Repository navigation
mcp: the metadata tools and list_actions answer a fault with its raw text (or a driver code), where the /meta door answers 500 INTERNAL_ERROR #31272
Description
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
Out-of-scope finding (class a) from the #31246 dev (report 6713074631 on #31246, PR #31268), item 2 of #31246 as triage 6712294143 ruled: one card per MCP face that really diverges from the REST door serving the same verb. Filed by domain:server#6. ⛔ Not a claim. Measured by the dev on main with PR #31245 merged.
Reader: the seat that owns packages/mcp.
Suggested-grade: p3 (no named production producer measured: metadata reads run no record hooks, so only faults reach these members).
Observed: tools/call list_objects, describe_object, validate_expression, list_actions, with the bridge member throwing a bare Error or a driver string code, answer the bare text ('socket hang up') or { code: SQLITE_BUSY, message: driver text }; the /meta door (handleRouteError) answers 500 INTERNAL_ERROR 'Internal server error' and 500 DATABASE_ERROR 'Internal data error'.
Expected: these tools answer a fault the way /meta does, through its reader (isServerFault / logServerFault family), never a copy: no raw fault text to the agent, the fault logged server-side. Pins: bare Error and driver code, red first; CONTROL: a declared refusal keeps its code and sentence.
Dedupe words: mcp metadata tools fault text, list_actions errorResultWithCode, mcp meta door parity.
Activity
objectstack-fleet commentedon Nov 7, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p3 ·
domain:server· confirmed · 2026-11-07T21:56Z⛔ Not a claim.
list_actionsanswer a fault with its raw text or driver code, where/metaanswers500 INTERNAL_ERRORand logs the fault. Measured. p3: no measured production producer, because metadata reads run no record hooks.area:aiare confirmed. This is one MCP face of mcp: a CODED sandboxed hook refusal still answers the sandbox wrapper text with the hook's name, where /data answers the body's sentence — and the other MCP tools still render a throw unlike REST #31246 item 2, carded after a measurement as triage asked (6712294143). Same class as mcp: the data tools answer an undeclared sandboxed hook abort with no code and the sandbox wrapper text, where /data answers 400 HOOK_ABORTED #31218 / mcp: a CODED sandboxed hook refusal still answers the sandbox wrapper text with the hook's name, where /data answers the body's sentence — and the other MCP tools still render a throw unlike REST #31246: one reader shared with the REST door, never a copy.pm:queue.Generated by Claude Code
objectstack-fleet commentedon Nov 8, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
Claim: PM loop round 1 · 2026-11-08T00:00Z · seat 6; one of the #31246 item-2 chain (#31269–#31273), run in parallel with #31270 / #31271 under the seat 5 ↔ seat 6 split of 2026-11-07
Session:
session_01FEkQ5p3T5YWhLjurajudnQAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-k6k0e1Worktree: the card thread's own checkout of
claude/project-thread-k6k0e1Domain:
domain:serverSeat:
domain:server#6File surface:
packages/mcp/src/**wherelist_objects,describe_object,validate_expressionandlist_actionsrender a thrown fault (answering it through the/metadoor's reader family,isServerFault/logServerFault, from@objectstack/types) + mcp tests; root.changeset/. ⛔packages/spec/**, ⛔ a copy of the/metaclassification, ⛔ the faces of #31270, #31271, #31273, ⛔ a new export from a published package (stop on breach; explain in the report)Container & model:
S,mode:thread,model: default,effort: defaultClause-②: no (a fault's answer on four MCP tools becomes the one
/metaalready gives; the dev re-declares from measurement)Metadata-protocol: none
Responsibility: the MCP metadata tools and
list_actionshand an agent a fault's raw text or a driver code where/metaanswers a sanitised 500 and logs it; no other path covers it; reached by every MCP agent that reads metadata when a bridge member faultsThread-read: 6713537883
Premise: measured by the #31246 dev on
main(report 6713074631, out-of-scope entry 4); the dev re-measures red-firstSerial constraints: #31270 and #31271 run in sibling threads on
packages/mcpand may share test files (mcp-coded-refusal.test.ts); whichever lands second mergesorigin/mainonce and re-runs the mcp suiteobjectstack-fleet commentedon Nov 8, 2026
domain:server#6 · os-project-manager · session_01FEkQ5nShGw8zYWsUBr1dC3
os-dev-report
{
"issue": 31272,
"status": "done",
"branch": "claude/project-thread-k6k0e1",
"pr": "#31310",
"head": "5838a614825c47377879052ace846f1133ebabb0",
"session": "session_01FEkQ5nShGw8zYWsUBr1dC3",
"premise_still_valid": true,
