Inventory and guard all existing MCP restart paths #657

New Issue

2026-07-10T15:30:56-05:00

jcwalker3 commented

2026-07-10 15:30:56 -05:00

Problem statement

Multiple restart/reload/reconnect paths exist (_trigger_mcp_auto_restart, config touch, IDE reconnect, shell pkill, master-advance auto-restart #591, profile switch restart guidance) without a complete inventory or fail-closed guards routing them through the coordinator.

Operational impact

Bypass paths leave concurrent sessions unprotected; dogfooding impossible.

Scope

Enumerate every code/script/doc path that restarts, reloads, kills, or forces MCP process recreation.
Classify: sanctioned narrow recovery vs unguarded full restart vs forbidden (pkill).
Guard or remove unguarded full-restart entry points; require coordinator token/capability once available.
Document residual host/IDE behaviors outside process control.
Align with #630 contamination detection for shell kills.

Non-goals

Full coordinator implementation (separate).
HA multi-instance.

Required implementation investigation

gitea_mcp_server.py (~10651+), mcp_server.py, native_mcp_preference.py, review_workflow_boundary.py, mcp_daemon_guard.py, #591, #584, #630, #656 policy.

Proposed implementation direction

Inventory markdown + code annotations; wrap auto-restart behind feature flag / coordinator hook; tests that forbidden paths fail closed or mark contamination.

Security / workflow-safety

No secret leakage; fail closed on unknown restart attempts from LLM tools.

Failure behavior

Unknown restart path discovery → durable issue + block in CI if possible.

Acceptance criteria

Complete inventory table in repo docs linked from #655.
Unguarded full-restart paths guarded or deleted with migration note.
pkill remains forbidden (#630).
Tests for at least one previously unguarded path.
Links #652 #653 #655 #656.

Required tests

Unit/integration for guarded entry; contamination classification regression.

Observability and audit

Log restart-path hits with path id.

Dependencies

Parent #655 · Soft-depends #656 · Related #630 #591 #584 · Vision #652 · Roadmap #653

Rollout

Flag-guard before hard-block in production dogfood.

Canonical issue state

STATE: ready-for-author
WHO_IS_NEXT: author
NEXT_ACTION: Inventory + guard restart paths
NEXT_PROMPT: Author #N inventory/guard only; PR under #655; stop

Required proof

Inventory doc + guarded code + tests.

Required final response and handoff

Brief PR → reviewer.

## Problem statement Multiple restart/reload/reconnect paths exist (`_trigger_mcp_auto_restart`, config touch, IDE reconnect, shell pkill, master-advance auto-restart #591, profile switch restart guidance) without a complete inventory or fail-closed guards routing them through the coordinator. ## Operational impact Bypass paths leave concurrent sessions unprotected; dogfooding impossible. ## Scope * Enumerate every code/script/doc path that restarts, reloads, kills, or forces MCP process recreation. * Classify: sanctioned narrow recovery vs unguarded full restart vs forbidden (pkill). * Guard or remove unguarded full-restart entry points; require coordinator token/capability once available. * Document residual host/IDE behaviors outside process control. * Align with #630 contamination detection for shell kills. ## Non-goals * Full coordinator implementation (separate). * HA multi-instance. ## Required implementation investigation `gitea_mcp_server.py` (~10651+), `mcp_server.py`, `native_mcp_preference.py`, `review_workflow_boundary.py`, `mcp_daemon_guard.py`, #591, #584, #630, #656 policy. ## Proposed implementation direction Inventory markdown + code annotations; wrap auto-restart behind feature flag / coordinator hook; tests that forbidden paths fail closed or mark contamination. ## Security / workflow-safety No secret leakage; fail closed on unknown restart attempts from LLM tools. ## Failure behavior Unknown restart path discovery → durable issue + block in CI if possible. ## Acceptance criteria 1. Complete inventory table in repo docs linked from #655. 2. Unguarded full-restart paths guarded or deleted with migration note. 3. pkill remains forbidden (#630). 4. Tests for at least one previously unguarded path. 5. Links #652 #653 #655 #656. ## Required tests Unit/integration for guarded entry; contamination classification regression. ## Observability and audit Log restart-path hits with path id. ## Dependencies * Parent **#655** · Soft-depends **#656** · Related #630 #591 #584 · Vision **#652** · Roadmap **#653** ## Rollout Flag-guard before hard-block in production dogfood. ## Canonical issue state ```text STATE: ready-for-author WHO_IS_NEXT: author NEXT_ACTION: Inventory + guard restart paths NEXT_PROMPT: Author #N inventory/guard only; PR under #655; stop ``` ## Required proof Inventory doc + guarded code + tests. ## Required final response and handoff Brief PR → reviewer.