Implement MCP restart coordinator and impact analysis #658

New Issue

2026-07-10T15:31:09-05:00

jcwalker3 commented

2026-07-10 15:31:09 -05:00

Problem statement

No central restart coordinator evaluates active sessions, leases, mutations, and blast radius before restart. Impact is invisible until work is already disrupted.

Operational impact

Uncoordinated restarts destroy concurrent LLM work; operators cannot preview blast radius (#652 console needs this API).

Scope

RestartCoordinator service/API: request → evaluate → impact report → allow/deny/override-required.
Inputs: sessions, projects, issue/PR work, leases/locks, mutations, critical sections, worktrees, clients, pending tools, heartbeats, checkpoint completeness.
Output impact preview DTO for console (#642/#670).
Record narrower recovery attempts already tried.
Single entry for sanctioned restarts post-#657.

Non-goals

Drain protocol implementation (separate child).
HA multi-instance.
UI (console child).

Required implementation investigation

#655 #656 #657; control_plane_db sessions; lease/lock stores; allocate_next_work; heartbeats; #613.

Proposed implementation direction

Module + MCP tool gitea_request_mcp_restart (dry-run default) returning impact JSON; mutative apply later gated by drain proof.

Security / workflow-safety

Capability-gated; fail closed if inventory incomplete; redaction.

Failure behavior

Incomplete evaluation → deny restart.

Acceptance criteria

Coordinator evaluates listed dimensions.
Impact report includes affected sessions/projects/issues/PRs, mutations, leases, ack state placeholders, blast radius, safe/unsafe/override.
Dry-run does not restart.
Tests with multi-session fixtures.
Links #652 #653 #655.

Required tests

Multi-session impact fixtures; deny when critical section open.

Observability and audit

Audit every evaluation request/result.

Dependencies

Parent #655 · Depends #656 · Soft #657 · Vision #652 · Roadmap #653 · Feeds drain/console children

Rollout

Dry-run only until drain gate lands.

Canonical issue state

STATE: ready-for-author
WHO_IS_NEXT: author
NEXT_ACTION: Implement coordinator + impact DTO + dry-run tool
NEXT_PROMPT: Author coordinator under #655; PR; stop

Required proof

Code + tests + sample impact JSON.

Required final response and handoff

Brief PR → reviewer.

## Problem statement No central restart coordinator evaluates active sessions, leases, mutations, and blast radius before restart. Impact is invisible until work is already disrupted. ## Operational impact Uncoordinated restarts destroy concurrent LLM work; operators cannot preview blast radius (#652 console needs this API). ## Scope * `RestartCoordinator` service/API: request → evaluate → impact report → allow/deny/override-required. * Inputs: sessions, projects, issue/PR work, leases/locks, mutations, critical sections, worktrees, clients, pending tools, heartbeats, checkpoint completeness. * Output impact preview DTO for console (#642/#670). * Record narrower recovery attempts already tried. * Single entry for sanctioned restarts post-#657. ## Non-goals * Drain protocol implementation (separate child). * HA multi-instance. * UI (console child). ## Required implementation investigation #655 #656 #657; control_plane_db sessions; lease/lock stores; `allocate_next_work`; heartbeats; #613. ## Proposed implementation direction Module + MCP tool `gitea_request_mcp_restart` (dry-run default) returning impact JSON; mutative apply later gated by drain proof. ## Security / workflow-safety Capability-gated; fail closed if inventory incomplete; redaction. ## Failure behavior Incomplete evaluation → deny restart. ## Acceptance criteria 1. Coordinator evaluates listed dimensions. 2. Impact report includes affected sessions/projects/issues/PRs, mutations, leases, ack state placeholders, blast radius, safe/unsafe/override. 3. Dry-run does not restart. 4. Tests with multi-session fixtures. 5. Links #652 #653 #655. ## Required tests Multi-session impact fixtures; deny when critical section open. ## Observability and audit Audit every evaluation request/result. ## Dependencies * Parent **#655** · Depends **#656** · Soft **#657** · Vision **#652** · Roadmap **#653** · Feeds drain/console children ## Rollout Dry-run only until drain gate lands. ## Canonical issue state ```text STATE: ready-for-author WHO_IS_NEXT: author NEXT_ACTION: Implement coordinator + impact DTO + dry-run tool NEXT_PROMPT: Author coordinator under #655; PR; stop ``` ## Required proof Code + tests + sample impact JSON. ## Required final response and handoff Brief PR → reviewer.