diff --git a/CHANGELOG.md b/CHANGELOG.md index da13ad9..d2fc8f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -36,6 +36,8 @@ This is a replacement alpha rather than a compatibility release. operational logging; - independently packaged consumer evidence for retained synchronous worker capacity after timeout and bounded shutdown quiescence; +- official MCP Inspector installed-wheel invocation and Visual Studio Code workspace + configuration-discovery evidence from the independent consumer; - real behavioral tests, strict typing/linting, package smoke tests, and accurate docs; - a dependency-free JSON runtime microbenchmark for repeatable local comparisons. - a dependency-free MCP stdio microbenchmark covering parsing, dispatch, diff --git a/README.md b/README.md index 8f98370..7e70e7f 100644 --- a/README.md +++ b/README.md @@ -102,7 +102,7 @@ progress and logging, admission limits, and security boundaries. ## Proven external consumer [Samsarix Integration Examples](https://github.com/Deathcharge/samsarix-integration-examples) -version 0.2.5 pins Core commit `04cf5ba7ca7eb2defcb946f538d62291762db109` +version 0.2.6 pins Core commit `04cf5ba7ca7eb2defcb946f538d62291762db109` and uses only the public API to expose a privacy-first, resumable redaction workflow over MCP. Its consumer-owned tests exercise initialization, discovery, stdio invocation, @@ -111,6 +111,9 @@ artifact conflict handling, exact `TypedDict` output discovery, client cancellation without an output artifact or response, continued protocol service, token-correlated content-free progress, client-filtered operational logging, synchronous timeout/quiescence accounting, package installation, and CLI entry points. +The official MCP Inspector also discovers and invokes its freshly installed wheel; a +portable VS Code workspace is configuration-discovered, with signed-in trust and tool +approval still awaiting operator acceptance. This is compatibility evidence, not a claim of third-party production adoption. See the [adoption record](docs/ADOPTION.md) for exact commits, commands, artifact diff --git a/ROADMAP.md b/ROADMAP.md index 9ac3214..c51be1b 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -29,23 +29,25 @@ remain separate decisions. - Strict `TypedDict` input and output contracts now preserve named nested fields, descriptions, and required/optional key semantics in JSON Schema and runtime validation. -- External consumer: `samsarix-integration-examples` version 0.2.5 pins Core +- External consumer: `samsarix-integration-examples` version 0.2.6 pins Core commit `04cf5ba7ca7eb2defcb946f538d62291762db109` and proves a confined, privacy-first redaction workflow, exact typed result discovery, and response-free asynchronous cancellation through the public MCP API. It also proves progress-token correlation, monotonic content-free updates, notification ordering, cancellation cutoff, artifact privacy, client-selected operational-log filtering, content-free terminal events, retained sync-worker capacity after timeout, - and bounded shutdown quiescence. -- Next: exercise the contract from an independently operated desktop client and - rerun the consumer matrix after GitHub Actions billing is restored. Use observed + and bounded shutdown quiescence. Its portable Visual Studio Code workspace is + configuration-discovered by VS Code 1.131.0, while official MCP Inspector 0.21.2 + independently proves installed-wheel discovery and invocation. +- Next: complete the signed-in Visual Studio Code trust/tool-approval journey and rerun + the consumer matrix after GitHub Actions billing is restored. Use observed demand and confirmed contract gaps—not framework parity—to prioritize broader schema support. - Review priority: Capture all 101 dirty/untracked paths. - Review priority: split legacy relocation. - Review priority: resolve license identity. - Review priority: keep resource defaults aligned with adopter evidence. -- Review priority: exercise the contract from an independently operated desktop client. +- Review priority: complete signed-in Visual Studio Code trust and invocation acceptance. ## Release candidate diff --git a/docs/ADOPTION.md b/docs/ADOPTION.md index f6580c5..215de3f 100644 --- a/docs/ADOPTION.md +++ b/docs/ADOPTION.md @@ -14,9 +14,9 @@ Repository: | --- | --- | | Core contract commit | `04cf5ba7ca7eb2defcb946f538d62291762db109` | | Core package version | `2.0.0a1` | -| Consumer merge commit | `f1bcbe1157865e99332caae3c302a2b25d0ed1ed` | -| Consumer pull request | [samsarix-integration-examples#8](https://github.com/Deathcharge/samsarix-integration-examples/pull/8) | -| Consumer package version | `0.2.5` | +| Consumer merge commit | `6fd45f7f36ad57ad5a9ceb372af5b73193739624` | +| Consumer pull request | [samsarix-integration-examples#9](https://github.com/Deathcharge/samsarix-integration-examples/pull/9) | +| Consumer package version | `0.2.6` | | Integration Guard provenance | [`samsarix-integration-guard`](https://github.com/Deathcharge/samsarix-integration-guard) `0.2.0` at `1aa711d89eaedcc396f0cd6eb416fb4253da3f5e` | | Orchestration provenance | [`samsarix-agent-orchestration`](https://github.com/Deathcharge/samsarix-agent-orchestration) `0.1.0` at `0dfc050cf9a4582c9fa8d34d74b1ca97d43c9005` | | Supported consumer Python | 3.11-3.13 | @@ -55,8 +55,17 @@ arguments. After a consumer-controlled release, pending and in-flight work retur zero and bounded shutdown succeeds. The gated probe exists only in the contract suite and is not a production redaction tool. +The consumer now ships a portable, workspace-scoped Visual Studio Code MCP +configuration and