fix: harden evidence lifecycle and MCP contracts - #461
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8657af4e46
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b069e770d4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7e60bf8b7b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 926cef35fe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1 participant
Summary
This PR closes the main developer-experience bottlenecks found in the repository audit.
Related: #18
Root causes addressed
Runtime refinements were stronger than the advertised MCP schemas, so clients could be told that invalid inputs were valid. Retained evidence deletion bypassed the session’s mutation/notification/authorization boundaries. The MCP suite shared the slower fork-based boundary execution path, which increased process overhead and made the intended test ownership unclear. These changes move the constraints and lifecycle rules to their canonical boundaries instead of adding caller-specific workarounds.
The review follow-up corrected seven gaps: readiness-stage cardinality is nested under
properties.stageswithout closing partial compositional schemas; passive and scenario capture inputs are mutually exclusive; bundle analysis inherits all relevant console/JSON/WebSocket/source-map approvals; source comparison requires exactly one application source; navigation preserves the most specific unavailable-mode reason instead of collapsing unsupported hosts toprovider_missing; and releasing a retained evidence bundle notifies subscribers for the exact invalidated URI.The CI documentation failure had a separate generated-artifact root cause: the committed managed-conformance manifest had been generated under Node 22 while CI uses the repository’s Node 24 runtime. The manifest was regenerated under Node 24.18.0 and validated with
docs:check.Validation
npm run test:fast— passed: 305 files, 1,522 tests.npm run test:integration— passed: 184 files, 957 tests.npm run verify:test-temp-hygiene— passed: 324 files, 1,641 tests; no owned temporary residues.npm run check:ci— passed.npm run docs:check— passed under Node 24.18.0.npm run format:check,npm run typecheck, andnpm run lint— passed; Oxlint reports 0 warnings and 0 errors.918faa9f— all checks passed, including all four test shards, coverage/timing, package E2Es, Windows Ghidra, Docs Generation, static checks, real browser, and real replay.docs:check; the generated-document check passes.Real Hopper and managed-tool verifiers were not run in this Linux checkout because their external provider prerequisites were unavailable. The CI real browser, replay, and Windows Ghidra lanes passed.
Review notes
All seven actionable review threads were addressed and marked resolved. The final tree was checked with focused behavioral tests, deterministic suites, static gates, generated-document checks, fresh CI, and exact-diff inspection.