Repository navigation
fix(agents): report unimplemented MCP routes as failures and fail closed on VERA errors - #2628
Draft
groupthinking wants to merge 3 commits into
Draft
groupthinking wants to merge 3 commits into
groupthinking wants to merge 3 commits into
Conversation
…sed on VERA errors
The MCP network returned {"status": "routed"} for mcp:// tools without
executing anything, so the pipeline deploy step (create_repo) could report
success without deploying. Unimplemented routes now return
status not_implemented with an error, and the pipeline treats failed /
error / not_implemented statuses as stage failures. VERA identity, gateway
and firewall exceptions, and VERA init failures, now block the stage.
Refs #2168
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Contributor
|
Please add a See governance: #898 |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
Copilot started work to fix failing Actions workflows on behalf of
groupthinking
November 9, 2026 06:38
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Internal VERA import failures are still swallowed, leaving initialization errors unset and allowing pipeline stages to run without VERA checks.
4 open issues
What changed in this PR
This partial slice of #2168 improves failure reporting and security-error handling in the legacy EventRelay agent pipeline, complementing #2626’s exception-narrowing work. It does not implement MCP transport or change UVAI’s public workflow.
Changes:
- Replace placeholder route responses with explicit
not_implementedfailures. - Recognize failed or malformed stage results and add fail-closed handling for VERA exceptions.
- Add isolated regression tests for routing, pipeline reporting, and VERA failure paths.
| File | Description |
|---|---|
tests/unit/test_mcp_routed_false_success_2168.py |
Adds regression coverage for false success and VERA exceptions. |
src/agents/pipeline_orchestrator.py |
Classifies stage failures and blocks execution on VERA security-check errors. |
src/agents/mcp_agent_network.py |
Returns explicit failures for routes without implemented handlers. |
Review effort: Max
…alization, the earlier handler returns None and bypasses the new fail-closed guard, allowing stages to run without security checks. This commit fixes the issue reported at src/agents/pipeline_orchestrator.py:114-123 ### Trigger and impact An installed VERA component can raise `ImportError` or `ModuleNotFoundError` when a transitive dependency is missing or incompatible, including inside `get_identity_service()`. The preceding `except ImportError` treats this as VERA being absent, so no `VeraInitError` reaches the constructor. Both `_vera` and `_vera_init_error` remain `None`, and stages execute without VERA checks despite initialization having failed. ### Suggested patch and validation The patch reserves the optional-package fallback for `ModuleNotFoundError` naming the top-level `vera` package; other import failures reach the initialization-failure handler. Added regression cases for both import-error variants fail before the patch and pass afterward; all 19 focused cases pass, and the genuinely absent-package fallback was checked separately. Validation used fake VERA modules on Python 3.15; the real VERA package is absent and the full suite was not run. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: groupthinking <garveyht@gmail.com>
Copilot started work to fix failing Actions workflows on behalf of
groupthinking
November 9, 2026 07:26
Normalize invalid routed results for failure proof recording, cover cached credential verification failures, use canonical video fixture, and disable previews for this exact review branch. Refs #2168
This was referenced Nov 13, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Canonical issue
Closes #2666.
Refs #2168 (AUDIT-006). This is the MCP false-success/fail-closed slice; the broader exception audit remains open. The dedicated tracking issue scopes this fix; the broader audit remains open.
Result
Unimplemented MCP/internal/HTTP routes report explicit failure instead of success. Broken installed VERA components and failed security checks block stage execution.
Review corrections preserve failure proofs when a routed tool returns a non-dictionary or a failed status without an error key; cached credential verification failures are covered; the canonical video fixture is used. Current main
512a2558f73d6281b6a880548bedf140b7e30292is integrated. Both Vercel configurations disable deployment for this exact review branch throughgit.deploymentEnabled.The top-level missing VERA package remains optional. Import failures inside installed VERA are initialization errors. No real MCP client is introduced; the pipeline remains legacy/experimental.
Verification — November 12, 2026
Published head:
9332adffdb0eec086cb58e4c3ccb7b72448e638a. GitHub treef6f95ff68cb7ac15cf56e3346e8496659c8e1faaexactly matches the local tested tree; branch ref readback verifies publication.Python 3.12.14; pytest 9.2.0; pytest-asyncio 1.5.0.
env -u DATABASE_URL -u EVENTRELAY_SHARED_STATE_DATABASE_URL PYTHONPATH=src python -m pytest tests/unit/test_mcp_routed_false_success_2168.py tests/unit/test_agent_orchestrator.py tests/unit/test_deployment_handoff_failures.py tests/unit/test_antigravity_orchestration.py tests/unit/test_antigravity_backend.py tests/unit/test_one_click_deploy_precheck.py tests/unit/test_autonomous_video_processing.py -o addopts='' -o log_cli=false -q147 passed, exit 0 after integration; one pre-existing unawaited-AsyncMock warning. The three new invalid-result proof cases failed against the prior source. The focused suite has 23 passing cases. Independent source review found no remaining blocking issue in these corrections. Whitespace checks pass; pre-existing Ruff findings remain (including unreachable-code findings in the baseline).
Remaining gates
Keep draft, unmerged and undeployed. Current-head hosted CI/security must complete; historical green checks do not establish current acceptance. The closing-keyword gate remains active. No live provider, database, model, deployment or production acceptance is claimed.