[Intro] (Mcp-Session-Id...) Yuh have di ID. Cool. But who are you? [Verse 1] Agent reconnect, workflow resume Second client copy di ID from a trace inna di room Server see di session, seh "welcome back, boss" Never check who send it — now di context get cross Initialise, get di ID, send it every time Server look it up, restore di state — fine But if it never ask who yuh be an' wha yuh can do Dat lickle header turn bearer — an' it bear yuh too [Pre-Chorus] Which session? (Dat one.) Who a call? (Nobody check!) [Chorus] Session nuh mean yuh, ID nuh mean yuh Holding mi handle nuh mean yuh can be mi Auth every request, check who own di state Continuity a routing, not a key to di gate Session nuh mean yuh (nuh mean yuh!) Copy-paste a header? Yuh still cyaan be mi [Verse 2] Two gap fi check, mek mi spell it out plain Some server nuh auth di return at all — insane Some auth di caller, but never match di owner Either way a next user ride inna yuh corner Spec seh issue di ID inna InitializeResult Visible ASCII, missing ID? Four-hundred, dat's di result Terminated? Four-oh-four. Dat a lifecycle But lifecycle nuh prove a caller entitled [Pre-Chorus] Which session? (Dat one.) Who a call? (Nobody check!) [Chorus] Session nuh mean yuh, ID nuh mean yuh Holding mi handle nuh mean yuh can be mi Auth every request, check who own di state Continuity a routing, not a key to di gate Session nuh mean yuh (nuh mean yuh!) Copy-paste a header? Yuh still cyaan be mi [Bridge] (Bass drops out, spoken) AgentCore use di header fi affinity — microVM routing. Dat a platform behaviour, not a bug. But "accept di ID" nuh mean "skip authorisation". Test it: second client, no creds. Then another user's valid creds. If it resume — yuh have a problem. [Verse 3] Mek di ID random, keep it out di logs But secrecy a nuh permission, mi nuh trust fog Name tag pon di door nuh mean yuh live yah Show mi yuh token, mi check it every time, star [Chorus] Session nuh mean yuh, ID nuh mean yuh Holding mi handle nuh mean yuh can be mi Auth every request, check who own di state Continuity a routing, not a key to di gate Session nuh mean yuh (nuh mean yuh!) Copy-paste a header? Yuh still cyaan be mi [Outro] Which session? Mine. Who are you? ...Exactly. (NDGM)
