[purpshell]

Prepare opaque team-key/project-token credentials through the public SDK, with no second CLI parser or fixed total-length check. Help and README require opaque handling and storage for at least 512 characters. Test keys remain ordinary project tokens; the CLI adds no Reveal or staff operation.

Current CLI head: 5cfb09813eb90bb8211a773237b68f7a5b99a2a2, normally merged with main 301bd6a. API source: polymorfa#647 at f4a82c014e8ea8deb476fce4d81bf27591981c63. The complete test/fixtures/machine-credentials-v1.json is a byte-for-byte copy of that source, SHA-256 7694d8eb61dca6aed69f41392d2e5fae585084e330b276ee6a71844ef9e2365d. Tests send the opaque fixtures through the SDK validators and reject checksum corruption. The source and copied vectors will be rechecked when #647 incorporates #782.

The SDKs thread owns sdks#355, sequenced after #348. Merge order is#647 → SDK #355 → CLI #86 after the SDK publication gate.

External SDK gate

The committed exact registry dependency remains 0.1.0-dev.20261004024706. It rejects the canonical opaque key vectors with Organization server API keys must use the canonical pmfa_ v1 format. This caused hosted Verify Node 22 failure 39312792792. A clean registry install reproduces the failure:518 failed / 536 passed tests across 111 files before the MCP security fix. The required SDK carrying #355 is not published. There is no github pin, candidate tarball override, skipped assertion or permissive fallback. Natural CI on the current head is expected to remain blocked on that dependency.

Before merge, pin the accepted published 0.1.0-dev.* SDK and registry lockfile integrity, then qualify that exact head. No package publication is performed here. Earlier local-candidate results (1,052 passed) are historical and do not establish registry acceptance.

Independent repair and verification

Production audit also exposed a high advisory in @modelcontextprotocol/server@2.0.0. The exact pin and lockfile now use 2.3.1. Production audit reports 0 vulnerabilities. Formatting, ESLint, TypeScript, build, package dry-run and 3 release-evidence tests pass. The complete test rerun on 5cfb09813eb90bb8211a773237b68f7a5b99a2a2 reports 536 passed / 518 failed across 111 files (82.48s), reproducing the published SDK gate. Natural hosted CI39563071257 is in progress on that exact head. This is blocked, not green.

Part	Assessment
API	Coordinated final credential contract from #647; no CLI endpoint change.
SDKs	Blocked on the SDKs thread's accepted published artifact carrying #355. No SDK branch push from this thread.
CLI	Updated credential fixtures/help and published-SDK validation tests; main merged and MCP security dependency repaired.
Docs	README and opaque-credentials-cutover record updated; public docs are coordinated in #647.
Feature releases	Source preparation only. Existing registry integrity and matching environment acceptance gates remain enforced. No new flag or availability claim.
Admin	Unaffected by CLI validation: no staff read/write/reveal is added. #647 owns the Test-key metadata capability.

Listener/media tickets retain their purpose-specific formats. Deployment, SDK publication and CLI publication remain separate gates.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}