The #35 data gate could never fill: a real review call routed cleanly to
qwen36 but /pass-rate stayed total:0 under every key. Root cause was three
independent defects in the session_log path, each alone fatal:
- A: a successful routed call logged final_status "skip", never "pass".
/pass-rate computes pass/(pass+fail) and skips count as neither, so the
>=0.90 gate was mathematically unreachable. Success now logs "pass".
- B: every record was written under skill "_routing", so /pass-rate?skill=
review|debug (what #35 measures) always read zero. Now uses the real
e.Skill; routing decisions stay groupable via session_id "_routing".
- C: the session_log POST to the bearer-gated ingestion /mcp carried no
Authorization header → silent 401, swallowed by best-effort logging
(the documented mcpclient-empty-token-silent-401 footgun). Logger now
takes a token (BRAIN_MCP_TOKEN) and sets the bearer when non-empty.
Tests rewritten to assert correct behavior (they had encoded the bugs:
"skip" on success, "_routing" skill). New test covers the auth header and
the empty-token path.
Infra (BRAIN_MCP_TOKEN ExternalSecret + env on the routing deployment) and
redeploy follow separately. Refs #73, #35.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>