Summary

The single in-memory server.Config is the last god-config coupling the vMCP domain core
to the transport. Phase 1 (RFC THV-0076) extracted a stateless core.Config, and Phase 2
re-homed every transport concern under a ServerConfig consumed by Serve — but
server.New still threads one monolithic config through both layers. This PR (Phase 3.1)
adds the two derivation helpers that map server.Config onto that core/transport pair,
setting up the #5445 wrapper that will reduce server.New to
Serve(ctx, core.New(deriveCoreConfig(cfg, …)), deriveServerConfig(cfg, …)).

Two new unexported derivation helpers:

• deriveServerConfig projects the transport-only fields (Host, Port,
  EndpointPath, SessionTTL, the auth/rate-limit middleware handlers, AuthServer,
  status reporting, watcher, session storage) plus the cross-cutting
  TelemetryProvider/AuditConfig onto a fresh ServerConfig, taking the pre-built
  health monitor, backend registry, and session-manager factory config as parameters. It
  is a pure projection (see defaulting below).
• deriveCoreConfig assembles the core.Config from the cross-cutting fields plus the
  collaborators (aggregator, router, backend client/registry, workflow defs, authz config,
  elicitation requester, health status provider) the composition root builds.

Transport defaulting consolidated to the edge (review Option 1). Following review
feedback, the cmp.Or transport-default list — previously duplicated across server.New
(which mutated its caller's config in place), buildServeConfig, and deriveServerConfig
— is consolidated into a single resolver, WithDefaults, applied once at the composition
root (cli/serve.go). The projection helpers (deriveServerConfig, buildServeConfig)
are now pure pass-through, and server.New resolves defaults on a copy so it no longer
mutates its caller. That non-mutation removes a carry-forward gotcha for #5445: the raw,
un-defaulted cfg.Name now survives for Cedar authz parity instead of being overwritten
with the synthetic toolhive-vmcp default.

No serialized/CRD/YAML format changes; this is an in-memory-only refactor. The assembled
server's runtime behavior is unchanged — the same defaults are applied, just resolved once
at the edge.

Closes #5444

Type of change

• Refactoring (no behavior change)

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

pkg/vmcp/server, pkg/vmcp/core, and pkg/vmcp/cli pass cleanly, including under
-race; the full task test run is green.

• derive_test.go (7 tests): verbatim transport-field projection, nil cross-cutting
  propagation (disabled subsystems stay nil), collaborator pass-through by identity for the
  core config, raw-ServerName use with nil admission/health defaults, read-only treatment
  of the input cfg, and reflection-based drift guards asserting every field of both output
  configs is populated.
• server_test.go: TestWithDefaults covers the defaulting matrix (all defaults /
  explicit-preserved / partial / Port never defaulted) and TestWithDefaultsDoesNotMutateInput
  asserts the resolver does not mutate its argument. The existing server.New defaulting
  tests are unchanged — it still resolves defaults, now via the shared resolver.

task lint-fix is clean for the changed files; the only flag is a pre-existing gosec G115
in cmd/thv/app/upgrade.go, unrelated.

Changes

Does this introduce a user-facing change?

No.

Special notes for reviewers

The issue's illustrative code predates the final Phase 1/2 types, so the helpers follow the
actual code rather than the issue's snippet. Intentional divergences:

• deriveCoreConfig drops the issue's discoveryMgr param. core.Config has no
  discovery field — the core replaces discovery's aggregation role — so the helper instead
  populates Aggregator/Authz/ServerName/Elicitation/HealthStatusProvider.
  ServerName uses the raw cfg.Name (not the transport default) so authorization keys on
  the real VirtualMCPServer name rather than the synthetic toolhive-vmcp fallback.
  Authz/ServerName validation is deferred to core.New, not defaulted here.

• The legacy SessionFactory/OptimizerFactory/OptimizerConfig fields fold into the
  injected *sessionmanager.FactoryConfig (per P2.2 Move SDK hooks + two-phase session creation under Serve #5440). deriveServerConfig takes that,
  the pre-built *health.Monitor (A2), and the shared BackendRegistry as parameters
  because server.Config does not carry them; only the composition root can build the
  factory config (its ComposerFactory closes over the core-owned router/backend client).

• AuthzMiddleware is intentionally not projected. ServerConfig has no such field —
  authorization moved to the core admission seam (P1.5 Core admission seam (bounded rewrite) #5438), which derives its authorizer from
  the Authz config. The vestigial server.Config.AuthzMiddleware field is kept on purpose;
  the dead HTTP authz blocks that read it are removed later in P3.2 Reduce server.New body to the wrapper #5445.

Option 1 scope note. This PR now also touches server.New and cli/serve.go, which the
issue originally scoped as "unchanged" — a deliberate deviation adopting reviewer feedback
(consolidate transport defaulting at the edge). server.New keeps defaulting defensively
(via the shared WithDefaults, not a duplicated list) rather than becoming strictly pure,
because full purity would require resolving SessionTTL at ~30 legacy server.New test
sites (a zero TTL panics the session-manager cleanup ticker) and #5445 deletes
server.New's body anyway — so the durable wins (one default list, pure projections, no
caller mutation) land now without throwaway churn.

Design decision — separate config types are intentional (Option 2 declined). A reviewer
asked whether the separate core.Config/ServerConfig types plus derive helpers are worth
it versus one shared config (core.Config is mostly injected collaborators). We are keeping
the split: the two-type boundary is what lets the core be constructed and tested with no
transport concerns, and the drift-guarded derive helpers are the single mapping point.
Collapsing to one shared config would re-couple the layers this epic is decomposing.

This is the first half of Phase 3; it blocks #5445 (P3.2, the server.New reduction).
Parent story #5432; epic #5419.

🤖 Generated with Claude Code