confined example. The official MCP Inspector 0.21.2 client discovered +the exact tool schemas and successfully invoked the freshly installed consumer wheel +over stdio; its result and artifact excluded the seeded token, email, and workspace path. +Visual Studio Code 1.131.0 separately opened the sample and discovered the stopped +`samsarixRedaction` server from the expected `.vscode/mcp.json`. That desktop profile +was signed out of Copilot, so no trust prompt or VS Code tool call was accepted. This is +desktop configuration-discovery evidence, not a completed desktop-agent journey. + The consumer's merged -[`pyproject.toml`](https://github.com/Deathcharge/samsarix-integration-examples/blob/f1bcbe1157865e99332caae3c302a2b25d0ed1ed/pyproject.toml) +[`pyproject.toml`](https://github.com/Deathcharge/samsarix-integration-examples/blob/6fd45f7f36ad57ad5a9ceb372af5b73193739624/pyproject.toml) is the dependency manifest. It declares `samsarix-core @ git+https://github.com/Deathcharge/samsarix-core.git@04cf5ba7ca7eb2defcb946f538d62291762db109`; the installed public package reports Core version `2.0.0a1`. The same manifest @@ -70,14 +79,14 @@ The consumer suite completed locally on Windows with Python 3.11.9: ```text python -m ruff check . -> passed python -m mypy -> passed, strict mode -python -m pytest -q -> 30 passed, 91.35% branch coverage +python -m pytest -q -> 31 passed, 91.35% branch coverage python -m bandit -q -r src -> passed python -m build -> isolated wheel and sdist passed python -m twine check -> wheel and sdist passed ``` A fresh virtual environment installed the consumer wheel with dependencies -resolved from their exact public Git commits. Import metadata resolved to `0.2.5` +resolved from their exact public Git commits. Import metadata resolved to `0.2.6` and retained the exact Core commit requirement. Outside the source checkout, the installed `samsarix-redaction-mcp` CLI completed a real redaction over stdio, published a sanitized artifact, emitted exactly two token-correlated progress @@ -89,14 +98,14 @@ Final local artifacts were: | Artifact | Bytes | SHA-256 | | --- | ---: | --- | -| `samsarix_integration_examples-0.2.5-py3-none-any.whl` | 17,519 | `31abff6dd15ff25771d85a30600b36d25145db5aa62a520b75f4a2b527cc3d98` | -| `samsarix_integration_examples-0.2.5.tar.gz` | 30,362 | `498851085c74c0a0c59fe13149a779941fa68a51d44ff1d8ac87514496a505f4` | +| `samsarix_integration_examples-0.2.6-py3-none-any.whl` | 17,798 | `b406b923a2e74778c7500d359851600cc219f14e24d28bb5e163a0084d7af1b5` | +| `samsarix_integration_examples-0.2.6.tar.gz` | 33,951 | `ba8d43723783c2253e9da9ebe438ec9f01f1521d0aa4461a75d6b941c30f5bd2` | CodeRabbit attached a green high-level status, but its quota warning states that a comprehensive review did not start; it is not counted as independent line-level review evidence. The consumer's -[pull-request](https://github.com/Deathcharge/samsarix-integration-examples/actions/runs/30732577364) -and [post-merge](https://github.com/Deathcharge/samsarix-integration-examples/actions/runs/30732604781) +[pull-request](https://github.com/Deathcharge/samsarix-integration-examples/actions/runs/30733933805) +and [post-merge](https://github.com/Deathcharge/samsarix-integration-examples/actions/runs/30733992055) GitHub Actions runs did not start their jobs: GitHub attached an account billing/spending-limit failure before checkout, leaving zero executed steps and @@ -120,7 +129,8 @@ remove the consumer workspace's generated artifacts and sanitized checkpoints. - Rerun the consumer Python 3.11-3.13 matrix after GitHub Actions billing is restored. -- Exercise the same contract from an independently operated desktop client. +- Complete the signed-in Visual Studio Code server-trust and tool-approval journey; + workspace configuration discovery and independent Inspector invocation are proven. - Record an independently operated deployment or downstream repository before claiming production adoption. - Use consumer demand, not framework parity, to decide whether dataclass, enum, diff --git a/docs/PRODUCTIZATION.md b/docs/PRODUCTIZATION.md index 2a66d54..ea7988c 100644 --- a/docs/PRODUCTIZATION.md +++ b/docs/PRODUCTIZATION.md @@ -254,8 +254,9 @@ All baseline commands were run on Windows with Python 3.11.9 at commit - Proved the public MCP API, exact typed result discovery, response-free asynchronous cancellation, bounded content-free progress, and client-filtered operational logging, retained sync-worker capacity after timeout, and bounded - shutdown quiescence from `samsarix-integration-examples` 0.2.5 at merge commit - `f1bcbe1157865e99332caae3c302a2b25d0ed1ed`; the consumer pins Core commit + shutdown quiescence, official MCP Inspector invocation, and Visual Studio Code + configuration discovery from `samsarix-integration-examples` 0.2.6 at merge commit + `6fd45f7f36ad57ad5a9ceb372af5b73193739624`; the consumer pins Core commit `04cf5ba7ca7eb2defcb946f538d62291762db109`. ## Deferred work and rationale @@ -267,7 +268,7 @@ features; subsequent surface area should follow concrete consumer demand. Core's [Python 3.10-3.14 hosted matrix](https://github.com/Deathcharge/samsarix-core/actions/runs/30731486471) is green; Core's local Python 3.11 suite has 90 tests and 94.28% branch coverage. The consumer's separate Python 3.11-3.13 jobs could not start because GitHub -reported an account billing/spending-limit problem, so its local 30-test and +reported an account billing/spending-limit problem, so its local 31-test and installed-wheel evidence is recorded separately in `docs/ADOPTION.md`. ## Owner-, credential-, or production-blocked tasks