0xLeif · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "workflow_version": 2,
+  "workflow_origin_version": 2,
+  "id": "split-mcp-implementation-into-cohesive-private-modules",
+  "slug": "split-mcp-implementation-into-cohesive-private-modules",
+  "title": "Split MCP implementation into cohesive private modules",
+  "description": "Split MCP implementation into cohesive private modules",
+  "kind": "refactor",
+  "state": "accepted",
+  "canonical_applied": true,
+  "base_commit": "621a74785e3c09b2e9ebea35768e05f5772f886f",
+  "created_at": 1792126103,
+  "updated_at": 1792158833,
+  "affected_specs": [
+    "mcp"
+  ],
+  "affected_paths": [
+    "src/mcp.rs",
+    "src/mcp",
+    "specs/mcp"
+  ],
+  "no_spec_change": false,
+  "no_spec_change_rationale": null,
+  "acceptance_criteria": [
+    "Replace textual MCP includes with ordinary private Rust modules while preserving existing production function bodies and cfg gates; keep run_mcp_server and mcp_tool_definitions as the two external MCP entry points; conserve all existing MCP tests and scan every moved source for provider-process construction; preserve protocol responses, confinement, budgets, publication, rollback and debug race barriers; pass debug unit/integration inventories, release-test compilation and strict canonical contract checks."
+  ],
+  "selected_artifacts": [
+    "context",
+    "plan",
+    "testing",
+    "research",
+    "design",
+    "tasks"
+  ],
+  "dependencies": [],
+  "answers": {
+    "architecture_risk": "yes",
+    "constraints": "Refactor only src/mcp.rs, src/mcp and specs/mcp on base621a74785e3c09b2e9ebea35768e05f5772f886f. Preserve PR800 lifecycle/evidence and PR815 check/fix ownership. Retain historical comment-only include_str scan anchors and add a complete moved-source scan. Cross-module items remain pub(super), not pub(crate). Use cached tools and latest released SpecSync6.1.1. Debug fixture qualification uses an ordinary local environment without inherited CI/forced-color overrides; real hosted lifecycle/CI gates remain pending. This is a technical draft for review, not human approval, acceptance, release or platform qualification.",
+    "public_contract": "no"
+  }
+}
@@ -0,0 +1,49 @@
+{
+  "approvals": [
+    {
+      "gate": "definition",
+      "actor": "0xLeif",
+      "timestamp": 1792157420,
+      "digest": "f864bb4a3d01b12142eb586541b34b7ccd0440ddd32b61bb0b29e90e7766963b",
+      "note": "Leif directly answered the pending explicit PR818/819/820 scope-approval question on2026-10-16: \"Yes I approval all!!! Omfg if you are 95% I approval… test this all locally and fucking fix it\". Genuine human definition-scope approval; actual local qualification, independent review, current lifecycle/protection gates and evidence remain required. Source receipt: _plans/2026-10-15-grok-fanout/receipts/ci-cleanup-human-approval.json. No human implementation-review event or passing tests are fabricated.",
+      "approved_scope": {
+        "schema_version": 1,
+        "change_id": "split-mcp-implementation-into-cohesive-private-modules",
+        "title": "Split MCP implementation into cohesive private modules",
+        "description": "Split MCP implementation into cohesive private modules",
+        "kind": "refactor",
+        "affected_specs": [
+          "mcp"
+        ],
+        "affected_paths": [
+          "specs/mcp",
+          "src/mcp",
+          "src/mcp.rs"
+        ],
+        "no_spec_change": false,
+        "no_spec_change_rationale": null,
+        "acceptance_criteria": [
+          "Replace textual MCP includes with ordinary private Rust modules while preserving existing production function bodies and cfg gates; keep run_mcp_server and mcp_tool_definitions as the two external MCP entry points; conserve all existing MCP tests and scan every moved source for provider-process construction; preserve protocol responses, confinement, budgets, publication, rollback and debug race barriers; pass debug unit/integration inventories, release-test compilation and strict canonical contract checks."
