MCP 2026-07-28 OAuth/Harpoon rollout
Use v0.0.14 as the supported tunnel-client release for multi-replica OAuth/Harpoon. MCP 2026-07-28 self-contained/sessionless requests no longer depend on initialize / notifications/initialized state being pinned to one process.
The sessionless capability landed before this tag range; v0.0.14 is the validated rollout target and adds rollout diagnostics plus redundant OAuth/Harpoon handover coverage. Identical fully booted replicas using the same tunnel ID and runtime API key, with matching startup catalog digests, can independently handle Harpoon requests.
Startup digest preflight
v0.0.14 adds a privacy-safe HMAC-SHA-256 harpoon startup catalog digest log after startup OAuth registration finalizes. Matching digests indicate equivalent startup catalogs without logging target details or secrets. They do not prove client health, simultaneous polling, response routing, shared mutable state, or convergence after later runtime changes.
Other changes
- Hardened MCP redirect handling: connector-forwarded headers are scoped to the configured MCP origin, and runtime MCP requests reject cross-origin redirects; same-origin redirects continue to work.
- Support archives now redact resolved extra-header secrets supplied through environment variables or CLI arguments.
- Improved reliability for proxied control-plane long polls after pre-header EOF-style idle disconnects.
- Fixed shared stdio recovery when a later logical session reuses a JSON-RPC request ID after an earlier response timeout.
Verification
v0.0.14 publishes 67 assets, including platform archives, SPDX and license sidecars, checksum and public-URL manifests, provenance, vulnerability evidence, OpenVEX, and an enterprise evidence manifest.
Full Changelog: v0.0.13...v0.0.14