feat: complete Epic 1 production foundation

apps/mcp-server/tests/integration/tool_search.rs

@@ -3,7 +3,8 @@ use super::common::*;
 use std::time::Duration;
 
 use crank_core::{
-    PlatformApiKeyScope, ToolAccessMode, ToolGroup, ToolSearchSettings, ToolSelectionPolicy,
+    AgentId, PlatformApiKeyScope, ToolAccessMode, ToolGroup, ToolSearchSettings,
+    ToolSelectionPolicy,
 };
 use crank_registry::PublishRequest;
 use serde_json::json;
@@ -108,10 +109,16 @@ async fn search_mode_discovers_and_calls_tools_through_meta_tools() {
         search["result"]["structuredContent"]["tools"][0]["name"],
         "create_invoice"
     );
-    assert_eq!(
-        search["result"]["structuredContent"]["catalog_revision"],
-        "agent-version-1"
+    assert!(
+        search["result"]["structuredContent"]["catalog_revision"]
+            .as_str()
+            .unwrap()
+            .starts_with("agent-version-1-catalog-revision-")
     );
+    let catalog_revision = search["result"]["structuredContent"]["catalog_revision"]
+        .as_str()
+        .unwrap()
+        .to_owned();
 
     let stale_call = post_jsonrpc(
         &client,
@@ -131,7 +138,7 @@ async fn search_mode_discovers_and_calls_tools_through_meta_tools() {
     assert_eq!(stale_call["result"]["isError"], true);
     assert_eq!(
         stale_call["result"]["structuredContent"]["error"]["code"],
-        "catalog_revision_changed"
+        "agent_catalog_result_stale"
     );
 
     let call = post_jsonrpc(
@@ -144,7 +151,7 @@ async fn search_mode_discovers_and_calls_tools_through_meta_tools() {
             "params":{"name":"call_tool","arguments":{
                 "name":"create_invoice",
                 "arguments":{"email":"user@example.com"},
-                "catalog_revision":"agent-version-1"
+                "catalog_revision": catalog_revision
             }}
         }),
     )
@@ -152,3 +159,116 @@ async fn search_mode_discovers_and_calls_tools_through_meta_tools() {
     assert_eq!(call["result"]["isError"], false);
     assert_eq!(call["result"]["structuredContent"]["id"], "lead_123");
 }
+
+#[tokio::test]
+async fn stale_search_result_rejects_tool_call() {
+    let registry = test_registry().await;
+    let upstream_base_url = spawn_upstream_server().await;
+    let invoice = test_operation(&upstream_base_url, "stale_invoice_tool");
+    registry
+        .create_operation(&test_workspace_id(), &invoice, Some("alice"))
+        .await
+        .unwrap();
+    registry
+        .publish_operation(PublishRequest {
+            workspace_id: &test_workspace_id(),
+            operation_id: &invoice.id,
+            version: 1,
+            published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
+            published_by: Some("alice"),
+        })
+        .await
+        .unwrap();
+    publish_agent_with_policy(
+        &registry,
+        "stale-search-agent",
+        vec![binding_for_operation(&invoice)],
+        ToolSelectionPolicy {
+            mode: ToolAccessMode::Search,
+            groups: vec![ToolGroup {
+                id: "finance".to_owned(),
+                name: "Finance".to_owned(),
+                description: "Invoices and payments".to_owned(),
+                tool_names: vec![invoice.name.clone()],
+            }],
+            search: ToolSearchSettings { max_results: 5 },
+        },
+    )
+    .await;
+    let agent_id = AgentId::new("agent_stale-search-agent");
+    let api_key = create_platform_api_key(
+        &registry,
+        "stale-search-agent",
+        "mcp-stale-search",
+        &[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
+    )
+    .await;
+    let base_url = spawn_mcp_server(build_test_app(
+        registry.clone(),
+        Duration::from_millis(0),
+        Some("https://crank.example.com".to_owned()),
+    ))
+    .await;
+    let client = reqwest::Client::new();
+    let mcp_url = agent_mcp_url(&base_url, "stale-search-agent");
+    let session = initialize_session(&client, &mcp_url, &api_key).await;
+
+    let search = post_jsonrpc(
+        &client,
+        &mcp_url,
+        &api_key,
+        Some(&session),
+        json!({
+            "jsonrpc":"2.0","id":3,"method":"tools/call",
+            "params":{"name":"search_tools","arguments":{"query":"invoice","group_ids":["finance"]}}
+        }),
+    )
+    .await;
+    let stale_revision = search["result"]["structuredContent"]["catalog_revision"]
+        .as_str()
+        .unwrap()
+        .to_owned();
+
+    registry
+        .unpublish_agent(
+            &test_workspace_id(),
+            &agent_id,
+            &OffsetDateTime::parse("2026-03-26T10:01:00Z", &Rfc3339).unwrap(),
+            None,
+        )
+        .await
+        .unwrap();
+    registry
+        .publish_agent(crank_registry::PublishAgentRequest {
+            workspace_id: &test_workspace_id(),
+            agent_id: &agent_id,
+            version: 1,
+            published_at: &OffsetDateTime::parse("2026-03-26T10:02:00Z", &Rfc3339).unwrap(),
+            published_by: Some("alice"),
+            expected_state: None,
+        })
+        .await
+        .unwrap();
+
+    let stale_call = post_jsonrpc(
+        &client,
+        &mcp_url,
+        &api_key,
+        Some(&session),
+        json!({
+            "jsonrpc":"2.0","id":4,"method":"tools/call",
+            "params":{"name":"call_tool","arguments":{
+                "name":"stale_invoice_tool",
+                "arguments":{"email":"user@example.com"},
+                "catalog_revision": stale_revision
+            }}
+        }),
+    )
+    .await;
+
+    assert_eq!(stale_call["result"]["isError"], true);
+    assert_eq!(
+        stale_call["result"]["structuredContent"]["error"]["code"],
+        "agent_catalog_result_stale"
+    );
+}