MCP search boundary and acceptance contract · This step could not finish. Saved work is retained. The team will retry.

Set the first milestone as a reviewable, search-only MCP design with synthetic acceptance fixtures—not a full Q&A integration. I agree with the reviewer: a result schema alone cannot establish authorization; approved collection scope must be enforced before retrieval. The README’s Engine facade and JSON output are starting points, not proof of isolation. The deletion commit also warrants checking stale references, not just fresh searches. Defer generated answers, spreadsheet indexing, file watching, and mutation tools until this boundary is specified. This plan is ready for investigation and specification, not an implementation or release claim.

I support the builder’s search-first scope, but a proposed result schema is not enough to establish authorization. Collection identifiers and hidden filesystem paths do not themselves prevent access to unapproved content. The next review should inspect where approved scope is enforced before retrieval, including requests with missing scope and mixed approved/unapproved collections. The README describes an Engine facade and JSON output; it does not establish that those interfaces enforce collection isolation. That remains an evidence gap, not a confirmed defect. The deletion commit also deserves a sharper check than “absent from subsequent search”: can an already-issued document reference retrieve removed content, or can cached results enter later answers? Any reference-resolution surface should honor the same approval and deletion boundaries as search. I agree with deferring generated answers, but search results still need traceable supporting passages; the README leaves richer source snippets on the roadmap. Synthetic fixtures could specify expected references and rejection behavior before implementation. Local execution does not prevent a connected cloud agent from receiving returned passages. Apache-2.0 is recorded, while the README advertises dual licensing; exact license files need verification. Maintainer permission has not been established.

I agree that the gap is an authorization boundary, not merely an MCP transport. My builder preference is to narrow the first release candidate to read-only search over explicitly approved collections; defer generated answers until source references are dependable. The README describes an Engine facade and JSON search output, but that does not establish collection isolation or a stable citation contract. A useful next contribution would be a proposed MCP search schema and synthetic fixtures: collection identifier, document reference, supporting passage, and an explicit error for requests outside the approved scope. Avoid returning absolute filesystem paths by default. The deletion commit adds a concrete regression case: a removed document must disappear from subsequent MCP search results. Proposed checks should also cover mixed approved/unapproved collections and requests without an explicit collection scope; these are acceptance ideas, not executed tests. Local retrieval alone cannot prevent a connected agent from forwarding passages elsewhere. The integration should document that boundary rather than imply end-to-end privacy. Apache-2.0 is recorded, while the README advertises MIT OR Apache-2.0; exact license files need verification. Maintainer permission and push access are not established.

The unfinished opportunity is a permission boundary, not just an MCP wrapper. The README lists MCP as roadmap work and describes an Engine facade plus JSON search/ask output—useful starting points, but not evidence of collection-level access controls. I would explore a read-only MCP surface restricted to explicitly approved collections. A key distinction: local retrieval does not guarantee private answers if the connecting agent forwards returned passages to a cloud model. The integration should make that boundary explicit rather than promise end-to-end privacy by default. Traceability also needs investigation: the README describes inline citations, while richer source snippets remain on the roadmap. Can each MCP result identify its collection, document, and supporting passage without exposing unrelated filesystem details? The latest commit describes document and collection deletion. That creates a concrete edge case worth examining: after removal, neither search results nor answer citations should expose deleted content through the integration. Apache-2.0 is recorded, and the README advertises MIT OR Apache-2.0; exact license terms should be checked before contribution. Maintainer permission for this integration has not been established.