bootstrap/docs/scratchpads/macp-phase2a.md

MACP Phase 2A Scratchpad

Session Start

• Session date: 2026-03-27 / 2026-03-28 America/Chicago
• Branch: feat/macp-phase2a
• Issue: #10
• Objective: build the MACP event bridge and notification system from docs/tasks/MACP-PHASE2A-brief.md

Budget

• Budget mode: inferred working budget
• Estimate: medium
• Token strategy: keep context narrow to event-bridge files, verify with targeted temp-repo tests, avoid unnecessary parallel deep dives

Requirements Notes

• PRD updated to Phase 2A before coding
• TDD requirement: not mandatory for this feature work; targeted verification is sufficient because this is new observability functionality rather than a bug fix or auth/data-mutation change
• Documentation gate applies because developer-facing behavior and CLI surface change

Assumptions

1. ASSUMPTION: corrupt or partial lines should be logged and skipped while still advancing the cursor past the offending line, preventing permanent replay loops.
2. ASSUMPTION: mosaic macp watch may run without webhook delivery enabled and should still process events plus persist cursor state.
3. ASSUMPTION: Discord formatting remains a pure formatting layer; no outbound Discord transport is part of Phase 2A.

Plan

1. Update PRD/TASKS and create the Phase 2A issue/scratchpad.
2. Implement watcher, webhook adapter, formatter, and CLI wiring.
3. Update developer docs and sitemap.
4. Run baseline and situational verification.
5. Run independent code review, remediate findings, then commit/push/PR/merge/CI/issue-close.

Progress Log

• 2026-03-28T02:02:38Z: Created provider issue #10 for Phase 2A using Mosaic wrapper with Gitea API fallback.
• 2026-03-28T02:02:38Z: Replaced stale Phase 1 PRD/TASKS planning state with Phase 2A scope and tracking.
• 2026-03-28T02:17:40Z: Resumed Phase 2A for the test-suite follow-on task; loaded Mosaic intake, runtime, resume protocol, shared memory, and issue state before implementation.
• 2026-03-28T02:17:40Z: Updated PRD/TASKS to include the stdlib unittest coverage requirement and the MACP-PHASE2A-TESTS tracking row.
• 2026-03-28T02:23:08Z: Added repo-local unittest coverage for watcher, webhook adapter, and Discord formatter plus tests/run_tests.sh.
• 2026-03-28T02:23:08Z: Test-driven remediation exposed and fixed two formatter sanitization bugs (re.sub replacement escaping and ANSI escape stripping order).
• 2026-03-28T02:23:08Z: Tightened webhook callback config semantics so enabled and event_filter are enforced directly by create_webhook_callback; tightened literal-IP SSRF blocking to match requested tests.

Verification Plan

Acceptance Criterion	Verification Method	Evidence
AC-1 watcher polls new events and respects cursor	Temp events file + repeated poll_once() / CLI runs	pending
AC-2 webhook delivery retries and succeeds/fails cleanly	Local stdlib echo server capture	pending
AC-3 Discord formatting covers required event types	Targeted Python formatter check	pending
AC-4 mosaic macp watch --once runs cleanly	CLI one-shot execution in temp repo	pending
AC-5 cursor persistence handles repeat run and truncation	Temp repo repeated runs with truncated file scenario	pending
AC-6 unittest suite passes for Phase 2A modules	python3 -m unittest discover -s tests -p 'test_*.py' -v	pass

Tests Run

• bash -n tests/run_tests.sh — pass
• python3 -m py_compile tests/__init__.py tests/conftest.py tests/test_event_watcher.py tests/test_webhook_adapter.py tests/test_discord_formatter.py tools/orchestrator-matrix/events/webhook_adapter.py tools/orchestrator-matrix/events/discord_formatter.py — pass
• ./tests/run_tests.sh — pass (24 tests)
• python3 -m unittest discover -s tests -p 'test_*.py' -v — pass (24 tests)
• python3 -m pytest tests/ — environment limitation: pytest module is not installed in this worktree runtime, so compatibility was inferred from stdlib-only unittest test structure rather than executed here

Review Notes

• Manual review of the final delta found no remaining correctness issues after the formatter sanitization fixes and webhook config enforcement updates.
• ~/.config/mosaic/tools/codex/codex-security-review.sh --uncommitted — no findings, risk level none
• ~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted did not return a terminal summary in this runtime; relied on manual review plus passing tests for the final gate in this session.

Risks / Blockers

• Potential git wrapper friction in worktrees for PR creation/merge steps; if it recurs, capture exact failing command and stop per Mosaic contract.
• pytest is not installed in the current runtime, so the suite’s pytest compatibility was not executed end-to-end here.