fix(session): require config-backed mutation authority and workspace-bound targets (#714)

Close the #714 remediation gap left at 943d402 where env-only mutation
profiles, REMOTES Timesheet defaults treated as explicit caller input, and
machine-dependent Git remotes produced false greens.

- Fail closed when mutations lack a config-backed profile with non-empty
  allowed_repositories; env ops cannot invent mutation authority.
- Preserve omitted-vs-explicit org/repo provenance through the mutation
  gate; omitted targets bind to the verified workspace repository.
- Prefer workspace-aligned Git remotes over historical Timesheet defaults
  in MCP _resolve and CLI resolve_remote.
- Centralize deterministic config-backed mutation fixtures; migrate
  mutation tests off env-only authority without weakening security
  assertions.

Full suite: 2744 passed, 6 skipped.

This commit is contained in:

sysadmin

2026-07-15 21:13:21 -04:00

parent 943d40270e

commit dc899d23c8

36 changed files with 1343 additions and 227 deletions

									
										tests/test_issue_comment_workspace_guard.py
									
		+4
		
												View File
												
				@@ -1,3 +1,7 @@

				import sys as _sys

				from pathlib import Path as _Path

				_sys.path.insert(0, str(_Path(__file__).resolve().parent))

				from mutation_profile_fixture import shared_mutation_env  # noqa: E402

				import os

				import sys

				import unittest