Epic: MCP hardening — close the swarm-review findings

[tcballard]

Purpose

Track the confirmed weaknesses from the 2 August 2026 three-agent Terra review of asdecided/core at fd1c20191351ba74524afd993290c6dfd1c56b16.

The review found no P0. The concentration of risk is MCP: transport hardening, protocol validation, audit correctness, and response-boundary enforcement. The Rust index, freshness, export, and Sentry paths were comparatively sound. The full decided-mcp suite passed while several invalid requests were still accepted, so negative and conformance coverage is part of the corrective programme rather than optional follow-up.

Recommended execution order

Phase 1 — secure and validate the MCP request boundary

• (mcp) Harden shared HTTP serving against stalled and oversized requests #417
• (mcp) Validate Origin on Streamable HTTP requests #416
• (mcp) Reject protocol-version carrier mismatches before era dispatch #412
• (mcp) Validate JSON-RPC envelopes before era dispatch #409

These should be designed together so Origin policy, size/deadline controls, version negotiation, and JSON-RPC validation happen before era-specific dispatch. Valid frozen legacy bytes must remain unchanged.

Phase 2 — make compatibility independently testable

• (mcp) Add language-neutral MCP 2026 conformance vectors spec#7

Core should consume the language-neutral fixtures directly. This can begin alongside Phase 1, but Phase 1 is not complete until its negative cases are represented in the shared fixture set or an explicitly Core-only integration suite.

Phase 3 — restore MCP product guarantees

• (mcp) Restore complete and attributable audit records #413
• (mcp) Enforce response budgets as hard limits #411

Audit semantics and the response budget are user-facing trust contracts. Any intentional changes to ADR-084, ADR-098, or ADR-033 must be recorded as explicit superseding artifacts rather than silent implementation drift.

Phase 4 — make mutation safe

• (engine) Confine rename writes to the corpus root #407
• (engine) Make multi-file rename application transactional #408

Root confinement lands first. Transactional multi-file replacement must not expand the filesystem attack surface.

Phase 5 — close operability and correctness gaps

• (docs) Align MCP documentation with the shipped Rust server #414
• (ci) Add Core runtime coverage on Windows and macOS #415
• (engine) Accept literal hyphen positionals in find and resolve #410

Documentation should follow the resolved runtime contracts. Cross-platform runtime coverage then verifies the supported distribution surfaces.

Programme exit criteria

• Every linked issue is closed by a reviewed PR with focused regression evidence.
• Accepted decision/design/requirement artifacts match the shipped behavior.
• asdecided/spec is the authoritative language-neutral MCP compatibility source.
• Core runs positive and negative MCP compatibility cases in CI.
• Shared HTTP serving resists stalled and oversized unauthenticated requests.
• Audit events accurately identify callers and all returned artifacts.
• Every successful MCP response obeys its configured response budget.
• Mutation commands cannot write outside the corpus or leave a silent partial rename.
• Windows and macOS execute representative runtime tests, not compile checks alone.

[tcballard]

Request-boundary implementation status

The four boundary items are now implemented as atomic PRs, in the review order:

1. #419 — bounded HTTP connections, deadlines, request/header/body limits, and oversized/stalled-client tests.
2. #420 — exact --allowed-origin policy with 403 before body read.
3. #421 — header/body protocol-version agreement before era dispatch.
4. #422 — shared JSON-RPC envelope validation across HTTP and stdio.

PRs #419–#421 have all required remote checks green. #422 has its Windows compile green and the remaining checks are still running.

Local evidence for each slice includes focused MCP tests, clippy with warnings denied, and git diff --check; #419 also passed the full Rust workspace test suite.

[tcballard]

Request-boundary sequence complete

The four findings from this epic are now merged in order:

1. #419 — bounded HTTP connections, deadlines, request/header/body limits, and stalled/oversized-client tests. Merge: a4577896.
2. #420 — exact --allowed-origin policy with 403 before body read. Merge: 7d715139.
3. #421 — header/body protocol-version agreement before era dispatch. Merge: d0d84c8e.
4. #422 — shared JSON-RPC 2.0 envelope validation across HTTP and stdio. Merge: abed6ded.

Each rebased PR passed the full required GitHub suite, including native Windows compile, Rust workspace/contract invariants, Sentry, Gatekeeper/validate/watchkeeper, distribution metadata, and the repository decided check. Local focused MCP tests, strict clippy, and git diff --check were also green on each rebased slice. The request-boundary work is closed; the remaining tracker items can proceed separately.

[tcballard]

Phase 2 — shared MCP compatibility source

The next ordered tranche is now open as two dependent PRs:

1. asdecided/spec#8 publishes mcp/conformance/vectors.json and its execution contract: 13 small language-neutral vectors covering current semantics, frozen legacy bytes, JSON-RPC negatives, HTTP version carriers, Origin policy, notifications, and schema-root assertions.
2. asdecided/core#423 adds a Rust consumer that runs those vectors over stdio and HTTP in native CI, with no Python oracle. It intentionally consumes asdecided/spec main, so v0.5 Decisions As Code #8 must merge first.

Local evidence: Core consumes all 13 vectors, focused MCP tests and strict clippy pass, and the spec manifest parses cleanly. Once #8 is merged, #423 can run its authoritative CI check and be reviewed/merged; Phase 3 is the audit and response-budget pair (#413, #411).