Merge branch 'master' into feat/issue-664-break-glass-restart

task_capability_map.py

@@ -41,6 +41,27 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.issue.comment",
         "role": "author",
     },
+    # #953: target-specific upgrade of an incomplete bootstrap lock (explicit
+    # operation, never a widening of lock_issue). Author-only, and the tool
+    # additionally proves exact-owner claimant match before writing.
+    "recover_incomplete_bootstrap_lock": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+    "gitea_recover_incomplete_bootstrap_lock": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+    # #953: read-only lock contract inspection. Read permission only — it must
+    # never be able to mutate.
+    "inspect_issue_lock_contract": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "gitea_inspect_issue_lock_contract": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
     # #860: dirty orphaned same-claimant worktree recovery (explicit operation).
     "recover_dirty_orphaned_issue_worktree": {
         "permission": "gitea.issue.comment",
@@ -142,6 +163,23 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.read",
         "role": "author",
     },
+    # #644: Phase 2 Web Console recovery tasks.
+    "clear_stale_binding": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "rebind_session_worktree": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    # The console playbook orchestrates gitea_reconcile_merged_cleanups, whose
+    # own gate is gitea.read (matching the existing reconcile_merged_cleanups
+    # entry). Declaring a stricter permission here stated a second, conflicting
+    # authority for one operation.
+    "reconcile_cleanups": {
+        "permission": "gitea.read",
+        "role": "reconciler",
+    },
     # PR synchronization lifecycle: assess is read-only (any role with gitea.read);
     # update-by-merge is author-only and mutates the PR head via Gitea API.
     "assess_pr_sync_status": {