Merge pull request 'feat: add conflict-fix leases and stale-head protection (Closes #399)' (#416) from feat/issue-399-conflict-fix-leases into master

gitea_mcp_server.py

@@ -545,6 +545,7 @@ import merged_cleanup_reconcile  # noqa: E402
 import reconciler_profile  # noqa: E402
 import reconciliation_workflow  # noqa: E402
 import review_merge_state_machine  # noqa: E402
+import pr_work_lease  # noqa: E402
 import native_mcp_preference  # noqa: E402
 
 
@@ -2501,6 +2502,50 @@ def gitea_get_pr_review_feedback(
     }
 
 
+def _list_pr_lease_comments(
+    pr_number: int,
+    *,
+    remote: str,
+    host: str | None,
+    org: str | None,
+    repo: str | None,
+    limit: int = 100,
+) -> list[dict]:
+    """Fetch PR/issue thread comments used for reviewer/conflict-fix leases."""
+    h, o, r = _resolve(remote, host, org, repo)
+    auth = _auth(h)
+    api = f"{repo_api_url(h, o, r)}/issues/{pr_number}/comments"
+    comments = api_request("GET", api, auth) or []
+    return list(comments[:limit])
+
+
+def _pr_work_lease_reviewer_block(
+    *,
+    pr_number: int,
+    reviewed_head_sha: str | None,
+    live_head_sha: str | None,
+    mutation: str,
+    remote: str,
+    host: str | None,
+    org: str | None,
+    repo: str | None,
+) -> dict:
+    comments = _list_pr_lease_comments(
+        pr_number,
+        remote=remote,
+        host=host,
+        org=org,
+        repo=repo,
+    )
+    return pr_work_lease.assess_reviewer_mutation_blocked(
+        pr_number=pr_number,
+        comments=comments,
+        reviewed_head_sha=reviewed_head_sha,
+        live_head_sha=live_head_sha,
+        mutation=mutation,
+    )
+
+
 def _evaluate_pr_review_submission(
     pr_number: int,
     action: str,
@@ -2599,6 +2644,11 @@ def _evaluate_pr_review_submission(
     lock = _load_review_decision_lock() or {}
     if live and lock.get("ready_expected_head_sha"):
         pinned_sha = lock.get("ready_expected_head_sha")
+    if live and not pinned_sha:
+        reasons.append(
+            "reviewed head SHA required before live review mutation (fail closed, #399)"
+        )
+        return result
     if pinned_sha and actual_sha and pinned_sha != actual_sha:
         reasons.append(
             "expected head SHA does not match current PR head (fail closed)"
@@ -2608,6 +2658,21 @@ def _evaluate_pr_review_submission(
         reasons.append("PR head SHA unavailable (fail closed)")
         return result
 
+    lease_block = _pr_work_lease_reviewer_block(
+        pr_number=pr_number,
+        reviewed_head_sha=pinned_sha,
+        live_head_sha=actual_sha,
+        mutation=action,
+        remote=remote,
+        host=host,
+        org=org,
+        repo=repo,
+    )
+    if lease_block.get("block"):
+        reasons.extend(lease_block.get("reasons") or [])
+        result["pr_work_lease"] = lease_block
+        return result
+
     result["would_perform"] = True
     if not live:
         reasons.append(
@@ -2750,6 +2815,39 @@ def gitea_mark_final_review_decision(
                 f"{sorted(_REVIEW_ACTIONS)}"
             ],
         }
+    if not (expected_head_sha or "").strip():
+        return {
+            "marked_ready": False,
+            "reasons": [
+                "expected_head_sha required before marking final review "
+                "decision (fail closed, #399)"
+            ],
+        }
+    elig = gitea_check_pr_eligibility(
+        pr_number=pr_number,
+        action="review",
+        remote=remote,
+        host=None,
+        org=org,
+        repo=repo,
+    )
+    live_head = elig.get("head_sha")
+    lease_block = _pr_work_lease_reviewer_block(
+        pr_number=pr_number,
+        reviewed_head_sha=expected_head_sha,
+        live_head_sha=live_head,
+        mutation="mark_ready",
+        remote=remote,
+        host=None,
+        org=org,
+        repo=repo,
+    )
+    if lease_block.get("block"):
+        return {
+            "marked_ready": False,
+            "reasons": lease_block.get("reasons") or [],
+            "pr_work_lease": lease_block,
+        }
     if action == "request_changes":
         # Duplicate request-changes suppression (#332): an unresolved
         # REQUEST_CHANGES at the current head must not be duplicated.
@@ -3394,8 +3492,27 @@ def gitea_merge_pr(
     if reasons:
         return result
 
-    # Gate 4 — head SHA must match if the caller pinned a reviewed SHA.
+    # Gate 4 — reviewed head SHA is mandatory and must match live PR head (#399).
     actual_sha = result["head_sha"]
+    if not (expected_head_sha or "").strip():
+        reasons.append(
+            "expected_head_sha required before merge (fail closed, #399)"
+        )
+        return result
+    lease_block = _pr_work_lease_reviewer_block(
+        pr_number=pr_number,
+        reviewed_head_sha=expected_head_sha,
+        live_head_sha=actual_sha,
+        mutation="merge",
+        remote=remote,
+        host=host,
+        org=org,
+        repo=repo,
+    )
+    if lease_block.get("block"):
+        reasons.extend(lease_block.get("reasons") or [])
+        result["pr_work_lease"] = lease_block
+        return result
     if expected_head_sha and actual_sha and expected_head_sha != actual_sha:
         reasons.append(
             "expected head SHA does not match current PR head (fail closed)"
@@ -6691,6 +6808,110 @@ def gitea_post_heartbeat(
     )
 
 
+@mcp.tool()
+def gitea_acquire_conflict_fix_lease(
+    pr_number: int,
+    branch: str,
+    worktree_path: str,
+    head_before: str,
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+) -> dict:
+    """Acquire a conflict-fix lease on a PR branch before pushing (#399)."""
+    blocked = _profile_permission_block(
+        task_capability_map.required_permission("comment_issue"))
+    if blocked:
+        return blocked
+    verify_preflight_purity(remote, worktree_path=worktree_path)
+    comments = _list_pr_lease_comments(
+        pr_number,
+        remote=remote,
+        host=host,
+        org=org,
+        repo=repo,
+    )
+    reviewer_lease = pr_work_lease.find_active_reviewer_lease(
+        comments, pr_number=pr_number)
+    if reviewer_lease:
+        return {
+            "acquired": False,
+            "reasons": [
+                f"active reviewer lease on PR #{pr_number}; cannot acquire "
+                "conflict-fix lease (fail closed)"
+            ],
+            "active_reviewer_lease": reviewer_lease,
+        }
+    profile_name = get_profile().get("profile_name") or "unknown"
+    body = pr_work_lease.format_conflict_fix_lease_body(
+        pr_number=pr_number,
+        branch=branch,
+        worktree=worktree_path,
+        profile=profile_name,
+        head_before=head_before,
+        reviewer_active=bool(reviewer_lease),
+    )
+    posted = _post_structured_issue_comment(
+        issue_number=pr_number,
+        body=body,
+        remote=remote,
+        host=host,
+        org=org,
+        repo=repo,
+        audit_op="conflict_fix_lease_acquire",
+    )
+    return {
+        "acquired": posted.get("success", False),
+        "pr_number": pr_number,
+        "branch": branch,
+        "worktree_path": worktree_path,
+        "head_before": head_before,
+        "comment_id": posted.get("comment_id"),
+        "active_reviewer_lease": reviewer_lease,
+        "reasons": [] if posted.get("success") else ["lease comment post failed"],
+    }
+
+
+@mcp.tool()
+def gitea_assess_conflict_fix_push(
+    pr_number: int,
+    branch_head_before: str,
+    branch_head_after: str,
+    worktree_path: str,
+    push_cwd: str,
+    is_fast_forward: bool = True,
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+) -> dict:
+    """Read-only pre-push gate for author conflict-fix sessions (#399)."""
+    read_block = _profile_operation_gate("gitea.read")
+    if read_block:
+        return {
+            "push_allowed": False,
+            "reasons": read_block,
+            "permission_report": _permission_block_report("gitea.read"),
+        }
+    comments = _list_pr_lease_comments(
+        pr_number,
+        remote=remote,
+        host=host,
+        org=org,
+        repo=repo,
+    )
+    return pr_work_lease.assess_conflict_fix_push(
+        pr_number=pr_number,
+        comments=comments,
+        branch_head_before=branch_head_before,
+        branch_head_after=branch_head_after,
+        worktree_path=worktree_path,
+        push_cwd=push_cwd,
+        is_fast_forward=is_fast_forward,
+    )
+
+
 @mcp.tool()
 def gitea_reconcile_issue_claims(
     state: str = "open",