[timeleft--]

Addresses the concrete review comments on upstream PR #323. Targets the existing contribution branch so the upstream contribution remains one PR.

• Move the application to apps/mcp / ansari-mcp, use the root lockfile and shared lint configuration, filter root commands and CI inputs, and build the compiled-only container from the repository root.
• Restore the legacy answer_islamic_question discovery contract with read-only/open-world annotations, validate 1–4000-character questions, pass the SDK request signal to upstream fetch, and make configured allowlists replace development defaults.
• Gate beta/production deployment aliases before build or Wrangler, retain installed SDK/application/artwork/font licence notices in the distributed HTML, and correct current documentation to stable SAGA 0.7.6.

Validation passed: app lint/typecheck, Node and Worker builds, 142 server/packaging tests, 73 browser checks, uncached Node 22 container build plus isolated smoke, public-registry production release check, Turbo command selection and Gitleaks. Dependency snapshots are unchanged from the base contribution. The walkthrough's 17 embedded source files match the application.

The actual 60-second request deadline cancels upstream fetch in Node and local Workers. A disconnected local Worker caller does not immediately close the upstream socket; the deadline still bounds it. Existing host receipts retain their original revisions and dates. This PR performs no deployment and makes no new stable-version Alexa acceptance claim. Upstream merge remains a maintainer decision.

[yia-mw-agent]

Helmet-Review-Request: #3 (comment)

Reviewed the full merge-base-to-head diff against codex/ansari-faithful-answers-076 (merge-base 137c96a, head fc40c24, 94 files, six commits). No material defects found.

Examined:

• Workspace move to apps/mcp / ansari-mcp: root lockfile importer, catalog typescript/eslint, shared @ansari/eslint-config, root --filter=!ansari-mcp task exclusions, and the scoped @a2ui/react@0.13.0>@a2ui/markdown-it override.
• Root-context Dockerfile, expanded root .dockerignore (committed .env.ci / .env.example files stay available to the api and auth images), verify-container.sh and the new mcp.yml workflow.
• Legacy answer_islamic_question contract: description, readOnlyHint/openWorldHint, 1-4000 character validation, and the request signal passed to upstream fetch.
• runtime-config.ts: configured host and origin lists replace the local defaults, including an explicitly empty list.
• Release gates: importer-scoped lockfile reading in check-release.mjs, and the beta/production deploy scripts running the gate before build or Wrangler.
• Licence notices embedded in the distributed HTML, and the SAGA credit link.

Validation run at the exact head (fc40c24, verified with git rev-parse HEAD):

• pnpm install --frozen-lockfile --strict-peer-dependencies --filter ansari-mcp... passed.
• The same install from a Dockerfile-shaped context (root manifests, packages, apps/mcp/package.json only) also passed.
• pnpm mcp lint, typecheck, build and build:worker (Wrangler dry run) passed.
• pnpm mcp test: 142 of 142 passed.
• Browser checks: 73 checks, no errors.
• check:release --target production passed against the public registry.
• Live PR checks are all green: MCP application (includes the container build and smoke), api, auth, frontend, gitleaks.

Not run locally: the Docker image build, because no Docker daemon is available here. The MCP application CI job covers it and passed.

Non-blocking observations:

• apps/mcp/wrangler.jsonc sets MCP_ALLOWED_ORIGINS to an empty string, which now means no browser Origin is accepted (clients that send no Origin header are unaffected). This matches the new explicit-empty semantics and is covered by tests, but deployers should know before enabling browser clients.
• Root pnpm typecheck, test and build now exclude ansari-mcp, so only mcp.yml and root lint cover it. That is deliberate, and the path filters in mcp.yml are comprehensive.