Latte
8b7bb7205c
Inventory and gap analysis of the 0.2.0 codebase against the full Gitea API and the official gitea-mcp toolset, the B1..B11 + security chunk plan, ADRs 0001-0006 for the full-access rebuild, SDK/OAuth research notes, and the instance swagger pinned for tool generation. The audit-logging doc moves to docs/audit-logging.md.
23 lines
993 B
Markdown
23 lines
993 B
Markdown
# ADR 0006: retire the 0.x adapters and gates
|
|
|
|
Status: accepted (2026-10-14)
|
|
|
|
## Decision
|
|
|
|
Remove: `server.py`, `server_entry.py`, `mcp_protocol.py`, `registry.py`,
|
|
`tools/*`, `policy.py` and `policy.yaml`, `authz.py`, `auth.py`, `oauth.py`,
|
|
`oauth_flow.py`, `automation.py`, `observability.py`, the API-key scripts, the
|
|
`[server]` extra, black and `requirements*.txt` (replaced by `uv.lock`).
|
|
|
|
Keep and adapt: `audit.py`, `security.py`, `response_limits.py`,
|
|
`request_context.py`, `errors.py`, `logging_utils.py`, `config.py`,
|
|
`rate_limit.py` (HTTP only), `scripts/validate_audit_log.py`.
|
|
|
|
## Rationale
|
|
|
|
The new catalog plus the SDK transports replace the adapters. The YAML policy
|
|
and resource-type gate existed to restrict a shared service PAT; per-user OAuth
|
|
now runs on the user's own token and the owner restricts admin mode with
|
|
`READ_ONLY`/`TOOLSETS`/`DISABLED_TOOLS`. Automation and metrics are outside an
|
|
API bridge's scope and were mostly scaffold. The release is a breaking 1.0.0.
|