Fix main: bridge test references removed meta key set

[JAORMX]

Summary

main does not currently build its tests. pkg/vmcp/server/bridge_regression_test.go:506 references mcpparser.ReservedModernMetaKeys, which no longer exists:

vet: pkg/vmcp/server/bridge_regression_test.go:506:38: undefined: mcpparser.ReservedModernMetaKeys

Both go vet ./... and task lint fail for everyone on main, and this is already failing other people's PRs — #6022 is red on Linting / Lint Go Code and Tests / Test Go Code with exactly this error, having been green on its previous head before these landed.

Neither PR was wrong on its own. #6024 replaced the enumerated reserved-key slice with ReservedMetaPrefix + a passthrough exemption, and converted the three call sites that existed on its branch (modern_envelope_test.go, revision_realbackend_test.go, mcp_session_meta_propagation_test.go). #6006 added this file, which uses the old symbol. Each was green; the merge of the two is not. Same semantic-conflict class as an interface change landing beside a new call site — which bit #6013 earlier today for the same underlying reason.

The fix converts the assertion to the prefix scan #6024 established, and is strictly stronger than the original: it catches any reserved io.modelcontextprotocol/* key, including ones added after this test was written, rather than only the four the removed slice happened to list.

Type of change

• Bug fix

Test plan

• Unit tests (task test) — pkg/vmcp/server green, full package, 94s
• Linting (task lint) — 0 issues; go vet ./... clean (this is the gate that was failing)
• Manual testing (described below)

Confirmed the break is pre-existing and not introduced by me: git stash && go vet ./pkg/vmcp/server/ on unmodified main reproduces the identical error. Also confirmed #6022's lint annotation is byte-for-byte the same failure, so this unblocks that PR too.

One thing I did not manage to verify, stated plainly: I could not mutation-verify that the converted assertion still fires on a real leak. Neutering it leaves the test passing, because the strip works and no reserved key is present either way — it is a regression guard, not a currently-firing check. What I can attest to is that the build is restored, the property asserted is unchanged in intent, and the key set it covers is now a superset of before.

API Compatibility

• This PR does not break the v1beta1 API.

Test-only change.

Does this introduce a user-facing change?

No.

Special notes for reviewers

• legacyRequestPassthroughMetaKeys duplicates pkg/mcp's unexported passthroughMetaKeys. That duplication is deliberate but unfortunate — if the production set gains an entry and this one doesn't, the test starts failing on a legitimate passthrough. The comment says to prefer widening the production set. If you'd rather export the production set and drop the local copy, that's a cleaner end state and I'm happy to do it instead.
• Worth considering whether go vet ./... belongs in a fast-failing CI job. task lint does run it, so CI did catch this — but only on the PRs that came after, not on the merge that caused it. A branch-protection check on main post-merge would have flagged it at the source.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.18%. Comparing base (f0de82f) to head (4a273ce).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6030      +/-   ##
==========================================
+ Coverage   72.15%   72.18%   +0.02%     
==========================================
  Files         721      721              
  Lines       74991    75025      +34     
==========================================
+ Hits        54113    54156      +43     
+ Misses      17015    17007       -8     
+ Partials     3863     3862       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[JAORMX]

Closing — superseded by #6029, which landed the same fix first and did it better.

We converged on the same diagnosis independently (the #6024 prefix-API rename versus the bridge_regression_test.go #6006 added, each green alone), and both fixes convert the assertion to a prefix scan. The difference is the passthrough handling: I mirrored pkg/mcp's unexported passthroughMetaKeys into the test and exempted those keys, and flagged that duplication in this PR's own review notes as its weak point — if the production set gains an entry and the copy doesn't, the test fails on a legitimate passthrough.

#6029 avoids that entirely with a blanket prefix check, justified precisely: "No passthroughMetaKeys entry is in play on a tools/call, so a blanket prefix check is exact." That is the better call — it is strictly simpler and has no set to keep in sync. go vet ./... on main is clean now.

Two follow-on notes:

• Echo the request JSON-RPC id in session-not-found 404s #6031 was stacked on this branch (because main's tests did not build, so its lint job could not go green). It has been rebased onto main as a single commit and retargeted, so it no longer depends on this.
• Fix Cedar deny-all when upstream JWT lacks identity claims #6022 was red solely from this same build break and should go green on a re-run now that Fix bridge_regression_test build after reserved-meta API rename #6029 has landed.

The one item here worth not losing: this class of failure — two independently-green PRs whose merge does not build — has now happened twice today (this, and #6013 meeting a new CallTool call site from #6010). A post-merge go vet ./... check on main would catch it at the source rather than in the next contributor's PR, where it reads as their failure. Raised in this PR's description; noting it here so it survives the close.