refactor(mcp): port adapters (external I/O wrapper)

[esifea]

Summary

• What changed: Implement adapters in Go
• Why:
• Scope: internal/adapters, go.mod, go.sum

Validation

• Tests run (or explain why not):
• Docs updated (if behavior/setup changed)

Cross-Agent Invariants

• scripts/bootstrap-mcp.sh remains the single source of truth for runtime prep (venv/deps/self-heal)
• No agent-specific script duplicates bootstrap/setup logic
• Agent-specific scripts remain thin adapters (registration/wiring only)
• Codex-only commands (codex mcp ...) are clearly separated from cross-agent/common instructions
• Claude/Gemini/OpenAI instructions do not include Codex-only commands
• SKILL.md, commands/rune/*.toml, and AGENT_INTEGRATION.md stay consistent on boundaries

Notes for Reviewers

• Risk areas:
• Backward compatibility impact:
• Follow-up work (if any):

[couragehong]

internal/adapters/vault/errors.go:117-130 의 statusFromError 가 실제 gRPC 에러와 시그니처 안 맞아서 MapGRPCError 가 모든 gRPC status 를 VAULT_INTERNAL 로 fallback 시킵니다.

// errors.go L117-130 (PR #95 head a13d174)
func statusFromError(err error) (grpcStatus, bool) {
    type grpcStatuser interface {
        GRPCStatus() interface {
            Code() int           // ← int 요구
            Message() string
        }
    }

    if gs, ok := err.(grpcStatuser); ok {
        ...
    }
    return grpcStatus{}, false
}

• 실제 *status.Error 의 GRPCStatus() 는 *status.Status 를 리턴하고, (*status.Status).Code() 는 codes.Code (= uint32) 를 리턴합니다.
• Go interface 만족 검사는 시그니처 정확 일치라서 named type codes.Code 가 int 와 매치 안 됨 → type assertion fails.

err := status.Error(codes.Unauthenticated, "wrong token")
if _, ok := err.(grpcStatuser); ok { /* 절대 안 들어옴 */ }
// 실제 출력: "DID NOT MATCH — type assertion failed for *status.Error"

Vault 응답	기대 매핑	현재 매핑
Unauthenticated	VAULT_AUTH_FAILED (retryable=false)	VAULT_INTERNAL (retryable=true) ❌
NotFound	VAULT_KEY_NOT_FOUND (retryable=false)	VAULT_INTERNAL (retryable=true) ❌
Unavailable	VAULT_UNAVAILABLE	VAULT_INTERNAL — code 부정확
DeadlineExceeded	VAULT_TIMEOUT	VAULT_INTERNAL — code 부정확

특히 Unauthenticated(토큰 만료/무효) 가 retryable=true 로 잘못 마킹돼 에이전트가 잘못된 토큰으로 무한 재시도 트리거합니다. recovery hint 도 모두 generic 하게 나가서 사용자가 토큰/네트워크/키 문제 분간 불가능

---

google.golang.org/grpc/{codes,status} 직접 import 해서 status.FromError(err) + codes.* 를 사용하는게 어떨까 싶습니다?!

couragehong/feat/vault-grpc 브랜치의 commit 7a8199c 에 동일 수정 들어가 있고, unit test TestMapGRPCError_CodeMatrix 가 6 gRPC code 케이스로 검증해두었습니다. (별도 PR).

[couragehong]

I think this needs a timeout. http.DefaultClient has no timeout, so if vault is unresponsive and caller doesn't set a ctx deadline, the call hangs. My suggest is set timeout like &http.Client{Timeout: 5 * time.Second}.