test: verify auth-header forwarding on both HTTP transports

[memtomem]

Closes #103. Stacked on #104 — base is test/verify-sse-transport, not
main. Merge #104 first, then retarget this to main before deleting that
branch, or GitHub closes this PR along with it.

What and why

ServerSpec.headers carries crawl credentials to upstream MCP servers. Both
HTTP transports forward it, through different SDK mechanisms:

transport	how headers are handed to the SDK
streamable-http	create_mcp_http_client(headers=...) passed as http_client= — no headers= kwarg exists
sse	headers= straight through to sse_client

One spelling can stop carrying credentials without the other noticing, and
neither had ever been executed with a non-empty headers dict at any SDK
version. A regression there does not crash. It returns 401s, or worse, crawls a
smaller tool set and prunes real edges out of the governance graph. headers
already sits on the control-plan secret denylist next to api_key and
password.

Nothing was broken. Both transports forward headers correctly at mcp 2.1.1
and 2.2.0. This PR turns that into standing coverage.

Precisely what CI enforces, since the two layers differ:

	streamable-http	sse
pytest, lockfile 2.2.0	yes	yes
floor script, pinned 2.1.1	yes	no

SSE header forwarding at the declared floor is verified, but by a local run
recorded below, not by a job that will fail if it regresses. Adding that leg is
cheap if we decide the gap matters; it is called out rather than papered over.

The design decision worth reviewing

The first version asserted on the client's exception. Codex called that a
Major, correctly: the SDK funnels both a 401 and a 500 into the same generic
error for streamable-http, so a crashed or hung server would have satisfied the
assertion exactly as well as a real refusal. The negative half would have been
vacuous — the precise "looks verified but isn't" failure this repo keeps
getting bitten by.

So the evidence moved server-side. The fixture counts what it turned away and
serves the tally at an unauthenticated path. Each test pins the count at zero
after the authorized crawl, then requires it to rise after the anonymous one.
pytest.raises only establishes that the crawl failed; the tally establishes
why. _leaf_errors, _assert_auth_rejection and the MCPError import are
gone.

The middleware is raw ASGI rather than BaseHTTPMiddleware so ASGI messages
are forwarded untouched. BaseHTTPMiddleware would also work — it streams
rather than buffers — but it relays the long-lived SSE response through an extra
task and memory object stream for no benefit here. Non-HTTP scopes pass through
so the SDK's session manager still starts.

Mutation testing

Three deliberate breakages, all of which turn the suite red:

mutation	result
if spec.headers: → if False, and sse_client(headers=None)	both header tests fail
fixture returns 500 without counting a rejection	both header tests fail
floor script's anonymous probe aimed at a dead port	no server rejection seen

The second is the case that passed under the exception-sniffing version.

Verification

uv run pytest -q                                585 passed
uv run ruff check .                             All checks passed
verify_mcp_floor.py @ mcp 2.2.0                 header forwarding ok
verify_mcp_floor.py @ mcp 2.1.1 (declared floor) header forwarding ok

The floor leg drives streamable-http only, since that is the 2.x-specific
spelling and the fragile one; pytest covers both transports at the lockfile
version. See the coverage table above for what that leaves unenforced. Also refreshes the minimum-mcp
comment in ci.yml, which still claimed the script covered only
streamable-http.

Codex re-reviewed after the fixes: SHIP, no blockers, no majors. Its
remaining minor — the floor script never pinned its authorized baseline at zero
the way pytest does — is fixed here too.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ue4wAZWpL7PFe7ARenR7fz