# Reported issues for AsDecided

Pod holds 17 of 19 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [AsDecided](/mcp/asdecided).

## Most discussed

### Epic: MCP hardening — close the swarm-review findings

## Purpose

Track the confirmed weaknesses from the 2 August 2026 three-agent Terra review of `asdecided/core` at `fd1c20191351ba74524afd993290c6dfd1c56b16`.

The review found no P0. The concentration of risk is MCP: transport hardening, protocol validation, audit correctness, and response-boundary enforcement. The Rust index, freshness, export, and Sentry paths were comparatively sound. The full `decided-mcp` suite passed while several invalid requests were still accepted, so negative and confo

[Read the thread](https://github.com/asdecided/core/issues/418) · 2026-08-02 · closed · 4 comments

### (mcp) Enforce response budgets as hard limits

## Priority

P1 — agent context-safety contract.

## Problem

The advertised response budget is not a hard limit. Oversized summary responses with no supported truncation key are only marked as truncated, and deep relationship responses can retain an unbounded `neighborhood`.

The binding port contract records real outputs of 24,346 and 62,609 characters against the default 10,000-character budget. ADR-033 says every guide/MCP response is budgeted and that the default is configurable at startup,

[Read the thread](https://github.com/asdecided/core/issues/411) · 2026-08-02 · closed · 1 comment

### Epic: decision-grounding-paper — the deterministic decision-grounding paper

Execution tracking (epic) for the **`decision-grounding-paper`** roadmap (ADR-093: intent lives in the corpus, execution here).

**Intent (corpus):** [`decisions/roadmaps/future/decision-grounding-paper.md`](https://github.com/asdecided/core/blob/main/decisions/roadmaps/future/decision-grounding-paper.md) — publish an academic (arXiv, then a peer venue) position-and-evidence paper naming the layer the AI-coding-agent field is missing: *deterministic, typed, human-ratified decision grounding*, th

[Read the thread](https://github.com/asdecided/core/issues/293) · 2026-07-04 · open · 1 comment

### Epic: deterministic-substrate — the council-ranked substrate programme

Execution tracking (epic) for the **`deterministic-substrate`** roadmap (ADR-093: intent lives in the corpus, execution here).

**Intent (corpus):** [`decisions/roadmaps/deterministic-substrate.md`](https://github.com/asdecided/core/blob/main/decisions/roadmaps/deterministic-substrate.md) — the council-ranked programme advancing AsDecided Core as the deterministic decision-grounding layer underneath AI coding agents. The scoring method, averages, and the review constraints (recorded as Risks) li

[Read the thread](https://github.com/asdecided/core/issues/248) · 2026-07-02 · open · 1 comment

### (mcp) Harden shared HTTP serving against stalled and oversized requests

## Priority

P1 — shared-service availability and memory safety.

## Problem

The shared HTTP MCP server accepts and handles one connection synchronously before accepting the next. Request parsing has no read/write deadline, request-line limit, aggregate header limit, or body-size limit, and allocates a buffer directly from `Content-Length`.

A single client that sends an incomplete request can therefore block the endpoint indefinitely. A large numeric `Content-Length` can force an arbitrary all

[Read the thread](https://github.com/asdecided/core/issues/417) · 2026-08-02 · closed · 0 comments

### (mcp) Reject protocol-version carrier mismatches before era dispatch

## Priority

P1 — protocol interoperability and safe fallback.

## Problem

HTTP era selection trusts `MCP-Protocol-Version` before comparing it with request-body protocol metadata. A legacy header paired with current 2026 metadata is silently dispatched as legacy and can receive a successful legacy response.

This violates ADR-121's requirement to reject disagreement between protocol carriers before dispatch.

## Evidence

- [Era selection and current-only cross-check](https://github.com/asdeci

[Read the thread](https://github.com/asdecided/core/issues/412) · 2026-08-02 · closed · 0 comments

### (mcp) Validate JSON-RPC envelopes before era dispatch

## Priority

P2 — current-protocol correctness and interoperability.

## Problem

Request parsing checks that input is JSON and has a method/ID, but does not centrally validate the JSON-RPC envelope. Current requests with `jsonrpc: "1.0"` or an object-valued ID are accepted. In stdio, every `initialize` method is classified as legacy before current metadata is considered, so a current-era initialize request receives a successful frozen legacy response.

## Evidence

- [Stdio initialize era short

[Read the thread](https://github.com/asdecided/core/issues/409) · 2026-08-02 · closed · 0 comments

### (mcp) Restore complete and attributable audit records

## Priority

P1 — mandatory audit correctness and attribution.

## Problem

The shared-server audit path has three contract gaps:

1. Runtime reads only `X-AsDecided-Principal`, while ADR-098, the port contract, and the parity harness specify `X-Lore-Principal`.
2. Returned-artifact extraction ignores the `items` collection used by `retrieve_grounding` and the `decisions` collection used by path-mode `find_decisions`.
3. ADR-084 specifies returned records with identity, resolution state, and pro

[Read the thread](https://github.com/asdecided/core/issues/413) · 2026-08-02 · closed · 0 comments

## Most recent

### (docs) Align MCP documentation with the shipped Rust server

## Priority

P2 — operator and agent onboarding correctness.

## Problem

The MCP documentation no longer matches the shipped Rust server:

- It presents four tools while the static `tools/list` result contains six.
- It instructs users to pass `--telemetry`, but the Rust argument parser has no such option and exits with an error.
- Retired Python-era telemetry/stats guidance remains mixed into the Rust-only operating model.

## Evidence

- [Four-tool documentation](https://github.com/asdecided/

[Read the thread](https://github.com/asdecided/core/issues/414) · 2026-08-02 · closed · 0 comments

### (mcp) Validate Origin on Streamable HTTP requests

## Priority

P1 — Streamable HTTP security.

## Problem

The HTTP MCP endpoint does not validate the `Origin` header. MCP 2026-07-28 requires Streamable HTTP servers to validate Origin and return HTTP 403 for invalid origins to protect against DNS-rebinding attacks.

## Evidence

- [Current HTTP request validation path](https://github.com/asdecided/core/blob/fd1c20191351ba74524afd993290c6dfd1c56b16/rust/decided-mcp/src/http.rs#L180-L220)
- [Official MCP Streamable HTTP security requirements](htt

[Read the thread](https://github.com/asdecided/core/issues/416) · 2026-08-02 · closed · 0 comments

### (engine) Support MCP 2026-07-28 dual-era protocol

## Outcome

`decided-mcp` supports MCP protocol revision `2026-07-28` over stdio and HTTP without breaking clients using the legacy initialize lifecycle.

## Scope

- implement `server/discover` and per-request protocol metadata
- add `2025-11-25` to the legacy initialize-compatible versions
- require and validate the standard HTTP protocol, method, and name headers for `2026-07-28`
- return revision-appropriate JSON-RPC errors and HTTP statuses
- add required caching hints to cacheable results

[Read the thread](https://github.com/asdecided/core/issues/389) · 2026-07-28 · closed · 0 comments

### feat(product): cut over completely to AsDecided

## Decision

Make a clean breaking cutover from RAC/Lore product vocabulary to AsDecided. There is no temporary `rac` executable, dual CLI, or legacy environment-variable fallback.

Canonical product contract:

- Product: **AsDecided**
- CLI: `decided`
- Native MCP binary: `decided-mcp`
- Tagline: **Build, as decided.**
- Description: **Engineering decisions your agents can follow.**

Existing `RAC-*` artifact IDs remain immutable durable identities and are not rewritten. Wayfinder is out of sco

[Read the thread](https://github.com/asdecided/core/issues/379) · 2026-07-22 · closed · 0 comments

### perf(engine): certify S1 memory and delta cutover

## Context

P6.7 establishes 5,000 artifacts as RAC's S1 recommended production envelope. Latency and correctness pass. The delta path must remain explicit until the two remaining S1 gates are evidenced.

## Scope

- Measure snapshot and delta peak RSS across the complete 5,000-file lifecycle using the P6 scale harness and `/usr/bin/time -l`.
- Define and run a bounded 5,000-file soak covering unchanged reads, edit, add, delete, rename, threshold compaction, and first edit after compaction.
- As

[Read the thread](https://github.com/asdecided/core/issues/375) · 2026-07-22 · closed · 0 comments

### Performance: cache on by default with stat-proxy freshness

Delivered in v0.23.0 and retained in the current native AsDecided runtime.

**Delivered behavior:**

- `decided find`, `decided validate`, and `decided-mcp` use the persistent cache by default.
- `--no-cache` and `DECIDED_NO_CACHE=1` restore the uncached path.
- `--verify` forces the full content-hash freshness floor.
- One-shot retrieval persists `manifest/v1/{root_key}.fseg` and uses stat-proxy freshness.
- Missing or unwritable cache locations degrade without failing the command.
- Cached and

[Read the thread](https://github.com/asdecided/core/issues/340) · 2026-07-09 · closed · 0 comments

### decision-to-code-proximity: applies-to vocabulary — land the decision code-scope section

Sub-issue of #273 (`decision-to-code-proximity`, ADR-093).

**Corpus:** [`rac/requirements/rac-decision-applies-to-scope.md`](https://github.com/itsthelore/rac-core/blob/main/rac/requirements/rac-decision-applies-to-scope.md) — the existing gap-7 requirement, adopted as this roadmap's Initiative 1.

**Scope:**
- Optional `## Applies To` section on decisions, recognised and extracted like other optional sections; additive (ADR-007), classification-neutral (adjacent-type tests hold).
- Path-style 

[Read the thread](https://github.com/asdecided/core/issues/274) · 2026-07-03 · closed · 0 comments

### corpus-federation: source-aware read model, resolution, routing, and enforcement

Sub-issue of #267 (`corpus-federation`, ADR-093). The governing ADR gate #269 and prerequisites #256/#260 are complete.

**Corpus:** [`parent-corpus-inheritance`](https://github.com/asdecided/core/blob/main/decisions/requirements/parent-corpus-inheritance.md) and [`federated-resolution-provenance`](https://github.com/asdecided/core/blob/main/decisions/requirements/federated-resolution-provenance.md), governed by ADR-133 through ADR-143.

**Scope:**

- Parse `.decided/corpus.md` with exact lowerc

[Read the thread](https://github.com/asdecided/core/issues/270) · 2026-07-02 · closed · 0 comments

### Epic: corpus-federation — parent corpus and ## inherits

Execution tracking (epic) for the **`corpus-federation`** roadmap (ADR-093: intent lives in the corpus, execution here).

**Accepted authority:** [PR #451](https://github.com/asdecided/core/pull/451) merged the refreshed design and separately human-ratified ADR-133 through ADR-143. Together they govern the first increment:

- exactly one direct, read-only parent;
- offline in-repository materialisation and versioned SHA-256 verification;
- explicit `corpus.source` identity;
- qualified resolutio

[Read the thread](https://github.com/asdecided/core/issues/267) · 2026-07-02 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/asdecided/core/issues).