feat(executor): per-task agent MCP server + token registry (Phase 2)

Adds the agent-facing MCP transport foundation: a Registry that mints a
per-task bearer token bound to a freshly built MCP server exposing the four
agent tools (ask_user, report_summary, spawn_subtask, record_progress), and
an HTTP handler (StreamableHTTP) that resolves the token to that server. The
server never trusts an agent-supplied task ID — context comes from the token.

The default storeChannel now buffers summary and question signals under a
mutex (an MCP tool call lands on an HTTP-handler goroutine mid-run), exposing
ReportedSummary/PendingQuestion. The pool flushes the buffered summary onto
the execution after the run, replacing the runner's direct exec.Summary write
and keeping the read race-free.

ask_user follows the record-and-resume model: it buffers the question, returns
ErrAgentBlocked, and the tool tells the agent to end its turn; the run blocks
and resumes later via claude --resume (no live slot held).

Tests cover registry lifecycle, in-memory tool dispatch, and HTTP end-to-end
with bearer auth (valid token dispatches; invalid token rejected).

Not yet wired into the runners or mounted on the API server — next increment.

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39

1 files changed, 10 insertions, 2 deletions

diff --git a/internal/executor/executor.go b/internal/executor/executor.go
index 76e67b8..6d6c528 100644
--- a/internal/executor/executor.go
+++ b/internal/executor/executor.go
@@ -356,8 +356,12 @@ func (p *Pool) executeResume(ctx context.Context, t *task.Task, exec *storage.Ex
 		}
 	}
 
-	err = runner.Run(ctx, t, exec, newStoreChannel(p.store, t.ID, exec))
+	sc := newStoreChannel(p.store, t.ID)
+	err = runner.Run(ctx, t, exec, sc)
 	exec.EndTime = time.Now().UTC()
+	if sum, ok := sc.ReportedSummary(); ok {
+		exec.Summary = sum
+	}
 
 	p.decActiveAgent(agentType, &cleaned)
 	p.handleRunResult(ctx, t, exec, err, agentType)
@@ -1077,8 +1081,12 @@ func (p *Pool) execute(ctx context.Context, t *task.Task) {
 	}
 
 	// Run the task.
-	err = runner.Run(ctx, t, exec, newStoreChannel(p.store, t.ID, exec))
+	sc := newStoreChannel(p.store, t.ID)
+	err = runner.Run(ctx, t, exec, sc)
 	exec.EndTime = time.Now().UTC()
+	if sum, ok := sc.ReportedSummary(); ok {
+		exec.Summary = sum
+	}
 
 	p.decActiveAgent(agentType, &cleaned)
 	p.handleRunResult(ctx, t, exec, err, agentType)