chore: record next rpc server slices

docs/current_roadmap.md

@@ -161,6 +161,20 @@ implementation state.
    - Completed: `wf-rpc-server --mcp-config wf_mcp.config.json` starts the
       JSON-RPC transport over an MCP-backed `WorkflowServer`, making the remote
       CLI path usable with MCP sources and desired source registry operations.
+- Next concrete platform slices:
+  - Manual product smoke: run `wf-rpc-server --mcp-config ...`, point
+    `wf --url ...` at it, and capture real CLI/server UX gaps before adding
+    more architecture.
+  - Source registry apply/reload: decide and implement how persisted registry
+    mutations affect the running source catalog. Prefer an explicit
+    apply/reload operation before automatic live remount.
+  - Persisted resume across server restart: prove an interrupted run can be
+    resumed after rebuilding the MCP-backed RPC server from the same stores and
+    pinned source environment.
+  - Auth/source secrets boundary: keep registry desired state separate from
+    upstream credentials, and surface missing auth as validation diagnostics.
+  - Run watch/progress: start with polling over existing inspect/trace APIs;
+    defer SSE/WebSocket/MCP progress until the polling UX is proven insufficient.
 - Cleanup candidate: consolidate store/source registry id validation patterns
       (`SOURCE_REGISTRY_ID_PATTERN`, `STORE_ID_PATTERN`) only after another package
       needs the same rule. Today they intentionally stay close to their stores.

docs/superpowers/specs/2026-06-03-long-lived-workflow-api-boundary.md

@@ -358,6 +358,25 @@ Possible providers:
 This slice should avoid making "source" mean "MCP connection." MCP is one
 source provider, not the source model.
 
+Current MCP-backed server status:
+
+- MCP-backed `WorkflowServer` construction is implemented.
+- `wf-rpc-server --mcp-config <path>` can serve JSON-RPC over that server.
+- Source registry read/mutation APIs are reachable remotely when the target
+  exposes `source_registry_admin`.
+
+Next implementation slices should be:
+
+1. Manual product smoke with the real CLI/server commands. Record UX/runtime
+   gaps before broadening architecture.
+2. Source registry apply/reload semantics. Registry mutation currently updates
+   desired persisted state; the next explicit decision is whether changes apply
+   only after restart, through an explicit reload/apply operation, or through
+   automatic live reconciliation. Prefer explicit reload/apply for v1.
+3. Persisted resume across server restart. Rebuild the MCP-backed RPC server
+   from the same stores and prove interrupted runs resume from the stored
+   checkpoint and pinned dependency environment.
+
 ### Slice 6: Auth and Tenancy
 
 Define who can read/write artifacts, deployments, runs, and auth records.

src/wf_transport_rpc_http/cli.py

@@ -67,10 +67,11 @@ def serve(
     if config is not None:
         workflow_config = load_workflow_config(config)
         store = workflow_config.server.store
-        if not isinstance(store, FilesystemStoreConfig):
+        if server is None and not isinstance(store, FilesystemStoreConfig):
             raise typer.BadParameter(
                 "wf-rpc-server currently requires filesystem store"
             )
+        if server is None:
             resolved_store_root = resolved_store_root or store.root
         rpc_transport = next(
             (

tests/wf_transport_rpc_http/test_mcp_backed_server_rpc.py

@@ -79,9 +79,9 @@ async def test_mcp_backed_rpc_reports_connections_and_events(tmp_path) -> None:
         transport=transport, base_url="http://test"
     ) as http_client:
         connections = await _rpc(
-            http_client, "workflow.admin.connections.list", {"limit": 20}
+            http_client, "workflow.admin.connections.list", {}
         )
-        events = await _rpc(http_client, "workflow.admin.events.list", {"limit": 20})
+        events = await _rpc(http_client, "workflow.admin.events.list", {})
 
     assert connections["result"]["connections"][0]["id"] == "demo.default"
     assert any(