canary: migrate the banana bot to mcp 2.x; e2e: keep failure evidence

.github/k8s/sam-node-cop-template.yaml

@@ -42,7 +42,7 @@ spec:
         - "/bin/bash"
         - "-c"
         - |
-          pip install --no-cache-dir httpx mcp &&
+          pip install --no-cache-dir httpx 'mcp>=2,<3' &&
           python -u /app/banana_bot_playground.py
         env:
         - name: SAM_MCP_URL

.github/workflows/e2e.yml

@@ -77,4 +77,8 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: e2e-logs-${{ env.JOB_NAME }}-${{ github.run_id }}
-          path: ./_artifacts
+          # tests/e2e/logs is where the bats harnesses dump container logs
+          # for tests that did not complete (see mesh_cleanup_test_resources).
+          path: |
+            ./_artifacts
+            ./tests/e2e/logs

site/content/docs/snippets/banana_bot_playground.py

@@ -6,7 +6,7 @@
 import httpx
 from typing import Optional, Dict, Any, List
 from mcp import ClientSession
-from mcp.client.streamable_http import streamablehttp_client
+from mcp.client.streamable_http import streamable_http_client
 
 class SamClient:
     """Inlined SAM Client for self-contained execution."""
@@ -25,19 +25,35 @@ async def connect(self):
         headers = {"Accept": "application/json, text/event-stream"}
         if self.token:
             headers["Authorization"] = f"Bearer {self.token}"
-        self._sse_cm = streamablehttp_client(self.server_url, headers=headers)
-        read_stream, write_stream, _ = await self._sse_cm.__aenter__()
-        self.session = ClientSession(read_stream, write_stream)
-        await self.session.__aenter__()
-        await self.session.initialize()
+        self._http_client = httpx.AsyncClient(
+            headers=headers,
+            follow_redirects=True,
+            # The SDK's SSE-friendly defaults; httpx's default 5s read timeout drops the stream.
+            timeout=httpx.Timeout(30.0, read=300.0),
+        )
+        try:
+            self._sse_cm = streamable_http_client(self.server_url, http_client=self._http_client)
+            res = await self._sse_cm.__aenter__()
+            read_stream, write_stream = res[0], res[1]
+            self.session = ClientSession(read_stream, write_stream)
+            await self.session.__aenter__()
+            await self.session.initialize()
+        except Exception:
+            # The retry loop in __aenter__ would otherwise orphan this
+            # attempt's http client and half-entered streams.
+            await self.close()
+            raise
 
     async def close(self):
         if self.session:
             await self.session.__aexit__(None, None, None)
         if self._sse_cm:
             await self._sse_cm.__aexit__(None, None, None)
+        if getattr(self, "_http_client", None):
+            await self._http_client.aclose()
         self.session = None
         self._sse_cm = None
+        self._http_client = None
 
     async def get_tools(self) -> List[Dict[str, Any]]:
         if not self.session:

tests/e2e/a2a_mesh.bats

@@ -81,11 +81,21 @@ teardown() {
 
   # The label the provider attests (region=eu) is admitted end to end over
   # the real attestation chain — same stock client, labels via header.
+  # Retried: the gate fail-closes a slow biscuit-fetch handshake into the
+  # same 403 as a denial ("labels unverifiable: ... context deadline
+  # exceeded", seen under CI load); a genuine denial fails all attempts.
   echo "[$(date +%T)] Labelled send (region=eu) must be admitted"
-  run docker run --rm --network "${MESH_NETWORK}" \
-    -e SAM_API_TOKEN="secret-token" \
-    -e SAM_REQUIRED_LABELS="region=eu" \
-    "${A2A_ECHO_IMAGE}" python3 /workspace/client.py "${mesh_base}" "hello eu"
+  local attempt
+  for attempt in 1 2 3; do
+    run docker run --rm --network "${MESH_NETWORK}" \
+      -e SAM_API_TOKEN="secret-token" \
+      -e SAM_REQUIRED_LABELS="region=eu" \
+      "${A2A_ECHO_IMAGE}" python3 /workspace/client.py "${mesh_base}" "hello eu"
+    [[ "$status" -eq 0 ]] && break
+    echo "labelled attempt ${attempt} failed, node-1 label gate verdicts:"
+    docker logs "${MESH_PREFIX}-node-1" 2>&1 | grep -F '[A2A]' || true
+    sleep 2
+  done
   echo "labelled client output: $output"
   [[ "$status" -eq 0 ]]
   [[ "$output" == *"agent> echo: hello eu"* ]]