Repository navigation
mcpx: Phase 2 of #1675 — broker retention bound + summary-only elicitation events #1677
Description
Phase 2 of design #1675 (mcpx elicitation broker hygiene). Design doc: files/designs/code-mcpx-elicitation-broker-hygiene.md in the keep-the-four-repos-healthy goal workspace. Gated on Phase 1 (the owner-only store issue of #1675): same open sequence and store files.
Scope
Bound the broker store's retention and stop broadcasting question/answer content on the event bus.
- Retention, enforced by the broker on
Open(the codebase's expire-on-read discipline: no timer, no sweeper): delete terminal rows (answered/expired) from bothelicitationsandelicitation_answerswhen they exceed the bounds ininternal/defaults/defaults.json— recorded defaults from the design: 30 days old or more than 1000 terminal rows, whichever bound hits first (triage confirms names/values against the defaults file's conventions). Pending rows are never pruned — a pending question is live state with its own expiry (expireOverdue). - Sampling rows obey the same bound (same table): this retires
sampling-messages-not-retained-between-requests. - Event payloads become summary-only at all publish sites:
events.ElicitOpenedandevents.ElicitAnsweredcarry id, server, tool, mode, audience, state, expiry — never a question'smessage,schemaorurl, and never an answer'scontent. Sites:internal/daemon/hooks.go~L164-171,internal/daemon/consumer.go~L325/424/505,internal/daemon/routes_proto.go~L669,internal/daemon/server.go~L1395 (today:Data: mustJSON(req)/mustJSON(ans), the full objects). - Tree-wide audit of consumers of these two event kinds'
Databefore the shrink lands; anything in-tree that read content is rerouted to the broker read path. The design's audit found no in-tree consumer reading answer content from the bus (askers useBroker.Await). Also confirm during implementation whether the out-of-tree OpenCode plugin reads payload fields being removed; if it does, route it through the broker read path — do not restore the leak. - Retire conformance gaps
sampling-messages-not-retained-between-requestsandsampling-both-handle-sensitive-data(client + server sides) ininternal/conformance/coverage_clientfeatures.go.
Evidence (main d39e611, 2026-10-28)
internal/elicit/elicit.gocontains noDELETE;expireOverdue(~L437) only transitions state. Origin mcpx: elicitation storage is readable by any local user and never pruned; elicitation UI and response validation rows dezren39/darwin-nix#255 acceptance: "Stored elicitations are pruned (age or count bound, documented)."- Gap texts (coverage_clientfeatures.go ~L108-110): "prompts and answers are stored unredacted in state/logs/elicit.db under a 0755 directory and published on the event bus"; "every CreateMessageRequest is kept in state/logs/elicit.db and never pruned".
- Decision recorded on design(mcpx): elicitation broker hygiene — owner-only store, bounded retention, redacted events, review-first answering #1675: payload shrink at the source, not per-subscriber filtering (the bus has no field-level filtering; every future subscriber would inherit the leak). The migration path for any external consumer is the broker read path, named here and in the nix#255 evidence comment at Phase 3.
Acceptance
- Broker open with aged terminal rows deletes them (both tables); pending rows and fresh terminal rows are kept; the count bound trims oldest-first.
- Retention bounds are settings in
defaults.jsonwith the documented defaults, not hard-coded constants. - Published
ElicitOpened/ElicitAnsweredevent data contains none of a fixture question's message/schema/url or a fixture answer's content (canary strings asserted absent), while id/server/mode/audience/state fields are present. - Consumer audit recorded on this issue: every in-tree
Dataconsumer of the two kinds accounted for. - Gaps
sampling-messages-not-retained-between-requestsandsampling-both-handle-sensitive-data(both sides) retired with the tests as evidence. - CI green for
pkgs/mcpx(tests run in GitHub Actions).
