDK Client with client names hermes, claude, codex: all list 43 tools and call list_pages

Migration / verification status

• Local PGLite/unit migration path passes through v39.
• No live production Postgres migration was applied by this PR hygiene pass.
• Phase 4 SQL verification to run after staging/prod migration:
  • SELECT token_name, scopes FROM access_tokens ORDER BY token_name;
  • SELECT operation, COUNT(*) FROM mcp_request_log GROUP BY operation ORDER BY 2 DESC;
  • SELECT COUNT(*) AS generic_mcp_request_rows FROM mcp_request_log WHERE operation = 'mcp_request';
  • SELECT indexname, indexdef FROM pg_indexes WHERE tablename = 'mcp_request_log' ORDER BY indexname;
  • EXPLAIN SELECT * FROM mcp_request_log WHERE token_name = 'agent-cto-ryde' ORDER BY created_at DESC LIMIT 50;
  • SELECT * FROM partman.part_config WHERE parent_table LIKE '%mcp_request_log%';
  • SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename;
  • SELECT schemaname, tablename, policyname FROM pg_policies WHERE schemaname = 'public' ORDER BY tablename, policyname;

Rollback

• Request-log partition rollback is documented in docs/ops/mcp-request-log-partitioning-2026-05-06.md: rename partitioned table aside, restore mcp_request_log_legacy, recreate lookup indexes, then remove the pg_partman config only after continuity is verified.
• RLS posture rollback is code-level: revert v39/doctor posture changes before deployment; do not re-enable zero-policy RLS trapdoors manually.

Kanban: t_a14a0ff5 / Phase 4E.

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews