Merge branch 'prgs/master' into feat/issue-503-reviewer-active-worktree

Merge prgs/master into feat/issue-503-reviewer-active-worktree.
Preserve reviewer mutation workspace binding (#503) and fold in
master's review_pr task preflight checks via _verify_reviewer_mutation_workspace.

.env.example

@@ -46,3 +46,12 @@ GITEA_TOKEN_SOURCE=GITEA_TOKEN
 # profile's values. Leave unset for pure env-based configuration.
 GITEA_MCP_CONFIG=/Users/jasonwalker/.config/gitea-tools/profiles.json
 GITEA_MCP_PROFILE=prgs
+
+# Namespace-scoped active task workspaces (#510). Each MCP namespace uses only
+# its own role env var; foreign bindings (e.g. GITEA_AUTHOR_WORKTREE in a
+# merger process) are ignored.
+# GITEA_AUTHOR_WORKTREE=/path/to/repo/branches/issue-123-work
+# GITEA_REVIEWER_WORKTREE=/path/to/repo/branches/review-pr456
+# GITEA_MERGER_WORKTREE=/path/to/repo/branches/merge-pr456
+# GITEA_RECONCILER_WORKTREE=/path/to/repo/branches/reconcile-pr456
+# GITEA_ACTIVE_WORKTREE=/path/to/repo/branches/session-override

.gitea/pull_request_template.md

@@ -0,0 +1,20 @@
+## Description
+
+[Summary of changes and issue number closed.]
+
+Closes #[Issue Number]
+
+## Checklist
+
+- [ ] I have verified my identity matches the required role.
+- [ ] No secrets, tokens, keychain IDs, or raw service URLs are committed.
+- [ ] All tests pass for touched code.
+- [ ] `git diff --check` is clean.
+
+## Documentation and Wiki
+
+- [ ] Does this change require a wiki update (workflows, tools, profiles, runbooks)?
+- [ ] If yes, has `docs/wiki/` been updated accordingly?
+- [ ] If wiki pages changed, plan the Gitea Wiki sync after merge (`scripts/sync-gitea-wiki.sh`, see Runbooks).
+- [ ] Readiness gate (#224): the Gitea Wiki is populated and current for this repo — verify the repo **Wiki tab**, not `docs/wiki/`. If stale or empty, record the required sync as a follow-up before approval.
+- [ ] If this PR closes a wiki-related issue: closure requires live Gitea Wiki proof links (Wiki Home plus page listing or wiki git log). Markdown in `docs/wiki/`, sync-helper code, or policy docs alone are not sufficient to close a wiki issue.

.gitignore

@@ -10,3 +10,7 @@ gitea-mcp*.json
 .vscode/
 graphify-out/
 branches/
+# Throwaway agent commit-encoding helpers (#261) — never commit.
+/_encode_*.py
+/_emit_*.py
+/_inline_*.py

README.md

@@ -172,6 +172,14 @@ Recognized environment fields (see [`.env.example`](.env.example) for placeholde
 | `GITEA_MCP_CONFIG` | Optional path to a JSON file defining multiple named runtime profiles. Unset ⇒ pure env behaviour. |
 | `GITEA_MCP_PROFILE` | Name of the profile (from `GITEA_MCP_CONFIG`) to activate for this runtime. |
 
+#### External MCP Control Plane servers
+
+Jenkins and GlitchTip are separate MCP trust boundaries, not tools inside this
+Gitea MCP runtime. Register them as `jenkins-mcp` and `glitchtip-mcp` in the
+client that will use them, then reconnect or reload the client and verify the
+expected tools are visible before claiming readiness. See
+[`docs/mcp-client-registration.md`](docs/mcp-client-registration.md).
+
 Notes:
 
 - This provides **one token + one profile per process**. It does not implement

agent_temp_artifacts.py

@@ -0,0 +1,26 @@
+"""Detect throwaway agent helper scripts left in the repo root (#261)."""
+
+from __future__ import annotations
+
+import fnmatch
+
+AGENT_TEMP_BASENAME_PATTERNS = (
+    "_encode_*.py",
+    "_emit_*.py",
+    "_inline_*.py",
+)
+
+
+def find_agent_temp_artifacts_from_porcelain(porcelain: str) -> list[str]:
+    """Return untracked repo-root helper paths matching agent temp patterns."""
+    found: list[str] = []
+    for line in (porcelain or "").splitlines():
+        if not line.startswith("??"):
+            continue
+        path = line[3:].strip()
+        if not path or "/" in path or "\\" in path:
+            continue
+        basename = path.split("/")[-1]
+        if any(fnmatch.fnmatch(basename, pat) for pat in AGENT_TEMP_BASENAME_PATTERNS):
+            found.append(path)
+    return sorted(found)

already_landed_reconcile.py

@@ -0,0 +1,142 @@
+"""Already-landed open PR reconciliation gates (#310).
+
+Reconciler workflows may close an open PR only when the PR head SHA is proven
+an ancestor of a freshly fetched target branch. Arbitrary PR closure is denied.
+"""
+
+from __future__ import annotations
+
+import subprocess
+from typing import Any
+
+from merged_cleanup_reconcile import extract_linked_issue, is_head_ancestor_of_ref
+
+ELIGIBILITY_ALREADY_LANDED = "ALREADY_LANDED_RECONCILE_REQUIRED"
+ELIGIBILITY_NOT_LANDED = "NOT_ALREADY_LANDED"
+ELIGIBILITY_STALE_TARGET = "TARGET_BRANCH_UNVERIFIED"
+ELIGIBILITY_PR_NOT_OPEN = "PR_NOT_OPEN"
+
+
+def fetch_target_branch(project_root: str, remote: str, branch: str) -> dict[str, Any]:
+    """Fetch *branch* from *remote* and return the resolved SHA."""
+    ref = f"{remote}/{branch}"
+    fetch = subprocess.run(
+        ["git", "-C", project_root, "fetch", remote, branch],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if fetch.returncode != 0:
+        return {
+            "success": False,
+            "target_branch": branch,
+            "target_ref": ref,
+            "target_branch_sha": None,
+            "reasons": [
+                f"git fetch {remote} {branch} failed: "
+                f"{(fetch.stderr or fetch.stdout or '').strip()}"
+            ],
+        }
+
+    rev = subprocess.run(
+        ["git", "-C", project_root, "rev-parse", ref],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if rev.returncode != 0:
+        return {
+            "success": False,
+            "target_branch": branch,
+            "target_ref": ref,
+            "target_branch_sha": None,
+            "reasons": [
+                f"git rev-parse {ref} failed: "
+                f"{(rev.stderr or rev.stdout or '').strip()}"
+            ],
+        }
+
+    return {
+        "success": True,
+        "target_branch": branch,
+        "target_ref": ref,
+        "target_branch_sha": (rev.stdout or "").strip(),
+        "reasons": [],
+        "git_fetch_command": f"git fetch {remote} {branch}",
+    }
+
+
+def assess_already_landed_reconciliation(
+    *,
+    pr: dict[str, Any],
+    project_root: str,
+    remote: str,
+    target_branch: str,
+    target_fetch: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    """Return eligibility and proof for reconciling an open PR."""
+    pr_number = int(pr.get("number") or 0)
+    pr_state = (pr.get("state") or "").strip().lower()
+    head_sha = (pr.get("head") or {}).get("sha") if isinstance(pr.get("head"), dict) else None
+    if not head_sha and isinstance(pr.get("head"), str):
+        head_sha = None
+    head_ref = (pr.get("head") or {}).get("ref") if isinstance(pr.get("head"), dict) else pr.get("head")
+    base_ref = (pr.get("base") or {}).get("ref") if isinstance(pr.get("base"), dict) else pr.get("base")
+    title = pr.get("title") or ""
+    body = pr.get("body") or ""
+
+    fetch_result = target_fetch or fetch_target_branch(project_root, remote, target_branch)
+    linked_issue = extract_linked_issue(title, body)
+
+    result: dict[str, Any] = {
+        "pr_number": pr_number,
+        "pr_state": pr_state,
+        "candidate_head_sha": head_sha,
+        "head_ref": head_ref,
+        "base_ref": base_ref or target_branch,
+        "target_branch": target_branch,
+        "target_branch_sha": fetch_result.get("target_branch_sha"),
+        "linked_issue": linked_issue,
+        "git_ref_mutations": [],
+        "reasons": [],
+    }
+    if fetch_result.get("git_fetch_command"):
+        result["git_ref_mutations"].append(fetch_result["git_fetch_command"])
+
+    if pr_state != "open":
+        result["eligibility_class"] = ELIGIBILITY_PR_NOT_OPEN
+        result["ancestor_proof"] = None
+        result["close_allowed"] = False
+        result["reasons"].append(f"PR #{pr_number} state is {pr_state!r}, not open")
+        return result
+
+    if not fetch_result.get("success"):
+        result["eligibility_class"] = ELIGIBILITY_STALE_TARGET
+        result["ancestor_proof"] = None
+        result["close_allowed"] = False
+        result["reasons"].extend(fetch_result.get("reasons") or [])
+        return result
+
+    target_ref = fetch_result.get("target_ref") or f"{remote}/{target_branch}"
+    ancestor = is_head_ancestor_of_ref(project_root, head_sha, target_ref)
+    result["ancestor_proof"] = ancestor
+
+    if ancestor is None:
+        result["eligibility_class"] = ELIGIBILITY_STALE_TARGET
+        result["close_allowed"] = False
+        result["reasons"].append(
+            f"ancestor check failed for head {head_sha!r} against {target_ref}"
+        )
+        return result
+
+    if ancestor:
+        result["eligibility_class"] = ELIGIBILITY_ALREADY_LANDED
+        result["close_allowed"] = True
+        return result
+
+    result["eligibility_class"] = ELIGIBILITY_NOT_LANDED
+    result["close_allowed"] = False
+    result["reasons"].append(
+        f"PR head {head_sha} is not an ancestor of {target_ref}"
+    )
+    return result

