[Proxicon]

Beta.9 failure

Raw JSON-RPC tools/call with duplicate outer params.arguments returns HTTP 500 and stdio -32603 before the existing tool validator runs. See #252.

Fix

Normalize only duplicate params.arguments frames before SDK binding so the existing transport-neutral duplicate-envelope validator returns structured validation_failed. HTTP inspects bounded authenticated JSON posts in memory; stdio filters newline-delimited frames. No tool is invoked for the rejected request.

Verification

• Raw mutation-shaped requests return the original JSON-RPC id, isError, and structured validation_failed/validation_error on HTTP and stdio.
• The same rejection succeeds through gateway authentication, matching the deployed ingress mode.
• The HTTP harness observed zero downstream API/token requests.
• McpHttpHostTests and HelpdeskMcpProcessTests: 55 passed, 0 failed locally.
• HTTP host build succeeded.

Deployed v0.1.2-beta.9 remains failing until a reviewed build is released and retested against the live instance.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	⚠️ Failed 2026-10-21T20:01:06.579426Z We couldn’t complete this review. Comment @codex security review to try again.	d0cdb85	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.

[Proxicon]

Follow-up code review and repair at ef67e4d close HTTP framing gaps in the initial guard: unknown Content-Length, the trailing slash route, and accepted bodies above 1 MiB now pass through the same duplicate validation. The 1 MiB setting is a memory threshold, not an execution bypass. Finite server body limits are honored; the finite fallback is 30,000,000 bytes, with 413 before execution above the bound.

Local pinned-SDK validation passed: 12/12 focused framing/size/duplicate cases; 66/66 HTTP/stdio transport regression cases; no skipped results. Slopwatch reports zero issues in changed/new source/tests. Documentation validation and whitespace checks passed. New hosted exact-head CI is required before merge. AI-assisted review and test evidence; live campaign receipts remain unchanged.