[devin-ai-integration]

What and why

develop's SonarCloud quality gate is ERROR on new_security_rating = 3 (threshold 1) and a release needs it green. The unauthenticated API lists exactly three unresolved new-code issues, all created 2026-10-18 by the MCP-registry work, and no security hotspots:

Rule	File	Line	Fix
shell:S6506 HTTPS should be enforced on HTTP clients following redirects	scripts/install-mcp-publisher.sh	45	curl --proto '=https' --tlsv1.2 -fsSL --retry 3 …
shell:S6506	scripts/mcp-registry-publish.sh	80	curl --proto '=https' --tlsv1.2 -fsSL …
text:S8564 JavaScript dependency lock file should be committed	packaging/npm/sysml-mcp/package.json	—	commit packaging/npm/sysml-mcp/package-lock.json

Verified with api/qualitygates/project_status?projectKey=Open-MBEE_OpenSysML&branch=develop (status ERROR, new_security_rating actual 3), api/issues/search?componentKeys=Open-MBEE_OpenSysML&branch=develop&resolved=false&sinceLeakPeriod=true (the three rows above are the only issues of type VULNERABILITY / security impact) and api/hotspots/search?projectKey=Open-MBEE_OpenSysML&branch=develop (0 hotspots). Nothing is marked won't-fix; nothing was changed in SonarCloud.

curl. Both URLs were already literal https:// strings, but -L followed any redirect, so a Location: header could have moved the download to plain HTTP. --proto '=https' makes curl refuse every scheme but HTTPS on the first request and on each redirect hop; --tlsv1.2 refuses older TLS. The fail (-f), silent (-s), redirect (-L), retry (--retry 3) and output flags are unchanged. Probe with a local redirector: https://localhost → Location: http://localhost is followed by the old invocation and rejected by the new one (curl: (1) Protocol "http" not supported / exit 1).

Lockfile. @openmbee/sysml-mcp is the runner that depends only on its five optional platform packages. The lockfile is generated with the npm the nightly publish-npm job pins (npm@11.21.0, npm install --package-lock-only --ignore-scripts), is lockfileVersion 3 like client/node/package-lock.json, and carries the root entry only because the platform packages are not on npm yet (the same state client/node's lockfile is in before a release, see docs/project/releasing.md). .gitignore ignores no package-lock.json; .npmignore/files in the runner's package.json do not touch it (npm never publishes a lockfile anyway); the CircleCI npm pack / scripts/npm-mcp-test.sh flow installs from tarballs and is unaffected. TestMCPRunnerLockfileAgreesWithTheManifest (tests/hygiene) now fails when a release bump leaves the lockfile behind, mirroring the existing client/node test, and the release procedure regenerates both lockfiles.

How SonarCloud will see this

The SonarCloud scan is a CircleCI job filtered to main and develop (.circleci/config.yml, scan with filters: *integration-branches), so no PR-mode analysis runs on this PR — api/project_pull_requests/list shows no entry for 1329 and there is no Sonar check here to be green. The develop gate runs in branch mode against the new-code period: this diff closes the three issues above (both shell:S6506 lines are rewritten; text:S8564 is a project-level issue that clears once the lockfile exists beside package.json), and no other new-code security issue or hotspot is open, so new_security_rating on develop is expected to return to A (1) on the first develop analysis after the merge. That develop run is the proof; please re-read api/qualitygates/project_status?projectKey=Open-MBEE_OpenSysML&branch=develop once it has run.

Note that develop's gate has since gained a second failing condition this PR does not touch: new_reliability_rating = 4 from one typescript:S2871 bug at editors/vscode/src/webview/diagram.ts:511 (a .sort() on relationship kinds without a compare function, created 2026-10-20 by the diagram-panel work). Clearing the security rating here leaves the gate ERROR until that is fixed too.

In-flight overlap

Checked all 19 open PRs (refs/pull/*/head) and every PR-less branch in git ls-remote --heads origin for edits to scripts/install-mcp-publisher.sh, scripts/mcp-registry-publish.sh, packaging/npm/sysml-mcp/, packaging/mcp/ or .github/workflows/mcp-registry.yml against their merge base with develop:

• No open PR and no PR-less branch touches any of these paths.
• chore(docs): name the project OpenSysML MDK #1324 (chore/mdk-brand-name) changes README/CONTRIBUTING/AGENTS/docs and .github/workflows/pr.yml only — nothing here.
• feat(mcp): serve the Model Context Protocol over Streamable HTTP #1275 (feat/mcp-http), the only other MCP PR, changes the MCP server sources only — nothing here.

No changelog fragment: the registry publish scripts and the npm runner are themselves unreleased (changes/unreleased/mcp-registry.added.md, mcp-npm-runner.added.md), so there is no released behaviour to describe a change to.

How it was verified

How CI runs the scripts. .github/workflows/mcp-registry.yml (MCP Registry, on release published / workflow_dispatch) runs scripts/mcp-registry-publish.sh "$TAG", which calls scripts/install-mcp-publisher.sh (line 45 download of mcp-publisher_<platform>.tar.gz from GitHub releases) and then polls https://registry.npmjs.org/<pkg>/<version> (line 80) before mcp-publisher login dns / publish. make mcp-registry-check → scripts/mcp-registry-publish.sh --check validates without credentials. CircleCI's publish-npm builds and publishes the npm packages (npm ci in client/node, npm pack the runner, scripts/npm-mcp-test.sh).

Dry runs of the changed invocations (real network, no credentials, nothing published):

$ rm -rf build/mcp-publisher && scripts/install-mcp-publisher.sh      # line 45
build/mcp-publisher/mcp-publisher
mcp-publisher 1.8.1 ...

$ scripts/mcp-registry-publish.sh --check v0.10.1                    # downloads the publisher again, validates server.json
✅ server.json is valid
server.json is valid for org.opensysml/sysml-mcp 0.10.1

$ MCP_REGISTRY_PRIVATE_KEY=<throwaway Ed25519 key> MCP_REGISTRY_NPM_TIMEOUT=0 scripts/mcp-registry-publish.sh v0.10.1
Error: @openmbee/sysml-mcp@0.10.1 is not on registry.npmjs.org after 0s; …   # line 80 ran, -f turned the 404 into the expected fail-fast

$ curl --proto '=https' --tlsv1.2 -fsSL -o f "https://registry.npmjs.org/@openmbee%2Fopensysml/0.10.1" && jq -r .version f
0.10.1                                                               # the same line against a package that is on npm: 200, parsed

$ # temp copy of the script with server.json's identifier swapped to @openmbee/opensysml (which exists on npm):
Error: @openmbee/opensysml@0.10.1 declares mcpName '<none>' on npm; the registry requires 'org.opensysml/sysml-mcp' …
                                                                     # the loop exited on success and reached the mcpName check

Lockfile test is load-bearing: mutating the lockfile's root version to 0.10.0, and separately pinning @openmbee/sysml-mcp-linux-x64 at 0.10.0, each fails TestMCPRunnerLockfileAgreesWithTheManifest with the regeneration hint; the committed file passes.

Gate (this branch, VM):

go build ./...                                   ok
go vet ./...                                     ok
gofmt -l .                                       (empty)
shellcheck scripts/install-mcp-publisher.sh scripts/mcp-registry-publish.sh   clean
python3 scripts/changelog.py check               ok
go test ./...                                    all packages ok except tests/codegen, which hit go test's
                                                 10m default timeout while make lint ran beside it;
                                                 go test -count=1 -timeout 40m ./tests/codegen alone: ok (303s)
go test -C tools ./...                           ok
make lint                                        ✓ Lint passed (gofmt, go vet, staticcheck, gosec — root and tools)

Checklist

• make test and make lint pass locally
• Tests added or updated for the change
• Documentation extended where it already covers the surface (see CONTRIBUTING.md)
• Changelog entry added as changes/unreleased/<slug>.<section>.md, not as an edit to CHANGELOG.md — not needed, see above
• baselines regenerated and make docs-counts run if a gate count moved (compliance rows need nothing: the census is counted at docs build) — no count moved
• No internal work-item labels (waves, slices, F4, K5) in the body, docs, or changelog

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/2ce4197c3a6c4c13982380aaf8d6f857
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/2ce4197c3a6c4c13982380aaf8d6f857?variant=devin
Requested by: @HuiJun

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring