Implement MCP restart classes and blast-radius permissions #663

New Issue

2026-07-10T15:32:18-05:00

jcwalker3 commented

2026-07-10 15:32:18 -05:00

Problem statement

All disruptions are treated like full server restart. Scoped recovery (client reconnect, worker restart, config reload, etc.) lacks formal classes with permissions and blast radius.

Operational impact

Over-broad restarts interrupt unrelated work; under-specified reconnect leaves stale capability state.

Scope

Define and implement controlled operations for:

Client reconnect · session reconnect · worker restart · role-runtime restart · connector restart · configuration reload · rolling MCP restart · full MCP restart · host restart

Each class: required permission, expected blast radius, drain requirements, approval requirements, audit requirements, recovery behavior. Prefer narrower class when sufficient (#655 last-resort ladder).

Non-goals

Full multi-instance rolling HA (design child).
Host reboot automation.

Required implementation investigation

#655 #656 #658 #657; namespace model; dual-namespace deployment docs.

Proposed implementation direction

Enum RestartClass + policy table; coordinator routes by class; tests matrix.

Security / workflow-safety

Least privilege; full restart highest bar; client reconnect lowest.

Failure behavior

Unknown class → deny.

Acceptance criteria

All classes documented with fields above.
Coordinator enforces class permissions.
Narrower class does not require full drain when policy says so (documented).
Tests for permission matrix.
Links #652 #653 #655.

Required tests

Permission matrix unit tests.

Observability and audit

Class field on all restart audits.

Dependencies

Parent #655 · Depends #656 #658 · Vision #652 · Roadmap #653

Rollout

Ship classes incrementally starting with client reconnect + full restart.

Canonical issue state

STATE: ready-for-author
WHO_IS_NEXT: author
NEXT_ACTION: Implement restart class matrix in coordinator
NEXT_PROMPT: Author restart classes under #655; PR; stop

Required proof

Policy table + enforcement + tests.

Required final response and handoff

Brief PR → reviewer.

## Problem statement All disruptions are treated like full server restart. Scoped recovery (client reconnect, worker restart, config reload, etc.) lacks formal classes with permissions and blast radius. ## Operational impact Over-broad restarts interrupt unrelated work; under-specified reconnect leaves stale capability state. ## Scope Define and implement controlled operations for: * Client reconnect · session reconnect · worker restart · role-runtime restart · connector restart · configuration reload · rolling MCP restart · full MCP restart · host restart Each class: required permission, expected blast radius, drain requirements, approval requirements, audit requirements, recovery behavior. Prefer narrower class when sufficient (#655 last-resort ladder). ## Non-goals * Full multi-instance rolling HA (design child). * Host reboot automation. ## Required implementation investigation #655 #656 #658 #657; namespace model; dual-namespace deployment docs. ## Proposed implementation direction Enum `RestartClass` + policy table; coordinator routes by class; tests matrix. ## Security / workflow-safety Least privilege; full restart highest bar; client reconnect lowest. ## Failure behavior Unknown class → deny. ## Acceptance criteria 1. All classes documented with fields above. 2. Coordinator enforces class permissions. 3. Narrower class does not require full drain when policy says so (documented). 4. Tests for permission matrix. 5. Links #652 #653 #655. ## Required tests Permission matrix unit tests. ## Observability and audit Class field on all restart audits. ## Dependencies * Parent **#655** · Depends **#656** **#658** · Vision **#652** · Roadmap **#653** ## Rollout Ship classes incrementally starting with client reconnect + full restart. ## Canonical issue state ```text STATE: ready-for-author WHO_IS_NEXT: author NEXT_ACTION: Implement restart class matrix in coordinator NEXT_PROMPT: Author restart classes under #655; PR; stop ``` ## Required proof Policy table + enforcement + tests. ## Required final response and handoff Brief PR → reviewer.