Add audit events, timeouts, cancellation, and error boundaries…

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R21 — MCP cancellation & error handling

   R27 — OpenTelemetry context propagation & audit logs

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Add structured audit event emission, per-call timeouts, output-size caps, cancellation propagation, and egress restrictions to D2.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Run combined prompt-injection, malformed JSON-RPC, timeout, and unauthorized tool tests through the agent D2 MCP server path.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Integrated D2 Sandboxed MCP Proxy security test report.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R21Model Context Protocol (MCP)↗ modelcontextprotocol.io

  Official specification: client/server lifecycle, JSON-RPC messages, tool discovery, authorization, and trust boundaries.

• R27OpenTelemetry Documentation↗ opentelemetry.io

  Traces, spans, context propagation, semantic conventions, and redacting sensitive attributes.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOpenTelemetry · ~10 min read
  Context propagation

  Explains trace/span context injection and extraction across service boundaries and the security warning about forged trace headers and leaking baggage — the correlation spine for audit events.

  R27moved 2026-11-11
• videoLightstep is now ServiceNow Cloud Observability · ~10 min
  Context Propagation makes OpenTelemetry awesome

  Walks why traces break without propagation and how the context object flows through nested spans, so per-call spans for each MCP invocation stay in one trace.

  R27checked 2026-11-11
• videoOpenTelemetry · ~38 min
  OTEL in Practice: Context Propapagtion in Distributed Tracing with Doug Ramirez

  Python-specific walkthrough of inject/extract and manual instrumentation, including where to attach attributes to spans rather than dumping payloads into them.

  R27checked 2026-11-11
• articleOWASP · ~15 min read
  MCP Security - OWASP Cheat Sheet Series

  Prescribes logging and centrally monitoring every tool invocation, plus output-size and least-privilege controls, which are the audit-event and egress requirements for the proxy.

  R21checked 2026-11-11
• labOpenTelemetry Python · 3 runnable scripts
  Basic Context — OpenTelemetry Python documentation

  Runnable implicit, child and async context examples let you prove spans nest correctly around each tool call, including the cancellation path in an async handler.

  R27checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.