Libra has no production signal for this change yet because it has not deployed. Libra checks hourly for 3 days after each deploy.
Confidence Score: 3/5
Not safe to merge until the broken collateral tool guidance, unsupported authentication dependency resolution, and repository-required assertion cleanup are addressed.
### Issue 1
apps/server/src/mastra/mcp/external/server.ts:124-125
The external MCP surface now registers `document-read` and `document-write`, but the dynamically loaded collateral HTML skill still directs agents to call `document (read)` and `document (write)`. That tool name is no longer registered, so collateral generation that follows this guidance fails with a tool-not-found error. Update the loaded skill resources to use the split tool IDs and their current input contracts.
### Issue 2
pnpm-lock.yaml:15924-15934
This lockfile resolves `@better-auth/core@1.6.33` with `jose@6.0.11`, although Better Auth requires `jose` version `^6.1.0`. A fresh strict dependency resolution rejects this combination, leaving the application on an unsupported authentication dependency graph. Upgrade the direct Jose dependency to a compatible version and regenerate the affected lockfile entries.
### Issue 3
apps/server/src/lib/__tests__/auth-initial-sync.test.ts:44
`let resolveCheck!` uses a non-null assertion to bypass definite-assignment checking. This violates the repository directive requiring runtime-safe narrowing rather than assertions. Initialize the deferred resolver safely, or guard that it was assigned before calling it. This repository requirement must be satisfied before merging.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
Summary
Do not merge yet. The external MCP document-tool split leaves dynamically loaded collateral guidance pointing at a removed tool name, so affected collateral workflows fail. The lockfile also resolves Better Auth with a Jose version outside its required peer range. The test contains a repository-prohibited non-null assertion that must be removed before merging.
Migrate loaded document guidance 
Remove non-null assertion