Repository navigation
mcpx: Phase 3 of #2497 — task audit logging, unbound-model documentation, and gap truth-up #2500
Description
Phase 3 of design #2497 (mcpx tasks, bounded — operational limits, cooperative cancel, audit, and the small truths). Design doc: files/designs/code-mcpx-tasks-operational-limits.md in the keep-the-four-repos-healthy goal workspace. The decisions are recorded on #2497; this phase implements its third slice. Gated on Phases 1–2 (the audit lines include the limit refusals Phase 1 creates).
Scope
Audit, documentation, and register truth-up:
- Audit lines through
internal/logging(the daemon's existing logging), ids and metadata only — no results, no tool arguments, no content (design(mcpx): elicitation broker hygiene — owner-only store, bounded retention, redacted events, review-first answering #1675 precedent):- task created, at info: task id, requestor key or
unbound, effective TTL (and that it was clamped, when it was) — at the creation seams / via the store's existingWatchseam (internal/tasks/tasks.go:106); - task terminal, at info: task id, final status, duration;
- limit refusals (Phase 1's creation cap and per-minute window), at info: which limit, requestor key;
- retrieval (
tasks/get/tasks/resulton both surfaces), at debug at the handler seams — the trail exists without logging every poll at info.
- task created, at info: task id, requestor key or
- Documentation. Correct
docs/protocol.md's task visibility row (line ~140: "a task is visible only to the connection that started it" is false for unbound tasks) and document the model where tasks are described for users: a task started without a connection identity is reachable by anyone holding its ID, IDs are unguessable (128-bit after Phase 1),tasks/listlists only a connection's own tasks so an identity-less connection lists nothing, and a client that wants listable tasks must present an identity. This is the recorded disposition for the gaptasks-get-implies-list— document, don't change: listing unbound tasks to an identity-less caller would enumerate other callers' work. - Truth-up. Retire the remaining gap rows in
internal/conformance/coverage_stateful.go(tasks-audit,tasks-document-unbound,tasks-get-implies-list, plus any of the other four rows Phases 1–2 did not already retire), each retirement traceable to its phase's merged PR. Post the evidence note toward mcpx: Phase 3 of #1554 — compare-register truth-up and dezren39/nix#209 closure #1557 (Phase 3 of design(mcpx): tasks, finished — one task store for MCP and /v1, and a client that can call task-required tools #1554) — closure of mcpx: tasks — the 2026 extension is advertised and not implemented; core tasks are unbound and live in two stores dezren39/darwin-nix#209 itself stays mcpx: Phase 3 of #1554 — compare-register truth-up and dezren39/nix#209 closure #1557's job; this phase does not steal it.
Acceptance
- The daemon log answers "which tasks ran, whose were they, how did they end, and what did the limits refuse" for tasks created on both the MCP and /v1 surfaces, with no task content in any line
- Retrieval is visible at debug level and absent at info level in normal operation
-
docs/protocol.mdno longer claims connection-only visibility, and the unbound model (reachable by ID, never listed, identity ⇒ listable) is documented where users read about tasks - All seven task gap rows in
coverage_stateful.goare retired or reworded to name a remaining open question from the design doc, each citing its landing PR - The evidence note is posted toward mcpx: Phase 3 of #1554 — compare-register truth-up and dezren39/nix#209 closure #1557 and mcpx: tasks — the 2026 extension is advertised and not implemented; core tasks are unbound and live in two stores dezren39/darwin-nix#209 is NOT closed by this phase
- Tests/docs checks run via CI per fleet policy (no builds on the sandbox)
Out of scope: audit export beyond the daemon log (event bus) — a design-doc open question, only on a named consumer; closing nix#209 (that's #1557); any behaviour change to visibility or listing.
🤖 Design-architect pass 17 — agent note: triage this phase against design #2497's recorded decisions; the get/list disposition (document, don't change) is recorded there and is not triage's to re-open.
Acceptance criteria
- Audit lines exist at info for task created (id, requestor key or
unbound, effective TTL + clamp flag), task terminal (id, status, duration), and limit refusals (which limit, requestor key); retrieval is logged at debug at both handler seams — ids and metadata only, no results or tool arguments -
docs/protocol.md's task-visibility row is corrected and the unbound-task model (reachable by ID holder, 128-bit unguessable IDs) is documented where tasks are described for users - The conformance/register truth-up for the design(mcpx): tasks, bounded — operational limits, cooperative cancel, audit, and the small truths #2497 design is posted, reflecting Phases 1–2 as landed
Activity
developing-today commentedon Oct 30, 2026
CODE-1277
dezren39 commentedon Oct 30, 2026
🤖 agent-note:v1 — design-architect pass 17 (2026-10-29). Phase 3 of design #2497. Triage packet enqueued: pilot task 3735 (queue=repo-health-code-pilot, status=queued, verified; packet self-corrected once in-pass for a stale template acceptance line — the live payload is the corrected one). Gated on Phases 1–2 (#2498, #2499) + status/blocked. Triage: confirm scope against current main per #2497, do not re-litigate its recorded decisions (the get/list disposition is document, don't change), enqueue the implementation follow-up with this issue's acceptance criteria intact.
dezren39 commentedon Oct 30, 2026
Intake review
Related: #2497 (design), #2498 (Phase 1 — the limit refusals these audit lines record), #2499 (Phase 2), #1675 (ids-and-metadata-only logging precedent)
Notes: Phase 3 of the #2497 mcpx tasks design: audit logging through
internal/logging, the docs/protocol.md visibility correction, and register truth-up. Already fully labelled by the design-architect filer (kind/enhancement, priority/normal, effort/m, app/mcpx) and correctlystatus/blocked— it is gated on Phases 1–2 because the audit lines include Phase 1's limit refusals. This pass appends the missing acceptance-criteria section and marks it enriched; labels otherwise unchanged.Risks: Audit lines that include content would repeat the leak class #1675 exists to prevent; a truth-up written before Phases 1–2 land would be false on arrival.
Suggested approach: Wait for #2498 and #2499 to close, then implement the audit lines at the creation seams / store Watch seam (tasks.go:106) and the doc corrections in one pass.
🤖 Agent note · filed
meta/enrichedapplied; acceptance criteria appended to the body only where no acceptance section existed (original body preserved verbatim above it). Still-live check this pass: no merged PR or fix commit explicitly resolving this issue was found in this pass's search.138 remaining items
dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up
mcpx: wire task audit seam into standalone serve (#2500)
Merge pull request #4743 from developing-today/queue/6075-2500-mcpx-a…
dezren39 commentedon Nov 3, 2026
🤖 Agent note · done