author_mutation_worktree.py

@@ -0,0 +1,234 @@
+"""Branches-only author mutation worktree guard (#274).
+
+Author/coder mutations must run from a session-owned worktree under the
+project's ``branches/`` directory, never from the stable control checkout.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+
+BASE_BRANCHES = frozenset({"master", "main", "dev"})
+ACTIVE_WORKTREE_ENV = "GITEA_ACTIVE_WORKTREE"
+AUTHOR_WORKTREE_ENV = "GITEA_AUTHOR_WORKTREE"
+# Author-only: reviewer/merger/reconciler namespaces use role-specific env vars
+# via namespace_workspace_binding (#510).
+
+
+def _normalize_path(path: str) -> str:
+    return (path or "").replace("\\", "/").rstrip("/")
+
+
+def is_path_under_branches(path: str, project_root: str | None = None) -> bool:
+    """True when *path* resolves inside ``<project_root>/branches/``."""
+    normalized = _normalize_path(path)
+    if not normalized:
+        return False
+    if "/branches/" in f"{normalized}/":
+        return True
+    if normalized.endswith("/branches"):
+        return True
+    if project_root:
+        root = _normalize_path(os.path.realpath(project_root))
+        real = _normalize_path(os.path.realpath(path))
+        if real.startswith(f"{root}/"):
+            rel = real[len(root) + 1 :]
+            return rel == "branches" or rel.startswith("branches/")
+    return False
+
+
+def resolve_mutation_workspace(
+    worktree_path: str | None,
+    project_root: str,
+    *,
+    active_worktree_env: str | None = None,
+    author_worktree_env: str | None = None,
+) -> str:
+    """Resolve the workspace path inspected before author mutations."""
+    for candidate in (worktree_path, active_worktree_env, author_worktree_env):
+        text = (candidate or "").strip()
+        if text:
+            return os.path.realpath(os.path.abspath(text))
+    return os.path.realpath(project_root)
+
+
+def _realpath_git_common_dir(workspace_path: str, common_dir: str) -> str:
+    """Resolve ``git rev-parse --git-common-dir`` relative to *workspace_path*."""
+    raw = (common_dir or "").strip()
+    if not raw:
+        return raw
+    if os.path.isabs(raw):
+        return os.path.realpath(raw)
+    return os.path.realpath(os.path.join(workspace_path, raw))
+
+
+def resolve_canonical_repo_root(workspace_path: str, fallback_project_root: str) -> str:
+    """Return the stable repository root for *workspace_path* via git metadata (#460)."""
+    path = (workspace_path or "").strip()
+    fallback = os.path.realpath(fallback_project_root)
+    if not path:
+        return fallback
+    try:
+        res = subprocess.run(
+            ["git", "-C", path, "rev-parse", "--git-common-dir"],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        common = _realpath_git_common_dir(path, res.stdout)
+    except Exception:
+        return fallback
+    if common.endswith(f"{os.sep}.git"):
+        return os.path.dirname(common)
+    if os.path.basename(common) == ".git":
+        return os.path.dirname(common)
+    return fallback
+
+
+def resolve_author_mutation_context(
+    worktree_path: str | None,
+    process_project_root: str,
+    *,
+    active_worktree_env: str | None = None,
+    author_worktree_env: str | None = None,
+) -> dict:
+    """Shared workspace resolution for runtime_context and mutation guards (#460)."""
+    workspace = resolve_mutation_workspace(
+        worktree_path,
+        process_project_root,
+        active_worktree_env=active_worktree_env,
+        author_worktree_env=author_worktree_env,
+    )
+    process_root = os.path.realpath(process_project_root)
+    # Canonical repository identity comes from the MCP process checkout (#460),
+    # not from the declared task workspace being validated.
+    canonical_root = resolve_canonical_repo_root(process_root, process_root)
+    return {
+        "workspace_path": workspace,
+        "process_project_root": process_root,
+        "canonical_repo_root": canonical_root,
+        "roots_aligned": canonical_root == process_root,
+    }
+
+
+def assess_workspace_repo_membership(
+    *,
+    workspace_path: str,
+    canonical_repo_root: str,
+) -> dict:
+    """Fail closed when *workspace_path* is not a git worktree of *canonical_repo_root*."""
+    workspace = os.path.realpath(workspace_path)
+    root = os.path.realpath(canonical_repo_root)
+    reasons: list[str] = []
+
+    if not os.path.exists(workspace):
+        reasons.append(f"worktree path '{workspace}' does not exist")
+        return _membership_assessment(False, reasons, workspace, root, None)
+
+    if not os.path.isdir(workspace):
+        reasons.append(f"worktree path '{workspace}' is not a directory")
+        return _membership_assessment(False, reasons, workspace, root, None)
+
+    try:
+        res = subprocess.run(
+            ["git", "-C", workspace, "rev-parse", "--git-common-dir"],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        common_dir = _realpath_git_common_dir(workspace, res.stdout)
+    except Exception:
+        reasons.append(f"worktree '{workspace}' is not a valid git repository")
+        return _membership_assessment(False, reasons, workspace, root, None)
+
+    expected_dir = os.path.realpath(os.path.join(root, ".git"))
+    if common_dir != expected_dir:
+        reasons.append(
+            f"worktree '{workspace}' does not belong to the target repository '{root}'"
+        )
+    return _membership_assessment(not reasons, reasons, workspace, root, common_dir)
+
+
+def _membership_assessment(
+    proven: bool,
+    reasons: list[str],
+    workspace: str,
+    root: str,
+    common_dir: str | None,
+) -> dict:
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "workspace_path": workspace,
+        "canonical_repo_root": root,
+        "git_common_dir": common_dir,
+    }
+
+
+def format_workspace_repo_membership_error(assessment: dict) -> str:
+    workspace = assessment.get("workspace_path") or "(unknown)"
+    root = assessment.get("canonical_repo_root") or "(unknown)"
+    reasons = "; ".join(assessment.get("reasons") or ["unknown repository membership violation"])
+    return (
+        f"Branches-only mutation guard (#274): {reasons} (fail closed). "
+        f"canonical repository root: {root}; workspace: {workspace}."
+    )
+
+
+def assess_author_mutation_worktree(
+    *,
+    workspace_path: str,
+    project_root: str,
+    current_branch: str | None = None,
+    base_branches: frozenset[str] | None = None,
+) -> dict:
+    """Fail closed when author mutations are not rooted under ``branches/``."""
+    bases = base_branches or BASE_BRANCHES
+    reasons: list[str] = []
+    root = os.path.realpath(project_root)
+    workspace = os.path.realpath(workspace_path)
+    branch = (current_branch or "").strip()
+
+    under_branches = is_path_under_branches(workspace, root)
+    if not under_branches:
+        if workspace == root:
+            reasons.append(
+                "author mutation blocked: workspace is the stable control checkout; "
+                "create or switch to a session-owned worktree under branches/"
+            )
+        else:
+            reasons.append(
+                f"author mutation blocked: workspace '{workspace}' is not under "
+                f"'{root}/branches/'; create a branches/<task> worktree first"
+            )
+
+    if not under_branches and workspace == root and branch and branch not in bases:
+        reasons.append(
+            f"control checkout drift: branch '{branch}' is not a stable base "
+            f"branch ({'/'.join(sorted(bases))})"
+        )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "project_root": root,
+        "workspace_path": workspace,
+        "under_branches": is_path_under_branches(workspace, root),
+        "current_branch": branch or None,
+    }
+
+
+def format_author_mutation_worktree_error(assessment: dict) -> str:
+    """Single RuntimeError message for MCP preflight gates."""
+    workspace = assessment.get("workspace_path") or "(unknown)"
+    root = assessment.get("project_root") or "(unknown)"
+    reasons = "; ".join(assessment.get("reasons") or ["unknown branches-only violation"])
+    return (
+        f"Branches-only mutation guard (#274): {reasons}. "
+        f"project root: {root}; workspace: {workspace}. "
+        "Create a session-owned worktree under branches/ before mutating."
+    )

