External chat persistence refuses to attach a message to an existing sessionId owned by another user.Not checked
prod
External MCP calls made while staff impersonation is active continue to receive ordinary tool telemetry but never persist the debugged user's human-readable intent.Not checked
prod
Intent capture persists an external-mcp user summary and assistant tool-call activity in chat_messages, stamps both the thread and message with the external-mcp source, mirrors conversation text to Redis working memory, and posts the activity to the #cedar-chat monitor.Not checked
prod
Each self-identity external MCP call with a non-empty user summary records the model-reported intent before the tool handler runs, including calls that later fail or are rejected.Not checked
prod
Chat and Slack intent persistence runs fire-and-forget so database or monitor failures do not fail or add persistence latency to the MCP tool call.Not checked
prod
Intent captures for the same user execute in arrival order while different users can capture concurrently, and a failed capture does not stall later captures for that user.Not checked
prod
Libra has verdicts on 0 of 12 tracked behaviors on prod; 12 are still being checked. Libra checks hourly for 3 days after each deploy.
Summary
PR #2834 removed the user_request_summary/is_new_request intent-capture fields from every external-MCP tool, reading Manufact's readiness-checklist finding as disqualifying for a required, admittedly-pure-telemetry field ("A tool may request a brief, task-specific user intent field only when it meaningfully improves execution...").
Manufact has since confirmed directly that this pattern is acceptable, so this restores the mechanism exactly as it was before that fix:
INTENT_FIELD_SHAPE, injectIntentFields, and the recordIntent capture branch in tool-call-observability.ts
the recordExternalMcpToolIntent/recordExternalChatMessage/runSerializedPerUser/resolveExternalMcpThreadId chain in chat-message-persistence.ts
the instrumentToolCalls call site + import in server.ts
Only the intent-capture removal is reverted. The other three fixes from PR #2834 are untouched:
reworded, narrower server instructions (server.ts's purposeSentence)
external-only credential/secret redaction from config-read/systems-write schemas (external-capability-redaction.ts, scope-map.ts)
document-write.delete's new approval-ask gate (approval-policy.ts)
Confirmed no overlap by diffing this restoration file-by-file against PR #2834's own diff , external-capability-redaction.ts, scope-map.ts, documentTool.ts, approval-policy.ts, and the document-deletion docs are all untouched here. The three test files shared between fix #2 and fix #3 (flat-args.test.ts, no-bare-user-id-inputs.test.ts, mutating-actions-are-administrable.test.ts, tool-inputschema-size.test.ts) keep fix #2's externalFamilyTools() switch and additionally restore fix #3's injectIntentFields wrapping , both fixes coexist correctly in those files.
Verification
tsc -b clean
pnpm deps:check clean (no dependency violations, 1843 modules cruised)
Scoped vitest across all 11 affected/adjacent test files: 332/332 passing (tool-call-observability.test.ts, chat-message-persistence.test.ts, server.test.ts, flat-args.test.ts, no-bare-user-id-inputs.test.ts, mutating-actions-are-administrable.test.ts, tool-inputschema-size.test.ts, scope-map.test.ts, external-capability-redaction.test.ts, external-mcp.e2e.test.ts, approval.test.ts)
The PR is not safe to merge until existing cached MCP schemas remain callable and free-text intent summaries are prevented from leaking sensitive content to persistence and Slack.
 Cached schemas reject calls ▶
 Intent summaries expose secrets <a hre