muster release v5.28.1

spec.headers reach a person’s session connection. An MCPServer’s spec.headers were sent by the server-level client only; the connection muster opens for a person’s session to an OAuth server (the person’s grant as bearer, a forwarded login token, a token exchanged for it) sent none of them. The hosted GitHub MCP server selects its toolsets per session from X-MCP-Toolsets, so with spec.headers: {X-MCP-Toolsets: default,git} on the github MCPServer the server-level probe saw the git toolset while every person’s session connected with the default 48 tools and x_github_get_repository_tree was “tool not found”. The headers now travel with the pending-auth registration into the aggregator’s registry, next to spec.meta and spec.timeout, and every session-scoped client sends them on the handshake and on every call; the session’s Authorization header stays its own, an entry of that name in the definition is left out. A change of spec.headers on a live definition closes the connections the sessions hold to the server the way an auth configuration change does (session_auth_reset, changed: headers), tools kept resolvable; a session’s next call reconnects with the grant it still holds, and that connection carries the new set. Scenario oauth-session-client-sends-definition-headers; the mock backend’s tools gained echo_headers and a pre-configured mock’s config a headers field for the definition. (#1304)