Activity
153 remaining items
dezren39 commentedon Oct 29, 2026
🤖 Agent note · parked
dezren39 commentedon Oct 29, 2026
🤖 Agent note · parked
dezren39 commentedon Oct 29, 2026
🤖 Agent note · implementation complete, blocked only on the repo-wide merge-queue freeze (#2403)
repo-worker-code, OpenChamber scheduled lane. Task 2946 (small_fix, resume) — third cycle on this item, so this is escalated from park to block, matching task 2875 (mcpx: JSON Schema validation of tool inputs/outputs and elicitation schemas (7 conformance rows) #1951) on the same incident.queue/2946-1677-elicit-retention, head6b577ea5, OPEN / CLEAN / MERGEABLE. Commits land exactly the packet's scope: prune-on-open ininternal/elicit(retentionMaxAgeage bound +retentionMaxTerminalRowscount bound, pending immune, both tables), the two new defaults indefaults.json, summary-onlyElicitOpened/ElicitAnsweredData at the five full-object sites (hooks.go×2,consumer.go×3), and tests (prune_test.go,elicit_events_test.go) asserting both bounds and the absence ofmessage/schema/url/contentkeys.basic: testSUCCESS,mcpx conformance basic: spec paritySUCCESS,nix ci basic: proxy port fallbacksSUCCESS (the branch-protection required check), CodeRabbit neutral. The single Codex review thread is resolved and outdated — resolved at 13:42Z by keepingsampling-messages-not-retained-between-requestsandsampling-both-handle-sensitive-dataas conformance gaps rather than retiring them: retaining terminal rows for up to 30 days does not satisfy "messages not retained between requests". That is a deliberate, reviewed deviation from acceptance item 3 of task 2946; the packet should be read with the review's reasoning.5a34fa70(10:57Z). Ruleset 26115813 ("main: merge queue pilot") requires the merge queue formainand the queue ejects every entry (ci: merge queue ejects every PR — no merge since #2233 (10:57Z), entries dropped 2-6 min into AWAITING_CHECKS #2403), so no PR can merge — this PR, mcpx: close #1951 remainder — stale dialect-gap rows + structuredContent warn-only policy doc #2190, or any other. Landing is additionally sequenced behind mcpx: close #1951 remainder — stale dialect-gap rows + structuredContent warn-only policy doc #2190 (task 2875, also blocked on ci: merge queue ejects every PR — no merge since #2233 (10:57Z), entries dropped 2-6 min into AWAITING_CHECKS #2403) because mcpx: close #1951 remainder — stale dialect-gap rows + structuredContent warn-only policy doc #2190 and mcpx: broker retention bound + summary-only elicitation events (#1677) #2202 conflict inpkgs/mcpx/docs/spec/conformance-matrix.md; rebasing before mcpx: close #1951 remainder — stale dialect-gap rows + structuredContent warn-only policy doc #2190 lands would only have to be done twice.git merge-tree HEAD origin/mainexits 0 with no conflicts.git -C ~/git/fleet/2946-1677-elicit-retention fetch origin main && git merge origin/maincd pkgs/mcpx && MCPX_UPDATE_MATRIX=1 go test ./internal/conformance -run TestMatrix(regeneratesdocs/spec/conformance-matrix.md— resolving the mcpx: close #1951 remainder — stale dialect-gap rows + structuredContent warn-only policy doc #2190 conflict by regeneration, not by hand)go test ./..., push, then enqueue in the queue. Complete asfixed_mergedwith the merge SHA.Merge pull request #2202 from developing-today/queue/2946-1677-elicit…
dezren39 commentedon Nov 3, 2026
agent-note:v1 — state: handed off — queue task 2946 launched in bound OpenCode session ses_e5e5f40e72cffe3wACUIoZfBi4 by opencode-claimant.
dezren39 commentedon Nov 3, 2026
Done — PR #2202 merged, acceptance verified on main.
7c52ced1(head357cb771c), present on current main (git logconfirms;f8e356f75is 2600+ PRs later and still contains all of it).Broker.Opensettles overdue rows viaexpireOverduethen callspruneTerminal(time.Now())(pkgs/mcpx/internal/elicit/elicit.go:214). Deletes terminal (answered/expired) rows from bothelicitationsandelicitation_answerspast either bound, oldest-first;pendingrows never touched. Bounds live indefaults.jsonunderelicit/:retentionMaxAge: "720h",retentionMaxTerminalRows: 1000, exposed asdefaults.ElicitRetentionMaxAge/Rows. Tests:internal/elicit/prune_test.go(age bound both tables, pending immunity, sampling rows, count bound oldest-first).elicitEventSummary/elicitAnsweredSummaryinhooks.goemit only{id, server, tool, mode, audience, state, expiry}. Applied at all five packet sites (hooks.go x2, consumer.go x3) plus the two sampling sites in the same functions. Verified on current main: zero remainingmustJSON(req/ans/opened)full-object publishes inhooks.go/consumer.go/server.go/routes_proto.go(consumer.go has since grown to 6 summary sites via follow-ups). Tests:internal/daemon/elicit_events_test.gowith canary strings asserted absent.sampling-both-handle-sensitive-dataretired on both sides, claimed on the new tests.sampling-messages-not-retained-between-requestsdeliberately kept as a narrowed gap (commit20346d0f8, Codex P2 disposition, thread resolved): sampling messages are still retained between requests by design until the terminal prune bound, so the SHOULD NOT is not met — retiring it would have been false. This is a reviewer-approved scope refinement, not a miss.basic: testFAILURE shown on PR mcpx: broker retention bound + summary-only elicitation events (#1677) #2202 is post-merge infra noise — run41008350843failed in 10s atactions/checkoutbecause the branch was already deleted after merge. The merge itself went through the merge queue (green merge-group checks required), and main has merged cleanly ever since with this code in place.Closing as implemented. Unblocks #1678 gate (task 1886).