[tmt-123]

Which issue or RFC does this PR close?

Closes #2082.

Rationale for this change

Stateful MCP execution retains the initializing HTTP request's authentication context. Another authenticated caller can reuse the session and execute tools under the creator's identity. Actor and group membership also remain stale across requests.

What changes are included in this PR?

• Use stateless Streamable HTTP so each tool execution inherits the current request's authenticated identity.
• Add ASGI and real TCP regression tests for cross-user access, concurrent callers, identity updates, and invalid, missing, or revoked credentials.
• Test denied writes, subsequent valid requests, client reconnects, and persistent Memory after a server restart.
• Document transport behavior in English and Chinese.

Are there any user-facing changes?

MCP no longer issues transport session IDs. Clients should reconnect after upgrading. Scope, Memory, and Handoff data remain persisted. Cross-request SSE stream resumption is unavailable.

How was this change tested?

• Linux, Python 3.12.13, FastMCP 3.4.4, MCP SDK 1.28.1.
• All three regression cases fail against the original implementation.
• 108 related tests passed, covering MCP, HTTP access control, authorization, tracing, metrics, and integration behavior.
• Lock-file validation, Ruff, ty check, and pre-commit hooks passed.
• Native Codex CLI 0.163.0-alpha.10.2 discovered 56 tools and completed scope creation and a Memory write/read round trip against the Linux server.
• Claude Code 2.1.117 passed its native MCP connection health check. Model-driven tool use was not exercised.

AI usage statement

OpenAI Codex assisted with implementation, regression tests, and validation.

[CLAassistant]

All committers have signed the CLA.

[hidb4ai]

One reproducible test-isolation issue remains in the TCP server lifecycle; details inline.

[tmt-123]

Fixed in 80928b9. Updated the test server to leave process signal handling to pytest and removed the manual AppStatus reset. Added regression coverage for delayed restarts and overlapping listeners.

[hidb4ai]

LGTM