README and instructions: 'every write lands on the timeline' is untrue for reminders and letter drafts #11

New issue

Closed

opened 2026-10-01 10:48:03 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-01 10:48:03 +00:00

Owner

Found on 2026-09-29 in a read-only review of postulo-mcp at 0b29e70b9, following each write tool into the core's API at postulo 95348908d.

The README makes attribution the reason writing is acceptable: "Every write lands on the application's timeline with the token's name against it, so you can always see what the agent did and undo it by hand." That holds for add_note and change_status only. add_reminder, complete_reminder and create_cover_letter_draft leave no timeline entry and no record of which token did it.

Where: README.md:108-113, README.md:26-27, src/postulo_mcp/server.py:82-84 (INSTRUCTIONS: "every write appears on their timeline attributed to this token"), src/postulo_mcp/__init__.py:10-12; in the wiki, The-capture-API.md:396-398. In the core: api/routers/reminders.py:45-47 (Reminder.objects.create(...), no event, no actor), api/routers/reminders.py:56 (reminder.complete() only sets done_at), api/routers/documents.py:102 (CoverLetter.objects.create(...), no event, no actor). Only api/routers/applications.py:102, :151 and :176 pass actor_of(request).
What happens: a person starts postulo-mcp --write=reminders,letters, trusting the README. The agent adds reminders, ticks off existing ones and saves letter drafts. None of it appears on a timeline or names the token; a reminder the agent completed just leaves the due list.
Why it matters: the person cannot tell the agent's reminders and letters from their own, and the one promise the README offers as the safeguard for --write does not cover three of its five tools.
Fix: narrow the sentence in README.md, INSTRUCTIONS, the __init__ docstring and the wiki to notes and status changes, and say plainly that reminders and letter drafts carry no record of who made them. If attribution is wanted for those too, that is a core change (an attributed timeline entry when a token adds or completes a reminder tied to an application, and a visible origin on a letter drafted through the API) and should be its own issue on postulo.

Related to #1, whose §2 lists this promise among those that want a test, without noting that it is already untrue for reminders and letters.

Done when

The README, INSTRUCTIONS and the wiki state which writes are attributed, and a test in tests/test_server.py asserts that INSTRUCTIONS no longer claims every write is on the timeline.

Found on 2026-09-29 in a read-only review of postulo-mcp at 0b29e70b9, following each write tool into the core's API at postulo 95348908d. The README makes attribution the reason writing is acceptable: "Every write lands on the application's timeline with the token's name against it, so you can always see what the agent did and undo it by hand." That holds for `add_note` and `change_status` only. `add_reminder`, `complete_reminder` and `create_cover_letter_draft` leave no timeline entry and no record of which token did it. - **Where:** `README.md:108-113`, `README.md:26-27`, `src/postulo_mcp/server.py:82-84` (`INSTRUCTIONS`: "every write appears on their timeline attributed to this token"), `src/postulo_mcp/__init__.py:10-12`; in the wiki, `The-capture-API.md:396-398`. In the core: `api/routers/reminders.py:45-47` (`Reminder.objects.create(...)`, no event, no actor), `api/routers/reminders.py:56` (`reminder.complete()` only sets `done_at`), `api/routers/documents.py:102` (`CoverLetter.objects.create(...)`, no event, no actor). Only `api/routers/applications.py:102`, `:151` and `:176` pass `actor_of(request)`. - **What happens:** a person starts `postulo-mcp --write=reminders,letters`, trusting the README. The agent adds reminders, ticks off existing ones and saves letter drafts. None of it appears on a timeline or names the token; a reminder the agent completed just leaves the due list. - **Why it matters:** the person cannot tell the agent's reminders and letters from their own, and the one promise the README offers as the safeguard for `--write` does not cover three of its five tools. - **Fix:** narrow the sentence in `README.md`, `INSTRUCTIONS`, the `__init__` docstring and the wiki to notes and status changes, and say plainly that reminders and letter drafts carry no record of who made them. If attribution is wanted for those too, that is a core change (an attributed timeline entry when a token adds or completes a reminder tied to an application, and a visible origin on a letter drafted through the API) and should be its own issue on postulo. Related to #1, whose §2 lists this promise among those that want a test, without noting that it is already untrue for reminders and letters. ## Done when - The README, `INSTRUCTIONS` and the wiki state which writes are attributed, and a test in `tests/test_server.py` asserts that `INSTRUCTIONS` no longer claims every write is on the timeline.

tiagoagueda added this to the 0.6.0 milestone

2026-10-01 10:48:03 +00:00

tiagoagueda added the

documentation

label

2026-10-01 10:48:03 +00:00

tiagoagueda referenced this issue

2026-10-19 06:50:42 +00:00

Security review fixes: one fence, honest API calls, a bounded and throttled port, CI that runs #22

tiagoagueda referenced this issue from a pull request that will close it,

2026-11-11 22:58:49 +00:00

Say which writes reach the timeline #26