v3.31.0 — MCP over streamable HTTP, and twenty fixes to checks that scored absence as success

MCP over streamable HTTP

The same 16-tool surface the stdio server exposes is now reachable over HTTP, behind the
opt-in mcp-http feature:

cargo install pmat --features mcp-http
PMAT_MCP_HTTP_TOKEN=<at least 16 chars> pmat …

It refuses to serve open. Without a token the server does not start, rather than starting
unauthenticated and logging a warning nobody reads. The token is compared in constant time,
and BearerToken's Debug is hand-written to redact it so it cannot reach a log through a
derived formatter.

Also new: .agents/hooks/pmat-quality-feedback.sh, a pure-shell hook that runs pmat's gates
from either Claude Code or a generic agent client and translates the result into whichever
refusal shape the caller understands (exit 2, or {"decision":"deny"}).

What most of this release actually is

Around twenty fixes, and they are overwhelmingly one defect family — a check, score or
manifest that renders absence as success:

• four MCP tools whose engine synthesized its findings from a substring of the path it was
  given (refactor.*, now unregistered; live tool count 20 → 16)
• grade A awarded to a project with almost nothing measured — now
  INSUFFICIENT (n/8 dimensions measured) below three measured dimensions
• a mutation job that had never executed a single mutant, because cargo-mutants ignores
  unknown configuration keys silently and a misspelled one disabled the run while the job
  stayed green
• a documentation gate that validated zero files
• a feature matrix that could not see a feature whose tests do not compile, because
  cargo check --lib does not build test targets. Adding --tests exposed 38 test-compile
  failures — all fixed, one of which was a real production bug in the ML predictor's
  parameter counting, where a slice ended before the closing paren so the empty-parameter
  branch could never be taken
• CB-1656 skipping green for a missing MCP manifest and failing red for a faithful
  one, and comparing every audited repo's manifest against pmat's own compiled-in tool list

and its mirror — a score printed against the wrong denominator (/134 against a 289-point
rubric), so git commit trailers recorded percentages above 100%.

Two more worth naming: MCP and the CLI answered the same SATD question with different
numbers, and --include-tests could not reach an inline #[cfg(test)] block. Both now run
through one code path; the shipped binary reports 9 for src/ and 34 with tests from either
interface.

The OpenAI API-key surface is deleted. The product stopped using it; the code that read,
stored and logged the key did not.

Flaky tests

Two were removed, neither by widening a tolerance. An enforce test asserted that a
parseable project measures every dimension — not a property the product guarantees, since
the dead-code phase is a wall-clock budget around cargo check. A five-whys proptest
asserted that generate_recommendations always echoes the root cause, but its \PC{1,50}
generator emits U+2028 LINE SEPARATOR, which is White_Space=yes, so the product correctly
took its blank-input branch. In both cases the test was wrong and the product was right, so
the test is what changed — and the blank branch is now pinned by an exhaustive,
non-random test rather than left to whether the seed cooperates.

docs.rs

3.30.1 was the first version docs.rs had ever successfully built; 3.28.2, 3.29.0 and 3.30.0
all failed silently, because docs.rs serves HTTP 200 for a failed build. The metadata that
caused it stays removed, verified for this release by parsing Cargo.toml rather than
grepping it.

Full detail in CHANGELOG.md.