Merge branch 'master' into feat/issue-605-workflow-dashboard

gitea_mcp_server.py

@@ -701,6 +701,18 @@ def _clear_preflight_capability_state() -> None:
     _preflight_reviewer_violation_files = []
 
 
+def _invalidate_preflight_identity_state() -> None:
+    """Fail closed when whoami cannot prove the configured identity."""
+    global _preflight_whoami_called, _preflight_whoami_violation
+    global _preflight_whoami_baseline_porcelain, _preflight_whoami_violation_files
+
+    _preflight_whoami_called = False
+    _preflight_whoami_violation = False
+    _preflight_whoami_baseline_porcelain = None
+    _preflight_whoami_violation_files = []
+    _clear_preflight_capability_state()
+
+
 def record_preflight_check(
     type_name: str,
     resolved_role: str | None = None,
@@ -1101,6 +1113,8 @@ def _run_anti_stomp_preflight(
 
     # Workflow-hash facts when the task is review/merge oriented.
     if workflow_hash_valid is None and task in {
+        "acquire_reviewer_pr_lease",
+        "gitea_acquire_reviewer_pr_lease",
         "review_pr",
         "submit_pr_review",
         "approve_pr",
@@ -1236,7 +1250,9 @@ def verify_preflight_purity(
         if (
             task is not None
             and _preflight_resolved_task is not None
-            and task != _preflight_resolved_task
+            and not task_capability_map.preflight_task_matches(
+                _preflight_resolved_task, task
+            )
         ):
             raise _PreflightOrderError(
                 "Pre-flight task mismatch: "
@@ -14163,6 +14179,8 @@ def gitea_whoami(
         "identity_match": not id_match.get("block"),
         "identity_match_reasons": id_match.get("reasons") or [],
     }
+    if id_match.get("block"):
+        _invalidate_preflight_identity_state()
     if _reveal_endpoints():
         result["server"] = gitea_url(h, "").rstrip("/")
     return result
@@ -17731,7 +17749,12 @@ def gitea_resolve_task_capability(
         result["stale_binding_recovery"] = stale_binding
     if reason_msg:
         result["reason"] = reason_msg
-    if task in ("review_pr", "merge_pr"):
+    if task in (
+        "acquire_reviewer_pr_lease",
+        "gitea_acquire_reviewer_pr_lease",
+        "review_pr",
+        "merge_pr",
+    ):
         result["workflow_load_proof"] = review_workflow_load.workflow_load_status(
             PROJECT_ROOT)
         if not result["workflow_load_proof"].get("workflow_load_valid"):
@@ -17754,6 +17777,10 @@ def gitea_resolve_task_capability(
         )
     elif was_terminal and not (stop_required or restart_required):
         result["cleared_stale_denial"] = True
+    if stop_required or restart_required:
+        # A denied or stale resolver result is diagnostic evidence, never a
+        # consumable capability token for a later mutation (#763).
+        _clear_preflight_capability_state()
     return result