docs: add ADR 0006 for shared operations across RPC and MCP - #4412
Merged
Merged
Conversation
Records the implemented operation seam (registry, invoker, RPC/MCP adapters, discovery, instance-owned catalogs, durable acknowledgements), the per-transport pre-invocation pipeline design it grows into, and its layering against the ADR 0005 action dispatcher: operations own domain rules and execution-ownership admission; transport pipelines and shared stages own caller policy. States current boundaries explicitly: source is the only caller differentiation, no web callers of operation.invoke, no call_action delegation yet, and outcome jobs that park after a daemon restart until the guardian ledger lands.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Review status
|
… ADR - Count of caller.source === 'mcp' branches was three, actually five (task.cancel, task.resolvePendingCompletion, task.update, task.dependencies.set, task.submitForReview) — fixed in decision 3, the Current state table, and Open items, and described what each branch actually checks instead of a blanket claim. - Decision 4's invoke-tool bullet claimed the hyperneo-operations catalog is filtered to execution-ownership operations; it is not (the Space registry provider wires the full catalog unfiltered) — reworded to state the true current state and keep the filter as the intended rule for new operations. - Dropped the invented `agentActions` identifier from the Context section; no such symbol exists in the repo history.
Decision 3, the Current state table, and Open items said five operations branch on caller.source; message.send also branches on it (rejecting MCP callers claiming human provenance) so the true count is six. Reworded each site to separate the five migration targets (missing Space-membership/worker-binding facts on the principal) from message.send's provenance check, which stays a policy check destined for the MCP pre-invocation pipeline rather than a principal field.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
docs/adr/0006-shared-operations.md, the normative record for the RPC/MCP unification stream (epic #4164).It records the implemented seam (operation contract, shared invoker, thin adapters, runtime discovery, instance-owned catalogs, durable acknowledgements, async invariants) and fixes two things the stream had left implicit:
OperationCallerprincipal; shared stages (authenticate, resolve target scope, require same Space, audit) are composed by either pipeline. Execution-ownership admission stays inside the operation; principal admission lives outside it. Today'sresolveCallercallbacks are named as the seam.dispatchActionare policy layers that share stages rather than rules, andcall_actionentries delegate to operations.A Current state table names what is not wired yet:
sourceis the only caller differentiation, zero web callers ofoperation.invoke, nocall_actiondelegation, and outcome jobs that park after a daemon restart until the guardian ledger (#4367) lands.Merge contract: documentation only, no code changes.