Skip to content

Document the capability model as ADR 0001 - #130

Merged
tony merged 11 commits into
mainfrom
adr
Aug 30, 2026
Merged

Document the capability model as ADR 0001#130
tony merged 11 commits into
mainfrom
adr

Conversation

@tony

@tony tony commented Aug 30, 2026

Copy link
Copy Markdown
Member

Summary

  • Add a numbered architecture decision collection for contributor-facing, long-lived decisions.
  • Define ADR 0001 as the shared capability contract for tmux MCP implementations, based on the source decision in #127.
  • Specify socket-scoped object selection, independent direct-capability properties, startup tool-surface resolution, whole-call MCP annotations, the host-command boundary, and disclosure obligations.
  • Separate normative BCP 14 requirements from informative rationale, consequences, rejected alternatives, security considerations, and reconsideration criteria.
  • State ambient execution, aggregate authority, shared-socket ownership, untrusted output, bounded matching, and redaction limits without claiming containment.

Verification

$ uv run ruff format . --check
$ uv run ruff check .
$ uv run mypy .
$ uv run pytest -n 0 --reruns 0
$ just build-docs

Test plan

  • Publish the ADR collection from the Project page and retain the source-decision provenance.
  • Give ADR 0001 a self-contained abstract, explicit conformance target, controlled terminology, and proposition-style CM-* headings.
  • Apply named includes and exclusions to the effective surface, including aggregate authority.
  • Distinguish direct process reach from ambient tmux execution and transport subprocesses.
  • Qualify shared-socket shutdown against the tmux 3.2a exit-empty and exit-unattached behavior.
  • Build the complete Sphinx site with warnings treated as errors.
  • Verify every code citation uses a tag-pinned GitHub URL with line anchors and returns HTTP 200.
  • Run the full formatting, lint, typing, and serial test gates.

why: The capability refactor needs a durable record of the boundary it
defines and the guarantees it declines to make.

what:
- Add a numbered architecture decision collection
- Preserve issue #127's proposed capability model and provenance
- Link the collection from the contributor project page
- Enforce the navigation and source-decision contract
@codecov-commenter

codecov-commenter commented Aug 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.91%. Comparing base (d69ec57) to head (2af0b0c).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #130   +/-   ##
=======================================
  Coverage   86.91%   86.91%           
=======================================
  Files          46       46           
  Lines        3874     3874           
  Branches      583      583           
=======================================
  Hits         3367     3367           
  Misses        355      355           
  Partials      152      152           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

tony added 10 commits August 30, 2026 14:10
why: Direct-only annotations contradict MCP semantics when tmux aliases
and hooks can change the whole call.

what:
- Define standard hints over the complete call
- Keep direct-operation detail in project metadata
why: Pane input can ask tmux to start host-side jobs, so only the
direct MCP schema boundary is enforceable.

what:
- Define the prohibited direct host-command surface
- Cite run-shell and status-job escape paths
why: FastMCP visibility rejects disabled calls as well as hiding them,
while pane authority remains unchanged.

what:
- Describe listing and invocation enforcement
- Separate MCP surface control from confinement
why: Proposed decisions were phrased as shipped behavior and retained a
completed documentation prerequisite.

what:
- Separate released toolsets from remaining target work
- Pin current-surface and gp-sphinx evidence to release tags
why: Durable code citations need tagged revisions and exact line anchors.

what:
- Anchor the CPython regex signature
- Anchor tmux's exit-empty default
why: An ADR defines the model every tmux MCP implements; release state and language-specific mechanics belong elsewhere.

what:
- Keep CM identifiers attached to plain-English rules
- Remove Python implementation status and tooling details
- Phrase guarantees and consequences across implementations
why: Ambient tmux configuration can add execution without changing the capability of the requested operation.

what:
- Scope process reach and tmux effect to the direct operation
- State ambient execution in whole-call terms
why: Toolsets alone do not determine which tools a tmux MCP advertises and accepts.

what:
- Define named inclusion and exclusion precedence
- Apply one frozen surface to discovery and invocation
- Keep filtering distinct from pane authority
why: Removing one caller's sessions does not empty a socket that other clients also use.

what:
- State the complete exit-empty condition
- Keep socket-wide termination with the operator
why: The decision must constrain every tmux MCP implementation without becoming a Python rollout report or requiring readers to decode internal labels.

what:
- Define scope, terminology, conformance, and BCP 14 requirements
- Separate normative rules from rationale and implementation guidance
- Record consequences, rejected alternatives, security limits, and reconsideration criteria
- Keep CM identifiers attached to complete plain-English propositions
@tony
tony merged commit ec00963 into main Aug 30, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants