Repository navigation
Integration: performance, MCP schemas and errors, flight switches, archives - #134
Merged
Merged
Conversation
tap info fetches its context in one call with a parallel fallback, orient stops fetching the keg catalog twice, telemetry spools events instead of flushing at exit, and the auth store is guarded against concurrent access. - fix(auth): guard the auth store against concurrent access - perf(info): fetch context in one call with parallel fallback - perf(orient): drop the duplicate keg catalog fetch - perf(telemetry): spool events instead of flushing at exit - perf(api): cache hub API discovery on disk - fix(info): decode the hub's context shape and send bare slugs
- fix(mcp): point missing-hash errors at node_read - fix(mcp): constrain and explain node_edit schema values - feat(mcp): flag repeated identical tool failures
Archives are read through one lookup interface and indexed by offset instead of loaded, export and import share their limits, an import replaces the keg's contents, and snapshot content hashes survive it. - refactor(keg): read archive entries through one lookup interface - feat(keg): index archives by offset instead of loading them - feat(keg): share archive limits and replace keg contents on import - fix(keg): keep snapshot content hashes through archive import - refactor(keg): drop the in-memory archive reader
A batch placeholder used as a bare link target resolves, each hub login's spooled telemetry stays with that login, bare flight slugs agree with orientation, and the archive spool belongs to the process that wrote it. - fix(keg): link batch placeholders used as bare link targets - docs(mcp): show the ../ prefix for batch node links - fix(telemetry): keep each hub login's spooled events to that login - test(info): check bare flight slugs agree with orientation
- fix(keg): make touch cheap - fix(keg): bound how long touch waits for the keg lock - perf(keg): load the snapshot timeline once per batch - perf(keg): batch dirty index reads
- fix(mcp): describe tools for hub-hosted KEGs only - fix(mcp): explain flight once, on the flight parameter - docs(mcp): tidy tool and parameter descriptions - refactor(mcp): drop id_only in favor of format %i
Every tool declares an output schema that relays carry to Hub, node_search takes one kegs list scoped to the call's flight, and failed results carry no structured content. - feat(mcp): scope node_search to the call's flight with one kegs list - feat(mcp): declare an output schema for every tool - feat(relay): carry each tool's output schema to Hub - docs(mcp): document output schemas, kegs scope, and retired arguments - fix(mcp): send failed tool results without structured content
- feat(relay): reconnect when Hub reports credential_expired - fix(relay): retry when refreshing the relay token fails - fix(relay): leave off output schemas before dropping MCP servers
Telemetry spools key on a stable account key minted under the auth store lock and stop only the current process on a refused credential, search keeps only the cover KEGs the role check grants, archive entry names and index memory are bounded, and flights are read fresh. - fix(telemetry): key the spool on a stable account key - fix(telemetry): remember a hub's rejection for a day per version - docs(keg): say the keg lock wait bound is advisory and in-process - fix(search): keep only cover KEGs the role check grants - fix(keg): bound archive entry names and import index memory - fix(flight): read flights fresh for flight_read and flight show - fix(telemetry): mint the account key under the auth store lock - fix(telemetry): stop only this process on a refused credential
Only invalid_grant and invalid_client count as a refused refresh, bare flight refs are described as the hub resolves them, and archive import reports unsupported on a hub. - fix(auth): treat only invalid_grant and invalid_client as a refused refresh - docs(tapper): describe bare flight refs as the hub resolves them - fix(keg): report archive import as unsupported on a hub - feat(apicontract): adopt revision 2026-10-17
- fix(auth): keep logout and login authoritative over a running refresh - docs(auth): describe the store lock around login, logout and refresh
- fix(orient): describe agent sessions by allowlist and flight, not identity authority - feat(lock): bound how long lock acquisition waits for a held lock - test(parity): exclude ActiveAgent from surface coverage as an internal read
- feat(relaycontract): add protocol 4 reauth frames and end codes - fix(relay): reauth before credential expiry and map each end code - fix(relay): force a token refresh when the hub expires or refuses it - docs(relay): describe in-band reauth and the end codes
- fix(mcp): report conflicts, restores and rate limits as refusals - fix(keg): classify caller query and settings parse errors as invalid - fix(tapper): wrap caller-supplied node ids and guide topics as invalid - fix(mcp): classify upload sources and locked sessions - fix(mcp): count repeat failures on the arguments as sent - test(mcp): cover error classification by kind and tool - docs: document the MCP failure result shape - fix(mcp): classify remaining caller-input and missing-node failures
- refactor(keg): remove node import and narrow it to engine kegs - fix(keg): count raw tar bytes and stop staging at the size limit - fix(keg): refuse hostile asset names when staging an archive - fix(keg): refuse an entry larger than the tar limit before sizing it
A flight's manageKegs switch lets a request rooted on it create, delete, and administer the KEGs of its namespace, and manageFlights lets it create, edit, and delete the namespace's flights, on the CLI and MCP alike. Neither passes the user's own role. - feat(flight): let a flight manage its namespace
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Eighteen commits of client, MCP, keg-engine, and relay work, each a self-contained step that builds and vets on its own.
Performance
tap infofetches its context in one call with a parallel fallback;orientstops fetching the keg catalog twice; hub API discovery is cached on disk.MCP
node_searchtakes onekegslist scoped to the call's flight;id_onlyis dropped in favor offormat: "%i".node_read, and badnode_editschema values are explained.flightis explained once, on its parameter.Flights
manageKegsswitch lets a request rooted on it create, delete, and administer the KEGs of its namespace;manageFlightslets it create, edit, and delete the namespace's flights. Both work on the CLI and MCP, and neither passes the user's own role.tap infoandorient.Archives
Auth, telemetry, and relay
invalid_grantandinvalid_clientcount as a refused refresh.credential_expired, and retry a failed token refresh.2026-10-17.Includes the attachment confinement change from #117.
Testing
go build ./...,go vet ./..., andgo test ./...-raceforpkg/keg,pkg/tapper, andpkg/paritytask lint:docs,task lint:fsGOWORK=off