feat: require MCP-native post-merge cleanup proof (Closes #517)

Add mcp_native_cleanup_proof verifier that blocks raw git branch deletion and raw API comment deletion scripts as cleanup proof, requires authorized reconciler MCP tools in cleanup mutation ledgers, and separates merge from cleanup mutations in controller handoffs. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-08 12:54:37 -04:00
parent cc63ab74e6
commit ea51b0196a
6 changed files with 505 additions and 1 deletions
@@ -978,6 +978,27 @@ If any gate fails, report:

 Skipped cleanup with an exact blocker passes validation. Performed-cleanup claims without the checklist fail validation.

+## 28B. MCP-native cleanup only (#517)
+
+Post-merge cleanup of leases, comments, branches, and worktrees must go through
+explicit MCP tools — never raw git, curl/API scripts, or ad hoc helper scripts.
+
+Merger and reviewer sessions must **not** perform cleanup inline. Record:
+
+* **Merge mutations** — only `gitea_merge_pr` (or review mutations for review-only runs)
+* **Cleanup mutations** — only authorized reconciler MCP tools, cited by exact tool name
+
+Authorized cleanup tools include `gitea_reconcile_merged_cleanups`,
+`gitea_cleanup_post_merge_moot_lease`, `gitea_delete_branch`, and
+`gitea_cleanup_merged_pr_branch` (when available). Lease cleanup uses
+append-only release comments — never delete another session's lease comment.
+
+Hand cleanup to a `prgs-reconciler` session with `gitea.branch.delete` capability
+proof. Raw `git branch -d`, `git push --delete`, and comment-deletion API calls
+are blocked in final-report validation.
+
+Template: `templates/post-merge-cleanup-handoff.md`.
+
 ## 29. Recovery handoff rules

 If blocked, produce a recovery handoff with: