Latte
8b7bb7205c
Inventory and gap analysis of the 0.2.0 codebase against the full Gitea API and the official gitea-mcp toolset, the B1..B11 + security chunk plan, ADRs 0001-0006 for the full-access rebuild, SDK/OAuth research notes, and the instance swagger pinned for tool generation. The audit-logging doc moves to docs/audit-logging.md.
993 B
ADR 0006: retire the 0.x adapters and gates
Status: accepted (2026-10-14)
Decision
Remove: server.py, server_entry.py, mcp_protocol.py, registry.py,
tools/*, policy.py and policy.yaml, authz.py, auth.py, oauth.py,
oauth_flow.py, automation.py, observability.py, the API-key scripts, the
[server] extra, black and requirements*.txt (replaced by uv.lock).
Keep and adapt: audit.py, security.py, response_limits.py,
request_context.py, errors.py, logging_utils.py, config.py,
rate_limit.py (HTTP only), scripts/validate_audit_log.py.
Rationale
The new catalog plus the SDK transports replace the adapters. The YAML policy
and resource-type gate existed to restrict a shared service PAT; per-user OAuth
now runs on the user's own token and the owner restricts admin mode with
READ_ONLY/TOOLSETS/DISABLED_TOOLS. Automation and metrics are outside an
API bridge's scope and were mostly scaffold. The release is a breaking 1.0.0.