sixfold-space/madtea

SHA256

Fork 0

security: adopt the SDK roots-replacement (SEP-2322) so the wrong-repo write guard survives 2026-07-28 clients #428

New issue

Open

opened 2026-08-17 15:52:57 +00:00 by hexajon · 1 comment

hexajon commented

2026-08-17 15:52:57 +00:00

Owner

Follow-up from #387 (2026-07-28 / go-sdk v1.7.0). This changes a security and isolation posture, so I want it settled deliberately rather than folded into routine SDK upkeep.

The degradation

SEP-2577 deprecates the MCP roots feature, and go-sdk v1.7.0 refuses server-initiated roots/list on any session that negotiates >= 2026-07-28. madtea's wrong-repo write guard (callerRepoFromRoots in internal/mcp/repoguard.go - the guard exists because a PR once merged to the wrong repo) uses that roots round-trip as its structural caller-repo signal. On a 2026-07-28 session it now gets no signal, and the guard falls through to the MADTEA_CALLER_REPO env hint alone, which is unset by default.

Current exposure

None immediate. No current published client negotiates 2026-07-28 (the TypeScript conformance harness cannot), and every consumer today, Claude Code included, speaks 2025-11-25, where the roots cross-check still works. #387 preserved today's behavior for today's clients, documented the fork in repoguard.go, and pinned the roots test to a wire-level 2025-11-25 client. The change is fail-open into the guard's existing no-signal path, so it adds no false blocks. But the deprecation window is about 12 months, and once the primary client moves to 2026-07-28 the secondary wrong-repo protection stops functioning for callers that do not set the env hint.

Options

Accept the degradation and adopt the SDK's roots-replacement path (SEP-2322 InputRequests), so the guard regains a structural signal before consuming clients move to 2026-07-28. My lean.
Migrate now, before any wider 2026-07-28 adoption.
Require MADTEA_CALLER_REPO set by the harness for modern-client sessions, as a compensating control.

Related: #387.

Follow-up from #387 (2026-07-28 / go-sdk v1.7.0). This changes a security and isolation posture, so I want it settled deliberately rather than folded into routine SDK upkeep. ## The degradation SEP-2577 deprecates the MCP roots feature, and go-sdk v1.7.0 refuses server-initiated `roots/list` on any session that negotiates >= 2026-07-28. madtea's wrong-repo write guard (`callerRepoFromRoots` in internal/mcp/repoguard.go - the guard exists because a PR once merged to the wrong repo) uses that roots round-trip as its structural caller-repo signal. On a 2026-07-28 session it now gets no signal, and the guard falls through to the `MADTEA_CALLER_REPO` env hint alone, which is unset by default. ## Current exposure None immediate. No current published client negotiates 2026-07-28 (the TypeScript conformance harness cannot), and every consumer today, Claude Code included, speaks 2025-11-25, where the roots cross-check still works. #387 preserved today's behavior for today's clients, documented the fork in repoguard.go, and pinned the roots test to a wire-level 2025-11-25 client. The change is fail-open into the guard's existing no-signal path, so it adds no false blocks. But the deprecation window is about 12 months, and once the primary client moves to 2026-07-28 the secondary wrong-repo protection stops functioning for callers that do not set the env hint. ## Options 1. Accept the degradation and adopt the SDK's roots-replacement path (SEP-2322 InputRequests), so the guard regains a structural signal before consuming clients move to 2026-07-28. My lean. 2. Migrate now, before any wider 2026-07-28 adoption. 3. Require `MADTEA_CALLER_REPO` set by the harness for modern-client sessions, as a compensating control. Related: #387.

hexajon added the

security

status/needs-decision

labels

2026-08-17 15:52:57 +00:00

hexajon self-assigned this

2026-08-17 17:45:48 +00:00

~~hexajon referenced this issue 2026-09-08 20:22:25 +00:00~~

Investigate re-evaluating workspace scope when the MCP client adds a working directory mid-run #416

hexajon referenced this issue

2026-09-08 20:36:54 +00:00

Investigate re-evaluating workspace scope when the MCP client adds a working directory mid-run #416

hexajon commented

2026-09-08 20:38:23 +00:00

Author

Owner

Decided: migrate the roots-derived signals to SEP-2322 within the deprecation window, not now.

State of play: roots is deprecated (SEP-2577, June 2026) but fully functional on a rolling ~12-month window, into 2027. SEP-2322 (Multi Round-Trip Requests / InputRequests) is the successor for the roots/list request. No published client negotiates SEP-2322 yet, and Claude Code still implements roots/list and roots/list_changed today.

Decision:

Keep using roots now. The wrong-repo accident-detector and the #416 scope re-derivation both read it, and it works for a year-plus.
Track client SEP-2322 adoption. Migrate the roots-derived signals before roots degrades, once a client actually negotiates SEP-2322 - not against a spec surface no client speaks yet.
Do not drop roots for the MADTEA_CALLER_REPO env hint: #416 relies on roots, and the hint is unset by default, so it is not a substitute.

The wrong-repo guard degrades fail-open on no signal (accident-detector, ADR 0007), so there is no security-boundary regression during the transition; explicit owner_repo / dir targeting and MADTEA_CALLER_REPO stay available. Clearing needs-decision. Related: #416 (uses roots), #412 (MCP-spec adoption epic).

Decided: migrate the roots-derived signals to SEP-2322 within the deprecation window, not now. State of play: roots is deprecated (SEP-2577, June 2026) but fully functional on a rolling ~12-month window, into 2027. SEP-2322 (Multi Round-Trip Requests / InputRequests) is the successor for the roots/list request. No published client negotiates SEP-2322 yet, and Claude Code still implements roots/list and roots/list_changed today. Decision: - Keep using roots now. The wrong-repo accident-detector and the #416 scope re-derivation both read it, and it works for a year-plus. - Track client SEP-2322 adoption. Migrate the roots-derived signals before roots degrades, once a client actually negotiates SEP-2322 - not against a spec surface no client speaks yet. - Do not drop roots for the MADTEA_CALLER_REPO env hint: #416 relies on roots, and the hint is unset by default, so it is not a substitute. The wrong-repo guard degrades fail-open on no signal (accident-detector, ADR 0007), so there is no security-boundary regression during the transition; explicit owner_repo / dir targeting and MADTEA_CALLER_REPO stay available. Clearing needs-decision. Related: #416 (uses roots), #412 (MCP-spec adoption epic).

hexajon removed the

status/needs-decision

label

2026-09-08 20:38:24 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#428

No description provided.

Rows
Columns