API - CODEX AGENTS: MCP transport and real e2e smoke

docs/IMPLEMENTATION_PLAN.md

@@ -23,7 +23,7 @@ Exit criteria:
 
 ## Phase 1. Agent Gateway skeleton
 
-Status: in progress. Initial service, migrations, persistence endpoints, token hashing, bearer-token session auth, product tool endpoints, local Postgres compose, and Gateway smoke checks are implemented.
+Status: done in `e95cb3a`, `112522c`, `14c5f49`, `9f40207`, and the MCP transport slice. Initial service, migrations, persistence endpoints, token hashing, bearer-token session auth, product tool endpoints, local Postgres compose, and Gateway smoke checks are implemented.
 
 Create standalone service with:
 
@@ -36,7 +36,7 @@ Create standalone service with:
 - opaque token hashing;
 - idempotency-key storage.
 
-No Tasker writes yet.
+Tasker writes are available through the narrow internal adapter; Gateway still must not call raw Plane routes.
 
 ## Phase 2. Launcher entitlement projection
 
@@ -89,6 +89,8 @@ Acceptance:
 - adapter rejects delete/archive;
 - adapter validates labels/states/assignees.
 
+Status: initial product slice done in Tasker commit `2ae353c`. Implemented project resolution/context, issue search/create/update/move/comment/label/assign, agent bot actor metadata, and internal token auth. `add_existing_project_member` remains planned behind the explicit `project:member:add_existing` scope.
+
 ## Phase 5. MCP server
 
 Agent Gateway changes:
@@ -109,6 +111,8 @@ Acceptance:
 - local Codex can move card state;
 - local Codex cannot delete/archive.
 
+Status: initial product slice implemented. `/mcp` supports JSON-RPC `initialize`, `ping`, `tools/list`, and `tools/call`. REST product endpoints and MCP tools share the same runtime, scope checks, grant checks, and Tasker adapter calls. `npm run smoke:mcp:e2e` verifies real local Tasker writes.
+
 ## Phase 6. Agent identity
 
 Tasker/Gateway integration: