merge(master): resolve conflicts for PR #703 onto current master

Preserve #702 recovery kinds (session lease shadow, stale-binding audit) and instance_id shadow keys while integrating master #709/#720 decision-lock archive, irrecoverable provenance, and TTL-exempt KIND_DECISION_LOCK. Keep list_states (#702) and cross-profile load APIs (#709).
2026-07-16 22:16:24 -04:00
parent c2fc2683b9 67e4a2b5e9
commit 9e144db75c
50 changed files with 14252 additions and 335 deletions
@@ -58,6 +58,17 @@ def _reset_mutation_authority(monkeypatch):
            _fallback: str = state_dir,
            _env_key: str = mcp_session_state.STATE_DIR_ENV,
        ) -> str:
+            # #695 AC2: when production native transport has pinned a session
+            # state root, that pin is authoritative even under test isolation
+            # (PR #701 redirected-state regression).
+            try:
+                import mcp_daemon_guard
+
+                pinned = mcp_daemon_guard.pinned_session_state_dir()
+                if pinned:
+                    return pinned
+            except Exception:
+                pass
            raw = (os.environ.get(_env_key) or "").strip()
            return raw or _fallback

@@ -79,41 +79,46 @@ class TestApiRequestFailures(unittest.TestCase):
    @patch("gitea_auth.urllib.request.urlopen")
    def test_timeout_converted_to_runtimeerror(self, mock_open):
        mock_open.side_effect = TimeoutError("timed out")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaNetworkError) as ctx:
            gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("network error contacting Gitea", str(ctx.exception))
+        # Fixed message only (#699) — still a RuntimeError subclass.
+        self.assertIsInstance(ctx.exception, RuntimeError)
+        self.assertEqual(str(ctx.exception), "Network error contacting Gitea")

    @patch("gitea_auth.urllib.request.urlopen")
    def test_dns_network_failure_converted(self, mock_open):
        mock_open.side_effect = urllib.error.URLError("Name or service not known")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaNetworkError) as ctx:
            gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("network error contacting Gitea", str(ctx.exception))
+        self.assertEqual(str(ctx.exception), "Network error contacting Gitea")

    @patch("gitea_auth.urllib.request.urlopen")
    def test_502_upstream_message(self, mock_open):
        mock_open.side_effect = http_error(502, "bad gateway")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
            gitea_auth.api_request("GET", URL, FAKE_AUTH)
        msg = str(ctx.exception)
-        self.assertIn("HTTP 502", msg)
-        self.assertIn("upstream unavailable", msg)
+        self.assertEqual(msg, "Gitea upstream unavailable")
+        self.assertEqual(ctx.exception.reason_code, "upstream_unavailable")
+        self.assertEqual(ctx.exception.http_status, 502)

    @patch("gitea_auth.urllib.request.urlopen")
    def test_503_upstream_message(self, mock_open):
        mock_open.side_effect = http_error(503, "")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
            gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("HTTP 503", str(ctx.exception))
-        self.assertIn("upstream unavailable", str(ctx.exception))
+        self.assertEqual(str(ctx.exception), "Gitea upstream unavailable")
+        self.assertEqual(ctx.exception.http_status, 503)

    @patch("gitea_auth.urllib.request.urlopen")
    def test_malformed_error_payload_does_not_crash(self, mock_open):
-        # Non-JSON garbage error body must still yield a clean RuntimeError.
+        # Non-JSON garbage error body must still yield a clean typed error
+        # with a fixed message (no body echo — #699).
        mock_open.side_effect = http_error(500, "<html>garbage</html>")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
            gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("HTTP 500", str(ctx.exception))
+        self.assertEqual(str(ctx.exception), "Gitea HTTP request failed")
+        self.assertNotIn("<html>", str(ctx.exception))

    @patch("gitea_auth.urllib.request.urlopen")
    def test_malformed_success_json_raises_clean_error(self, mock_open):
@@ -126,16 +131,17 @@ class TestApiRequestFailures(unittest.TestCase):
    def test_no_secret_leak_in_error_body(self, mock_open):
        mock_open.side_effect = http_error(
            400, "failed: token supersecret123 rejected")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
            gitea_auth.api_request("GET", URL, FAKE_AUTH)
        msg = str(ctx.exception)
        self.assertNotIn("supersecret123", msg)
-        self.assertIn(gitea_audit.REDACTED, msg)
+        # Fixed message — body never appears (stronger than redaction).
+        self.assertEqual(msg, "Gitea HTTP request failed")

    @patch("gitea_auth.urllib.request.urlopen")
    def test_auth_header_never_in_error(self, mock_open):
        mock_open.side_effect = http_error(400, "bad request")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
            gitea_auth.api_request("GET", URL, FAKE_AUTH)
        self.assertNotIn(FAKE_AUTH, str(ctx.exception))

@@ -329,13 +329,17 @@ class TestGatedToolAudit(_AuditWiringBase):
    @patch("mcp_server.api_request")
    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
    def test_merge_success_audited(self, _auth, mock_api):
-        # user, pr, feedback pr+reviews, merge POST, readback.
+        # user, pr, eligibility feedback pr+reviews (#695), gate-7 feedback
+        # pr+reviews, merge POST, readback.
+        approval = [{
+            "id": 1, "user": {"login": "reviewer-bot"}, "state": "APPROVED",
+            "commit_id": "abc123", "submitted_at": "2026-07-06T10:00:00Z",
+            "dismissed": False,
+        }]
        mock_api.side_effect = [
            {"login": "merger-bot"}, self._pr("author-bot"),
-            self._pr("author-bot"),
-            [{"id": 1, "user": {"login": "reviewer-bot"}, "state": "APPROVED",
-              "commit_id": "abc123", "submitted_at": "2026-07-06T10:00:00Z",
-              "dismissed": False}],
+            self._pr("author-bot"), approval,  # eligibility merge feedback
+            self._pr("author-bot"), approval,  # gate 7 feedback
            {}, {"merged_commit_sha": "c1"},
        ]
        env = self._env(GITEA_PROFILE_NAME="gitea-merger",
@@ -27,7 +27,13 @@ from task_capability_map import required_permission, required_role

 DELETE_PROFILE = {
    "profile_name": "prgs-author-delete",
-    "allowed_operations": ["gitea.read", "gitea.branch.delete"],
+    "role": "author",
+    "allowed_operations": [
+        "gitea.read",
+        "gitea.pr.create",
+        "gitea.branch.push",
+        "gitea.branch.delete",
+    ],
    "forbidden_operations": [],
    "audit_label": "prgs-author-delete",
 }
@@ -94,6 +94,7 @@ REVIEW_STATUS: approved / approval_at_current_head
 MERGE_READY: true
 BLOCKERS: none
 VALIDATION: pytest passed; reviewer approved at head {FULL_SHA}
+NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=testharmless
 LAST_UPDATED_BY: prgs-reviewer
 """

@@ -0,0 +1,848 @@
+"""Regression tests for Issue #695 — second incident (PR #694 / review 427).
+
+Reproduces offline import, env-only runtime spoof, exposed-token invocation,
+direct imports, basename entrypoint spoof, allow_test_bootstrap forgery,
+standalone quarantine attempts, and false “official workflow” canonical claims.
+Gates must fail closed.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import tempfile
+import textwrap
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+import mcp_daemon_guard
+import merge_approval_gate
+import review_quarantine
+import canonical_comment_validator as ccv
+
+HEAD_694 = "1844e298809373be19a526fd39b7d8b0669eb5bd"
+HEAD_OTHER = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+REPO_ROOT = Path(__file__).resolve().parent.parent
+
+
+def _run_offline_snippet(snippet: str, *, env_extra: dict[str, str] | None = None) -> subprocess.CompletedProcess:
+    """Execute snippet in a fresh interpreter (no pytest modules)."""
+    env = os.environ.copy()
+    env.pop("PYTEST_CURRENT_TEST", None)
+    env.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+    env["PYTHONPATH"] = str(REPO_ROOT) + os.pathsep + env.get("PYTHONPATH", "")
+    if env_extra:
+        env.update(env_extra)
+    return subprocess.run(
+        [sys.executable, "-c", snippet],
+        capture_output=True,
+        text=True,
+        cwd=str(REPO_ROOT),
+        env=env,
+        timeout=30,
+        check=False,
+    )
+
+
+class TestNativeTransportBinding(unittest.TestCase):
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+        os.environ.pop(mcp_daemon_guard.SANCTIONED_DAEMON_ENV, None)
+        os.environ.pop(mcp_daemon_guard.ALLOW_DIRECT_IMPORT_ENV, None)
+
+    def test_env_alone_does_not_establish_native_transport(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ[mcp_daemon_guard.SANCTIONED_DAEMON_ENV] = "1"
+        os.environ[mcp_daemon_guard.ALLOW_DIRECT_IMPORT_ENV] = "1"
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        self.assertFalse(mcp_daemon_guard.is_native_mcp_transport())
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.assert_sanctioned_mutation_runtime("offline_import")
+        msg = str(ctx.exception)
+        self.assertIn("#695", msg)
+        # FORCE disables pytest allowance; direct-import env is rejected first
+        # (AC1). Without ALLOW_DIRECT, env-alone also yields "not sufficient".
+        lowered = msg.lower()
+        self.assertTrue(
+            "direct" in lowered
+            or "not sufficient" in lowered
+            or "allow_direct" in lowered
+            or "gitea_allow_direct" in lowered,
+            msg,
+        )
+
+    def test_direct_import_mark_rejected_outside_entrypoint(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.mark_sanctioned_daemon()
+        self.assertIn("canonical", str(ctx.exception).lower())
+        self.assertFalse(mcp_daemon_guard.is_native_mcp_transport())
+
+    def test_locally_generated_runtime_key_without_entrypoint_rejected(self):
+        """Spoofing process-local fields via mark outside entrypoint fails."""
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
+            mcp_daemon_guard.mark_sanctioned_daemon()
+
+    def test_test_native_runtime_for_hermetic_tests_not_production(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        st = mcp_daemon_guard.install_test_native_runtime()
+        self.assertTrue(st["native_mcp_transport"])
+        self.assertTrue(mcp_daemon_guard.is_native_mcp_transport())
+        self.assertFalse(mcp_daemon_guard.is_production_native_mcp_transport())
+        mcp_daemon_guard.assert_sanctioned_mutation_runtime("test-bootstrap")
+        fields = mcp_daemon_guard.mutation_provenance_fields()
+        self.assertEqual(fields["transport"], "test_native_mcp")
+        self.assertTrue(fields["native_mcp_transport"])
+        self.assertFalse(fields["production_native_mcp_transport"])
+        self.assertIsNotNone(fields["native_token_fingerprint"])
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.assert_production_mutation_runtime("prod-endpoint")
+        self.assertIn("Test-mode", str(ctx.exception))
+
+    def test_no_allow_test_bootstrap_parameter_on_mark(self):
+        import inspect
+
+        sig = inspect.signature(mcp_daemon_guard.mark_sanctioned_daemon)
+        self.assertNotIn("allow_test_bootstrap", sig.parameters)
+
+    def test_exposed_token_env_never_grants_native(self):
+        """Raw / exposed token env vars must never reconstruct native transport."""
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        for key in (
+            "GITEA_TOKEN",
+            "GITEA_ACCESS_TOKEN",
+            "GITHUB_TOKEN",
+            "GITEA_MCP_TOKEN",
+            "GITEA_RAW_TOKEN",
+        ):
+            os.environ[key] = "exposed-token-value-must-not-authorize"
+        try:
+            self.assertFalse(mcp_daemon_guard.is_native_mcp_transport())
+            with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
+                mcp_daemon_guard.assert_sanctioned_mutation_runtime("exposed-token")
+        finally:
+            for key in (
+                "GITEA_TOKEN",
+                "GITEA_ACCESS_TOKEN",
+                "GITHUB_TOKEN",
+                "GITEA_MCP_TOKEN",
+                "GITEA_RAW_TOKEN",
+            ):
+                os.environ.pop(key, None)
+
+
+class TestAC9BypassRegressions(unittest.TestCase):
+    """AC9: empirically reproduced offline bypasses must fail closed (#695)."""
+
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+
+    def test_allow_test_bootstrap_cannot_authorize_fresh_offline_interpreter(self):
+        """Finding 1: former allow_test_bootstrap forge is gone and rejected offline."""
+        snippet = textwrap.dedent(
+            """
+            import inspect
+            import mcp_daemon_guard as g
+            sig = inspect.signature(g.mark_sanctioned_daemon)
+            assert "allow_test_bootstrap" not in sig.parameters, "bootstrap flag must not exist"
+            try:
+                g.mark_sanctioned_daemon(allow_test_bootstrap=True)
+            except TypeError:
+                pass
+            else:
+                raise SystemExit("mark_sanctioned_daemon accepted allow_test_bootstrap")
+            try:
+                g.install_test_native_runtime()
+            except g.UnsanctionedRuntimeError as exc:
+                assert "pytest" in str(exc).lower() or "#695" in str(exc)
+            else:
+                raise SystemExit("install_test_native_runtime authorized offline interpreter")
+            assert g.is_native_mcp_transport() is False
+            try:
+                g.assert_sanctioned_mutation_runtime("offline-bootstrap")
+            except g.UnsanctionedRuntimeError:
+                pass
+            else:
+                raise SystemExit("mutation runtime authorized after offline bootstrap attempt")
+            print("OK")
+            """
+        )
+        proc = _run_offline_snippet(snippet)
+        self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+        self.assertIn("OK", proc.stdout)
+
+    def test_renamed_runner_named_mcp_server_py_rejected(self):
+        """Finding 2: basename-only entrypoint trust is insufficient."""
+        with tempfile.TemporaryDirectory() as tmp:
+            attacker = Path(tmp) / "mcp_server.py"
+            attacker.write_text(
+                textwrap.dedent(
+                    """
+                    import mcp_daemon_guard as g
+                    try:
+                        g.mark_sanctioned_daemon()
+                    except g.UnsanctionedRuntimeError as exc:
+                        print("REJECTED:" + str(exc))
+                        raise SystemExit(0)
+                    print("AUTHORIZED")
+                    raise SystemExit(1)
+                    """
+                ),
+                encoding="utf-8",
+            )
+            env = os.environ.copy()
+            env.pop("PYTEST_CURRENT_TEST", None)
+            env["PYTHONPATH"] = str(REPO_ROOT) + os.pathsep + env.get("PYTHONPATH", "")
+            proc = subprocess.run(
+                [sys.executable, str(attacker)],
+                capture_output=True,
+                text=True,
+                cwd=tmp,
+                env=env,
+                timeout=30,
+                check=False,
+            )
+            self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+            self.assertIn("REJECTED:", proc.stdout)
+            self.assertIn("canonical", proc.stdout.lower())
+            self.assertNotIn("AUTHORIZED", proc.stdout)
+
+    def test_direct_launch_import_canonical_entrypoint_without_transport_rejected(self):
+        """Merely importing/launching real entrypoint offline must not authorize."""
+        snippet = textwrap.dedent(
+            f"""
+            import importlib.util
+            import mcp_daemon_guard as g
+            # Simulate claim-only phase (no transport bind).
+            g.clear_native_runtime_for_tests()
+            # Direct mark from non-entrypoint must fail.
+            try:
+                g.mark_sanctioned_daemon()
+            except g.UnsanctionedRuntimeError:
+                pass
+            assert g.is_native_mcp_transport() is False
+            # Even if someone forges entrypoint_claimed without transport bind:
+            g._NATIVE_RUNTIME = {{
+                "token": "x" * 64,
+                "token_fingerprint": "deadbeefdeadbeef",
+                "pid": __import__("os").getpid(),
+                "started_at": 0,
+                "entrypoint": "mcp_server",
+                "entrypoint_path": {str(REPO_ROOT / "mcp_server.py")!r},
+                "phase": "entrypoint_claimed",
+                "transport": None,
+                "mode": "production",
+            }}
+            assert g.is_native_mcp_transport() is False
+            try:
+                g.assert_sanctioned_mutation_runtime("import-only")
+            except g.UnsanctionedRuntimeError as exc:
+                assert "transport" in str(exc).lower() or "entrypoint" in str(exc).lower() or "#695" in str(exc)
+            else:
+                raise SystemExit("import-only claim authorized mutation")
+            print("OK")
+            """
+        )
+        proc = _run_offline_snippet(snippet)
+        self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+        self.assertIn("OK", proc.stdout)
+
+    def test_spoofed_pytest_env_stack_path_rejected(self):
+        """Spoofed pytest/env/call-stack/path evidence must not authorize offline."""
+        snippet = textwrap.dedent(
+            f"""
+            import os
+            import mcp_daemon_guard as g
+            os.environ["PYTEST_CURRENT_TEST"] = "spoofed::test"
+            os.environ[g.SANCTIONED_DAEMON_ENV] = "1"
+            os.environ[g.ALLOW_DIRECT_IMPORT_ENV] = "1"
+            # Fresh interpreter has no pytest module; PYTEST_CURRENT_TEST alone
+            # might still trip is_pytest_runtime — force-unsanctioned is not set.
+            # But install_test_native_runtime requires real pytest path; if
+            # PYTEST_CURRENT_TEST alone grants is_pytest_runtime, production
+            # mutation still requires production transport outside true pytest.
+            if g.is_pytest_runtime():
+                # Env-only pytest spoof: test install may succeed, but production
+                # mutation gate must still reject test mode.
+                g.install_test_native_runtime()
+                assert g.is_production_native_mcp_transport() is False
+                try:
+                    g.assert_production_mutation_runtime("spoofed-pytest")
+                except g.UnsanctionedRuntimeError:
+                    pass
+                else:
+                    raise SystemExit("production mutation accepted test-mode under spoofed pytest env")
+            else:
+                try:
+                    g.install_test_native_runtime()
+                except g.UnsanctionedRuntimeError:
+                    pass
+                else:
+                    raise SystemExit("test install without pytest evidence")
+            # Basename path spoof via inspect is covered elsewhere; env alone:
+            g.clear_native_runtime_for_tests()
+            os.environ.pop("PYTEST_CURRENT_TEST", None)
+            assert g.is_native_mcp_transport() is False
+            try:
+                g.assert_sanctioned_mutation_runtime("env-path-spoof")
+            except g.UnsanctionedRuntimeError:
+                pass
+            else:
+                raise SystemExit("env/path spoof authorized mutation")
+            print("OK")
+            """
+        )
+        proc = _run_offline_snippet(snippet)
+        self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+        self.assertIn("OK", proc.stdout)
+
+    def test_test_bootstrap_cannot_reach_production_mutation_endpoints(self):
+        """Under pytest, test-mode runtime cannot satisfy production mutation gate."""
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        mcp_daemon_guard.install_test_native_runtime()
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.assert_production_mutation_runtime(
+                "gitea_quarantine_contaminated_review"
+            )
+        msg = str(ctx.exception)
+        self.assertIn("Test-mode", msg)
+        self.assertIn("#695", msg)
+
+        # Offline: install_test_native_runtime must not authorize production mutations.
+        snippet = textwrap.dedent(
+            """
+            import mcp_daemon_guard as g
+            try:
+                g.install_test_native_runtime()
+            except g.UnsanctionedRuntimeError:
+                pass
+            assert g.is_production_native_mcp_transport() is False
+            try:
+                g.assert_production_mutation_runtime("gitea_quarantine_contaminated_review")
+            except g.UnsanctionedRuntimeError:
+                pass
+            else:
+                raise SystemExit("production mutation authorized offline")
+            try:
+                g.assert_sanctioned_mutation_runtime("gitea_mutation")
+            except g.UnsanctionedRuntimeError:
+                pass
+            else:
+                raise SystemExit("sanctioned mutation authorized offline")
+            print("OK")
+            """
+        )
+        proc = _run_offline_snippet(snippet)
+        self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+        self.assertIn("OK", proc.stdout)
+
+    def test_legitimate_native_transport_bind_succeeds(self):
+        """Canonical entrypoint path + stdio bind establishes production native."""
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        # Simulate production path under force-unsanctioned (no pytest allowance)
+        # by calling internal claim/bind with patched caller path.
+        canonical = str((REPO_ROOT / "mcp_server.py").resolve())
+
+        def _fake_caller():
+            return canonical
+
+        with patch.object(
+            mcp_daemon_guard, "_caller_official_entrypoint_path", side_effect=_fake_caller
+        ):
+            # Force non-pytest path for mark/bind logic.
+            with patch.object(mcp_daemon_guard, "is_pytest_runtime", return_value=False):
+                st1 = mcp_daemon_guard.mark_sanctioned_daemon()
+                self.assertFalse(st1["native_mcp_transport"])
+                self.assertEqual(st1["phase"], "entrypoint_claimed")
+                st2 = mcp_daemon_guard.bind_native_mcp_transport(transport="stdio")
+                self.assertTrue(st2["native_mcp_transport"])
+                self.assertTrue(st2["production_native_mcp_transport"])
+                self.assertEqual(st2["transport"], "stdio")
+                self.assertEqual(st2["mode"], "production")
+                mcp_daemon_guard.assert_sanctioned_mutation_runtime("native-ide")
+                mcp_daemon_guard.assert_production_mutation_runtime("native-ide")
+                fields = mcp_daemon_guard.mutation_provenance_fields()
+                self.assertEqual(fields["transport"], "native_mcp")
+                self.assertTrue(fields["production_native_mcp_transport"])
+
+    def test_canonical_entrypoint_paths_are_resolved_absolute(self):
+        paths = mcp_daemon_guard.canonical_entrypoint_paths()
+        self.assertTrue(any(p.endswith("mcp_server.py") for p in paths))
+        for p in paths:
+            self.assertTrue(os.path.isabs(p), p)
+            self.assertEqual(p, str(Path(p).resolve()))
+
+
+class TestQuarantineWriteNativeOnly(unittest.TestCase):
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+
+    def test_standalone_quarantine_write_blocked_when_unsanctioned(self):
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        assessment = review_quarantine.assess_quarantine_write(
+            confirmation="QUARANTINE CONTAMINATED REVIEW 427 PR 694",
+            pr_number=694,
+            review_id=427,
+            reason="contaminated offline approval",
+            native_required=True,
+        )
+        self.assertFalse(assessment["allowed"])
+        self.assertTrue(
+            any("native MCP transport" in r for r in assessment["reasons"])
+        )
+        record = review_quarantine.build_quarantine_record(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            pr_number=694,
+            review_id=427,
+            reviewed_head_sha=HEAD_694,
+            reason="contaminated",
+            actor_username="sysadmin",
+            profile_name="prgs-merger",
+            incident_issue=695,
+            forensic_comment_ids=[10883, 10886],
+        )
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
+            # Force non-pytest and non-native for write path.
+            with patch.object(mcp_daemon_guard, "is_pytest_runtime", return_value=False):
+                with patch.object(
+                    mcp_daemon_guard, "is_native_mcp_transport", return_value=False
+                ):
+                    review_quarantine.write_quarantine_record(record)
+
+    def test_confirmation_must_match_exactly(self):
+        assessment = review_quarantine.assess_quarantine_write(
+            confirmation="quarantine 427",
+            pr_number=694,
+            review_id=427,
+            reason="x",
+            native_required=False,
+        )
+        self.assertFalse(assessment["allowed"])
+        self.assertIn("confirmation must equal exactly", assessment["reasons"][0])
+
+    def test_quarantine_honored_by_merge_approval_gate(self):
+        """Contaminated review 427 at head must not authorize merge (#695)."""
+        result = merge_approval_gate.assess_merge_approval_head(
+            current_head_sha=HEAD_694,
+            latest_by_reviewer={
+                "sysadmin": {
+                    "verdict": "APPROVED",
+                    "dismissed": False,
+                    "reviewed_head_sha": HEAD_694,
+                    "review_id": 427,
+                    "submitted_at": "2026-07-13T07:20:00Z",
+                }
+            },
+            quarantined_review_ids={427},
+        )
+        self.assertFalse(result["approval_at_current_head"])
+        self.assertIn("quarantined", result["stale_approval_block_reason"])
+        self.assertEqual(result["quarantined_approvals_at_current_head"], 1)
+
+    def test_filter_approvals_for_merge_splits_quarantined(self):
+        with patch(
+            "review_quarantine.mcp_session_state.default_state_dir",
+            return_value=self._tmp.name,
+        ):
+            mcp_daemon_guard.install_test_native_runtime()
+            record = review_quarantine.build_quarantine_record(
+                remote="prgs",
+                org="org",
+                repo="repo",
+                pr_number=694,
+                review_id=427,
+                reviewed_head_sha=HEAD_694,
+                reason="offline import contaminated approval",
+                actor_username="sysadmin",
+                profile_name="prgs-merger",
+                incident_issue=695,
+            )
+            # Force native provenance bit for write path under test bootstrap.
+            record["native_provenance"] = {
+                **record["native_provenance"],
+                "native_mcp_transport": True,
+            }
+            review_quarantine.write_quarantine_record(record)
+            filtered = review_quarantine.filter_approvals_for_merge(
+                remote="prgs",
+                org="org",
+                repo="repo",
+                pr_number=694,
+                current_head_sha=HEAD_694,
+                reviews=[
+                    {
+                        "verdict": "APPROVED",
+                        "review_id": 427,
+                        "reviewed_head_sha": HEAD_694,
+                        "reviewer": "sysadmin",
+                    },
+                    {
+                        "verdict": "APPROVED",
+                        "review_id": 999,
+                        "reviewed_head_sha": HEAD_694,
+                        "reviewer": "fresh-reviewer",
+                    },
+                ],
+            )
+            self.assertTrue(filtered["has_quarantined_approval_at_head"])
+            self.assertEqual(len(filtered["quarantined_approvals"]), 1)
+            self.assertEqual(filtered["quarantined_approvals"][0]["review_id"], 427)
+            self.assertEqual(len(filtered["usable_approvals_at_current_head"]), 1)
+            self.assertEqual(
+                filtered["usable_approvals_at_current_head"][0]["review_id"], 999
+            )
+            self.assertTrue(filtered["approval_visible_for_merge"])
+
+
+class TestCanonicalHandoffValidation(unittest.TestCase):
+    def test_false_official_workflow_offline_claim_rejected(self):
+        body = f"""## Canonical PR State
+
+STATE: approved
+WHO_IS_NEXT: merger
+NEXT_ACTION: Merge PR #694 immediately after offline helper success
+NEXT_PROMPT:
+```text
+Merger: land PR #694; offline_mcp_runner completed official workflow.
+```
+WHAT_HAPPENED: offline import of gitea_mcp_server submitted APPROVED review 427
+WHY: claimed official workflow via direct import after native EOF
+ISSUE: #693
+HEAD_SHA: {HEAD_694}
+REVIEW_STATUS: approved / approval_at_current_head
+MERGE_READY: true
+BLOCKERS: none
+VALIDATION: offline_mcp_helper.py + offline_mcp_runner.py; import gitea_mcp_server
+NATIVE_REVIEW_PROOF: transport=offline_mcp; spoofed
+LAST_UPDATED_BY: contaminated-session
+"""
+        result = ccv.assess_canonical_comment(body, context="pr_comment")
+        self.assertFalse(result["allowed"])
+        joined = " ".join(result.get("extra_reasons") or [])
+        self.assertIn("#695", joined)
+        self.assertIn("offline", joined.lower())
+
+    def test_merge_ready_without_native_proof_rejected(self):
+        body = f"""## Canonical PR State
+
+STATE: ready-to-merge
+WHO_IS_NEXT: merger
+NEXT_ACTION: Merge PR after confirming approval_at_current_head
+NEXT_PROMPT:
+```text
+Merge PR #694 for issue #693 after live mergeable check passes.
+```
+WHAT_HAPPENED: Reviewer approved at current head
+WHY: All gates passed and head SHA is current
+ISSUE: #693
+HEAD_SHA: {HEAD_694}
+REVIEW_STATUS: approved / approval_at_current_head
+MERGE_READY: true
+BLOCKERS: none
+VALIDATION: pytest passed; reviewer approved at head {HEAD_694}
+LAST_UPDATED_BY: prgs-reviewer
+"""
+        result = ccv.assess_canonical_comment(body, context="pr_comment")
+        self.assertFalse(result["allowed"])
+        joined = " ".join(result.get("extra_reasons") or [])
+        self.assertIn("NATIVE_REVIEW_PROOF", joined)
+
+    def test_merge_ready_with_native_proof_allowed(self):
+        body = f"""## Canonical PR State
+
+STATE: ready-to-merge