capability_stop_terminal.py

@@ -0,0 +1,234 @@
+"""Hard-stop terminal mode after reviewer capability denial (#197)."""
+
+from __future__ import annotations
+
+import re
+
+TERMINAL_REPORT_HEADING = (
+    "Cannot perform reviewer task under current profile. "
+    "No reviewer mutations performed."
+)
+
+REVIEWER_CAPABILITY_TASKS = frozenset({
+    "review_pr",
+    "merge_pr",
+    "blind_pr_queue_review",
+    "pr_queue_cleanup",
+    "pr-queue-cleanup",
+    "request_changes_pr",
+    "approve_pr",
+})
+
+BLOCKED_QUEUE_TOOLS = frozenset({
+    "list_prs",
+    "check_pr_eligibility",
+    "view_pr",
+    "submit_pr_review",
+    "dry_run_pr_review",
+    "merge_pr",
+    "review_pr",
+})
+
+_session_terminal: dict | None = None
+
+
+def enter_from_capability_result(capability: dict) -> dict | None:
+    """Enter terminal mode when a reviewer/merge task is denied."""
+    global _session_terminal
+    task = (capability or {}).get("requested_task", "")
+    required_role = (capability or {}).get("required_role_kind")
+    if not capability.get("stop_required"):
+        return None
+    if required_role != "reviewer" and task not in REVIEWER_CAPABILITY_TASKS:
+        return None
+    record = {
+        "active": True,
+        "requested_task": task,
+        "required_role_kind": required_role,
+        "active_profile": capability.get("active_profile"),
+        "active_identity": capability.get("active_identity"),
+        "stop_required": True,
+        "exact_safe_next_action": capability.get("exact_safe_next_action"),
+        "terminal_message": TERMINAL_REPORT_HEADING,
+    }
+    _session_terminal = record
+    return dict(record)
+
+
+def _is_reviewer_denial(capability: dict) -> bool:
+    task = (capability or {}).get("requested_task", "")
+    required_role = (capability or {}).get("required_role_kind")
+    return (
+        required_role == "reviewer"
+        or task in REVIEWER_CAPABILITY_TASKS
+    )
+
+
+def sync_from_capability_result(capability: dict) -> dict | None:
+    """Enter or clear terminal mode from a capability resolution (#238).
+
+    Reviewer denials activate terminal mode for the denied operation only.
+    A later allowed task route clears stale denial state so author read-only
+    tools (e.g. ``list_prs``) are not permanently blocked.
+    """
+    if (capability or {}).get("stop_required") and _is_reviewer_denial(capability):
+        return enter_from_capability_result(capability)
+    clear()
+    return None
+
+
+def enter_from_route_result(route: dict) -> dict | None:
+    """Enter terminal mode from a role router wrong_role_stop (#206 compat)."""
+    if (route or {}).get("route_result") != "wrong_role_stop":
+        return None
+    if route.get("required_role") != "reviewer":
+        return None
+    return enter_from_capability_result({
+        "requested_task": route.get("task_type"),
+        "required_role_kind": "reviewer",
+        "stop_required": True,
+        "active_profile": route.get("active_profile"),
+        "active_identity": None,
+        "exact_safe_next_action": route.get("message"),
+    })
+
+
+def is_active() -> bool:
+    return bool(_session_terminal and _session_terminal.get("active"))
+
+
+def active_record() -> dict | None:
+    if not is_active():
+        return None
+    return dict(_session_terminal)
+
+
+def clear():
+    global _session_terminal
+    _session_terminal = None
+
+
+def check_reviewer_queue_tool(tool_name: str) -> tuple[bool, list[str]]:
+    """Return (allowed, reasons). False when terminal mode blocks queue work."""
+    if not is_active():
+        return True, []
+    name = (tool_name or "").strip().lower().removeprefix("gitea_")
+    if name in BLOCKED_QUEUE_TOOLS:
+        denied_task = (_session_terminal or {}).get("requested_task") or "unknown"
+        return False, [
+            TERMINAL_REPORT_HEADING,
+            f"Reviewer queue tool '{tool_name}' is blocked by the current "
+            f"capability denial for task '{denied_task}' (fail closed).",
+            "Resolve or route an allowed author task to clear stale denial "
+            "state, or relaunch a reviewer MCP namespace for reviewer work.",
+        ]
+    return True, []
+
+
+def validate_eligibility_wording(text: str) -> tuple[bool, list[str]]:
+    """Reject session-based eligibility reasoning (#197)."""
+    lower = (text or "").lower()
+    violations = []
+    if "not authored by this session" in lower:
+        violations.append(
+            "eligibility must use authenticated account identity, not "
+            "'this session' wording"
+        )
+    if re.search(r"not (?:self-)?authored by (?:the )?session", lower):
+        violations.append("session-based eligibility reasoning is invalid")
+    return (len(violations) == 0), violations
+
+
+def assess_capability_stop_report(
+    report_text: str,
+    *,
+    trust_gate_status: str | None = None,
+    capability_denied: bool = True,
+) -> dict:
+    """Validate final report purity after reviewer capability denial."""
+    text = report_text or ""
+    lower = text.lower()
+    violations = []
+
+    if capability_denied and TERMINAL_REPORT_HEADING.lower() not in lower:
+        violations.append("missing required terminal report heading")
+
+    forbidden_patterns = [
+        ("pr selection", re.compile(
+            r"selected pr|pr #\d+ (?:to review|selected)|eligible pr|"
+            r"next pr to review", re.I)),
+        ("sibling repo inventory", re.compile(
+            r"sibling repo|other repo|mcp-control-plane|gitea-tools and", re.I)),
+        ("author fallback", re.compile(
+            r"rebase conflicted|author-side fallback|have me rebase|"
+            r"implement the fix|push a branch|open a pr for", re.I)),
+        ("invalid session eligibility", re.compile(
+            r"not authored by this session", re.I)),
+    ]
+    for label, pattern in forbidden_patterns:
+        if pattern.search(text):
+            violations.append(f"forbidden after hard stop: {label}")
+
+    empty_queue_patterns = re.compile(
+        r"\b0 open pr|\bno open pr|\bno eligible pr|\bempty (?:review )?queue|"
+        r"inventory empty",
+        re.I,
+    )
+    parsed_status = None
+    for line in text.splitlines():
+        if "pr_inventory_trust_gate.status:" in line.lower():
+            parsed_status = line.split(":", 1)[1].strip()
+            break
+    effective_status = trust_gate_status or parsed_status
+    if empty_queue_patterns.search(text):
+        if effective_status != "trusted_empty":
+            violations.append(
+                "empty-queue claim after capability stop without "
+                "pr_inventory_trust_gate.status == trusted_empty"
+            )
+
+    ok, elig_violations = validate_eligibility_wording(text)
+    violations.extend(elig_violations)
+
+    if violations:
+        return {
+            "pure": False,
+            "downgraded": True,
+            "violations": violations,
+            "reasons": violations,
+        }
+    return {
+        "pure": True,
+        "downgraded": False,
+        "violations": [],
+        "reasons": [],
+    }
+
+
+def build_terminal_report(capability: dict) -> dict:
+    """Minimal allowed report fields after hard stop."""
+    return {
+        "terminal_mode": True,
+        "heading": TERMINAL_REPORT_HEADING,
+        "authenticated_profile": capability.get("active_profile"),
+        "authenticated_identity": capability.get("active_identity"),
+        "denied_task": capability.get("requested_task"),
+        "required_role_kind": capability.get("required_role_kind"),
+        "stop_required": capability.get("stop_required"),
+        "required_action": capability.get("exact_safe_next_action"),
+        "mutations_performed": False,
+        "allowed_sections": [
+            "authenticated identity/profile",
+            "denied capability result",
+            "reason task cannot proceed",
+            "required reviewer profile/identity",
+            "mutation confirmation (none)",
+        ],
+        "forbidden_sections": [
+            "PR selection",
+            "sibling-repo queue recommendations",
+            "author-side fallback suggestions",
+            "empty-queue claims without trusted_empty",
+            "session-based eligibility wording",
+        ],
+    }

docs/architecture/glitchtip-readonly-tools-design.md

@@ -22,13 +22,13 @@ Strictly read-only, per ADR-0001:
   tools — never one dual-credential server).
 - **This server never holds Gitea write credentials.**
 
-## 2. Boundary placement (namespace pending)
+## 2. Boundary placement
 
 These tools belong to the GlitchTip observability boundary of the MCP Control
-Plane — `glitchtip-mcp` (ADR-0001's recommendation), `observability-mcp`, or
-folded into `ops-mcp`. **ADR-0001 open owner decision #2 picks the name; this
-design does not assume it.** Tool names below use the `glitchtip_` prefix for
-readability and rename mechanically with the decision.
+Plane. The canonical MCP server name is `glitchtip-mcp`; client registration
+and reload instructions live in
+[`../mcp-client-registration.md`](../mcp-client-registration.md). Tool names
+below use the `glitchtip_` prefix.
 
