feat: guarded merger lease adoption flow (#536)

Replace manual in-process _SESSION_LEASE seeding with an auditable
gitea_adopt_merger_pr_lease tool that posts durable adoption proof and
records sanctioned session provenance. Mutation gates now reject bare
record_session_lease calls without provenance from acquire/adopt/heartbeat.

Closes #536
This commit is contained in:
2026-07-08 11:03:56 -04:00
parent 6b45212659
commit 08ea214526
10 changed files with 905 additions and 10 deletions
@@ -796,6 +796,21 @@ inventory before continuing.
Final reports must include lease session id, acquisition proof, heartbeat
status, and release/blocked status.
## 26B-1. Merger lease adoption (#536)
When review and merge are **different sessions**, the merger must adopt the
reviewer's lease — never manually seed `reviewer_pr_lease._SESSION_LEASE`.
Before merge in a merger-only session:
1. Confirm `approval_at_current_head` via `gitea_get_pr_review_feedback`.
2. Call `gitea_adopt_merger_pr_lease` from a clean merger worktree under
`branches/`, passing `expected_head_sha` pinned to the approved head.
3. Quote the adoption comment id and `adopted_from_session_id` in the handoff.
4. Proceed to `gitea_merge_pr` only after adoption succeeds.
Manual in-process lease seeding is rejected by mutation gates (fail closed).
## 26C. Conflict-fix lease and stale-head protection (#399)
Before validating, approving, or merging a PR: