[aleksUIX]

Pass the originating HTTP request to the comply_test_controller context factory using the dispatch helper already used by ordinary MCP tools. Factories can then read request-scoped identity, tenant state, and headers consistently.

Add stateful and stateless HTTP regressions for request-state and built-in factories. The tests exercise bearer middleware and principal-scoped sandbox account resolution, assert store context and per-call headers, and retain non-HTTP and legacy-store coverage.

The confirmed failure is missing request metadata for documented custom factories. Built-in authentication retained identity through its ContextVar fallback with MCP 2.3.0 in the baseline control, so this does not claim to reproduce the broader identity-loss report on that version.

Validation: all four HTTP regressions fail on the unchanged controller source and pass with the fix. The controller-context, stateful-session, and account-mode-gate suites pass, 59 tests total. Source lint and all type-check contracts pass on Python 3.12.13. Hosted CI passes on this head, including the Python 3.10 to 3.13 suites, Postgres conformance and the storyboard runners. A local make ci-local run reported 15 failures and 4 errors in reporting interop and installed-artifact tests; those same tests pass in the hosted Python 3.12 job.

Refs #1821.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean, well-tested bug fix with no blocking or medium findings.

What I checked:

• comply_test_controller now passes request_context=_get_starlette_request_for_dispatch() into RequestMetadata (test_controller.py:1518-1522), mirroring the ordinary-tool path at serve.py:3376-3381. This fixes the real bug where the controller passed request_context=None, breaking factories that read request.state (middleware-set principal/tenant) under streamable-http.
• Test coverage is genuine: asserts request_context is not None (test:202, fails on base source), parametrized across stateful/stateless and request-state/built-in factories with real bearer middleware.
• Correct fix: conventional-commit prefix; no public-API, forward-compat, generated-code, import-layering, or ctx_metadata/credential concerns.
• high_risk is true only via src/adcp/server/test_controller.py (modified), but the reviewer found no medium-or-higher concerns, so the modification is presumed safe (row 5 does not fire).

Decision path: No critical/high findings (row 1 no). gated_paths is false (row 2 no). No deletions (row 3 no). No medium findings (rows 4, 5, 8 no). No prior escalation (row 6 no). No no-auto-approve team match (row 7 no). Falls through to row 9 → approve.

Note: the signer overlay (apply_verified_signer) is not applied on the controller path, but the controller is sandbox-only and this is pre-existing — non-blocking.