a-workspace-reaches-the-repository — A vendor workspace reads the repository, and proposes to it only where the owner has decided it may

✕BLOKOVÁNO 0 ze 2 úkolů hotovo

připraveno

0

blokováno

2

aktivní

0

verify

0

hotovo

0

zrušeno

0

Problém

The pull path brings decisions in after the fact; the owner asked twice for ChatGPT to act on the repository directly, and the only legitimate shape (a custom MCP connector) runs into ADR 0126 for any mutation and into a tunnel that makes remote callers look local. Sources: chatgpt-majordomus:c239#7, chatgpt-majordomus:c267#2, chatgpt-majordomus:c239#4.

Výsledek

Read-only connector first; a proposal path only after an ADR amends ADR 0126.

Aktuální stav

MCP over HTTP on the shared server; ADR 0126 admits only reads and signed-input capabilities beyond loopback; intent.propose is repository_mutation.

Cílový stav

A vendor caller reads the plan; with the owner's decision, proposes intents carrying their workspace reference.

Rozsah

• apps/majordomus-cli/src/http
• apps/majordomus-cli/src/mcp
• .ai/repo/adrs
• docs/MCP.md

Mimo rozsah

• Public hosting
• Writes without a person accepting them

Kritéria přijetí

• A vendor caller is refused every mutation until the ADR exists
• A tunnel cannot grant loopback authority
• Intent criteria a-vendor-reads-and-never-writes and a-proposal-names-its-source

Validace

• majordomus plan validate

Rizika

• Vendor plan limits on write tools are unverified
• Generalising this into a platform before the pull path is proven (lesson)

Úkoly

Každý z nich je prováděcí kontrakt s vlastními kritérii přijetí, validačním příkazem a požadovanými důkazy. Sloupec wave je vrstva grafu závislostí, v níž úkol leží.

Graf

flowchart LR
    I3285["I3285<br/>A vendor workspace reads the plan through the authenticated remote MCP surface, and a tunnel never makes it look local"]:::blocked
    I3286["I3286<br/>A proposal from a workspace arrives as intent.propose carrying the workspace reference it came from"]:::blocked
    I3285 --> I3286
    classDef done stroke:#16a34a,fill:#dcfce7,color:#14532d,stroke-width:2px
    classDef active stroke:#2563eb,fill:#eff6ff,color:#1e3a8a,stroke-width:2px
    classDef verify stroke:#7c3aed,fill:#f5f3ff,color:#4c1d95,stroke-width:2px
    classDef ready stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef planned stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef blocked stroke:#b45309,fill:#fffbeb,color:#78350f,stroke-width:2px
    classDef cancelled stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px
    classDef superseded stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px

Canonical record: .ai/repo/project/milestones/a-workspace-reaches-the-repository.yaml. Read it back with majordomus plan show a-workspace-reaches-the-repository.