Upgrade Internet Identity Backend Canister to e646fe933

Backend Canister Upgrade

This release prepares II for MCP general availability.

In particular:

• A new install argument mcp_official_url is added, indicating the official MCP connector URL.
• If specified, the official MCP connector becomes available to all users.
• In this proposal, the official connector is set to https://mcp.internetcomputer.org,

which is the official DFINITY-operated MCP server.

• Users still need to approve each new session (this remains unchanged).
• Users can still opt out to guarantee that a particular identity cannot be accidentally user by AI.

What's Changed

_Since proposal-backend-143166_

• feat(be): migrate every anchor to AI access on the official connector (#4169)
• feat(be,fe): turn AI access on at registration and let the upgrade arg control the migration (#4164)
• test(be): SSO gating cross-domain takeover regression test + threat-model docs (#4155)
• fix(be): invalidate in-flight MCP registration on revoking config write (#4158)
• fix(be): cap MCP per-app delegations at 5 minutes (#4160)
• feat(be): batched migration enabling AI access on stored MCP configs (#4157)
• feat(be,fe): show the official MCP connector in AI access settings (#4153)

Full release notes

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull  # to ensure you have the latest changes.
git checkout e646fe9338d0aedd3ee35aa9ea70c1d6b95c511d
./scripts/verify-hash --ii-hash 32217d4c7d0139b1c5a10850f048a23704aee36bbe3afeab871005f216085e3c

Backend Argument Verification

Run the following command to verify the backend upgrade argument hash:

didc encode -d ./src/internet_identity/internet_identity.did -t '(opt InternetIdentityInit)' '(
  opt record {
    mcp_config_migration = opt true;
    mcp_official_url = opt opt "https://mcp.internetcomputer.org/mcp";
  },
)' | xxd -r -p | sha256sum

The output should match the argument hash.