feat(executor): per-task agent MCP server + token registry (Phase 2)

Adds the agent-facing MCP transport foundation: a Registry that mints a
per-task bearer token bound to a freshly built MCP server exposing the four
agent tools (ask_user, report_summary, spawn_subtask, record_progress), and
an HTTP handler (StreamableHTTP) that resolves the token to that server. The
server never trusts an agent-supplied task ID — context comes from the token.

The default storeChannel now buffers summary and question signals under a
mutex (an MCP tool call lands on an HTTP-handler goroutine mid-run), exposing
ReportedSummary/PendingQuestion. The pool flushes the buffered summary onto
the execution after the run, replacing the runner's direct exec.Summary write
and keeping the read race-free.

ask_user follows the record-and-resume model: it buffers the question, returns
ErrAgentBlocked, and the tool tells the agent to end its turn; the run blocks
and resumes later via claude --resume (no live slot held).

Tests cover registry lifecycle, in-memory tool dispatch, and HTTP end-to-end
with bearer auth (valid token dispatches; invalid token rejected).

Not yet wired into the runners or mounted on the API server — next increment.

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39

1 files changed, 24 insertions, 18 deletions

diff --git a/internal/executor/channel_test.go b/internal/executor/channel_test.go
index 822dd35..250e8eb 100644
--- a/internal/executor/channel_test.go
+++ b/internal/executor/channel_test.go
@@ -6,7 +6,6 @@ import (
 	"testing"
 
 	"github.com/thepeterstone/claudomator/internal/event"
-	"github.com/thepeterstone/claudomator/internal/storage"
 	"github.com/thepeterstone/claudomator/internal/task"
 )
 
@@ -29,8 +28,8 @@ func (f *fakeChannelStore) CreateEvent(e *event.Event) error {
 	return nil
 }
 
-func TestStoreChannel_AskUser_ReturnsBlocked(t *testing.T) {
-	ch := newStoreChannel(&fakeChannelStore{}, "task-1", &storage.Execution{})
+func TestStoreChannel_AskUser_BuffersAndBlocks(t *testing.T) {
+	ch := newStoreChannel(&fakeChannelStore{}, "task-1")
 	answer, err := ch.AskUser(context.Background(), `{"text":"q"}`)
 	if !errors.Is(err, ErrAgentBlocked) {
 		t.Errorf("expected ErrAgentBlocked, got %v", err)
@@ -38,29 +37,36 @@ func TestStoreChannel_AskUser_ReturnsBlocked(t *testing.T) {
 	if answer != "" {
 		t.Errorf("expected empty answer, got %q", answer)
 	}
+	q, blocked := ch.PendingQuestion()
+	if !blocked || q != `{"text":"q"}` {
+		t.Errorf("expected buffered question, got q=%q blocked=%v", q, blocked)
+	}
 }
 
-func TestStoreChannel_ReportSummary_BuffersOntoExec(t *testing.T) {
-	e := &storage.Execution{}
-	ch := newStoreChannel(&fakeChannelStore{}, "task-1", e)
-	if err := ch.ReportSummary(context.Background(), "did the thing"); err != nil {
-		t.Fatalf("ReportSummary: %v", err)
-	}
-	if e.Summary != "did the thing" {
-		t.Errorf("expected exec.Summary set, got %q", e.Summary)
+func TestStoreChannel_PendingQuestion_DefaultNotBlocked(t *testing.T) {
+	ch := newStoreChannel(&fakeChannelStore{}, "task-1")
+	if q, blocked := ch.PendingQuestion(); blocked || q != "" {
+		t.Errorf("expected no pending question, got q=%q blocked=%v", q, blocked)
 	}
 }
 
-func TestStoreChannel_ReportSummary_NilExec(t *testing.T) {
-	ch := newStoreChannel(&fakeChannelStore{}, "task-1", nil)
-	if err := ch.ReportSummary(context.Background(), "x"); err != nil {
-		t.Errorf("expected nil err with nil exec, got %v", err)
+func TestStoreChannel_ReportSummary_Buffers(t *testing.T) {
+	ch := newStoreChannel(&fakeChannelStore{}, "task-1")
+	if _, ok := ch.ReportedSummary(); ok {
+		t.Error("expected no summary before report")
+	}
+	if err := ch.ReportSummary(context.Background(), "did the thing"); err != nil {
+		t.Fatalf("ReportSummary: %v", err)
+	}
+	sum, ok := ch.ReportedSummary()
+	if !ok || sum != "did the thing" {
+		t.Errorf("expected buffered summary, got %q ok=%v", sum, ok)
 	}
 }
 
 func TestStoreChannel_SpawnSubtask_CreatesChildWithParent(t *testing.T) {
 	store := &fakeChannelStore{}
-	ch := newStoreChannel(store, "parent-1", &storage.Execution{})
+	ch := newStoreChannel(store, "parent-1")
 	id, err := ch.SpawnSubtask(context.Background(), SubtaskSpec{
 		Name:         "child",
 		Instructions: "do it",
@@ -93,7 +99,7 @@ func TestStoreChannel_SpawnSubtask_CreatesChildWithParent(t *testing.T) {
 
 func TestStoreChannel_SpawnSubtask_PropagatesError(t *testing.T) {
 	store := &fakeChannelStore{createTaskErr: errors.New("boom")}
-	ch := newStoreChannel(store, "parent-1", &storage.Execution{})
+	ch := newStoreChannel(store, "parent-1")
 	if _, err := ch.SpawnSubtask(context.Background(), SubtaskSpec{Name: "x"}); err == nil {
 		t.Error("expected error from CreateTask")
 	}
@@ -101,7 +107,7 @@ func TestStoreChannel_SpawnSubtask_PropagatesError(t *testing.T) {
 
 func TestStoreChannel_RecordProgress_EmitsAgentMessage(t *testing.T) {
 	store := &fakeChannelStore{}
-	ch := newStoreChannel(store, "task-1", &storage.Execution{})
+	ch := newStoreChannel(store, "task-1")
 	if err := ch.RecordProgress(context.Background(), "halfway done"); err != nil {
 		t.Fatalf("RecordProgress: %v", err)
 	}