mcp: adopt protocol revision 2026-07-28 and add otel audit log format; fix build date stamping (#729, #704) - #732

Closes #729, closes #704.

Part 1: MCP protocol revision 2026-07-28 (#729)

Bumps github.com/modelcontextprotocol/go-sdk v1.0.0 -> v1.7.0 (jsonschema-go, jwt and x/time follow transitively). The SDK owns version negotiation (server/discover, per-request _meta, and the legacy initialize handshake) and advertises 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05. Three stackql-side changes were needed for the headline feature (safe-mode gated writes) not to regress:

Design decision to review, server.stateless: the SDK serves 2026-07-28 over Streamable HTTP only in stateless mode, and in that mode a legacy client gets an ephemeral session per request, so the elicitation capability it declared at initialize is not retained and it cannot approve gated writes. A stateful server keeps legacy sessions and elicitation intact, and a 2026-07-28 client learns the supported versions from server/discover and negotiates down (the bundled client lands on 2025-11-25). So the HTTP default stays stateful (no regression for existing hosts) and "stateless": true opts into native 2026-07-28 serving. stdio serves every revision on one process with no switch. Documented as a support matrix in docs/mcp.md.

Audit of the other task items: no cross-call state exists to move behind handles (mode, audit and provider auth are process configuration); tools/list / prompts/list / resources/list are static registrations, so already connection-invariant; the HTTP transport has no OAuth surface in this server, so the authorization hardening items do not apply.

Part 2: --mcp.log.format otel (#729)

• pkg/sink/otel.go (generic, per review feedback): sink.NewOTelSink(inner, resource, scope) decorates any Sink with the OTLP/JSON encoding. It owns the envelope (resource, scope, schema URLs), attribute typing, severity text and trace-id correlation. A payload that implements sink.OTelRecorder supplies its own log records; any other JSON-shaped record is decorated generically (compact JSON body, top-level scalar fields as typed attributes), so it is equally usable for result rows or other log channels.
• pkg/mcp_server/audit/otel.go keeps only the MCP-specific part: Event.OTelLogRecords() maps an audit event onto the GenAI/MCP attributes (one record per tool invocation plus one per elicitation decision), and audit.NewOTelSink binds the stackql resource and this package's schema scope. Each Event still lands as one LogsData per line. One log record per tool invocation plus one per elicitation decision for calls that went through the gate; both share gen_ai.tool.call.id and a trace id. A W3C traceparent in params._meta is honoured, otherwise one trace id is generated per MCP session (map bounded at 1024 sessions).
• Attribute set: gen_ai.operation.name=execute_tool, gen_ai.tool.name, gen_ai.tool.call.id, mcp.method.name, mcp.protocol.version, mcp.session.id, stackql.query, stackql.query_class, stackql.provider, stackql.query.source, stackql.mode, stackql.decision, stackql.duration_ms, stackql.rows_returned, and error.type / error.message on failure. Pinned as instrumentation scope github.com/stackql/stackql/pkg/mcp_server/audit version 1.0.0 with schemaUrl https://opentelemetry.io/schemas/1.44.0; TestOTelEncode_ToolInvocationAttributeSchema asserts the exact set.
• Transport context (ProtocolVersion, SessionID, TraceParent, RowsReturned) rides on audit.Event.Wire with json:"-", so the default jsonl output is byte-identical to today (asserted).
• Selection: server.audit.format in mcp.config, overridden by the new --mcp.log.format flag (jsonl default, otel); validated in Config.Validate.
• Verified against a stock collector: otelcol-contrib 0.160.0 with the otlp_json_file receiver and the debug exporter decodes resource, scope, schema URLs, attributes and trace/span ids from the file with no transform processor (the otlpjsonfile alias is deprecated upstream; docs use the current name).
• Redaction parity: result values are never serialised in either format; row values the client received are asserted absent from both logs while the verbatim SQL (including a RETURNING mutation) is present.

#704: build metadata stamping

• winbuild sets $env:BUILDDATE (ISO-8601 UTC) in "Generate Build Flags and Build"; the seven bash jobs now use date -u +%Y-%m-%dT%H:%M:%SZ instead of the locale-dependent $(date), so build_date is uniform and parseable across platforms.
• {{.Minor}}} -> {{.Minor}} in the three goreleaser configs.
• Optional hardening taken: cmd/root.go init() falls back to debug.ReadBuildInfo() vcs.time when the BuildDate ldflag is empty, so local builds report a build date. The package-level ldflag targets are untouched (still written only by the linker); the fallback only shapes the value handed to buildinfo.Init.

Tests

Go (pkg/mcp_server, pkg/mcp_server/audit):

• Existing accept / decline / cancel gate tests now run on 2026-07-28 via the SDK client.
• New raw-connection conformance tests: TestLegacyRevisionClient_SafeModeApprovalViaElicitationRequest (2025-06-18 handshake, server-initiated elicitation/create), TestCurrentRevisionClient_SafeModeApprovalViaInputRequests (_meta, input_required, inputResponses accept and decline), TestCurrentRevisionClient_SafeModeRefusesWithoutElicitation.
• pkg/sink/otel_test.go: generic record decoration (typed attributes, key order, empties dropped, JSON body), struct and scalar payloads, OTelRecorder envelope (resource/scope/schema URL, observed vs record time, severity text), trace context (traceparent honoured, malformed falls back, correlation key sharing, bounded key map), wire shape, Close and inner-error propagation.
• pkg/mcp_server/audit/otel_test.go: attribute schema (pinned 1.0.0), elicitation decision record and error typing, trace context propagation, redaction parity with JSONL.

Robot (mcp.robot, 11 new scenarios, 65 total): the Python harness (mcp_stdio_client.py) gained a 2026-07-28 stateless client and a 2025-06-18 elicitation-capable client for both transports.

• stdio: current-revision gated write approved and declined via input requests; legacy-revision gated write approved and declined via elicitation/create.
• HTTP: legacy handshake still served (stateful 9912); current-revision client without handshake or session on the new sessionless 9926 server; legacy handshake still served on 9926 (no session issued); stateful 9912 rejects a raw _meta-versioned request while the bundled client negotiates down; current-revision gated write approved and declined over sessionless HTTP.
• Audit: new 9925 server started with --mcp.log.format=otel; asserts OTLP/JSON shape per line, the GenAI/MCP attributes, stackql.rows_returned, and that row values are absent from both the otel and the JSONL (9923) logs while the SQL is present, and that no wire-context keys leak into JSONL.

Docs: docs/mcp.md gains a protocol revision support matrix (with the stateful/stateless HTTP trade-off), the --mcp.log.format reference with a collector config, and the pinned attribute schema table.

Test plan

• go build --tags sqlite_stackql ./..., go test -timeout 1200s --tags sqlite_stackql ./... pass.
• golangci-lint run (v2.5.0) 0 issues.
• Mcp robot suite locally: 65/65 (sqlite, native).
• OTel output ingested by otelcol-contrib 0.160.0 otlp_json_file receiver.
• CI green.

Out of scope, as the issue states: OTLP network exporter, ClickHouse sink, metrics and spans.