fix(runtime): fix identity derivation disarming in canonical root guard (Closes #973)

gitea_mcp_server.py

@@ -526,18 +526,21 @@ def _resolve_expected_repository_slug(
     org: str | None = None,
     repo: str | None = None,
 ) -> str | None:
-    """Resolve expected repository slug from parameters, session context, or process root.
+    """Resolve expected repository slug from session context, parameters, or process root.
 
     Must derive expected repository identity ONLY from trusted sources independent
     of the candidate configured canonical root (#973 B8).
+
+    Bound session context takes precedence over request parameters so request-supplied
+    coordinates cannot replace a bound canonical root (#741 / #973 B9).
     """
-    if org and repo:
-        return session_ctx.format_repository_slug(org, repo)
     bound = session_ctx.get_session_context() or {}
     b_org = bound.get("org")
     b_repo = bound.get("repository")
     if b_org and b_repo:
         return session_ctx.format_repository_slug(b_org, b_repo)
+    if org and repo:
+        return session_ctx.format_repository_slug(org, repo)
     eff_remote = remote or bound.get("remote") or _effective_remote()
     parsed = remote_repo_guard.parse_org_repo_from_remote_url(
         _process_root_git_remote_url(eff_remote)
@@ -2250,6 +2253,7 @@ def _canonical_repository_slug(
         process_project_root=PROJECT_ROOT,
         remote=remote,
         require_binding=True,
+        mode="derivation",
     )
     slug = assessment.get("resolved_slug")
     if assessment.get("block") or not slug: