Fix registry quarantine provenance and MCP dependency bound

[cursor]

Bug and impact

• A crafted .json file under the registry_fetch/ quarantine layout could act as both the merge payload and sidecar metadata by including top-level reason: registry_fetch, allowing apply_merge(..., approve=True) to accept a file that was not the .txt content path produced by scp_fetch_registry.
• Fresh installs also resolved mcp 2.x even though the code imports the v1 mcp.server.fastmcp.FastMCP API, breaking MCP entrypoints and the contract test collection path.

Root cause

• _load_quarantine_snapshot validated that a path resolved under the registry-fetch quarantine directory, but did not require the content path to use the .txt quarantine payload suffix before checking the sibling .json sidecar.
• Package metadata allowed any mcp>=1.2.0, including the incompatible 2.x API.

Fix

• Require registry quarantine merge inputs to be .txt content paths, so a JSON file cannot satisfy its own sidecar provenance check.
• Add a regression test for the forged self-sidecar JSON case.
• Bound MCP dependency to mcp>=1.2.0,<2 in both pyproject.toml and requirements.txt.

Validation

• Red test before fix: PYTHONPATH=src python3 -m pytest tests/test_registry_ssot.py::test_apply_merge_rejects_json_payload_as_its_own_sidecar -q failed because the forged payload merged.
• Focused verification: PYTHONPATH=src python3 -m pytest tests/test_registry_ssot.py tests/test_appsec_fetch_body_caps.py tests/test_appsec_antigen_mcp_gates.py tests/test_mcp_contract_v1.py -q -> 46 passed.
• Full optional Python suite: 351 passed, 3 skipped, 7 failed due pre-existing optional/non-CI checks (vendored contract hash tests, RT11 residual, and missing optional coincurve extra).
• Promptfoo CI path was blocked locally by Node v22.14.0; promptfoo requires ^20.20.0 or >=22.22.0.

  

[ManintheCrowds]

Audit: self-certifying JSON sidecar reject + MCP pin; sidecar rule in #60, MCP pin skipped. Closing as superseded by #60.