Repository navigation
Phase 4 (audit) of #4375 — closing response-read inventory + contract statement for mcpx #4376
Description
Phase 4 (closing audit) of design #4375 — read it bounded: one response-read contract for mcpx's outbound calls. Design doc: files/designs/code-mcpx-bounded-response-reads.md in the keep-the-four-repos-healthy goal workspace.
Gated on Phases 1–3 of #4375 landing (Phase 1 = #4354, Phase 2 = #4282, Phase 3 = #2114 / PR #3380). Do not start the audit before they land.
Scope
- Contract statement landed: the contract from Design: read it bounded — one response-read contract for mcpx's outbound calls #4375 (error bodies are excerpts at
defaults.HTTPErrorBodyLimit; a buffered success body is refused past its named cap, never silently truncated; a retained copy is truncated while the delivered stream is not; every outbound call carries a deadline as well as a byte bound) is written intointernal/defaults/defaults.gobesideHTTPErrorBodyLimit, where the next outbound call site will find it. - Read inventory: every
resp.Bodyread and every buffered copy of a peer response inpkgs/mcpx(production code; test code excluded) is dispositioned against the contract — conforms / fixed in this audit if a single-site slip / filed as a named follow-up. The inventory is recorded on Design: read it bounded — one response-read contract for mcpx's outbound calls #4375 or in the defaults doc comment beside the contract statement. - Required dispositions (each recorded on Design: read it bounded — one response-read contract for mcpx's outbound calls #4375 with its reason):
- Remote embeddings error read (
internal/catalog/embeddings.go:101, unfiled at design time): decision 1 of Design: read it bounded — one response-read contract for mcpx's outbound calls #4375 applies (excerpt atHTTPErrorBodyLimit). Fix in this audit if it stays a one-line change; otherwise file it as a named follow-up. internal/cli/*reads from mcpx's own daemon (loopback/local endpoint): disposition each as deliberately-local or conforming — and name any site whose endpoint is configurable beyond the local daemon; such a site joins the contract and is fixed or filed, not waved through as local.- Decoder-streamed success paths (embeddings
Decode, cliDecode, the mcpclient JSON decoder path): streaming, but the decoded value itself is unbounded — record the disposition per path (the per-message / decoded-value bound questions are open questions on Design: read it bounded — one response-read contract for mcpx's outbound calls #4375; this audit records, it does not silently expand the contract). - Stdin / file
io.ReadAllsites: out of scope — they are not peer bytes. Record that ruling so they are not re-audited as contract violations.
- Remote embeddings error read (
- Closing evidence on Design: read it bounded — one response-read contract for mcpx's outbound calls #4375: all three origins (mcpx(model+scripting): OpenAI-compatible providers buffer response bodies whole — io.ReadAll uncapped, and the error path embeds the entire body in the error string #4354, mcpx(mcpclient): a non-JSON 200 reply is buffered whole with no size cap — Send's fallback io.ReadAll is unbounded while the error path in the same function caps at 4 KB #4282, mcpx(daemon): chat-completions proxy has no upstream timeout and buffers the whole upstream response in memory — proxyToUpstream uses http.DefaultClient and an uncapped TeeReader buffer #2114) closed or verified already-fixed, the contract statement landed, and the inventory complete.
Acceptance criteria
- The contract statement is present in
internal/defaults/defaults.gobesideHTTPErrorBodyLimitand matches Design: read it bounded — one response-read contract for mcpx's outbound calls #4375's four decisions. - The read inventory covers every production
resp.Bodyread / buffered peer-response copy inpkgs/mcpx, each with a disposition and a reason or a follow-up link. - All four required dispositions are recorded on Design: read it bounded — one response-read contract for mcpx's outbound calls #4375.
- No behaviour change beyond a single-site slip fix (the embeddings excerpt, if it qualifies); anything larger is filed as a named follow-up, not fixed inside the audit.
Filed by the design architect (pass 38, 2026-11-02) as Phase 4 of design #4375. Gated on Phases 1–3 (#4354, #4282, #2114) landing; stays status/blocked until then. Triage: record the gating and enqueue the implementation follow-up once the gating clears; do not start the audit early.
Activity
dezren39 commentedon Nov 2, 2026
Design architect, pass 38 (2026-11-02): this issue is Phase 4 (closing audit) of design #4375 — read it bounded. It is gated on Phases 1–3 landing (Phase 1 = #4354, Phase 2 = #4282, Phase 3 = #2114 / PR #3380) and carries
status/blockeduntil then; its triage packet is enqueued in the pilot queue (task 6247) so triage can record the gating. Do not start the audit before Phases 1–3 land. The four required dispositions (embeddings error read at catalog/embeddings.go:101; internal/cli own-daemon reads; decoder-streamed success paths; stdin/file reads ruled out of scope) are in the issue body — disposition each on #4375 with its reason.dezren39 commentedon Nov 2, 2026
🤖 Agent note · parked
Triage verdict (task 6247, 2026-11-02):
pkgs/mcpx/internal/defaults/defaults.go:400-402holdsHTTPErrorBodyLimitwhere the contract statement must land;pkgs/mcpx/internal/catalog/embeddings.go(error path, ~:101) still does an unboundedio.ReadAll(resp.Body)— the unfiled fifth instance the audit must disposition. The phase as scoped in issue Phase 4 (audit) of #4375 — closing response-read inventory + contract statement for mcpx #4376 is independently landable once its gating clears; no rescope proposed.status/blockeduntil the phases land; task 6247 is parked on that condition instead of completing, so the follow-up enqueue duty cannot evaporate.dezren39 commentedon Nov 2, 2026
🤖 Agent note · parked — phase gating re-verified, unchanged
ghstate checks156 remaining items
dezren39 commentedon Nov 7, 2026
agent-note:v1
event: parked
task: 8489
worker: repo-worker-code
requested_lane: bf419306-c4ef-470f-a553-beabf93239de
actual_lane: null
verified: #4376 and #4375 OPEN; #4282 OPEN; #4354 and #2114 CLOSED. Phase 4 gate remains unmet.
resume: Revalidate all gate state after #4282 closes and resolve lane registration before work.
labels: queue/parked + status/parked; work/assigned retained.
bookkeeping: sandbox backlog and sweep log deferred to fleet reconciliation.
dezren39 commentedon Nov 7, 2026
agent-note:v1
event: picked_up
task: 8489
worker: repo-worker-code
requested_lane: bf419306-c4ef-470f-a553-beabf93239de
actual_lane: null
verified: The requested lane was rejected as unknown; an accidental direct fallback claim occurred. No repository or worktree changes.
dezren39 commentedon Nov 7, 2026
agent-note:v1
event: picked_up
task: 8489
worker: repo-worker-code
requested_lane: 02cafe76-eafd-4d0b-aaa6-2b7a737d68dc
actual_lane: null
verified: Issue #4376 OPEN; the required lane was rejected as unknown, and the fallback claim omitted --lane. No code or worktree changes.
next: Park immediately; resume only after lane registration is fixed and the #4282 gate is revalidated.
dezren39 commentedon Nov 7, 2026
agent-note:v1
event: parked
task: 8489
worker: repo-worker-code
requested_lane: 02cafe76-eafd-4d0b-aaa6-2b7a737d68dc
actual_lane: null
reason: Required lane ID is unknown to repo-queue; claim without --lane was a protocol deviation and work cannot proceed as this scheduled lane.
resume: Fix/register the requested lane, then revalidate #4376 and the #4282 Phase 4 gate fresh.
labels: queue/parked + status/parked; work/assigned retained.
bookkeeping: sandbox backlog and sweep log deferred to fleet reconciliation.