Strengthen MCP And Route Validation Tests (codex)

[numnx]

🧩 Task: Strengthen MCP And Route Validation Tests

Automated task PR opened by Code UX for T05.

📋 Summary

Sprint: Sprint 144 · QS: Coverage Observability and CI Reliability Audit · Task: T05

Create a repeatable coverage, observability, security, and CI reliability quicksprint by adding enforceable tests, CI/Playwright hardening, structured logging guarantees, and aligned operational documentation without lowering coverage thresholds.

📝 Full Task Prompt

## Objective
Close the current API surface gap where route validation and MCP payload parsing can regress independently of happy-path tests. The desired guarantee is consistent 400/404/409/500-style status mapping, sanitized errors, and correlation-aware request handling for invalid inputs.

## Scope
- Edit `tests/backend/mcp/management-payload-parsers.test.ts`
- Edit `tests/backend/mcp/tool-validators.test.ts`
- Edit route tests such as `tests/backend/server/dashboard-server.test.ts`, `tests/backend/server/dashboard-chat-api.test.ts`, `tests/backend/server/terminal-routes.test.ts`, or `tests/backend/services/quicksprint-server.test.ts`
- Verify source modules under `src/server/**`, `src/server/code-ux-server.ts`, `src/domain/jules/mcp-request-router.ts`, and `src/contracts/**`
- Relevant symbols: `parseRequiredString`, `parseOptionalEnum`, `parseOptionalNumber`, approval envelopes, `x-correlation-id`, route error payloads

## Implementation Requirements
1. Add MCP parser tests for missing required string values, invalid enum values, invalid numeric ranges, unexpected payload shapes, and approval envelope validation where applicable.
2. Add dashboard route tests using `supertest` or existing fetch harnesses that verify malformed JSON/body values return consistent 400 responses without exposing raw request bodies or secrets.
3. Add route status mapping tests for at least one not-found case, one conflict/idempotency case, and one dependency/service failure case in existing route modules.
4. Assert correlation IDs are returned in response headers and included in structured logs for request failures where the route stack supports it.
5. If production code changes are needed, centralize validation/status mapping in existing helpers rather than adding per-route ad hoc behavior.

## Constraints
- Do not change public MCP tool names or response contracts except to tighten invalid-input handling.
- Do not log raw request bodies, provider transcripts, API keys, or approval secrets.
- Do not require real MCP clients, provider CLIs, Docker, or Git remotes.
- Keep parser tests focused and deterministic.

## Verification
- Run `pnpm run test:backend -- tests/backend/mcp/management-payload-parsers.test.ts tests/backend/mcp/tool-validators.test.ts tests/backend/server/dashboard-server.test.ts tests/backend/server/dashboard-chat-api.test.ts tests/backend/services/quicksprint-server.test.ts` adjusted to exact files changed.
- Run `pnpm run test:backend`.
- Run `pnpm run lint` and confirm no new TypeScript errors.

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.5

⏱️ Timing

Started	2026-07-06 20:09:44 UTC
Finished	2026-07-06 20:15:57 UTC
Duration	6m 13s

📊 Token Usage

Metric	Value
Input tokens	169,506
Cached input tokens	2,505,984
Output tokens	10,436
Total tokens	2,685,926
Invocations	1
Tool calls	58
Active time	5m 1s

Included usage estimate (subscription/local login): $2.41

🌿 Branch Info

Base: feature/CODUX-144-qs-coverage-observability-and-ci-reliability-audit-4
Head: task/feature-codux-144-qs-coverage-observability-and--t05-codex-mr9nlzht

---

🤖 Generated by Code UX