fix: resolve conflicts for PR #376 against current master

2026-07-07 09:17:33 -04:00
parent 6e774e191a e017d80256
commit d0f52cbf19
6 changed files with 650 additions and 0 deletions
@@ -62,7 +62,24 @@ class TestPreflightWarnings(unittest.TestCase):
        self.assertIn("_encode_commit_payload.py", status["preflight_warnings"][0])


+# Issue-write tools are profile-gated (#69); gitea_lock_issue requires
+# gitea.issue.comment (see task_capability_map), so the gate must be
+# seeded exactly like tests/test_mcp_server.py::TestIssueLocking (#359).
+ISSUE_WRITE_ENV = {
+    "GITEA_ALLOWED_OPERATIONS": (
+        "gitea.issue.create,gitea.issue.close,gitea.issue.comment"
+    ),
+}
+
+
 class TestIssueLockArtifactWarning(unittest.TestCase):
+    def setUp(self):
+        self._env_patcher = patch.dict(os.environ, ISSUE_WRITE_ENV, clear=True)
+        self._env_patcher.start()
+
+    def tearDown(self):
+        self._env_patcher.stop()
+
    @patch("mcp_server.api_get_all", return_value=[])
    @patch("mcp_server._auth", return_value="token x")
    @patch("mcp_server._resolve", return_value=("h", "o", "r"))
@@ -72,6 +89,9 @@ class TestIssueLockArtifactWarning(unittest.TestCase):
        mock_state.return_value = {
            "current_branch": "master",
            "porcelain_status": "?? _emit_payload.py\n",
+            "base_equivalent": True,
+            "inspected_git_root": "/scratch/wt",
+            "base_branch": "origin/master",
        }
        result = mcp_server.gitea_lock_issue(
            issue_number=261,
@@ -152,3 +152,9 @@ def test_reconcile_inventory_verifier_exported():
    from review_proofs import assess_reconcile_inventory_report

    assert callable(assess_reconcile_inventory_report)
+
+
+def test_worktree_ownership_verifier_exported():
+    from review_proofs import assess_worktree_ownership_report
+
+    assert callable(assess_worktree_ownership_report)
@@ -24,6 +24,7 @@ from review_proofs import (  # noqa: E402
    ISSUE_SELECTION_CONTINUATION_EXPLICIT,
    ISSUE_SELECTION_REPRESENTED_BY_OPEN_PR,
    assess_author_pr_report,
+    assess_full_suite_failure_approval_gate,
    assess_queue_ordering_proof,
    assess_reviewer_baseline_validation_proof,
    assess_capability_evidence,
@@ -2539,5 +2540,170 @@ class TestReviewerBaselineValidationProof(unittest.TestCase):
        self.assertFalse(report["baseline_validation_proven"])


+class TestFullSuiteFailureApprovalGate(unittest.TestCase):
+    """Issue #323: full-suite failure blocks approval without baseline proof."""
+
+    ROOT = "/repo/Gitea-Tools"
+
+    def _good_proof(self, **overrides):
+        proof = {
+            "worktree_path": f"{self.ROOT}/branches/baseline-master-pr280",
+            "baseline_target_sha": PINNED,
+            "pr_head_sha": OTHER,
+            "baseline_failures": ["tests/test_foo.py::test_bar"],
+            "pr_failures": ["tests/test_foo.py::test_bar"],
+            "failure_signatures_match": True,
+            "clean_before": True,
+            "clean_after": True,
+            "pr_suite_command": "venv/bin/pytest tests/",
+            "baseline_suite_command": "venv/bin/pytest tests/",
+            "new_tests_passed": True,
+            "unrelated_explanation": (
+                "failures touch agent_temp_artifacts only; PR changes "
+                "review_proofs handoff fields"
+            ),
+        }
+        proof.update(overrides)
+        return proof
+
+    def _good_report(self):
+        return (
+            "Full suite failed on PR worktree and on baseline.\n"
+            "- Validation command: venv/bin/pytest tests/\n"
+            f"- Working directory: {self.ROOT}/branches/review-pr-280\n"
+            "Failures are pre-existing on master.\n"
+        )
+
+    def test_full_suite_pass_allows_approval_without_baseline(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="approve",
+            full_suite_passed=True,
+            project_root=self.ROOT,
+        )
+        self.assertTrue(result["approve_allowed"])
+        self.assertFalse(result["block"])
+        self.assertEqual(result["default_action"], "proceed")
+
+    def test_full_suite_failure_defaults_to_request_changes(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="request_changes",
+            full_suite_passed=False,
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["block"])
+        self.assertEqual(result["default_action"], "request_changes")
+
+    def test_approval_with_failure_and_no_proof_blocks(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="approve",
+            full_suite_passed=False,
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["approve_allowed"])
+        self.assertTrue(result["block"])
+        self.assertEqual(result["default_action"], "request_changes")
+
+    def test_approval_with_matching_baseline_proof_allowed(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="approve",
+            full_suite_passed=False,
+            baseline_proof=self._good_proof(),
+            report_text=self._good_report(),
+            project_root=self.ROOT,
+        )
+        self.assertTrue(result["approve_allowed"])
+        self.assertFalse(result["block"])
+
+    def test_mismatched_failure_signatures_block_approval(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="approve",
+            full_suite_passed=False,
+            baseline_proof=self._good_proof(
+                failure_signatures_match=False,
+                pr_failures=["tests/test_other.py::test_other"],
+            ),
+            report_text=self._good_report(),
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["approve_allowed"])
+        self.assertTrue(result["block"])
+
+    def test_main_checkout_baseline_blocks_approval(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="approve",
+            full_suite_passed=False,
+            baseline_proof=self._good_proof(worktree_path=self.ROOT),
+            report_text=self._good_report(),
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["approve_allowed"])
+        self.assertTrue(result["block"])
+
+    def test_missing_new_tests_proof_blocks_approval(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="approve",
+            full_suite_passed=False,
+            baseline_proof=self._good_proof(new_tests_passed=None),
+            report_text=self._good_report(),
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["approve_allowed"])
+        self.assertTrue(any(
+            "new" in reason.lower() and "test" in reason.lower()
+            for reason in result["reasons"]
+        ))
+
+    def test_missing_unrelated_explanation_blocks_approval(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="approve",
+            full_suite_passed=False,
+            baseline_proof=self._good_proof(unrelated_explanation=""),
+            report_text=self._good_report(),
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["approve_allowed"])
+
+    def test_missing_suite_commands_block_approval(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="approve",
+            full_suite_passed=False,
+            baseline_proof=self._good_proof(
+                pr_suite_command="", baseline_suite_command=""),
+            report_text=self._good_report(),
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["approve_allowed"])
+        self.assertTrue(any(
+            "command" in reason.lower() for reason in result["reasons"]
+        ))
+
+    def test_unknown_suite_result_blocks_approval(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="approve",
+            full_suite_passed=None,
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["approve_allowed"])
+        self.assertTrue(result["block"])
+
+    def test_vague_same_as_master_claim_without_proof_blocks(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="approve",
+            full_suite_passed=False,
+            report_text="Validation: failures same as master; approving.",
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["approve_allowed"])
+        self.assertTrue(result["block"])
+
+    def test_non_approve_decision_never_blocks(self):
+        result = assess_full_suite_failure_approval_gate(
+            review_decision="comment",
+            full_suite_passed=None,
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["block"])
+
+
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,137 @@
+"""Tests for reviewer worktree ownership verifier (#312)."""
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from reviewer_worktree_ownership import assess_worktree_ownership_report  # noqa: E402
+
+
+def _fresh_review_report() -> str:
+    return "\n".join([
+        "Review worktree path: branches/review-pr280-feat-issue-275-claim",
+        "Worktree is inside branches/ and not the main checkout.",
+        "Tracked state: clean; untracked state: clean.",
+        "Official PR-head validation on session-owned worktree.",
+        "Worktree mutations: none",
+    ])
+
+
+def _safe_reuse_report() -> str:
+    return "\n".join([
+        "Safe-reuse proof for existing review worktree.",
+        "Review worktree path: branches/docs-issue-260-forbid-commit-fallbacks",
+        "Worktree inside branches/; not the main checkout.",
+        "Not owned by another active task/session.",
+        "Clean tracked state; clean untracked state.",
+        "Branch/head before reset: feat/issue-260-example",
+        "Reset target SHA: abc123def4567890abcdef1234567890abcdef12",
+        "Project policy allows reuse/reset for this clean review worktree.",
+        "Worktree mutations: git reset --hard FETCH_HEAD",
+        "Destructive reset operations: git reset --hard FETCH_HEAD",
+    ])
+
+
+class TestWorktreeOwnership(unittest.TestCase):
+    def test_fresh_session_owned_passes(self):
+        result = assess_worktree_ownership_report(
+            _fresh_review_report(),
+            ownership_session={
+                "validation_ran": True,
+                "worktree_path": "branches/review-pr280-feat-issue-275-claim",
+            },
+        )
+        self.assertTrue(result["proven"], result["reasons"])
+        self.assertTrue(result["session_owned"])
+
+    def test_safe_reuse_with_reset_passes(self):
+        result = assess_worktree_ownership_report(
+            _safe_reuse_report(),
+            ownership_session={
+                "safe_reuse": True,
+                "worktree_path": "branches/docs-issue-260-forbid-commit-fallbacks",
+            },
+            command_log=["git reset --hard FETCH_HEAD"],
+        )
+        self.assertTrue(result["proven"], result["reasons"])
+
+    def test_destructive_reset_without_proof_blocks(self):
+        report = "\n".join([
+            "Review worktree path: branches/docs-issue-260-forbid-commit-fallbacks",
+            "Worktree mutations: git reset --hard FETCH_HEAD",
+        ])
+        result = assess_worktree_ownership_report(
+            report,
+            ownership_session={
+                "validation_ran": True,
+                "worktree_path": "branches/docs-issue-260-forbid-commit-fallbacks",
+            },
+            command_log=["git reset --hard FETCH_HEAD"],
+        )
+        self.assertFalse(result["proven"])
+        self.assertTrue(result["block"])
+
+    def test_reused_dirty_tracked_blocks(self):
+        result = assess_worktree_ownership_report(
+            _fresh_review_report(),
+            ownership_session={
+                "validation_ran": True,
+                "worktree_path": "branches/review-pr280-feat-issue-275-claim",
+                "dirty_tracked": True,
+            },
+        )
+        self.assertFalse(result["proven"])
+        self.assertTrue(any("tracked" in r.lower() for r in result["reasons"]))
+
+    def test_safe_reuse_dirty_untracked_blocks(self):
+        result = assess_worktree_ownership_report(
+            _safe_reuse_report(),
+            ownership_session={
+                "safe_reuse": True,
+                "dirty_untracked": True,
+                "worktree_path": "branches/docs-issue-260-forbid-commit-fallbacks",
+            },
+            command_log=["git reset --hard FETCH_HEAD"],
+        )
+        self.assertFalse(result["proven"])
+        self.assertTrue(any("untracked" in r.lower() for r in result["reasons"]))
+
+    def test_workspace_none_with_reset_blocks(self):
+        report = "\n".join([
+            "Review worktree path: branches/review-pr280-feat-issue-275-claim",
+            "Workspace mutations: none",
+            "Worktree mutations: git reset --hard FETCH_HEAD",
+        ])
+        result = assess_worktree_ownership_report(
+            report,
+            ownership_session={
+                "session_owned": True,
+                "worktree_path": "branches/review-pr280-feat-issue-275-claim",
+            },
+            command_log=["git reset --hard FETCH_HEAD"],
+        )
+        self.assertFalse(result["proven"])
+        self.assertTrue(any("workspace mutations" in r.lower() for r in result["reasons"]))
+
+    def test_main_checkout_blocks(self):
+        result = assess_worktree_ownership_report(
+            "Review worktree path: /Users/dev/Gitea-Tools",
+            ownership_session={
+                "validation_ran": True,
+                "main_checkout": True,
+                "worktree_path": "/Users/dev/Gitea-Tools",
+            },
+        )
+        self.assertFalse(result["proven"])
+
+
+class TestExport(unittest.TestCase):
+    def test_review_proofs_reexport(self):
+        from review_proofs import assess_worktree_ownership_report as exported
+
+        self.assertTrue(callable(exported))
+
+
+if __name__ == "__main__":
+    unittest.main()