coilyco-flight-deck/ward-mcp
2
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

Add non-MCP admin endpoints for ward-mcp runtime health, describe, and reload #22

New issue
Closed
opened 2026-07-14 10:08:01 +00:00 by coilyco-ops · 2 comments
coilyco-ops commented 2026-07-14 10:08:01 +00:00
Member
Copy link

Decision

Go, from coilysiren/inbox#211 follow-up.

Add non-MCP operational endpoints to ward-mcp / future agent-guard-mcp for runtime health and operator control. These endpoints stay outside the MCP tool surface so agents do not discover admin controls as model-facing tools.

Scope

  • Keep GET /healthz as the unactionable readiness/liveness endpoint.
  • Add or design GET /admin/describe for operator-facing runtime description: loaded guardfile, projected tool count, transport mode, upstreams if any, and safe non-secret config facts.
  • Add or design POST /admin/reload for explicit operator reload of guardfile/runtime state, if the current process model can reload safely.
  • Protect any admin endpoint with the same deployment/auth assumptions used for other operator-only surfaces.
  • Document the split: MCP is model-facing tools/resources/prompts, admin HTTP is operator-facing control and inspection.

Non-goals

  • Do not expose admin/reload/describe as MCP tools.
  • Do not add Ward-specific MCP verbs.
  • Do not print secrets, tokens, opaque hosts, or raw guardfile credentials from admin/describe.
  • Do not require reload support if the current runtime must stay restart-only; document restart-only if that is the safe answer.

Parent: coilysiren/inbox#211.
Related: coilyco-flight-deck/ward-mcp#21.

## Decision Go, from coilysiren/inbox#211 follow-up. Add non-MCP operational endpoints to ward-mcp / future agent-guard-mcp for runtime health and operator control. These endpoints stay outside the MCP tool surface so agents do not discover admin controls as model-facing tools. ## Scope - Keep `GET /healthz` as the unactionable readiness/liveness endpoint. - Add or design `GET /admin/describe` for operator-facing runtime description: loaded guardfile, projected tool count, transport mode, upstreams if any, and safe non-secret config facts. - Add or design `POST /admin/reload` for explicit operator reload of guardfile/runtime state, if the current process model can reload safely. - Protect any admin endpoint with the same deployment/auth assumptions used for other operator-only surfaces. - Document the split: MCP is model-facing tools/resources/prompts, admin HTTP is operator-facing control and inspection. ## Non-goals - Do not expose admin/reload/describe as MCP tools. - Do not add Ward-specific MCP verbs. - Do not print secrets, tokens, opaque hosts, or raw guardfile credentials from `admin/describe`. - Do not require reload support if the current runtime must stay restart-only; document restart-only if that is the safe answer. Parent: coilysiren/inbox#211. Related: coilyco-flight-deck/ward-mcp#21.
coilyco-ops commented 2026-07-14 10:51:59 +00:00
Author
Member
Copy link

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-ward-mcp-22 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-14T10:51:58Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)
  • Resolved: coilyco-flight-deck/ward-mcp#22 · branch issue-22 · harness codex · workflow merge-remote-main
  • Run: engineer-codex-ward-mcp-22 · ward v0.679.0 · dispatched 2026-07-14T10:51:57Z
  • Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.679.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-ward-mcp-22` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-14T10:51:58Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward-mcp#22` · branch `issue-22` · harness `codex` · workflow `merge-remote-main` - **Run:** `engineer-codex-ward-mcp-22` · ward `v0.679.0` · dispatched `2026-07-14T10:51:57Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.679.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`
coilyco-ops commented 2026-07-14 11:00:15 +00:00
Author
Member
Copy link

WARDED_WORKFLOW: done ✅

details

workflow: merge-remote-main; review summary: review gate skipped by ~/.ward/config.yaml default
felt: the implementation was straightforward after the runtime contract was pinned down
confidence: high
surprises: /admin/reload is restart-only because the server cannot hot-swap guarded state safely
follow-ups: none

WARDED_WORKFLOW: done ✅ <details><summary>details</summary> workflow: merge-remote-main; review summary: review gate skipped by ~/.ward/config.yaml default felt: the implementation was straightforward after the runtime contract was pinned down confidence: high surprises: /admin/reload is restart-only because the server cannot hot-swap guarded state safely follow-ups: none </details>
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
issue-18
issue-21
issue-20
issue-13
ward-salvage/ward-mcp-558b4977
No results found.
Labels
Clear labels
  
coherence-core
Core review set for the warded control plane coherence milestone. These issues form the release spine; adjacent milestone issues are stretch or supporting work.

  
consult
A human decision, design, or external action must happen first. Fail-closed default for unlabeled/low-confidence.

  
headless
Agent can take it from open issue to merged change with no human in the loop. The auto-burndown queue.

  
interactive
Agent does the work but pauses at a human checkpoint mid-flight (design choice, destructive step, human-only verification).

  
P0
now / blocking / urgent

  
P1
next / important

  
P2
backlog / will do

  
P3
someday / low

  
P4
icebox / frozen / reopen if it becomes real

No labels
coherence-core
consult
headless
interactive
P0
P1
P2
P3
P4
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
coilyco-flight-deck/ward-mcp#22
No description provided.