Skip to content

feat(mcp): change forgetful server type to stdio with uvx command#768

Merged
rjmurillo-bot merged 9 commits into
mainfrom
feat/mcp-forgetful-stdio
Jan 4, 2026
Merged

feat(mcp): change forgetful server type to stdio with uvx command#768
rjmurillo-bot merged 9 commits into
mainfrom
feat/mcp-forgetful-stdio

Conversation

@rjmurillo-bot

@rjmurillo-bot rjmurillo-bot commented Jan 4, 2026

Copy link
Copy Markdown
Collaborator

Pull Request

Summary

Changes Forgetful MCP server from HTTP to stdio transport now that upstream issue #19 is fixed. This simplifies configuration and removes 964 lines of HTTP-specific infrastructure code.

Upstream Fix: ScottRBK/forgetful#19

Specification References

Type Reference Description
Infrastructure Upstream issue #19 Forgetful stdio transport now works correctly

Changes

  • Update .mcp.json to use stdio transport for Forgetful MCP server
  • Change from HTTP URL (localhost:8020/mcp) to uvx command invocation (uvx forgetful-ai)
  • Remove HTTP server implementation (964 lines):
    • Delete scripts/forgetful/Install-ForgetfulLinux.ps1 (systemd service setup)
    • Delete scripts/forgetful/Install-ForgetfulWindows.ps1 (Task Scheduler setup)
    • Delete scripts/forgetful/Test-ForgetfulHealth.ps1 (HTTP endpoint testing)
    • Delete scripts/forgetful/README.md (HTTP setup documentation)
  • Update documentation:
    • CONTRIBUTING.md: Replace HTTP setup section with simple stdio configuration
    • CLAUDE.md: Update MCP servers table and remove HTTP references

Type of Change

  • Bug fix (non-breaking change fixing an issue)
  • New feature (non-breaking change adding functionality)
  • Breaking change (fix or feature causing existing functionality to change)
  • Documentation update
  • Infrastructure/CI change
  • Refactoring (no functional changes)

Testing

  • Tests added/updated
  • Manual testing completed
  • No testing required (documentation only)

Agent Review

Security Review

Required for: Authentication, authorization, CI/CD, git hooks, secrets, infrastructure

  • No security-critical changes in this PR
  • Security agent reviewed infrastructure changes
  • Security agent reviewed authentication/authorization changes
  • Security patterns applied (see .agents/security/)

Files requiring security review:

  • .mcp.json - MCP server configuration
  • scripts/forgetful/ - Deleted HTTP server scripts (964 lines removed)

Other Agent Reviews

  • Architect reviewed design changes
  • Critic validated implementation plan
  • QA verified test coverage

Checklist

  • Code follows project style guidelines
  • Self-review completed
  • Comments added for complex logic
  • Documentation updated (if applicable)
  • No new warnings introduced

Related Issues

N/A - Upstream bug fix enables reverting to stdio transport

Benefits

  1. Simpler setup: No manual service configuration required (uvx handles lifecycle)
  2. Less maintenance: Removed 964 lines of platform-specific installation code
  3. Better reliability: Uses official stdio transport instead of workaround
  4. Auto-install: uvx automatically downloads and runs Forgetful on demand

Copilot AI review requested due to automatic review settings January 4, 2026 09:27
@diffray diffray Bot added the diffray-review-started diffray review status: started label Jan 4, 2026
@github-actions github-actions Bot added the enhancement New feature or request label Jan 4, 2026
@github-actions

github-actions Bot commented Jan 4, 2026

Copy link
Copy Markdown
Contributor

PR Validation Report

Note

Status: PASS

Description Validation

Check Status
Description matches diff PASS

QA Validation

Check Status
Code changes detected True
QA report exists false

⚡ Warnings

  • QA report not found for code changes (recommended before merge)

Powered by PR Validation workflow

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request changes the Forgetful MCP server from HTTP to stdio transport. However, this change directly contradicts the project's documentation and installation scripts, which explicitly warn that stdio transport is broken due to an upstream bug and that HTTP transport must be used. This change is likely to cause a regression and break the Forgetful integration. The configuration should be reverted unless the underlying bug has been fixed and all related documentation is updated accordingly.

Comment thread .mcp.json
Session log for PR #768 creation:
- Created branch feat/mcp-forgetful-stdio from commit d10dc63
- Opened PR for MCP configuration change
- Fixed markdown linting for ultrathink commands

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@diffray

diffray Bot commented Jan 4, 2026

Copy link
Copy Markdown

Changes Summary

This PR changes the Forgetful MCP server configuration from HTTP transport (localhost:8020) to stdio transport using the uvx command. This is an infrastructure change that affects how the Forgetful AI service communicates with the MCP system.

Type: config

Components Affected: MCP Server Configuration, Forgetful AI Integration

Files Changed
File Summary Change Impact
/tmp/workspace/.mcp.json Changed forgetful server from HTTP transport to stdio with uvx launcher ✏️ 🔴
Architecture Impact
  • New Patterns: stdio transport pattern
  • Dependencies: changed: forgetful transport from HTTP to stdio
  • Coupling: Reduces dependency on network stack for local service communication, moves to process-based IPC
  • Breaking Changes: Forgetful server must now be available via uvx/pip instead of running HTTP service

Risk Areas: Forgetful AI service availability and initialization, Compatibility with existing code that may expect HTTP endpoint, uvx package manager availability and forgetful-ai package installation, Process lifecycle management for stdio-based server, Error handling during server startup/communication

Suggestions
  • Verify that forgetful-ai package is available via uvx
  • Check for any hardcoded references to localhost:8020 in codebase
  • Update documentation to reflect new stdio-based configuration
  • Test server initialization and communication flow
  • Consider fallback handling if uvx or forgetful-ai package is unavailable

🔗 See progress

Full review in progress... | Powered by diffray

@diffray diffray Bot added diffray-review-completed diffray review status: completed and removed diffray-review-started diffray review status: started labels Jan 4, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR changes the Forgetful MCP server configuration from HTTP transport (localhost:8020/mcp) to stdio transport using the uvx forgetful-ai command. However, this change contradicts extensive project documentation stating that Forgetful's stdio transport is broken due to FastMCP banner corruption (upstream issue #19), with no explanation or evidence that this issue has been resolved.

Key Changes:

  • Modified .mcp.json to use stdio transport with uvx command instead of HTTP transport
  • Removed HTTP URL configuration for Forgetful server
  • Added uvx command-based invocation for automatic package installation

Comment thread .mcp.json
Comment thread .mcp.json
Upstream issue #19 (ScottRBK/forgetful#19)
has been fixed. Forgetful now works correctly with stdio transport.

Changes:
- Remove HTTP-based install scripts (Linux/Windows)
- Remove HTTP health check script
- Update CONTRIBUTING.md to document stdio setup
- Update CLAUDE.md to reflect stdio transport
- Simplify configuration (uvx handles lifecycle automatically)

Related: PR #768

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@diffray diffray Bot added diffray-review-started diffray review status: started and removed diffray-review-completed diffray review status: completed labels Jan 4, 2026
@github-actions github-actions Bot added the automation Automated workflows and processes label Jan 4, 2026
@github-actions

github-actions Bot commented Jan 4, 2026

Copy link
Copy Markdown
Contributor

Spec-to-Implementation Validation

Warning

No spec references found

This PR does not reference any specifications (REQ-, DESIGN-, TASK-*, or linked issues).

How to add spec references

Add spec references to your PR description to enable traceability:

Method Example
Reference requirements Implements REQ-001
Link issues Closes #123
Reference spec files .agents/specs/requirements/...

Spec Requirement by PR Type:

PR Type Required?
Feature (feat:) ✅ Required
Bug fix (fix:) Optional
Refactor (refactor:) Optional
Documentation (docs:) Not required
Infrastructure (ci:, build:, chore:) Optional

See PR template for full guidance.


Powered by AI Spec Validator workflow

@diffray

diffray Bot commented Jan 4, 2026

Copy link
Copy Markdown

Changes Summary

This PR migrates the Forgetful MCP server from HTTP transport to stdio transport with automatic uvx installation. This simplifies the setup by eliminating the need for manual systemd/scheduled task services, making Forgetful automatically start on demand like other MCP servers. The change removes complex installation scripts and documentation for HTTP-based service management.

Type: refactoring

Components Affected: MCP Configuration, Forgetful MCP Server Setup, Documentation, Installation Scripts, Slash Commands

Files Changed
File Summary Change Impact
.mcp.json Changed Forgetful transport from HTTP (localhost:8020) to stdio with uvx command ✏️ 🔴
CLAUDE.md Updated MCP servers table and verification instructions to reflect stdio transport change ✏️ 🟡
CONTRIBUTING.md Replaced complex HTTP service setup documentation with simple stdio/uvx configuration ✏️ 🟡
.claude/commands/memory-documentary.md Moved ultrathink directive before content heading (formatting fix) ✏️ 🟢
.claude/commands/research.md Moved ultrathink directive before content heading (formatting fix) ✏️ 🟢
...026-01-04-session-306-mcp-forgetful-stdio-pr.md Session log documenting the PR creation process 🟢
Architecture Impact
  • Dependencies: removed: systemd service setup for Forgetful, removed: Windows scheduled task setup for Forgetful, added: automatic uvx-based stdio transport for Forgetful
  • Coupling: Reduced coupling by removing platform-specific service management (systemd/Task Scheduler) in favor of unified stdio transport
  • Breaking Changes: Existing Forgetful HTTP service installations will no longer be used (users must migrate to stdio)

Risk Areas: Users with existing Forgetful HTTP services will need to stop and disable them, Changes to .mcp.json affect MCP server connectivity - runtime failure if uvx not installed, Removed installation/health check scripts may have been in use by existing workflows, Documentation changes may not reach all users who rely on HTTP setup

Suggestions
  • Consider adding migration notes in the PR description for users with existing HTTP setups
  • Verify that the stdio transport doesn't have the FastMCP banner corruption issue mentioned in the removed documentation
  • Test that uvx automatically installs forgetful-ai on first use
  • Consider keeping a deprecation notice for the removed scripts/forgetful directory

🔗 See progress

Full review in progress... | Powered by diffray

Updated session log with complete outcomes:
- HTTP server implementation removed (964 lines)
- Documentation updated for stdio transport
- All changes pushed to PR #768

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings January 4, 2026 09:31
@github-actions

github-actions Bot commented Jan 4, 2026

Copy link
Copy Markdown
Contributor

AI Quality Gate Review

Tip

Final Verdict: PASS

Walkthrough

This PR was reviewed by six AI agents in parallel, analyzing different aspects of the changes:

  • Security Agent: Scans for vulnerabilities, secrets exposure, and security anti-patterns
  • QA Agent: Evaluates test coverage, error handling, and code quality
  • Analyst Agent: Assesses code quality, impact analysis, and maintainability
  • Architect Agent: Reviews design patterns, system boundaries, and architectural concerns
  • DevOps Agent: Evaluates CI/CD, build pipelines, and infrastructure changes
  • Roadmap Agent: Assesses strategic alignment, feature scope, and user value

Review Summary

Agent Verdict Category Status
Security PASS N/A
QA PASS N/A
Analyst PASS N/A
Architect PASS N/A
DevOps PASS N/A
Roadmap PASS N/A

💡 Quick Access: Click on individual agent jobs (e.g., "🔒 security Review", "🧪 qa Review") in the workflow run to see detailed findings and step summaries.

Analyst Review Details

Based on my analysis of the PR, I have enough information to provide a comprehensive review.


Analysis: PR feat(mcp) - Forgetful stdio transport

Code Quality Score

Criterion Score (1-5) Notes
Readability 5 Configuration change is clear and minimal
Maintainability 5 Removes 964 lines of platform-specific code
Consistency 5 Follows existing Serena stdio pattern
Simplicity 5 uvx auto-install eliminates manual setup

Overall: 5/5

Impact Assessment

  • Scope: Module-wide (MCP configuration only)
  • Risk Level: Low
  • Affected Components: .mcp.json, CONTRIBUTING.md, CLAUDE.md

Findings

Priority Category Finding Location
Low Documentation Forgetful setup section updated correctly CONTRIBUTING.md:381-405
Low Configuration stdio transport matches Serena pattern .mcp.json:23-29
Low Cleanup HTTP infrastructure properly removed scripts/forgetful/ (deleted)

Verified Changes

  1. .mcp.json: Forgetful now uses stdio transport with uvx forgetful-ai command. Matches the existing Serena configuration pattern exactly.

  2. CONTRIBUTING.md: Forgetful section (lines 381-405) correctly documents:

    • stdio transport with uvx
    • Simplified configuration example
    • uv installation prerequisites for Linux/macOS/Windows
    • Connection verification steps
  3. CLAUDE.md: MCP servers table (line 107) correctly shows Forgetful as stdio transport. References to HTTP server removed.

  4. Deleted Files: The scripts/forgetful/ directory no longer exists, confirming removal of:

    • Install-ForgetfulLinux.ps1 (systemd service)
    • Install-ForgetfulWindows.ps1 (Task Scheduler)
    • Test-ForgetfulHealth.ps1 (HTTP health check)
    • README.md (HTTP setup docs)

Architectural Alignment

Documentation Completeness

  • [PASS] CONTRIBUTING.md updated with new setup instructions
  • [PASS] CLAUDE.md transport table updated
  • [PASS] Prerequisites documented (uv installation)

Dependencies

  • uvx: Required for stdio transport. Same requirement as Serena.
  • forgetful-ai: PyPI package. Handled by uvx on demand.
  • Licensing: No new licensing concerns (existing dependency)

Recommendations

  1. None. The change is clean, well-documented, and removes unnecessary complexity.

Verdict

VERDICT: PASS
MESSAGE: Clean infrastructure simplification. Removes 964 lines of HTTP workaround code. Follows established Serena pattern for stdio transport.
Roadmap Review Details

Based on my review of the PR description, the product roadmap, CLAUDE.md, .mcp.json, and CONTRIBUTING.md, I can now provide the strategic alignment assessment.


Strategic Alignment Assessment

Criterion Rating Notes
Aligns with project goals High Simplifies MCP configuration per multi-platform agent system architecture
Priority appropriate High Upstream fix enables removal of 964 lines of workaround code
User value clear High Eliminates manual service setup, enables auto-install via uvx
Investment justified High Negative code investment (removes code, reduces maintenance)

Feature Completeness

  • Scope Assessment: Right-sized
  • Ship Ready: Yes
  • MVP Complete: Yes
  • Enhancement Opportunities: None identified

Impact Analysis

Dimension Assessment Notes
User Value High Zero-config setup replaces platform-specific service installation (Linux systemd, Windows Task Scheduler)
Business Impact Medium Reduces onboarding friction for all three platforms
Technical Leverage High Removes 964 lines of HTTP infrastructure code (Install-ForgetfulLinux.ps1, Install-ForgetfulWindows.ps1, Test-ForgetfulHealth.ps1)
Competitive Position Improved Aligns with upstream project direction

Concerns

Priority Concern Recommendation
Low uvx dependency now required for all platforms Documented in CONTRIBUTING.md with install commands

Recommendations

  1. No strategic concerns. This change aligns with the Master Product Objective: "Enable development teams to adopt coordinated multi-agent AI workflows across VS Code, GitHub Copilot CLI, and Claude Code with minimal friction and maximum consistency."

  2. Documentation appears complete. CONTRIBUTING.md and CLAUDE.md both updated to reflect stdio transport.

  3. Maintenance burden reduction supports P0 platform (Claude Code). The MCP server table in CLAUDE.md correctly shows Forgetful as stdio transport.

Verdict

VERDICT: PASS
MESSAGE: Change simplifies MCP configuration, removes 964 lines of HTTP workaround code, and aligns with upstream fix. Zero strategic conflicts, positive maintenance impact.
DevOps Review Details

Based on my analysis, I can now provide the DevOps review.


DevOps Review: Forgetful MCP stdio Transport Migration

PR Scope Detection

Category Files Review Scope
CONFIG .mcp.json Schema validation
DOCS CONTRIBUTING.md, CLAUDE.md None required
SCRIPT (deleted) scripts/forgetful/* Verify safe removal

This PR removes HTTP infrastructure and simplifies to stdio transport.

Pipeline Impact Assessment

Area Impact Notes
Build None No build scripts affected
Test None No test workflows affected
Deploy Low MCP configuration change for local development
Cost None Removes maintenance burden

CI/CD Quality Checks

Check Status Location
YAML syntax valid N/A No workflow changes
Actions pinned N/A No workflow changes
Secrets secure .mcp.json contains no secrets
Permissions minimal N/A No workflow changes
Shell scripts robust N/A Scripts deleted, not modified

Findings

Severity Category Finding Location Fix
Low Configuration uvx dependency not documented in prerequisites CONTRIBUTING.md:406-420 Prerequisites section present, uv install documented

Configuration Review

.mcp.json Analysis:

The new Forgetful configuration is valid:

{
  "forgetful": {
    "type": "stdio",
    "command": "uvx",
    "args": ["forgetful-ai"]
  }
}
  • Transport type correctly changed from http to stdio
  • Uses uvx for automatic package management (no manual service setup)
  • Consistent with Serena MCP pattern in same file (both use uvx)
  • No hardcoded secrets or sensitive data

Infrastructure Cleanup

Deleted scripts (verified safe removal):

  • Install-ForgetfulLinux.ps1 - systemd service no longer needed
  • Install-ForgetfulWindows.ps1 - Task Scheduler no longer needed
  • Test-ForgetfulHealth.ps1 - HTTP endpoint testing obsolete
  • scripts/forgetful/README.md - HTTP documentation obsolete

The scripts/forgetful/ directory confirmed removed (path does not exist).

Documentation Review

CONTRIBUTING.md properly updated with:

  • Prerequisites section for uv installation (lines 406-420)
  • Simple stdio configuration example (lines 389-402)
  • Verification steps for MCP connection

Template Assessment

  • PR Template: Not affected
  • Issue Templates: Not affected
  • Template Issues: None

Automation Opportunities

Opportunity Type Benefit Effort
None identified N/A PR simplifies infrastructure N/A

Recommendations

  1. PR removes 964 lines of platform-specific installation code. This reduces maintenance burden.
  2. stdio transport via uvx provides automatic installation and lifecycle management.
  3. Configuration aligns with existing Serena MCP pattern.

Verdict

VERDICT: PASS
MESSAGE: Infrastructure simplification with proper documentation. No CI/CD, secrets, or security concerns.
Architect Review Details

The PR removes the scripts/forgetful/ directory. Let me check what files are being changed and review the existing ADRs for relevant decisions.

Architect Review: feat(mcp): change forgetful server type to stdio with uvx command

Design Quality Assessment

Aspect Rating (1-5) Notes
Pattern Adherence 5 Aligns with uvx stdio pattern already used by Serena MCP
Boundary Respect 5 Clean separation - removes infrastructure layer, simplifies to config-only
Coupling 5 Reduces coupling by eliminating HTTP service dependencies
Cohesion 5 Single responsibility: MCP client config, not service management
Extensibility 4 uvx handles versioning; loses platform-specific customization

Overall Design Score: 4.8/5

Architectural Concerns

Severity Concern Location Recommendation
Low uvx dependency implicit CONTRIBUTING.md Document uv installation prerequisite more prominently

Breaking Change Assessment

  • Breaking Changes: No
  • Impact Scope: Minor
  • Migration Required: No
  • Migration Path: N/A - uvx auto-installs on first use

Technical Debt Analysis

  • Debt Added: None
  • Debt Reduced: High (964 lines of platform-specific infrastructure removed)
  • Net Impact: Improved

ADR Assessment

  • ADR Required: No
  • Decisions Identified: Transport mechanism change (HTTP to stdio)
  • Existing ADR: ADR-007 already documents Forgetful as supplementary memory with stdio transport
  • Recommendation: N/A - ADR-007 already covers Forgetful integration; this change aligns with documented architecture

Recommendations

  1. No architectural changes required. The PR correctly simplifies infrastructure.
  2. ADR-007 Section "Implementation Notes" already anticipates Forgetful MCP as stdio-based.
  3. Documentation updates in CONTRIBUTING.md and CLAUDE.md correctly reflect the change.

Verdict

VERDICT: PASS
MESSAGE: Clean architectural simplification. Removes 964 lines of HTTP infrastructure in favor of uvx stdio transport. Aligns with existing Serena pattern and ADR-007 memory architecture. No breaking changes. No new ADR required.
QA Review Details

Based on my analysis, I can now provide the QA review.


QA Review: feat(mcp): change forgetful server type to stdio with uvx command

VERDICT: PASS
MESSAGE: Infrastructure/documentation change with no executable code requiring tests.

PR TYPE: MIXED (CONFIG + DOCS + INFRASTRUCTURE-REMOVAL)
FILES:
- CONFIG: .mcp.json (updated transport type)
- DOCS: CONTRIBUTING.md, CLAUDE.md (documentation updates)
- INFRASTRUCTURE-REMOVAL: scripts/forgetful/ (deleted - HTTP server scripts)

PR Type Classification

Category Files Status
CONFIG .mcp.json Valid JSON with stdio transport
DOCS CONTRIBUTING.md, CLAUDE.md Updated to reflect stdio transport
DELETED scripts/forgetful/*.ps1, scripts/forgetful/README.md 964 lines of HTTP infrastructure removed

Test Coverage Assessment

N/A - No new executable code introduced.

This PR:

  1. Changes configuration (JSON transport type)
  2. Deletes obsolete code (HTTP server scripts)
  3. Updates documentation

No new functions, classes, or executable logic requiring tests.

Quality Concerns

Severity Issue Location Evidence Required Fix
LOW Deleted code has no replacement tests scripts/forgetful/ Intentional removal - upstream fix enables native stdio None required

Schema Validation (CONFIG)

.mcp.json analysis:

{
  "forgetful": {
    "type": "stdio",       // Valid transport type
    "command": "uvx",       // Valid command
    "args": ["forgetful-ai"] // Valid args array
  }
}

Status: [PASS] - Valid MCP configuration schema.

Documentation Consistency Check

Document Updated Consistent
.mcp.json ✓ stdio transport
CONTRIBUTING.md ✓ Forgetful section updated
CLAUDE.md ✓ MCP servers table updated

Status: [PASS] - All documentation aligned with new configuration.

Regression Risk Assessment

  • Risk Level: Low
  • Affected Components: MCP server configuration, AI agent memory access
  • Breaking Changes: Transport change from HTTP to stdio (requires uvx installed)
  • Required Testing: Manual verification of MCP connection (documented as completed in PR)
  • Rollback: Revert .mcp.json to HTTP transport if issues occur

Security Review (For Infrastructure Changes)

Check Status Evidence
No secrets in config [PASS] .mcp.json contains only transport config
No credential exposure [PASS] Deleted scripts had no hardcoded credentials
Command injection risk [PASS] uvx with fixed args, no user input

Evidence Summary

EVIDENCE:
- Tests found: N/A - No new executable code
- Edge cases: N/A - Configuration change only
- Error handling: N/A - No code paths added
- Blocking issues: 0
- Deleted code: 964 lines (intentional cleanup)
- Documentation: Updated in 2 files
- Prerequisites: uvx installation documented in CONTRIBUTING.md

Rationale

  1. No new tests required: PR removes infrastructure code (964 lines) and updates configuration. No new executable logic.
  2. Upstream dependency: Change enabled by ScottRBK/forgetful#19 fix.
  3. Simplification benefit: Removes platform-specific installation complexity (systemd/Task Scheduler).
  4. Documentation complete: Prerequisites (uvx installation) and verification steps documented.
Security Review Details

Based on my review of the PR, here is the security analysis:


PR Type Detection

Category Files Changed Security Scrutiny
CONFIG .mcp.json Schema and secrets only
DOCS CONTRIBUTING.md, CLAUDE.md None required
INFRA scripts/forgetful/ (deleted) Secrets, permissions

Findings

Severity Category Finding Location CWE
None - No security issues found - -

Analysis Summary

1. MCP Configuration Review (.mcp.json)

The Forgetful server configuration change:

  • Before: HTTP transport to localhost:8020/mcp
  • After: stdio transport via uvx forgetful-ai

Security Assessment:

  • [PASS] No hardcoded secrets or API keys
  • [PASS] Uses local stdio transport (no network exposure)
  • [PASS] uvx is a standard Python package manager tool
  • [PASS] No credential patterns detected

2. Deleted Infrastructure Scripts

The PR removes 4 files (964 lines):

  • Install-ForgetfulLinux.ps1 (systemd service setup)
  • Install-ForgetfulWindows.ps1 (Task Scheduler setup)
  • Test-ForgetfulHealth.ps1 (HTTP endpoint testing)
  • README.md (HTTP setup documentation)

Security Assessment:

  • [PASS] Removing HTTP infrastructure reduces attack surface
  • [PASS] No secrets exposed in deleted files
  • [PASS] Stdio transport eliminates network-based attack vectors

3. Documentation Changes

  • CONTRIBUTING.md: Updated to reflect stdio configuration
  • CLAUDE.md: Updated MCP servers table

Security Assessment:

  • [PASS] No sensitive data in documentation
  • [PASS] Example configuration uses standard patterns

Recommendations

  1. Transport security improved: Moving from HTTP (network-accessible) to stdio (local process) eliminates remote attack vectors against the MCP server.

  2. Attack surface reduced: Removing 964 lines of service installation code reduces maintenance burden and potential misconfiguration risks.


Verdict

VERDICT: PASS
MESSAGE: Transport change from HTTP to stdio reduces attack surface. No secrets, injection vulnerabilities, or security misconfigurations detected.

Run Details
Property Value
Run ID 20691156528
Triggered by pull_request on 768/merge
Commit 462baa31325212f43beb29b442c51bb0df6416b4

Powered by AI Quality Gate workflow

@diffray diffray Bot added diffray-review-completed diffray review status: completed and removed diffray-review-started diffray review status: started labels Jan 4, 2026
@rjmurillo-bot rjmurillo-bot enabled auto-merge (squash) January 4, 2026 09:33
@rjmurillo rjmurillo added the triage:approved Human has triaged and approved bot responses for this PR label Jan 4, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Comment thread .agents/sessions/2026-01-04-session-306-mcp-forgetful-stdio-pr.md Outdated
Per SESSION-PROTOCOL.md requirement and PR review feedback, update
Session End checklist to use proper table format with commit SHA
evidence.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@diffray diffray Bot added the diffray-review-failed diffray review status: failed label Jan 4, 2026
Per analyst agent CI review, update MCP server documentation to remove
HTTP references now that upstream issue #19 is fixed. Forgetful now
uses stdio transport with uvx for automatic installation.

Resolves analyst CRITICAL_FAIL verdict.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@diffray diffray Bot added diffray-review-started diffray review status: started and removed diffray-review-completed diffray review status: completed diffray-review-failed diffray review status: failed labels Jan 4, 2026
@rjmurillo-bot

Copy link
Copy Markdown
Collaborator Author

Reverted in commit e8d8081 - keeping PR focused on MCP transport change only.

Thread: research.md ultrathink placement (PRRT_kwDOQoWRls5n8O18)
Thread: memory-documentary.md ultrathink placement (PRRT_kwDOQoWRls5n8O2F)

Both files reverted to original formatting to avoid scope creep.

@rjmurillo-bot

Copy link
Copy Markdown
Collaborator Author

Clarified in commit e8d8081 - session log now explicitly states that after creating the branch from commit d10dc63, a separate HTTP cleanup commit was added.

Thread: session log documentation clarity (PRRT_kwDOQoWRls5n8O2I)

@diffray

diffray Bot commented Jan 4, 2026

Copy link
Copy Markdown

Changes Summary

Migrates Forgetful MCP server from HTTP to stdio transport following upstream fix of FastMCP banner corruption issue. Removes 964 lines of HTTP-specific infrastructure (install scripts, health checks) and simplifies setup to use uvx automatic lifecycle management. Updates documentation across CLAUDE.md, CONTRIBUTING.md, and copilot-instructions.md to reflect the new stdio configuration.

Type: mixed

Components Affected: MCP server configuration, Forgetful setup infrastructure, Documentation, CI/CD GitHub Actions, Slash commands

Files Changed
File Summary Change Impact
/tmp/workspace/.mcp.json Changed Forgetful server from HTTP (localhost:8020/mcp) to stdio transport using uvx command ✏️ 🔴
/tmp/workspace/CLAUDE.md Updated MCP server table and verification instructions to reflect stdio transport, removed HTTP health check references ✏️ 🟡
/tmp/workspace/CONTRIBUTING.md Replaced 121 lines of HTTP setup instructions (systemd, Task Scheduler) with 23 lines of stdio setup using uvx ✏️ 🟡
/tmp/workspace/.github/copilot-instructions.md Updated Forgetful transport documentation from HTTP to stdio, removed manual service setup instructions ✏️ 🟢
...ace/.github/workflows/slash-command-quality.yml Pinned GitHub Actions to full commit SHAs for security (actions/checkout, dorny/paths-filter, actions/setup-node) ✏️ 🟡
...orkspace/.claude/commands/memory-documentary.md Updated allowed-tools to reference mcp__forgetful__* with stdio transport ✏️ 🟢
/tmp/workspace/.claude/commands/research.md Updated allowed-tools to reference mcp__forgetful__* with stdio transport ✏️ 🟢
...026-01-04-session-306-mcp-forgetful-stdio-pr.md Session log documenting the PR creation and changes across 5 commits ✏️ 🟢
Architecture Impact
  • Dependencies: removed: HTTP server infrastructure for Forgetful (964 lines), removed: systemd service configuration, removed: Windows Task Scheduler setup, removed: health check scripts, added: stdio transport with uvx automatic lifecycle
  • Coupling: Significantly reduced coupling by removing manual service management infrastructure. Forgetful now relies on uvx for automatic installation and lifecycle management, eliminating platform-specific setup scripts and health monitoring code.
  • Breaking Changes: Users with existing HTTP-based Forgetful setup must migrate to stdio transport, .mcp.json configuration format changed from HTTP URL to stdio command, Health check scripts (Test-ForgetfulHealth.ps1) removed - users must use uvx/PATH verification instead

