M13: harden MCP trust boundary

PROJECT_STATE.md

@@ -2314,3 +2314,18 @@ evidence yet."
   focused Unraid contracts **19 passed** and the full suite **208 passed, 1 warning**.
 - Exact next action: harden MCP per-client authorization and evidence completeness, then
   replace inferred n8n status with explicit heartbeat/execution telemetry.
+
+## MCP trust boundary and trace completeness (2026-08-10)
+
+- The MCP API now validates the ITWorx Hub delegated client-id shape in addition to the
+  shared service secret, supports an explicit tenant assertion and rejects cross-tenant
+  calls. Readiness and project-bound client identities remain compatible with the Hub's
+  documented connector contract; arbitrary/spoofed labels no longer enter the audit log.
+- Every successful tool response returns `X-Correlation-Id`, `X-Tenant-Id` and
+  `Cache-Control: no-store`. Knowledge calls additionally expose available versus
+  returned source counts and persist tenant, locale and source coverage in their audit
+  metadata. `contracts/mcp-tools.json` is versioned to 1.2.0 with this trust contract.
+- Evidence: ruff and mypy passed; focused MCP tests **14 passed** and full Unraid suite
+  **210 passed, 1 warning**.
+- Exact next action: add authenticated n8n workflow heartbeats and execution results,
+  surface stale/healthy workflow state, then update generated contracts and E2E coverage.