Repository navigation
docs(decisions): accept DEC-101 — a failed plugin load stops mcp-server; document the escape - #833
Merged
Merged
Conversation
…er; document the escape The owner chose option A (stop) over warn-and-continue and stop-only-if-an-allowlisted-syscall-is-missing. Records the escape for an operator serving runtime tools only with a broken plugin: run the MCP process with AINDY_BOOT_PROFILE=platform-only (profile manifests), or leave AINDY_PLUGIN_MANIFEST unset (legacy flat manifests ignore profiles). Both verified; the profile escape is pinned by a test with a control. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Records the owner's decision on DEC-101 (FR-53 (a), #831): "go with A". A plugin that fails to load stops
aindy-runtime mcp-server, the same way it stops the API server's boot. DEC-101 moves fromprovisionaltoaccepted, and the two declined options are recorded.Declined options:
load_plugins()fails the whole profile, so it would decide against a half-loaded registry.The case this breaks on upgrade, and its escape: an operator serving runtime tools only, whose app plugin is broken, had a working MCP server before #831 and won't after. Both escapes were checked against a deliberately broken plugin:
AINDY_BOOT_PROFILE=platform-onlyAINDY_BOOT_MODE=runtime-onlyAINDY_PLUGIN_MANIFESTunsetinit's){"plugins": […]}Written into
MCP_INTEGRATION.md, DEC-101, and the still-unreleased00-831changelog fragment (not yet published, so edited in place). A new test pins the profile escape, with the same manifest stopping the server when the variable is unset as its control.No runtime code changes.
🤖 Generated with Claude Code