Alwaldend

Mon, 01 Jan 0001 00:00:00 +0000

Acceptance criteria

Back to durable goal

projects/mcp_cordis is a documented, Bazel-built standalone MCP stdio server and is not coupled to a Codex plugin manifest.
The server demonstrably uses Cordis lifecycle primitives rather than a separately invented plugin framework.
One connected MCP client can define, start, inspect, invoke, update, stop, and remove a runtime package without restarting the server.
MCP source writes are syntax-checked and atomically persisted. Existing running entries are handed to Cordis HMR without a private acknowledgement protocol. The MCP does not promise synchronous activation, broad activation rollback, or restoration of prior on-disk bytes. Native Cordis failure behavior remains intact. The pinned HMR dependency serializes reload work and drains later observed writes so an in-flight replacement cannot discard the latest persisted source. Git owns reusable source history; the runtime does not invent a second version store.
Reusable package source is stored beneath projects/mcp_cordis/plugins; disposable source and configuration resolve beneath the current workspace’s out/mcp_cordis.
Reusable packages reload after an MCP server restart. Disposable packages have an explicit promotion path into the reusable library.
At least three useful, non-sensitive starter packages are justified by recurring prior-session tasks and have executable tests.
Stable gateway tools allow immediate invocation even if a particular MCP client does not refresh dynamically registered schemas.
Focused tests, builds, repository formatting checks, and an end-to-end MCP transcript pass for the exact delivered candidate.
On Linux, ctx.exec() results, execution timeouts, and plugin disposal settle only after the direct child and live members of its original process group stop. A trusted package that deliberately creates a new session is explicitly outside that guarantee; unsupported platforms fail closed. cordis_invoke.timeout_ms is a response deadline, not handler cancellation; the admitted handler retains its Fiber lease until completion.
Trusted Codex sessions discover the MCP from the checked-in .codex/config.toml in the active clone or linked worktree. Server startup releases Bazel’s output-base lock before serving stdio, and source plus disposable state remain scoped to that worktree.

Evidence plan

Unit tests cover validation, standard Cordis entries, lifecycle disposal, persistence roots, eventual reload, and promotion.
An MCP integration test drives initialize/list/define/run/invoke/update/stop over stdio without restarting the process.
A restart test proves reusable package recovery.
Package tests execute every starter package through the same runtime path.
Process regressions cover normal results, output limits, valid UTF-8 prefix retention, timeout, disposal, and rejection of launches after disposal.
HMR regressions write a second generation during slow top-level evaluation and slow asynchronous activation, then require convergence to the latest persisted generation.
Bazel query, test, build, Buildifier, and git diff --check cover repository integration.
A launcher probe starts the generated-script MCP and runs a second Bazel command concurrently in the same linked worktree.

Fixed regression set

git diff --check
Focused //projects/mcp_cordis:all Bazel tests and build
//:buildifier_test after every BUILD or Bzlmod change
End-to-end stdio lifecycle and restart tests

Mon, 01 Jan 0001 00:00:00 +0000

Artifact log

Back to durable goal

Thin-wrapper strategy reset, 2026-08-30

Attempt 10 plan: dependency-owned reload serialization with deterministic slow-evaluation and slow-activation regressions. Review verdict: focused tests pass; complete delivery evidence remains open.
Pinned HMR patch: standard pnpm patch that serializes the package’s module reload task and drains newly stashed URLs. Review verdict: exact-package apply check and focused regressions pass.
Attempt 9 plan: atomic persistence plus official Cordis Include/HMR, with the custom source-marker and acknowledgement transaction removed. Review verdict: refine after reproducing an HMR overlap race.

Published candidate review reset, 2026-08-30

Attempt 8 review corrections: fail-closed recursive fallback, UTF-8 byte offsets, and valid-prefix HTTP previews. Review verdict: accepted locally with focused and complete package evidence.

Mon, 01 Jan 0001 00:00:00 +0000

Evidence manifest

Back to durable goal

Attempt 8 review-correction evidence

Recursive JavaScript fallback fails closed when ripgrep is unavailable; explicitly selected files remain supported.
Fallback fixed and regular-expression submatches use UTF-8 byte offsets.
Bounded textual HTTP previews omit an incomplete UTF-8 suffix.
Focused tests pass 2/2 in invocation b73ce3b4-bfb6-4081-b84f-29c3f763b3a4; the complete MCP package passes 7/7 tests in 93845f08-cd10-4dfb-88c5-034497dea58a and builds all 16 targets in d7716a48-9509-44fe-9e37-b5c44904fffd.
Buildifier passes in invocation 1fb561cc-d336-49db-813f-de26b7fedbe4.
Follow-up review corrections preserve original-line indexes for Unicode case-insensitive matching, make explicit fallback files override globs, and return healthy scopes plus structured errors from unfiltered listing after partial startup.
Follow-up focused tests pass 2/2 in c07704be-cdf8-4045-a0c0-4626ebc0d1e7; complete MCP tests pass 7/7 in 3fbaa4e1-8ea1-4b3f-a533-51e1ad01f87b, all 16 targets build in f87e45b6-765e-49c8-a618-cd2eb1efa1ad, and Buildifier passes in 8542838d-92ae-4999-b1e8-fac631629f6f.
Final review corrections skip every unavailable Include scope and report only retained line endpoints. Fresh correctness scrutiny also preserves startup errors across repeated initialization and limits UTF-8 suffix removal to locally truncated HTTP bodies.
Focused tests pass 2/2 in 99866999-c31d-457f-b64b-c7a15073e7a2. Combined MCP and repo-delivery tests pass 8/8 in e86a5d1c-cadf-4ff6-9647-3e1050e461e6; all 19 affected targets build in 083fbf55-851e-4db4-b8e5-e5871c874faa. Skill quick validation and Buildifier pass.
Focused HTTP evidence passes in e80439df-bddd-4a76-b9e1-be6c7f1ed649.
Runtime evidence uses semantic admission assertions and eagerly attaches the expected timeout rejection; three consecutive runs pass in e7d69598-b843-4da4-833b-e024d406b8ca.
HMR rollback accepts an already-restored prior cache marker after failed import; otherwise it still waits for an exact correlated reload. Three runtime runs pass in 5f9b49e0-d3d3-4f9e-84ec-602dfbe38c77.
Regex fallback uses Unicode scalar mode, so . reports one four-byte match for 😀, and the real MCP tool catalog marks cordis_define and cordis_promote as potentially destructive. Both focused regressions pass in 132e2f33-837c-40b2-83b5-4b06ceadfd0f.
The complete affected packet passes 8/8 tests in b19d303e-0aca-4097-a191-e81015dc2982, builds all 19 targets in 1c8aa274-dd72-4e6f-9491-de5e283b2c5c, and passes Buildifier in 34f6f5c7-7f44-478b-b939-63ac03c3bbb1.
Fallback context is emitted once in line order and never reclassifies a matching line as context. Bounded reads distinguish a retained empty line from EOF. Focused invocation 2528b6ee-7d82-48c9-a607-298a4cef0b9b passes both regressions.

