Skip to content

fix(mcp): preserve provider policy receipts - #10573

Draft
apurvvkumaria wants to merge 1 commit into
mainfrom
codex/10119-mcp-policy-receipt-hotfix
Draft

fix(mcp): preserve provider policy receipts#10573
apurvvkumaria wants to merge 1 commit into
mainfrom
codex/10119-mcp-policy-receipt-hotfix

Conversation

@apurvvkumaria

@apurvvkumaria apurvvkumaria commented Aug 28, 2026

Copy link
Copy Markdown
Collaborator

Outcome

BLOCKED DRAFT — independent review has not approved this commit. Do not mark this PR ready for review or merge.

This draft preserves policy creation receipts across managed MCP provider attachment changes. It also keeps an incomplete add retryable when final policy-authority verification refuses the operation.

Reason

Concurrent MCP adds can rotate the live sandbox policy identity after NemoClaw records its policy creation receipt. The current failure can report two receipt-mismatch errors instead of one durable success and one refusal, and a failed add can leave state that makes the next attempt report already exists.

Related issues

Refs #9833

Changes

  • Add managed receipt preparation and finalization around MCP provider attachment mutations.
  • Keep fresh-add completion unpublished until final policy-authority verification succeeds.
  • Reconcile an exact interrupted preflighted add by compensating its recorded provider attachment before an ordinary retry.
  • Preserve fail-closed handling for authority mismatch and receipt movement.
  • Extend existing MCP add, restart, remove, destroy, and provider-attachment tests and fixtures for receipt rotation, process interruption, retry, and cleanup.

Verification

  • Ordered concatenation of the 15 changed file bodies — SHA-256 86c57c4ec0efe6adf0cf2d8463e9007e06b3e44e10e79fa88b865ba62b3229c7.
  • Focused seven-file Vitest command — 156/156 tests passed.
  • CLI type-check — passed, including the normal pre-push hook.
  • Repository checks — passed.
  • Source-shape test budget — passed.
  • Codebase growth guardrails — passed.
  • Oxfmt — passed.
  • git diff --check — passed.
  • Normal pre-commit hook — passed, including secret scanning.
  • Normal commit-message hook — passed.
  • npm run test:changed — 6,167 passed and 2 skipped. Seven environment failures reproduced on the unmodified base: five uninstall cases stopped at the host OpenShell Homebrew pinned-trust check; one Hermes gateway drift case used system Python 3.9.6, which does not support zip(strict=True); one Hermes adapter case used a system Python environment without PyYAML.
  • Commit dbd4e085678ed97562babcde24a45c8ed9e292a2 — GitHub Verified, reason valid, with DCO sign-off.
  • Diff inspection — no credential values, API keys, or tokens added.

Review notes

This draft remains blocked on these independent-review findings:

  • High: Finalization can bless unrelated concurrent provider attachment drift.
  • High: Compensation has a receipt-check-to-detach race.
  • Medium: Provider attach and detach mutations outside a fresh add have no durable pending-mutation journal and can become receipt-stale after process death.
  • Security test gap: Tests still need real receipt-finalizer and compare-and-swap interleaving coverage.

This PR does not claim security approval or merge readiness. The commit is based on fa6b2c89eb01e2b27648cfea61208a9897d5fcb4; refreshed origin/main is verified commit 29e79e7163ea3837f90759c3ed93d54422eb6341, three commits ahead. Publication does not rebase or modify the frozen stacked PRs or worktrees.

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

@apurvvkumaria
fix(mcp): preserve provider policy receipts
dbd4e08 
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
@apurvvkumaria apurvvkumaria self-assigned this Aug 28, 2026
@copy-pr-bot

copy-pr-bot Bot commented Aug 28, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit dbd4e08 in the codex/10119-mcp-poli... branch remains at 96%, unchanged from commit 7ca488e in the main branch.

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor finished for commit dbd4e08. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs

@cv cv mentioned this pull request Aug 29, 2026
Merged
cv added a commit that referenced this pull request Aug 29, 2026
@cv
feat(maintainer): export PR lifetime traces (#10581)
883fbe3 
<!-- markdownlint-disable MD041 -->
## Outcome

Maintainers can inspect a pull request's complete retained lifetime in
Perfetto from the standard value-stream analysis command. The command
now writes a validated trace, matching summary, and manifest instead of
limiting interactive evidence to a static latest-revision waterfall.

## Reason

The existing bounded JSON summarized bottlenecks but could not expose
concurrent workflows, runner queues, individual steps, lifecycle events,
or contributor feedback loops interactively. A single canonical lifetime
trace makes those relationships explorable without adding user-selected
analysis modes.

## Changes

- Collect bounded lifecycle events, comments, inline feedback, every
retained PR revision, matching workflow jobs and steps, and external
checks during the standard analyzer invocation.
- Render Chrome Trace Event JSON with independent Perfetto tracks for
workflows, jobs, steps, author publication, feedback waiting, and
response spans; validate phase, timestamp, metadata, and slice-nesting
invariants before publishing the manifest.
- Write summary.json, trace.json, and manifest.json atomically under the
ignored maintainer artifact directory, failing closed on incomplete
required history or a changed PR head.
- Update the maintainer skill contract and focused process-boundary
tests for the one complete lifetime workflow.

## Verification

- Contributor validation: Signed commit passed pre-commit, commit-msg,
and pre-push hooks, including repository checks, Oxfmt, Oxlint,
markdownlint, gitleaks, source-shape budget, codebase growth guardrails,
and CLI typecheck.
- Tests: `npx vitest run --project integration
test/automation/pull-requests/analyze-pr-value-stream.test.ts`: 19 tests
passed. Real Perfetto-compatible traces validated for open draft PR
#10573, open PR #10574, and merged PRs #10566 and #10575.
- Broad gate: `npm run checks:repository` passed: 1,849 files, 5,878
edges, 0 cycles, and exact membership for 2,634 test candidates.
- Secrets review: The diff contains no secrets, API keys, or credentials
<!-- nemoclaw-docs-review:start -->
- Documentation review: `docs-updated`
- Documentation evidence: Maintainer skill documents portable stale-lock
recovery behavior.
- Documentation agent: openai/openai/gpt-5.6-sol
<!-- docs-review-head-sha: e53b069 -->
<!-- docs-review-agents-blob-sha:
dd3528f -->
<!-- nemoclaw-docs-review:end -->
<!-- nemoclaw-targeted-validation:start -->
- Targeted validation: Value-stream and growth integration: 66 passed;
focused TypeScript and Oxlint passed.
<!-- nemoclaw-targeted-validation:end -->
<!-- nemoclaw-broad-gate:start -->
- Broad gate: passed — Repository checks and signed commit hooks passed;
all twenty-two GitHub commits are verified.
<!-- nemoclaw-broad-gate:end -->

---

Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added complete pull request lifetime analysis covering commits,
checks, reviews, comments, and lifecycle events.
* Generated summary, trace, and manifest artifacts with event counts,
timestamps, completeness details, and caveats.
* Added Chrome Trace output for visualizing pull request activity over
time.
* Added safeguards for bounded analysis and consistent artifact
publication.

* **Bug Fixes**
  * Improved timestamp validation and artifact integrity checks.
* Prevented incomplete or inconsistent artifacts from being retained
after failures.
* Added stale-lock recovery and protection against publishing results
for outdated revisions.

* **Tests**
* Expanded coverage for trace validity, completeness, concurrent
publishing, and lifecycle changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@apurvvkumaria apurvvkumaria added the v0.0.117 Release target label Aug 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@apurvvkumaria apurvvkumaria

Labels

v0.0.117 Release target

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@apurvvkumaria