fix(worktree-audit): make cleanup audit merged-PR aware for issue worktrees (Closes #858)
gitea_audit_worktree_cleanup had no PR linkage. Issue worktrees therefore
reported pr_number=null and classified as active_issue_work with
removable=false permanently, even once their PR was merged and the head was
already contained in master. Observed on live master 9301739910: 42
issue_work worktrees, 0 removable, 0 with pr_number populated, while
gitea_reconcile_merged_cleanups reported the same worktree safe to remove.
Two independent gaps caused it:
* build_worktree_metadata was never given a pr_number, and only open PRs were
fetched, so no owning-PR evidence existed at all.
* clean_stale_removable was unreachable for issue_work: it required
ttl_expired, derived from a last_used_at that nothing populates, and
is_ttl_expired fail-safes to False when the timestamp is unknown.
This adds deterministic merged-PR linkage and gates removal on the complete
cleanup policy:
* build_pr_index / resolve_owning_pr link a worktree branch to exactly one
owning PR. Competing PRs on one branch, a still-open owner, a head-branch
mismatch, or missing PR state all fail closed while still reporting the
resolved pr_number.
* assess_merged_pr_worktree_cleanup requires all of: conclusive merged
ownership, branch agreement, containment of the head in authoritative
master, no open/competing PR, no active lease, no issue lock, no live
session, a clean tree, and a non-protected checkout. Unknown state blocks.
* Containment reuses merged_cleanup_reconcile.is_head_ancestor_of_ref so the
audit and the PR-scoped reconciler agree on what "already landed" means.
Lease evidence is now supplied. audit_branches_directory already accepted
leased_branches but the MCP tool never passed it, so has_active_lease was
false for every worktree in a live run. That was inert only while issue
worktrees could never become removable; it is wired to authoritative
control-plane leases here, scoped so a lease on issue N protects that issue's
work worktree and not a baseline or review tree merely named after it.
Issue work no longer becomes removable on TTL age alone, since age is not
proof that a branch landed and would otherwise reclaim a worktree holding
unmerged commits. conflict_fix keeps its existing TTL behaviour, and review,
baseline, merge-simulation, detached, dirty, open-PR, and protected
classifications are unchanged.
The assessor still performs no deletion and gains no cleanup mutation. This
is assessor-side only and does not implement the PR-scoped executor or the
expired-lease reclaim policy tracked separately by #855.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
Claude Opus 4.8
+77
-5
@@ -11634,6 +11634,7 @@ def gitea_audit_worktree_cleanup(
|
||||
org: str | None = None,
|
||||
repo: str | None = None,
|
||||
ttl_hours: float = worktree_cleanup_audit.DEFAULT_TTL_HOURS,
|
||||
merged_pr_limit: int = 200,
|
||||
) -> dict:
|
||||
"""Read-only: classify every session-owned worktree under ``branches/`` (#401).
|
||||
|
||||
@@ -11644,17 +11645,26 @@ def gitea_audit_worktree_cleanup(
|
||||
the active issue-lock branch is read from the local lock file and treated
|
||||
as active work. Deletes nothing and mutates no Gitea state.
|
||||
|
||||
Fails closed if the live open-PR list cannot be fetched: without it,
|
||||
removability cannot be proven, so no candidates are returned.
|
||||
Merged PRs are fetched as well, so an issue worktree can be linked to the
|
||||
PR that owns its branch (#858). Such a worktree only becomes removable
|
||||
when that owning PR is unambiguous and merged, the worktree head is
|
||||
already contained in authoritative master, and nothing else protects it —
|
||||
no open or competing PR, lease, issue lock, live session, dirty file, or
|
||||
protected/control checkout. Anything unproven keeps it classified as
|
||||
active issue work.
|
||||
|
||||
Fails closed if the live open-PR list, the merged-PR list, or the
|
||||
control-plane lease state cannot be read: without them removability
|
||||
cannot be proven, so no candidates are returned.
|
||||
|
||||
Args:
|
||||
remote: Known instance — 'dadeschools' or 'prgs'.
|
||||
host: Override the Gitea host.
|
||||
org: Override the owner/organization.
|
||||
repo: Override the repository name.
|
||||
ttl_hours: Age (hours) after which a clean issue/conflict-fix
|
||||
worktree becomes stale-removable (default from
|
||||
GITEA_WORKTREE_TTL_HOURS).
