test(mcp): assert workflow caveats at their declared locations

Main now retains upstream provider caveats in the workflow Evidence envelope
as well as the established graph result. Assert each exact list instead of
counting text occurrences across two distinct contract locations. Also assert
the actual complete graph edges so a caveat cannot silently truncate traversal.

Verified 22 focused workflow Evidence and MCP boundary tests. Product code and
advertised output are unchanged.

Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>

docs/releasing.md

@@ -84,8 +84,10 @@ registry metadata or changelog disagrees with that version before creating a tag
 
 ### Compatibility and version selection
 
-For the 6.2 candidate, review the [6.1 to 6.2 migration guide](migration-6.2.md)
-alongside the changelog before publication.
+Before publishing a candidate, review its changelog's breaking changes and the
+migration notes for the release being prepared. The
+[6.1 to 6.2 migration guide](migration-6.2.md) records that release's changes;
+it is a historical reference, not the compatibility checklist for later releases.
 
 REA uses Release Please's `always-bump-minor` strategy: every release increments
 minor and resets patch, including releases with breaking changes. For example,

tests/boundary/mcp/browserComparisonInput.test.ts

@@ -110,15 +110,6 @@ describe("browser comparison input boundary", () => {
         },
         { before_scenario: {}, after_scenario: {} },
         { before_scenario: scenario.before_scenario },
-        { ...passive, normalization: { rules: [] } },
-        {
-          before_scenario: scenario.before_scenario,
-          normalization: { rules: [] },
-        },
-        {
-          after_scenario: scenario.after_scenario,
-          normalization: { rules: [] },
-        },
         { ...passive, unexpected: true },
         {
           ...scenario,
@@ -133,8 +124,24 @@ describe("browser comparison input boundary", () => {
           },
         },
       ];
-      // The projection leaves group exclusion to the canonical runtime parser.
-      const mixedGroups = [{ ...passive, ...scenario }];
+      // Strict clients reject combinators and dependentRequired, so the
+      // projection states the groups in its description and leaves group
+      // completeness and exclusion to the canonical runtime parser.
+      expect(advertised.inputSchema.description).toContain(
+        "before + after; before_scenario + after_scenario + [normalization]",
+      );
+      const mixedGroups = [
+        { ...passive, ...scenario },
+        { ...passive, normalization: { rules: [] } },
+        {
+          before_scenario: scenario.before_scenario,
+          normalization: { rules: [] },
+        },
+        {
+          after_scenario: scenario.after_scenario,
+          normalization: { rules: [] },
+        },
+      ];
       for (const { input, advertisedValid, runtimeValid } of [
         ...[passive, scenario, withoutNormalization].map((input) => ({
           input,

tests/boundary/mcp/enhancedTools.callPathsAndBatches.test.ts

@@ -91,7 +91,9 @@ describe("enhanced MCP tools", () => {
       },
     });
   });
+});
 
+describe("enhanced MCP graph caveats", () => {
   it("keeps generic provider caveats visible without truncating complete relationships", async () => {
     const caveat = "Decompiler output may omit indirect calls.";
     const client = await connect({
@@ -113,21 +115,33 @@ describe("enhanced MCP tools", () => {
       arguments: { address: "0x1", direction: "forward" },
     });
     expect(graph.structuredContent).toMatchObject({
+      limitations: [
+        "Artifact identity is unavailable for this observation.",
+        "Derived by an REA composed workflow.",
+        caveat,
+      ],
       normalized_result: {
         graph: {
           "0": [
-            { status: "ok", relationship_coverage: { status: "complete" } },
+            {
+              address: "0x1",
+              calls: ["0x2"],
+              status: "ok",
+              relationship_coverage: { status: "complete" },
+            },
           ],
           "1": [
-            { status: "ok", relationship_coverage: { status: "complete" } },
+            {
+              address: "0x2",
+              calls: [],
+              status: "ok",
+              relationship_coverage: { status: "complete" },
+            },
           ],
         },
         limitations: [caveat],
       },
     });
-    expect(JSON.stringify(graph.structuredContent)?.split(caveat)).toHaveLength(
-      2,
-    );
 
     const trace = await client.callTool({
       name: "trace_call_path",

tests/process-global/cleanLinuxHopperRuntime.test.ts

@@ -74,15 +74,12 @@ it
       const { stdout } = await parent;
       const { pid } = JSON.parse(stdout) as { pid: number };
       orphanPid = pid;
-      if (alternateMode) {
-        const processEntry = join(procRoot, String(pid));
-        await mkdir(processEntry);
-        for (const name of ["cmdline", "comm", "exe"])
-          await symlink(
-            `/proc/${String(pid)}/${name}`,
-            join(processEntry, name),
-          );
-      }
+      // The runtime check reads only the supplied proc root, so expose the
+      // fixture there in both modes.
+      const processEntry = join(procRoot, String(pid));
+      await mkdir(processEntry);
+      for (const name of ["cmdline", "comm", "exe"])
+        await symlink(`/proc/${String(pid)}/${name}`, join(processEntry, name));
       const { stdout: coordinates } = await execFileAsync("ps", [
         "-p",
         String(pid),