ContextQMD
Back to Prisma

Brief: S3-D1 — probe and pin (test-first)

projects/agent-native/slices/safety-mcp-audit/briefs/d1-r1.md

7.9.0-dev.173.1 KB
Original Source

Brief: S3-D1 — probe and pin (test-first)

Task

In a fresh worktree on tml-2969-s3-ai-safety-checkpoint-through-prisma-mcp-audit-pin (from origin/main), empirically probe whether the AI safety checkpoint's consent text reaches an MCP client calling prisma mcp's migrate-reset tool, and encode the desired contract as packages/cli/src/__tests__/mcp-safety.vitest.ts driving the real server over stdio.

Setup

  • git -C <main-checkout> worktree add ../agent-native-s3 -b tml-2969-s3-ai-safety-checkpoint-through-prisma-mcp-audit-pin origin/main (fetch first); pnpm install + pnpm exec turbo build --filter='prisma^...' + turbo build --filter=prisma (the probe needs the built CLI; budget ~10 min total).
  • Read the S3 slice spec first: /home/aqrln.guest/worktrees/prisma/solid-otter/prisma/projects/agent-native/slices/safety-mcp-audit/spec.md — it is the contract, including both pre-investigated edge cases (curated subprocess env: never inherit your own agent markers; ensure the consent env var is absent in the agent-marker case).

Completed when

  • Probe captures exist: an SDK Client over StdioClientTransport spawning node <worktree>/packages/cli/build/index.js mcp with a curated env (allowlist: HOME/PATH/TERM + CLAUDECODE=1; no other markers; no consent var), calling migrate-reset with a scratch sqlite project as cwd — the raw tool result recorded verbatim. A control run with no marker likewise recorded.
  • The probe's verdict is stated plainly: does the tool result carry the checkpoint's consent instructions (PRISMA_USER_CONSENT_FOR_DANGEROUS_AI_ACTION + the stop-and-relay language), or is it swallowed/truncated — and if swallowed, exactly where in runCommand (packages/cli/src/mcp/MCP.ts) the text is lost.
  • mcp-safety.vitest.ts encodes the desired contract (marker → consent text present, no success; no marker → no consent text), self-contained (builds nothing; skips or fails clearly if build/index.js is absent — note your choice), DB-free, curated-env per the spec's edge cases.
  • If the probe shows the text surfaces today: the test is green; run it twice to confirm stability. If not: the test is red exactly on the surfacing assertion, and your report names the gap for D2. No MCP.ts changes this dispatch either way.
  • packages/cli typecheck green (pnpm run tsc).

Standing instruction

Stay focused on the goal; control scope. Trivial-and-related fixes with a one-line note; drift halts and surfaces. A checkpoint that does not fire at all in the child (marker not inherited, or #29684 changed the mechanism) is an I12 halt with evidence — not something to patch.

Operational metadata

  • Model tier: orchestrator-inherit (resumed persistent implementer).
  • Time-box: 50 minutes including environment setup.
  • Halt conditions: checkpoint does not fire in the child (I12); SDK client cannot connect to the spawned server (surface the transport failure rather than working around it); diff exceeds ~4 files.