[bandzalkin]

Why

Codex needs to acquire external MCP servers when a room connection starts, rather than reuse credentials and configuration captured before that room existed. MCP resolution, native startup, and teardown must have one owner so a cancelled or failed startup cannot leave a child process or credential-bearing resources behind.

What changes

• Add a room-scoped asynchronous MCP resolver and immutable stdio/HTTP descriptors. Acquire and freeze the snapshot inside retained Codex startup, preserving Band's reserved server and explicit launch precedence.
• Deliver bearer tokens, headers, and protected environment values through secret aliases rather than embedding grants in native arguments or public descriptor representations. Keep transport diagnostics to event kinds and lengths.
• Accept only absolute HTTP(S) endpoint URLs with a host and no userinfo, query string, or fragment, including empty query/fragment delimiters. Endpoint origins and paths remain public; authentication belongs in protected bearer-token or header fields. Invalid URL diagnostics do not repeat the supplied value.
• Retain startup, readiness, child-process, and retry custody until physical teardown settles. Preserve POSIX process-group cleanup and refuse secret-bearing stdio launches where Windows cannot provide the required protection.

Validation

Tests cover descriptor validation and redaction, launch precedence, resolver failure, concurrent startup, cancellation, reconnect, and process cleanup. I also verified protected bearer delivery with an actual Python child.

[bandzalkin]

Closing: band-agent does not consume this; may be re-proposed per feature.