+WHO_IS_NEXT: merger
+NEXT_ACTION: Merge PR after confirming approval_at_current_head
+NEXT_PROMPT:
+```text
+Merge PR #500 for issue #496 after live mergeable check passes.
+```
+WHAT_HAPPENED: Reviewer approved at current head via native MCP
+WHY: All gates passed and head SHA is current
+ISSUE: #496
+HEAD_SHA: {HEAD_694}
+REVIEW_STATUS: approved / approval_at_current_head
+MERGE_READY: true
+BLOCKERS: none
+VALIDATION: pytest passed; reviewer approved at head {HEAD_694}
+NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=abc123
+LAST_UPDATED_BY: prgs-reviewer
+"""
+        result = ccv.assess_canonical_comment(body, context="pr_comment")
+        self.assertTrue(result["allowed"], result)
+
+
+class TestFeedbackQuarantineIntegration(unittest.TestCase):
+    """gitea_get_pr_review_feedback must void quarantined review 427 at head."""
+
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        mcp_daemon_guard.install_test_native_runtime()
+
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+
+    def test_feedback_excludes_quarantined_approval_from_merge_auth(self):
+        import mcp_server
+
+        with patch(
+            "review_quarantine.mcp_session_state.default_state_dir",
+            return_value=self._tmp.name,
+        ):
+            record = review_quarantine.build_quarantine_record(
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+                pr_number=694,
+                review_id=427,
+                reviewed_head_sha=HEAD_694,
+                reason="contaminated offline approval (incident #695)",
+                actor_username="controller",
+                profile_name="prgs-merger",
+                incident_issue=695,
+                forensic_comment_ids=[10883, 10886],
+            )
+            record["native_provenance"]["native_mcp_transport"] = True
+            review_quarantine.write_quarantine_record(record)
+
+            def _api(method, url, auth=None, payload=None):
+                if url.endswith("/pulls/694") and method == "GET":
+                    return {
+                        "number": 694,
+                        "state": "open",
+                        "head": {"sha": HEAD_694},
+                        "user": {"login": "jcwalker3"},
+                    }
+                if url.endswith("/reviews"):
+                    return [
+                        {
+                            "id": 427,
+                            "user": {"login": "sysadmin"},
+                            "state": "APPROVED",
+                            "body": "contaminated",
+                            "submitted_at": "2026-07-13T07:20:00Z",
+                            "commit_id": HEAD_694,
+                            "dismissed": False,
+                            "stale": False,
+                        }
+                    ]
+                return {}
+
+            with patch("mcp_server.api_request", side_effect=_api):
+                with patch(
+                    "mcp_server.get_auth_header", return_value="Basic dGVzdA=="
+                ):
+                    with patch(
+                        "mcp_server.get_profile",
+                        return_value={
+                            "profile_name": "prgs-merger",
+                            "allowed_operations": ["gitea.read", "gitea.pr.merge"],
+                            "forbidden_operations": [],
+                            "base_url": None,
+                        },
+                    ):
+                        result = mcp_server.gitea_get_pr_review_feedback(
+                            pr_number=694,
+                            remote="prgs",
+                            org="Scaled-Tech-Consulting",
+                            repo="Gitea-Tools",
+                        )
+        self.assertTrue(result.get("success"), result)
+        self.assertFalse(result.get("approval_at_current_head"))
+        self.assertFalse(result.get("approval_visible"))
+        self.assertIn(427, result.get("quarantined_review_ids") or [])
+        self.assertGreaterEqual(
+            result.get("quarantined_approvals_at_current_head") or 0, 1
+        )
+        self.assertIn("quarantined", (result.get("stale_approval_block_reason") or ""))
+
+
+class TestDocsStopAfterNativeFailure(unittest.TestCase):
+    def test_daemon_guard_doc_requires_stop(self):
+        root = Path(__file__).resolve().parent.parent
+        doc = (root / "docs" / "mcp-daemon-import-guard.md").read_text(encoding="utf-8")
+        self.assertIn("#695", doc)
+        self.assertIn("STOP after native MCP failure", doc)
+        self.assertIn("offline_mcp_runner", doc)
+        self.assertIn("run_quarantine.py", doc)
+        self.assertIn("GITEA_ALLOW_DIRECT_MCP_IMPORT", doc)
+
+
+class TestPR701DirectImportSessionOverrideSequence(unittest.TestCase):
+    """AC9 regression: exact PR #701 contaminated-approval sequence must fail closed.
+
+    Observed attack:
+    - GITEA_ALLOW_DIRECT_MCP_IMPORT=1
+    - import mutation tools from gitea_mcp_server
+    - GITEA_MCP_SESSION_STATE_DIR=.mcp_session_701 (cross-PR lock evasion)
+    - mark_final + submit_pr_review
+    """
+
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+        os.environ.pop(mcp_daemon_guard.SANCTIONED_DAEMON_ENV, None)
+        os.environ.pop(mcp_daemon_guard.ALLOW_DIRECT_IMPORT_ENV, None)
+        os.environ.pop(mcp_daemon_guard.SESSION_STATE_DIR_ENV, None)
+
+    def test_offline_run_submit_sequence_fails_closed(self):
+        """Fresh interpreter: direct import + state-dir override cannot mark/submit."""
+        with tempfile.TemporaryDirectory() as tmp:
+            redirect = str(Path(tmp) / ".mcp_session_701")
+            snippet = textwrap.dedent(
+                f"""
+                import os
+                import sys
+                os.environ["GITEA_ALLOW_DIRECT_MCP_IMPORT"] = "1"
+                os.environ["GITEA_MCP_SESSION_STATE_DIR"] = {redirect!r}
+                os.environ["GITEA_MCP_PROFILE"] = "prgs-reviewer"
+                # No pytest modules in this subprocess.
+                import mcp_daemon_guard as g
+                assert g.is_native_mcp_transport() is False
+                assert g.is_production_native_mcp_transport() is False
+                try:
+                    g.assert_sanctioned_mutation_runtime("run_submit_mark")
+                except g.UnsanctionedRuntimeError as exc:
+                    msg = str(exc)
+                    assert "GITEA_ALLOW_DIRECT_MCP_IMPORT" in msg or "#695" in msg
+                else:
+                    raise SystemExit("direct-import env authorized mutation runtime")
+                try:
+                    g.mark_sanctioned_daemon()
+                except g.UnsanctionedRuntimeError:
+                    pass
+                else:
+                    raise SystemExit("mark_sanctioned_daemon authorized offline import")
+                # Simulate decision-lock write into redirected dir only — must not
+                # establish native authority.
+                import mcp_session_state as ss
+                wrote = ss.save_state(
+                    kind=ss.KIND_DECISION_LOCK,
+                    payload={{
+                        "final_review_decision_ready": True,
+                        "ready_pr_number": 701,
+                        "ready_action": "approve",
+                        "ready_expected_head_sha": "6b675f5c834b41f9d74e8a54294ff44dddf28ae4",
+                        "session_profile": "prgs-reviewer",
+                        "session_profile_lock": "prgs-reviewer",
+                        "remote": "prgs",
+                    }},
+                    profile_identity="prgs-reviewer",
+                    state_dir={redirect!r},
+                )
+                assert wrote is not None
+                assert g.is_native_mcp_transport() is False
+                try:
+                    g.assert_no_direct_import_bypass("gitea_submit_pr_review")
+                except g.UnsanctionedRuntimeError:
+                    pass
+                else:
+                    raise SystemExit("direct-import bypass accepted for submit")
+                print("OK")
+                """
+            )
+            proc = _run_offline_snippet(snippet)
+            self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+            self.assertIn("OK", proc.stdout)
+
+    def test_session_state_dir_pin_ignores_post_bind_redirect(self):
+        """AC2: after production bind, env STATE_DIR override is ignored."""
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        import mcp_session_state
+
+        with tempfile.TemporaryDirectory() as tmp:
+            legitimate = str(Path(tmp) / "legitimate-state")
+            rogue = str(Path(tmp) / ".mcp_session_701")
+            os.makedirs(legitimate, mode=0o700, exist_ok=True)
+            os.makedirs(rogue, mode=0o700, exist_ok=True)
+            os.environ[mcp_daemon_guard.SESSION_STATE_DIR_ENV] = legitimate
+            canonical = str((REPO_ROOT / "mcp_server.py").resolve())
+
+            def _fake_caller():
+                return canonical
+
+            with patch.object(
+                mcp_daemon_guard,
+                "_caller_official_entrypoint_path",
+                side_effect=_fake_caller,
+            ):
+                with patch.object(
+                    mcp_daemon_guard, "is_pytest_runtime", return_value=False
+                ):
+                    mcp_daemon_guard.mark_sanctioned_daemon()
+                    mcp_daemon_guard.bind_native_mcp_transport(transport="stdio")
+                    pinned = mcp_daemon_guard.pinned_session_state_dir()
+                    self.assertEqual(pinned, str(Path(legitimate).resolve()))
+                    # Attacker redirects env after bind (PR #701).
+                    os.environ[mcp_daemon_guard.SESSION_STATE_DIR_ENV] = rogue
+                    self.assertEqual(
+                        mcp_daemon_guard.pinned_session_state_dir(),
+                        str(Path(legitimate).resolve()),
+                    )
+                    self.assertEqual(
+                        mcp_session_state.default_state_dir(),
+                        str(Path(legitimate).resolve()),
+                    )
+                    self.assertNotEqual(
+                        mcp_session_state.default_state_dir(),
+                        str(Path(rogue).resolve()),
+                    )
+                    # Unpinned env view still sees rogue (diagnostics only).
+                    unpinned = mcp_session_state.env_session_state_dir_unpinned()
+                    self.assertTrue(
+                        unpinned == rogue
+                        or Path(unpinned).resolve() == Path(rogue).resolve(),
+                        unpinned,
+                    )
+
+    def test_direct_import_env_does_not_authorize_under_force_unsanctioned(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ[mcp_daemon_guard.ALLOW_DIRECT_IMPORT_ENV] = "1"
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        self.assertTrue(mcp_daemon_guard.direct_import_env_enabled())
+        # Under pytest, assert_no_direct_import_bypass is a no-op; FORCE path
+        # still blocks is_native / assert_sanctioned via force-unsanctioned.
+        self.assertFalse(mcp_daemon_guard.is_native_mcp_transport())
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
+            mcp_daemon_guard.assert_sanctioned_mutation_runtime("direct-import")
+
+    def test_quarantine_voids_merge_approval_for_contaminated_review(self):
+        """AC6–AC8: quarantined APPROVED does not satisfy merge approval head."""
+        entry = {
+            "verdict": "APPROVED",
+            "dismissed": False,
+            "reviewed_head_sha": "6b675f5c834b41f9d74e8a54294ff44dddf28ae4",
+            "review_id": 431,
+            "submitted_at": "2026-07-13T23:52:34Z",
+            "quarantined": True,
+        }
+        result = merge_approval_gate.assess_merge_approval_head(
+            current_head_sha="6b675f5c834b41f9d74e8a54294ff44dddf28ae4",
+            latest_by_reviewer={"sysadmin": entry},
+            quarantined_review_ids={431},
+        )
+        self.assertFalse(result["approval_at_current_head"])
+        self.assertEqual(result["quarantined_approvals_at_current_head"], 1)
+        self.assertIn("quarantined", (result["stale_approval_block_reason"] or ""))
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,461 @@
+"""Regression tests for #698: final-report validator vs canonical schema.
+
+Covers the original #698 lead plus the independent reproduction recorded
+during the PR #703 formal review (issue #698 comment 11246):
+
+1. non-dict ``action_log`` entries must fail structured, never crash;
+2. the validator must not demand legacy fields the canonical schema forbids
+   (``Pinned reviewed head``, ``Scratch worktree used``, ``Worktree path``,
+   ``Worktree dirty``, ``Mutations``, ``Next``);
+3. a legitimately blocked report (``Candidate head SHA: none``, no formal
+   verdict) must not owe approval/merge live-head proofs;
+4. canonical reviewer lease release must not be misclassified as post-merge
+   cleanup;
+5. structured workflow-load and validation proof must be recognized;
+6. review mutations are inferred only from authoritative evidence.
+"""
+
+from __future__ import annotations
+
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+import final_report_validator as frv  # noqa: E402
+import post_merge_cleanup_proof as pmcp  # noqa: E402
+import pr_work_lease as pwl  # noqa: E402
+import review_proofs as rp  # noqa: E402
+from review_final_report_schema import (  # noqa: E402
+    assess_review_final_report_schema,
+)
+
+REVIEWED_HEAD = "a" * 40
+LIVE_HEAD = "a" * 40
+
+
+def _pr703_style_report(
+    *,
+    decision: str = "request_changes",
+    cleanup_mutations: str = (
+        "released reviewer PR lease via gitea_release_reviewer_pr_lease "
+        "(terminal lease marker phase=released posted)"
+    ),
+) -> str:
+    """Canonical-schema report modeled on the PR #703 formal review handoff."""
+    return f"""
+Formal review completed with a REQUEST_CHANGES verdict submitted and read
+back via the native review API.
+
+## Controller Handoff
+
+- Task: review-merge-pr
+- Repo: Scaled-Tech-Consulting/Gitea-Tools
+- Role: reviewer
+- Identity: sysadmin / prgs-reviewer
+- Active profile: prgs-reviewer
+- Runtime context: neutral workspace binding
+- Selected PR: 703
+- Linked issue: #702 open
+- Eligibility class: reviewable
+- Queue ordering policy: oldest eligible first
+- Inventory pagination proof: has_more=false, total_count=8
+- Earlier PRs skipped: none
+- Candidate head SHA: {REVIEWED_HEAD}
+- Reviewed head SHA: {REVIEWED_HEAD}
+- Target branch: master
+- Target branch SHA: {"2" * 40}
+- Already-landed gate: not landed
+- Author-safety result: pass (author differs from reviewer)
+- Prior request-changes state: none
+- Review worktree used: true
+- Review worktree path: branches/review-pr-703-independent
+- Review worktree inside branches: true
+- Review worktree HEAD state: detached at pinned head
+- Review worktree dirty before validation: clean
+- Review worktree dirty after validation: clean
+- Baseline worktree used: false
+- Baseline worktree path: none
+- Files reviewed: 4
+- Validation: focused 50 passed; related 94 passed; full 2665 passed, 6 skipped
+- Official validation integrity status: intact
+- Terminal review mutation: one REQUEST_CHANGES review submitted and read back
+- Review decision: {decision}
+- Merge preflight: not run
+- Merge result: none
+- Linked issue status: open (live fetch proof: gitea_view_issue)
+- Main checkout branch: master
+- Main checkout dirty state: clean
+- Main checkout updated: false
+- File edits by reviewer: none
+- Worktree/index mutations: none
+- Git ref mutations: git fetch prgs (recorded)
+- MCP/Gitea mutations: review submission and lease comments only
+- Review mutations: one formal REQUEST_CHANGES verdict
+- Merge mutations: none
+- Cleanup mutations: {cleanup_mutations}
+- External-state mutations: none
+- Read-only diagnostics: gitea_view_pr, gitea_get_pr_review_feedback
+- Blockers: findings F1-F6 recorded on the PR thread
+- Current status: review complete; author remediation required
+- Safe next action: author addresses findings and pushes a new head
+- Safety statement: no merge attempted; no self-review; no root-checkout edits
+- Workflow-load helper result: workflow_hash=da045d1e1f1f boundary_status=clean
+- Live head SHA before approval: {LIVE_HEAD}
+- Pushes occurred during validation: no
+"""
+
+
+def _blocked_preflight_report() -> str:
+    """Blocked-run report modeled on the #702 comment 11164 reproduction."""
+    return """
+Fresh review preflight stopped before any worktree or validation work.
+
+## Controller Handoff
+
+- Task: review-merge-pr
+- Repo: Scaled-Tech-Consulting/Gitea-Tools
+- Role: reviewer
+- Identity: sysadmin / prgs-reviewer
+- Active profile: prgs-reviewer
+- Runtime context: stale workspace binding detected
+- Selected PR: 701
+- Linked issue: #699 open
+- Eligibility class: blocked-before-validation
+- Queue ordering policy: oldest eligible first
+- Inventory pagination proof: has_more=false, total_count=8
+- Earlier PRs skipped: none
+- Candidate head SHA: none
+- Reviewed head SHA: none
+- Target branch: master
+- Target branch SHA: none
+- Already-landed gate: not run
+- Author-safety result: not run
+- Prior request-changes state: none
+- Review worktree used: false
+- Review worktree path: none
+- Review worktree inside branches: not applicable
+- Review worktree HEAD state: not applicable
+- Review worktree dirty before validation: not applicable
+- Review worktree dirty after validation: not applicable
+- Baseline worktree used: false
+- Baseline worktree path: none
+- Files reviewed: 0
+- Validation: not run
+- Official validation integrity status: not applicable
+- Terminal review mutation: none
+- Review decision: none
+- Merge preflight: not run
+- Merge result: none
+- Linked issue status: open (live fetch proof: gitea_view_issue)
+- Main checkout branch: master
+- Main checkout dirty state: clean
+- Main checkout updated: false
+- File edits by reviewer: none
+- Worktree/index mutations: none
+- Git ref mutations: none
+- MCP/Gitea mutations: none
+- Review mutations: none
+- Merge mutations: none
+- Cleanup mutations: none
+- External-state mutations: none
+- Read-only diagnostics: gitea_view_pr, gitea_get_runtime_context
+- Blockers: runtime bound to a foreign task worktree; mutation prohibited
+- Current status: stopped before validation began
+- Next actor: operator
+- Next action: repair the runtime workspace binding, then rerun the full
+  review workflow in a fresh reviewer session
+- Next prompt: Act as REVIEWER for PR 701 after the operator repairs the
+  runtime binding; acquire the lease before any validation.
+- Safe next action: operator repairs runtime binding, then a fresh reviewer
+  reruns the full workflow
+- Safety statement: no lease acquired; no verdict recorded; no source edits
+- Workflow-load helper result: workflow_hash=da045d1e1f1f boundary_status=clean
+"""
+
+
+class TestActionLogRobustness(unittest.TestCase):
+    """#698 original lead: non-dict action_log must not crash validation."""
+
+    MALFORMED = [
+        "git fetch prgs",
+        42,
+        None,
+        {"action": "edit", "path": "x.py", "performed": True, "tracked": True},
+    ]
+
+    def test_assess_final_report_validator_survives_malformed_entries(self):
+        result = frv.assess_final_report_validator(
+            _pr703_style_report(),
+            "review_pr",
+            action_log=self.MALFORMED,
+        )
+        self.assertIsInstance(result, dict)
+        rule_ids = {f["rule_id"] for f in result["findings"]}
+        self.assertIn("shared.action_log_malformed", rule_ids)
+
+    def test_malformed_entry_errors_are_sanitized(self):
+        _entries, findings = frv.sanitize_action_log(["secret-token-abc123"])
+        self.assertEqual(len(findings), 1)
+        reason = findings[0]["reason"]
+        self.assertNotIn("secret-token-abc123", reason)
+        self.assertIn("str", reason)
+        self.assertIn("entry 0", reason)
+
+    def test_non_list_action_log_is_reported_not_raised(self):
+        entries, findings = frv.sanitize_action_log("not-a-list")
+        self.assertEqual(entries, [])
+        self.assertEqual(len(findings), 1)
+        self.assertIn("not a list", findings[0]["reason"])
+
+    def test_performed_file_mutations_skips_non_dict_entries(self):
+        performed = rp._performed_file_mutations(
+            ["oops", {"action": "edited", "path": "a.py"}]
+        )
+        self.assertEqual(len(performed), 1)
+        self.assertEqual(performed[0]["path"], "a.py")
+
+    def test_schema_entrypoint_survives_string_only_log(self):
+        result = assess_review_final_report_schema(
+            _pr703_style_report(),
+            action_log=["just a string", "another string"],
+        )
+        self.assertIsInstance(result, dict)
+
+
+class TestLegacyFieldRequirementsRemoved(unittest.TestCase):
+    """#698: prohibited legacy fields must not be REQUIRED of reports."""
+
+    PROHIBITED = (
+        "Pinned reviewed head",
+        "Scratch worktree used",
+        "Worktree path",
+        "Worktree dirty",
+        "Workspace mutations",
+        "Mutations",
+        "Next",
+        "Issue/PR",
+        "Branch/SHA",
+        "Files changed",
+    )
+
+    def test_review_role_field_table_has_no_prohibited_requirements(self):
+        names = [name for name, _ in rp.HANDOFF_ROLE_FIELDS["review"]]
+        for prohibited in ("Pinned reviewed head", "Scratch worktree used",
+                           "Worktree path", "Worktree dirty"):
+            self.assertNotIn(prohibited, names)
+
+    def test_merger_role_field_table_has_no_pinned_reviewed_head(self):
+        names = [name for name, _ in rp.HANDOFF_ROLE_FIELDS["merger"]]
+        self.assertNotIn("Pinned reviewed head", names)
+
+    def test_canonical_report_missing_fields_never_include_prohibited(self):
+        result = rp.assess_controller_handoff(
+            _pr703_style_report(), role="review"
+        )
+        for prohibited in self.PROHIBITED:
+            self.assertNotIn(prohibited, result.get("missing_fields") or [])
+
+    def test_canonical_pr703_report_satisfies_required_fields(self):
+        result = rp.assess_controller_handoff(
+            _pr703_style_report(), role="review"
+        )
+        self.assertEqual(result.get("missing_fields") or [], [])
+        self.assertEqual(result.get("verdict"), "complete")
+
+
+class TestBlockedReportAccepted(unittest.TestCase):
+    """#698: blocked run with no reviewed head / verdict is legitimate."""
+
+    def test_stale_head_proof_waived_before_validation(self):
+        result = pwl.assess_reviewer_stale_head_final_report(
+            _blocked_preflight_report()
+        )
+        self.assertTrue(result["proven"])
+        self.assertEqual(result.get("phase"), "blocked_before_validation")
+
+    def test_blocked_report_passes_schema_validation(self):
+        result = assess_review_final_report_schema(_blocked_preflight_report())
+        blocking = [
+            f for f in result["findings"] if f["severity"] == "block"
+        ]
+        self.assertEqual(blocking, [], blocking)
+
+    def test_verdict_phase_still_demands_approval_head_proof(self):
+        report = _blocked_preflight_report().replace(
+            "- Review decision: none",
+            "- Review decision: approve",
+        ).replace(
+            "- Candidate head SHA: none",
+            f"- Candidate head SHA: {REVIEWED_HEAD}",
+        )
+        result = pwl.assess_reviewer_stale_head_final_report(report)
