main · last commit
18 hours ago ·
8tmadfpi
spec-17s Replace specs' private mcpsrv cache/hostguard copies with sr-ht-ecore/mcphttp once vary is parameterised
Lined Up
bd update spec-17s --claim
bd close spec-17s
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-08-17T20:40:05Z |
| Updated | 2026-08-17T20:40:05Z |
What is wrong: `sourcehut-specs/mcpsrv/` carries a private, byte-identical copy of the Host guard (`allowHosts`/`hostAllowed`), the commit-time cache wrapper (`cacheWriter`) and the transport options literal that `sr-ht-ecore/mcphttp` was extracted to hold in one place — and specs does not import `mcphttp`. specs' own `mcpsrv/cache.go` doc comment claims the swap is blocked: "It is not imported because it is not resolvable: the ecore commit that adds mcphttp is not published, and this module pins an ecore from before it."
Why it matters: that excuse is verifiably false. `mcphttp` landed in ecore commit `3aa1fcf` (2026-08-16 01:53); specs (along with bench/coverage/curator) pins `sr-ht-ecore v0.0.0-20260816184219-89fa694cbf54`, ~20h later — the pinned revision already contains the package. The duplication has already cost what it was predicted to cost: specs is one of the copies missing `Stateless: true` (separate issue, D01) and the identical `Flush` bug this package fixes was independently discovered and fixed twice elsewhere in the family (ecore `3bd158f`/`00d7582`, artifacts `6c44e03`).
Sibling that does it correctly: `sr-ht-ecore/mcphttp/{mcphttp,hostguard,cache}.go`. One real blocker exists family-wide: `mcphttp` hardcodes `vary = "Cookie, Authorization"`, and dolt deliberately uses `Authorization` alone — so `vary` needs parameterising in ecore before every service (including dolt) can adopt it; this is being tracked as an ecore-side change, not a specs-side one.
Fix: once `mcphttp.PrivateCache`'s `vary` parameter lands in ecore, delete specs' private `privateCache`/`cacheWriter`/`allowHosts`/`hostAllowed`, import `mcphttp`, call `PrivateCache`/`HostGuard`/`StreamableOptions()`, and delete the false "not resolvable" doc comment. Keep the tool-registration code copied — that part of the "copy, don't import" convention is genuinely about business logic, not infrastructure.
Note: confidence verified — two doc-comment mentions of `mcphttp`, zero actual imports, confirmed by grep across all nine service trees.
Audit: D10 (cross-repo audit, 2026-08-17)
No outgoing dependencies.
Nothing depends on this issue.
| id | spec-17s |
| content_hash | 6d84b595e3d1d014db62509c689e5cc17443ce843dc12e76c44cc7ab9d6afda0 |
| title | Replace specs' private mcpsrv cache/hostguard copies with sr-ht-ecore/mcphttp once vary is parameterised |
| description | What is wrong: `sourcehut-specs/mcpsrv/` carries a private, byte-identical copy of the Host guard (`allowHosts`/`hostAllowed`), the commit-time cache wrapper (`cacheWriter`) and the transport options literal that `sr-ht-ecore/mcphttp` was extracted to hold in one place — and specs does not import `mcphttp`. specs' own `mcpsrv/cache.go` doc comment claims the swap is blocked: "It is not imported because it is not resolvable: the ecore commit that adds mcphttp is not published, and this module pins an ecore from before it." Why it matters: that excuse is verifiably false. `mcphttp` landed in ecore commit `3aa1fcf` (2026-08-16 01:53); specs (along with bench/coverage/curator) pins `sr-ht-ecore v0.0.0-20260816184219-89fa694cbf54`, ~20h later — the pinned revision already contains the package. The duplication has already cost what it was predicted to cost: specs is one of the copies missing `Stateless: true` (separate issue, D01) and the identical `Flush` bug this package fixes was independently discovered and fixed twice elsewhere in the family (ecore `3bd158f`/`00d7582`, artifacts `6c44e03`). Sibling that does it correctly: `sr-ht-ecore/mcphttp/{mcphttp,hostguard,cache}.go`. One real blocker exists family-wide: `mcphttp` hardcodes `vary = "Cookie, Authorization"`, and dolt deliberately uses `Authorization` alone — so `vary` needs parameterising in ecore before every service (including dolt) can adopt it; this is being tracked as an ecore-side change, not a specs-side one. Fix: once `mcphttp.PrivateCache`'s `vary` parameter lands in ecore, delete specs' private `privateCache`/`cacheWriter`/`allowHosts`/`hostAllowed`, import `mcphttp`, call `PrivateCache`/`HostGuard`/`StreamableOptions()`, and delete the false "not resolvable" doc comment. Keep the tool-registration code copied — that part of the "copy, don't import" convention is genuinely about business logic, not infrastructure. Note: confidence verified — two doc-comment mentions of `mcphttp`, zero actual imports, confirmed by grep across all nine service trees. Audit: D10 (cross-repo audit, 2026-08-17) |
| design | |
| acceptance_criteria | |
| notes | |
| status | open |
| priority | 2 |
| issue_type | task |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-08-17T20:40:05Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-17T20:40:05Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| id | 01a01173-ee79-7ea2-9385-22ef6666d885 |
| issue_id | spec-17s |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-08-17T23:40:05Z |
No comments.