Defect A - invariants:
- task_capability_map.ROLE_EXCLUSIVE_TASKS is now the single shared
definition of role-exclusive tasks; the resolver's inline copy is gone
(AC1/AC5 drift surface removed).
- tests: every role-exclusive task must exist in the capability map;
formal-review tasks stay role-exclusive; canonical merger satisfies
merge_pr; canonical reconciler satisfies branch-cleanup tasks
(extends the #722 break-glass invariant suite).
Defect B - unactionable internal_error:
- AC3: gitea_resolve_task_capability records the capability purity
baseline first but stamps _preflight_resolved_role/_task only for an
ALLOWED resolve; a denied resolve clears any stale stamp
(_clear_resolved_capability_stamp) so later mutation preflights key
off the real profile role.
- AC4: _evaluate_pr_review_submission converts
_verify_role_mutation_workspace failures (role binding, stale
runtime) into result reasons with blocker_kind=workspace_role_binding
instead of letting RuntimeError escape as a generic internal_error.
- AC5: _build_runtime_task_capabilities applies the resolver's
role-exclusive filter when given the active role kind and labels each
entry role_filtered/permission_only; matching_configured_profiles
honors declared profile roles for role-exclusive tasks.
Validation: focused suites 22 passed (+48 subtests); adjacent resolver/
runtime/review suites 72 passed; full suite 2929 passed, 6 skipped,
221 subtests (single pre-existing Starlette warning, #682).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
