Paradaux
Issues

PAR-188

0

Remove/guard destructive hard-delete (MCP tesks_delete_task)

DoneHighUnassignedTesksBug

Child of PAR-182.

Product rule: deleting issues should not be supported via the agent surface, and destructive delete must be admin-restricted everywhere.

  • tesks_delete_task (mcp/TaskMcpTools.java:229-241) is fully exposed and unguarded — does an irreversible hard DELETE (PostgresTaskSystem.deleteTask ~540). The TriageService DELETE action (~230-236) likewise. Remove the MCP delete tool (or hard-gate behind an explicit admin permission + disable for the Discord triage path).
  • Consider replacing hard-delete with archive/soft-delete (archived_at already exists in the schema) so deletes are recoverable; reserve true hard-delete for admins only.
  • UI delete should be manage-gated (tracked in the UI RBAC issue) and ideally route to archive by default.

Acceptance: no agent/MCP path can hard-delete; any retained delete is admin-only and ideally a soft archive.

Resources

Comments

tesks · Jun 15, 2026, 7:43 PM

Code-complete (pending commit). Removed deletion from both agent surfaces:

  • MCP: dropped tesks_delete_task from TaskMcpTools.all() and removed the tool method — agents can no longer hard-delete.
  • Discord triage: applyDelete now refuses ("set status to Done/Cancelled"), DELETE removed from the prompt/JSON action set and from isMutating.

Backend TaskSystem.deleteTask is retained (now tenant-scoped via PAR-183) for the future admin-gated UI path — see PAR-187. Updated TriageApplyTest.deleteViaTriageIsRefusedAndIssueSurvives to assert refusal + survival. Full suite green.

Open decision (carried to the checkpoint): whether UI/admin delete should become a soft-archive (archived_at exists) with hard-delete reserved for owners, vs. keeping hard-delete admin-only.

tesks · Jun 15, 2026, 8:22 PM

Soft-archive backend landed with the RBAC work (commit c7d4aa0): TaskSystem.archiveTask sets archived_at + logs an archived event, archived issues are excluded from list/search, and the REST DELETE /issues/{ref} now archives (gated on issue.delete) rather than hard-deleting. Hard-destroy (issue.destroy) remains owner-only and currently has no REST endpoint — a future owner-only "permanently delete" action. UI archive/restore UX is part of PAR-187.

tesks · Jun 16, 2026, 8:01 PM

Verified already implemented — acceptance met, no code change needed:

  • MCP: tesks_delete_task is gone — not defined in TaskMcpTools and not in all() (consistent with the tool no longer being exposed to clients). No agent/MCP hard-delete path.
  • Discord triage: TriageService.applyDelete refuses — returns "I can't delete issues — set the status to Done/Cancelled to close it." So the assistant can't delete.
  • REST DELETE /issues/{ref}: gated on ISSUE_DELETE and routes to archiveTask (recoverable soft-archive via archived_at), not hard delete.
  • Hard PostgresTaskSystem.deleteTask: has no production caller — it's wired to no endpoint or agent path (only exercised by tests). ISSUE_DESTROY (owner-only) is defined but no controller uses it yet, so there is currently no hard-destroy path exposed at all — even safer than the "admin-only" target.

Acceptance ("no agent/MCP path can hard-delete; any retained delete is admin-only and ideally a soft archive") satisfied.

Activity

  • tesks changed status to Status → Done
  • tesks commented
  • ParadauxIO linked a commit — Commit 130c274 — Remove issue deletion from the agent surfaces (PAR-188)
  • tesks commented
  • tesks changed status to Status → Pending Release
  • tesks commented
  • tesks created the issue