Repository navigation
docs: audit README, CHANGELOG, SECURITY, shipped guides and tool descriptions against the code for 2.8.0 - #358
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
…t the code for 2.8.0 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
…e code for 2.8.0 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
team_announcement.md (2025 note: '9 tools', old repo URL), .pr_details.md (unfilled PR template), .claude/plans/ticklish-inventing-stearns.md (early plan for a removed feature) and two force-added .dev-skills handoff notes (the directory is gitignored; they carry a host path). Nothing in the code, tests or CI reads them; they shipped in the sdist. Drops the plan's entry from .claude/docs-catalog.json. Owner approved the removal on 2026-10-04. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
- code_examples.yaml: the context7 example now uses query-docs with libraryId and query (get-library-docs no longer exists). - .claude/docs-catalog.json: drop the removed plan's entry (the edit was left unstaged in the previous commit). - code_execution_guide: invoke errors are almost always JSON, but the URL-mode elicitation path returns a plain message; parse defensively. - README: --debug and -q still win over PMCP_LOG_LEVEL. - tasks_cancel description: gateway.tasks_result also records a task. - CHANGELOG #236 entry: later description corrections in this release are noted. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
…get (#358 panel, codex F001) gateway.describe cuts static snippets to max_snippet_lines (default 4); four try/except templates lost their except body at that budget. The loader now returns the longest prefix of at most max_lines lines that parses, or no snippet. The four templates now show the real pattern (ok: false, not an exception), which also fits in four lines. A test checks every template at budgets 1-12 and that each still yields a snippet at the default; reverting to the naive cut fails 14 cases. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
…+ result.isError) (#358 round 2, claude F001) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
#358 round 2, codex F001) The filtering snippets iterated the gateway.invoke envelope as if it were the downstream rows; gateway.describe's read a risk_hint field the schema card does not have; provision_status was polled by server_name/state instead of job_id/status. All six now match the real outputs. New test executes every snippet against responses built from the gateway's own output models (InvokeOutput wrapping a tools/call result, CatalogSearch- Output, SchemaCard, ProvisionOutput, ProvisionJobStatus); on the previous templates it fails 5 of 18. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
… branches (#358 round 3, claude F001/F002) provision_status: gateway.provision returns no job_id when the server is already running, remote or refused; the snippet now waits only when a job exists. describe: warns on the gateway's own safety_notes as well as annotations.destructiveHint. The execution test's fakes now follow the handler (job_id only with status=started; a no-job and a safety-notes variant); on 5df087b's templates the new cases fail. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
…358 round 3, grok F009) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
…ge (#358 round 4, claude F001) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
ViperJuice
added a commit
that referenced
this pull request
Oct 5, 2026
… mode; sized from the returned answer; re-embedded on main 6edf8a4 (see #297) This answers the round-15 board on #314 @ 360fe3e. Codex filed F001 (BLOCKING), and claude filed F003 in the same class. The fix: effective_task_mode(tool_info, task) is the one derivation, and call_tool and gateway.invoke each compute it once. A call that is not a task returns its answer as opaque data: no recognition, no registry lookup, no replacement, and it is sized as returned. A task call returns, and is sized from, the reduced answer. Unrequested answers are not stripped. pmcp parses nothing in them, and the plan states the guarantee exactly. Code: wip/297-code @ 18824c1 (local only), which merges origin/main 6edf8a4 (#345, #358, #363). - #363's own task-mode gate in invoke is reconciled to the single value. - Its ms-to-seconds conversion is combined with raw=_usable_task_raw. - Its code-derived tests now follow task_answer_of. Results: - Sweep: 36 cases. - Codex and claude falsifiers pass; M112-M114 are killed. - Repro: rev 16 replaced both new rows; rev 17 keeps both, and its 11 earlier rows stay clean. - Red on 6edf8a4: 285 failed, 593 passed, 57 errors. - The eight modules: 935 passed. - The full suite: 9271 passed, 5 skipped. - Mutation: 104/106 killed, and 100/106 with NO_STATIC. Restores were sha-verified, with logs on /var/tmp. - Embedding proof on 6edf8a4: 47 of 47 files identical. The plan is 447,968 bytes (437.5 KiB). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qq9UsYfWoENCKhQsuqRkNK
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pre-release documentation audit, requested by the owner before cutting 2.8.0 (release PR #351 waits on this). Three auditors each verified one set of files claim-by-claim against main (file:line evidence, commands run, examples parsed through the real loaders); this PR merges their branches unchanged (disjoint files) plus one owner-approved cleanup.
What changed
github-actionsrow, undocumented CLI commands/flags and a new gateway options/env-var table, policy sections, secret examples that no longer put the value on argv, guidance token costs, config discovery and trust rules, troubleshooting. Known issues linked: cli: pmcp refresh writes its descriptions cache to .pmcp, but the gateway reads .mcp-gateway #352 (refresh cache dir), auth: tenant-aware remote header resolution is never wired (tenant_id is always None) #353 (tenant headers not wired).[Unreleased]: new### Upgrade notescallout (everything now refused or behaving differently, plus known issues); every entry re-verified against the code (stale or wrong claims fixed, same-release fixes folded into their features, test-only entries collapsed); missing entries added (httpx2 security bump, Action pins, test harness, agent-visible data and help text).check_security_claimsOK with 131 cited tests. CONTRIBUTING.md: repo URL, extras, manifest key, CI-matching lint/type commands. SPEC_COMPLIANCE.md: client ping / unknown-method rows; ms-vs-s deviation note (tasks: pmcp documents ttl/poll_interval in seconds but forwards them unchanged; MCP defines both in milliseconds #330).code_execution_guide.md(real startup text,gateway.invokeresult shape, catalog/provision APIs), six tool/argument descriptions (schema snapshot regenerated; diff is those lines only), CLI help, the no-servers startup text, thetry/catch→tryhint (was truncated totry/catc), Playwrightbrowser_take_screenshotwithfilename, the context7 entry in.mcp-gateway/descriptions.yaml.team_announcement.md,.pr_details.md,.claude/plans/ticklish-inventing-stearns.md, two.dev-skillshandoff notes.Code problems found, filed, not fixed here
#352, #353, #354, #356 (security: caller
max_output_charsexceeds the policy cap), #357.Verification (read on this branch)
ruff check / format --check, mypy (52 files),
check_security_claimsOK (131), full suite8282 passed, 3 skipped(npm env unset), workflow/baseline guards after the removal231 passed.🤖 Generated with Claude Code
https://claude.ai/code/session_01GoBxjoLE6NtmqydGnfUKEo
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.