Repository navigation
[P0][Protocol] SEP-3415 alignment, client lifecycle and delivery-gap-safe CEP #166
Description
Parent: #41 (Event Intelligence v1.0). Related: #42 (host integration), #44 (CEP correctness), #45 (security), #50 (release contract). Baseline: main / npm package metadata 0.11.0 as inspected on 2026-10-16.
Objective
Bring EI's MCP Events boundary in line with the current experimental SEP-3415 and ensure delivery gaps cannot silently become false-certain CEP outcomes. Preserve the architecture: MCP Events transports/discovers events; EI persists subscriptions, evaluates conditions/patterns and issues targeted wakeups; the host owns connections, authorization, side effects and wake execution. Poll remains a fallback; push/webhook are host-provided modes, not an assumption that the upstream system is event-driven.
The SEP is still a draft. Pin the exact SEP revision used by tests; recheck upstream and conformance suites before merge/release. This is one tracking issue for three separately reviewed, focused PRs, not permission for an unreviewed rewrite.
A. [P0] MCP Events wire/contract alignment (provider/server)
Verified on main:
src/mcpEvents/provider.ts: extension-specific error constants are-32011..-32015rather than current SEP-32023..-32027.src/mcpEvents/server.ts: unknown events use hardcoded-32011; align the low-level exported server too.src/mcpEvents/provider.tsandsrc/mcpEvents/server.ts:ok()returns{jsonrpc,id,result}withoutresult.resultType = "complete"onevents/list/events/poll.src/mcpEvents/provider.tsrequires a result cursor property, although the SEP treats an omitted cursor asnull. Confirm exact nullable/optional semantics and avoid coercing malformed supplied cursors to strings.test/mcp-events-current-draft-conformance.test.mjscurrently asserts the older-32011.
Acceptance:
- Update both public provider and low-level server behavior for the current SEP-3415: error codes/data shapes,
resultType: "complete", omitted/null cursors, discovery and poll results; reject invalid cursor types without executing coerced values. - Preserve the correct capability ID
io.modelcontextprotocol/eventsundercapabilities.extensions, and no legacyserver/discoversurface; do not add obsolete profiles/shims simply to keep pre-v1 consumers compatible. - Add positive/negative wire tests for unknown event, invalid arguments,
-32601unsupported method, poll bootstrapcursor:null, null/omitted cursor andmaxEvents/pagination; keep advertised modes truthful. Test bothcreateMcpEventsProvider()andExperimentalMcpEventsServer. - Document the targeted SEP commit/assumptions and avoid claiming full SEP conformance if push/webhook server behaviors are host-owned or unimplemented in this adapter.
B. [P1] MCP Events client lifecycle / polling safety
Verified on main:
scripts/lib/mcp-events-client.mjsnormalizeCursor()rejectsundefinedinstead of treating an omitted cursor asnull.nextPollMscurrently permits0; the timer path uses a 250 ms minimum, whereas the SEP recommends a configurable 1,000 ms default floor for normal polling (not backlog drains withhasMore:true).invokeProvider()converts every provider failure to a generic error, protecting diagnostics from sensitive untrusted messages but also discarding useful structured distinctions (e.g. terminalForbidden/NotFound).
Acceptance:
- Tolerate missing cursor as
nullacross all permitted client delivery boundaries, and correctly handle replay-unsupported sources. - For
hasMore:false, enforce configurable default 1,000 ms poll floor while honoring larger producer backoff; forhasMore:true, drain promptly but preserve current hard caps (maxPollBatches, page count, rate/resource safety) and no infinite tight loop. - Preserve only allowlisted, structurally validated provider protocol codes/kinds for actionable terminal vs transient handling. Continue scrubbing provider-controlled messages, error objects, telemetry and credentials. No access/authorization bypasses and no blind retry loops after terminal revocation/removal.
- Test 0-ms producer intervals, repeated empty pages,
hasMorebursts, disconnect/reconnect, terminated sessions, late responses and persisted cursor recovery. - Review push/webhook handling against SEP cursor/heartbeat/refresh semantics where the host exposes these adapters, without pretending EI owns all native protocol transport details.
C. [P0 investigation] Gap-aware CEP correctness and negative finality
Risk to prove or disprove before implementing a fix: the client persists a producer's truncated:true / onGap() state, but the reviewed paths do not demonstrate that a source-delivery gap is propagated into the temporal evaluator as incomplete evidence. In particular, notFollowedBy, notPresent, notNext and absence/deadline workflows must not conclude not happened from a period in which matching events may have been skipped.
Important: a provider delivery gap (events/poll.truncated, push notifications/events/active gap, webhook gap) is different from Pattern v2's existing internal budget evaluation.truncated. Do not conflate the flags.
Acceptance:
- Build independent reproducible tests first: same stream with/without a delivery gap, negative temporal window spanning the gap, gap before/after finality, out-of-order/replayed events, interruption + durable restart and cross-tenant/source partition isolation.
- If the risk reproduces, design and implement a bounded source/subscription gap evidence contract (with durable scope and provenance), propagated to relevant evaluator/finality and wake decisions. When evidence is insufficient, mark the result inconclusive/pending or require host-owned authoritative reconciliation; never emit a falsely certain absence-trigger wake.
- Preserve normal matches on unaffected sources/windows, idempotent receipts and host-owned authorization; avoid global indefinite suspension because one unrelated source has a gap.
- Conformance/adversarial tests verify gap signaling for poll, push and webhook adapter callbacks, plus restart and no false-certain negative outcomes. Link any extra formal CEP proof to [P0][B] Formal CEP invariants and adversarial Pattern AST v2 conformance #44.
Delivery / review gates
- Complete three separately scoped A/B/C tracks: A fix(events): SEP-3415 wire contract and protocol error alignment #174; B fix(events): bounded polling floor and nullable client cursors #175/fix(events): quarantine validated terminal MCP Events poll errors #177; C diagnostic test(events): reproduce delivery-gap false-certain negative CEP deadline #179 then corrective fix(cep): block false negative finality on unresolved MCP delivery gaps #180. All changes reviewed and merged with exact-head CI.
- Record exact contracts, compatibility changes, focused adversarial tests, independent review, CI evidence and references across the merged A/B/C PRs and final documentation.
- Report conformance limits explicitly: external draft server #521 / client #541 suites NOT TESTED in this scope (do not count as PASS); native host-owned push/webhook transport flows NOT IMPLEMENTED by EI. EI local boundary/wire/adversarial tests PASS. Revisit upstream suites during [P0][D] v1.0 release contract: clean API evolution and safe persisted state #50 release qualification.
- No Muffin/Artemis repo changes or automatic upgrades as a side effect of EI changes (see [P0][D] v1.0 release contract: clean API evolution and safe persisted state #50).
- Close this tracking issue only after A/B/C are backed by merged PRs, 5/5 exact-head CI and clean independent final review. Do not close [P0][B] Formal CEP invariants and adversarial Pattern AST v2 conformance #44/[Roadmap] Event Intelligence v1.0: integration excellence, correctness and production readiness #41 on this scoped work.
References
- SEP-3415
- Working-group sketch
- Conformance server #521 / client #541
- EI provider, low-level server, client
2026-10-17 protocol/client acceptance evidence (A/B)
A is implemented and merged as #174 (exact review HEAD da64489), including provider and direct server contract/wire tests and pinned draft assumptions. B implemented and merged via #175 (poll floor, cursors, backpressure) and #177 (validated terminal error handling and host-session quarantine). Independent reviews and 5/5 CI passed on merged heads. Existing host push/webhook boundary tests cover callback cursor, heartbeat and onGap handling; EI does not implement native server transport refresh endpoints on behalf of the host. Draft external upstream server/client conformance suites: NOT TESTED here, not reported as PASS; where unsupported by EI's transport role, treat as NOT IMPLEMENTED (host-owned).
C diagnostic #179 is merged; runtime correctness PR #180 is MERGED via squash commit a68b2f87. Final reviewed source HEAD 5050253f: 5/5 workflows SUCCESS (CI with PostgreSQL HA, Security Scan, MCP Launch Check, Public Release Check, Clean-room Smoke). Codex exact-head review at 2026-10-17T14:18:36Z: no major issues; no unresolved threads. No npm publish and no downstream Artemis/Muffin changes.
Closure evidence — 2026-10-17
- A / protocol: fix(events): SEP-3415 wire contract and protocol error alignment #174 merged, corrected SEP-3415 provider/server wire contracts, pinned draft assumptions and local contract tests.
- B / client: fix(events): bounded polling floor and nullable client cursors #175 and fix(events): quarantine validated terminal MCP Events poll errors #177 merged, null/omitted cursors, 1,000-ms normal poll floor with backlog guard, validated terminal errors and host transport boundary tests.
- C / delivery-gap-safe CEP: diagnostic test(events): reproduce delivery-gap false-certain negative CEP deadline #179 and fix fix(cep): block false negative finality on unresolved MCP delivery gaps #180 merged. Durable source-scoped gap evidence, safe negative operators (
notPresent,notNext,notFollowedBy,absence), positive-branch isolation, revision-conditional host repair with fail-closed stale receipt rejection; atomic gap + current-buffer match commit, replay/deadline retry, physical JSONL restart and two-worker PostgreSQL adversarial tests. Serialized state/trigger definitions and safe-JSON source identities prevent host/out-of-band/shared-memory mutation from hiding unresolved gaps. - Source commit:
5050253f66294564d55a132e85cc3a86f58c1396— Codex independent latest-head review: no major issues. Exact-head CI 5/5 SUCCESS. Merge commit:a68b2f87fb344147333b6dae3be1556dcb162718. - Scope limits: experimental SEP, external draft upstream server/client conformance suites NOT TESTED; EI does not implement native host-owned push/webhook transports. No npm publish, no Artemis/Muffin changes. Follow-up v1.0 QA, upstream conformance and release qualification remain in [Roadmap] Event Intelligence v1.0: integration excellence, correctness and production readiness #41/[P0][A] Runtime-neutral embedded facade and integration conformance v3 #42/[P0][B] Formal CEP invariants and adversarial Pattern AST v2 conformance #44/[P0][B] Harden multi-tenant security, untrusted evidence and credential boundaries #45/[P0][D] v1.0 release contract: clean API evolution and safe persisted state #50; those issues are not closed here.
Activity
sarooo17 commentedon Oct 16, 2026
2026-10-16 development continuation (unmerged work; acceptance remains pending independent review/merge):
Part A — PR #174
7f0a61e: provider + ExperimentalMcpEventsServer aligned to draft SEP-3415 (revisionc47fd24): complete result envelope,-32023..-32027error family, strict cursor typing, null/omitted cursors, pagination/maxEvents tests for both surfaces. Public draft assumptions documented indocs/SEP-3415-WIRE-ALIGNMENT.md. 5/5 exact-head CI checks passing.Part B first slice — PR #175
8495d2c: host-configurable 1000ms normal poll floor (larger producer backoff honored), bounded fast hasMore draining, missing cursor => null and hasMore-without-cursor fail closed before durable ingestion. Includes seeded/fixed-clock schedule, backoff, persisted checkpoint, invalid-type and backlog tests. 5/5 exact-head CI checks passing. Part B error kind classification and terminal revocation handling still outstanding; Part C provider-gap propagation into negative CEP not yet addressed.No PRs merged and no npm/Artemis/Muffin changes; reviewer quota is currently exhausted. Do not check acceptance sections A/B/C or close #166 without independent reviewed final heads and merged evidence. Draft SEP still subject to change.
sarooo17 commentedon Oct 16, 2026
2026-10-16 follow-up (unmerged #166 Part B implementation): PR #177 on independent main-based head
528fdbeadds a strictly allowlisted SEP-3415 terminal error classifier (-32023 NotFound,-32024 Forbiddenwith own-datadata.kind) and an exact-session MCP client polling circuit-breaker. NotFound quarantines just the affected subscription; Forbidden prevents further polls on the current host-owned connection object. Producer-controlled messages/stack/data are discarded (including accessor/Proxy hazards), transient/unrecognized codes remain generic and retryable. Tests cover hostile errors, no repeated terminal RPC, unaffected-source progression, sanitized diagnostics. Documented limit: session-local in-memory suppression only, host remains responsible for reauthorization and recovery on restart; no #166 C delivery-gap proof yet. CI under evaluation; review-required, no merge, no npm/Artemis/Muffin changes.sarooo17 commentedon Oct 16, 2026
2026-10-16 reviewer-gated progress update: Part A PR #174 merged as squash
75819e2d976899f8df3f37b1247e5f36ad32ef05after exact-head Codex clean review, zero unresolved threads and five green CI workflows. Part B terminal error slice PR #177 merged as squash72ba4a8ff31c51c457cfeba9a653e721045e1568, also independently reviewed clean on exact head with five green CI workflows. The separate Part B polling floor/cursor PR #175 remains open with 5/5 green tests and new exact-head Codex review underway after addressing deadline scheduling feedback. Part C gap-aware CEP negative finality is not implemented and this parent issue remains OPEN. No downstream changes or npm release.sarooo17 commentedon Oct 16, 2026
2026-10-16 further merge evidence: Part B polling floor PR #175 merged as squash
e5a28c547762baadcd7050b9777dc7e71a1796f8after 5/5 exact-head CI and clean latest-head Codex review, no unresolved findings. This follows merged Part A #174 and Part B terminal handling #177. Part C (gap-aware negative temporal finality) remains unimplemented, and full Part B reconnect/transport-adapter lifecycle matrix still requires audit; keep #166 OPEN. No npm/Artemis/Muffin update.sarooo17 commentedon Oct 16, 2026
2026-10-16 scoped #166 C investigation (no semantic change yet; proof still required): checked current
mainsource paths.scripts/lib/mcp-events-client.mjspersists polltruncatedand forwardsonGaptoonActive({truncated:true})in per-subscription MCP client state.scripts/lib/composite-event-consumer.mjscallstriggerEngine.ingest(correlatable)with just the event; no source delivery-completeness/gap proof is forwarded.src/composite/engine.tstimer/negative pattern evaluation sees match/deadline evidence, not source subscription gap state. Potential safety gap, not yet a demonstrated false-positive: an event missing in an upstream truncated window might incorrectly letabsence/notFollowedByfinalize. The providertruncatedflag is a different kind of incompleteness from the pattern evaluator's internalevaluation.truncatedflag (being improved by #173); do not substitute one for the other.Next code slice should start with a reproducible negative-finality witness on (i) intact stream, (ii) gap crossing forbidden interval, (iii) gap outside interval, (iv) restart and replay, (v) another tenant/source; then implement per-subscription durable gap provenance and interval-aware finality/wake guard, allowing unaffected sources to progress. No premature issue closure or conformance claim.
sarooo17 commentedon Oct 16, 2026
2026-10-16 #166 C update: PR #179 opened as a test-first diagnostic witness, exact head
89aae75c5840ce71b415ec27b0b7dcc830f38aae, 4/4 checks green at observation; independent Codex review requested and running, no merge yet. This is not a production safety fix or proof of conformance. It uses actual JSONLPersistentEventStore+CompositeTriggerEngine+TemporalDeadlineSchedulerto demonstrate the current unsafe behavior: storemcp_client_state.truncated:truefor exactly the forbidden MCP source before anotFollowedBydeadline and the engine still persists a matched negative on timer finality, including after physical store reopen. Clean/no-gap, unrelated-source, gap-after-finality and isolated-store controls distinguish the failure. Poll/push/webhook are persisted-state delivery-mode fixtures, not end-to-end transport tests. Documentationdocs/MCP-EVENTS-DELIVERY-GAP-NEGATIVE-WITNESS.mdnames required durable gap evidence, scoped finality gate, explicit reconciliation and host responsibility. A separate reviewed implementation must invert the unsafe assertions and handle other negative nodes, timer retryability, producer callback tests and scoped isolation. Keep #166 OPEN.sarooo17 commentedon Oct 17, 2026
