# complete_wave_gate [SUPPORT] d2430713 — EXECUTOR GATE: call this AFTER you have actually run a wave's gate action list (push, deploy, wait, run_verification) to unblock the next wave's sprint items. You MUST pass the REAL structured result from run_verification as verification_payload — the server validates it (status=='ok', exit_code==0). A self-report ('I think it passed') or a fabricated payload is rejected with a clear error. On success, writes a wave_gate_results row and returns {gate_completed, wave_label, next_wave_label, next_wave_item_count, next_wave_item_ids, gate_id}. Each wave gate may only be completed once (duplicate calls return an error). Security note: this is a deploy-adjacent gate — only actual run_verification output satisfies it. ed8e4524 — SCOPED TO SPRINT VERSION: pass version (or session_id to auto-resolve the calling session's scope) so two different sprint versions that happen to share the SAME wave_label (e.g. both have a 'wave-2') never satisfy or unblock each other's gate — omit both to keep the exact prior project-wide behavior for a single-version project. Persistent-state disclosure: on hosted Meridian, supplied text and project/session metadata are sent to and stored in Meridian's service; self-hosted deployments keep them in the configured local SQLite/Postgres database. This data is visible in the dashboard/API and later project context or handoffs. Delete individual tasks, notes, or decisions where supported, or delete the project/account using the documented controls. Do not include secrets. Agent View of the PolicyLayer registry record for `complete_wave_gate`. HTML page: https://policylayer.com/tools/io-github-ajc3xc-meridian/complete-wave-gate ## Facts - Tool: `complete_wave_gate` - Server: Meridian (`@meridianmcp/mcp`) — https://policylayer.com/tools/io-github-ajc3xc-meridian.md - Install: `npx -y @meridianmcp/mcp` - Homepage: https://github.com/meridianmcp/Meridian - Risk category: Execute (High risk) - Registry record: grade F, identity unverified - Server auth posture: open - Server CORS policy: * - Server rate-limited: no - Parameters: 7 (2 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `actor` | string | no | Optional session_id or actor name to record who completed the gate. | | `version` | string | no | ed8e4524 — Optional sprint-version bucket this gate belongs to (e.g. 'v0.2.6'). Wins over session_id's resolved scope. Omit (and omit session_id) for the legacy | | `project_id` | string | no | | | `session_id` | string | no | ed8e4524 — Optional: resolve the version scope from this session's own sprint_version (same helper handoff._resolve_session_sprint_version uses for checkpoint) | | `wave_label` | string | yes | The wave whose gate is being completed, e.g. 'wave-1'. Must match the wave field on sprint_items that were just executed. | | `project_name` | string | no | Project name — an alternative to project_id; resolved to the id internally. project_id wins if both are given. | | `verification_payload` | object | yes | The FULL dict returned by run_verification. Must have status='ok' and exit_code=0. Any other value (non-zero exit, error, not_configured, not_connected) is reje | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "complete_wave_gate", "arguments": { "wave_label": "", "verification_payload": {} } } } ``` ## Why complete_wave_gate is rated High This tool triggers and validates completion of external operations (push, deploy, wait, run_verification) and writes gate results to persistent state, unblocking subsequent pipeline waves. It executes and coordinates real external operations and modifies workflow state, placing it firmly in the Execute category with high severity due to its ability to unblock deployment pipelines and trigger downstream actions. From the tool's own definition: "EXECUTOR GATE: call this AFTER you have actually run a wave's gate action list (push, deploy, wait, run_verification) to unblock the next wave's sprint items..." ## Use case AI agents invoke complete_wave_gate to trigger actions in Meridian. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Meridian: ```json { "version": "1", "default": "deny", "tools": { "complete_wave_gate": { "limits": [ { "counter": "complete_wave_gate_rate", "window": "minute", "max": 10, "scope": "grant" } ] } } } ``` ## Other tools on Meridian (174) - `archive_decision` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/archive-decision.md - `batch_mutate` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/batch-mutate.md - `claim_sprint_item` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/claim-sprint-item.md - `clear_capability_profile` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/clear-capability-profile.md - `clone_profile_layer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/clone-profile-layer.md - `delete_custom_hook` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-custom-hook.md - `delete_note` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-note.md - `delete_sprint_item_pointer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-sprint-item-pointer.md - `fan_out_sprint_items` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/fan-out-sprint-items.md - `purge_ai_log` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/purge-ai-log.md - `record_handoff_correction` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/record-handoff-correction.md - `release_docx_region_claims` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/release-docx-region-claims.md - `request_hitl` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/request-hitl.md - `reset_plugin_override` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/reset-plugin-override.md - `reset_profile_layer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/reset-profile-layer.md - `execute_batch` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/execute-batch.md - `prospect_symbol` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/prospect-symbol.md - `run_verification` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/run-verification.md - `start_session` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/start-session.md - `analyze_model_efficiency` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/analyze-model-efficiency.md - `analyze_sprint` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/analyze-sprint.md - `batch_read` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/batch-read.md - `find_outputs_by_source` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-outputs-by-source.md - `find_similar_equation` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-similar-equation.md - `find_similar_figure` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-similar-figure.md - `find_similar_table` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-similar-table.md - `find_symbol_usages` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-symbol-usages.md - `get_agent_instructions` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/get-agent-instructions.md - `get_blog_posts` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/get-blog-posts.md - `get_capability_manifest` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/get-capability-manifest.md - …and 144 more: https://policylayer.com/tools/io-github-ajc3xc-meridian.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-ajc3xc-meridian · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-ajc3xc-meridian