Revert RFC 008 validation stack

[burtenshaw]

This PR reverts #1091, #1045, and #1044 while retaining the FastMCP compatibility bound.

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Two-tier review of the RFC 008 validation-stack revert (3d9eac1 → a3c8cd6).

Automated Checks

• Lint (this PR's changed files): PASS. ruff format --check, ruff check, and usort check all pass on the three changed Python files (src/openenv/cli/__main__.py, src/openenv/cli/commands/validate.py, tests/test_cli/test_validate.py). The repo-wide lint.sh hook does fail, but only on 26 pre-existing unformatted files under envs/** that this PR does not touch. CI's lint job formats only src/ tests/, so that pre-existing envs/ drift will not fail CI.
• Debug code: CLEAN (this PR). check-debug.sh surfaces pre-existing prints/TODOs repo-wide, but none are in this PR's changed lines; the restored validate.py has no debug code.
• Tests: 1 regression (see Tier 1). Full suite: 2 failed, 1530 passed, 133 skipped.

Open RFCs Context

• RFC 008 — Environment Auto-Validation (In Review, @zkwentz). This PR reverts its shipped implementation stack (slices 0a/0b/1: core types, registries/report schema/severity policy, and the openenv validate walking skeleton).
• RFC 003 — MCP Support (In Review, @Darktex, @pankit-eng). Relevant because the revert regresses MCP session-state persistence (below).

Tier 1: Fixes Required

• pyproject.toml:32 — BLOCKING: reverting the fastmcp<4.0.0 cap breaks MCP session persistence. The revert changes fastmcp>=3.0.0,<4.0.0 → fastmcp>=3.0.0. The root uv.lock is gitignored (.gitignore:121), so a fresh uv sync (including CI's test job) now resolves fastmcp 4.0.0, under which MCP sessions stop persisting state across calls. Two tests fail on both transports:

  • tests/core/test_production_mode_routes.py::TestMCPSessionTransportPersistence::test_http_session_mcp_state_persists_across_calls
  • tests/core/test_production_mode_routes.py::TestMCPSessionTransportPersistence::test_websocket_mcp_state_persists_across_calls

  Verified: pinning fastmcp>=3.0.0,<4.0.0 makes all 3 tests in that class pass; fastmcp 4.0.0 also emits a FastMCPDeprecationWarning for Tool.inputSchema at mcp_environment.py:111. The cap was introduced by RFC 008 slice 0a (#1044) but is a dependency-compat guard orthogonal to the validation feature. Recommended fix: keep the <4.0.0 cap in the revert.

Tier 2: Alignment Discussion

Principle / Invariant Conflicts

None identified — the revert removes a feature; it does not add code that violates PRINCIPLES.md or INVARIANTS.md. (The MCP-persistence breakage above is a functional regression, tracked as Tier 1, not a design violation.)

RFC Conflicts

ALIGNMENT FLAG: Revert removes the in-repo implementation of an In-Review RFC.

• RFC at stake: RFC 008 (Environment Auto-Validation), status In Review.
• The concern: This PR deletes the entire shipped RFC 008 contract layer (src/openenv/validation/**, schemas, severity policy, fixtures, tests) and reverts openenv validate from the RFC 008 quality-bar command (--level / --skip-build / --policy / --output, exit codes 0–3) back to the older structure/deployment-readiness command (--json / --verbose, exit 0/1). Per the two-tier model we flag conflicts with open RFCs even when the revert is intentional: the team should confirm the rollback is desired and update RFC 008's status/delivery notes (e.g. mark the implementation as deferred) so the doc and the codebase stay consistent. Any downstream tooling relying on the RFC 008 CLI contract would also break.
• Suggested reviewer: @zkwentz (RFC 008 author).

Summary

• 1 blocking mechanical issue — fastmcp 4.0.0 regression (2 failing tests; CI test job will fail).
• 1 RFC conflict to discuss — reverting In-Review RFC 008's implementation (@zkwentz).
• 0 principle/invariant violations in the revert itself.

Otherwise the revert is clean and self-consistent: src/openenv/cli/_validation.py retains every function the restored validate.py imports, no dangling references to the removed openenv.validation package remain, the deleted openenv.yaml validation:/version fields are read nowhere else, and the 12 restored test_validate.py tests pass.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

BLOCKING — please keep the fastmcp<4.0.0 cap.

Reverting to fastmcp>=3.0.0 lets a fresh uv sync resolve fastmcp 4.0.0 — the root uv.lock is gitignored (.gitignore:121), so nothing else pins it, and CI's test job (uv sync --all-extras) will pick 4.0.0. Under fastmcp 4.0.0, MCP session state stops persisting across calls, failing:

• tests/core/test_production_mode_routes.py::TestMCPSessionTransportPersistence::test_http_session_mcp_state_persists_across_calls
• tests/core/test_production_mode_routes.py::TestMCPSessionTransportPersistence::test_websocket_mcp_state_persists_across_calls

Verified locally: with fastmcp 4.0.0 both fail; pinning fastmcp>=3.0.0,<4.0.0 (→ 3.4.7) makes all 3 tests in that class pass. The cap arrived with RFC 008 slice 0a (#1044) but is a dependency-compat guard independent of the validation stack, so it should survive this revert:

    "fastmcp>=3.0.0,<4.0.0",

cc @Darktex / @pankit-eng (RFC 003 / MCP contract)

[cursor]

ALIGNMENT FLAG (RFC 008 — In Review): this reverts openenv validate from the RFC 008 quality-bar command back to the structure/deployment-readiness command, and the PR deletes the whole src/openenv/validation/** contract layer (schemas, severity policy, graders, fixtures, tests).

Flagging per the two-tier model since RFC 008 is still In Review — the change may well be correct, but please confirm the rollback is intended and update RFC 008's status/delivery notes so the doc and code stay consistent. Downstream tooling relying on the RFC 008 CLI contract (--level / --skip-build / --policy / --output, exit codes 0–3) would also break. cc @zkwentz