feat(adt-mcp): add delegated assistant read scope#147
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
✅ Deploy Preview for adt-cli canceled.
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (29)
📝 WalkthroughWalkthroughThe change replaces no-auto-commit guidance with authorized autonomous delivery instructions and adds a delegated-assistant read-scope policy to ADT MCP, including strict claim parsing, public exports, catalogue restrictions, dispatch support, and tests. ChangesAutonomous delivery guidance
Delegated assistant read scope
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Assistant
participant InvocationVerifier
participant MCPToolCatalogue
participant MCPDispatch
Assistant->>InvocationVerifier: Submit signed delegated-assistant read claims
InvocationVerifier->>MCPToolCatalogue: Filter server/read tools
MCPToolCatalogue-->>Assistant: Return permitted tools
Assistant->>MCPDispatch: Invoke a read tool
MCPDispatch->>MCPDispatch: Recheck class and Destination
Suggested labels: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install failed: dependency version conflict. Check your lock file or package.json. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
The delegated-assistant read scope implementation is well-structured and secure. The code correctly implements product-neutral, principal-scoped read access with proper validation and test coverage. All verification gates pass and the implementation follows established security patterns for fail-closed policy enforcement.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
PR Summary by QodoAdd delegated-assistant read policy for ADT MCP
AI Description
Diagram
High-Level Assessment
Files changed (28)
|
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 21 |
| Duplication | 2 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| | [`verification/after-changes`](rules/verification/after-changes.md) | Build, typecheck, test, lint, format checklist | | ||
| | Rule | Description | | ||
| | ------------------------------------------------------------------------------- | ------------------------------------------------------------ | | ||
| | [`git/autonomous-delivery`](rules/git/autonomous-delivery.md) | Commit and push authorized feature work without re-prompting | |
There was a problem hiding this comment.
📝 Info: no-auto-commit references fully removed
The PR deletes .agents/rules/git/no-auto-commit.md and replaces it with .agents/rules/git/autonomous-delivery.md, updating the rules index and all epic Devin prompt blocks. I grepped the entire repo for no-auto-commit and found zero remaining references, so no dangling links to the removed rule file exist. The .agents/repo-guide.md index row and docs/roadmap/README.md conventions were both updated consistently.
Was this helpful? React with 👍 or 👎 to provide feedback.
MergerCould not evaluate merge readiness. Commit |
1 participant
Summary
Verification
Technical Details
This change introduces a new
delegated-assistantsigned invocation policy that allows interactive MCP clients to discover and call read tools on behalf of an authenticated principal without duplicating the server's tool catalogue. The policy is product-neutral and does not include product-specific agent names or workflows.The change also updates the repository's git workflow rules to enable autonomous delivery of verified feature work to scoped branches, replacing the previous "no auto-commit" rule with a more flexible "autonomous delivery" rule that still gates destructive operations and protected-branch updates.
Summary by cubic
Adds a product-neutral delegated-assistant read scope to
packages/adt-mcp, enabling MCP clients to discover and call server-owned read tools via a signed credential. Also updates repo rules to allow autonomous, verified commits to scoped branches.New Features
delegated-assistantread policy bound to principal,threadId,executionId, and one System/Destination.tools/listand dispatch expose onlyserver/read; denywriteandsafe_execute; no client allowlists or limits.parseDelegatedAssistantReadPolicy, types); add focused policy/catalogue/HTTP tests and OpenSpec docs.Refactors
git/no-auto-commitwithgit/autonomous-deliveryto commit and push verified feature work to scoped branches; destructive and protected actions remain gated.Written for commit 4bf4cde. Summary will update on new commits.
Summary by CodeRabbit
New Features
Documentation