PR #30834 live verification, Linux Boat VM, 2026-11-04
Main: 9e85538535c8553901351112ab02dd1dd62db5ee (github/main)
PR: 6cc9779eb06925dee5008d2cbcdabd819bc35441

Setup:
  git worktree add ../main github/main
  (main) vp i
  (main) T3CODE_DEV_SEED=0 setsid nohup timeout 6600 vp run dev
  main server/web ports: 16733 / 8693
  stop main using captured process-group PID, confirm ports closed
  git fetch https://github.com/navidnadali/t3code.git fix/mcp-auth-span
  git switch -c fix/mcp-auth-span FETCH_HEAD
  vp i
  T3CODE_HOME=/home/user/t3code/.t3 T3CODE_DEV_SEED=0 setsid nohup timeout 6600 vp run dev
  PR server/web ports: 13773 / 5733

Client/provider path:
  Playwright 1.60.0 from apps/web dependencies, /usr/bin/google-chrome.
  Paired web client, Add project -> Local folder -> real git repository.
  Selected Codex GPT-6.1-Sol, submitted real provider turns through composer.
  Provider called orchestrator_capabilities, preview_status, device_screenshot over HTTP MCP.
  Both builds completed both turns. No mock provider, fixtures, or demo data.

Filtered completed local trace records (only safe timing/tool metadata):
MAIN
{"tool":"orchestrator_capabilities","callMs":23.838264,"authMs":26.469325,"authWrapsCall":true,"authEndsBeforeCall":false,"toolSpan":null,"callExit":{"_tag":"Success"}}
{"tool":"preview_status","callMs":10.352229,"authMs":11.506201,"authWrapsCall":true,"authEndsBeforeCall":false,"toolSpan":null,"callExit":{"_tag":"Success"}}
{"tool":"device_screenshot","callMs":3.899157,"authMs":12.669914,"authWrapsCall":true,"authEndsBeforeCall":false,"toolSpan":null,"callExit":{"_tag":"Success"}}
PR
{"tool":"orchestrator_capabilities","callMs":26.061169,"authMs":0.376623,"authWrapsCall":false,"authEndsBeforeCall":true,"toolSpan":{"name":"mcp.tool.orchestrator_capabilities","attributes":{"rpc.system":"mcp","rpc.method":"tools/call","mcp.tool.name":"orchestrator_capabilities"},"durationMs":24.200688},"callExit":{"_tag":"Success"}}
{"tool":"preview_status","callMs":4.005213,"authMs":0.111167,"authWrapsCall":false,"authEndsBeforeCall":true,"toolSpan":{"name":"mcp.tool.preview_status","attributes":{"rpc.system":"mcp","rpc.method":"tools/call","mcp.tool.name":"preview_status"},"durationMs":3.646685},"callExit":{"_tag":"Success"}}
{"tool":"device_screenshot","callMs":3.68247,"authMs":0.160089,"authWrapsCall":false,"authEndsBeforeCall":true,"toolSpan":{"name":"mcp.tool.device_screenshot","attributes":{"rpc.system":"mcp","rpc.method":"tools/call","mcp.tool.name":"device_screenshot"},"durationMs":3.259759},"callExit":{"_tag":"Success"}}
main: missing_authorization_header: warning retained on authentication span; no tool or McpServer span
main: unknown_or_expired_token: warning retained on authentication span; no tool or McpServer span
pr: missing_authorization_header: warning retained on authentication span; no tool or McpServer span
pr: unknown_or_expired_token: warning retained on authentication span; no tool or McpServer span
main vs pr: no-auth: HTTP status, body and headers match (port/date normalized)
main vs pr: invalid-auth: HTTP status, body and headers match (port/date normalized)

Observed device_screenshot result, identical on both builds:
Agent device access is turned off for this environment. Ask the user to turn on Agent device access in Settings > Integrations > Devices; it applies when the agent session next starts, such as in a new thread.

Missing credential: 401, cache-control=no-store, WWW-Authenticate offers OAuth resource metadata.
Invalid credential: 401, cache-control=no-store, WWW-Authenticate=Bearer error="invalid_token".
Both bodies: {"error":"invalid_mcp_credential","message":"A valid T3 Code MCP credential is required."}

Conclusion: main authentication spans contain tool execution. PR authentication ends before tool handling, and all three tool spans have exactly rpc.system, rpc.method, mcp.tool.name. This is trace attribution, not a performance speed-up claim.
Unverified: OAuth client credential/mode-limit/linked-environment live flows; native desktop/mobile; successful hardware screenshot; other providers.