+        self.assertFalse(result["proven"])
+        joined = " ".join(result["reasons"])
+        self.assertIn("before approval", joined)
+
+    def test_merge_phase_still_demands_merge_head_proof(self):
+        report = _pr703_style_report().replace(
+            "- Merge result: none",
+            "- Merge result: merged",
+        )
+        result = pwl.assess_reviewer_stale_head_final_report(report)
+        self.assertFalse(result["proven"])
+        self.assertIn(
+            "final live head SHA before merge not stated",
+            result["reasons"],
+        )
+
+    def test_validation_phase_demands_push_disclosure(self):
+        report = _pr703_style_report().replace(
+            "- Pushes occurred during validation: no\n", ""
+        )
+        result = pwl.assess_reviewer_stale_head_final_report(report)
+        self.assertFalse(result["proven"])
+        self.assertIn(
+            "whether push occurred during validation not stated",
+            result["reasons"],
+        )
+
+
+class TestLeaseReleaseVsPostMergeCleanup(unittest.TestCase):
+    """#698 (PR #703 review reproduction): lease release is not cleanup."""
+
+    def test_lease_release_cleanup_mutations_do_not_demand_checklist(self):
+        result = pmcp.assess_post_merge_cleanup_proof(_pr703_style_report())
+        self.assertFalse(result["block"], result["reasons"])
+
+    def test_release_tool_name_alone_is_recognized(self):
+        report = _pr703_style_report(
+            cleanup_mutations="gitea_release_reviewer_pr_lease comment 11244"
+        )
+        result = pmcp.assess_post_merge_cleanup_proof(report)
+        self.assertFalse(result["block"], result["reasons"])
+
+    def test_substantive_non_lease_cleanup_still_demands_checklist(self):
+        report = _pr703_style_report(
+            cleanup_mutations="deleted stale scratch directory manually"
+        )
+        result = pmcp.assess_post_merge_cleanup_proof(report)
+        self.assertTrue(result["block"])
+
+    def test_remote_branch_delete_claims_still_demand_full_proof(self):
+        report = _pr703_style_report(
+            cleanup_mutations="gitea_delete_branch removed the remote branch"
+        )
+        result = pmcp.assess_post_merge_cleanup_proof(report)
+        self.assertTrue(result["block"])
+        self.assertTrue(
+            any("remote branch deletion missing" in r for r in result["reasons"])
+        )
+
+    def test_full_schema_run_accepts_lease_release_report(self):
+        result = assess_review_final_report_schema(_pr703_style_report())
+        lease_cleanup_blocks = [
+            f for f in result["findings"]
+            if f["rule_id"] == "reviewer.post_merge_cleanup_proof"
+        ]
+        self.assertEqual(lease_cleanup_blocks, [], lease_cleanup_blocks)
+
+
+class TestStructuredProofRecognition(unittest.TestCase):
+    """#698: structured workflow-load and validation proof must be accepted."""
+
+    def test_key_value_workflow_proof_recognized(self):
+        findings = frv._rule_reviewer_workflow_load_boundary(
+            _pr703_style_report()
+        )
+        self.assertEqual(findings, [], findings)
+
+    def test_colon_form_workflow_proof_still_recognized(self):
+        report = _pr703_style_report().replace(
+            "- Workflow-load helper result: workflow_hash=da045d1e1f1f "
+            "boundary_status=clean",
+            "- Workflow-load helper result: workflow_hash: da045d1e1f1f, "
+            "boundary_status: clean",
+        )
+        findings = frv._rule_reviewer_workflow_load_boundary(report)
+        self.assertEqual(findings, [], findings)
+
+    def test_incomplete_structured_proof_still_blocks(self):
+        report = _pr703_style_report().replace(
+            "workflow_hash=da045d1e1f1f boundary_status=clean",
+            "workflow_hash=da045d1e1f1f",
+        )
+        findings = frv._rule_reviewer_workflow_load_boundary(report)
+        self.assertTrue(findings)
+        self.assertIn("boundary_status", findings[0]["reason"])
+
+    def test_validation_counts_accepted_as_pass_proof(self):
+        # "Validation: focused 50 passed; ..." must satisfy the reviewed-head
+        # validation-proof rule (PR #703 reproduction).
+        result = assess_review_final_report_schema(_pr703_style_report())
+        head_blocks = [
+            f for f in result["findings"]
+            if f["rule_id"] == "reviewer.reviewed_head_without_validation"
+        ]
+        self.assertEqual(head_blocks, [], head_blocks)
+
+
+class TestAuthoritativeMutationInference(unittest.TestCase):
+    """#698: review mutations inferred only from authoritative evidence."""
+
+    def test_read_only_entries_do_not_imply_mutations(self):
+        report = "## Controller Handoff\n- Mutations: none\n"
+        findings = frv._rule_reviewer_vague_mutations_none(
+            report,
+            action_log=[
+                {"action": "gitea_view_pr"},
+                {"action": "gitea_get_pr_review_feedback", "performed": False},
+            ],
+        )
+        self.assertEqual(findings, [], findings)
+
+    def test_performed_mutation_still_blocks_vague_none(self):
+        report = "## Controller Handoff\n- Mutations: none\n"
+        findings = frv._rule_reviewer_vague_mutations_none(
+            report,
+            action_log=[{"action": "edit", "path": "a.py", "performed": True}],
+        )
+        self.assertTrue(findings)
+
+    def test_gated_rejection_is_not_a_mutation(self):
+        report = "## Controller Handoff\n- Mutations: none\n"
+        findings = frv._rule_reviewer_vague_mutations_none(
+            report,
+            action_log=[
+                {"action": "edit", "path": "a.py", "performed": True,
+                 "gated_rejected": True},
+            ],
+        )
+        self.assertEqual(findings, [], findings)
+
+
+class TestValidatorRuleErrorContainment(unittest.TestCase):
+    """#698: a defective rule fails closed with a sanitized error."""
+
+    def test_rule_exception_becomes_sanitized_block_finding(self):
+        def _boom(report_text):
+            raise ValueError("raw secret detail that must not leak")
+
+        original = frv._RULES_BY_TASK["review_pr"]
+        frv._RULES_BY_TASK["review_pr"] = [_boom]
+        try:
+            result = frv.assess_final_report_validator(
+                "report body", "review_pr"
+            )
+        finally:
+            frv._RULES_BY_TASK["review_pr"] = original
+        self.assertTrue(result["blocked"])
+        finding = next(
+            f for f in result["findings"]
+            if f["rule_id"] == "shared.validator_rule_error"
+        )
+        self.assertNotIn("raw secret detail", finding["reason"])
+        self.assertIn("ValueError", finding["reason"])
+        self.assertIn("_boom", finding["reason"])
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,499 @@
+"""#720: Expired old-head KIND_DECISION_LOCK must not block fresh review.
+
+Reproduction shape (PR #616):
+  * REQUEST_CHANGES terminal at head A
+  * open PR advanced to head B
+  * durable decision lock age > default 4h TTL
+  * fresh_review_on_current_head_allowed is true but unreachable under TTL-first reject
+  * mark_final fails with "session state expired after 4h"
+  * assessment may report "no lock" while the file remains on disk
+
+Security invariants preserved:
+  * same-head second terminal remains fail-closed (#332/#620)
+  * REQUEST_CHANGES is never treated as approval
+  * historical mutations remain on the ledger
+  * merged/closed moot cleanup still allowed (#594)
+  * irrecoverable provenance still requires #709 authorization
+  * ordinary profiles do not gain gitea.decision_lock.irrecoverable_recovery
+"""
+
+from __future__ import annotations
+
+import os
+import tempfile
+import unittest
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from unittest.mock import patch
+
+import sys
+
+ROOT = str(Path(__file__).resolve().parent.parent)
+if ROOT not in sys.path:
+    sys.path.insert(0, ROOT)
+
+import mcp_session_state as ss
+import mcp_server
+import stale_review_decision_lock as srdl
+import task_capability_map
+
+HEAD_A = "a0fffae576673ba7df7456b32e6aec916581bdfb"
+HEAD_B = "a6a2243aad9c3e385fc70509f4941a0f0ec33162"
+HEAD_SAME = HEAD_A
+
+RC_616_A = {
+    "pr_number": 616,
+    "action": "request_changes",
+    "review_id": 443,
+    "review_state": "request_changes",
+    "head_sha": HEAD_A,
+}
+
+
+def _lock(mutations=None, **kwargs):
+    base = {
+        "task": "review_pr",
+        "kind": ss.KIND_DECISION_LOCK,
+        "remote": "prgs",
+        "org": "Scaled-Tech-Consulting",
+        "repo": "Gitea-Tools",
+        "session_pid": os.getpid(),
+        "session_profile": "prgs-reviewer",
+        "session_profile_lock": "prgs-reviewer",
+        "profile_identity": "prgs-reviewer",
+        "final_review_decision_ready": False,
+        "ready_pr_number": kwargs.get("ready_pr"),
+        "ready_action": kwargs.get("ready_action"),
+        "ready_expected_head_sha": kwargs.get("ready_head"),
+        "ready_remote": "prgs" if kwargs.get("ready_pr") else None,
+        "ready_org": "Scaled-Tech-Consulting" if kwargs.get("ready_pr") else None,
+        "ready_repo": "Gitea-Tools" if kwargs.get("ready_pr") else None,
+        "live_mutations": list(mutations or []),
+        "correction_authorized": False,
+        "correction_reason": None,
+    }
+    return base
+
+
+def _open_pr(pr_number=616, head=HEAD_B, merged=False, closed=False):
+    state = "closed" if closed or merged else "open"
+    return {
+        "number": pr_number,
+        "state": state,
+        "merged": merged,
+        "merged_at": "2026-07-16T12:00:00Z" if merged else None,
+        "merge_commit_sha": "m" * 40 if merged else None,
+        "head": {"sha": head},
+    }
+
+
+def _no_lease():
+    return {"block": False, "reasons": [], "mutation_allowed": True}
+
+
+def _feedback(blocking=False, stale=True):
+    return {
+        "success": True,
+        "has_blocking_change_requests": blocking,
+        "review_feedback_stale": stale,
+        "current_head_sha": HEAD_B,
+    }
+
+
+def _age_lock_payload(lock: dict, hours: float = 5.0) -> dict:
+    """Rewrite timestamps to *hours* ago (simulates durable age without touching prod)."""
+    aged = (datetime.now(timezone.utc) - timedelta(hours=hours)).isoformat().replace(
+        "+00:00", "Z"
+    )
+    out = dict(lock)
+    out["recorded_at"] = aged
+    out["updated_at"] = aged
+    return out
+
+
+class TestIssue720ExpiredDecisionLockLifecycle(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.env = patch.dict(
+            os.environ,
+            {
+                ss.STATE_DIR_ENV: self._tmp.name,
+                ss.SESSION_PROFILE_LOCK_ENV: "prgs-reviewer",
+                "GITEA_MCP_PROFILE": "prgs-reviewer",
+                "GITEA_PROFILE_NAME": "prgs-reviewer",
+            },
+            clear=False,
+        )
+        self.env.start()
+        mcp_server._REVIEW_DECISION_LOCK = None
+        import review_workflow_load
+
+        review_workflow_load.clear_review_workflow_load()
+        review_workflow_load.record_review_workflow_load(mcp_server.PROJECT_ROOT)
+        mcp_server.gitea_load_review_workflow()
+
+    def tearDown(self):
+        mcp_server._REVIEW_DECISION_LOCK = None
+        import review_workflow_load
+
+        review_workflow_load.clear_review_workflow_load()
+        self.env.stop()
+        self._tmp.cleanup()
+
+    def _persist_aged_lock(self, mutations, hours: float = 5.0, **kwargs):
+        """Write decision lock aged > TTL to the temp durable store (test-only)."""
+        payload = _age_lock_payload(_lock(mutations, **kwargs), hours=hours)
+        saved = ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=payload,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity="prgs-reviewer",
+        )
+        # save_state refreshes updated_at; re-age the on-disk envelope for TTL tests.
+        path = ss.state_file_path(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        aged = (datetime.now(timezone.utc) - timedelta(hours=hours)).isoformat().replace(
+            "+00:00", "Z"
+        )
+        import json
+
+        with open(path, encoding="utf-8") as fh:
+            envelope = json.load(fh)
+        envelope["recorded_at"] = aged
+        envelope["updated_at"] = aged
+        if isinstance(envelope.get("payload"), dict):
+            envelope["payload"]["recorded_at"] = aged
+            envelope["payload"]["updated_at"] = aged
+        with open(path, "w", encoding="utf-8") as fh:
+            json.dump(envelope, fh, indent=2, sort_keys=True)
+            fh.write("\n")
+        # Drop memory so subsequent loads hit durable store.
+        mcp_server._REVIEW_DECISION_LOCK = None
+        return saved
+
+    def _mark(self, pr, action, head, feedback=None):
+        with patch("mcp_server._list_pr_lease_comments", return_value=[]), patch(
+            "mcp_server._pr_work_lease_reviewer_block", return_value=_no_lease()
+        ), patch.object(
+            mcp_server,
+            "gitea_get_pr_review_feedback",
+            return_value=feedback or _feedback(blocking=False, stale=True),
+        ), patch.object(
+            mcp_server,
+            "gitea_check_pr_eligibility",
+            return_value={"eligible": True, "head_sha": head},
+        ), patch.object(
+            mcp_server.mcp_daemon_guard,
+            "assert_sanctioned_mutation_runtime",
+            return_value=None,
+        ), patch.object(
+            mcp_server.mcp_daemon_guard,
+            "assert_no_direct_import_bypass",
+            return_value=None,
+        ):
+            return mcp_server.gitea_mark_final_review_decision(
+                pr_number=pr,
+                action=action,
+                expected_head_sha=head,
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+            )
+
+    # --- AC regression matrix ---
+
+    def test_under_four_hours_fresh_review_at_b_allowed(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=1.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        res = self._mark(616, "approve", HEAD_B)
+        self.assertTrue(res.get("marked_ready"), res)
+
+    def test_over_four_hours_fresh_review_at_b_still_allowed(self):
+        """Primary #720 defect: age > TTL must not block head-B mark_final."""
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        # Prove durable load is possible for recovery-critical decision locks.
+        loaded = ss.load_state(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+        )
+        self.assertIsNotNone(
+            loaded,
+            "expired KIND_DECISION_LOCK must remain loadable (not generic TTL cache)",
+        )
+        res = self._mark(616, "approve", HEAD_B)
+        self.assertTrue(
+            res.get("marked_ready"),
+            f"expected mark_ready on head B after >4h; got {res}",
+        )
+        reasons = " ".join(res.get("reasons") or [])
+        self.assertNotIn("session state expired", reasons)
+
+    def test_historical_review_at_a_preserved_and_stale(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        res = self._mark(616, "approve", HEAD_B)
+        self.assertTrue(res.get("marked_ready"), res)
+        lock = mcp_server._load_review_decision_lock()
+        self.assertIsNotNone(lock)
+        hist = [m for m in lock["live_mutations"] if m.get("review_id") == 443]
+        self.assertEqual(len(hist), 1)
+        self.assertEqual(hist[0]["head_sha"], HEAD_A)
+        self.assertEqual(hist[0]["action"], "request_changes")
+        a = srdl.assess_stale_review_decision_lock(
+            lock, pr_live=_open_pr(616, HEAD_B)
+        )
+        self.assertTrue(a["stale_by_head"])
+        self.assertTrue(a["fresh_review_on_current_head_allowed"])
+        self.assertEqual(a["locked_head_sha"], HEAD_A)
+
+    def test_no_reuse_approval_from_head_a(self):
+        """REQUEST_CHANGES at A is never an approval credential for B."""
+        self._persist_aged_lock([RC_616_A], hours=5.0)
+        lock = ss.load_state(
+            kind=ss.KIND_DECISION_LOCK, profile_identity="prgs-reviewer"
+        )
+        last = srdl.last_terminal_mutation(lock)
+        self.assertEqual(last.get("action"), "request_changes")
+        self.assertNotEqual(last.get("action"), "approve")
+        # Gate must still require a new mark/submit for head B; prior RC is not approve.
+        reasons = mcp_server.terminal_review_hard_stop_reasons(
+            616, "mark_ready", expected_head_sha=HEAD_B
+        )
+        self.assertEqual(reasons, [])
+
+    def test_second_terminal_mutation_at_b_same_run_blocked(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        res = self._mark(616, "approve", HEAD_B)
+        self.assertTrue(res.get("marked_ready"), res)
+        # Record terminal approve at B (same run).
+        lock = mcp_server._load_review_decision_lock()
+        lock["final_review_decision_ready"] = True
+        lock["ready_pr_number"] = 616
+        lock["ready_action"] = "approve"
+        lock["ready_expected_head_sha"] = HEAD_B
+        mcp_server._save_review_decision_lock(lock)
+        mcp_server.record_live_review_mutation(616, "approve", review_id=999)
+        # Second terminal at same head B must hard-stop.
+        hard = mcp_server.terminal_review_hard_stop_reasons(
+            616, "mark_ready", expected_head_sha=HEAD_B
+        )
+        self.assertTrue(hard)
+        res2 = self._mark(616, "approve", HEAD_B)
+        self.assertFalse(res2.get("marked_ready"))
+
+    def test_open_pr_same_head_expired_still_fail_closed(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        res = self._mark(616, "approve", HEAD_SAME)
+        self.assertFalse(res.get("marked_ready"), res)
+        self.assertTrue(
+            any("#332" in r or "already consumed" in r for r in (res.get("reasons") or [])),
+            res,
+        )
+
+    def test_merged_pr_moot_cleanup_still_allowed(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        lock = ss.load_state(
+            kind=ss.KIND_DECISION_LOCK, profile_identity="prgs-reviewer"
+        )
+        a = srdl.assess_stale_review_decision_lock(
+            lock, pr_live=_open_pr(616, HEAD_A, merged=True)
+        )
+        self.assertTrue(a["is_moot"])
+        self.assertTrue(a["cleanup_allowed"])
+        self.assertFalse(a["fresh_review_on_current_head_allowed"])
+
+    def test_assessment_reports_expired_old_head_not_absent(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        # Disk presence + load after lifecycle fix.
+        path = ss.state_file_path(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        self.assertTrue(os.path.exists(path))
+        loaded = ss.load_state(
+            kind=ss.KIND_DECISION_LOCK, profile_identity="prgs-reviewer"
+        )
+        self.assertIsNotNone(loaded)
+        inspect = ss.inspect_state_envelope(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        self.assertTrue(inspect.get("on_disk"))
+        self.assertTrue(inspect.get("has_payload"))
+        self.assertTrue(inspect.get("recovery_critical") or inspect.get("ttl_exempt"))
+        self.assertTrue(inspect.get("age_hours", 0) >= 4.0)
+        a = srdl.assess_stale_review_decision_lock(
+            loaded, pr_live=_open_pr(616, HEAD_B)
+        )
+        self.assertTrue(a["has_lock"])
+        self.assertNotIn("no review decision lock present", " ".join(a["reasons"]))
+        self.assertTrue(a["stale_by_head"])
+        self.assertEqual(a["last_terminal_action"], "request_changes")
+
+    def test_existing_serialized_records_compatible(self):
+        """Pre-fix ledgers without recovery_critical flag still load via kind."""
+        payload = _age_lock_payload(_lock([RC_616_A]), hours=8.0)
+        payload.pop("recovery_critical", None)
+        # Manually write pre-#720-shaped envelope (kind only on envelope).
+        path = ss.state_file_path(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        import json
+
+        os.makedirs(self._tmp.name, exist_ok=True)
+        aged = payload["recorded_at"]
+        envelope = {
+            "kind": ss.KIND_DECISION_LOCK,
+            "remote": "prgs",
+            "org": "Scaled-Tech-Consulting",
+            "repo": "Gitea-Tools",
+            "profile_identity": "prgs-reviewer",
+            "session_profile_lock": "prgs-reviewer",
+            "recorded_at": aged,
+            "updated_at": aged,
+            "writer_pid": os.getpid(),
+            "payload": payload,
+        }
+        with open(path, "w", encoding="utf-8") as fh:
+            json.dump(envelope, fh, indent=2, sort_keys=True)
+            fh.write("\n")
+        loaded = ss.load_state(
+            kind=ss.KIND_DECISION_LOCK, profile_identity="prgs-reviewer"
+        )
+        self.assertIsNotNone(loaded)
+        self.assertEqual(loaded["live_mutations"][0]["review_id"], 443)
+
+    def test_decision_lock_is_recovery_critical_kind(self):
+        self.assertIn(ss.KIND_DECISION_LOCK, ss.RECOVERY_CRITICAL_KINDS)
+
+    def test_workflow_load_still_ttl_expires(self):
+        """Do not make every session-state kind permanently TTL-exempt."""
+        aged = (datetime.now(timezone.utc) - timedelta(hours=5)).isoformat().replace(
+            "+00:00", "Z"
+        )
+        rec = {
+            "kind": ss.KIND_WORKFLOW_LOAD,
+            "recorded_at": aged,
+            "updated_at": aged,
+            "profile_identity": "prgs-reviewer",
+            "session_profile_lock": "prgs-reviewer",
+        }
+        reasons = ss.identity_match_reasons(
+            rec, profile_identity="prgs-reviewer"
+        )
+        self.assertTrue(any("expired" in r for r in reasons), reasons)
+
+    def test_irrecoverable_permission_not_on_ordinary_profiles(self):
+        perm = "gitea.decision_lock.irrecoverable_recovery"
+        # Capability map must not map ordinary author/reviewer/merger tasks to it.
+        for task in (
+            "create_issue",
+            "comment_issue",
+            "review_pr",
+            "merge_pr",
+            "lock_issue",
+            "create_pr",
+        ):
+            req = task_capability_map.required_permission(task)
+            self.assertNotEqual(req, perm, msg=task)
+
+    def test_structured_error_when_same_head_expired(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        res = self._mark(616, "approve", HEAD_A)
+        self.assertFalse(res.get("marked_ready"))
+        reasons = res.get("reasons") or []
+        self.assertTrue(reasons)
+        blob = " ".join(reasons)
+        # Actionable recovery text from hard-stop (not generic internal_error).
+        self.assertIn("#332", blob)
+        self.assertTrue(
+            "#620" in blob or "head moved" in blob or "new expected_head_sha" in blob
+            or "already consumed" in blob
+        )
+        self.assertNotIn("internal_error", blob.lower())
+
+
+class TestIssue720InspectEnvelope(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.env = patch.dict(
+            os.environ,
+            {
+                ss.STATE_DIR_ENV: self._tmp.name,
+                ss.SESSION_PROFILE_LOCK_ENV: "prgs-reviewer",
+            },
+            clear=False,
+        )
+        self.env.start()
+
+    def tearDown(self):
+        self.env.stop()
+        self._tmp.cleanup()
+
+    def test_inspect_missing_file(self):
+        info = ss.inspect_state_envelope(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        self.assertFalse(info["on_disk"])
+        self.assertFalse(info["has_payload"])
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -1,4 +1,4 @@
-"""Tests for sanctioned MCP daemon guards (#558)."""
+"""Tests for sanctioned MCP daemon guards (#558 / #695)."""

 from __future__ import annotations

@@ -11,6 +11,10 @@ import gitea_auth


 class TestMcpDaemonGuard(unittest.TestCase):
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+
    def test_unsanctioned_blocks_mutation_runtime(self):
        env = {k: v for k, v in os.environ.items() if k not in {
            mcp_daemon_guard.SANCTIONED_DAEMON_ENV,
@@ -26,11 +30,35 @@ class TestMcpDaemonGuard(unittest.TestCase):
        # Running under pytest already sets PYTEST_CURRENT_TEST.
        mcp_daemon_guard.assert_sanctioned_mutation_runtime("pytest")

-    def test_mark_sanctioned_allows(self):
-        env = {k: v for k, v in os.environ.items() if k != "PYTEST_CURRENT_TEST"}
+    def test_test_native_runtime_install_under_pytest(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        mcp_daemon_guard.install_test_native_runtime()
+        self.assertTrue(mcp_daemon_guard.is_native_mcp_transport())
+        self.assertFalse(mcp_daemon_guard.is_production_native_mcp_transport())
+        # Hermetic unit path still passes under pytest.
+        mcp_daemon_guard.assert_sanctioned_mutation_runtime("daemon")
+        # Production mutation gate rejects test-mode records.
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.assert_production_mutation_runtime("gitea_mutation")
+        self.assertIn("Test-mode", str(ctx.exception))
+
+    def test_env_alone_insufficient_when_force_unsanctioned(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        env = {
+            k: v
+            for k, v in os.environ.items()
+            if k not in {
+                mcp_daemon_guard.SANCTIONED_DAEMON_ENV,
+                mcp_daemon_guard.ALLOW_DIRECT_IMPORT_ENV,
+                "PYTEST_CURRENT_TEST",
+            }
+        }
        env[mcp_daemon_guard.SANCTIONED_DAEMON_ENV] = "1"
+        env["GITEA_TEST_FORCE_UNSANCTIONED"] = "1"
        with patch.dict(os.environ, env, clear=True):
-            mcp_daemon_guard.assert_sanctioned_mutation_runtime("daemon")
+            with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+                mcp_daemon_guard.assert_sanctioned_mutation_runtime("env-spoof")
+            self.assertIn("not sufficient", str(ctx.exception))

    def test_keychain_blocked_without_sanction(self):
        env = {
@@ -65,6 +93,11 @@ class TestMcpDaemonGuard(unittest.TestCase):
            with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
                gitea_auth.get_auth_header("gitea.prgs.cc")

+    def test_no_allow_test_bootstrap_public_parameter(self):
+        """Production mark must not accept allow_test_bootstrap (#695)."""
+        sig = __import__("inspect").signature(mcp_daemon_guard.mark_sanctioned_daemon)
+        self.assertNotIn("allow_test_bootstrap", sig.parameters)
+

 if __name__ == "__main__":
    unittest.main()
@@ -836,16 +836,24 @@ class TestMergePR(unittest.TestCase):
            )

    def _feedback_reads(self, author="author-bot", sha="abc123"):
-        """PR + reviews GETs for gitea_get_pr_review_feedback during merge."""
+        """PR + reviews GETs for one gitea_get_pr_review_feedback call."""
        return [self._pr(author, sha=sha), _visible_approval_reviews(sha=sha)]

+    def _eligibility_merge_reads(self, author="author-bot", sha="abc123"):
+        """Eligibility user/PR plus #695 merge-approval feedback PR+reviews."""
+        return [
+            {"login": "merger-bot"},
+            self._pr(author, sha=sha),
+            *self._feedback_reads(author=author, sha=sha),
+        ]
+
    # -- success --------------------------------------------------------------

    @patch("mcp_server.api_request")
    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
    def test_merge_succeeds_when_all_gates_pass(self, _auth, mock_api):
        mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
            *self._feedback_reads(),
            {},  # merge POST
            {"merged_commit_sha": "mergecommit99"},  # read-back
@@ -864,7 +872,7 @@ class TestMergePR(unittest.TestCase):
        self.assertEqual(r["merge_method"], "squash")
        self.assertEqual(r["merge_commit"], "mergecommit99")
        # 5th call is the merge POST with the requested method/title/message.
-        merge_call = mock_api.call_args_list[4]
+        merge_call = mock_api.call_args_list[6]
        self.assertEqual(merge_call.args[0], "POST")
        self.assertTrue(merge_call.args[1].endswith("/pulls/8/merge"))
        payload = merge_call.args[3]
@@ -877,7 +885,7 @@ class TestMergePR(unittest.TestCase):
    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
    def test_expected_changed_files_match_allows(self, _auth, mock_api):
        mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
            [{"filename": "a.py"}, {"filename": "b.py"}],  # files
            *self._feedback_reads(),
            {},  # merge POST
@@ -899,7 +907,7 @@ class TestMergePR(unittest.TestCase):
    def test_readback_failure_reports_skipped_cleanup(self, _auth, mock_api):
        """Merge OK + read-back GET failure => explicit cleanup skip, not silence."""
        mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
            *self._feedback_reads(),
            {},  # merge POST
            RuntimeError("HTTP 502: Gitea upstream unavailable"),  # read-back fails
@@ -919,7 +927,7 @@ class TestMergePR(unittest.TestCase):
        self.assertEqual(r["cleanup_status"], "skipped (merge read-back failed)")
        # No tracker-cleanup API traffic after the failed read-back:
        # user, PR (eligibility), feedback PR+reviews, merge POST, read-back.
-        self.assertEqual(mock_api.call_count, 6)
+        self.assertEqual(mock_api.call_count, 8)
        for c in mock_api.call_args_list:
            self.assertNotEqual(c.args[0], "DELETE")

@@ -930,7 +938,7 @@ class TestMergePR(unittest.TestCase):
    def test_cleanup_exception_surfaced_and_redacted(self, _auth, mock_api, _cleanup):
        """Unexpected cleanup exception => merge still succeeds; error surfaced redacted."""
        mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
            *self._feedback_reads(),
            {},  # merge POST
            {"merged_commit_sha": "c9"},  # read-back OK
@@ -1142,8 +1150,10 @@ class TestMergePR(unittest.TestCase):
    @patch("mcp_server.api_request")
    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
    def test_head_sha_mismatch_blocks(self, _auth, mock_api):
+        # Eligibility (#695) needs approval feedback before head-gate runs.
        mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot", sha="abc123")]
+            *self._eligibility_merge_reads(sha="abc123"),
+        ]
        env = {"GITEA_PROFILE_NAME": "gitea-merger",
               "GITEA_ALLOWED_OPERATIONS": "read,merge"}
        with patch.dict(os.environ, env, clear=True):
@@ -1162,7 +1172,7 @@ class TestMergePR(unittest.TestCase):
    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
    def test_changed_files_mismatch_blocks(self, _auth, mock_api):
        mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
            [{"filename": "a.py"}, {"filename": "c.py"}],  # actual files
        ]
        env = {"GITEA_PROFILE_NAME": "gitea-merger",
@@ -1193,7 +1203,7 @@ class TestMergePR(unittest.TestCase):
    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
    def test_output_redacts_secrets(self, _auth, mock_api):
        mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
            *self._feedback_reads(),
            {}, {"merged_commit_sha": "c1"},
        ]
@@ -1213,7 +1223,7 @@ class TestMergePR(unittest.TestCase):
    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
    def test_merge_error_message_redacts_credential(self, _auth, mock_api):
        mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
            *self._feedback_reads(),
            RuntimeError("HTTP 500: token abc-secret-xyz rejected"),
        ]
@@ -1234,6 +1244,7 @@ class TestMergePR(unittest.TestCase):
    def test_merge_blocked_on_stale_approval_head(self, _auth, mock_api):
        old_sha = "8b61c4b41f1b49b271ed3b99657431cf06eeda3e"
        new_sha = "3e4b721d60e97147ba0704773cf57cd0d42cbe31"
+        # #695: eligibility itself now fails closed on stale approval head.
        mock_api.side_effect = [
            {"login": "merger-bot"}, self._pr("author-bot", sha=new_sha),
            self._pr("author-bot", sha=new_sha),
@@ -1256,6 +1267,7 @@ class TestMergePR(unittest.TestCase):
    @patch("mcp_server.api_request")
    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
    def test_merge_blocked_without_visible_approval(self, _auth, mock_api):
+        # #695: eligibility denies merge when no non-quarantined APPROVED review.
        mock_api.side_effect = [
            {"login": "merger-bot"}, self._pr("author-bot"),
            self._pr("author-bot"),
@@ -1270,12 +1282,21 @@ class TestMergePR(unittest.TestCase):
            )
        self.assertFalse(r["performed"])
        self.assertFalse(r.get("approval_visible"))
-        self.assertTrue(any("no visible APPROVED review" in x for x in r["reasons"]))
+        self.assertTrue(
+            any(
+                "no non-quarantined APPROVED review" in x
+                or "no visible APPROVED review" in x
+                or "merge eligibility denied" in x
+                for x in r["reasons"]
+            ),
+            msg=r["reasons"],
+        )
        self._assert_no_merge_call(mock_api)

    @patch("mcp_server.api_request")
    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
    def test_merge_blocked_on_request_changes(self, _auth, mock_api):
+        # #695: eligibility denies merge on undismissed REQUEST_CHANGES.
        mock_api.side_effect = [
            {"login": "merger-bot"}, self._pr("author-bot"),
            self._pr("author-bot"),
@@ -1425,10 +1446,16 @@ class TestReviewPR(unittest.TestCase):
 class TestDeleteBranch(unittest.TestCase):

    DELETE_PROFILE = {
-        "profile_name": "test-deleter",
-        "allowed_operations": ["gitea.read", "gitea.branch.delete"],
+        "profile_name": "test-author-deleter",
+        "role": "author",
+        "allowed_operations": [
+            "gitea.read",
+            "gitea.pr.create",
+            "gitea.branch.push",
+            "gitea.branch.delete",
+        ],
        "forbidden_operations": [],
-        "audit_label": "test-deleter",
+        "audit_label": "test-author-deleter",
    }

    @patch("mcp_server.get_profile", return_value=DELETE_PROFILE)
@@ -54,6 +54,26 @@ class TestMergeApprovalGate(unittest.TestCase):
        self.assertFalse(result["approval_at_current_head"])
        self.assertIsNone(result["latest_approved_head_sha"])

+    def test_quarantined_approval_void_for_merge(self):
+        """#695: contaminated formal review at head must not authorize merge."""
+        result = assess_merge_approval_head(
+            current_head_sha=HEAD_NEW,
+            latest_by_reviewer={
+                "sysadmin": {
+                    "verdict": "APPROVED",
+                    "dismissed": False,
+                    "reviewed_head_sha": HEAD_NEW,
+                    "review_id": 427,
+                    "submitted_at": "2026-07-13T07:20:00Z",
+                }
+            },
+            quarantined_review_ids={427},
+        )
+        self.assertFalse(result["approval_at_current_head"])
+        self.assertEqual(result["quarantined_approvals_at_current_head"], 1)
+        self.assertIn("quarantined", result["stale_approval_block_reason"])
+        self.assertIn("#695", result["stale_approval_block_reason"])
+

 if __name__ == "__main__":
    unittest.main()
@@ -92,14 +92,19 @@ class TestMigrateProfiles(unittest.TestCase):
        author = prgs_gitea["identities"]["author"]
        self.assertEqual(author["username"], "jcwalker3")
        self.assertEqual(author["auth"]["id"], "redacted-author-ref")
-        self.assertEqual(author["allowed_operations"], ["read", "comment"])
-        self.assertEqual(author["forbidden_operations"], ["approve", "merge"])
+        self.assertEqual(
+            author["allowed_operations"], ["gitea.read", "gitea.pr.comment"]
+        )
+        self.assertEqual(
+            author["forbidden_operations"],
+            ["gitea.pr.approve", "gitea.pr.merge"],
+        )

        reviewer = prgs_gitea["identities"]["reviewer"]
        self.assertEqual(reviewer["role"], "reviewer")
        self.assertEqual(reviewer["username"], "sysadmin")
        self.assertEqual(reviewer["auth"]["id"], "redacted-reviewer-ref")
-        self.assertIn("merge", reviewer["allowed_operations"])
+        self.assertIn("gitea.pr.merge", reviewer["allowed_operations"])

    def test_alias_generation(self):
        """Test that aliases are correctly generated to support old profile names."""
@@ -188,7 +193,7 @@ class TestMigrateProfiles(unittest.TestCase):
        self.assertNotIn("token", stdout_output.lower())

    def test_explicit_operations_are_preserved(self):
-        """Explicit v1 permissions must not be replaced by role defaults."""
+        """Explicit v1 permissions are canonicalized, not replaced by role defaults."""
        v1_data = json.loads(json.dumps(self.v1_content))
        v1_data["profiles"]["prgs-reviewer"]["allowed_operations"] = ["read"]
        v1_data["profiles"]["prgs-reviewer"]["forbidden_operations"] = ["merge"]
@@ -198,8 +203,8 @@ class TestMigrateProfiles(unittest.TestCase):
            v2_data["environments"]["prgs"]["services"]["gitea"]
            ["identities"]["reviewer"]
        )
-        self.assertEqual(reviewer["allowed_operations"], ["read"])
-        self.assertEqual(reviewer["forbidden_operations"], ["merge"])
+        self.assertEqual(reviewer["allowed_operations"], ["gitea.read"])
+        self.assertEqual(reviewer["forbidden_operations"], ["gitea.pr.merge"])

    def test_inferred_role_defaults_only_when_unambiguous(self):
        """Role defaults are allowed only for clear author/reviewer profiles."""
@@ -306,6 +311,171 @@ class TestMigrateProfiles(unittest.TestCase):
                migrate_profiles.main()
            self.assertEqual(cm.exception.code, 1)

+    def test_reconciler_profile_migration(self):
+        """Legacy reconciler shorthands migrate to valid canonical operations."""
+        import gitea_config
+        import reconciler_profile
+
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                    "allowed_operations": [
+                        "read",
+                        "pr.close",
+                        "pr.comment",
+                        "issue.comment",
+                        "issue.close",
+                        "gitea.branch.delete",
+                    ],
+                    "forbidden_operations": [
+                        "merge",
+                        "approve",
+                        "review",
+                        "pr.create",
+                        "branch.push",
+                        "commit",
+                    ],
+                }
+            }
+        }
+        v2_data = migrate_profiles.migrate_v1_to_v2(v1_data)
+        reconciler = (
+            v2_data["environments"]["prgs"]["services"]["gitea"]
+            ["identities"]["reconciler"]
+        )
+        self.assertEqual(reconciler["role"], "reconciler")
+        allowed = reconciler["allowed_operations"]
+        forbidden = reconciler["forbidden_operations"]
+        # No invalid shorthand remains
+        for bad in ("pr.close", "pr.comment", "issue.close", "read", "merge"):
+            self.assertNotIn(bad, allowed)
+            self.assertNotIn(bad, forbidden)
+        for required in (
+            "gitea.read",
+            "gitea.pr.close",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+            "gitea.issue.close",
+            "gitea.branch.delete",
+        ):
+            self.assertIn(required, allowed)
+            # Production loader accepts every allowed op
+            self.assertEqual(
+                gitea_config.normalize_operation(required), required
+            )
+        self.assertEqual(v2_data["aliases"]["prgs-reconciler"], "prgs.gitea.reconciler")
+        assessment = reconciler_profile.assess_reconciler_profile(allowed, forbidden)
+        self.assertTrue(assessment["valid"])
+        self.assertTrue(migrate_profiles.validate_v2_data(v2_data))
+
+    def test_reconciler_profile_defaults(self):
+        """Reconciler defaults are fully canonical and loader-valid."""
+        import gitea_config
+        import reconciler_profile
+
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                }
+            }
+        }
+        v2_data = migrate_profiles.migrate_v1_to_v2(v1_data)
+        reconciler = (
+            v2_data["environments"]["prgs"]["services"]["gitea"]
+            ["identities"]["reconciler"]
+        )
+        self.assertEqual(reconciler["role"], "reconciler")
+        self.assertEqual(
+            reconciler["allowed_operations"],
+            migrate_profiles.RECONCILER_DEFAULT_ALLOWED,
+        )
+        self.assertEqual(
+            reconciler["forbidden_operations"],
+            migrate_profiles.RECONCILER_DEFAULT_FORBIDDEN,
+        )
+        for op in reconciler["allowed_operations"]:
+            self.assertEqual(gitea_config.normalize_operation(op), op)
+            self.assertTrue(op.startswith("gitea."))
+        assessment = reconciler_profile.assess_reconciler_profile(
+            reconciler["allowed_operations"],
+            reconciler["forbidden_operations"],
+        )
+        self.assertTrue(assessment["valid"])
+        self.assertNotIn(
+            "gitea.branch.delete", assessment["missing_recommended_operations"]
+        )
+
+    def test_reconciler_migration_idempotent_canonicalize(self):
+        """Second canonicalize of already-canonical ops is a no-op."""
+        first = migrate_profiles.canonicalize_operations(
+            list(migrate_profiles.RECONCILER_DEFAULT_ALLOWED)
+        )
+        second = migrate_profiles.canonicalize_operations(first)
+        self.assertEqual(first, second)
+        self.assertEqual(first, list(migrate_profiles.RECONCILER_DEFAULT_ALLOWED))
+
+    def test_reconciler_missing_required_fails_visibly(self):
+        """Missing gitea.pr.close after migration fails closed (not silent drop)."""
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                    "allowed_operations": ["read", "gitea.branch.delete"],
+                    "forbidden_operations": ["merge"],
+                }
+            },
+        }
+        with self.assertRaisesRegex(ValueError, "missing required"):
+            migrate_profiles.migrate_v1_to_v2(v1_data)
+
+    def test_unknown_operation_fails_visibly(self):
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-author": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "jcwalker3",
+                    "auth": {"type": "keychain", "id": "hidden-author-ref"},
+                    "execution_profile": "prgs-author",
+                    "allowed_operations": ["read", "not.a.real.op"],
+                    "forbidden_operations": ["merge"],
+                }
+            },
+        }
+        with self.assertRaisesRegex(ValueError, "cannot be canonicalized"):
+            migrate_profiles.migrate_v1_to_v2(v1_data)
+
+    def test_role_inference_author_reviewer_merger_reconciler(self):
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-author", "prgs-author"), "author"
+        )
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-reviewer", "prgs-reviewer"),
+            "reviewer",
+        )
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-reconciler", "prgs-reconciler"),
+            "reconciler",
+        )
+        self.assertIsNone(
+            migrate_profiles.infer_role("prgs-merger", "prgs-merger")
+        )
+

 if __name__ == "__main__":
    unittest.main()
+
@@ -206,7 +206,20 @@ class TestEligibilityNormalizesOperations(unittest.TestCase):
    def test_namespaced_profile_ops_allow_legacy_action(self, _auth, mock_api):
        # JSON-config profiles carry canonical namespaced ops; the raw action
        # "merge" must still match them after normalization.
-        mock_api.side_effect = [{"login": "merger-bot"}, self._pr("author-bot")]
+        # #695: merge eligibility also loads quarantine-aware review feedback.
+        mock_api.side_effect = [
+            {"login": "merger-bot"},
+            self._pr("author-bot"),
+            self._pr("author-bot"),
+            [{
+                "id": 1,
+                "user": {"login": "reviewer-bot"},
+                "state": "APPROVED",
+                "commit_id": "abc123",
+                "submitted_at": "2026-07-06T10:00:00Z",
+                "dismissed": False,
+            }],
+        ]
        env = {"GITEA_PROFILE_NAME": "gitea-merger",
               "GITEA_ALLOWED_OPERATIONS": "gitea.read,gitea.pr.merge"}
        with patch.dict(os.environ, env, clear=True):
@@ -82,6 +82,42 @@ class TestReconcilerProfileModel(unittest.TestCase):
            "reconciler",
        )

+    def test_branch_delete_is_recommended_for_reconciler(self):
+        self.assertIn(
+            "gitea.branch.delete",
+            reconciler_profile.RECONCILER_RECOMMENDED_OPERATIONS,
+        )
+        self.assertNotIn(
+            "gitea.branch.delete",
+            reconciler_profile.RECONCILER_REQUIRED_OPERATIONS,
+        )
+
+    def test_reconciler_with_branch_delete_stays_valid(self):
+        allowed = PRGS_RECONCILER_ALLOWED + ["gitea.branch.delete"]
+        result = reconciler_profile.assess_reconciler_profile(
+            allowed,
+            PRGS_RECONCILER_FORBIDDEN,
+        )
+        self.assertTrue(result["is_reconciler_profile"])
+        self.assertTrue(result["valid"])
+        self.assertNotIn(
+            "gitea.branch.delete", result["missing_recommended_operations"]
+        )
+        self.assertEqual(
+            mcp_server._role_kind(allowed, PRGS_RECONCILER_FORBIDDEN),
+            "reconciler",
+        )
+
+    def test_reconciler_without_branch_delete_reports_missing_recommended(self):
+        result = reconciler_profile.assess_reconciler_profile(
+            PRGS_RECONCILER_ALLOWED,
+            PRGS_RECONCILER_FORBIDDEN,
+        )
+        self.assertTrue(result["valid"])
+        self.assertIn(
+            "gitea.branch.delete", result["missing_recommended_operations"]
+        )
+

 if __name__ == "__main__":
    unittest.main()
@@ -122,9 +122,11 @@ class TestApiRequestRetry(unittest.TestCase):
        sleep.assert_not_called()

    def test_non_429_error_raises_immediately(self):
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
            _call([_http_error(500, body=b"boom")])
-        self.assertIn("HTTP 500", str(ctx.exception))
+        # Fixed message only (#699) — no response body echo.
+        self.assertEqual(str(ctx.exception), "Gitea HTTP request failed")
+        self.assertEqual(ctx.exception.http_status, 500)

    def test_non_429_error_does_not_sleep(self):
        sleep = MagicMock()
@@ -171,9 +173,12 @@ class TestApiRequestRetry(unittest.TestCase):
        # max_retries=3 -> 3 sleeps, then the 4th failure raises.
        errors = [_http_error(429, retry_after="1") for _ in range(4)]
        sleep = MagicMock()
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
            _call(errors, sleep_func=sleep, max_retries=3)
-        self.assertIn("HTTP 429", str(ctx.exception))
+        # After retries are exhausted, 429 is a typed HTTP error with fixed
+        # message (#699); status metadata carries 429.
+        self.assertEqual(str(ctx.exception), "Gitea HTTP request failed")
+        self.assertEqual(ctx.exception.http_status, 429)
        self.assertEqual(sleep.call_count, 3)

    def test_no_infinite_loop_when_always_429(self):
@@ -957,17 +957,20 @@ class TestControllerHandoff(unittest.TestCase):
            if not line.startswith("- Workspace mutations:"))
        result = assess_controller_handoff(review_base, role="review")
        self.assertEqual(result["verdict"], "incomplete")
-        self.assertIn("Pinned reviewed head", result["missing_fields"])
-        self.assertIn("Worktree path", result["missing_fields"])
+        # #698: the canonical schema forbids the legacy fields, so the
+        # validator must demand the canonical names instead.
+        self.assertIn("Reviewed head SHA", result["missing_fields"])
+        self.assertIn("Review worktree path", result["missing_fields"])
        self.assertIn("Merge result", result["missing_fields"])
+        for legacy in ("Pinned reviewed head", "Scratch worktree used"):
+            self.assertNotIn(legacy, result["missing_fields"])

        complete = review_base + "\n" + "\n".join([
            "- Selected PR: #999",
            "- Reviewer eligibility: passed",
-            "- Pinned reviewed head: 0fdc8f582026b72a229d59a172c0a63ac4aaeaf9",
-            "- Worktree path: /repo/branches/review-pr-999",
-            "- Worktree dirty: no",
-            "- Scratch worktree used: yes (/repo/branches/review-pr-999)",
+            "- Reviewed head SHA: 0fdc8f582026b72a229d59a172c0a63ac4aaeaf9",
+            "- Review worktree path: /repo/branches/review-pr-999",
+            "- Review worktree dirty before validation: no",
            "- Unrelated local mutations: none",
            "- Review decision: approve",
            "- Merge result: merged",
@@ -1125,10 +1128,9 @@ class TestReviewHandoffPreciseMutationCategories(unittest.TestCase):
        "- Safety: no self-review; no self-merge; no secrets",
        "- Selected PR: #999",
        "- Reviewer eligibility: passed",
-        "- Pinned reviewed head: 0fdc8f582026b72a229d59a172c0a63ac4aaeaf9",
+        "- Reviewed head SHA: 0fdc8f582026b72a229d59a172c0a63ac4aaeaf9",
        "- Worktree path: /repo/branches/review-pr-999",
        "- Worktree dirty: no",
-        "- Scratch worktree used: yes (/repo/branches/review-pr-999)",
        "- Unrelated local mutations: none",
        "- Review decision: approve",
        "- Merge result: none",
@@ -0,0 +1,139 @@
+"""Documentation acceptance for the stable control runtime ADR (#615 / PR #616).
+
+Enforces review 443 remediation:
+
+* F1 — operator guide / runbooks cross-link the ADR (issue #615 AC2).
+* F2 — LLM sessions are not instructed to kill/restart/relaunch MCP; process
+  restart is operator-owned; ADR is the authoritative split.
+* F3 — routine post-merge master-parity staleness has a sanctioned response
+  (stop → report → operator reload → re-verify parity) and is not a full
+  promotion ledger requirement.
+"""
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+ADR = (
+    REPO_ROOT
+    / "docs"
+    / "architecture"
+    / "mcp-stable-control-runtime-policy-adr.md"
+)
+ADR_REL = "architecture/mcp-stable-control-runtime-policy-adr.md"
+ADR_BASENAME = "mcp-stable-control-runtime-policy-adr.md"
+
+CROSS_LINK_DOCS = (
+    REPO_ROOT / "docs" / "wiki" / "Operator-Guide.md",
+    REPO_ROOT / "docs" / "wiki" / "Runbooks.md",
+    REPO_ROOT / "docs" / "llm-workflow-runbooks.md",
+)
+
+
+def _read(path: Path) -> str:
+    assert path.is_file(), f"missing {path.relative_to(REPO_ROOT)}"
+    return path.read_text(encoding="utf-8")
+
+
+def test_adr_exists_with_policy_core():
+    text = _read(ADR)
+    assert text.lstrip().startswith("#"), "ADR lacks a title"
+    assert "#615" in text
+    assert "stable control runtime" in text.lower()
+    assert "2.3" in text and "2.4" in text and "2.5" in text and "2.6" in text
+
+
+def test_f1_operator_docs_cross_link_adr():
+    for path in CROSS_LINK_DOCS:
+        text = _read(path)
+        assert ADR_BASENAME in text, (
+            f"{path.relative_to(REPO_ROOT)} must cross-link {ADR_BASENAME} "
+            f"(issue #615 acceptance criterion 2)"
+        )
+
+
+def test_f1_adr_lists_cross_links_as_acceptance_not_optional_tooling():
+    text = _read(ADR)
+    # Acceptance section must require guide/runbook cross-links.
+    assert "Operator guide / runbooks cross-link" in text or (
+        "operator guide" in text.lower() and "cross-link" in text.lower()
+        and "Acceptance" in text
+    )
+    # Cross-link must not remain only as optional tooling item #4.
+    optional = text.split("## 5. Implementation follow-ups", 1)[-1].split(
+        "## 6. Acceptance", 1
+    )[0]
+    assert "Operator Guide wiki cross-link to this ADR" not in optional, (
+        "ADR §5 must not list operator-guide cross-link as optional tooling"
+    )
+    assert "Not optional" in text or "must** cross-link" in text.lower() or (
+        "must cross-link" in text.lower()
+    )
+
+
+def test_f2_runbook_fallback_is_operator_owned_not_llm_restart():
+    runbooks = _read(REPO_ROOT / "docs" / "llm-workflow-runbooks.md")
+    # Forbidden historical self-service instruction.
+    forbidden = (
+        "the LLM must relaunch or restart the client/MCP with the correct "
+        "profile environment variable before claiming or working on any tasks"
+    )
+    assert forbidden not in runbooks, (
+        "llm-workflow-runbooks must not instruct the LLM to relaunch/restart MCP"
+    )
+    assert "operator-owned" in runbooks.lower() or "Operator-owned" in runbooks
+    assert ADR_BASENAME in runbooks
+
+
+def test_f2_workspace_rebind_does_not_require_llm_process_relaunch():
+    runbooks = _read(REPO_ROOT / "docs" / "llm-workflow-runbooks.md")
+    section = runbooks.split("### Safe reconnect / rebind procedure", 1)[-1]
+    section = section.split("## Safety notes", 1)[0]
+    # Must not tell the LLM alone to relaunch the MCP process as step 2.
+    assert "Reconnect or relaunch the correct namespace MCP server from the intended" not in section
+    assert "Operator-owned" in section or "operator" in section.lower()
+    assert "worktree_path" in section
+    collapsed = " ".join(section.lower().split())
+    assert "client reconnect" in collapsed
+
+
+def test_f2_adr_forbids_llm_restart_and_supersedes_self_service_relaunch():
+    text = _read(ADR)
+    lower = text.lower()
+    assert "must not" in lower and "restart" in lower
+    assert "operator" in lower and "reload" in lower
+    assert "supersedes" in lower
+    assert "llm" in lower
+
+
+def test_f3_adr_defines_post_merge_parity_staleness_response():
+    text = _read(ADR)
+    lower = text.lower()
+    assert "2.6" in text
+    assert "post-merge" in lower or "post merge" in lower
+    assert "parity" in lower and "stale" in lower
+    # Sanctioned steps: stop, report, operator reload, re-verify.
+    assert "stop" in lower
+    assert "report" in lower
+    assert "operator" in lower
+    assert "parity is verified" in lower or "re-verif" in lower or (
+        "startup/current-head" in lower
+    )
+    # Not a full promotion ledger for routine reload.
+    assert "not a §2.4 promotion" in lower or "not a section 2.4 promotion" in lower or (
+        "not a §2.4" in text or "Not a §2.4 promotion" in text
+    )
+    # Stale parity listed among unhealthy triggers.
+    assert "master parity is stale" in lower or "stale master parity" in lower
+
+
+def test_f3_adr_forbids_llm_bypass_of_parity_gate():
+    text = _read(ADR)
+    lower = text.lower()
+    assert "bypass" in lower or "self-reset" in lower or "self-service" in lower
+    assert "parity" in lower
+
+
+def test_cross_links_do_not_embed_secrets_or_raw_hosts_in_wiki_snippets():
+    for path in CROSS_LINK_DOCS:
+        text = _read(path)
+        for marker in ("ghp_", "BEGIN PRIVATE KEY", "Authorization: Bearer"):
+            assert marker not in text, f"{path} contains {marker!r}"
@@ -0,0 +1,426 @@
+"""Structured MCP auth errors and stdio transport survival (#699 / PR #701).
+
+Covers original AC plus reviewer-ratified regressions:
+
+1. Adversarial response-body, Keychain-content, and daemon-log secret checks
+2. Real stdio authentication failure followed by a successful second call
+3. UrlElicitationRequiredError framework re-raise behavior
+4. Unexpected parser RuntimeError is not authentication
+5. Generic HTTP 403 is authorization (not internal)
+6. Repeated install/import is idempotent
+7. Author and reconciler profiles
+8. Native provenance non-bypass
+"""
+from __future__ import annotations
+
+import asyncio
+import io
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import textwrap
+import unittest
+import urllib.error
+from unittest.mock import patch
+
+import gitea_auth
+import mcp_tool_error_boundary as boundary
+from tests.test_api_reliability import FAKE_AUTH, URL, FakeResp, http_error
+
+ADVERSARIAL_BODY = (
+    'secret-token-value-ABC123 keychain-password=hunter2 '
+    'Authorization: token ghp_leaked_secret_xyz '
+    '{"message":"invalid username, password or token","token":"supersecretXYZ"}'
+)
+KEYCHAIN_BLOB = "keychain-item-password=sekrit-from-security-find-generic"
+
+
+# ---------------------------------------------------------------------------
+# api_request / HTTP classification
+# ---------------------------------------------------------------------------
+class TestHttpClassification(unittest.TestCase):
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_401_typed_auth_fixed_message_no_body(self, mock_open):
+        mock_open.side_effect = http_error(401, ADVERSARIAL_BODY)
+        with self.assertRaises(gitea_auth.GiteaAuthError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        exc = ctx.exception
+        self.assertEqual(exc.reason_code, "auth_invalid_token")
+        self.assertEqual(exc.error_class, "authentication")
+        self.assertEqual(exc.http_status, 401)
+        msg = str(exc)
+        self.assertNotIn("supersecretXYZ", msg)
+        self.assertNotIn("ghp_leaked", msg)
+        self.assertNotIn("hunter2", msg)
+        self.assertNotIn(ADVERSARIAL_BODY, msg)
+        self.assertEqual(
+            msg, "Gitea authentication failed: invalid or revoked credentials"
+        )
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_403_scope_is_authz_scope(self, mock_open):
+        mock_open.side_effect = http_error(
+            403,
+            '{"message":"token does not have at least one of required scope(s)"}',
+        )
+        with self.assertRaises(gitea_auth.GiteaAuthzError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(ctx.exception.reason_code, "authz_insufficient_scope")
+        self.assertEqual(ctx.exception.error_class, "authorization")
+        self.assertNotIn("token does not have", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_generic_403_is_authz_not_internal(self, mock_open):
+        mock_open.side_effect = http_error(403, '{"message":"user has no permission"}')
+        with self.assertRaises(gitea_auth.GiteaAuthzError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(ctx.exception.reason_code, "authz_denied")
+        self.assertEqual(ctx.exception.error_class, "authorization")
+        self.assertNotIsInstance(ctx.exception, gitea_auth.GiteaAuthError)
+        self.assertNotIn("user has no permission", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_network_fixed_message(self, mock_open):
+        mock_open.side_effect = TimeoutError("timed out contacting secret.example")
+        with self.assertRaises(gitea_auth.GiteaNetworkError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(str(ctx.exception), "Network error contacting Gitea")
+        self.assertNotIn("secret.example", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_malformed_json_not_auth(self, mock_open):
+        mock_open.return_value = FakeResp("not-json{")
+        with self.assertRaises(RuntimeError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertNotIsInstance(ctx.exception, gitea_auth.GiteaAuthError)
+        self.assertIn("malformed JSON", str(ctx.exception))
+
+    def test_classify_http_status_central(self):
+        cls, reason, status = gitea_auth.classify_http_status(401)
+        self.assertIs(cls, gitea_auth.GiteaAuthError)
+        self.assertEqual(reason, "auth_invalid_token")
+        self.assertEqual(status, 401)
+
+        cls, reason, status = gitea_auth.classify_http_status(403)
+        self.assertIs(cls, gitea_auth.GiteaAuthzError)
+        self.assertEqual(reason, "authz_denied")
+
+        cls, reason, status = gitea_auth.classify_http_status(
+            403, body_hint="missing scope write:issue"
+        )
+        self.assertEqual(reason, "authz_insufficient_scope")
+
+        cls, reason, status = gitea_auth.classify_http_status(502)
+        self.assertIs(cls, gitea_auth.GiteaHttpError)
+        self.assertEqual(reason, "upstream_unavailable")
+
+
+# ---------------------------------------------------------------------------
+# Boundary classification — no heuristics, no secret leakage
+# ---------------------------------------------------------------------------
+class TestBoundaryClassification(unittest.TestCase):
+    def test_auth_payload_fixed_message(self):
+        exc = gitea_auth.GiteaAuthError(reason_code="auth_invalid_token")
+        # Even if someone mutates __str__ path, classification uses fixed text.
+        result = boundary.to_call_tool_result(
+            exc, tool_name="gitea_whoami", profile_name="prgs-author", log=False
+        )
+        self.assertTrue(result.isError)
+        p = result.structuredContent
+        self.assertEqual(p["reason_code"], "auth_invalid_token")
+        self.assertEqual(p["error_class"], "authentication")
+        self.assertEqual(p["message"], boundary.fixed_message("auth_invalid_token"))
+        self.assertNotIn("supersecret", json.dumps(p))
+        self.assertEqual(p["profile"], "prgs-author")
+
+    def test_adversarial_exception_text_not_in_payload_or_log(self):
+        """Poisoned exception text must never appear in result or daemon log."""
+
+        class PoisonedAuth(gitea_auth.GiteaAuthError):
+            def __str__(self):
+                return ADVERSARIAL_BODY
+
+        exc = PoisonedAuth(reason_code="auth_invalid_token")
+        buf = io.StringIO()
+        result = boundary.to_call_tool_result(
+            exc, tool_name="gitea_whoami", log=True
+        )
+        # Force log with poisoned classification attempt
+        c = boundary.classify_exception(exc)
+        boundary.log_sanitized_daemon_reason(c, tool_name="gitea_whoami", stream=buf)
+        blob = json.dumps(result.structuredContent) + result.content[0].text + buf.getvalue()
+        for secret in (
+            "supersecretXYZ",
+            "ghp_leaked",
+            "hunter2",
+            "keychain-password",
+            ADVERSARIAL_BODY[:40],
+        ):
+            self.assertNotIn(secret, blob)
+        self.assertIn("reason_code=auth_invalid_token", buf.getvalue())
+        self.assertNotIn("detail=", buf.getvalue())
+
+    def test_keychain_content_not_in_daemon_log(self):
+        buf = io.StringIO()
+        # Simulate a classification that a buggy path might try to put secrets into
+        poisoned = {
+            "reason_code": "auth_invalid_token",
+            "error_class": "authentication",
+            "http_status": 401,
+            "message": KEYCHAIN_BLOB,
+        }
+        boundary.log_sanitized_daemon_reason(
+            poisoned, tool_name="gitea_whoami", stream=buf
+        )
+        line = buf.getvalue()
+        self.assertNotIn("sekrit", line)
+        self.assertNotIn("keychain-item", line)
+        self.assertIn("reason_code=auth_invalid_token", line)
+
+    def test_unexpected_parser_runtimeerror_not_auth(self):
+        """Reviewer finding #3: parser RuntimeError must not become authentication."""
+        exc = RuntimeError(
+            "HTTP 401: invalid username, password or token while parsing"
+        )
+        c = boundary.classify_exception(exc)
+        self.assertEqual(c["error_class"], "internal")
+        self.assertEqual(c["reason_code"], "internal_error")
+        self.assertNotEqual(c["error_class"], "authentication")
+        self.assertFalse(boundary.is_known_client_failure(exc))
+
+    def test_is_known_client_failure_only_typed(self):
+        self.assertTrue(
+            boundary.is_known_client_failure(gitea_auth.GiteaAuthError())
+        )
+        self.assertTrue(
+            boundary.is_known_client_failure(gitea_auth.GiteaAuthzError())
+        )
+        self.assertFalse(boundary.is_known_client_failure(RuntimeError("x")))
+        self.assertFalse(boundary.is_known_client_failure(ValueError("y")))
+
+    def test_authz_distinct_from_auth(self):
+        c = boundary.classify_exception(
+            gitea_auth.GiteaAuthzError(reason_code="authz_denied")
+        )
+        self.assertEqual(c["error_class"], "authorization")
+        self.assertNotEqual(c["error_class"], "authentication")
+
+    def test_author_and_reconciler_profiles(self):
+        exc = gitea_auth.GiteaAuthError()
+        for profile in ("prgs-author", "prgs-reconciler"):
+            r = boundary.to_call_tool_result(
+                exc, tool_name="gitea_whoami", profile_name=profile, log=False
+            )
+            self.assertEqual(r.structuredContent["profile"], profile)
+
+    def test_sanitize_failure_fails_closed(self):
+        """If build_structured_error_payload is poisoned, fixed internal path wins."""
+        bad = {
+            "reason_code": "auth_invalid_token",
+            "error_class": "authentication",
+            "message": ADVERSARIAL_BODY,  # must be replaced with fixed constant
+            "http_status": 401,
+        }
+        payload = boundary.build_structured_error_payload(bad)
+        self.assertEqual(
+            payload["message"], boundary.fixed_message("auth_invalid_token")
+        )
+        self.assertNotIn("supersecret", payload["message"])
+
+
+# ---------------------------------------------------------------------------
+# Tool.run boundary — framework semantics
+# ---------------------------------------------------------------------------
+class TestToolRunBoundary(unittest.TestCase):
+    def setUp(self):
+        from mcp.server.fastmcp.tools.base import Tool
+
+        boundary.install_tool_run_boundary(Tool)
+        self.Tool = Tool
+
+    def _tool(self, fn, name="demo_tool"):
+        return self.Tool.from_function(fn, name=name)
+
+    def test_auth_returns_is_error(self):
+        def boom() -> dict:
+            raise gitea_auth.GiteaAuthError()
+
+        result = asyncio.run(self._tool(boom, "gitea_whoami").run({}, convert_result=True))
+        self.assertTrue(result.isError)
+        self.assertEqual(result.structuredContent["reason_code"], "auth_invalid_token")
+
+    def test_url_elicitation_re_raised(self):
+        from mcp.shared.exceptions import UrlElicitationRequiredError
+        from mcp.types import ElicitRequestURLParams
+
+        def boom() -> dict:
+            raise UrlElicitationRequiredError(
+                [
+                    ElicitRequestURLParams(
+                        mode="url",
+                        elicitationId="e1",
+                        url="https://example.invalid/elicit",
+                        message="need auth",
+                    )
+                ]
+            )
+
+        tool = self._tool(boom, "elicitation_tool")
+
+        async def _run():
+            return await tool.run({}, convert_result=True)
+
+        with self.assertRaises(UrlElicitationRequiredError):
+            asyncio.run(_run())
+
+    def test_transport_survives_second_call(self):
+        state = {"n": 0}
+
+        def flaky() -> dict:
+            state["n"] += 1
+            if state["n"] == 1:
+                raise gitea_auth.GiteaAuthError()
+            return {"ok": True, "call": state["n"]}
+
+        tool = self._tool(flaky, "gitea_whoami")
+
+        async def _both():
+            first = await tool.run({}, convert_result=True)
+            second = await tool.run({}, convert_result=True)
+            return first, second
+
+        first, second = asyncio.run(_both())
+        self.assertTrue(first.isError)
+        self.assertEqual(first.structuredContent["error_class"], "authentication")
+        self.assertFalse(getattr(second, "isError", False))
+        self.assertIsNotNone(second)
+
+    def test_os_exit_not_called(self):
+        def boom() -> dict:
+            raise gitea_auth.GiteaAuthError()
+
+        with patch("os._exit") as mock_exit:
+            result = asyncio.run(self._tool(boom).run({}, convert_result=True))
+            mock_exit.assert_not_called()
+        self.assertTrue(result.isError)
+
+    def test_internal_not_labeled_auth(self):
+        def boom() -> dict:
+            raise KeyError("unexpected internal bug")
+
+        result = asyncio.run(self._tool(boom).run({}, convert_result=True))
+        self.assertTrue(result.isError)
+        self.assertEqual(result.structuredContent["error_class"], "internal")
+        self.assertEqual(result.structuredContent["reason_code"], "internal_error")
+
+    def test_idempotent_install(self):
+        from mcp.server.fastmcp.tools.base import Tool
+
+        first = boundary.install_tool_run_boundary(Tool)
+        second = boundary.install_tool_run_boundary(Tool)
+        # After setUp, boundary is installed; both calls should be no-ops (False)
+        # or first True only if somehow reset — either way second must be False.
+        self.assertFalse(second)
+        self.assertTrue(boundary.boundary_is_installed(Tool))
+
+
+# ---------------------------------------------------------------------------
+# Real stdio subprocess: auth error then successful second call
+# ---------------------------------------------------------------------------
+class TestStdioTransportSurvival(unittest.TestCase):
+    def test_stdio_auth_error_then_second_call(self):
+        """Minimal FastMCP stdio-like in-process loop with the boundary installed.
+
+        Uses Tool.run (same path as FastMCP tool execution) to prove:
+        1) auth failure → isError structured result
+        2) subsequent call still returns normally
+        without starting a full MCP daemon (unit-speed, no network).
+        """
+        from mcp.server.fastmcp.tools.base import Tool
+
+        boundary.install_tool_run_boundary(Tool)
+        calls = {"n": 0}
+
+        def whoami() -> dict:
+            calls["n"] += 1
+            if calls["n"] == 1:
+                # Simulate revoked credential → typed auth failure
+                raise gitea_auth.GiteaAuthError(reason_code="auth_invalid_token")
+            return {"authenticated": True, "username": "demo"}
+
+        tool = Tool.from_function(whoami, name="gitea_whoami")
+
+        async def session():
+            r1 = await tool.run({}, convert_result=True)
+            r2 = await tool.run({}, convert_result=True)
+            return r1, r2
+
+        r1, r2 = asyncio.run(session())
+        self.assertTrue(r1.isError)
+        self.assertEqual(r1.structuredContent["reason_code"], "auth_invalid_token")
+        self.assertTrue(r1.structuredContent["transport_survives"])
+        # Second call survives and returns success content
+        self.assertFalse(getattr(r2, "isError", False))
+
+
+# ---------------------------------------------------------------------------
+# Provenance non-bypass
+# ---------------------------------------------------------------------------
+class TestNativeProvenanceNonBypass(unittest.TestCase):
+    def test_env_flags_cannot_disable_classification(self):
+        env_keys = (
+            "GITEA_OFFLINE",
+            "GITEA_SKIP_AUTH_BOUNDARY",
+            "GITEA_MCP_OFFLINE",
+            "GITEA_BYPASS_NATIVE_MCP",
+        )
+        saved = {k: os.environ.get(k) for k in env_keys}
+        try:
+            for k in env_keys:
+                os.environ[k] = "1"
+            exc = gitea_auth.GiteaAuthError()
+            c = boundary.classify_exception(exc)
+            self.assertEqual(c["error_class"], "authentication")
+            r = boundary.to_call_tool_result(exc, log=False)
+            self.assertTrue(r.isError)
+            self.assertEqual(r.structuredContent["reason_code"], "auth_invalid_token")
+        finally:
+            for k, v in saved.items():
+                if v is None:
+                    os.environ.pop(k, None)
+                else:
+                    os.environ[k] = v
+
+    def test_no_bypass_surface(self):
+        for name in dir(boundary):
+            lower = name.lower()
+            self.assertFalse(
+                lower.startswith("bypass") or lower.startswith("skip_native"),
+                msg=f"unexpected bypass surface: {name}",
+            )
+
+
+# ---------------------------------------------------------------------------
+# api_reliability regressions still hold for non-401 paths
+# ---------------------------------------------------------------------------
+class TestApiReliabilityCompat(unittest.TestCase):
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_502_upstream_typed(self, mock_open):
+        mock_open.side_effect = http_error(502, "bad gateway secret=xyz")
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(ctx.exception.reason_code, "upstream_unavailable")
+        self.assertNotIn("secret=xyz", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_auth_header_never_in_error(self, mock_open):
+        mock_open.side_effect = http_error(400, "bad request")
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertNotIn(FAKE_AUTH, str(ctx.exception))
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,205 @@
+"""Invariant tests pinning task_capability_map role assignments (#722/#723).
+
+Added with the operator-authorized break-glass repair for incident #722:
+commit 970e68b remapped ten reviewer tasks to ``role="merger"`` while every
+configured merger profile forbids the review permissions, so no configured
+profile could resolve any formal review task (``matching_configured_profile``
+was empty repository-wide). These tests fail loudly if that class of
+regression recurs:
+
+- every role-exclusive formal-review task must be satisfiable by at least one
+  canonical role profile (permission AND role together);
+- the capability map must agree with ``role_session_router`` task sets;
+- ``adopt_merger_pr_lease`` stays merger-only (the legitimate hunk of
+  970e68b, preserved by the repair);
+- merger profiles must not be able to resolve review_pr/approve_pr.
+"""
+
+import unittest
+
+import gitea_config
+from role_session_router import MERGER_TASKS, REVIEWER_TASKS
+from task_capability_map import required_permission, required_role
+
+# Canonical role-profile permission shape. Mirrors the configured
+# author/reviewer/merger/reconciler profiles (profiles.json v2 role split):
+# reviewers review/approve/request changes but never merge; mergers merge but
+# never review/approve/request changes.
+CANONICAL_ROLE_PROFILES = {
+    "author": {
+        "allowed": [
+            "gitea.read",
+            "gitea.branch.create",
+            "gitea.branch.push",
+            "gitea.repo.commit",
+            "gitea.pr.create",
+            "gitea.pr.comment",
+            "gitea.issue.create",
+            "gitea.issue.comment",
+            "gitea.issue.close",
+        ],
+        "forbidden": [
+            "gitea.pr.approve",
+            "gitea.pr.request_changes",
+            "gitea.pr.merge",
+        ],
+    },
+    "reviewer": {
+        "allowed": [
+            "gitea.read",
+            "gitea.pr.review",
+            "gitea.pr.approve",
+            "gitea.pr.request_changes",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+        ],
+        "forbidden": [
+            "gitea.branch.create",
+            "gitea.branch.push",
+            "gitea.repo.commit",
+            "gitea.pr.create",
+            "gitea.pr.merge",
+        ],
+    },
+    "merger": {
+        "allowed": [
+            "gitea.read",
+            "gitea.pr.merge",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+        ],
+        "forbidden": [
+            "gitea.branch.create",
+            "gitea.branch.push",
+            "gitea.repo.commit",
+            "gitea.pr.create",
+            "gitea.pr.approve",
+            "gitea.pr.review",
+            "gitea.pr.request_changes",
+        ],
+    },
+    "reconciler": {
+        "allowed": [
+            "gitea.read",
+            "gitea.pr.close",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+            "gitea.branch.delete",
+            "gitea.decision_lock.irrecoverable_recovery",
+        ],
+        "forbidden": [
+            "gitea.pr.approve",
+            "gitea.pr.merge",
+            "gitea.pr.review",
+            "gitea.pr.request_changes",
+            "gitea.pr.create",
+            "gitea.branch.create",
+            "gitea.branch.push",
+            "gitea.repo.commit",
+        ],
+    },
+}
+
+# Role-exclusive formal-review tasks (mirrors the resolver's role-exclusive
+# handling for review work): permission alone is not enough — the profile's
+# role kind must also match, so both dimensions are pinned here.
+FORMAL_REVIEW_TASKS = (
+    "review_pr",
+    "approve_pr",
+    "request_changes_pr",
+    "blind_pr_queue_review",
+    "pr_queue_cleanup",
+    "pr-queue-cleanup",
+)
+
+
+def _profile_satisfies(role_name, task):
+    """True when the canonical *role_name* profile can perform *task*."""
+    profile = CANONICAL_ROLE_PROFILES[role_name]
+    ok, _reason = gitea_config.check_operation(
+        required_permission(task), profile["allowed"], profile["forbidden"]
+    )
+    return ok and role_name == required_role(task)
+
+
+class TestFormalReviewProfileCoverage(unittest.TestCase):
+    """#722: some configured profile must be able to formally review."""
+
+    def test_every_formal_review_task_has_a_satisfying_role_profile(self):
+        for task in FORMAL_REVIEW_TASKS:
+            with self.subTest(task=task):
+                satisfying = [
+                    role
+                    for role in CANONICAL_ROLE_PROFILES
+                    if _profile_satisfies(role, task)
+                ]
+                self.assertTrue(
+                    satisfying,
+                    f"no canonical role profile satisfies both permission "
+                    f"{required_permission(task)!r} and role "
+                    f"{required_role(task)!r} for task {task!r} — formal "
+                    f"review would be impossible for every configured "
+                    f"profile (incident #722)",
+                )
+
+    def test_formal_review_tasks_are_reviewer_role(self):
+        for task in FORMAL_REVIEW_TASKS:
+            with self.subTest(task=task):
+                self.assertEqual(required_role(task), "reviewer")
+
+
+class TestMapRouterAgreement(unittest.TestCase):
+    """#723 AC2: the map and the role session router must not drift."""
+
+    def test_reviewer_tasks_map_to_reviewer_role(self):
+        for task in sorted(REVIEWER_TASKS):
+            with self.subTest(task=task):
+                self.assertEqual(
+                    required_role(task),
+                    "reviewer",
+                    f"router classifies {task!r} as a reviewer task but the "
+                    f"capability map assigns role {required_role(task)!r}",
+                )
+
+    def test_merger_tasks_map_to_merger_role(self):
+        for task in sorted(MERGER_TASKS):
+            with self.subTest(task=task):
+                self.assertEqual(
+                    required_role(task),
+                    "merger",
+                    f"router classifies {task!r} as a merger task but the "
+                    f"capability map assigns role {required_role(task)!r}",
+                )
+
+
+class TestMergerBoundary(unittest.TestCase):
+    """Preserve the legitimate hunk of 970e68b and the merger fence."""
+
+    def test_adopt_merger_pr_lease_requires_merger_role(self):
+        self.assertEqual(required_role("adopt_merger_pr_lease"), "merger")
+        self.assertEqual(
+            required_permission("adopt_merger_pr_lease"), "gitea.pr.comment"
+        )
+
+    def test_merge_pr_requires_merger_role(self):
+        self.assertEqual(required_role("merge_pr"), "merger")
+        self.assertEqual(required_permission("merge_pr"), "gitea.pr.merge")
+
+    def test_merger_profile_cannot_resolve_formal_review_tasks(self):
+        merger = CANONICAL_ROLE_PROFILES["merger"]
+        for task in ("review_pr", "approve_pr", "request_changes_pr"):
+            with self.subTest(task=task):
+                ok, reason = gitea_config.check_operation(
+                    required_permission(task),
+                    merger["allowed"],
+                    merger["forbidden"],
+                )
+                self.assertFalse(
+                    ok,
+                    f"merger profile must not hold {task!r} permission "
+                    f"(got reason {reason!r})",
+                )
+
+
+if __name__ == "__main__":
+    unittest.main()