Reported issues for AsDecided

Pod holds 17 of 19 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to AsDecided.

Most discussed

Epic: MCP hardening — close the swarm-review findings

Purpose

Track the confirmed weaknesses from the 2 August 2026 three-agent Terra review of asdecided/core at fd1c20191351ba74524afd993290c6dfd1c56b16.

The review found no P0. The concentration of risk is MCP: transport hardening, protocol validation, audit correctness, and response-boundary enforcement. The Rust index, freshness, export, and Sentry paths were comparatively sound. The full decided-mcp suite passed while several invalid requests were still accepted, so negative and confo

Read the thread · 2026-08-02 · closed · 4 comments

(mcp) Enforce response budgets as hard limits

Priority

P1 — agent context-safety contract.

Problem

The advertised response budget is not a hard limit. Oversized summary responses with no supported truncation key are only marked as truncated, and deep relationship responses can retain an unbounded neighborhood.

The binding port contract records real outputs of 24,346 and 62,609 characters against the default 10,000-character budget. ADR-033 says every guide/MCP response is budgeted and that the default is configurable at startup,

Read the thread · 2026-08-02 · closed · 1 comment

Epic: decision-grounding-paper — the deterministic decision-grounding paper

Execution tracking (epic) for the decision-grounding-paper roadmap (ADR-093: intent lives in the corpus, execution here).

Intent (corpus): decisions/roadmaps/future/decision-grounding-paper.md — publish an academic (arXiv, then a peer venue) position-and-evidence paper naming the layer the AI-coding-agent field is missing: deterministic, typed, human-ratified decision grounding, th

Read the thread · 2026-07-04 · open · 1 comment

Epic: deterministic-substrate — the council-ranked substrate programme

Execution tracking (epic) for the deterministic-substrate roadmap (ADR-093: intent lives in the corpus, execution here).

Intent (corpus): decisions/roadmaps/deterministic-substrate.md — the council-ranked programme advancing AsDecided Core as the deterministic decision-grounding layer underneath AI coding agents. The scoring method, averages, and the review constraints (recorded as Risks) li

Read the thread · 2026-07-02 · open · 1 comment

(mcp) Harden shared HTTP serving against stalled and oversized requests

Priority

P1 — shared-service availability and memory safety.

Problem

The shared HTTP MCP server accepts and handles one connection synchronously before accepting the next. Request parsing has no read/write deadline, request-line limit, aggregate header limit, or body-size limit, and allocates a buffer directly from Content-Length.

A single client that sends an incomplete request can therefore block the endpoint indefinitely. A large numeric Content-Length can force an arbitrary all

Read the thread · 2026-08-02 · closed · 0 comments

(mcp) Reject protocol-version carrier mismatches before era dispatch

Priority

P1 — protocol interoperability and safe fallback.

Problem

HTTP era selection trusts MCP-Protocol-Version before comparing it with request-body protocol metadata. A legacy header paired with current 2026 metadata is silently dispatched as legacy and can receive a successful legacy response.

This violates ADR-121's requirement to reject disagreement between protocol carriers before dispatch.

Evidence

[Era selection and current-only cross-check](https://github.com/asdeci

Read the thread · 2026-08-02 · closed · 0 comments

(mcp) Validate JSON-RPC envelopes before era dispatch

Priority

P2 — current-protocol correctness and interoperability.

Problem

Request parsing checks that input is JSON and has a method/ID, but does not centrally validate the JSON-RPC envelope. Current requests with jsonrpc: "1.0" or an object-valued ID are accepted. In stdio, every initialize method is classified as legacy before current metadata is considered, so a current-era initialize request receives a successful frozen legacy response.

Evidence

[Stdio initialize era short

Read the thread · 2026-08-02 · closed · 0 comments

(mcp) Restore complete and attributable audit records

Priority

P1 — mandatory audit correctness and attribution.

Problem

The shared-server audit path has three contract gaps:

Runtime reads only X-AsDecided-Principal, while ADR-098, the port contract, and the parity harness specify X-Lore-Principal.
Returned-artifact extraction ignores the items collection used by retrieve_grounding and the decisions collection used by path-mode find_decisions.
ADR-084 specifies returned records with identity, resolution state, and pro

Read the thread · 2026-08-02 · closed · 0 comments

Most recent

(docs) Align MCP documentation with the shipped Rust server

Priority

P2 — operator and agent onboarding correctness.

Problem

The MCP documentation no longer matches the shipped Rust server:

It presents four tools while the static tools/list result contains six.
It instructs users to pass --telemetry, but the Rust argument parser has no such option and exits with an error.
Retired Python-era telemetry/stats guidance remains mixed into the Rust-only operating model.

Evidence

[Four-tool documentation](https://github.com/asdecided/

Read the thread · 2026-08-02 · closed · 0 comments

(mcp) Validate Origin on Streamable HTTP requests

Priority

P1 — Streamable HTTP security.

Problem

The HTTP MCP endpoint does not validate the Origin header. MCP 2026-07-28 requires Streamable HTTP servers to validate Origin and return HTTP 403 for invalid origins to protect against DNS-rebinding attacks.

Evidence

Current HTTP request validation path
[Official MCP Streamable HTTP security requirements](htt

Read the thread · 2026-08-02 · closed · 0 comments

(engine) Support MCP 2026-07-28 dual-era protocol

Outcome

decided-mcp supports MCP protocol revision 2026-07-28 over stdio and HTTP without breaking clients using the legacy initialize lifecycle.

Scope

implement server/discover and per-request protocol metadata
add 2025-11-25 to the legacy initialize-compatible versions
require and validate the standard HTTP protocol, method, and name headers for 2026-07-28
return revision-appropriate JSON-RPC errors and HTTP statuses
add required caching hints to cacheable results

Read the thread · 2026-07-28 · closed · 0 comments

feat(product): cut over completely to AsDecided

Decision

Make a clean breaking cutover from RAC/Lore product vocabulary to AsDecided. There is no temporary rac executable, dual CLI, or legacy environment-variable fallback.

Canonical product contract:

Product: AsDecided
CLI: decided
Native MCP binary: decided-mcp
Tagline: Build, as decided.
Description: Engineering decisions your agents can follow.

Existing RAC-* artifact IDs remain immutable durable identities and are not rewritten. Wayfinder is out of sco

Read the thread · 2026-07-22 · closed · 0 comments

perf(engine): certify S1 memory and delta cutover

Context

P6.7 establishes 5,000 artifacts as RAC's S1 recommended production envelope. Latency and correctness pass. The delta path must remain explicit until the two remaining S1 gates are evidenced.

Scope

Measure snapshot and delta peak RSS across the complete 5,000-file lifecycle using the P6 scale harness and /usr/bin/time -l.
Define and run a bounded 5,000-file soak covering unchanged reads, edit, add, delete, rename, threshold compaction, and first edit after compaction.
As

Read the thread · 2026-07-22 · closed · 0 comments

Performance: cache on by default with stat-proxy freshness

Delivered in v0.23.0 and retained in the current native AsDecided runtime.

Delivered behavior:

decided find, decided validate, and decided-mcp use the persistent cache by default.
--no-cache and DECIDED_NO_CACHE=1 restore the uncached path.
--verify forces the full content-hash freshness floor.
One-shot retrieval persists manifest/v1/{root_key}.fseg and uses stat-proxy freshness.
Missing or unwritable cache locations degrade without failing the command.
Cached and

Read the thread · 2026-07-09 · closed · 0 comments

decision-to-code-proximity: applies-to vocabulary — land the decision code-scope section

Sub-issue of #273 (decision-to-code-proximity, ADR-093).

Corpus: rac/requirements/rac-decision-applies-to-scope.md — the existing gap-7 requirement, adopted as this roadmap's Initiative 1.

Scope:

Optional ## Applies To section on decisions, recognised and extracted like other optional sections; additive (ADR-007), classification-neutral (adjacent-type tests hold).
Path-style

Read the thread · 2026-07-03 · closed · 0 comments

corpus-federation: source-aware read model, resolution, routing, and enforcement

Sub-issue of #267 (corpus-federation, ADR-093). The governing ADR gate #269 and prerequisites #256/#260 are complete.

Corpus: parent-corpus-inheritance and federated-resolution-provenance, governed by ADR-133 through ADR-143.

Scope:

Parse .decided/corpus.md with exact lowerc

Read the thread · 2026-07-02 · closed · 0 comments

Epic: corpus-federation — parent corpus and ## inherits

Execution tracking (epic) for the corpus-federation roadmap (ADR-093: intent lives in the corpus, execution here).

Accepted authority: PR #451 merged the refreshed design and separately human-ratified ADR-133 through ADR-143. Together they govern the first increment:

exactly one direct, read-only parent;
offline in-repository materialisation and versioned SHA-256 verification;
explicit corpus.source identity;
qualified resolutio

Read the thread · 2026-07-02 · closed · 0 comments

The remaining reports are on the project's issue tracker.