Repository navigation
Phase 4 (audit) of #4375 — closing response-read inventory + contract statement for mcpx #4376
Description
Phase 4 (closing audit) of design #4375 — read it bounded: one response-read contract for mcpx's outbound calls. Design doc: files/designs/code-mcpx-bounded-response-reads.md in the keep-the-four-repos-healthy goal workspace.
Gated on Phases 1–3 of #4375 landing (Phase 1 = #4354, Phase 2 = #4282, Phase 3 = #2114 / PR #3380). Do not start the audit before they land.
Scope
- Contract statement landed: the contract from Design: read it bounded — one response-read contract for mcpx's outbound calls #4375 (error bodies are excerpts at
defaults.HTTPErrorBodyLimit; a buffered success body is refused past its named cap, never silently truncated; a retained copy is truncated while the delivered stream is not; every outbound call carries a deadline as well as a byte bound) is written intointernal/defaults/defaults.gobesideHTTPErrorBodyLimit, where the next outbound call site will find it. - Read inventory: every
resp.Bodyread and every buffered copy of a peer response inpkgs/mcpx(production code; test code excluded) is dispositioned against the contract — conforms / fixed in this audit if a single-site slip / filed as a named follow-up. The inventory is recorded on Design: read it bounded — one response-read contract for mcpx's outbound calls #4375 or in the defaults doc comment beside the contract statement. - Required dispositions (each recorded on Design: read it bounded — one response-read contract for mcpx's outbound calls #4375 with its reason):
- Remote embeddings error read (
internal/catalog/embeddings.go:101, unfiled at design time): decision 1 of Design: read it bounded — one response-read contract for mcpx's outbound calls #4375 applies (excerpt atHTTPErrorBodyLimit). Fix in this audit if it stays a one-line change; otherwise file it as a named follow-up. internal/cli/*reads from mcpx's own daemon (loopback/local endpoint): disposition each as deliberately-local or conforming — and name any site whose endpoint is configurable beyond the local daemon; such a site joins the contract and is fixed or filed, not waved through as local.- Decoder-streamed success paths (embeddings
Decode, cliDecode, the mcpclient JSON decoder path): streaming, but the decoded value itself is unbounded — record the disposition per path (the per-message / decoded-value bound questions are open questions on Design: read it bounded — one response-read contract for mcpx's outbound calls #4375; this audit records, it does not silently expand the contract). - Stdin / file
io.ReadAllsites: out of scope — they are not peer bytes. Record that ruling so they are not re-audited as contract violations.
- Remote embeddings error read (
- Closing evidence on Design: read it bounded — one response-read contract for mcpx's outbound calls #4375: all three origins (mcpx(model+scripting): OpenAI-compatible providers buffer response bodies whole — io.ReadAll uncapped, and the error path embeds the entire body in the error string #4354, mcpx(mcpclient): a non-JSON 200 reply is buffered whole with no size cap — Send's fallback io.ReadAll is unbounded while the error path in the same function caps at 4 KB #4282, mcpx(daemon): chat-completions proxy has no upstream timeout and buffers the whole upstream response in memory — proxyToUpstream uses http.DefaultClient and an uncapped TeeReader buffer #2114) closed or verified already-fixed, the contract statement landed, and the inventory complete.
Acceptance criteria
- The contract statement is present in
internal/defaults/defaults.gobesideHTTPErrorBodyLimitand matches Design: read it bounded — one response-read contract for mcpx's outbound calls #4375's four decisions. - The read inventory covers every production
resp.Bodyread / buffered peer-response copy inpkgs/mcpx, each with a disposition and a reason or a follow-up link. - All four required dispositions are recorded on Design: read it bounded — one response-read contract for mcpx's outbound calls #4375.
- No behaviour change beyond a single-site slip fix (the embeddings excerpt, if it qualifies); anything larger is filed as a named follow-up, not fixed inside the audit.
Filed by the design architect (pass 38, 2026-11-02) as Phase 4 of design #4375. Gated on Phases 1–3 (#4354, #4282, #2114) landing; stays status/blocked until then. Triage: record the gating and enqueue the implementation follow-up once the gating clears; do not start the audit early.
Activity
dezren39 commentedon Nov 2, 2026
Design architect, pass 38 (2026-11-02): this issue is Phase 4 (closing audit) of design #4375 — read it bounded. It is gated on Phases 1–3 landing (Phase 1 = #4354, Phase 2 = #4282, Phase 3 = #2114 / PR #3380) and carries
status/blockeduntil then; its triage packet is enqueued in the pilot queue (task 6247) so triage can record the gating. Do not start the audit before Phases 1–3 land. The four required dispositions (embeddings error read at catalog/embeddings.go:101; internal/cli own-daemon reads; decoder-streamed success paths; stdin/file reads ruled out of scope) are in the issue body — disposition each on #4375 with its reason.dezren39 commentedon Nov 2, 2026
🤖 Agent note · parked
Triage verdict (task 6247, 2026-11-02):
pkgs/mcpx/internal/defaults/defaults.go:400-402holdsHTTPErrorBodyLimitwhere the contract statement must land;pkgs/mcpx/internal/catalog/embeddings.go(error path, ~:101) still does an unboundedio.ReadAll(resp.Body)— the unfiled fifth instance the audit must disposition. The phase as scoped in issue Phase 4 (audit) of #4375 — closing response-read inventory + contract statement for mcpx #4376 is independently landable once its gating clears; no rescope proposed.status/blockeduntil the phases land; task 6247 is parked on that condition instead of completing, so the follow-up enqueue duty cannot evaporate.dezren39 commentedon Nov 2, 2026
🤖 Agent note · parked — phase gating re-verified, unchanged
ghstate checks114 remaining items
dezren39 commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 8489 (triage, queued, priority 30) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03
dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 4, 2026
🤖 Agent note · picked up
dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 4, 2026
agent-note:v1
event: picked_up
task: 9441 (repo-health-code-pilot, repo-worker-code; OpenChamber scheduled lane ec118cad-0fd3-4652-91c4-27432f2f2efd)
state: claimed
verified: Fresh GitHub checks: #4376 and design #4375 OPEN; Phase 1 #4354 OPEN; Phase 2 #4282 OPEN (PR #4417 OPEN); Phase 3 #2114 CLOSED with PR #3380 MERGED. The gate is still unmet because Phases 1 and 2 remain open. Prior triage on #4376 already recorded the scope and follow-up task 8489 deferred until 2026-11-06T16:00Z.
next: verify whether task 8489 remains the canonical follow-up and inspect latest #4375 evidence; if so, preserve the gate and route this duplicate triage without starting the Phase 4 audit.
dezren39 commentedon Nov 4, 2026
agent-note:v1
event: triaged
task: 9441 (repo-health-code-pilot, repo-worker-code; OpenChamber scheduled lane ec118cad-0fd3-4652-91c4-27432f2f2efd)
state: done — triaged as still blocked on Phase 1–2
verified: Fresh GitHub state: #4376/#4375 OPEN; #4354 OPEN; #4282 OPEN with PR #4417 OPEN; #2114 CLOSED and PR #3380 MERGED (merge 0b44df8). The Phase 4 audit must not start yet.
route: Existing triage record on #4376 documents follow-up task 8489, deferred until 2026-11-06T16:00Z to revalidate the gate. No duplicate packet was created. No audit/code changes or tests were made in task 9441.
labels: queue/claimed, status/in-progress, and work/assigned cleared; status/blocked retained for the unmet gate.