QUA-1580: mint MCP-compatible token after browser login

[Desperado]

Summary

• exchange the browser login session token for a registered QualityMax API token
• persist the registered token so authenticated cloud MCP and REST both work
• use a 90-day lifetime and refuse redirects on login/mint requests
• add focused tests for minting, validation, save sequencing, and redirect handling

Validation

• go test -count=1 -race ./internal/setup ./internal/mcp
• go test -count=1 ./...
• go vet ./...
• git diff --check

Linear: QUA-1580

[sigilix]

---

_{Posted · d468225 · 0 findings — View review
Sigilix · 2 of 50 reviews used in past 5h}

Sigilix is reviewing this pull request.

A structured overview will replace this note when retrieval and specialist review complete.

== unfinished constellation ==
        .             *                    .              *
   *         .                    .                .              .
             .-----.        .-------.        .----.
      .     /  .   \______/   *     \______/  .   \      .
           /      .      /          .      \        \
      *   *------*------*-----*------------*---------*     *
             \        .'       \        .'       .  /
        .     \  .  .'    .     \  .  .'          /
               *--*             *--*        .     *
          .       \       all proofs return to light
    .              \____       one star still unnamed       .
           *            \___.--------.____
      .                      \   .   /        *        .
                 .            \_____/              .
        *                  .             .                 *

the last star waits for its name
we trace it gently before the dawn

[qualitymaxapp]

QualityMax Review — canonical overview updated; inline findings are attached to this review.

[qualitymaxapp]

QualityMax Review

Verdict: COMMENT · Confidence: evidence-backed scan

Files eligible: 9 · Files reviewed: 9 · Files with findings: 0 · Findings: 0 · Inline cards: 0

Priority findings

priority	location	finding
—	—	No blocking findings

Review gates

gate	status
AI diff review	completed · eligible 9, reviewed 3 · LLM · served gemini-3.1-flash-lite
SAST	completed · eligible 9, reviewed 9 · hybrid · served gemini-3.1-pro-preview
Overall review evidence	clean
Inline evidence	not needed

Important files

file	risk	note	next step
—	—	No findings	—

Change diagram — Flow

flowchart LR
    Agent[Agent] -->|Call Tool| Client[cloudMCPClient]
    Client -->|POST /api/mcp/| Cloud[QualityMax Cloud]
    Cloud -->|SSE/JSON Response| Client
    Client -->|Result| Agent

Loading

Review lifecycle

Use the inline cards to inspect evidence and suggested remediation. Re-run the QualityMax review after pushing a fix; unchanged cards are identified by their stable finding marker. Dismiss with a reason through the existing QualityMax/GitHub review feedback flow. 0 prior card(s) are stale/resolved on this head. @qmax Q&A is tracked separately.

Proof legend: VERIFIED independently judged patch · REPRODUCED verified finding · GROUNDED deterministic evidence · MODEL-ONLY model judgment.

QualityMax project results are available in the configured project.

_{Receipt · commit d4682255e795ddb74a47dbc22b3037db1ff2caa5 · run 2026-07-28T10:00:54+00:00 · model served gemini-3.1-pro-preview, gemini-3.1-flash-lite · model requested gemini-3.1-pro-preview, gemini-3.1-flash-lite · model review substantive — 1414 model output tokens · model source repository ai_review_preferences.preferred_model · re-review 1 · proof counts {}}

[qualitymaxapp]

⚠️ QualityMax Pipeline

Gate	Result
🔍 AI diff review	✅ Clean · gemini-3.1-flash-lite · completed · 9 eligible / 3 reviewed · gemini-3.1-flash-lite
🔍 SAST	completed · 9 eligible / 9 reviewed · gemini-3.1-pro-preview
🔍 Canonical PR review delivery	completed · 0 eligible / 0 reviewed · exact-head review #4796062801 and overview #5102680809 confirmed
🧪 Repo Tests	❌ 0/0 passed (go)
🤖 AI Tests	⚠️ 0/9 passed

_{Powered by QualityMax — AI-Powered Test Automation}