state-mcp rejects required casting runtime state keys

[chboeye]

Summary

Squad's coordinator contract requires casting/policy.json, casting/registry.json, and casting/history.json to be managed through squad_state_* on non-local backends, but state-mcp rejects all three keys as non-mutable.

This creates a startup deadlock for an already-squadified repository whose casting registry has not been migrated: the coordinator must migrate casting state before dispatching ordinary work, while the only permitted persistence path refuses that migration.

Reproduction

Using Squad CLI 0.12.0 with stateBackend: "orphan":

1. Start @bradygaster/squad-cli@0.12.0 state-mcp.
2. Confirm squad_state_health succeeds.
3. Confirm squad_state_read("casting/registry.json") reports the key absent.
4. Call squad_state_write for:
   • casting/policy.json
   • casting/registry.json
   • casting/history.json

Actual behavior

Each write fails with:

State mutations are limited to mutable runtime state (decisions, inbox, logs, sessions, scratch files, agent history, and identity). Static config such as config.json, team.md, routing.md, charters, templates, and skills must not be changed with state tools.

identity/now.md succeeds in the same session, confirming that the MCP bridge and orphan backend are healthy.

Expected behavior

The three documented casting keys are accepted as runtime-owned mutable state. Other arbitrary casting/* paths remain rejected.

Root cause

validateMutableStateToolKey in packages/squad-sdk/src/tools/index.ts allowlists several mutable namespaces but omits these three keys. This conflicts with the coordinator, init-mode, source-of-truth, and casting-reference contracts, which require casting state to use squad_state_* on orphan and two-layer backends.

The omission is also present on the current dev branch, so restarting an MCP process pinned to 0.12.0 cannot resolve it.

Proposed fix

• Allow exactly the three documented casting keys; do not allow arbitrary casting/* paths.
• Add SDK validation tests and state-mcp integration coverage with an orphan backend.
• Verify backend migration and doctor flows account for casting state.
• Keep generated coordinator/templates aligned with the runtime allowlist.

Impact

Repositories with an existing team but no casting registry cannot complete the mandatory migration without violating the state-backend contract. Ordinary project work remains blocked until Squad is patched locally or a fixed release is published.