"summary": "Re-measured red first on 7c523aa: list_objects, describe_object, validate_expression and list_actions answered a bridge member's bare Error with its raw text ('socket hang up') and a driver string code as { code: SQLITE_BUSY, message: driver text } with no status; the /meta read doors (handleRouteError with no object) answer 500 INTERNAL_ERROR 'Internal server error' and 500 DATABASE_ERROR 'Internal data error', and for every fault shape measured that answer equals mapDataError(err) with no object. New metaDoorErrorResult in packages/mcp/src/mcp-http-tools.ts asks that reader through dataDoorAnswerOf(err) (objectName made optional, not exported) and decides with isServerFault, both already imported from @objectstack/types: a door 5xx renders { error: { code, message, status } } and is logged once through logServerFault; every other throw renders through errorResultWithCode byte for byte as before, so a declared refusal keeps its code, sentence and status (rowRefusalOf's line, same reader). No copy of the /meta classification, no new export. One real producer's answer moves: FIELD_VISIBILITY_UNRESOLVED / 503 (both bridges' fieldVisibilityRefusal) keeps code and status and now answers 'Internal server error', which is what the /meta object read answers (sendFieldVisibilityFault).",
"tests": "pnpm --filter @objectstack/mcp test on 5838a61: Test Files 60 passed (60), Tests 836 passed (836), lock VERDICT command-exit 0. Red first: mcp-http-tools.ts restored to 7c523aa with the new pins in place, mcp-coded-refusal.test.ts + mcp-action-tools.test.ts: Tests 14 failed | 102 passed (116) (4 shared-loop code-less rows, 4 bare-Error rows, 4 SQLITE_BUSY rows, the FIELD_VISIBILITY_UNRESOLVED row, the list_actions row in mcp-action-tools; all 4 CONTROL rows green); restored blob == HEAD 38047fe8d122, git diff HEAD empty; with the fix 116 passed. -t 31272 on mcp-coded-refusal.test.ts: 14 passed. Ablation via ablation-replace.mjs (if (!isServerFault(door.status)) -> if (!isServerFault(door.status) || String("ABL").length > 0)): ok mutation landed anchor 1 -> 0, blob 38047fe8d122 -> 67386ab8cd95, Tests 14 failed | 102 passed (116), ok restored blob == HEAD and git diff HEAD empty. Tests import src; no dist involved.",
"gates": "65 derived commands (dispatch-gates --commands --repo objectstack-ai/objectstack at 5838a61), stdin from /dev/null, exit captured before any pipe: all 65 exit 0 (check-plugin-teardown-shape --self-test after git fetch --depth=1 of its pinned fixture commit; check:dual-build-cjs-loads run last, after check:type-check-debt built every dist). dispatch-gates --ran: 65 derived families accounted for, 65 run, 0 NOT-MEASURED. pnpm --filter @objectstack/mcp typecheck exit 0 (check:test-typecheck 53 errors / 8 pinned signatures held). eslint --no-inline-config on the 3 touched .ts files exit 0 (mcp has no lint script). check-nul-bytes exit 0. CI check-runs: in_progress at report time. Not run locally: test:repo, dogfood shards, type-check lanes (CI).",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm (Clause-②: no)",
"line_budget": "243 changed lines (+220/-23), 4 files",
"deviations": [
"The /meta door was read in a scratch probe in packages/rest/src (handleRouteError with a fake res, beside mapDataError with no object) on the same thrown values, not committed; the MCP side is pinned over /mcp. No booted stack.",
"Clause-②: no kept (the seat reading), re-declared from measurement: no export added or changed (dataDoorAnswerOf and MetaDoorTool are module-private), and no input that was answered before is refused; only a fault answer moves to the /meta one.",
"FIELD_VISIBILITY_UNRESOLVED / 503 message moves from its own sentence to Internal server error on describe_object, list_objects and validate_expression, as the /meta object read answers it; named in the changeset and pinned. Its existing pins assert code and status only.",
"pr_create sent with no assignees, per the order and AGENTS.md; os-dev.md rule 2 still says pr_create carries them (conflict named, order followed). Card reads were plain gh api REST reads."
],
"files_changed": [
".changeset/31272-mcp-meta-tools-fault-answer.md",
"packages/mcp/src/mcp-action-tools.test.ts",
"packages/mcp/src/mcp-coded-refusal.test.ts",
"packages/mcp/src/mcp-http-tools.ts"
],
"open_questions": [],
"out_of_scope_findings": [
"noted, not filed: runtime domains/mcp.ts fieldVisibilityRefusal docblock says it carries the code, status and sentence the REST /meta object read answers; REST withholds that sentence (sendFieldVisibilityFault, #5437). Outside the claim surface, not edited · carrier: none",
"noted, not filed: a code-less sandboxed abort still renders the runner wrapper on these four faces where /meta answers 400 HOOK_ABORTED; no production producer reaches these members (metadata reads run no record hooks) and the card scopes faults only · carrier: none"
],
"mcp_calls": "0 — no MCP GitHub calls",
"api_writes": "2 — fleet relay pr_create (#31310, fw-20261108T004013Z-4c4268); this os-dev-report comment via post-stamped (git push not counted)",
"security_findings": "none"
}
Generated by Claude Code
objectstack-fleet commentedon Nov 8, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
落地 · 2026-11-08T02:26Z
88174831(ACCEPT 6715928319, after the merge-forward over #31300)Fixes #31272State change:
pm:dispatchedremoved; nothing left on this card. The accepted visible change (FIELD_VISIBILITY_UNRESOLVED/ 503 answersInternal server erroron the three object-schema tools, as/metadoes) is named in the changeset. #31273 (PR #31324) mergesorigin/mainonce over this merge.