- Invoke optional AfterPersistentPreRun after root PersistentPreRunE setup so overlays can wire non-MCP clients (e.g. A2A gateway). - Add pkg/runtimetoken.ResolveAccessToken mirroring MCP auth resolution. - Export MCP identity headers via pkg/cli for auxiliary HTTP transports. - Fix staticcheck: SA1012 nil-context test guard, ST1005 error string in verify. Made-with: Cursor