mcp-data-platform-v1.89.1

A patch release that fixes two read-time correctness defects found while testing the v1.89.0 memory, insight, and knowledge loop end to end against a live instance. The loop logic was already sound; these are about what a record looks like once it is read back and displayed.

Superseded insights no longer linger in search or the review queue (#682)

A captured record carries two status axes: the lifecycle status column (active, superseded, archived) and the insight review status (metadata.insight_status: pending, applied, superseded). Recall-first supersede advanced only the lifecycle column, while the insights read path keys off the review status. The result: after a near-identical capture superseded an earlier one, the earlier record still surfaced in search and still sat pending in the review queue, even after its successor was promoted to a knowledge page. That defeated recall-first at read time and left an orphaned pending insight behind.

Supersede now advances insight_status to superseded as well, but only for records that already carry one (a reviewable insight). Preferences and other non-insight records are left untouched. The read path already retracts superseded, so the stale record now drops out of both search and the review queue.

A latent null-metadata corruption, fixed

While reworking the metadata update, the real-Postgres test surfaced a pre-existing bug. A record captured with no extra metadata is stored as JSON null, and in Postgres null || patch produces a JSON array rather than an object, which then fails to read back as a map. Superseding such a record (a recall-first restatement of a plain preference) would corrupt it. The metadata base is now coerced to an empty object when it is not already a JSON object, so the merge stays an object regardless of the prior shape. This is the kind of jsonb behavior unit mocks cannot catch; a real-Postgres test now exercises it.

Page and changeset authorship now shows the email, not a UUID (#682)

Knowledge-page created_by/created_email, the DataHub changeset author, and the rollback author were set to the user id (a UUID), so the page view displayed an opaque identifier instead of an email. Authorship now prefers the user's email, falling back to the id only when no email is present (for example an API-key identity). This matches the portal page handler, captured-insight authorship, and the created_by ownership convention used for the "my pages" filter.

Testing

• make verify green: race plus real-Postgres, package budget, lint, gosec/govulncheck, semgrep, CodeQL, mutation, swagger-check, GoReleaser. Patch coverage 100%.
• New real-Postgres coverage for the supersede status advance (insight advances, non-insight untouched, null-metadata safe) and for email authorship on a promoted page, plus unit coverage for the email-preferred author resolution.
• An adversarial review confirmed the SQL placeholder ordering and dual-CASE semantics, that advancing the review status is required because the read path prefers it (and lineage stays display-accurate), and that no join or foreign key keys on the user id, so the authorship change is safe.

Full changelog: v1.89.0...v1.89.1

Installation

Homebrew (macOS)

brew install txn2/tap/mcp-data-platform

Claude Code CLI

claude mcp add mcp-data-platform -- mcp-data-platform

Docker

docker pull ghcr.io/txn2/mcp-data-platform:v1.89.1

Verification

All release artifacts are signed with Cosign. Verify with:

cosign verify-blob --bundle mcp-data-platform_1.89.1_linux_amd64.tar.gz.sigstore.json \
  mcp-data-platform_1.89.1_linux_amd64.tar.gz