release: v1.22.1 — ship the QUA-1580 cloud MCP routing fix

[Desperado]

Refs QUA-1725, QUA-1580.

The problem

The QUA-1580 fix merged on 2026-07-28 and has never been released.

v1.22.0     -> 29a5fd2   feat: standalone local-only mode (#156)
origin/main -> 56a5940   QUA-1580: mint MCP-compatible token (#159)

git log v1.21.2..origin/main
  56a5940  QUA-1580: mint MCP-compatible token after browser login (#159)
  8f816d2  QUA-1580: Route authenticated tool calls through cloud MCP
  29a5fd2  feat: standalone local-only mode + docs refresh (#156)

main is exactly two commits ahead of the newest tag, and those two commits are the fix. Checked every recent tag for 8f816d2:

tag	contains the fix
v1.22.0	no
v1.21.2	no
v1.21.1	no
v1.21.0	no
v1.20.9	no
v1.20.8	no

The installer resolves releases/latest, so every user who installed qmax-code since Jul 28 got a binary without the fix. Their serve --mcp still calls REST directly, which means:

1. Tool calls set no trace context — no session history at all. This is the exact regression QUA-1580 was closed for.
2. Responses are UI-shaped REST payloads carrying every script's full source. On a 19-script project that's 44,240 chars (~11K tokens) in one list_scripts call, and no server-side response budget can reach it — the platform-side work in QUA-1724 only covers /api/mcp/.

QUA-1580 was marked Done on a merged PR. Merged ≠ shipped.

This PR

Changelog entry + version constant. No functional change — the fix itself is already on main.

• CHANGELOG.md — new ## [1.22.1] section. Both commits landed with no changelog entry, so [Unreleased] was empty despite the fix sitting there.
• main.go — Version 1.22.0 → 1.22.1. Cosmetic for released builds (release.yml stamps the tag via ldflags) but correct for go build from source.

Patch, not minor: bug fix plus the token minting it needs, no new surface.

Verification

• Branched from freshly fetched origin/main, 0 ahead / 0 behind at time of branching; both fix commits confirmed present.
• CI is green on 56a5940 — the exact base commit — for both CI and QualityMax Go Tests.
• go vet ./... clean locally. Local go test ./... shows internal/mcp ok; five packages (setup, skills, sysutil, tui, vnc) hit the 11m budget on this machine for want of a TTY/network, which is why the CI result above is the load-bearing signal rather than my laptop.

After merge

Tag v1.22.1 on the merge commit and push — release.yml fires on v* and handles tests, six-platform builds, archives, and the GitHub release. I have not tagged anything; that's the deliberate manual step.

Loose end, not fixed here

Desperado/update-qmax-docs-orch-mode carries a commit 7601b2b test+release: … release v1.22.0 that differs from the actual v1.22.0 tag (29a5fd2). If that branch merges as-is you'd get a second, conflicting 1.22.0. Worth untangling separately.

[sigilix]

Sigilix Overview

Effort: 1/5 (trivial)

Quality gates

• ⚠️ PR title follows convention — Title doesn't match repo convention: ^(?:feat|fix|chore|docs|refactor|test|perf|style|build|ci|revert)(?:\([^)]+\))?!?: .+
• ✅ PR description is complete
• ℹ️ PR is linked to an issue — No Closes #N / Closes SIG-N keyword found in PR body or commit messages.

Summary — latest push

Bumps the version constant to 1.22.1 and adds a changelog entry to formally release the previously merged but unshipped QUA-1580 cloud MCP routing fix. The functional changes (routing authenticated tool calls through the cloud MCP endpoint and minting MCP-compatible tokens after browser login) are already on main; this PR exists solely to cut the release tag so the installer distributes the fix. The specialist review verdict is a clean APPROVE with zero findings.

Important files

File	Score	Notes	Next step
CHANGELOG.md	1/5	Adds the 1.22.1 release section documenting the MCP routing and token minting fixes, plus a note that these fixes merged on 2026-07-28 but were never included in a published build.	Verify the Unreleased section is now empty and that no other unreleased entries were accidentally absorbed into 1.22.1.
main.go	1/5	Updates the Version constant from 1.22.0 to 1.22.1, which is cosmetic for release builds (overridden by ldflags) but correct for local go build usage.	Confirm the release workflow uses ldflags to stamp the tag version so this constant only affects ad-hoc builds.

Confidence: 5/5

Purely mechanical version bump and changelog addition with no functional code changes; CI is green on the base commit and the specialist review returned zero findings.

• Ensure the Unreleased section in CHANGELOG.md is intentionally left empty and no pending entries were dropped.
• After merge, remember to manually tag the merge commit as v1.22.1 and push the tag to trigger the release workflow.
• Separately untangle the conflicting v1.22.0 tag on the Desperado/update-qmax-docs-orch-mode branch before it merges.

---

_{Posted · eff35ec · 0 findings — View review
Dismiss @sigilix dismiss <reason> (not-a-bug | bad-anchor | already-covered | too-minor | wrong-context) · Re-run /sigilix review
Sigilix · 0 of 50 reviews used in past 5h}

[qualitymaxapp]

QualityMax Review — canonical overview updated; inline findings are attached to this review.

[qualitymaxapp]

QualityMax Review

Verdict: COMMENT · Confidence: insufficient — 139 model output tokens (minimum 200)

Files eligible: 2 · Files reviewed: 2 · Files with findings: 0 · Findings: 0 · Inline cards: 0

Priority findings

priority	location	finding
—	—	No blocking findings

Review gates

gate	status
AI diff review	completed · eligible 1, reviewed 1 · LLM · served gemini-3.1-flash-lite
SAST	completed · eligible 2, reviewed 2 · hybrid · served gemini-3.1-pro-preview
Overall review evidence	unavailable — insufficient model review evidence
Inline evidence	not needed

Important files

file	risk	note	next step
—	—	No findings	—

Review lifecycle

Use the inline cards to inspect evidence and suggested remediation. Re-run the QualityMax review after pushing a fix; unchanged cards are identified by their stable finding marker. Dismiss with a reason through the existing QualityMax/GitHub review feedback flow. 0 prior card(s) are stale/resolved on this head. @qmax Q&A is tracked separately.

Proof legend: VERIFIED independently judged patch · REPRODUCED verified finding · GROUNDED deterministic evidence · MODEL-ONLY model judgment.

QualityMax project results are available in the configured project.

_{Receipt · commit eff35ec52255c2ac211a1ae1bf970f524e775aee · run 2026-08-02T22:21:05+00:00 · model served gemini-3.1-pro-preview, gemini-3.1-flash-lite · model requested gemini-3.1-pro-preview, gemini-3.1-flash-lite · model review insufficient — 139 model output tokens (minimum 200) · model source repository ai_review_preferences.preferred_model · re-review 1 · proof counts {}}

[qualitymaxapp]

⚠️ QualityMax Pipeline

Gate	Result
🔍 AI diff review	✅ Clean · gemini-3.1-flash-lite · completed · 1 eligible / 1 reviewed · gemini-3.1-flash-lite
🔍 SAST	completed · 2 eligible / 2 reviewed · gemini-3.1-pro-preview
🔍 Canonical PR review delivery	completed · 0 eligible / 0 reviewed · exact-head review #4839852033 and overview #5160616806 confirmed
🧪 Repo Tests	✅ 553/553 passed (go)
🤖 AI Tests	⚠️ 0/9 passed

_{Powered by QualityMax — AI-Powered Test Automation}