Skip to content

docs: repair procedures orphaned by API ceremony rewrite - #41

Merged
jmgilman merged 1 commit into
masterfrom
docs/followup-review
Aug 25, 2026
Merged

jmgilman merged 1 commit into
masterfrom
docs/followup-review

Conversation

@jmgilman

Copy link
Copy Markdown
Contributor

Summary

Follow-up independent docs review after #33–#40. Same three-axis wave as #32 plus functional reproduction in the review itself.

Blocking defect fixed

  • Rego how-to verification was orphaned by feat(api): reduce first-touch server ceremony #34: the tutorial rewrite deleted the in-process client (callTool, go run ., the execute print path), but use-rego-authorization.md still instructed patching it. Rewritten against the actual stdio tutorial: build, reload in the agent, run exact def main(): programs for the allowed and denied cases.

Accuracy

  • mcp-tools.md claimed literal tools/list schemas but showed normalized equivalents — now byte-matches the advertised wire values (inlined field shapes under both items, "result": true), established from a live tools/list capture.
  • Composite example declared output type list[...] while indexing response["items"] — a bare list root is ErrInvalidRegistration; prose now names the root field items.
  • SECURITY.md limit inventory now includes MaxIntermediateValueBytes (feat(worker): bound intermediate native results #36) and uses the canonical exposure sentence.
  • Tutorial go get prose no longer claims the MCP SDK comes from its default branch.

Style / Diátaxis (in-place)

  • Conditions before code: AllowAll/StaticSubject suitability now precedes the snippets in the tutorial, README, and disable how-to.
  • public-api.md procedural passages rewritten in neutral reference voice (no facts removed).
  • disable-capabilities.md verification split into numbered executable checks with exact inputs/expected errors.
  • Removed reintroduced hedges (normally, common) and new jargon (output universe); terminology regressions fixed; README documentation list gained the missing Rego how-to link.

Deliberately not done (consistent with the #32 scope decision): named-agent tutorial path, relocating tutorial explanation, moving the MCP recovery section, removing README's assembly snippet.

Validation

  • moon run docs:build (strict) and go test ./... -count=1 pass.
  • Functional reproduction (MCP client over CommandTransport standing in for the agent): tutorial program compiles as pasted and returns {"result":{"count":2,"key":"alpha"}}; Rego how-to allowed/denied cases reproduce {"result":{"count":2,"key":"alpha"}} / permission denied exactly (including the embed variant); disable how-to checks reproduce [] / capability not found / invalid program exactly.

Follow-up review after #33-#40 landed:
- Rewrite the Rego how-to verification against the current stdio
  tutorial; #34 deleted the in-process client it patched.
- Show the literal tools/list wire schemas in the MCP reference
  (inlined field shapes, result: true) and fix the composite example's
  root output shape (field items, not a bare list root).
- Add MaxIntermediateValueBytes to SECURITY.md's limit inventory.
- Make disable-capabilities verification executable-shaped with exact
  inputs and expected tool errors.
- Style repairs on new text: conditions before code, descriptive
  reference voice, removed 'normally'/'common'/'output universe',
  terminology and link fixes.
@jmgilman
jmgilman merged commit a5031b5 into master Aug 25, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant