cdf v1.0.3 — Phase 4 MoPla validation fixes

Patch release surfacing two friction points caught during Phase 4 MoPla validation (2026-04-26 — first real-world snapshot run against a non-trivial DS, 152 component_sets, 9 min wall-time).

Fixed

FIGMA_PAT not reaching the MCP server

The plugin's .mcp.json did not explicitly forward FIGMA_PAT from the user's shell, so whether cdf-mcp received it depended on Claude Code's MCP-launcher inheritance behavior. Real run: export FIGMA_PAT=... was set in ~/.zshrc, but the first cdf_fetch_figma_file call still failed with the no-PAT error. The user had to read the value from .env and pass pat: inline.

Fix — .mcp.json now declares an explicit env passthrough:

"env": { "FIGMA_PAT": "${FIGMA_PAT}" }

The ${FIGMA_PAT} syntax interpolates at MCP launch time. Shell-set tokens now reach cdf-mcp on first call without per-call pat: arg. The arg-form fallback still works (and overrides env) for multi-account scenarios.

_quality: draft schema annotation invalid on findings_unclassified

snapshot.profile.schema.yaml documented _quality: draft as a top-level marker on every best-effort section, but findings_unclassified is a YAML list — a sibling _quality: draft key produces a mixed scalar+list shape that breaks parsers. The schema now omits the marker on the list section and adds an explicit note that draft-status there is implicit via the soft-boundary position. Mapping sections (vocabularies, token_grammar, theming, interaction_a11y) keep the inline marker — they're objects, where it's well-formed.

Upgrade

claude plugin marketplace update cdf
claude plugin update cdf@cdf
# Fully quit Claude Code (Cmd+Q) and relaunch — the MCP launcher
# needs to reload .mcp.json env passthrough.

Phase 4 status

The MoPla run produced a full, useful snapshot output (12 findings + 7 blind-spots, all under cap, vocabulary-collisions surfaced, Rule A tool-survey corrected the Variables blind-spot). Wall-time was 9 min — at the upper edge of the <10 min target. Three deferred friction points (pre-reading 6 files before drafting; walker output >25k tokens for 152 component_sets; deferred-tool ToolSearch overhead) are tracked in the upstream backlog under "Skill UX iteration from MoPla run."

No package version bumps — @formtrieb/cdf-mcp and @formtrieb/cdf-core are unchanged at v1.7.2 / v1.0.3. Only this plugin's manifest + schema doc changed.