Attempt 7 working-tree evidence

The custom manifest.json, hash-named versions/, storage layer, activation worker, and package worker have been removed.
Official @deepseek-ai/cordis-plugin-loader, -include, -hmr, and -timer packages are pinned. Bazel launches Node with the HMR package’s documented --expose-internals requirement.
Project entries use projects/mcp_cordis/cordis.yaml and ordinary modules under plugins/; scratch entries use the same layout under out/mcp_cordis.
Runtime integration proves create, live HMR update, failed activation with on-disk/live rollback, stop, run, promotion, removal, and restart recovery.
Direct starter-module tests and the complete starter runtime test pass. A real stdio client proves the complete lifecycle, failed-update rollback, package-log isolation, and restart recovery without replacing the MCP process during an update.
Runtime regressions prove exact source-limit round-trip, invalid-timeout side-effect exclusion, never-settling activation rejection, handler-lease draining, and direct/descendant process-group non-liveness at settlement.
Affected test and Buildifier invocation 39711671-375a-413f-8a72-e6f9ff892bd3 passed 11/11 on the rebased implementation after the final import-boundary corrections. Affected build invocation 153467fd-e62d-4eab-b260-6754d17fe8e2 passed all 26 targets.
These full receipts bind implementation commit 0a93e487. Later amendments are confined to the durable goal record and require proportional diff and formatting validation before publication.
Fresh independent review accepted durable-record commit c05bd45a with no actionable findings.
PR 32 was republished at the verified rebased head. Its description now records the standard Cordis architecture, and all three obsolete review threads are resolved.

Preflight evidence

Official OpenAI documentation confirms local Codex clients can connect directly to stdio MCP servers and read server instructions.
Official DeepSeek documentation states that its dynamic Cordis definitions are process-local and memory-only, establishing the need for the requested persistence layer.
Cordis 4.0.1 exposes the required Context, plugin, Fiber.await, Fiber.dispose, and effect-scoped cleanup primitives without depending on DeepSeek Harness’s agent/session/browser packages.
MCP SDK v2 provides a stable stdio server and fixed tool registration. Codex does not reliably refresh dynamically added tool schemas, so the accepted design keeps a fixed list/invoke gateway.
Repository review selected an ordinary root-workspace Bazel package with a project-owned pnpm lock and Bzlmod dependency fragment.
Safe aggregate analysis of 40 top-level recent sessions selected repo_context, git_worktree, and network_probe as the initial reusable packages. No transcript or secret-bearing content will be copied.

Attempt 1 verdict

Architecture: one worker and Cordis root/fiber per active package generation.
Storage: immutable content-addressed source and atomic manifests in explicit project or scratch scopes.
Update rule: start and validate a candidate, atomically swap the active generation, then drain and dispose the previous generation.
MCP rule: stdout is protocol-only; package output is redirected to stderr and out/mcp_cordis/logs.
Candidate hash: c9300c9887104777c8915e3d4f390196604e9bd18497bbec319415d1a4ad057f.
Focused query, lifecycle/in-memory MCP, and subprocess stdio tests pass.
Starter execution test fails at repo_context_search with spawn rg ENOENT; candidate rejected and Attempt 2 opened.

Attempt 2 verdict

Candidate commit: e3e74cb1e573867825347292bf17220a5b9a4a0c.
Candidate tree: 079a0c27b86527c6950cc75b0c8b9dbf572d3e4b.
Fetched base and direct parent: 7ad2704cd27757355ab36ec8eb1bb27ef9e1d91d.
The delivery preparation receipt confirms an exact, conflict-free rebase, task-only path scope, and absence of a remote feature ref or pull request.
Focused post-rebase query passes.
Integrated post-rebase result: three of four tests pass. Starter packages, stdio, and build coverage pass; lifecycle evidence fails at an elapsed-time drain precondition with actual 0, expected 1.
Verdict: refine the test evidence in Attempt 3; do not change the runtime architecture based on this measurement.

Attempt 3 verdict

Final local commit: 7cfef0719075ad372c3bb257ad216b35770356b2.
Final local tree: 34153eca0f582af5c641f81bf8c7209b0045ab9a.
Direct parent and fetched base: 7ad2704cd27757355ab36ec8eb1bb27ef9e1d91d.
Forced project tests: four of four pass on the exact commit.
Complete project build: nine of nine targets pass.
Forced root Buildifier and exact commit diff check: pass.
Review verdict: accept as the final local candidate. Publication was stopped before execution because a rebase-only request does not authorize remote push/PR mutation.

Attempt 4 preflight

PR 32 was published at exact commit 7cfef071; remote branch and PR tree matched the local receipt.
Current remote master is 7ad2704c, the direct parent of the published task commit; repository inspection reports needs_rebase: false.
PR 24 head is da2085f1, based on ada3ed90. Its projects/agents diff is exactly four files: one bazel-agent update, one goal update, and two new decision-review files.
Three PR 32 review threads were independently diagnosed as valid. Their controlling fixes are bounded-success execution, pre-record change limits, and shutdown admission closure followed by lock draining.
Verdict: reject 7cfef071 as final; proceed with the scoped three-way import and three behavior-changing corrections in Attempt 4.

Attempt 4 working-tree evidence

PR 24 import: bazel-agent batching guidance, result-first goal guidance, and the exact decision-review instruction blob are present. Newer throwaway-record and bounded-delegation guidance remains intact.
Execution overflow now retains a combined arrival-order byte prefix, returns only valid UTF-8, stops live process-group members, and reports truncated rather than rejecting. Timeout and spawn errors retain rejection semantics.
git_worktree keeps 70d8... as immutable history and activates new exact content hash de978...; its record limit is checked before every porcelain record matcher.
Shutdown closes admission, joins the exact admitted package-lock snapshot, then disposes the final active set and awaits retirements through one memoized promise. Initialization rechecks closure after awaited storage boundaries.
Four focused Bazel tests pass, including all new regression targets and decision-review offline validation.
Integrated Bazel test invocation passes ten of ten tests: the whole MCP package plus all three imported/updated skill configurations.
Full affected build passes and validates bazel-agent, goal, and decision-review; root Buildifier passes.
Verdict: behaviorally acceptable as a working-tree candidate. Independent diff review and exact commit-bound validation are still required.

Attempt 4 independent-review verdict

Max-change review proved the bound placement but rejected the completeness flag when exactly maximum records exist, the missing second-record test, and newline-unsafe pathname capture.
Execution review accepted byte bounding, process-group cleanup, and runfiles, but rejected silent invalid-UTF-8 loss and incomplete propagation of host truncation through reusable package result fields.
PR 24 provenance review accepted the three-way import and packaging, but found no eval cases for compatible Bazel batching, immutable candidate promotion, or durable-versus-throwaway push behavior.
Verdict: refine; passing Attempt 4 checks do not qualify it for commit.

Attempt 5 working-tree evidence

Execution tests cover ASCII overflow, multi-byte boundary overflow, malformed UTF-8 both below and above the byte cap, combined stdout/stderr budgeting, timeout rejection, normal nonzero exit, and process-group non-liveness at settlement.
git_worktree active hash is 8853aa20665778aeec43e03f2fe975445002d56ed33ea1cf38bef3946381f60d; its manifest retains only that version and unchanged historical hash 70d8f28dc947d19410b8e79bad90cb416303107243d72d062dd70e30f97a2c3b.
repo_context active hash is abd0db3e26ec970dcf5cc3ec21b9f2b2c452f9302edc0e10c5231a140b92fbc0; all three manifest version hashes match their exact source bytes.
Focused MCP regressions and three skill eval configurations pass 8/8.
Full affected test packet passes 12/12; full affected build and three rules_skill validation aspects pass; root Buildifier passes 1/1.
Exact commit and post-rebase evidence remain pending, so this is a green working-tree candidate rather than a delivered checkpoint.

Attempt 6 working-tree evidence

Current immutable starter hashes are 04b06a7d6277c4a6e8513d970f549ad980a780b68755f28d7b402fe8be26c279 for git_worktree and 94131e058f82328f091613dc68d2717484378066a9c64940d99522c14b48b4d7 for repo_context; line wrapping does not introduce whitespace into the first identifier.
Historical version bytes retain their exact filename hashes. The checkout enforces LF for every hash-addressed JavaScript source.
The parent activation now owns every ctx.exec() child handle. Focused tests prove immediate live-process absence after inner timeout, outer timeout, startup timeout, output overflow, normal completion with a background child, and a background child inheriting output pipes.
Runtime regressions prove shutdown admits complete promotion, rolls back a candidate that fails during active-version persistence, and actively disposes a retired generation whose admitted handler remains gated.
Bazel invocation 9b1b2d34-8490-474a-b12c-e2052bf2d90b passes the current process, unavailable-shutdown, and runtime-admission targets 3/3.
Bazel invocation 7c680be8-e2a6-4b5b-9b45-4a0390f39a5a passes the current process, ripgrep-byte-field, and runtime-admission targets 3/3.
Fresh whole-diff and adversarial supervisor reviews are running. Full integrated, build, skill-aspect, Buildifier, exact-commit, rebase, and remote verification remain unverified after the latest changes.

Attempt 10 focused HMR evidence

Subject: dirty Attempt 10 tree using @deepseek-ai/cordis-plugin-hmr 1.0.16 with pnpm patch hash ec800d86298faacc86c7717ffa1dce7c28116ab1393b8abc198be6ac02c38489.
Primary dependency evidence: the npm registry lists 1.0.16 as the latest release, and current upstream vendor/hmr/src/index.ts retains the same untracked debounced partialReload() plus shared-stash reset behavior.
Independent reproduction: a slow top-level-await generation followed by a second write reached {live: "slow", diskLatest: true} with the unpatched package.
Patch applicability: git apply --check accepts patches/hmr@1.0.16.patch against the exact resolved 1.0.16 package files.
Lock generation: Bazel-managed pnpm invocation a1c50484-20c6-4935-8832-92029d0de3c6 completed successfully with no unrelated dependency resolution changes.
Causal runtime regressions: Bazel invocation ac79a8e4-f5d9-4dd7-a821-29bce3d8ece6 passed explicit release-gated top-level evaluation and asynchronous activation overlaps, failed apply rollback and recovery, manual editing, and deterministic disabled activation.
Repetition: Bazel invocation 65c1932a-896b-470d-9462-086dd93beaff passed ten runs each of runtime_test and starter_packages_test.
Complete project packet: invocations 6490dd57-49e0-4558-b280-f5625db07208, 218e5797-b2d7-44bc-aded-f5df8139ca1c, and 09d4ec2c-aac1-4509-8579-5ef8c5eebe39 passed all project tests, all project builds, and root Buildifier respectively.
Project-layout adaptation: Bazel invocation ea2c6c6e-b2e1-425d-bedb-2ac9679de6c5 passed runtime_test after moving the command, internal implementation, launcher, and test suite to their role-based directories.
Independent final HMR review accepted patch identity, stashed-change draining, complete Fiber cleanup join, declarations, causal overlap tests, rollback and recovery, and disabled-entry activation. Its only finding was a README sentence describing the superseded publication order; that contract text is corrected in the current tree.
The real cmd/mcp_cordis/launch.sh completed MCP initialization and listed all ten tools. While that stdio server remained live, Bazel query invocation 7739c14e-1b22-40c7-94af-b81143e84d4a completed successfully, proving the launcher releases the workspace Bazel lock before serving; SIGINT shut the server down cleanly.
Preliminary current-tree Bazel invocations 95d37231-63f9-44f6-9eee-3f0fe8fb4107, d70f61a2-57e5-4ce9-b8fd-27b06bd02a6d, and 1e186c82-3bcd-4048-a534-fe747e1cf79c pass the complete affected test packet (10/10), affected build packet, and root Buildifier check.
Guarded delivery inspection bound same-repository PR 32 to local and remote feature OID bc4e5ae97ef9ea968c01b1b2a55403ae032a6a8d, fetched base OID d29f9d471ea467e8dfc75db4eedeedbbae43dc2d, and SSH transport. All nine linear feature commits have the task-bot author and committer identity; the only refusal is version 1’s unconditional multi-commit consolidation guard, which is unchanged on the fetched base.
The user explicitly authorized the narrow adapter extension. Its exact-head consolidation path verifies linearity, identity, oldest ownership marker, pull-request metadata matching the requested aggregate projection, signature requirements, and every other inspection refusal before creating one aggregate commit. Integration coverage proves that the pre-consolidation remote head remains the receipt-bound publication lease.
Bazel invocations 574dadd5-51b1-443e-b8c2-50ca5d257eb2 and 030a8bb4-2a22-4ece-b632-b3c75572bcee pass the complete adapter suite once, then its Go, skill-validation, and root Buildifier targets three times.
Independent adapter review rejected the first implementation because clean ranges had no staged delta. The correction permits an unchanged index only behind validated exact consolidation evidence, while parent-to-tree scope validation continues to reject an empty aggregate. A clean --path regression proves tree preservation and one final commit; Bazel invocation 0d715375-6a8d-4269-ad3e-f8a002888808 passes, and independent re-review accepts the corrected adapter with no remaining findings.
After adding upstream-compatible root-consumer visibility to the branch-owned decision-review skill, Bazel invocations 6099d90d-0ade-43b2-b50b-8f7050c26c32 and 7f4b37a4-b970-46ea-bc76-b4a60aeeab59 pass its focused validation and the root Buildifier check; git diff --check also passes.
Guarded consolidation and rebase produced one candidate commit on fetched base 63e7b9f0be1e054373415914ff3d2ea2282aa3da. The adapter now stages deletions and symlink-to-directory changes and permits a rebased path to vanish only when the old candidate and new base have the exact same Git tree entry.
Exact code-candidate Bazel invocations 13588b19-1f8a-43a7-8006-f9d5d4652670 and 5863ac24-3bb2-47be-99fb-50141e933018 passed all 12 affected tests and all 29 affected builds, including Buildifier and discovery-link validation. Live launcher initialization listed all ten gateway tools while concurrent query invocation 4637f187-d05e-4905-8153-18fca8644ea1 passed.
Verdict: the focused race, recovery, layout, repeated-run, project-wide, consolidation, and exact code-candidate evidence pass. The final adapter-and-record rewrite, remote publication, hosted review reconciliation, and final receipt verification remain open.

