docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

tasks/server/review-001-schema-internal-visibility.md

@@ -0,0 +1,60 @@
+---
+id: review-001-schema-internal-visibility
+name: Enforce Internal-op invisibility on GET /schema (SRV-02, PRJ-06, GW-02)
+status: pending
+depends_on: []
+scope: narrow
+risk: medium
+impact: component
+level: implementation
+tags: [server, gateway, review-001, security]
+---
+
+## Description
+
+Review 001 findings SRV-02 + PRJ-06 + GW-02 — three faces of one
+visibility gap on the discovery axis:
+
+- **SRV-02** (`src/gateway/routes.rs:120-137`): `schema_handler` runs only
+  `access_check_for_op`; it skips the `is_internal_op` pre-check that
+  `/call`, `/batch`, `/subscribe`, `/publish` all apply. Internal ops carry
+  `AccessControl::default()`, so an unauthenticated caller can fetch the
+  full spec (visibility, schemas, `access_control`) of an op it cannot
+  call. `POST /call` on the same op correctly 404s (tested); `GET /schema`
+  does not — the invisibility invariant (ADR-015 §2) is defeated on the
+  discovery axis.
+- **PRJ-06** (`src/adapters/to_mcp.rs:148-174`): the MCP `schema` tool has
+  the identical gap — no per-op pre-check, full spec including
+  `required_scopes` returned for forbidden ops. The test
+  `schema_returns_full_operation_spec` enshrines the leak.
+- **GW-02**: `/search` and `/schema` are per-identity GETs with no
+  `Cache-Control: no-store` / `Vary: Authorization`, so shared caches may
+  serve caller A's filtered response to caller B.
+
+Fix all three in one pass since they share the pre-check logic and test
+fixtures: add the 404 guard to `schema_handler`; run the same
+`access_check_for_op` pre-check in the MCP `schema` tool (or filter the
+returned spec per identity) and fix the enshrining test; add cache headers
+to the two per-identity GETs.
+
+## Acceptance Criteria
+
+- [ ] `GET /schema?name=<internal>` → 404 unauthenticated, for an unauthorized identity, and for an anonymous identity (test)
+- [ ] MCP `schema` tool denies/404s unauthorized ops symmetrically with HTTP `/schema` (test); enshrining test fixed
+- [ ] `/search` + `/schema` responses carry `Cache-Control: no-store` (and `Vary: Authorization` where a token can change the body)
+- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
+- [ ] `cargo test --all-features` passes (the MCP half is feature-gated)
+
+## References
+
+- docs/reviews/001-initial-implementation-review.md (SRV-02, PRJ-06, GW-02)
+- docs/architecture/decisions/015-privilege-model-and-authority-context.md
+- docs/architecture/decisions/041-mcp-tool-gateway-pattern.md
+
+## Notes
+
+> Agent fills during implementation.
+
+## Summary
+
+> Filled on completion.