Add mcp_native_cleanup_proof verifier that blocks raw git branch deletion and
raw API comment deletion scripts as cleanup proof, requires authorized
reconciler MCP tools in cleanup mutation ledgers, and separates merge from
cleanup mutations in controller handoffs.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Extend the review workflow load gate with pre-review command classification,
boundary violation tracking, and structured helper-result requirements in
final reports. Adds gitea_record_pre_review_command MCP tool.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Merge prgs/master into feat/issue-405-mutation-capability-proof and keep
both reviewer mutation-capability proof and post-merge cleanup proof rules.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Add reviewer_handoff_consistency validation for narrative vs mutation
ledger contradictions, wire it into review_pr final-report rules, and
document the blocked-review handoff template.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Merge current prgs/master into feat/issue-399-conflict-fix-leases.
Preserve reviewer PR lease gate (#407) before conflict-fix stale-head
gate (#399); document both as §26B and §26C. Align MCP and validator
tests with mandatory expected_head_sha and stale-head proof fields.
Add audit vs cleanup phase tracking so reconciliation audits stay read-only
unless cleanup is explicitly authorized with delete capability proof, safety
proof, and before/after snapshots. Block gitea_delete_branch and merged-cleanup
execution during audit phase, validate final reports for false no-mutations
claims, and document the boundary in the reconcile-landed-pr workflow.
Adds mutation-capability table validation so review_pr cannot authorize
merge or delete mutations without their own exact capability rows.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Adds post_merge_cleanup_proof validation so cleanup claims must carry the
branch deletion and worktree removal checklists, or report CLEANUP_SKIPPED
with an exact blocker.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Add lock_provenance metadata on gitea_lock_issue writes and fail closed at
gitea_create_pr when provenance is missing. Final-report validation now
requires explicit External-state mutations disclosure for issue-lock
read/write/delete and blocks mixed author PR creation with reviewer approval.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Rebased onto current prgs/master; merged with #396 validation failure
history by keeping both validator rules and workflow handoff fields.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Closes#306.
The dedicated reconciler close path (profile, gated close tool, ancestor
proof, tests) already shipped across #301/#304/#309/#310, but the
final-report validator did not require a reconciler close to prove itself.
A handoff could report `PRs closed: #N` while omitting the close
capability, ancestor proof, or linked-issue result and still grade A.
This adds the missing report-time enforcement.
Changes:
- final_report_validator.py — new `reconcile.close_proof_fields` rule
(`_rule_reconcile_close_proof`). Fires only when a PR close is reported
(via the `PRs closed` field or a `reconciler_close_lock`), then blocks
unless the handoff carries close capability proof (gitea.pr.close),
ancestor proof, PR close result, and linked-issue result. Comment-only
and blocked reconciliations are unaffected. New optional
`reconciler_close_lock` kwarg on `assess_final_report_validator`.
- tests/test_final_report_validator.py — TestReconcilerCloseProof (6 cases):
full-proof close passes; missing capability / ancestor / linked-issue
result each block; session close lock requires proof; comment-only
needs no close proof.
- reconcile-landed-pr.md — §18A documents the enforced gate.
Validation:
venv/bin/python -m pytest tests/test_final_report_validator.py \
tests/test_reconciler_close_gate.py tests/test_already_landed_reconcile.py \
tests/test_reconcile_already_landed_pr_tool.py \
tests/test_reconciliation_workflow.py tests/test_review_proofs.py -q
289 passed.
Worktree: branches/issue-306-reconciler-close-proof
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Introduce validation_status_vocabulary with proof-path binding for baseline-
equivalent, merge-simulation-resolved, and transient-pass labels. Wire the
assessor into final_report_validator and document the taxonomy in the
review-merge workflow.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Add assess_validation_failure_history_report so reviewer final reports must
document every validation failure observed during a session, not only the
final passing result. Wire the verifier into final_report_validator,
gitea_validate_review_final_report, and the review-merge workflow template.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Reconciliation final reports must emit only the canonical reconciliation
handoff schema:
- Expand _RECONCILE_REQUIRED_FIELDS from 5 to the full 27-field canonical
schema (Task through No review/merge confirmation), so incomplete
reconciliation handoffs downgrade with per-field reasons.
- Add 'issue lock proof', 'claim/comment status', and 'workspace mutations'
to _RECONCILE_STALE_FIELDS so stale author/reviewer fields block.
- Make the 'PR number opened' rejection conditional on a new
session_pr_opened proof kwarg: the field is allowed only when a PR was
actually opened in the session.
- Close the git-fetch reporting gap: a fetch observed only in the action
log (not report text) now requires a Git ref mutations entry as well.
- Update the reconciliation handoff fixture to the canonical schema and
add TestCanonicalReconcileSchema covering blocked, successful-close,
and comment-only reconciliation plus missing-close-capability,
stale-field, and conditional PR-number-opened paths.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Add reviewer_already_landed_classification verifier to block oldest/next
eligible PR wording, review-eligible claims, and pinned reviewed head
usage when a PR is already landed. Wire the check into build_final_report
and tighten final_report_validator regex coverage.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
sysadmin