2026-10-17 continuation for #166 C: diagnostic PR #179 is merged with latest-head independent clean Codex review and 4/4 CI; provider-gap falsified negative finality was independently reproduced. Implementation PR #180 (HEAD
09714c5a8a3a5e929fca45c823d63546ad0bc4d2) has 5/5 CI green, all previous five P1 review threads resolved, and a new independent exact-head Codex review currently running. Added durable snapshot (notPresent/notNext) and temporal (notFollowedBy/absence) retry deadlines, real JSONL engine/scheduler/host acknowledgment/restart regression, sticky JSONL/Postgres gap evidence, and malformed-truncated-page early persistence. Not yet merged or accepted. No package publish or downstream Muffin/Artemis changes. Parent #166 remains OPEN pending latest-head review, merge, scope/conformance/migration evidence checks.sarooo17 commentedon Oct 17, 2026
2026-10-17 — #166 C finality closeout status
fac3f39de61e50dbed4da7f860171f97956d068d.fac3f39requested on fix(cep): block false negative finality on unresolved MCP delivery gaps #180. Do not merge fix(cep): block false negative finality on unresolved MCP delivery gaps #180 or close [P0][Protocol] SEP-3415 alignment, client lifecycle and delivery-gap-safe CEP #166 until it is complete without unresolved blockers. SEP-3415 upstream conformance suites remain NOT TESTED, not represented as PASS; host-owned transports are not implemented by EI.sarooo17 commentedon Oct 17, 2026
#166 C — 2026-10-17 updated merge gate
PR #180 implementation is at exact head
6b1bd9e. All 5 latest-head GitHub workflow gates PASS: CI (including real PostgreSQL HA), Security Scan, MCP Launch Check, Public Release Check and packed-package Clean-room Smoke.Codex's two latest P1s were addressed: (a) a persistent monotonic per-source completeness revision prevents gap→reconcile ABA; (b) conditional negative persistence atomically checks source state AND latest buffer, and on stale comparison the engine reloads current buffer. Regressions include forced ABA+forbidden replay, buffer-only concurrent replay, JSONL reopen/forged revision, and two-worker PostgreSQL fences. Earlier repeated-stale retry P1 is resolved. All pre-existing review threads have been replied to and marked resolved.
Still required to merge/close: independent latest-head Codex review requested on PR #180; no such new review receipt yet, so #180 and #166 remain OPEN. Upstream experimental conformance runs #521/#541 are still NOT TESTED; host-owned modes are NOT IMPLEMENTED in EI, not falsely reported as conformance PASS. No npm publish or consumer repository update.
sarooo17 commentedon Oct 17, 2026
#166 final blocker status — 2026-10-17
PR #180 at exact head
ac982ca2f4e79d60fde5e4bd4a757bc161953843fixes the latest Codex P1: host reconcilers now must supplyexpectedCompletenessRevisionwith their verified replay evidence, and JSONL/PG enforce revision CAS inside their serialized/locked state transition. An older host acknowledgement cannot clear a newly reported gap from another PostgreSQL worker. Dedicated JSONL/manager injection and multiworker PG tests pass; all 5 exact-head CI gates SUCCESS (including PostgreSQL HA and packed clean-room). Original P1 review thread answered/resolved.Only outstanding merge condition: independent Codex review of exact head
ac982ca2requested on PR #180 but not yet submitted. Do not merge based on the earlier Codex review of6b1bd9; retain #166 OPEN until latest-head review is clean, #180 is merged and acceptance/checklist evidence is updated. Upstream draft conformance suites #521/#541 remain NOT TESTED; host-owned modes are NOT IMPLEMENTED, not claimed PASS.sarooo17 commentedon Oct 17, 2026
2026-10-17 #180 latest-head closeout gate
Fix for latest independent Codex P1 (
Do not expose mutable gap records) is committed in PR #180 at exact HEAD27f4f81dbefe20b328bca087f451618aea57a54c. The JSONL MCP state store now creates a deep clone at the write boundary and returns independent deep clones from put/get/list/snapshot so no host-exposed alias can bypass durable gap/revision CAS; added adversarial regression for mutated direct input, returned records, nested arguments, physical restart and valid host reconciliation. All 5/5 exact-head GitHub Actions workflows SUCCESS including PostgreSQL HA, Security, MCP Launch, Public Release and packed-package clean-room. All previously raised inline review threads are resolved.Remaining gate: latest-head independent Codex review requested on #180 at
27f4f81, but a new Codex review receipt has not yet been returned. PR #180 and issue #166 intentionally remain OPEN until the review is confirmed clean and the merge is verified. Upstream experimental external SEP conformance suites #521/#541: NOT TESTED (host-owned transports NOT IMPLEMENTED in EI), not represented as PASS. No npm publish or downstream Artemis/Muffin updates.fix(cep): block negative finality on unresolved MCP delivery gaps (#180)