Expose fail-when postconditions on inline HTTP grants #267

Closed
opened 2026-07-29 03:29:58 +00:00 by coilyco-ops · 0 comments
Member

Outcome

Allow inline opcore grants used by ward-mcp to reject semantically invalid 2xx responses with a JMESPath fail-when predicate.

Required behavior

  • Parse and validate fail-when on a can grant.
  • Evaluate it after a successful HTTP response.
  • Bind request path, query, and body inputs as JMESPath variables.
  • Return a coded error when the predicate matches.
  • Keep grants without a predicate unchanged.
  • Document and test the inline grammar.

Motivating case

Forgejo accepts an unknown numeric issue-label ID with HTTP success and an empty resulting label set. The deploy Forgejo MCP must compare the requested $labels with the returned label IDs and fail loudly instead of accepting the no-op.

Refs coilyco-bridge/deploy#247.

## Outcome Allow inline opcore grants used by ward-mcp to reject semantically invalid 2xx responses with a JMESPath fail-when predicate. ## Required behavior * Parse and validate fail-when on a can grant. * Evaluate it after a successful HTTP response. * Bind request path, query, and body inputs as JMESPath variables. * Return a coded error when the predicate matches. * Keep grants without a predicate unchanged. * Document and test the inline grammar. ## Motivating case Forgejo accepts an unknown numeric issue-label ID with HTTP success and an empty resulting label set. The deploy Forgejo MCP must compare the requested $labels with the returned label IDs and fail loudly instead of accepting the no-op. Refs coilyco-bridge/deploy#247.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
coilyco-flight-deck/umbra#267
No description provided.