mcpx: Phase 1 of #1531 — exec identity core: a script's identity folds in its resolved directory (internal/config)

Phase 1 of design #1531 (filed by the design architect, 2026-10-27). Design doc: files/designs/code-mcpx-stdio-exec-identity.md in the keep-the-four-repos-healthy goal workspace.

Decision in force (from #1531, do not re-litigate in triage): for a hashed executable whose content begins with #!, the exec identity is its content plus the resolved directory of the real file; non-script hashed files stay content-only; files above limits.execHashMax stay stat/inode. This implements the first option named in pkgs/mcpx/TODO.md item 4 and the planning/roadmaps/mcpx.md row "Decide what a stdio server's identity is" (proposed).

Scope

ExecStamp.Identity() in pkgs/mcpx/internal/config/execid.go (currently lines 114–130) is the single identity implementation — callers are Resolved.ExecState() (execid.go:56), pool construction (internal/pool/pool.go:199) and the exec watch (internal/pool/execwatch.go:84). Keep it single: no second implementation in internal/pool or elsewhere.
While the hashed branch streams the file (it is already read whole), note whether its first two bytes are #!. For a script, fold filepath.Dir(s.Path) — s.Path is already the EvalSymlinks-resolved real path (execid.go:94–99) — into the hash under a distinct framing (marker + separators, so no (content, directory) pair can alias another pair's hash input; exact framing is this issue's to settle). The identity string keeps the sha256:<16 hex> form.
Non-script hash input must stay byte-for-byte today's, so existing binary identities do not move on rollout. The stat branch, the missing: form, and non-stdio servers are untouched.
The execid.go header comment: replace the caveat paragraph ("a program that finds its own files relative to its real location is not [identified]… A restart (mcpx restart) is what moves it") with the new rule, including the one-time identity change for script servers on rollout (recorded handoff identities mismatch → script pools restart once at upgrade/first check, the existing binary-changed path).

Acceptance

Defining tests in pkgs/mcpx/internal/config/execid_test.go:
- identical script bytes in two different directories → different identities;
- identical script bytes at two names in one directory → same identity;
- identical non-script bytes in two different directories → same identity (today's rule preserved);
- a script and a non-script with identical bytes → different identities;
- framing non-alias: pairs whose content/directory splits differ do not trivially collide;
- large-file stat identity unchanged (existing TestExecIdentityOfALargeFileIsItsInode keeps passing).
TestExecIdentityFollowsTheExecutableNotTheCommandName (execid_test.go:25) pins a #!/bin/sh script's identity to its bare content hash — the design knowingly changes this one expectation to the framed script hash; update it and say so in the PR. The same-directory identical-copy tests (TestExecIdentityOfASmallFileIsItsContentNotItsPath) must pass unmodified in behaviour — if one fails, the implementation is folding in more than the directory (e.g. the full path), which the design rejects.
No changes needed in internal/pool, internal/daemon, handoff, or lifecycle code in this phase; Identity() staying platform-independent (the unix/other split is only fileInode) is confirmed, or any build-tag surprise is reported on this issue.
Verification via CI per fleet policy: cd pkgs/mcpx && go test ./internal/config/....

Out of scope: daemon-level reload/watch tests and the TODO/roadmap closure (Phase 2, gated on this phase); interpreter-as-command servers; sibling-loading native binaries (both are open questions on #1531).

Acceptance criteria

ExecStamp.Identity() folds the resolved directory into the hash for #! scripts only, under a framed (marker + separators) input that cannot alias another (content, directory) pair; non-script hashed input stays byte-for-byte today's.
Defining tests in pkgs/mcpx/internal/config/execid_test.go pass: cross-directory identical script → different identity; same-directory identical script → same identity; cross-directory identical non-script → same identity; script vs non-script with identical bytes → different identities; large-file stat identity unchanged.
TestExecIdentityFollowsTheExecutableNotTheCommandName is updated to the framed script hash and the PR says so explicitly; the same-directory identical-copy tests pass unmodified in behaviour.
The execid.go header caveat is replaced with the new rule, including the one-time identity change / single restart for script servers on rollout.
No changes in internal/pool, internal/daemon, handoff, or lifecycle code; CI green on the PR (fleet CI-first policy).

CODE-588

🤖 Agent note · filed

Agent: design architect (repo-design-architect-code job)
Session / ID: repo-design-architect-code cron run, 2026-10-27 19:35 CDT
Found via: filed this run
Task: Phase 1 implementation issue for design design(mcpx): what a stdio server's identity is — a script's identity includes its directory #1531 (mcpx stdio exec identity — a script's identity folds in its resolved directory, internal/config core only). Linked as a sub-issue of design(mcpx): what a stdio server's identity is — a script's identity includes its directory #1531. Enqueued as a triage packet in repo-health-code-pilot this run (queue task 1574) — first fleet step is triage/confirmation of scope and the hash framing, then implementation.
Expectation: effort/m; done = acceptance criteria in the body, defining tests = cross-directory identical script differs / same-directory identical script keeps / cross-directory identical non-script keeps, in pkgs/mcpx/internal/config.
Links: design design(mcpx): what a stdio server's identity is — a script's identity includes its directory #1531; design doc files/designs/code-mcpx-stdio-exec-identity.md (goal workspace); queue task 1574 (repo-health-code-pilot)

Intake review

Fleet-monitor intake pass (2026-10-28): verified still live — the design #1531 was filed today and this Phase 1 sub-issue is queued (queue/queued); no merged PR implements directory folding in ExecStamp.Identity() yet.

Related: parent design design(mcpx): what a stdio server's identity is — a script's identity includes its directory #1531; Phase 2 mcpx: Phase 2 of #1531 — daemon proof: cross-directory re-point restarts on reload and the exec watch; TODO/roadmap closure #1533 is gated on this issue merging. Origin records: pkgs/mcpx/TODO.md item 4 and the planning/roadmaps/mcpx.md identity row.
Notes: the body's "## Acceptance" list is complete; an ## Acceptance criteria checklist has been appended to the issue body in that form (original body preserved verbatim above it). Labels were already normalized by the filer (kind/feature, priority/normal, effort/m, app/mcpx, source/design-architect).
Risks: the framing for the (content, directory) hash input is the one place a subtle aliasing bug could hide — the non-alias test in the acceptance list is the guard. One pinned test (TestExecIdentityFollowsTheExecutableNotTheCommandName) changes by design; the PR must say so.
Suggested approach: exactly the body's scope — single identity implementation in internal/config, no pool/daemon changes in this phase; verify via CI per fleet policy.

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), Lane D shift
Session / ID: queue task 1574 (triage)
Found via: queue claim
Task: Triage mcpx: Phase 1 of #1531 — exec identity core: a script's identity folds in its resolved directory (internal/config) #1532 (Phase 1 of design(mcpx): what a stdio server's identity is — a script's identity includes its directory #1531): confirm as-built scope of the exec-identity core change in ExecStamp.Identity(), settle the hash framing, route the implementation follow-up. No implementation in this task.
Expectation: verdict posted on mcpx: Phase 1 of #1531 — exec identity core: a script's identity folds in its resolved directory (internal/config) #1532 against current main; follow-up packet enqueued with the settled framing and the issue's acceptance criteria intact.
Links: design design(mcpx): what a stdio server's identity is — a script's identity includes its directory #1531 · design doc files/designs/code-mcpx-stdio-exec-identity.md

🤖 Agent note · state: picked-up

Agent: repo-queue worker lane C (task 1634, small_fix)
Session / ID: repo-queue-worker-shift-c, 2026-10-28T04:26Z
Found via: queue claim (resume of parked task)
Task: Resume mcpx: Phase 1 of #1531 — exec identity core: a script's identity folds in its resolved directory (internal/config) #1532 fix — PR feat(mcpx): fold a script's resolved directory into its exec identity (#1532) #1571 @ f80ed0a: all 17 checks now PASS fresh (including the previously queued "compare with the records"), no failures. Merging under the standing criteria and completing fixed_merged; this also lifts the Phase 1 gate on mcpx: Phase 2 of #1531 — daemon proof: cross-directory re-point restarts on reload and the exec watch; TODO/roadmap closure #1533.
Expectation: effort/m for the phase; done = PR feat(mcpx): fold a script's resolved directory into its exec identity (#1532) #1571 merged, mcpx: Phase 1 of #1531 — exec identity core: a script's identity folds in its resolved directory (internal/config) #1532 closed.
Links: issue mcpx: Phase 1 of #1531 — exec identity core: a script's identity folds in its resolved directory (internal/config) #1532 · PR feat(mcpx): fold a script's resolved directory into its exec identity (#1532) #1571 · design design(mcpx): what a stdio server's identity is — a script's identity includes its directory #1531 · gated Phase 2 mcpx: Phase 2 of #1531 — daemon proof: cross-directory re-point restarts on reload and the exec watch; TODO/roadmap closure #1533

Merge pull request #1571 from developing-today/queue/1634-1532-exec-dir

🤖 Agent note · state: done

Agent: repo-queue worker lane C (task 1634, small_fix)
Session / ID: repo-queue-worker-shift-c, 2026-10-28
Found via: queue claim (resume)
Task: PR feat(mcpx): fold a script's resolved directory into its exec identity (#1532) #1571 merged — merge commit 996111fd04c9fc9c5201aeb9cfba9f51367dad6f; all 17 checks passed (test, spec parity, treefmt, MCP matrix, compare-with-the-records). Issue mcpx: Phase 1 of #1531 — exec identity core: a script's identity folds in its resolved directory (internal/config) #1532 is closed. Phase 1 of design(mcpx): what a stdio server's identity is — a script's identity includes its directory #1531 has landed, which lifts the gate on Phase 2 (mcpx: Phase 2 of #1531 — daemon proof: cross-directory re-point restarts on reload and the exec watch; TODO/roadmap closure #1533, task 1575): its next resume can enqueue the Phase 2 implementation packet and complete that triage.
Expectation: done as defined.
Links: PR feat(mcpx): fold a script's resolved directory into its exec identity (#1532) #1571 · design design(mcpx): what a stdio server's identity is — a script's identity includes its directory #1531 · Phase 2 mcpx: Phase 2 of #1531 — daemon proof: cross-directory re-point restarts on reload and the exec watch; TODO/roadmap closure #1533

test(mcpx): prove cross-directory script re-point restarts on reload …

Navigation Menu

Repository navigation

mcpx: Phase 1 of #1531 — exec identity core: a script's identity folds in its resolved directory (internal/config) #1532

Scope

Acceptance

Acceptance criteria

Intake review

30 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

mcpx: Phase 1 of #1531 — exec identity core: a script's identity folds in its resolved directory (internal/config) #1532

Description

Scope

Acceptance

Acceptance criteria

Activity

developing-today commented on Oct 28, 2026

dezren39 commented on Oct 28, 2026

dezren39 commented on Oct 28, 2026

Intake review

dezren39 commented on Oct 28, 2026

30 remaining items

dezren39 commented on Oct 28, 2026

dezren39 commented on Oct 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions