test: cover client response posts across MCP handlers

[jstar0]

Summary

Valid JSON-RPC responses sent by Streamable HTTP clients used to pass through a
request-only authorization layer, which rejected them as malformed and broke
server-initiated MCP requests. The production vMCP handler no longer installs
that legacy layer after #5556, but the client-response path lacked end-to-end
regression coverage.

This adds coverage for the vMCP handler and the ordinary proxy layers used by
stdio thv run, thv proxy, and remote Streamable HTTP runs.

Changes

The vMCP integration test verifies that:

• the client response POST returns 202 Accepted with an empty body;
• the elicitation response is correlated and delivered to the server;
• the outer tool call completes with the expected result; and
• the retired request-only authorization middleware remains absent from the
  production handler chain.

The streamable proxy specification test POSTs a JSON-RPC client response and
verifies 202, an empty body, and forwarding to the destination. A complementary
transparent proxy regression exercises the ReverseProxy/RoundTrip layer used by
thv proxy and remote Streamable HTTP transport, verifying that an upstream
202 and empty body are preserved while the response reaches the backend.

The changes are test-only and do not modify runtime behavior.

Verification

GOFLAGS='-run=^(TestHandler_AcceptsClientResponsePost|TestPOSTNotificationAndClientResponseAccepted|TestStreamableHTTPTransparentProxyForwardsClientResponse)$' task test

Closes #5009

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.45%. Comparing base (8efeeb3) to head (5aaa720).
⚠️ Report is 84 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5885      +/-   ##
==========================================
- Coverage   71.48%   71.45%   -0.03%     
==========================================
  Files         694      694              
  Lines       70971    70971              
==========================================
- Hits        50735    50714      -21     
- Misses      16577    16598      +21     
  Partials     3659     3659              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ChrisJBurns]

Test-only PR with genuine regression value for the client-response → 202 path. I applied it to current main and it passes under -race. A few small things would make it clearer/stronger:

Scope of Closes #5009: the issue's "where to fix" points at pkg/transport/proxy/streamable/ and its impact section mentions non-vMCP proxy pings too. This test only covers the vMCP server path. Can you confirm the general thv run / thv proxy streamable transport also returns 202 for client-response POSTs? If not, this closes only half of #5009 — worth either adding coverage there or noting the remaining gap on the issue before it's auto-closed.

Housekeeping: the branch is ~84 commits behind main and CI hasn't reported. Mind rebasing so the parity/lint suites run green before merge? (It still applies cleanly and passes locally, so no real conflict expected.)

[jstar0]

Addressed in 87de7ebc:

• made the vMCP test negotiate the session-based Legacy revision through the
  existing capability gate and assert the selected protocol version;
• made an early tool-call failure surface immediately instead of timing out;
• clarified the retired authz canary and observation-drop behavior; and
• confirmed the ordinary thv run / thv proxy Streamable HTTP path already
  accepts and forwards client responses, then added a real HTTP regression test
  for 202, an empty body, and destination forwarding.

The two focused tests passed under -race -count=10, both complete affected
packages passed under -race, and the same checks passed after merging the PR
head into current main.

[jstar0]

Thanks for the scope check. I re-verified the ordinary transport layers and expanded the regression coverage:

• pkg/transport/proxy/streamable now covers the NewHTTPProxy path used by stdio thv run, including 202, an empty body, and forwarding of the JSON-RPC client response.
• pkg/transport/proxy/transparent now covers the ReverseProxy/RoundTrip path used by thv proxy and remote Streamable HTTP transport, including forwarding the response to the backend and preserving the upstream 202 with an empty body.
• The vMCP integration test continues to cover the production Serve path and response correlation.

I rebased onto current main (6f04df42) and pushed head c5abd68d. The focused race run passed with the repository Taskfile:

GOFLAGS='-run=^(TestHandler_AcceptsClientResponsePost|TestPOSTNotificationAndClientResponseAccepted|TestStreamableHTTPTransparentProxyForwardsClientResponse)$' task test

A full local task test still reports unrelated environment/baseline failures in cmd/thv-operator/pkg/httpclient, pkg/api, pkg/ignore, and pkg/oauthproto/tokenexchange; task lint likewise reports four findings outside the changed files. GitHub currently has not reported checks for this branch. Could you re-review the updated scope and rebased head when convenient?