 Fixed regardless of the name (per `tool-boundaries.md`,
 `credential-isolation.md`):
@@ -160,11 +160,13 @@ Mocked-GlitchTip unit tests only, per `docs/developer-testing-guidelines.md`:
 
 ## 10. Implementation-readiness checklist
 
-Ready to implement once:
+Ready to operate once:
 
-1. ADR-0001 owner decision #2 (namespace/placement) is made — mechanical
-   rename of the `glitchtip_` prefix if needed.
-2. ADR-0001 owner decision #1 (repo home) is made.
+1. The MCP client registers the external server under the exact `glitchtip-mcp`
+   name and is reconnected/reloaded.
+2. Tool discoverability proves the expected `glitchtip_*` read tools are
+   visible; if the server is enabled but exposes no usable tools, report
+   `SKIPPED` and stop.
 3. #76 profile schema exists (or a minimal `glitchtip-readonly` profile is
    hand-rolled to the same rules).
 4. A pinned GlitchTip version is chosen for API-subset testing (§3).

docs/architecture/glitchtip-to-gitea-workflow-design.md

@@ -1,21 +1,34 @@
-# GlitchTip-to-Gitea Issue Filing Workflow Design
+# GlitchTip-to-Gitea Issue Filing Workflow Contract
 
-- **Status:** Design (no implementation in this repo)
-- **Issue:** #74 (parent umbrella: #75)
+- **Status:** Contract for the library-only implementation in
+  `Scaled-Tech-Consulting/mcp-control-plane` (#57)
+- **Issue:** #153 (supersedes #74/#78 as the Gitea-Tools tracker)
 - **Related:** #78 (deduplication design, child of #74)
-- **Date:** 2026-07-02
+- **Date:** 2026-07-07
 
 ## 1. Boundary and Orchestration
 
 * **GlitchTip-to-Gitea filing is NOT a GlitchTip MCP capability.** The `glitchtip-mcp` boundary remains strictly read-only per ADR-0001.
-* The filing capability lives in an **orchestrator / runbook / release workflow**. It **composes** separate GlitchTip **read** tools (from the `glitchtip-mcp` server) and Gitea **issue** tools (from the `gitea-mcp` server).
+* The filing capability lives in a **library-only orchestrator** in
+  `mcp-control-plane` and is not exposed through `glitchtip-mcp`.
+* The orchestrator composes the real GlitchTip read path with Gitea
+  issue-write tools. It must not use mocked GlitchTip issue data in production
+  filing paths.
 * The orchestrator **must not centralize credentials** into a single server. The GlitchTip MCP holds only GlitchTip tokens, and the Gitea MCP holds only Gitea tokens.
+* If a future MCP surface exposes filing, it must be a separate write-boundary
+  server/profile with explicit Gitea issue-write permission and the same audit
+  gates. It must not be added to the read-only `glitchtip-mcp` surface.
 
 ## 2. Invocation and Safety
 
 * **Explicit invocation only:** There is no automatic, unsupervised filing in phase 1. A human or an explicitly-triggered automation must initiate the workflow.
 * **Dry-run / Preview required:** The orchestrator must present a preview of the drafted Gitea issue (title, body, labels) and obtain explicit confirmation before calling the Gitea mutation tool to file the issue.
-* **Gitea Profile Checks & Audit Logging:** The actual Gitea issue creation relies on `gitea-mcp`, and therefore inherently subjects the mutation to Gitea profile checks and audit logging as standard.
+* **Gitea Profile Checks & Audit Logging:** The actual Gitea issue creation
+  relies on `gitea-mcp`, and therefore must pass Gitea profile checks and
+  fail-closed mutation audit before create/link/comment actions.
+* **Deduplication before create:** The orchestrator must run the
+  GlitchTip-to-Gitea dedup/linking logic before any Gitea create action. Create,
+  link, and skip decisions must be represented in tests.
 
 ## 3. Gitea Issue Format
 
@@ -51,6 +64,23 @@ To prevent PII or secret leakage into Gitea, the orchestrator and the underlying
 
 The principle is: **"Link, don't dump"**. The generated issue acts as an alert/pointer, while the raw context remains protected inside GlitchTip.
 
-## 5. Deduplication and Linking (Deferred)
+## 5. Deduplication and Linking
 
-Deduplication logic (e.g. searching existing Gitea issues, managing GlitchTip issue IDs, and race condition handling) is specifically handled by **Issue #78** and will augment this design.
+Deduplication logic (e.g. searching existing Gitea issues, managing GlitchTip
+issue IDs, and race condition handling) is integrated into the library-only
+filing orchestrator in `mcp-control-plane`. The orchestrator must reuse that
+dedup/linking path instead of duplicating or bypassing it.
+
+## 6. Gitea-Tools Acceptance Contract for #153
+
+Gitea-Tools does not host the filing implementation. This repository owns the
+operator-facing contract:
+
+* `glitchtip-mcp` remains read-only and exposes only GlitchTip inspection tools.
+* Filing is implemented in `mcp-control-plane`, not in this Gitea MCP runtime.
+* Filing uses the real GlitchTip read path, not mocked issue data.
+* Dedup runs before any Gitea create action.
+* Create/link/skip decisions and audit failure are covered by orchestrator tests.
+* Mutation audit fails closed before any Gitea create, link, or comment mutation.
+* Any future MCP exposure requires a separate write-boundary server/profile and
+  must not add Gitea write credentials to `glitchtip-mcp`.

docs/architecture/jenkins-readonly-build-status-design.md

@@ -5,7 +5,9 @@
 - **Related:** #77 (repo/branch/PR → job mapping, designed separately)
 - **Date:** 2026-07-02
 
-Note on naming: This design used historical `jenkins-readonly` skill name in Gitea-Tools. Actual package/server is `jenkins-mcp` (see mcp-control-plane registration in #55). The server boundary now contains gated trigger (see #56), but read tools remain as designed.
+Note on naming: This design used historical `jenkins-readonly` skill name in Gitea-Tools. Actual package/server is `jenkins-mcp` (see mcp-control-plane registration in #55). The read server boundary remains read-only; gated triggers live on the separate `jenkins-write-mcp` / `jenkins_mcp.write_server` boundary (see #56 / #152).
+Client registration and reload instructions live in
+[`../mcp-client-registration.md`](../mcp-client-registration.md).
 
 ## 1. Purpose and scope
 
@@ -16,7 +18,9 @@ detail (build URL, number, timing, result) to report or investigate.
 Phase 1 is **primarily read-only**, per ADR-0001
 ([`adr-0001-mcp-control-plane-boundaries.md`](adr-0001-mcp-control-plane-boundaries.md)):
 
-- Build triggers are gated behind dedicated profile + exact confirmation (landed in #4, boundary correction in #56).
+- Build triggers are outside this read-only surface and require the separate
+  `jenkins-write-mcp` boundary, a dedicated profile, exact confirmation, and
+  fail-closed mutation audit (landed in #4, boundary correction in #56 / #152).
 - **Excluded: deploy triggers.**
 - **Excluded: parameterized job launches.**
 - Excluded: job creation/deletion/config changes, queue manipulation, node
@@ -107,7 +111,7 @@ by #76):
   `forbidden_operations: ["jenkins.build.trigger", "jenkins.deploy", "jenkins.job.configure"]`
   as belt-and-braces even though no mutating tool exists.
 - Missing URL/user/token/profile ⇒ **fail closed** with a clear message.
-- Since every tool is read-only, no confirmation gates are needed — but
+- Since every tool on `jenkins-mcp` is read-only, no confirmation gates are needed — but
   identity (`jenkins_whoami`) must still work so workflows can prove which
   Jenkins account they act as.
 
@@ -141,12 +145,16 @@ repo's conventions (`docs/developer-testing-guidelines.md`):
 
 ## 10. Implementation-readiness checklist
 
-Ready to implement in `jenkins-mcp` once:
+Ready to operate through `jenkins-mcp` once:
 
-1. ADR-0001 owner decision #1 (where `jenkins-mcp` lives) is made.
-2. #76 profile schema exists (or a minimal `jenkins-readonly` profile is
+1. The MCP client registers the external server under the exact `jenkins-mcp`
+   name and is reconnected/reloaded.
+2. Tool discoverability proves the expected `jenkins_*` read tools are visible;
+   if the server is enabled but exposes no usable tools, report `SKIPPED` and
+   stop.
+3. #76 profile schema exists (or a minimal `jenkins-readonly` profile is
    hand-rolled to the same rules).
-3. #77 mapping design is accepted (or tools ship path-addressed only, mapping
+4. #77 mapping design is accepted (or tools ship path-addressed only, mapping
    deferred).
 
 Explicitly **not** unlocked by this document: build triggers, deploys,

docs/gitea-dual-namespace-deployment.md

@@ -23,6 +23,7 @@ launched with exactly one static execution profile:
 |-----------------------------|----------------|-------------|
 | `gitea-author` | an author profile | implement issues, push branches, open PRs, comment |
 | `gitea-reviewer` | a reviewer profile | review, approve/request changes, merge |
+| `gitea-reconciler` | a reconciler profile | close already-landed open PRs after ancestry proof (#304 profile; #310 close tool) |
 
 Properties:
 

docs/gitea-execution-profiles.md

@@ -226,6 +226,31 @@ explicit operator-directed closure of a contaminated PR). If `close_pr` ever
 resolves as unknown, agents must fail closed rather than fall back to the
 edit path.
 
+## Reconciler profile for already-landed open PRs (#304 / #310)
+
+Normal author and reviewer profiles must not gain broad `gitea.pr.close`
+authority. Already-landed open PRs (head SHA is an ancestor of the target
+branch) need a dedicated reconciler profile such as `prgs-reconciler` with a
+narrow operation set:
+
+- `gitea.read`
+- `gitea.pr.comment`
+- `gitea.issue.comment`
+- `gitea.issue.close`
+- `gitea.pr.close`
+
+Forbidden on reconciler profiles: `gitea.pr.approve`, `gitea.pr.merge`,
+`gitea.pr.review`, `gitea.pr.create`, `gitea.branch.push`, and
+`gitea.repo.commit`.
+
+Launch a static `gitea-reconciler` MCP namespace with
+`GITEA_MCP_PROFILE=prgs-reconciler`. Profile shape is validated by
+`reconciler_profile.assess_reconciler_profile` (#304). Use the
+`gitea_reconcile_already_landed_pr` tool (#310). The resolver task is
+`reconcile_already_landed_pr`. PR close is allowed only after live PR fetch,
+fresh target-branch fetch, recorded target SHA, and ancestor proof. PRs whose
+heads are not already landed cannot be closed through this path.
+
 ## Identity and fail-closed rules
 
 Before **any** mutating action, a workflow must know both:
@@ -298,6 +323,17 @@ When dynamic profile switching is enabled and a profile is activated via `gitea_
 2. Call `gitea_whoami` with the target remote to prove and verify the fresh Gitea authenticated identity.
 This guarantees the active profile operations align with the actual Gitea authenticated user credential.
 
+## Gitea MCP Runtime Isolation and Worktree Safety
+
+To ensure high availability and prevent broken feature worktrees from disabling essential security/identity controls, the Gitea MCP server implements runtime isolation:
+
+- **Startup Conflict Check:** The MCP server (`mcp_server.py`) acts as a conflict-free loader. On startup, it scans all Python files in the directory for unresolved git merge conflicts (`<<<<<<<`, `=======`, `>>>>>>>`). If any are found, it prints an `infra_stop` message and exits immediately.
+- **Workflow Guard:** Before starting reviewer work, task routing checks if the MCP runtime source is mid-merge (by checking for `.git/MERGE_HEAD` or conflict markers). If dirty, it returns `infra_stop` (never `wrong_role_stop` or empty queue) to prevent unsafe mutations.
+- **Recovery Instructions:** To recover from an `infra_stop` state:
+  1. Resolve all merge conflicts in the local repository or abort the merge (`git merge --abort` / `git rebase --abort`).
+  2. Restart the Gitea MCP server process.
+  3. Retry the task.
+
 ## Relationship to roadmap issues
 
 This document defines the **model only**. Related work is tracked separately

docs/llm-workflow-runbooks.md

@@ -30,6 +30,11 @@ audit logging). See [Related documents](#related-documents).
 > the standard rules; operator prompts still control task-specific scope.
 > See issue #129 for the skill registry design.
 
+Jenkins and GlitchTip workflows use separate MCP servers, not this Gitea MCP
+runtime. Register them as `jenkins-mcp` and `glitchtip-mcp`, reconnect or
+reload the client, and verify visible tools before claiming either integration
+is usable. See [`mcp-client-registration.md`](mcp-client-registration.md).
+
 For cross-project use, copy the portable workflow skill at
 [`../skills/llm-project-workflow/SKILL.md`](../skills/llm-project-workflow/SKILL.md).
 It extracts the issue-first, isolated-worktree, no-self-review, profile-safety,
@@ -164,6 +169,25 @@ To avoid the bottleneck of relaunching/restarting the MCP server to switch betwe
   * `mcp__gitea-reviewer__*` (for reviewing PRs, approving, requesting changes, merging)
 * **Trust Model:** Separate tokens remain separate in the keychain/environment. Each instance operates under its own `GITEA_MCP_PROFILE` and enforces its own `allowed_operations`. A runtime `whoami` identity check is still performed independently, and self-review/self-merge checks remain strictly mandatory. The dual-server pattern is a operational convenience and never a security bypass.
 * **Reviewer-Identity PR Creation Deadlock:** Reviewer/merge identities must not create PRs or push branches. Doing so makes the reviewer identity the PR author in Gitea, blocking subsequent independent review and causing a review deadlock. Normally, PRs must be created by the author/work identity (`gitea-author`), leaving the reviewer identity (`gitea-reviewer`) clean and available for independent review and merge.
+* **Reconciler namespace (#310):** Register a third static instance for
+  already-landed PR cleanup when review queues block on open PRs whose heads
+  already landed on `master`:
+
+```json
+"gitea-reconciler": {
+  "command": "/path/to/Gitea-Tools/venv/bin/python3",
+  "args": ["/path/to/Gitea-Tools/mcp_server.py"],
+  "env": {
+    "GITEA_MCP_CONFIG": "/path/to/.config/gitea-tools/profiles.json",
+    "GITEA_MCP_PROFILE": "prgs-reconciler"
+  }
+}
+```
+
+  The reconciler profile grants `gitea.pr.close` only for
+  `gitea_reconcile_already_landed_pr` after ancestry proof — not for normal
+  review or author workflows.
+
 * **Fallback:** If the dual-profile MCP launcher pattern is not supported or configured in the client, the LLM must relaunch or restart the client/MCP with the correct profile environment variable before claiming or working on any tasks.
 
 ## Setup runbook — interactive menu
@@ -224,6 +248,195 @@ Legacy environment-only setups keep working unchanged until migrated.
 Each runbook names the **profile role** it runs under, the steps, and a safe
 prompt. Confirm the active profile first (`gitea_get_profile` / `gitea_whoami`).
 
+## Work Selection Rule for LLMs
+
+Before starting any issue or PR work, acquire or verify a work lease. Do not
+begin coding, reviewing, fixing, branching, committing, pushing, commenting,
+or creating a PR until you prove the target is not already being worked.
+
+Required checks:
+
+1. List open PRs.
+2. Search for PRs linked to the target issue.
+3. Search local and remote branches for the issue number.
+4. Search registered worktrees for the issue branch.
+5. Check dirty worktrees.
+6. Check active leases or recent handoffs.
+7. Check whether the issue was already completed by a merged PR.
+
+If another active LLM/session owns the lease, stop. Allowed responses:
+continue as the lease owner; review the existing PR if reviewer capability
+allows; produce a handoff; request takeover after lease expiry; stop with
+"work already claimed."
+
+Never create a parallel branch or PR for the same issue unless the old branch
+is proven abandoned and the takeover is recorded.
+
+Gitea-Tools lease gates: `gitea_lock_issue` (fail-closed before author
+mutations), `status:in-progress`, and claim comments. `gitea_lock_issue`
+records an `author_issue_work` lease in a keyed lock file under
+`GITEA_ISSUE_LOCK_DIR` (default `~/.cache/gitea-tools/issue-locks`), one file
+per `remote` + `org` + `repo` + `issue_number`. The current MCP session binds
+its active lock through a per-process pointer so concurrent repos/issues never
+share one overwrite-prone slot (#443).
+
+Each lock payload includes issue number, optional PR number, branch, worktree
+path, claimant identity/profile, created timestamp, expiry timestamp, and last
+heartbeat timestamp. An active same-issue/same-operation lease blocks duplicate
+work. An expired lease still blocks takeover until a recovery review records why
+the prior work is abandoned, completed, or unsafe to continue.
+
+**Stacked PRs (#484).** By default the lock worktree must be base-equivalent to
+`master`/`main`/`dev` — ordinary work is unchanged. A *stacked* PR (deliberately
+based on another unmerged PR's branch) is an explicit, opt-in path: pass
+`stacked_base_branch` **and** `stacked_base_pr` to `gitea_lock_issue`. The lock
+fails closed unless that branch is owned by a live **open** PR whose number
+matches `stacked_base_pr`, so arbitrary or stale branches cannot be used as
+bases. When approved, the lock payload records
+`approved_stacked_base = {branch, pr_number, verified_open}` and the worktree may
+be base-equivalent to that branch instead of master. `gitea_create_pr` then
+allows `base = <that branch>` only when it matches the recorded approval, the
+dependency PR is **still open**, and the PR body documents the stack:
+
+- `Stacked on PR #<X> / issue #<Y>`
+- `Base branch: <feature-branch>`
+- `Head branch: <this-issue-branch>`
+- `Do not merge before PR #<X>` (merge ordering)
+- retarget/rebase to `master` after the dependency lands, if required
+
+Stacked support never bypasses the issue lock — the base is recorded *on* the
+lock and re-verified at PR time. A merged/closed dependency base fails closed;
+retarget onto `master` or re-lock against a live base.
+
+**Do not manually seed `/tmp/gitea_issue_lock.json` or any lock file as a normal
+recovery path.** That global slot is deprecated and can clobber unrelated live
+leases (#438). After an MCP restart, call `gitea_lock_issue` again — own-branch
+adoption rebinds the session when the issue's exact branch already exists (#442).
+`gitea_create_pr` resolves the durable keyed lock by session pointer or by
+matching `head` branch without unsafe manual seeding.
+
+**Issue-lock recovery (#447):** Do not manually seed, restore, or delete
+`/tmp/gitea_issue_lock.json` as a normal recovery path. That file is global
+shared state and manual writes can clobber another session's live lease. Use
+`sanctioned recovery` instead:
+
+1. `gitea_lock_issue` on a clean `branches/` worktree (normal path).
+2. Own-branch adoption via #442 when the issue's exact branch is already pushed.
+3. Operator override only when explicitly authorized — record
+   `External-state mutations` and `operator override proof` in the final report.
+
+**Adoption proof in the live lock response (#477):** when `gitea_lock_issue`
+adopts an existing own branch, the response carries an `adoption` block with
+citable fields — `adoption_decision` (`ADOPT`), `adopted` (`true`),
+`adopted_branch`, `adopted_branch_head`, `matcher_summary` (boundary-safe reason
+the branch qualified), `competing_branch_check`, and `safe_next_action`. A normal
+lock instead returns an `adoption_check` block with `adoption_decision`
+(`NO_MATCH`) and `adopted: false`, so a non-adoption response can never be misread
+as claiming adoption. Recovery reports should quote the live lock response
+`adoption`/`adoption_check` block directly instead of inferring adoption from
+separate offline checks.
+
+`gitea_create_pr` rejects lock files that lack sanctioned `lock_provenance`
+metadata. Final-report validation blocks handoffs that hide lock read/write/delete
+under `External-state mutations: none` or mix author PR creation with reviewer
+approval in one run. See also #438 (global lock redesign).
+
+Remote branches matching the issue number are also treated as active work unless
+the recovery review proves the branch is abandoned or superseded. Never delete
+or clean up a branch when it has an active lease, dirty worktree, open PR, or is
+the only copy of unmerged work.
+
+Full portable wording:
+[`skills/llm-project-workflow/SKILL.md`](../skills/llm-project-workflow/SKILL.md).
+
+## Global LLM Worktree Rule
+
+The main project checkout is a stable control checkout. It must stay on the
+configured stable branch: `master`, `main`, or `dev`.
+
+All LLM task work must happen inside the project's `branches/` directory.
+
+Before any mutation, prove:
+
+1. current project root
+2. current working directory
+3. current branch
+4. stable branch for the main checkout
+5. session-owned worktree path under `branches/`
+
+If `cwd` is not inside `branches/`, stop. Do not edit, create, delete, format,
+test-write, commit, merge, rebase, checkout task branches, resolve conflicts,
+or run cleanup.
+
+There are no exceptions for small fixes, docs, tests, cleanup, PR review fixes,
+conflict resolution, or emergencies.
+
+The main checkout may only be used for read-only inspection, fetching,
+stable-branch update after merged PRs, creating `branches/` worktrees, or
+explicit control-checkout repair.
+
+Portable wording: [`skills/llm-project-workflow/SKILL.md`](../skills/llm-project-workflow/SKILL.md).
+
+## Shell Spawn Hard-Stop Rule
+
+Symptom: a shell tool call returns `exit_code: -1` with empty stdout/stderr.
+That is an executor spawn failure, not a command failure — the command never
+ran, and retrying the identical call cannot succeed.
+
+Required behavior (fail closed, issue #258):
+
+1. **Probe once.** On the first spawn failure, run one trivial probe
+   (`echo ok` or `pwd`). If the probe also returns `exit_code: -1`, mark
+   shell unavailable for the session.
+2. **Hard-stop at two.** After two consecutive spawn failures, stop all
+   further shell tool use for the session; never retry the same failing
+   spawn. A hundred retries produce a hundred identical failures (session
+   `019f382e`: 100+ tool calls stalled on a trivial encode-and-commit task).
+3. **Emit a recovery report.** The report must direct the operator to:
+   - restart the session,
+   - kill hung background terminals (a hung test runner holding the
+     executor is a known contributor),
+   - prefer MCP-native paths for remaining mutations (for example
+     `gitea_commit_files` under `gitea.repo.commit`) instead of shell.
+4. **No improvised fallbacks.** Shell unavailability never authorizes
+   WebFetch/browser/manual-encoding workarounds (see #260). No shell means
+   stop-and-report.
+
+Doc-contract tests: `tests/test_shell_spawn_hard_stop_docs.py`.
+
+## Subagent Tool-Budget Guardrails
+
+General-purpose subagents tasked with **deterministic MCP work** (for example a
+single `gitea_commit_files` call) have expanded to 100–122 tool calls,
+WebFetch/Playwright fallbacks, and throwaway helper-script generation instead of
+calling the native MCP tool once (observed during #152 closure, issue #259).
+
+**Default budgets** (fail closed when exceeded):
+
+| Task class | Max tool calls | Max wall time |
+|------------|----------------|---------------|
+| Single-step MCP mutation (`commit_files`, `create_pr`, `lock_issue`) | 15 | 5 minutes |
+| Review / merge queue inspection | 40 | 15 minutes |
+| Exploration / codebase search (non-mutating) | 60 | 20 minutes |
+
+**Required behavior:**
+
+1. **Main session first.** When the active author profile allows
+   `gitea.repo.commit` and `gitea_commit_files` is visible, the main session
+   must call it directly — do not delegate commit authority to a subagent
+   (see #260).
+2. **Native MCP before fallback.** After a shell spawn failure (#258), attempt
+   the native MCP tool once before any alternate path. Shell unavailability
+   never authorizes WebFetch, Playwright, or manual base64 encoding.
+3. **No retry spirals.** Never resume a failed subagent into a larger retry
+   loop or spawn a second subagent for the same deterministic step. Stop and
+   emit a recovery report instead.
+4. **Forbidden detours** when `gitea_commit_files` is available: WebFetch,
+   Playwright/browser automation, manual LLM-generated base64, and ad-hoc
+   `_encode_*` / `_emit_*` helper scripts left in the repo.
+
+Doc-contract tests: `tests/test_subagent_tool_budget_docs.py`.
+
 ## Branch worktree isolation
 
 All LLM implementation and review work happens in an isolated branch worktree
@@ -255,6 +468,30 @@ may edit another issue's branch folder unless explicitly assigned to that issue.
 No LLM may clean another issue's branch folder unless the PR is merged or closed
 and cleanup is explicitly part of the task.
 