+        ],
+        "dependencies": [],
+        "supersedes": [],
+        "answers": {
+          "architecture_risk": "yes",
+          "constraints": "Refactor only src/mcp.rs, src/mcp and specs/mcp on base621a74785e3c09b2e9ebea35768e05f5772f886f. Preserve PR800 lifecycle/evidence and PR815 check/fix ownership. Retain historical comment-only include_str scan anchors and add a complete moved-source scan. Cross-module items remain pub(super), not pub(crate). Use cached tools and latest released SpecSync6.1.1. Debug fixture qualification uses an ordinary local environment without inherited CI/forced-color overrides; real hosted lifecycle/CI gates remain pending. This is a technical draft for review, not human approval, acceptance, release or platform qualification.",
+          "public_contract": "no"
+        }
+      },
+      "approved_delta_digests": {
+        "mcp": "88c18c553c386951ae8cff08ee73e124879880f42007d9cc34ac5c53dc701cfe"
+      }
+    },
+    {
+      "gate": "finalization",
+      "actor": "specsync:finalization",
+      "timestamp": 1792158833,
+      "digest": "5061bfb954f63eb4cd7be54cc4dc9134affc18daab24b4dbfa7af7fe84ef8709",
+      "note": "Same-PR finalization closing digest"
+    }
+  ],
+  "reopenings": []
+}
@@ -0,0 +1,24 @@
+---
+id: split-mcp-implementation-into-cohesive-private-modules
+state: archived
+type: refactor
+base_commit: 621a74785e3c09b2e9ebea35768e05f5772f886f
+---
+
+# Split MCP implementation into cohesive private modules
+
+## Intent
+
+Split MCP implementation into cohesive private modules
+
+## Affected Canonical Specs
+
+- `mcp`
+
+## Acceptance Criteria
+
+- Replace textual MCP includes with ordinary private Rust modules while preserving existing production function bodies and cfg gates; keep run_mcp_server and mcp_tool_definitions as the two external MCP entry points; conserve all existing MCP tests and scan every moved source for provider-process construction; preserve protocol responses, confinement, budgets, publication, rollback and debug race barriers; pass debug unit/integration inventories, release-test compilation and strict canonical contract checks.
+
+## No-spec Rationale
+
+Not applicable
@@ -0,0 +1,12 @@
+---
+change: split-mcp-implementation-into-cohesive-private-modules
+artifact: context
+---
+
+# Context
+
+PR810 already split the original MCP monolith into two textual include chunks. Those chunks still share one large Rust namespace. This refactor replaces them with ordinary private modules grouped by protocol, handlers, confinement, preflight, snapshots, manifest traversal and publication. The external MCP wire/API contract is unchanged.
+
+Grok produced the local candidate; a separate GPT reviewer compared original declarations/function bodies and test inventories. That review found a release-test import regression, corrected by direct std::fs imports in the two child test modules. No contributor or primary checkout was changed. PR800 evidence and PR815 check/fix files remain outside this scope.
+
+This package began as a complete unapproved technical draft. Leif directly approved its prepared scope on 2026-10-16, conditional on actual local testing and at least 95% engineering confidence; the native writer recorded actor 0xLeif. The direct response is preserved in the coordinator receipt ci-cleanup-human-approval.json. Implementation review, supported finalization and platform qualification still require their actual evidence.
@@ -0,0 +1,9 @@
+# mcp delta
+
+## MODIFIED
+
+### Spec Section Purpose
+
+Model Context Protocol (MCP) server for AI agent integration. Implements JSON-RPC 2.0 over stdio, exposing spec-sync functionality as tools callable from Claude Code, Cursor, Windsurf, and other MCP-compatible agents.
+
+The implementation uses private protocol, tools, confinement, preflight, snapshot, snapshot_manifest and publication modules, with shared fixtures compiled only for tests. The facade retains the existing server and tool-catalog entry points.
@@ -0,0 +1,12 @@
+---
+change: split-mcp-implementation-into-cohesive-private-modules
+artifact: design
+---
+
+# Design
+
+The facade owns only module declarations, the unchanged server/catalog entry points and the complete moved-source provider-process absence test. Protocol handles transport; tools handles dispatch; confinement owns retained-root/path checks; preflight owns input checks; snapshot and snapshot_manifest own bounded copies and workspace discovery; publication owns staged writes and rollback. Shared test fixtures are cfg(test).
+
+Module helpers use private or pub(super) visibility. Public and pub(crate) visibility are not introduced beneath src/mcp. Production bodies/constants and cfg boundaries are conserved; only import qualification and mechanical layout change. Protocol/snapshot child tests import std::fs directly because release-profile cfg(test) cannot inherit a debug_assertions-only parent import.
+
+Historical server_name.rs and publish_staged_file_with_verification_hooks.rs are two-line comment-only files, retained for the existing GitHub source scan. They are no longer included as Rust code. A new MCP test explicitly scans all moved implementation files, so retaining the anchors does not hide actual code from that regression check.
@@ -0,0 +1,12 @@
+{
+  "schema_version": 2,
+  "change_id": "split-mcp-implementation-into-cohesive-private-modules",
+  "implementation_commit": "5e23800ea78c12dc9750c6817002585324c2dbcf",
+  "implementation_tree": "f69d8ca96ff31ee969835425a8da153fabe82099",
+  "contract_digest": "f864bb4a3d01b12142eb586541b34b7ccd0440ddd32b61bb0b29e90e7766963b",
+  "workspace_digest": "4e341a5d11e7141c751ec5817aae38a9dfa5903d9b422fb3da2290a06c3e2539",
+  "closing_digest": "5061bfb954f63eb4cd7be54cc4dc9134affc18daab24b4dbfa7af7fe84ef8709",
+  "review_digest": "0b4e68043921511cd3ba22d0e2bf6411d75b550d2003795e90305f7e95bcea12",
+  "finalization_digest": "95ed43e5cdde1aa9ea3a85a2c699eab3b19e169ee63c149c97072fc8c5e68f1f",
+  "timestamp": 1792158833
+}
@@ -0,0 +1,68 @@
+# Lesson bundle — split-mcp-implementation-into-cohesive-private-modules
+
+Material for folding this change's lessons into each affected module's lesson file.
+Synthesise from what actually happened below; do not restate the change description.
+
+## What this change was
+
+- **Title**: Split MCP implementation into cohesive private modules
+- **Kind**: Refactor
+- **Specs**: mcp
+- **Paths**: src/mcp.rs, src/mcp, specs/mcp
+- **Acceptance**: Replace textual MCP includes with ordinary private Rust modules while preserving existing production function bodies and cfg gates; keep run_mcp_server and mcp_tool_definitions as the two external MCP entry points; conserve all existing MCP tests and scan every moved source for provider-process construction; preserve protocol responses, confinement, budgets, publication, rollback and debug race barriers; pass debug unit/integration inventories, release-test compilation and strict canonical contract checks.
+
+## Evidence
+
+- Verification commit: `5e23800ea78c12dc9750c6817002585324c2dbcf`
+- Base commit: `621a74785e3c09b2e9ebea35768e05f5772f886f`
+- Verified by: `specsync check --spec mcp`
+
+## From the change's context.md
+
+# Context
+
+PR810 already split the original MCP monolith into two textual include chunks. Those chunks still share one large Rust namespace. This refactor replaces them with ordinary private modules grouped by protocol, handlers, confinement, preflight, snapshots, manifest traversal and publication. The external MCP wire/API contract is unchanged.
+
+Grok produced the local candidate; a separate GPT reviewer compared original declarations/function bodies and test inventories. That review found a release-test import regression, corrected by direct std::fs imports in the two child test modules. No contributor or primary checkout was changed. PR800 evidence and PR815 check/fix files remain outside this scope.
+
+This package began as a complete unapproved technical draft. Leif directly approved its prepared scope on 2026-10-16, conditional on actual local testing and at least 95% engineering confidence; the native writer recorded actor 0xLeif. The direct response is preserved in the coordinator receipt ci-cleanup-human-approval.json. Implementation review, supported finalization and platform qualification still require their actual evidence.
+
+## From the change's design.md
+
+# Design
+
+The facade owns only module declarations, the unchanged server/catalog entry points and the complete moved-source provider-process absence test. Protocol handles transport; tools handles dispatch; confinement owns retained-root/path checks; preflight owns input checks; snapshot and snapshot_manifest own bounded copies and workspace discovery; publication owns staged writes and rollback. Shared test fixtures are cfg(test).
+
+Module helpers use private or pub(super) visibility. Public and pub(crate) visibility are not introduced beneath src/mcp. Production bodies/constants and cfg boundaries are conserved; only import qualification and mechanical layout change. Protocol/snapshot child tests import std::fs directly because release-profile cfg(test) cannot inherit a debug_assertions-only parent import.
+
+Historical server_name.rs and publish_staged_file_with_verification_hooks.rs are two-line comment-only files, retained for the existing GitHub source scan. They are no longer included as Rust code. A new MCP test explicitly scans all moved implementation files, so retaining the anchors does not hide actual code from that regression check.
+
+## From the change's testing.md
+
+# Testing
+
+## Local evidence
+
+- Existing MCP baseline:123 unit tests and72 integration tests; original source-declared test inventory conserved, including cfg-only cases.
+- Corrected candidate:124 MCP unit tests and72 unchanged MCP integration tests pass.
+- Full local tests:2583 unit tests pass; the complete462-case integration suite passes after removing inherited CI/forced-color overrides. The original combined lane failed on environment-sensitive assertions; its failed receipt is retained. This is qualification across separately captured stages, not a claim that that lane invocation succeeded.
+- Every remaining native verify stage passes: release build, source-binary strict contract check,64 release-candidate validator controls and29 required-CI controls. Format, clippy and type steps passed before the test stage.
+- Latest released SpecSync6.1.1 strict check passes all62 specs with zero warnings and100% source coverage. Score average and mcp score are100/100.
+- Release test compilation: cargo check --release --tests --bin specsync --offline failed101 before the import correction, then passed0. Release-profile test execution is not claimed.
+- Independent GPT refactor review and narrow cfg correction review are complete. Human review is pending.
+
+## Publication gates
+
+Before pushing, run the mandatory fast pre-push lane and committed-range Trust. An empty base..HEAD Trust result is not evidence for this change. Preserve actual risk/contract/provenance output and report any block. Leif directly approved the prepared definition scope on 2026-10-16 and the supported writer recorded actor 0xLeif. Current native qualification, independent implementation review, same-PR finalization and hosted checks still require actual evidence. Do not remove the package or weaken policy to bypass any of those gates.
+
+## Limits
+
+macOS local execution only. No Windows/Linux runtime or immutable release-candidate qualification is claimed. No new dependency/tool was downloaded. Tests do not prove human acceptance or a statistical95% guarantee.
+
+## Current lifecycle follow-up
+
+The original product source and test bytes remain unchanged from the independently reviewed and locally qualified candidate. The genuine scope approval removes the absence-of-permission condition only; no new local test run, human inspection, native review/finalization or passing hosted gate is inferred from that approval. Fresh command results will be recorded after execution.
+
+## Where these lessons go
+
+- `specs/mcp/mcp.3md`
@@ -0,0 +1,30 @@
+---
+change: split-mcp-implementation-into-cohesive-private-modules
+artifact: plan
+---
+
+# Plan
+
+## Approach
+
+Use a 105-line facade with the existing two external entry points. Move existing bodies into private modules and child test modules; expose sibling helpers only as pub(super). Preserve the old two include_str scan paths as comment-only anchors and scan every actual moved source in the MCP test suite.
+
+## Out of scope
+
+New tools, public wire behavior, security-policy changes, lifecycle implementation, check/fix work, release publication and external provider execution.
+
+## Steps
+
+1. Map declarations, dependencies and platform cfg gates before moving code.
+2. Conserve existing test names/behavior and synchronize canonical file ownership and architecture documentation.
+3. Independently review the move, correct the release-test imports, and qualify debug tests and release-test compilation.
+4. Run all native verification stages and exact committed-range risk/contract/provenance checks before draft publication.
+5. Leave real human acceptance, finalization and hosted review/CI gates pending.
+
+## Risks
+
+Cross-module visibility, cfg-only imports, omitted scan coverage and lost tests can change behavior despite a mechanical move. Cross-module cycles already existed as calls in the monolith; moving them does not remove those dependencies. Independent comparison, inventory conservation and runtime regression tests address these risks without claiming formal equivalence.
+
+## Constraints consulted
+
+Existing MCP capability confinement, byte/work budgets, retained-handle identity, atomic publication/rollback and race barriers remain unchanged. The mcp.3md lessons require those guarantees. Cached tools only; latest released SpecSync6.1.1. No overlap with PR800/815.
@@ -0,0 +1,12 @@
+---
+change: split-mcp-implementation-into-cohesive-private-modules
+artifact: research
+---
+
+# Research
+
+The baseline has123 macOS MCP unit tests and72 MCP integration cases. The candidate retains those tests, adds one complete moved-source scan (124 unit tests), and leaves integration/mcp.rs unchanged. The independent source review conserved all125 source-declared original tests, including platform-specific cases unavailable on this host; this is not a formal AST equivalence proof.
+
+Two launcher-environment issues were reproduced without changing production guards or tests. CI=true without GITHUB_WORKSPACE makes local synthetic fixtures take protected CI paths. Separately, forced color overrides add ANSI bytes to integration assertions expecting plain strings. Same-code controlled checks fail in the inherited modes and pass in the ordinary local fixture environment. All2583 unit tests and462 integration tests then pass. Actual hosted CI and lifecycle approval are separate gates.
+
+The source refactor itself introduced an fs import defect for release-profile test compilation. The identical check failed101 before direct imports and passed0 afterward. This check compiles the release test target; it does not execute release-profile tests.
@@ -0,0 +1,21 @@
+{
+  "schema_version": 1,
+  "reviews": [
+    {
+      "schema_version": 2,
+      "change_id": "split-mcp-implementation-into-cohesive-private-modules",
+      "reviewer": "agent:codex",
+      "provenance": {
+        "schema_version": 1,
+        "provider": "github_actions_check",
+        "required_check": "SpecSync scoped review"
+      },
+      "verdict": "pass",
+      "implementation_commit": "5e23800ea78c12dc9750c6817002585324c2dbcf",
+      "contract_digest": "f864bb4a3d01b12142eb586541b34b7ccd0440ddd32b61bb0b29e90e7766963b",
+      "execution_digest": "94fe0b8f0b93f840725d371fc15531500f5d141d5e40cb6f3fcbac9a356e7299",
+      "workspace_digest": "4e341a5d11e7141c751ec5817aae38a9dfa5903d9b422fb3da2290a06c3e2539",
+      "timestamp": 1792158814
+    }
+  ]
+}