You’re viewing Paradaux’s public workspaceSign in to vote and comment Get taskl.ie for your team

PAR-188

Loading issues

PAR-188 · Remove/guard destructive hard-delete (MCP tesks_delete_task) · Paradaux · taskl.ie

PAR-188

Remove/guard destructive hard-delete (MCP tesks_delete_task)

Product rule: deleting issues should not be supported via the agent surface, and destructive delete must be admin-restricted everywhere.

tesks_delete_task (mcp/TaskMcpTools.java:229-241) is fully exposed and unguarded — does an irreversible hard DELETE (PostgresTaskSystem.deleteTask ~540). The TriageService DELETE action (~230-236) likewise. Remove the MCP delete tool (or hard-gate behind an explicit admin permission + disable for the Discord triage path).
Consider replacing hard-delete with archive/soft-delete (archived_at already exists in the schema) so deletes are recoverable; reserve true hard-delete for admins only.
UI delete should be manage-gated (tracked in the UI RBAC issue) and ideally route to archive by default.

Acceptance: no agent/MCP path can hard-delete; any retained delete is admin-only and ideally a soft archive.

Activity

tesks created the issue Jun 15
tesksJun 15
Code-complete (pending commit). Removed deletion from both agent surfaces:
- MCP: dropped tesks_delete_task from TaskMcpTools.all() and removed the tool method — agents can no longer hard-delete.
- Discord triage: applyDelete now refuses ("set status to Done/Cancelled"), DELETE removed from the prompt/JSON action set and from isMutating.
Backend TaskSystem.deleteTask is retained (now tenant-scoped via PAR-183) for the future admin-gated UI path — see PAR-187. Updated TriageApplyTest.deleteViaTriageIsRefusedAndIssueSurvives to assert refusal + survival. Full suite green.

Open decision (carried to the checkpoint): whether UI/admin delete should become a soft-archive (archived_at exists) with hard-delete reserved for owners, vs. keeping hard-delete admin-only.
tesks set status to Pending Release Jun 15
tesksJun 15
Soft-archive backend landed with the RBAC work (commit c7d4aa0): TaskSystem.archiveTask sets archived_at + logs an archived event, archived issues are excluded from list/search, and the REST DELETE /issues/{ref} now archives (gated on issue.delete) rather than hard-deleting. Hard-destroy (issue.destroy) remains owner-only and currently has no REST endpoint — a future owner-only "permanently delete" action. UI archive/restore UX is part of PAR-187.
ParadauxIO linked a commit: Commit 130c274 — Remove issue deletion from the agent surfaces (PAR-188) Jun 16
tesksJun 16
Verified already implemented — acceptance met, no code change needed:
- MCP: tesks_delete_task is gone — not defined in TaskMcpTools and not in all() (consistent with the tool no longer being exposed to clients). No agent/MCP hard-delete path.
- Discord triage: TriageService.applyDelete refuses — returns "I can't delete issues — set the status to Done/Cancelled to close it." So the assistant can't delete.
- REST DELETE /issues/{ref}: gated on ISSUE_DELETE and routes to archiveTask (recoverable soft-archive via archived_at), not hard delete.
- Hard PostgresTaskSystem.deleteTask: has no production caller — it's wired to no endpoint or agent path (only exercised by tests). ISSUE_DESTROY (owner-only) is defined but no controller uses it yet, so there is currently no hard-destroy path exposed at all — even safer than the "admin-only" target.
Acceptance ("no agent/MCP path can hard-delete; any retained delete is admin-only and ideally a soft archive") satisfied.
tesks set status to Done Jun 16
ParadauxIO linked a commit: Commit 130c274 — Remove issue deletion from the agent surfaces (PAR-188) Oct 13

Sign in to comment

Join the conversation, react to comments and vote on this issue.