[Bug]: octopoda_log_decision context field rejects dict, requires string

[Dvalin21]

The octopoda_log_decision MCP tool has a type mismatch in its context parameter.

The MCP tool definition advertises:
context: "Optional context dict"

But the pydantic validator enforces:
Input should be a valid string [type=string_type]

How to reproduce:

1. Call octopoda_log_decision with context={"key": "value"}
2. Observe: Error executing tool octopoda_log_decision:
   Input should be a valid string

The JSON schema in the tool definition has context listed as:
"anyOf": [{"type": "string"}, {"type": "null"}]

So the schema says string-or-null. But the documentation says "dict".
One of them is wrong. Either:

• The schema should accept object/dict (fix the pydantic model)
• Or the docs should say "JSON string, not a dict" (fix the description)

Current behavior breaks any caller that passes structured data directly.
Workaround: JSON-serialize the context dict to a string before calling.

Environment:
octopoda 3.1.3
synrix_runtime 3.1.0
Linux x86_64

[Dvalin21]

ROOT CAUSE UPDATE with exact file and line numbers.

The function at api/mcp_server.py:787-806:

@mcp.tool()
def octopoda_log_decision(
    agent_id: str, decision: str, reasoning: str, context: str | None = None
) -> dict:
    """Log an agent decision with full audit trail.

    Args:
        agent_id: The agent making the decision
        decision: What was decided ("allow", "deny", or "escalate")
        reasoning: Why this decision was made
        context: Optional JSON string with additional context    <-- LINE 796: docstring says string
    """
    agent = _get_agent(agent_id)
    ctx = _parse_value(context) if context else {}

The Python type hint at line 788 says context: str | None = None (string).
The docstring at line 796 says "Optional JSON string".
The function body at line 799 does _parse_value(context) which expects a string.

So the function AND the docstring BOTH say string. The issue is that the MCP tool
description (advertised to AI agents) or the tool definition template says "Optional context dict".
This mismatch causes AI agents to pass a dict, which fails pydantic validation.

The two fixes needed:

1. Update the MCP tool description/registration to say "JSON string" not "dict"
2. The existing _parse_value() at line 799 already handles both JSON strings and plain strings,
   so the logic side is correct once the schema/doc mismatch is fixed.

[RyjoxTechnologies]

Hey @Dvalin21 huge thanks for the detailed root-cause walkthrough, that level of pinpointing (file + line numbers, schema vs docstring mismatch, repro) made the chase so much easier on our side. Your audit overall has been the single biggest source of improvement to the product over the past two releases genuinely appreciate the rigour.

Quick heads-up on this one specifically: the version in your environment block (octopoda 3.1.3, synrix_runtime 3.1.0) is from before the fix landed. The schema mismatch was closed in 3.1.8 by changing the context annotation from str | None to "dict | str | None" (string forward-ref so older Python's still parse it). I just re-verified against the current PyPI build:

FastMCP-generated JSON Schema for octopoda_log_decision.context in 3.1.13:

{
"anyOf": [
{ "type": "object", "additionalProperties": true },
{ "type": "string" },
{ "type": "null" }
]
}
So calls like octopoda_log_decision(context={"key": "value"}) now pass validation. If you pip install --upgrade octopoda you should be on 3.1.14 (3.1.13 + two same-day patches) and this won't reproduce.

If after the upgrade you still see the validation failure, please reopen with the new version captured — I want to make sure there isn't a second code path I missed.

Also many of your other findings from the May 10 audit have shipped in 3.1.10 → 3.1.14: drift sampler now actually samples (recent_samples climbs on off-goal writes), /cleanup route works, ?purge=true does a real hard delete across 5 namespaces, consolidate() now flags same-key version churn, loop_warning is carried into both inline responses and audit_v2 events when severity is elevated, v1 detector now trips the v2 breaker (severity ≥ orange auto-pauses the agent), agent stall detection has been added, and OCTOPODA_DATA_DIR is honored. There's a live verification script in the repo at audit_verify_3_1_13.py that re-runs your probe scenarios 12/12 of your priority items pass against production now.

The two remaining open items from your report (rename loops/v2/circuit-breaker → billing/budget-cap, add a behavioral breaker with write-rate thresholds beyond cost) are architectural improvements rather than bugs and are on the roadmap.

Thanks again your feedback has been worth real engineering time.

also, happy to upgrade you to our full plan with absolutely 0 restrictions forever, as your help has been insane! I cant thank you enough.

[Dvalin21]

Thank you — that's incredibly generous and I really appreciate it. I'm glad the audit was helpful. I don't currently have a GitHub sponsorship or paid plan set up, so if the unrestricted access is something you can enable on my existing account, I'd be happy to accept. Either way, I'll keep the feedback coming when I find things worth reporting.