Attempt 11 final review evidence

Guarded publication and receipt verification established a clean, single-commit feature branch on base 63e7b9f0be1e054373415914ff3d2ea2282aa3da, with the local and remote tree identical and PR 32 synchronized.
The exact-head hosted review completed against the published aggregate and reported three actionable findings: lexical symlink reopening, unbounded /proc inspection retries, and a 100 ms process-start assumption.
Repository reads now open the canonical target with O_NOFOLLOW, validate the opened descriptor through /proc/self/fd, inspect and read through that same handle, and retain the existing byte bound. A regression proves an internal symlink read never reopens the lexical alias through ctx.readText.
Process-group verification now skips inaccessible per-PID entries and turns three consecutive inspection failures into EXEC_CLEANUP; a direct regression proves the retry bound. The timeout cleanup fixture now allows a five-second startup window before exercising forced group cleanup.
Bazel invocation d32cccf7-b5b9-427c-93a1-6b612e32a0aa passed all seven MCP tests. Invocation 9d11ce11-1f79-4077-b61a-efa95a5fc3de built all 16 MCP targets. Invocation aadcc7f6-e2b3-4480-8b76-0607b2017415 passed three runs each of the process-supervisor and repository-context regression targets.
Final publication, exact-head review completion, thread reconciliation, and receipt verification are performed by the guarded delivery workflow; the ignored receipt is the authoritative mutable delivery record.
Follow-up exact-head review identified lexical reopening in git_worktree. Repository selection and discovered-root use now retain verified directory handles for the complete tool call, and all Git -C arguments address those handles through /proc/<pid>/fd. The focused command-contract test and real Cordis starter-package integration pass together in Bazel invocation 4c3eba8d-32c9-47e9-a257-f8af92ef0c19; invocation 6c638120-90cb-446c-b76e-6d39df3640e5 repeats both targets three times. Invocations ef83ec38-84ed-466e-abbd-ffd6cef892c1 and 16e0c322-adc7-4763-8ff4-11d5f38a4172 pass the complete seven-test and sixteen-target MCP packets.
The next exact-head pass identified the same lexical reopening in repo_context’s ripgrep and Git metadata branches. Selected search paths and repository directories now remain open while subprocesses address them through /proc/<pid>/fd; reported ripgrep paths are mapped back to stable workspace-relative names. Directory kind and entry inspection also use the selected handle. Bazel invocation a3f4ed56-a44b-46d6-8717-c38ecc7f05eb passes the focused context contract and real ripgrep/Git starter integration together. Invocation e7af6e8f-823e-40ef-a833-dcb0a704f46f repeats both three times, while invocations 9fd4d465-957a-424f-9bb8-f6e10eb93009 and 4a464ddd-f646-4b9a-aaab-a411bf930ee0 pass the complete seven-test and sixteen-target MCP packets.
The terminal exact-head review found that the JavaScript regex fallback could monopolize the MCP event loop through backtracking and could not match ripgrep’s Unicode regex semantics. Regex search now requires ripgrep when the executable is unavailable, while the bounded fixed-string fallback is preserved. Bazel invocation b98534c0-1667-462b-81d5-ee393fca343b passes the focused context and real starter integration targets; invocations 4689e7cb-9600-4b35-ad7a-97e02cd6730c and 557f322c-4fad-4358-bf5f-98ad9b8972b0 pass the complete seven-test and sixteen-target MCP packets.
The next exact-head pass found that invalid UTF-8 replacement decoding changed fixed-search byte offsets when ripgrep was unavailable. The fallback now verifies that decoded text round-trips to the original bytes and fails closed otherwise. Bazel invocation 449ea2c4-4d52-44d2-b7d1-b1e9745359bd passes the focused context and real starter integration targets; invocations 77bae252-af20-4242-89d8-7d6bc242b64f and 3a0bd136-a327-416a-8128-aaaec171bd9c pass the complete seven-test and sixteen-target MCP packets.

Mon, 01 Jan 0001 00:00:00 +0000

Failure ledger

Back to durable goal

Attempt 8 hosted review finds starter fallback and encoding gaps

Candidate: published standard-Cordis commit deaa2dcd.
Result: hosted review found three valid defects after the earlier local whole-diff review had accepted the runtime architecture.
Causes: the no-ripgrep fallback recursively traversed ignored and hidden files, JavaScript string indexes were exposed as byte offsets, and a bounded textual HTTP body decoded an incomplete trailing UTF-8 sequence.
Strategy delta: fail closed for directory fallback, retain explicit-file fallback with true UTF-8 offsets, and decode only a complete UTF-8 prefix.
Regression guard: explicit hidden-file versus directory cases, fixed and regex non-ASCII offsets, and a one-byte multibyte HTTP preview must pass with the complete MCP test/build packet.
Follow-up causes: lowercasing a line could change UTF-16 length before offset projection, fallback glob filtering contradicted ripgrep’s explicit-path precedence, and unfiltered listing did not preserve a healthy scope after partial startup.
Follow-up guard: length-changing İx, explicit file plus excluding glob, and malformed-project/healthy-scratch listing cases pass with the complete MCP packet.
Final-review causes: config parsing alone did not identify a scope whose Include never mounted, and bounded reads reused the requested endpoint after clipping content.
Fresh-scrutiny cause: idempotent initialization returned an empty error list after partial startup because only the first call retained local failures.
Additional fresh-scrutiny cause: UTF-8 suffix trimming did not distinguish a byte-cap split from a naturally completed malformed response body.
Final guard: missing-module and malformed-config scopes are both skipped by unfiltered listing, clipped reads report retained endpoints, and repeated initialization preserves structured scope errors. Textual bodies trim an incomplete suffix only when locally truncated. repo-delivery now makes this correctness scrutiny an explicit post-edit gate.

Exact aggregate runtime evidence was timing-sensitive

Candidate: post-review Attempt 8 aggregate validation.
Result: the complete packet failed only when system load delayed a wall-clock <400 ms assertion and allowed an expected 300 ms rejection to occur before its assertion was attached.
Cause: the test inferred synchronous admission from elapsed time and created a temporary unhandled-rejection window while waiting for a PID file.
Strategy delta: assert the wrapped synchronous-admission error semantics and attach the expected rejection before awaiting the fixture handshake.
Regression guard: the complete runtime target passes three consecutive concurrent runs without loosening production deadlines.

Failed-import rollback waited for an event Cordis does not emit

Candidate: loaded exact aggregate validation after the evidence correction.
Result: a failed source update occasionally reported reload_rollback_failed even though Cordis had already restored the prior module cache.
Cause: failed HMR import restores its cache and returns without emitting hmr/reload; the host always required a second reload event after restoring prior bytes.
Strategy delta: after restoring bytes, accept the exact prior cache marker immediately; retain correlated HMR waiting when the failed candidate marker actually reached the cache.
Regression guard: three concurrent runtime runs prove failed-update rollback, source restoration, and subsequent healthy invocation.

Attempt 1, check 1: npm repository analysis

Command: bazel_agent bazel query //projects/mcp_cordis:all
Result: failed before target analysis.
Cause: rules_js requires pnpm v10 workspaces to declare onlyBuiltDependencies, including when lifecycle actions are disabled.
Evidence: repository fetch failed in verify_lifecycle_hooks_specified with that exact requirement.
Strategy delta: declare an empty lifecycle allowlist in the project-owned workspace and regenerate its exact lock before rerunning the same query.
Regression guard: successful focused query and build of the translated npm repository.

Attempt 1, check 2: package query after npm correction

Command: bazel_agent bazel query //projects/mcp_cordis:all
Result: npm translation succeeded; target loading stopped because the deliberately non-empty starter-package glob had not yet been populated.
Cause: implementation was queried while the parallel starter-package draft was still outstanding.
Strategy delta: retain the non-empty invariant and add the three accepted packages before rerunning the same query.
Regression guard: the starter_packages target must contain real files and the focused query must succeed.

Attempt 1, check 3: runtime test process did not terminate

Command: bazel_agent bazel test //projects/mcp_cordis:runtime_test
Result: both test bodies completed in under 400 ms, one failed, but a worker retained by the failing test kept the process alive until the run was interrupted at 144 seconds.
Cause: the test registered cleanup only along its success path, so the first assertion failure leaked its runtime and obscured the underlying defect.
Strategy delta: register unconditional node:test teardown before the first assertion, then rerun to expose the real behavioral failure promptly.
Regression guard: the target must terminate normally on both passing and failing assertions.

Attempt 1, check 4: activation error assertion mismatch

Command: focused runtime test after unconditional teardown.
Result: target terminated in 0.8 seconds; the MCP gateway test passed and the lifecycle test stopped at its syntax-rollback assertion.
Cause: the runtime correctly exposed activation_failed as the error’s machine-readable code, while the test searched only its human message.
Strategy delta: assert the stable code and separately check the underlying syntax diagnostic.
Regression guard: failed activation retains the working v2 generation and reports both the stable wrapper code and candidate cause.

Starter search depends on undeclared ripgrep (occurrence 1)

Command: bazel_agent bazel test //projects/mcp_cordis:starter_packages_test.
Result: failed in 0.4 seconds with spawn rg ENOENT.
Cause: repo_context_search invoked the preferred ripgrep engine without a fallback, while the Bazel test PATH intentionally does not expose the host installation.
Attempted strategy: none before this measurement.
Strategy delta: Attempt 2 adds a bounded in-process fallback while retaining ripgrep when available.
Regression guard: the unchanged hermetic starter test must exercise a successful search and all remaining package handlers.
Latest result: resolved in Attempt 2. The unchanged hermetic test passes with the new bounded JavaScript fallback and executes all eight tools.

Lifecycle drain test uses an elapsed-time race (occurrence 1)

Command: bazel_agent bazel test //projects/mcp_cordis:all on rebased commit e3e74cb1e573867825347292bf17220a5b9a4a0c.
Result: three test targets pass; runtime_test reports actual drain count 0, expected 1.
Cause: the test delays the old request for 150 ms but must start and validate a replacement worker before retirement. Nothing guarantees the swap occurs before the fixed request delay expires.
Attempted strategy: a 20 ms sleep before starting replacement; this proves that the old request started, not that it remains active at the later swap.
Strategy delta: Attempt 3 uses an explicit started marker and release latch.
Regression guard: run the focused lifecycle test and complete suite with no wall-clock assumption controlling the drain-count assertion.

BUILD data labels not in Buildifier order (occurrence 1)

Command: bazel_agent bazel test //:buildifier_test during Attempt 3.
Result: failed with an exact three-line ordering diff in projects/mcp_cordis/BUILD.bazel.
Cause: the external-style :node_modules/... label followed the two shorter local labels in runtime_test.data.
Strategy delta: apply Buildifier’s exact lexical ordering and rerun the same repository formatter target.
Regression guard: //:buildifier_test must pass on the frozen candidate.
Latest result: resolved. The forced Buildifier test passes on commit 7cfef071.

Remote publication lacks explicit authorization (occurrence 1)

Intended command: repository delivery publish using the exact preparation receipt and validated head 7cfef071.
Result: the approval gate rejected execution before any push or pull request mutation.
Cause: the latest user instruction explicitly requested a rebase and did not authorize the separate consequential remote publication operation.
Safe attempts: preparation, exact-tree validation, and local commit are complete; no workaround or indirect mutation was attempted.
Exact unblocker: explicit user authorization to push this branch and create or update its pull request.
Latest result: resolved. The user explicitly requested push and continued goal execution; PR 32 was published at 7cfef071 and remains the authorized delivery vehicle for the corrected candidate.

Published candidate has three valid review defects (occurrence 1)

Candidate: PR 32 commit 7cfef0719075ad372c3bb257ad216b35770356b2.
Result: automated review found three independently reproducible defects.
Causes: output overflow rejects instead of returning bounded data with a truncation marker; branch records bypass max_changes; shutdown snapshots active workers before an admitted activation finishes.
Strategy delta: Attempt 4 changes each controlling mechanism and adds a black-box regression for each, rather than suppressing or merely replying to the review.
Regression guard: republish only when all focused tests, the full MCP Cordis package, imported skill validation, and Buildifier pass on one exact commit.
Latest result: resolved in the Attempt 4 working tree. Four focused tests, all ten integrated tests, the complete package build, three skill-validation aspects, and root Buildifier pass. Exact-commit rerun remains required.

Attempt 4 independent review rejects completeness claims (occurrence 1)

Candidate: uncommitted Attempt 4 working tree after all recorded tests passed.
Result: four directly related semantic and evidence gaps survived.
Causes: invalid UTF-8 loss did not set truncated; several starter fields ignored host truncation; Git status inferred truncation from result length instead of actual omission and used newline-unsafe path regexes; imported skill eval cases did not exercise their new contracts.
Strategy delta: Attempt 5 makes loss explicit, propagates truncation by field, parses one-record lookahead semantics, adds newline/exact-limit tests, and expands offline eval cases before another integrated run.
Regression guard: independent review must find no correctness issue before delivery preparation; a green test suite alone is insufficient.

Unavailable worker teardown escapes shutdown tracking (occurrence 1)

Evidence: independent shutdown review of Attempt 4.
Cause: #handleUnavailable() removes the activation from #active, while its worker termination is asynchronous and was not added to #retirements.
Strategy delta: track the activation’s idempotent dispose() promise as a retirement at the same moment it is removed.
Regression guard: a deterministic unavailable-then-shutdown scenario must prove shutdown does not finish before the teardown promise.

Main references an absent decision-review skill (occurrence 1)

Evidence: current base 7ad2704c mentions decision-review in AGENTS.md, but the referenced package is absent from that tree.
Cause: the skill exists in open PR 24, not in the rebased master commit.
Strategy delta: import only PR 24’s four projects/agents changes, merged against current guidance, and supply validation assets required by current repository policy.
Regression guard: build and validate the imported skill through its Bazel skill_library and offline Promptfoo target.
Latest result: resolved in the working tree. decision-review matches PR 24’s instruction blob and passes quick validation, offline Promptfoo loading, and the repository skill-validation aspect.

Attempt 5 independent review rejects lifecycle and compatibility

Candidate: green uncommitted Attempt 5 working tree.
Result: focused tests passed 8/8, integrated tests passed 12/12, the affected build and skill aspects passed, and Buildifier passed; independent review nevertheless found release-blocking defects.
Causes: immediate Worker.terminate() can bypass detached-child cleanup; already-admitted handlers can spawn after one-shot disposal cleanup; promotion is outside the shutdown lock snapshot; an unavailable candidate’s one-shot notification can be ignored during persistence; and always-success output truncation silently changes retained package-version semantics.
Additional gaps: command signals/failures, exact-bound search and omitted records, Git optional writes/history framing, LF hash portability, weak integration assertions, and contradictory or domain-specific imported-skill rules.
Strategy delta: Attempt 6 versions partial-output behavior explicitly, closes process and runtime admission, creates sole final package candidates, and binds every completeness claim to a direct regression.
Regression guard: no delivery preparation until a fresh review accepts the new candidate after all invalidated gates pass.

Attempt 6 first final review rejects worker-side process ownership

Candidate: green Attempt 6 working tree before parent-owned supervision.
Result: focused tests, the 14/14 integrated packet, build, skill validation, and Buildifier passed; independent reviews still rejected release.
Causes: outer timeouts settled before cleanup; signaling a process group was called reaping; the worker’s native-spawn/PID-publication window could not be both bounded and orphan-safe; direct exit could leave inherited pipes open; shutdown awaited but did not dispose retired generations; ripgrep byte fields could be returned as empty complete text; and durable records were stale.
Strategy delta: the parent activation now owns process spawning and group cleanup, runtime tracks retired activations rather than only their promises, byte fields set explicit truncation, and the durable goal records every verdict and invalidated gate.
Regression guard: immediate non-liveness assertions, inherited-pipe cleanup, fatal cleanup ordering, retired-generation shutdown, byte-field cases, and a fresh adversarial review must pass before final integrated validation.

Custom manifests and hash versions are the wrong extension model

Candidate: published PR 32 checkpoint 7cfef071 and its Attempt 6 descendants.
Result: the user rejected the per-package manifest.json, immutable versions/, and active-pointer design as nonstandard and temporary-looking.
Cause: the runtime had grown a second package manager instead of using Cordis Loader entries, Include-backed configuration, HMR, and Git history.
Strategy delta: Attempt 7 deletes the custom store and workers, pins the official services, and uses cordis.yaml plus ordinary ESM modules.
Regression guard: no package manifest, hash-named source snapshot, custom storage layer, or version-file .gitattributes rule may remain.

In-process standard Cordis needs reliability admission guards

Candidate: independently reviewed Attempt 7 working tree.
Result: review found that accidental stdout writes could corrupt stdio, Promise/async-iterator activation or top-level await could wedge lifecycle mutation, filename-only HMR events could acknowledge the wrong write, and response timeout could leave invocation-owned children running.
Strategy delta: reserve a private protocol stream, use Node’s ESM parser to reject top-level await, require synchronous object activation, correlate managed source with a named-export token, and use an invocation-scoped supervisor that cancels and joins ctx.exec().
Regression guard: real stdio logging, hung activation, source round-trip, invalid/expired invocation, and descendant non-liveness tests all pass.

Official HMR requires Node internal-module access

Command: first Attempt 7 runtime_test initialization.
Result: HMR rejected startup with --expose-internals is required for HMR service.
Cause: the optional native fallback peer was not reliably visible through Bazel’s strict pnpm layout.
Strategy delta: every runtime-bearing Bazel launcher passes the official package’s supported --expose-internals Node flag. Automatic peer install is disabled because all required peers are pinned explicitly and the optional native fallback is unnecessary.
Regression guard: the complete project build and all runtime tests must boot through the Bazel launchers.

Root Fiber uid zero skips watcher disposal

Command: runtime and starter tests without Node’s force-exit option.
Result: both test bodies passed but timed out with live FSEventWrap resources after runtime.shutdown().
Cause: shutdown guarded root.fiber.dispose() with root.fiber.uid; Cordis assigns the root Fiber uid 0, so the truthiness check skipped every root-owned cleanup effect, including HMR watchers.
Strategy delta: dispose whenever the root Fiber exists, independent of its numeric uid. Remove force-exit workarounds from tests and keep stdio shutdown graceful.
Regression guard: runtime, starter, and real stdio tests must exit normally without --test-force-exit or process.exit().

Review completion is not thread reconciliation

Candidate: published commit cfab0fb5 after a completed hosted review.
Result: the review summary completed, but GraphQL thread inspection exposed one unresolved older regex-parity finding and one new annotation finding.
Cause: regex fallback omitted JavaScript Unicode mode and matched surrogate halves; source-overwriting MCP tools declared destructiveHint: false.
Strategy delta: enable Unicode scalar matching, mark both potentially overwriting tools destructive, and treat the review-thread graph—not the summary state—as the authoritative review ledger.
Regression guard: an astral . fallback match must be one UTF-8 span, and real stdio tool discovery must expose both destructive annotations.

