sixfold-space/madtea

SHA256

Fork 0

chore: replace the npm MCP conformance harness with a Go check, and drop npm from the project #854

Merged

hexajon merged 4 commits from issue-750-go-conformance-no-npm into main

2026-10-20 23:06:14 +00:00

hexajon commented

2026-10-20 23:06:10 +00:00

Owner

Summary

madtea no longer carries npm or TypeScript. The MCP client-conformance harness was a Node script on the TypeScript SDK, with its own lockfile, and every npm advisory against that lockfile failed the gate. Its checks now run in Go, inside go test ./....

What the Go check covers (internal/mcp/client_conformance_test.go), each one proven to fail on a planted broken case:

The server handshake over stdio against a real serve process.
tools/list: every tool's shape the way the SDK client checks it, and every input and output schema compiles and resolves.
madt_enable with every gated domain, then a fresh tools/list that validates and grows. The domain list comes from the registry, not a hand list.
A madt_help call whose structured content validates against its declared output schema. The old harness did not check this.
The ambiguous-forge fail-closed probe.

What is removed: conformance/mcp-client/ (the harness, package.json, package-lock.json), scripts/mcp-conformance.sh, the gate's conformance leg and its --no-conformance flag, the node bootstrap in scripts/setup-dev.sh, and the mcp-conformance CI job. git ls-files lists no package.json, lockfile, .js, or .ts file.

The CI gate job was also broken: scripts/gate.sh --skip-remote-issues passed --skip-remote-issues to adr check, which now takes --skip-forge-checks. The gate keeps its own flag and passes the new one. ADR 0036 now names --skip-forge-checks, and ADR 0044 no longer describes the removed npm lockfile as current.

Not in this change, so #750 stays open: validation against the official MCP schema.json per protocol revision, a gate warning when the pinned go-sdk is behind, and the removal of result_type_test.go once a validator covers resultType.

./scripts/gate.sh passes on this commit, and the CI gate job step ./scripts/gate.sh --skip-remote-issues passes too.

Refs #750

## Summary madtea no longer carries npm or TypeScript. The MCP client-conformance harness was a Node script on the TypeScript SDK, with its own lockfile, and every npm advisory against that lockfile failed the gate. Its checks now run in Go, inside `go test ./...`. What the Go check covers (`internal/mcp/client_conformance_test.go`), each one proven to fail on a planted broken case: - The server handshake over stdio against a real `serve` process. - `tools/list`: every tool's shape the way the SDK client checks it, and every input and output schema compiles and resolves. - `madt_enable` with every gated domain, then a fresh `tools/list` that validates and grows. The domain list comes from the registry, not a hand list. - A `madt_help` call whose structured content validates against its declared output schema. The old harness did not check this. - The ambiguous-forge fail-closed probe. What is removed: `conformance/mcp-client/` (the harness, `package.json`, `package-lock.json`), `scripts/mcp-conformance.sh`, the gate's conformance leg and its `--no-conformance` flag, the node bootstrap in `scripts/setup-dev.sh`, and the `mcp-conformance` CI job. `git ls-files` lists no `package.json`, lockfile, `.js`, or `.ts` file. The CI gate job was also broken: `scripts/gate.sh --skip-remote-issues` passed `--skip-remote-issues` to `adr check`, which now takes `--skip-forge-checks`. The gate keeps its own flag and passes the new one. ADR 0036 now names `--skip-forge-checks`, and ADR 0044 no longer describes the removed npm lockfile as current. Not in this change, so #750 stays open: validation against the official MCP `schema.json` per protocol revision, a gate warning when the pinned go-sdk is behind, and the removal of `result_type_test.go` once a validator covers `resultType`. `./scripts/gate.sh` passes on this commit, and the CI gate job step `./scripts/gate.sh --skip-remote-issues` passes too. Refs #750

hexajon added 4 commits

2026-10-20 23:06:10 +00:00

test: check MCP client conformance in Go over stdio 735553216f

Drive a real serve process (the test binary re-run on the Run entry) over
stdio with the go-sdk client. Check every tool's shape and schemas the way
a strict client does, the widened list after madt_enable, a madt_help
result against its advertised outputSchema, and the fail-closed
ambiguous-forge call. Planted faults prove each check fails.

chore: remove the npm conformance harness and every node step e6e8f72f8d

The MCP client-conformance check is now a Go test that the gate's
test-race step runs, so the JavaScript harness, its lockfile, and
scripts/mcp-conformance.sh go. gate.sh loses the --no-conformance flag
and its conformance leg. setup-dev.sh no longer installs a JavaScript
runtime or harness packages. Docs and comments that named the harness,
npm, or node now describe the Go check.

Refs #750

docs: ADR 0036 names adr check --skip-forge-checks, and ADR 0044 drops the removed npm lockfile 8f45074f99

Refs #750

chore: drop the mcp-conformance CI job and the last npm references, and pass --skip-forge-checks to adr check

drift / govulncheck (pull_request) Has been skipped

Details

drift / forgejo-smoke (pull_request) Has been skipped

Details

drift / surface-diff (pull_request) Successful in 36s

Details

drift / govulncheck (push) Has been skipped

Details

drift / surface-diff (push) Successful in -39s

Details

drift / forgejo-smoke (push) Has been skipped

Details

ci / gate (push) Successful in 21m24s

Details

ci / gate (pull_request) Successful in 28m39s

Details

51c4fa34eb

Refs #750

hexajon merged commit 51c4fa34eb into main

2026-10-20 23:06:14 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!854

No description provided.

Rows
Columns