Repository navigation
mcpx: Phase 1 of #1753 — server-side sampling relay gating (tools/includeContext checked against the host's declaration) #1755
Description
Phase 1 of #1753 — server-side sampling relay gating
Design: #1753 (mcpx sub-capability gating). Design doc: files/designs/code-mcpx-subcapability-gating.md in the keep-the-four-repos-healthy goal workspace. Origin: dezren39/nix#210.
Problem (verified on main f6760a69)
Peer.CanSample (pkgs/mcpx/internal/mcpserver/conn.go ~L251-252) is Declared("sampling") and nothing more. Question.Sendable (~L448-458) therefore offers any sampling question to any host that declared the parent capability, and Question.paramsFor (~L466+) shapes elicitation params per era but passes sampling params verbatim — tools and includeContext reach a host that never declared sampling.tools or sampling.context. Conformance gaps (both internal/conformance/coverage_clientfeatures.go, tagged #210): sampling-server-no-tools-without-capability, sampling-server-includecontext-only-with-context-capability.
Scope (decision recorded on #1753)
In pkgs/mcpx/internal/mcpserver:
Peergains sub-capability reads: whether the peer'ssamplingdeclaration carriestools/contextkeys. Malformed declaration values behave as undeclared (the toleranceCanElicit's url branch already uses).Question.Sendableforsampling/createMessagereturns false for a tools-carrying question (toolsortoolChoicepresent) when the peer declared nosampling.tools. The question then follows the existing unsendable path (sendableTo/ broker fallback) — it is not offered to this host, and it is NOT degraded by stripping: a strippedtoolChoice: "required"request is a different request.Question.paramsFordropsincludeContextfrom a relayed sampling question when the peer declared nosampling.context(context inclusion is expressly ignorable; dropping preserves the plain completion). When the peer did declarecontext, the field passes unchanged in this phase.CanSamplekeeps its parent meaning (other callers, e.g.AnswersInline, ask "can this peer sample at all"); shape logic lives inSendable/paramsFor, where the question's shape is known.
Out of scope
- Client-side enforcement in
internal/mcpclient(Phase 2 of mcpx: design — sub-capability gating (gate on sampling.tools / sampling.context / elicitation.form, not parent presence) #1753). - Elicitation form gate and register truth-up (Phase 3 of mcpx: design — sub-capability gating (gate on sampling.tools / sampling.context / elicitation.form, not parent presence) #1753).
includeContextvalues (thisServer/allServers) across a relay — open question on mcpx: design — sub-capability gating (gate on sampling.tools / sampling.context / elicitation.form, not parent presence) #1753; gapsampling-server-avoid-includecontext-valuesstays open.- Declaring
sampling.tools/contextanywhere new.
Acceptance criteria
- Host declaring bare
samplingreceives a plain sampling question unchanged; a tools-carrying question is not offered to it;includeContextis absent from what it receives. - Host declaring
sampling.tools+sampling.contextreceives the question verbatim. - Malformed
samplingdeclaration behaves as undeclared in tests. - Conformance gaps
sampling-server-no-tools-without-capabilityandsampling-server-includecontext-only-with-context-capabilityretired fromcoverage_clientfeatures.gowith passing conformance rows. - CI green (GitHub Actions; per fleet rule, no builds on the sandbox).
Activity
developing-today commentedon Oct 28, 2026
CODE-710
dezren39 commentedon Oct 28, 2026
🤖 Agent note · filed
internal/mcpserver. Triage packet enqueued directly to therepo-health-code-pilotqueue as task 1978 (verified: queue=repo-health-code-pilot, status=queued, last_error=null). Packet:hidden_files/queue-packets/packet-1755.jsonin the keep-the-four-repos-healthy goal workspace.includeContextstripped for context-less hosts, gapssampling-server-no-tools-without-capabilityandsampling-server-includecontext-only-with-context-capabilityretired.files/designs/code-mcpx-subcapability-gating.md; origin mcpx: capabilities declared to upstreams that nothing answers, and host gates that ignore sub-capabilities dezren39/darwin-nix#210dezren39 commentedon Oct 28, 2026
🤖 Agent note · picked up — triage of Phase 1 sampling relay gating
99 remaining items
dezren39 commentedon Oct 29, 2026
🤖 Agent note · parked
dezren39 commentedon Oct 29, 2026
🤖 Agent note · picked up
Merge pull request #2003 from developing-today/queue/2002-1755-mcpx-s…
dezren39 commentedon Oct 29, 2026
🤖 Agent note · done
if: github.event_name != 'pull_request'; workflow states failed conformance checks do not block a merge) and no required status checks are configured, so merged under the standing merge directive.