Fallback event and empty-range boundaries diverge

Candidate: published review correction bc4e5ae9.
Result: the next hosted review found duplicate, out-of-order fallback context around adjacent matches and a null endpoint for an existing empty line.
Cause: context filtering knew only the current matching line, while bounded reads inferred range existence from non-empty selected text.
Strategy delta: precompute match classifications, emit the union of match and context lines once in source order, and track whether the requested range exists separately from its content.
Regression guard: adjacent matches followed by context must emit match/match/context in line order; a selected empty line reports its line number while a start past EOF reports null.

Delivery adapter refuses the multi-commit feature range

Candidate: local Attempt 9 changes above published head bc4e5ae9, with fetched base d29f9d47.
Result: read-only delivery inspection reports nine feature commits and refuses preparation; version 1 will not infer consolidation ownership.
Cause: only the first commit carries the adapter’s ownership disclaimer, while the adapter supports preparation of at most one feature commit.
Rejected workaround: direct rebase, reset, cherry-pick, or a replacement branch would bypass the GitHub adapter’s explicit safety refusal.
Required strategy delta: obtain scope to add a guarded exact-head, merge-base-aware consolidation path to repo_delivery, or have that support land separately before resuming the rebase.
Resolution: the user explicitly authorized a guarded adapter extension. repo_delivery prepare --consolidate <exact-inspected-head> now verifies a merge-free linear range, identical author and committer identities, the oldest commit’s ownership marker, unchanged pull-request projection, signature preservation, and every unrelated refusal before replacing the range. Its integration test also proves the prior remote tip remains the receipt-bound publication lease.

Cordis HMR loses a write during an in-flight reload

Candidate: Attempt 9 with unmodified @deepseek-ai/cordis-plugin-hmr 1.0.16.
Result: a deterministic slow top-level-await replacement followed by a second write left the latest source on disk but the first replacement live.
Cause: debounced partialReload() work was not serialized; each successful run reset one shared stash even when a later change arrived during import.
Rejected wrapper workaround: public HMR emits neither import-failure nor settled-activation events, so a wrapper gate would either reopen unsafely on a timeout or wedge permanently after failure.
Strategy delta: Attempt 10 uses standard pnpm patching to serialize the owning HMR task, snapshot each change set, and drain changes observed while it runs.
Regression guard: overlapping writes during both slow module evaluation and slow asynchronous activation must converge to the latest persisted source.

Mon, 01 Jan 0001 00:00:00 +0000

Requirements and constraints

Back to durable goal

User requirements

The project is named mcp_cordis and lives under projects/.
Reuse Cordis itself rather than reimplementing its lifecycle architecture.
Keep reusable runtime code under the project for later reuse.
Keep disposable runtime code under out.
Seed the project with packages based on recurring past-session needs.
Security hardening is not the priority on this dedicated LLM machine.
Codex must load the MCP from project-scoped configuration so different clones and linked worktrees use their own source and disposable state.

Repository constraints

Use bazel_agent for every Bazel command.
Pin external dependencies reproducibly and retain required notices.
Keep disposable task scratch under out/mcp_cordis; maintain this explicitly requested reusable goal under projects/mcp_cordis/goals.
Preserve unrelated working-tree changes.
Prefer a narrowly scoped project and focused validation.

Assumptions

“Based on past sessions” means extracting generic recurring workflows, not copying private conversation text, credentials, or secret-bearing data.
Host-only JavaScript packages are the initial scope; browser UI packages are not required for the first working server.
A stable gateway invocation tool is required because MCP clients differ in when they consume tool-list change notifications.

Requirement changes

2026-08-30: project name changed from agent_extension_host to codex_cordis, then finally to the client-neutral mcp_cordis.
2026-08-30: storage clarified as two-tier: reusable project packages and disposable out packages.
2026-08-30: the user promoted the runtime-extension goal directory from disposable out coordination to durable project documentation for future reuse.
2026-08-30: remote master advanced and the user explicitly requested a rebase before implementation continued. The task commit was rebased from 775f44d3b56146005e44980f3cf948785f963ba0 onto 7ad2704cd27757355ab36ec8eb1bb27ef9e1d91d; all prior checks were treated as invalid until rerun.
2026-08-30: after publication, the user explicitly expanded the delivery to include only the projects/agents subtree changes from PR 24. PR 24 changes four files there: bazel-agent, goal, and the new decision-review package. Import those changes three-way against current master; do not import its unrelated render or infrastructure content.
2026-08-30: the user rejected the custom per-package manifests and requested standard solutions. Runtime persistence must use official Cordis loader entries and cordis.yaml; normal reusable files and Git replace committed content-addressed source history.
2026-08-30: after review-driven fixes exposed additional correctness gaps, the user required repo-delivery to invalidate prior correctness verdicts after code changes and require fresh diff-focused scrutiny beyond green tests.
2026-08-30: the user rejected the HMR race-handling complexity and explicitly required the simplest robust MCP wrapper for loading DeepSeek/Cordis plugins. Source-tool success therefore means validated atomic persistence and an official Cordis load/reload request, not a custom synchronous activation transaction or on-disk rollback protocol.
2026-08-30: the user required per-workspace Codex loading. The checked-in .codex/config.toml must resolve the active linked worktree; the launcher must release Bazel’s output-base lock before the MCP begins serving stdio.
2026-08-30: remote master advanced again to d29f9d471ea467e8dfc75db4eedeedbbae43dc2d. The user requested another rebase and incorporation review. Preserve the new projects/goal redesign and do not resurrect its deleted predecessor under projects/agents.
2026-08-30: after the delivery adapter refused the exact nine-commit task range, the user explicitly authorized extending repo_delivery with a guarded exact-head consolidation operation and then repeated the request to rebase, review, and incorporate the upstream changes.