Resume brief for oth/mcp_helpers — current state, decisions, gotchas.
NOT a changelog; if something stops being true, overwrite it.

What it is
----------
Shared library imported by the MCP servers. Two pieces:

- signed_tool  — `@signed("keyname")` decorator: gates an MCP tool behind an Ed25519
                 signature. Adds `timestamp` + `signature` params to the tool, checks
                 a time window (default ±5 min), verifies the signature, then calls the
                 original function without those params.
                 Signed message: "{tool_name}:{timestamp}:{sha256(json(args))}"
                 (args deterministic JSON, sort_keys, no spaces).
                 Load keys at startup: SignedTool.load_keys({"alice": "<b64 ed25519 pub>"}).
- code_updater — `add_code_updater(mcp, __file__)` registers two tools on an MCP server:
                 readCode() (returns the server's own source) and updateCode(new_code)
                 (shows a diff, asks for confirmation in the server console, then
                 overwrites the file and restarts the server). Enables MCP self-edit.

Files
-----
- __init__.py       — exports: SignedTool, signed, add_code_updater.
- signed_tool.py
- code_updater.py
- requirements.txt  — cryptography>=42.0.0.
- tests/            — test_signed_tool, test_code_updater, test_integration_update,
                      mcp_test_server.

Gotchas
-------
- updateCode restarts the process via os.execv after a short asyncio.sleep — the caller
  loses the connection during restart; clients must reconnect.
- Imported by servers via sys.path (they add the repo root / oth to the path).
