3 Commits

Include renames

Author	SHA1	Message	Date
sysadmin	d302602567	feat(guard): harden workflow against unattributed root WIP and pytest-disabled production guards (Closes #683) ... Add shared workflow_scope_guard with typed blockers (blocker_kind + exact_next_action) and force-on production enforcement under pytest. Wire root/branches/scope checks through verify_preflight_purity and mutation entrypoints (create_issue, comment_issue) without adopting the rejected 300a4ca patterns (test-mode early-return, porcelain *.py filter). Regression suite covers out-of-scope issue ownership, root diagnostic edits, worktree bind success path, force-on under pytest, porcelain integrity, monkeypatch resistance, real entrypoint fail-closed proof, and durable failure recording.	2026-07-12 13:15:58 -04:00
sysadminandClaude Opus 4.8	3bce0a55fb	test: reset preflight globals in read-survival setUp (#469) ... Prevents cross-test leakage that masked the missing-capability fail-closed case. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-07-08 03:23:12 -04:00
sysadminandClaude Opus 4.8	afb4ba563c	fix: preserve capability preflight across interleaved read-only whoami (#469) ... Read-only gitea_whoami calls no longer clear a valid capability proof when whoami was already verified clean. Capability is consumed on mutation (one resolve per mutation), and verify_preflight_purity rejects task mismatches. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-07-08 03:23:12 -04:00