adr: pin the strict-omission destruction-safety model (ADR 0029) #207

New issue

Closed

opened 2026-07-17 15:28:32 +00:00 by hexajon · 0 comments

hexajon commented

2026-07-17 15:28:32 +00:00

(Migrated from codeberg.org)

Part of #206.

Write docs/adr/0029: madtea is safe by design - a madtea surface (MCP tool or CLI command) never carries an operation that can destroy unrecoverable work or data. The ADR pins:

The rule: destructive capability is omitted from every surface, not gated. Gates (elicitation dialogs, consent flags, hooks) degrade per client and invite fail-open regressions; omission cannot.
The one carve-out: machine-proof destruction - operations where madtea verifies nothing unrecoverable is lost before acting (content-verified prune, force-with-lease push, branch delete refusing unmerged). The proof is structural, computed from git/forge state, never from a caller assertion.
The escape for genuine need: refusals name the tool the user already holds (raw git in their own shell, the forge web UI) as guidance, never a runnable madtea flag. Deny messages must not recommend a madtea incantation that performs the destruction (the ADR 0009 deny-message lesson, applied to the surface itself).
Elicitation's remaining role: consent for reversible-but-notable actions only; it is NOT an accepted guard for irreversible destruction (non-elicitation clients silently lose the dialog - #2004's fail-open gap is the demonstration).
A per-operation classification table for everything currently destructive-adjacent: worktree remove force, madt_delete (repo, issue, release, tag, wiki page), prune, push --force, branch delete - each marked omit / machine-proof / already-safe, so the convergence work (#208, #209) implements a decided list rather than re-arguing each op.

Acceptance criteria:

ADR 0029 exists, Accepted status, follows the existing ADR format, cross-references ADR 0009 (non-overridable guards) and ADR 0014 (layered dual-surface).
The classification table covers every operation named above with its disposition.
docs/reference/destructive.md points at the ADR as the model of record.

Part of #206. Write docs/adr/0029: madtea is safe by design - a madtea surface (MCP tool or CLI command) never carries an operation that can destroy unrecoverable work or data. The ADR pins: - The rule: destructive capability is omitted from every surface, not gated. Gates (elicitation dialogs, consent flags, hooks) degrade per client and invite fail-open regressions; omission cannot. - The one carve-out: machine-proof destruction - operations where madtea verifies nothing unrecoverable is lost before acting (content-verified prune, force-with-lease push, branch delete refusing unmerged). The proof is structural, computed from git/forge state, never from a caller assertion. - The escape for genuine need: refusals name the tool the user already holds (raw git in their own shell, the forge web UI) as guidance, never a runnable madtea flag. Deny messages must not recommend a madtea incantation that performs the destruction (the ADR 0009 deny-message lesson, applied to the surface itself). - Elicitation's remaining role: consent for reversible-but-notable actions only; it is NOT an accepted guard for irreversible destruction (non-elicitation clients silently lose the dialog - #2004's fail-open gap is the demonstration). - A per-operation classification table for everything currently destructive-adjacent: worktree remove force, madt_delete (repo, issue, release, tag, wiki page), prune, push --force, branch delete - each marked omit / machine-proof / already-safe, so the convergence work (#208, #209) implements a decided list rather than re-arguing each op. Acceptance criteria: - ADR 0029 exists, Accepted status, follows the existing ADR format, cross-references ADR 0009 (non-overridable guards) and ADR 0014 (layered dual-surface). - The classification table covers every operation named above with its disposition. - docs/reference/destructive.md points at the ADR as the model of record.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#207

No description provided.

Rows
Columns