fix(mcp): enforce product scope guardrails

backend/src/mcp/note-tools.ts

@@ -42,7 +42,15 @@ export interface NotesMcpTool<TInput> {
   execute(args: TInput, req: NotesMcpRequest): Promise<unknown>;
 }
 
+function requireProductScope(req: NotesMcpRequest): void {
+  const requestProductId = req.jwtPayload?.productId;
+  if (requestProductId && requestProductId !== PRODUCT_ID) {
+    throw new Error(`Product scope mismatch: expected '${PRODUCT_ID}'`);
+  }
+}
+
 function requireUserId(req: NotesMcpRequest): string {
+  requireProductScope(req);
   const userId = req.jwtPayload?.sub;
   if (!userId) {
     throw new Error('Authenticated user is required');

docs/roadmaps/05_MCP_AGENT_ROADMAP.md

@@ -34,10 +34,10 @@ Parent: `docs/ROADMAP.md`
 
 # Phase A3 — Operational Hardening
 
-- [ ] Workspace/product scoping guardrails
+- [x] Workspace/product scoping guardrails
 - [ ] Audit verification for mutating tools
 - [ ] Safe usage docs and runbooks
-- [ ] Regression tests for mutating tool paths
+- [x] Regression tests for mutating tool paths
 - [ ] Review `mcp-server` integration against auth boundaries
 
 # A2A Follow-On Work
@@ -71,6 +71,10 @@ Parent: `docs/ROADMAP.md`
   - an adapter that exports the note tools in a shape compatible with shared `mcp-server` registration
   - a clear product-side handoff point for future shared-server wiring
   - backend verification still passing after the adapter layer was introduced
+- 2026-03-10 — Product-side MCP hardening advanced:
+  - executable tools now reject mismatched `productId` scope at runtime
+  - regression coverage now asserts mutating calls do not persist when scope is invalid
+  - core tools remain workspace-scoped through input contracts and repository calls
 
 # Open Questions
 

docs/roadmaps/07_QA_RELEASE_DOCS_ROADMAP.md

@@ -24,7 +24,7 @@ Parent: `docs/ROADMAP.md`
 - [x] MCP tool tests
 - [ ] Approval workflow tests
 - [ ] Audit verification tests
-- [ ] Regression coverage for agent-mediated note changes
+- [x] Regression coverage for agent-mediated note changes
 
 # Phase Q3 — Release
 
@@ -53,6 +53,7 @@ Parent: `docs/ROADMAP.md`
   - `backend` `npm run typecheck` passes
   - `backend` `npm test` passes
   - MCP contract tests and executable MCP tool tests now pass
+  - MCP scope-guard regression tests now pass for invalid product-scoped mutating requests
 
 # Open Questions