|
||||
ttl_hours: Age (hours) after which a clean conflict-fix worktree
|
||||
becomes stale-removable (default from GITEA_WORKTREE_TTL_HOURS).
|
||||
merged_pr_limit: Max closed PRs scanned for merged-PR ownership.
|
||||
|
||||
Returns:
|
||||
dict with per-worktree classifications, counts, removable
|
||||
@@ -11690,22 +11700,84 @@ def gitea_audit_worktree_cleanup(
|
||||
if (pr.get("head") or {}).get("ref")
|
||||
}
|
||||
|
||||
# #858: merged PRs are the ownership evidence that lets a landed issue
|
||||
# worktree stop being reported as active work. Without them the audit can
|
||||
# never agree with the PR-scoped reconciler, so treat a fetch failure the
|
||||
# same way an open-PR fetch failure is treated: fail closed.
|
||||
try:
|
||||
closed_prs = api_get_all(
|
||||
f"{repo_api_url(h, o, r)}/pulls?state=closed", auth, limit=merged_pr_limit
|
||||
)
|
||||
except Exception as exc:
|
||||
return {
|
||||
"success": False,
|
||||
"performed": False,
|
||||
"open_pr_state_verified": True,
|
||||
"merged_pr_state_verified": False,
|
||||
"reasons": [
|
||||
"could not fetch merged PRs; worktree ownership unverified "
|
||||
f"(fail closed): {_redact(str(exc))}"
|
||||
],
|
||||
}
|
||||
merged_prs = [pr for pr in closed_prs if (pr.get("merged") or pr.get("merged_at"))]
|
||||
pr_index = worktree_cleanup_audit.build_pr_index(list(open_prs) + merged_prs)
|
||||
|
||||
# #858: the auditor already accepted lease evidence but nothing ever
|
||||
# supplied it, so every worktree looked unleased. Removability is now
|
||||
# reachable for issue worktrees, so authoritative control-plane leases
|
||||
# must be readable or the audit fails closed.
|
||||
db, lease_errs = _control_plane_db_or_error()
|
||||
if db is None:
|
||||
return {
|
||||
"success": False,
|
||||
"performed": False,
|
||||
"open_pr_state_verified": True,
|
||||
"merged_pr_state_verified": True,
|
||||
"lease_state_verified": False,
|
||||
"reasons": [
|
||||
"could not read control-plane leases; worktree protection "
|
||||
"unverified (fail closed)",
|
||||
*lease_errs,
|
||||
],
|
||||
}
|
||||
lease_result = lease_lifecycle.list_active_leases(
|
||||
db, remote=remote, org=o, repo=r, include_non_active=False, limit=500
|
||||
)
|
||||
leased_issue_numbers: set[int] = set()
|
||||
live_session_paths: set[str] = set()
|
||||
for lease in lease_result.get("leases") or []:
|
||||
if lease.get("work_kind") == "issue" and lease.get("work_number") is not None:
|
||||
try:
|
||||
leased_issue_numbers.add(int(lease["work_number"]))
|
||||
except (TypeError, ValueError):
|
||||
pass
|
||||
if lease.get("worktree_path"):
|
||||
live_session_paths.add(str(lease["worktree_path"]))
|
||||
|
||||
active_issue_branches: set[str] = set()
|
||||
lock = merged_cleanup_reconcile.read_issue_lock(ISSUE_LOCK_FILE)
|
||||
if lock and lock.get("branch_name"):
|
||||
active_issue_branches.add(str(lock["branch_name"]).strip())
|
||||
|
||||
master_ref = f"{remote}/master" if remote in REMOTES else "origin/master"
|
||||
report = worktree_cleanup_audit.audit_branches_directory(
|
||||
_canonical_local_git_root(),
|
||||
open_pr_branches=open_pr_branches,
|
||||
active_issue_branches=active_issue_branches,
|
||||
now=datetime.now(timezone.utc),
|
||||
ttl_hours=ttl_hours,
|
||||
pr_index=pr_index,
|
||||
leased_issue_numbers=leased_issue_numbers,
|
||||
live_session_paths=live_session_paths,
|
||||
master_ref=master_ref,
|
||||
)
|
||||
return {
|
||||
"success": True,
|
||||
"performed": False,
|
||||
"open_pr_state_verified": True,
|
||||
"merged_pr_state_verified": True,
|
||||
"lease_state_verified": True,
|
||||
"master_ref": master_ref,
|
||||
"task_mode": "work-issue",
|
||||
**report,
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user