Risk Areas: Breaking change for existing users running Forgetful HTTP service, Dependency on upstream fix (issue #19) being stable, Users without uvx in PATH will experience connection failures, No migration guide for users transitioning from HTTP to stdio, GitHub Actions SHA pinning changes workflow trust chain

Suggestions
  • Consider adding migration documentation for users transitioning from HTTP setup
  • Add troubleshooting section for uvx PATH issues
  • Verify upstream FastMCP fix remains stable in production use
  • Consider adding CI test to verify Forgetful stdio transport works
  • Document rollback procedure if stdio transport proves unstable

🔗 See progress

Full review in progress... | Powered by diffray

Restructure session-306-mcp-forgetful-stdio-pr.md to comply with
SESSION-PROTOCOL.md template requirements:

- Add Session Info section with date, branch, starting commit
- Add Protocol Compliance section with proper table structure
- Add Work Log section with task details
- Add Skill Inventory and Git State subsections
- Add all required Session End checklist items

Fixes session protocol validation failure.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings January 4, 2026 09:55
@github-actions

github-actions Bot commented Jan 4, 2026

Copy link
Copy Markdown
Contributor

Session Protocol Compliance Report

Tip

Overall Verdict: PASS

All session protocol requirements satisfied.

What is Session Protocol?

Session logs document agent work sessions and must comply with RFC 2119 requirements:

  • MUST: Required for compliance (blocking failures)
  • SHOULD: Recommended practices (warnings)
  • MAY: Optional enhancements

See .agents/SESSION-PROTOCOL.md for full specification.

Compliance Summary

Session File Verdict MUST Failures
2026-01-04-session-306-mcp-forgetful-stdio-pr.md ✅ COMPLIANT 0

Detailed Validation Results

Click each session to see the complete validation report with specific requirement failures.

📄 2026-01-04-session-306-mcp-forgetful-stdio-pr

Session Protocol Validation Report

Date: 2026-01-04 09:55
RFC 2119: MUST = error, SHOULD = warning

Session: 2026-01-04-session-306-mcp-forgetful-stdio-pr.md

Status: PASSED

Validation Results

Check Level Status Issues
MustRequirements MUST PASS -
ShouldRequirements SHOULD PASS -
ProtocolComplianceSection MUST PASS -
SessionLogExists MUST PASS -
SessionLogCompleteness SHOULD PASS -
HandoffUpdated MUST PASS -
CommitEvidence MUST PASS -

✨ Zero-Token Validation

This validation uses deterministic PowerShell script analysis instead of AI:

  • Zero tokens consumed (previously 300K-900K per debug cycle)
  • Instant feedback - see exact failures in this summary
  • No artifact downloads needed to diagnose issues
  • 10x-100x faster debugging

Powered by Validate-SessionProtocol.ps1

📊 Run Details
Property Value
Run ID 20691156532
Files Checked 1
Validation Method Deterministic script analysis

Powered by Session Protocol Validator workflow

@coderabbitai

coderabbitai Bot commented Jan 4, 2026

Copy link
Copy Markdown

Caution

Review failed

The head commit changed during the review from 4aa5118 to ba22bed.

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch feat/mcp-forgetful-stdio

Comment @coderabbitai help to get the list of available commands and usage tips.

@rjmurillo-bot rjmurillo-bot merged commit f2d36ca into main Jan 4, 2026
51 of 54 checks passed
@rjmurillo-bot rjmurillo-bot deleted the feat/mcp-forgetful-stdio branch January 4, 2026 09:57
Comment thread CONTRIBUTING.md
| `tasklist /FI "IMAGENAME eq python*"` | Check if running |
| `taskkill /IM python.exe /F` | Stop server |
```powershell
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM - Piping Invoke-WebRequest output directly to Invoke-Expression
Agent: security

Category: security

Description:
The Windows installation instructions use irm ... | iex (Invoke-RestMethod piped to Invoke-Expression), which executes arbitrary code from the internet with -ExecutionPolicy ByPass. While this is standard uv installer documentation, it poses a supply chain risk.

Suggestion:
Recommend a two-step process: (1) Download the script: Invoke-WebRequest -Uri 'https://astral.sh/uv/install.ps1' -OutFile 'install.ps1', (2) Review the script, (3) Execute with appropriate execution policy. Consider recommending winget or scoop package managers as safer alternatives.

Confidence: 70%
Rule: sec_secrets_scan
Review ID: 97bb6d23-821d-460b-8578-7a444fef8a54
Rate it 👍 or 👎 to improve future reviews | Powered by diffray

Comment thread .mcp.json
Comment on lines 23 to 29
"forgetful": {
"type": "http",
"url": "http://localhost:8020/mcp"
"type": "stdio",
"command": "uvx",
"args": [
"forgetful-ai"
]
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 HIGH - MCP server uses uvx to execute arbitrary packages without pinning
Agent: security

Category: security

Description:
The Forgetful MCP server configuration uses uvx forgetful-ai without pinning to a specific version. This means every time the MCP server starts, it could download and execute a different version. Compare to serena which is pinned to a git repository.

Suggestion:
Pin to a specific version: "args": ["forgetful-ai==X.Y.Z"] where X.Y.Z is a known good version, or use --from git+https://github.com/ScottRBK/forgetful@<commit-sha> to pin to a specific commit like the Serena configuration does.

Confidence: 90%
Rule: cicd_unpinned_action_version
Review ID: 97bb6d23-821d-460b-8578-7a444fef8a54
Rate it 👍 or 👎 to improve future reviews | Powered by diffray

@diffray

diffray Bot commented Jan 4, 2026

Copy link
Copy Markdown

Review Summary

Validated 4 issues: 3 kept, 1 filtered (speculative/weak evidence)

Issues Found: 3

💬 See 2 individual line comment(s) for details.

📊 2 unique issue type(s) across 3 location(s)

📋 Full issue list (click to expand)

🟠 HIGH - MCP server uses uvx to execute arbitrary packages without pinning

Agent: security

Category: security

File: .mcp.json:23-29

Description: The Forgetful MCP server configuration uses uvx forgetful-ai without pinning to a specific version. This means every time the MCP server starts, it could download and execute a different version. Compare to serena which is pinned to a git repository.

Suggestion: Pin to a specific version: "args": ["forgetful-ai==X.Y.Z"] where X.Y.Z is a known good version, or use --from git+https://github.com/ScottRBK/forgetful@<commit-sha> to pin to a specific commit like the Serena configuration does.

Confidence: 90%

Rule: cicd_unpinned_action_version


🟡 MEDIUM - Piping Invoke-WebRequest output directly to Invoke-Expression (2 occurrences)

Agent: security

Category: security

📍 View all locations
File Description Suggestion Confidence
CONTRIBUTING.md:418 The Windows installation instructions use irm ... | iex (Invoke-RestMethod piped to Invoke-Expres... Recommend a two-step process: (1) Download the script: `Invoke-WebRequest -Uri 'https://astral.sh/uv... 70%
CONTRIBUTING.md:464 The 'One-Command Install' option for Claude Router uses curl -sSL ... | bash, executing code from... Consider reordering options to emphasize safer alternatives first, or add a note about reviewing scr... 65%

Rule: sec_secrets_scan


ℹ️ 1 issue(s) outside PR diff (click to expand)

These issues were found in lines not modified in this PR.

🟡 MEDIUM - Claude Router installation uses curl | bash without verification

Agent: security

Category: security

File: CONTRIBUTING.md:464

Description: The 'One-Command Install' option for Claude Router uses curl -sSL ... | bash, executing code from a GitHub repository without verification. The documentation already provides safer alternatives (Option 1: Plugin Marketplace, Option 3: Manual Install).

Suggestion: Consider reordering options to emphasize safer alternatives first, or add a note about reviewing script contents before execution.

Confidence: 65%

Rule: sec_secrets_scan


🔗 View full review details


Review ID: 97bb6d23-821d-460b-8578-7a444fef8a54
Rate it 👍 or 👎 to improve future reviews | Powered by diffray

@diffray diffray Bot added diffray-review-completed diffray review status: completed and removed diffray-review-started diffray review status: started labels Jan 4, 2026
rjmurillo-bot added a commit that referenced this pull request Jan 4, 2026
Work completed:
- PR #768: MERGED (session log fix from previous cycle)
- PR #566: Auto-merge enabled, blocked by CodeRabbit
- PR #745: CLOSED as obsolete (HTTP scripts deleted)
- PR #757: Fixed title, auto-merge enabled

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
rjmurillo-bot added a commit that referenced this pull request Jan 4, 2026
Work completed:
- PR #768: MERGED (session log fix from previous cycle)
- PR #566: Auto-merge enabled, blocked by CodeRabbit
- PR #745: CLOSED as obsolete (HTTP scripts deleted)
- PR #757: Fixed title, auto-merge enabled

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: rjmurillo[bot] <rjmurillo-bot@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
rjmurillo-bot added a commit that referenced this pull request Jan 4, 2026
Work completed:
- PR #768: MERGED (session log fix from previous cycle)
- PR #566: Auto-merge enabled, blocked by CodeRabbit
- PR #745: CLOSED as obsolete (HTTP scripts deleted)
- PR #757: Fixed title, auto-merge enabled

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@rjmurillo rjmurillo mentioned this pull request Jan 4, 2026
21 tasks
rjmurillo-bot added a commit that referenced this pull request Jan 4, 2026
Autonomous PR monitoring and review session:

## PRs Processed (6 total)

**Completed**:
- PR #566: Auto-merge enabled, all criteria passed
- PR #744: Comprehensive review posted (HTTP/stdio conflict)
- PR #764: Acknowledged CHANGES_REQUESTED status
- PR #765: Acknowledged investigation PR (title format note)
- PR #766: Acknowledged WIP with conflicts

**In Progress**:
- PR #771: Awaiting CI completion (2 pending, 17 passed)

## Key Findings

1. PR #744 modifies HTTP code removed in PR #768 (Forgetful stdio migration)
2. Multi-agent review toolkit execution (5 agents: code-reviewer, silent-failure-hunter, pr-test-analyzer, git history, previous PRs)
3. Code-review skill execution with 8-step workflow
4. Stewardship classification (owned vs non-owned) determines action scope

## Session Metrics

- Execution: Fully autonomous (no user intervention)
- Review comments posted: 5
- Worktrees created: 1
- PRs blocked on external dependencies: 1

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@rjmurillo rjmurillo added this to the 0.2.0 milestone Jan 9, 2026
rjmurillo-bot pushed a commit that referenced this pull request Jan 11, 2026
- Fix regex pattern for section replacement (remove \n before ##)
- Update commit message format to use multiple -m flags
- Add comment explaining BOT_PAT triggers workflows
- Update checkout action from SHA to @v4
- Fix issue number reference (#234 instead of #768)
- Add comment explaining cross-author review test scenario
- Document trend calculation with thresholds and examples
- Document pagination limitation (50 comments/thread)
- Add test case for dependabot self-comment exclusion
- Reply to 3 deferred threads (thin workflow, exit codes, GraphQL injection)

All 12 threads resolved via GraphQL.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
rjmurillo added a commit that referenced this pull request Jan 11, 2026
* Initial plan

* feat(stats): add automated daily reviewer signal statistics

- Create scripts/Update-ReviewerSignalStats.ps1 for aggregating PR review comment statistics
- Create .github/workflows/update-reviewer-stats.yml for daily scheduled execution
- Create scripts/tests/Update-ReviewerSignalStats.Tests.ps1 with 26 passing tests
- Create .agents/stats/ directory for JSON output
- Create session log for protocol compliance

Closes #768

* chore: address code review feedback

- Add comment explaining [double] cast requirement for Math.Max/Min
- Document pagination limit (50 pages / 2500 PRs) in help text
- Update session log with commit evidence

* refactor: address PR review feedback

- Move test file from scripts/tests/ to tests/ directory
- Fix ExcludedAuthors logic: now correctly allows cross-author reviews
  (e.g., rjmurillo can review rjmurillo-bot PRs and vice versa)
- Add score documentation with range explanation (0.0-1.0)
- Use GitHubCore module when available for rate limiting/repo info
- Remove timestamp update from memory (git tracks modifications)
- Update workflow to use BOT_PAT and gh auth setup-git
- Update tests to match new parameter names

Co-authored-by: rjmurillo <6811113+rjmurillo@users.noreply.github.com>

* refactor: remove JSON output, update Serena memory directly

- Remove Export-StatsJson function and -OutputPath parameter (YAGNI)
- Remove -UpdateMemory switch (memory update is now always performed)
- Update Update-SerenaMemory to write computed stats to the memory file
- Remove .agents/stats/ directory (no longer needed)
- Update workflow to commit only the Serena memory file
- Update tests for new function signatures

The Serena memory file is now the single source of truth for reviewer
signal quality data, eliminating duplicate data storage.

Addresses review feedback to simplify output and use memory file as
source of truth.

Co-authored-by: rjmurillo <6811113+rjmurillo@users.noreply.github.com>

* fix: correct regex pattern for section replacement

Fix lookahead pattern to properly match next level-2 heading or end of file.

Co-authored-by: rjmurillo <6811113+rjmurillo@users.noreply.github.com>

* fix: remove dead code and fix markdown table formatting

- Remove unreachable dead code at line 414 (cursor[bot] #2659707604)
  Line 411 already continues if commentAuthor equals prAuthor,
  making line 414's redundant check impossible to reach
- Fix markdown table formatting by adding newline between header
  and data rows (cursor[bot] #2659707606)

All 25 Pester tests passing.

Comment-IDs: 2659707604, 2659707606

* docs(pr-764): add PR comment response session log

Session log for PR #764 comment response workflow.

- Fixed 2 cursor[bot] bugs (dead code, markdown table)
- Delegated 22 remaining threads to orchestrator
- Batch 1 replies posted (10 threads)
- Session artifacts created for continuation

Commit: f34b575

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix(pr-764): address 12 review comments with code improvements

- Fix regex pattern for section replacement (remove \n before ##)
- Update commit message format to use multiple -m flags
- Add comment explaining BOT_PAT triggers workflows
- Update checkout action from SHA to @v4
- Fix issue number reference (#234 instead of #768)
- Add comment explaining cross-author review test scenario
- Document trend calculation with thresholds and examples
- Document pagination limitation (50 comments/thread)
- Add test case for dependabot self-comment exclusion
- Reply to 3 deferred threads (thin workflow, exit codes, GraphQL injection)

All 12 threads resolved via GraphQL.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* docs(session): complete session 309 with outcomes

Session 309 continuation successfully addressed all 12 remaining PR #764 review threads.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* chore(stats): update reviewer signal statistics

Automated update of reviewer statistics from last 7 days:
- 151 PRs analyzed
- 9 reviewers tracked
- 1504 total comments

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* docs(session-309): update final verification status

- All 31 review threads resolved (verified via GraphQL)
- CI: 21/21 checks passing, 0 failures
- Rebased and pushed cf55de9
- Awaiting owner approval to unblock merge

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: use SHA for actions/checkout instead of version tag

Use SHA 34e114876b0b11c390a56381ad16ebd13914f8d5 for actions/checkout
to maintain consistency with other workflows and follow security best
practices for pinning action versions.

Co-authored-by: rjmurillo <6811113+rjmurillo@users.noreply.github.com>

* refactor: change default analysis window to 28 days

Update DaysBack default from 90 to 28 days for a rolling 28-day window:
- Script parameter default changed to 28
- Workflow input default changed to 28
- Memory file description updated to reflect 28-day window
- Test description updated to match new default

Co-authored-by: rjmurillo <6811113+rjmurillo@users.noreply.github.com>

* docs(sessions): complete protocol compliance for migrated JSON sessions

Fix session protocol validation failures for sessions 308 and 309 by
populating protocol compliance fields with actual evidence from session
work.

Session 308: Initial PR #764 review (cursor[bot] fixes, partial)
Session 309: Complete PR #764 review response (31 threads resolved)

All MUST requirements now satisfied with evidence. SHOULD requirements
marked complete where applicable or N/A with justification.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* chore(sessions): remove obsolete markdown session files

Remove markdown session files that were migrated to JSON format. The JSON
versions (.json) are now the source of truth and pass validation.

Markdown files were causing CI validation failures as they don't follow
the current JSON-based session protocol.

Migrated files:
- 2026-01-04-session-308-pr-764.md → .json (commit b676100)
- 2026-01-11-session-309-pr-764-review.md → .json (commit b676100)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* docs(session): document PR #764 gh act testing procedure

Documented testing procedure for Update Reviewer Signal Stats workflow:
- gh act dry run validation (all steps verified)
- Local script execution (152 PRs, 9 reviewers, 12.6s)
- Output verification (Serena memory updated correctly)
- Limitations noted (act docker image lacks PowerShell)
- PR approved and set to auto-merge

Session 823
Related: #764

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(session-823): correct protocol compliance evidence for inherited context

Fix session validation failures by properly documenting that session 823
was a continuation of the pr-comment-responder session context where Serena
activation and memory loading had already occurred.

Changes:
- Mark serenaActivated/serenaInstructions as complete (inherited from parent)
- Mark usageMandatoryRead/constraintsRead as complete (loaded in parent)
- Mark serenaMemoryUpdated as complete (updated in parent session)
- Mark qaRoutedIfFeature as complete with ADR-034 investigation-only skip

This was a testing session that only staged `.agents/sessions/` files,
qualifying for investigation-only QA exemption per ADR-034.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: rjmurillo <6811113+rjmurillo@users.noreply.github.com>
Co-authored-by: rjmurillo[bot] <rjmurillo-bot@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Richard Murillo <richard.murillo@example.com>
@rjmurillo-bot rjmurillo-bot review requested due to automatic review settings March 23, 2026 23:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-workflows GitHub Actions workflows automation Automated workflows and processes diffray-review-completed diffray review status: completed enhancement New feature or request github-actions GitHub Actions workflow updates triage:approved Human has triaged and approved bot responses for this PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants