Merge branch 'master' into fix/issue-790-slice-a-heartbeat-policy
This commit is contained in:
+193
-106
@@ -11388,127 +11388,163 @@ def gitea_reconcile_merged_cleanups(
|
||||
if dry_run:
|
||||
report["dry_run"] = True
|
||||
report["executed"] = False
|
||||
# #851: surface planned lifecycle order so dry-run matches execute.
|
||||
report["planned_execution_orders"] = {
|
||||
str(entry.get("pr_number")): entry.get("planned_execution_order") or []
|
||||
for entry in (report.get("entries") or [])
|
||||
}
|
||||
return {"success": True, "performed": False, **report}
|
||||
|
||||
verify_preflight_purity(
|
||||
remote, task="reconcile_merged_cleanups", org=org, repo=repo
|
||||
)
|
||||
actions: list[dict] = []
|
||||
project_root = _canonical_local_git_root()
|
||||
|
||||
def _ownership_records_for_branch(
|
||||
head_branch: str, pr_num_int: int | None
|
||||
) -> list[dict]:
|
||||
ownership_bundle = _collect_branch_ownership_records(
|
||||
remote=remote,
|
||||
host=h,
|
||||
org=o,
|
||||
repo=r,
|
||||
branch=head_branch,
|
||||
pr_number=pr_num_int,
|
||||
project_root=project_root,
|
||||
auth=auth,
|
||||
base_api=base,
|
||||
)
|
||||
ownership_records = list(ownership_bundle.get("records") or [])
|
||||
if ownership_bundle.get("inventory_error"):
|
||||
ownership_records.append(
|
||||
{
|
||||
"category": (
|
||||
branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR
|
||||
),
|
||||
"status": "unknown",
|
||||
"remote": remote,
|
||||
"host": h,
|
||||
"org": o,
|
||||
"repo": r,
|
||||
"branch": head_branch,
|
||||
"reclaim_allowed": False,
|
||||
"role": "inventory",
|
||||
}
|
||||
)
|
||||
return ownership_records
|
||||
|
||||
def _attempt_owned_remote_delete(
|
||||
*,
|
||||
head_branch: str,
|
||||
pr_num_int: int | None,
|
||||
after_worktree_removal: bool = False,
|
||||
) -> dict:
|
||||
"""Fail-closed remote delete with live ownership reassessment (#851)."""
|
||||
import urllib.parse
|
||||
|
||||
ownership_records = _ownership_records_for_branch(head_branch, pr_num_int)
|
||||
ownership = branch_cleanup_guard.assess_active_branch_ownership(
|
||||
remote=remote,
|
||||
org=o,
|
||||
repo=r,
|
||||
branch=head_branch,
|
||||
host=h,
|
||||
records=ownership_records,
|
||||
)
|
||||
if ownership.get("block"):
|
||||
return {
|
||||
"action": "delete_remote_branch",
|
||||
"branch": head_branch,
|
||||
"success": False,
|
||||
"performed": False,
|
||||
"delete_acknowledged": False,
|
||||
"verified_absent": False,
|
||||
"blocker_kind": "active_branch_ownership",
|
||||
"reasons": ownership.get("reasons") or [],
|
||||
"blocking_categories": ownership.get("blocking_categories") or [],
|
||||
"after_worktree_removal": after_worktree_removal,
|
||||
"ownership_reassessed": after_worktree_removal,
|
||||
}
|
||||
|
||||
encoded = urllib.parse.quote(head_branch, safe="")
|
||||
url = f"{base}/branches/{encoded}"
|
||||
with _audited(
|
||||
"delete_branch",
|
||||
host=h,
|
||||
remote=remote,
|
||||
org=o,
|
||||
repo=r,
|
||||
target_branch=head_branch,
|
||||
request_metadata={
|
||||
"branch": head_branch,
|
||||
"source": "reconcile_merged_cleanups",
|
||||
"ownership_checked": True,
|
||||
"after_worktree_removal": after_worktree_removal,
|
||||
},
|
||||
):
|
||||
api_request("DELETE", url, auth)
|
||||
readback = _probe_remote_branch(h, o, r, auth, head_branch)
|
||||
readback_assessment = branch_cleanup_guard.assess_post_delete_readback(
|
||||
readback
|
||||
)
|
||||
verified = bool(readback_assessment.get("verified_absent"))
|
||||
return {
|
||||
"action": "delete_remote_branch",
|
||||
"branch": head_branch,
|
||||
"success": bool(readback_assessment.get("ok")),
|
||||
"performed": True,
|
||||
"delete_acknowledged": True,
|
||||
"verified_absent": verified,
|
||||
"readback": readback_assessment.get("readback"),
|
||||
"reasons": readback_assessment.get("reasons") or [],
|
||||
"after_worktree_removal": after_worktree_removal,
|
||||
"ownership_reassessed": after_worktree_removal,
|
||||
}
|
||||
|
||||
for entry in report.get("entries") or []:
|
||||
head_branch = entry.get("head_branch") or ""
|
||||
remote_assessment = entry.get("remote_branch") or {}
|
||||
local_assessment = entry.get("local_worktree") or {}
|
||||
pr_num = entry.get("pr_number")
|
||||
try:
|
||||
pr_num_int = int(pr_num) if pr_num is not None else None
|
||||
except (TypeError, ValueError):
|
||||
pr_num_int = None
|
||||
|
||||
if remote_assessment.get("safe_to_delete_remote"):
|
||||
import urllib.parse
|
||||
|
||||
pr_num = entry.get("pr_number")
|
||||
try:
|
||||
pr_num_int = int(pr_num) if pr_num is not None else None
|
||||
except (TypeError, ValueError):
|
||||
pr_num_int = None
|
||||
ownership_bundle = _collect_branch_ownership_records(
|
||||
remote=remote,
|
||||
host=h,
|
||||
org=o,
|
||||
repo=r,
|
||||
branch=head_branch,
|
||||
pr_number=pr_num_int,
|
||||
project_root=_canonical_local_git_root(),
|
||||
auth=auth,
|
||||
base_api=base,
|
||||
)
|
||||
ownership_records = list(ownership_bundle.get("records") or [])
|
||||
if ownership_bundle.get("inventory_error"):
|
||||
ownership_records.append(
|
||||
{
|
||||
"category": (
|
||||
branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR
|
||||
),
|
||||
"status": "unknown",
|
||||
"remote": remote,
|
||||
"host": h,
|
||||
"org": o,
|
||||
"repo": r,
|
||||
"branch": head_branch,
|
||||
"reclaim_allowed": False,
|
||||
"role": "inventory",
|
||||
}
|
||||
)
|
||||
ownership = branch_cleanup_guard.assess_active_branch_ownership(
|
||||
remote=remote,
|
||||
org=o,
|
||||
repo=r,
|
||||
branch=head_branch,
|
||||
host=h,
|
||||
records=ownership_records,
|
||||
)
|
||||
if ownership.get("block"):
|
||||
actions.append(
|
||||
{
|
||||
"action": "delete_remote_branch",
|
||||
"branch": head_branch,
|
||||
"success": False,
|
||||
"performed": False,
|
||||
"delete_acknowledged": False,
|
||||
"verified_absent": False,
|
||||
"blocker_kind": "active_branch_ownership",
|
||||
"reasons": ownership.get("reasons") or [],
|
||||
"blocking_categories": ownership.get(
|
||||
"blocking_categories"
|
||||
)
|
||||
or [],
|
||||
}
|
||||
)
|
||||
continue
|
||||
|
||||
encoded = urllib.parse.quote(head_branch, safe="")
|
||||
url = f"{base}/branches/{encoded}"
|
||||
with _audited(
|
||||
"delete_branch",
|
||||
host=h,
|
||||
remote=remote,
|
||||
org=o,
|
||||
repo=r,
|
||||
target_branch=head_branch,
|
||||
request_metadata={
|
||||
"branch": head_branch,
|
||||
"source": "reconcile_merged_cleanups",
|
||||
"ownership_checked": True,
|
||||
},
|
||||
):
|
||||
api_request("DELETE", url, auth)
|
||||
readback = _probe_remote_branch(h, o, r, auth, head_branch)
|
||||
readback_assessment = branch_cleanup_guard.assess_post_delete_readback(
|
||||
readback
|
||||
)
|
||||
verified = bool(readback_assessment.get("verified_absent"))
|
||||
actions.append(
|
||||
{
|
||||
"action": "delete_remote_branch",
|
||||
"branch": head_branch,
|
||||
"success": bool(readback_assessment.get("ok")),
|
||||
"performed": True,
|
||||
"delete_acknowledged": True,
|
||||
"verified_absent": verified,
|
||||
"readback": readback_assessment.get("readback"),
|
||||
"reasons": readback_assessment.get("reasons") or [],
|
||||
}
|
||||
)
|
||||
|
||||
# #851 lifecycle: when the target worktree is independently safe, remove
|
||||
# it first so worktree_binding ownership does not permanently strand
|
||||
# both the worktree and the remote branch. Never skip worktree removal
|
||||
# merely because remote delete would be blocked by that binding.
|
||||
# Ownership protection for remote delete remains fail-closed below.
|
||||
worktree_removed = False
|
||||
if local_assessment.get("safe_to_remove_worktree"):
|
||||
result = merged_cleanup_reconcile.remove_local_worktree(
|
||||
_canonical_local_git_root(),
|
||||
project_root,
|
||||
head_branch,
|
||||
worktree_path=local_assessment.get("worktree_path"),
|
||||
)
|
||||
actions.append({"action": "remove_local_worktree", **result})
|
||||
# Idempotent resume: absent worktree is already gone.
|
||||
msg = (result.get("message") or "").lower()
|
||||
worktree_removed = bool(result.get("success")) or (
|
||||
"not found" in msg
|
||||
)
|
||||
|
||||
if remote_assessment.get("safe_to_delete_remote"):
|
||||
actions.append(
|
||||
_attempt_owned_remote_delete(
|
||||
head_branch=head_branch,
|
||||
pr_num_int=pr_num_int,
|
||||
after_worktree_removal=worktree_removed,
|
||||
)
|
||||
)
|
||||
|
||||
for scratch in report.get("reviewer_scratch_entries") or []:
|
||||
if not scratch.get("safe_to_remove_worktree"):
|
||||
continue
|
||||
result = merged_cleanup_reconcile.remove_reviewer_scratch_worktree(
|
||||
_canonical_local_git_root(), scratch.get("worktree_path") or ""
|
||||
project_root, scratch.get("worktree_path") or ""
|
||||
)
|
||||
actions.append({"action": "remove_reviewer_scratch_worktree", **result})
|
||||
|
||||
@@ -20058,6 +20094,7 @@ def _allocator_candidates_from_gitea(
|
||||
state="open",
|
||||
labels=tuple(labels),
|
||||
title=title,
|
||||
body=body,
|
||||
priority=20 if "status:ready" in labels else 1,
|
||||
blocked=blocked,
|
||||
dependency_unmet=dep_unmet,
|
||||
@@ -21294,10 +21331,21 @@ def gitea_adopt_workflow_lease(
|
||||
remote: str = "dadeschools",
|
||||
host: str | None = None,
|
||||
) -> dict:
|
||||
"""Adopt a control-plane lease through the sanctioned path (#601).
|
||||
"""Adopt a control-plane lease through the sanctioned path (#601 / #843).
|
||||
|
||||
Same-owner resume refreshes provenance. Foreign active leases are refused.
|
||||
Expired leases may be reclaimed; provenance records adopted_from/by.
|
||||
Same-owner resume refreshes provenance. Foreign active leases are refused
|
||||
unless the lease is a pending controller cross-role handoff and the caller
|
||||
holds the required role (independent consume without sharing the
|
||||
controller session). Expired leases may be reclaimed; provenance records
|
||||
adopted_from/by. Terminal (abandoned/released) leases cannot be adopted.
|
||||
|
||||
#843 F1: the adopter role is derived authoritatively from the active
|
||||
authenticated profile — never from caller input. A supplied ``role`` that
|
||||
does not exactly match the profile-derived role is rejected (no silent
|
||||
accept or reinterpretation), and handoff provenance ``required_profile`` /
|
||||
``required_namespace`` restrictions are validated against the same
|
||||
authoritative caller context. Caller-supplied role/profile/namespace can
|
||||
never grant authority.
|
||||
"""
|
||||
read_block = _profile_operation_gate("gitea.read")
|
||||
if read_block:
|
||||
@@ -21306,25 +21354,64 @@ def gitea_adopt_workflow_lease(
|
||||
"reasons": read_block,
|
||||
"permission_report": _permission_block_report("gitea.read"),
|
||||
}
|
||||
profile = get_profile()
|
||||
profile_name = (profile.get("profile_name") or "").strip() or "session"
|
||||
active_role = (_profile_role_kind(profile) or "").strip().lower()
|
||||
if not active_role:
|
||||
return {
|
||||
"success": False,
|
||||
"outcome": "blocked",
|
||||
"mutation_performed": False,
|
||||
"reasons": [
|
||||
"active profile role could not be derived authoritatively; "
|
||||
"refusing lease adoption (fail closed, #843)"
|
||||
],
|
||||
"lease_id": lease_id,
|
||||
"authoritative_source": "control_plane_db",
|
||||
"file_lock_only": False,
|
||||
"comment_lease_only": False,
|
||||
}
|
||||
if role is not None and str(role).strip():
|
||||
supplied_role = str(role).strip().lower()
|
||||
if supplied_role != active_role:
|
||||
return {
|
||||
"success": False,
|
||||
"outcome": "blocked",
|
||||
"mutation_performed": False,
|
||||
"profile_role_kind": active_role,
|
||||
"supplied_role": supplied_role,
|
||||
"reasons": [
|
||||
f"caller-supplied role '{supplied_role}' does not match "
|
||||
f"the authenticated profile-derived role '{active_role}'; "
|
||||
"caller-supplied role/profile/namespace can never grant "
|
||||
"authority (fail closed, #843)"
|
||||
],
|
||||
"lease_id": lease_id,
|
||||
"authoritative_source": "control_plane_db",
|
||||
"file_lock_only": False,
|
||||
"comment_lease_only": False,
|
||||
}
|
||||
db, errs = _control_plane_db_or_error()
|
||||
if db is None:
|
||||
return {"success": False, "reasons": errs}
|
||||
profile = get_profile()
|
||||
profile_name = (profile.get("profile_name") or "").strip() or "session"
|
||||
active_role = _profile_role_kind(profile) or "author"
|
||||
sid = (session_id or "").strip() or (
|
||||
f"{profile_name}-{os.getpid()}-{uuid.uuid4().hex[:8]}"
|
||||
)
|
||||
adopter_namespace = allocator_service.DEFAULT_ROLE_NAMESPACES.get(
|
||||
active_role, f"gitea-{active_role}"
|
||||
)
|
||||
try:
|
||||
return lease_lifecycle.adopt_lease(
|
||||
db,
|
||||
lease_id=lease_id,
|
||||
adopter_session_id=sid,
|
||||
role=(role or active_role).strip() or "author",
|
||||
role=active_role,
|
||||
worktree_path=worktree_path,
|
||||
expected_head_sha=expected_head_sha,
|
||||
owner_pid=os.getpid(),
|
||||
operator_authorized=bool(operator_authorized),
|
||||
adopter_profile_name=profile_name,
|
||||
adopter_namespace=adopter_namespace,
|
||||
)
|
||||
except (lease_lifecycle.LeaseLifecycleError, control_plane_db.ControlPlaneError) as exc:
|
||||
return {
|
||||
|
||||
Reference in New Issue
Block a user