+## Agent temp artifact cleanup (#261)
+
+Failed or aborted MCP commit attempts sometimes leave throwaway helper scripts in
+the **repository root**. These are not part of any issue scope and pollute
+`git status`, which can break `gitea_lock_issue` and preflight checks.
+
+**Patterns (repo root only, untracked):**
+
+- `_encode_*.py` — base64 payload encoders
+- `_emit_*.py` — commit payload emitters
+- `_inline_*.py` — inline encoding helpers
+
+**Required cleanup (after MCP commit completes or aborts):**
+
+1. Delete any matching files at the repo root (`rm ./_encode_*.py` etc.).
+2. Confirm `git status` is clean on the orchestration checkout before
+   `gitea_lock_issue`.
+3. Prefer native `gitea_commit_files` / gated commit paths — do not leave shell
+   encoding fallbacks behind.
+
+Root-level matches are listed in `.gitignore` so they never get committed.
+`gitea_get_runtime_context` and `gitea_lock_issue` surface **warnings** (not
+hard blocks) when these artifacts are still present.
+
 Implementation work and review work must use separate branch folders. For
 example, an implementation branch might live under
 `branches/fix-issue-123-example`, while a review branch for the resulting PR
@@ -309,6 +546,36 @@ git branch -d fix/issue-123-example
 All three helpers accept `--dry-run` to print the exact commands/paths without
 touching anything.
 
+### MCP-native commit path (#260)
+
+When the active author profile allows **`gitea.repo.commit`** and
+**`gitea_commit_files`** is visible in the client, that is the **only** approved
+path for committing files to the tracked repository. Do not improvise alternate
+encoding or transport when MCP commit is available.
+
+**Required before commit:**
+
+1. Call `gitea_resolve_task_capability` for `commit_files` or
+   `gitea_commit_files` and confirm `allowed_in_current_session` is true.
+2. Use `gitea_commit_files` with file payloads prepared in the author worktree.
+3. Stage only issue-scoped paths; never commit throwaway `_encode_*` /
+   `_emit_*` / `_inline_*` helpers.
+
+**Explicitly forbidden workarounds** when MCP commit is reachable:
+
+- `WebFetch` / HTTP calls to external decode sites (for example httpbin base64
+  endpoints)
+- Playwright or other browser automation to bypass MCP
+- Manual LLM-generated base64 pasted into ad-hoc scripts
+- Delegating commit authority to a subagent while the main session has
+  `gitea.repo.commit` on an author profile
+
+**If shell encoding is unavailable** (spawn failure, hung terminal) **and** MCP
+commit cannot run: **stop** with a recovery report. Mention restarting the
+session, clearing hung background terminals, switching to MCP-native commit, and
+the agent temp artifact cleanup checklist. Do **not** retry shell encoding in a
+loop and do **not** substitute WebFetch/Playwright/manual base64.
+
 ### Create an issue / child issues
 
 - **Profile:** issue-manager or author (any profile allowed to create issues).
@@ -556,6 +823,45 @@ scripts/release-tag v0.4.0 --notes-file /tmp/release-notes.md
 scripts/release-tag v0.4.0 --notes-file /tmp/release-notes.md --push
 ```
 
+## Namespace workspace binding (#510)
+
+Each MCP namespace resolves its **own** active task workspace. Foreign role
+worktree environment variables must not poison another namespace's purity
+checks.
+
+| Namespace | Workspace env vars (in priority under `GITEA_ACTIVE_WORKTREE`) | Allowed roots |
+|-----------|------------------------------------------------------------------|---------------|
+| author | `GITEA_AUTHOR_WORKTREE` | `branches/<task>` worktree only (#274) |
+| reviewer | `GITEA_REVIEWER_WORKTREE` | clean `branches/<review>` worktree |
+| merger | `GITEA_MERGER_WORKTREE` | clean `branches/<merge>` worktree **or** clean control checkout |
+| reconciler | `GITEA_RECONCILER_WORKTREE` | clean `branches/<reconcile>` worktree **or** clean control checkout |
+
+`GITEA_AUTHOR_WORKTREE` is **author-only**. Reviewer, merger, and reconciler
+MCP processes ignore it even when it points at a dirty author WIP tree.
+
+### Safe reconnect / rebind procedure
+
+When a mutation blocks on workspace binding:
+
+1. Read the error — it names the **resolved workspace path**, **role
+   namespace**, and **binding source** (tool arg, env var, or process root).
+2. Reconnect or relaunch the correct namespace MCP server from the intended
+   workspace (or set the role-specific env var before launch).
+3. Pass `worktree_path` on reviewer/merger mutation tools when the active
+   branches/ worktree differs from the MCP process root.
+4. **Do not** clean, reset, or discard foreign role worktrees to unblock your
+   own namespace — that destroys another agent's WIP.
+
+### CTH guidance for workspace binding blockers
+
+When posting a Canonical Thread Handoff after a binding blocker:
+
+- State which namespace was active (author / reviewer / merger / reconciler).
+- Quote the resolved workspace path and binding source from the error.
+- Name the safe reconnect action (relaunch MCP from `branches/...`, set
+  `GITEA_*_WORKTREE`, or pass `worktree_path`).
+- Explicitly note that foreign worktrees must not be cleaned to unblock.
+
 ## Safety notes
 
 - Never place raw tokens or passwords in any LLM MCP config; reference secrets
@@ -574,3 +880,22 @@ scripts/release-tag v0.4.0 --notes-file /tmp/release-notes.md --push
 - [`credential-isolation.md`](credential-isolation.md) — credential handling.
 - [`release-workflows.md`](release-workflows.md) — release/merge workflow.
 - [`../README.md`](../README.md) — canonical config, thin launchers, the menu.
+
+## PR-only queue cleanup mode (#390)
+
+Use `pr-queue-cleanup` mode when the queue holds many open PRs and the goal
+is to drain reviews deterministically. One run = one PR = one canonical
+review (`skills/llm-project-workflow/workflows/pr-queue-cleanup.md`).
+
+* Cleanup runs are reviewer-role only (`pr_queue_cleanup` resolver task);
+  author sessions get `wrong_role_stop`.
+* Forbidden in cleanup mode: issue claiming, branch creation, implementation
+  edits, new issue filing, and any second-PR review after a terminal
+  mutation.
+* Terminal chain: stop after `REQUEST_CHANGES`; after `APPROVED` continue
+  only to same-PR merge with explicit per-PR operator authorization and
+  passing gates; stop after merge or merge blocker.
+* Every run reports the next suggested PR without continuing to it; the next
+  PR requires a fresh run with fresh identity/capability/inventory proof.
+* Use full `review-merge-pr` mode instead when the operator wants a single
+  targeted review, and `work-issue` mode for any authoring.

docs/mcp-client-registration.md

@@ -0,0 +1,108 @@
+# MCP Client Registration for External Control Plane Servers
+
+Issue #151 fixes the registration and naming contract for the Jenkins and
+GlitchTip MCP servers that live outside this Gitea MCP runtime.
+
+## Canonical Server Names
+
+Use these exact MCP server names in clients:
+
+| Server name | Boundary | Default capability |
+|---|---|---|
+| `jenkins-mcp` | Jenkins CI inspection (read) | Read-only build/job inspection |
+| `jenkins-write-mcp` | Jenkins build trigger (write) | Gated `jenkins_trigger_build` only |
+| `glitchtip-mcp` | GlitchTip observability inspection | Read-only issue/event inspection |
+
+The write boundary (`jenkins-write-mcp`) is **not** registered by default (#152).
+It exposes a single mutating tool and requires operator approval of a dedicated
+trigger profile before any client config references it.
+
+Historical names such as `jenkins-readonly` and `glitchtip-readonly` are
+descriptive profile labels only. They are not the canonical MCP server names
+unless an operator intentionally creates aliases and documents them.
+
+## Registration Pattern
+
+Register each external server as its own MCP entry. Do not add Jenkins or
+GlitchTip credentials to the Gitea MCP server. Also, do not add Gitea write
+credentials to the GlitchTip server.
+
+```json
+{
+  "mcpServers": {
+    "jenkins-mcp": {
+      "command": "/path/to/mcp-control-plane/venv/bin/python3",
+      "args": ["-m", "jenkins_mcp"],
+      "env": {
+        "JENKINS_MCP_CONFIG": "/path/to/mcp-control-plane/profiles.json",
+        "JENKINS_MCP_PROFILE": "jenkins-readonly"
+      }
+    },
+    "glitchtip-mcp": {
+      "command": "/path/to/mcp-control-plane/venv/bin/python3",
+      "args": ["-m", "glitchtip_mcp"],
+      "env": {
+        "GLITCHTIP_MCP_CONFIG": "/path/to/mcp-control-plane/profiles.json",
+        "GLITCHTIP_MCP_PROFILE": "glitchtip-readonly"
+      }
+    }
+  }
+}
+```
+
+Client-specific wrappers may differ, but the server names, trust boundaries,
+and profile separation must remain the same. After adding or changing either
+entry, reconnect or reload the MCP client before claiming the tools are usable.
+
+## Discoverability Validation
+
+Before using either server in a task, prove the expected tools are visible in
+the client. It is not enough for the config entry to exist.
+
+Expected Jenkins read tools (`jenkins-mcp` only):
+
+- `jenkins_whoami`
+- `jenkins_list_jobs`
+- `jenkins_latest_build`
+- `jenkins_build_status`
+- `jenkins_get_build`
+
+`jenkins_trigger_build` must **not** appear on `jenkins-mcp`. When an operator
+explicitly enables the write boundary, the only expected tool on
+`jenkins-write-mcp` is `jenkins_trigger_build`.
+
+Expected GlitchTip tools:
+
+- `glitchtip_whoami`
+- `glitchtip_list_projects`
+- `glitchtip_list_unresolved`
+- `glitchtip_get_issue`
+- `glitchtip_recent_events`
+- `glitchtip_search`
+
+If a client reports the server as enabled but exposes no usable tools, report
+`SKIPPED: server enabled but no usable tools visible`, then stop. Do not fall
+back to shell commands, raw service APIs, or unrelated MCP servers.
+
+## Boundary Rules
+
+- `jenkins-mcp` read profiles must not expose build trigger tools.
+- Build triggers live on the separate `jenkins-write-mcp` server
+  (`jenkins_mcp.write_server`), not on `jenkins-mcp`.
+- Jenkins build triggers require a dedicated trigger profile with
+  `jenkins.build.trigger` allowed, exact confirmation
+  (`TRIGGER BUILD <job-path>`), and fail-closed mutation audit.
+- Do not register `jenkins-write-mcp` until an operator approves a trigger
+  profile; no shipped profile carries trigger capability by default.
+- `glitchtip-mcp` remains read-only. It must not file or mutate Gitea issues.
+- GlitchTip-to-Gitea filing is a separate library-only orchestrator in
+  `mcp-control-plane` that composes the real GlitchTip read path with Gitea
+  issue-write tools.
+- The filing orchestrator must run GlitchTip/Gitea dedup before any Gitea
+  create action, and its create/link/skip decisions must be covered by tests.
+- The filing orchestrator must fail closed on mutation-audit failure before
+  any Gitea create, link, or comment mutation.
+- If filing is ever MCP-exposed, it must use a separate write-boundary
+  server/profile. It must not be exposed by `glitchtip-mcp`.
+- Gitea credentials never enter Jenkins or GlitchTip runtimes.
+- Jenkins and GlitchTip credentials never enter the Gitea MCP runtime.

docs/safety-model.md

@@ -21,5 +21,28 @@ Note on naming: Historical design docs used `jenkins-readonly` / `glitchtip-read
 
 ## 5. Mutation Gating
 Any mutating action (e.g., Gitea issue creation from GlitchTip, or Jenkins builds) must be explicitly allowed by the execution profile.
-- **Jenkins build triggers** exist in jenkins-mcp (landed #4) but require dedicated profile/identity and exact confirmation; not on standard reader profiles. See #56 for boundary correction.
-- **GlitchTip to Gitea issue filing** is documented as a gated, orchestrated workflow (not in glitchtip-mcp), currently partial (mocked, dedup not wired, audit missing). See #57.
+- **Jenkins build triggers** are gated on a separate write boundary
+  (`jenkins-write-mcp` / `jenkins_mcp.write_server`), not on the read-only
+  `jenkins-mcp` surface. Triggers require a dedicated profile with
+  `jenkins.build.trigger`, exact confirmation, and fail-closed mutation audit.
+  No default profile carries trigger capability (#152 / mcp-control-plane #56).
+- **GlitchTip to Gitea issue filing** is a library-only orchestrator in
+  mcp-control-plane (not on `glitchtip-mcp`). See #153 / mcp-control-plane #57.
+
+## 6. Agent Commit Path (no improvised fallbacks)
+
+When an author execution profile allows **`gitea.repo.commit`** and the
+**`gitea_commit_files`** tool is visible, agents must use that MCP path for
+repository commits. Fail closed instead of improvising alternate transports.
+
+Forbidden when MCP commit is available:
+
+- WebFetch or other HTTP calls to external base64/decode services
+- Playwright or browser automation used to work around MCP commit
+- Manual LLM-generated base64 embedded in throwaway scripts as the primary
+  commit transport
+
+If shell helpers are unavailable and MCP commit cannot run, stop with a recovery
+report (restart session, clear hung terminals, use MCP-native commit). See
+[`llm-workflow-runbooks.md`](llm-workflow-runbooks.md) § MCP-native commit path
+(#260) and agent temp artifact cleanup (#261).

docs/webui-local-dev.md

@@ -0,0 +1,89 @@
+# Internal web UI — local development (#426)
+
+Read-only MVP skeleton for the MCP Control Plane operator console. Gitea,
+MCP capability gates, and `skills/llm-project-workflow/` remain the source of
+truth; this UI only provides route stubs and layout.
+
+## Prerequisites
+
+- Python 3.11+ with project dependencies installed (`pip install -r requirements.txt`)
+- No secrets in repo, config, or client bundle
+
+## Start the server
+
+From the repository root (or an issue worktree):
+
+```bash
+./scripts/run-webui
+```
+
+Or directly:
+
+```bash
+python3 -m webui
+```
+
+Optional environment variables:
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `WEBUI_HOST` | `127.0.0.1` | Bind address (keep local for MVP) |
+| `WEBUI_PORT` | `8765` | Listen port |
+
+## Routes (MVP)
+
+| Path | Description |
+|------|-------------|
+| `/` | Home / operator overview |
+| `/health` | JSON liveness (`status`, `service`, `mode`, `timestamp`) |
+| `/queue` | Live PR and issue queue dashboard (#429) |
+| `/api/queue` | JSON queue export with pagination metadata |
+| `/projects` | Project registry list (#427) |
+| `/projects/{id}` | Project detail + onboarding checklist |
+| `/api/projects` | JSON registry export |
+| `/prompts` | Prompt library with per-prompt copy buttons (#428) |
+| `/api/prompts` | JSON prompt export with workflow hashes |
+| `/runtime` | Stub — MCP runtime health (#430) |
+| `/audit` | Stub — report audit paste (#431) |
+| `/worktrees` | Stub — hygiene dashboard (#432) |
+| `/leases` | Stub — lease visibility (#433) |
+
+All routes are GET-only. POST/PUT/PATCH/DELETE return `405` with
+`read-only-mvp`.
+
+## Project registry (#427)
+
+Versioned registry file: `webui/data/projects.registry.json` (schema version `1`).
+
+Override path with `WEBUI_PROJECT_REGISTRY` when operators keep a machine-local
+copy outside git. The registry stores repo identity, remotes, profile names,
+workflow/schema path references, and onboarding checklist steps — never tokens
+or credentials.
+
+Seed entry: **Gitea-Tools** on `https://gitea.prgs.cc` with `prgs-author`,
+`prgs-reviewer`, and `prgs-reconciler` profiles.
+
+## Prompt library (#428)
+
+Prompts are generated at load time from canonical workflow files under
+`skills/llm-project-workflow/workflows/`. SHA-256 hashes are computed from
+`WEBUI_REPO_ROOT` (defaults to the repository root). Prompt bodies are short
+copy/paste starters; canonical workflow files remain the only full policy
+source.
+
+## Live queue dashboard (#429)
+
+`/queue` loads open PRs and issues for the default registry project (seed:
+**Gitea-Tools** on `https://gitea.prgs.cc`) using existing `gitea_auth` read
+credentials. The UI surfaces pagination proof (returned count, pages fetched,
+`has_more`, `inventory_complete`) and classification badges (`claimed`,
+`blocked`, `in-review`, `duplicate`) when evidence exists.
+
+If credentials are missing or the fetch fails, the page shows an explicit error
+instead of an empty queue (fail closed).
+
+## Tests
+
+```bash
+pytest tests/test_webui_skeleton.py tests/test_webui_project_registry.py tests/test_webui_prompt_library.py tests/test_webui_queue_dashboard.py -q
+```

docs/wiki/History.md

@@ -0,0 +1,15 @@
+# Project History
+
+## Navigation
+
+- [Home](Home.md) | [Operator Guide](Operator-Guide.md) | [Repositories Map](Repositories.md) | [Identity and Profiles](Identity-and-Profiles.md) | [Workflow Model](Workflow.md) | [Safety and Gates](Safety-and-Gates.md) | [MCP Tools Reference](MCP-Tools.md) | [Operator Runbooks](Runbooks.md) | [Open Decisions](Open-Decisions.md) | [Project History](History.md)
+
+## 2026-07-06
+
+- **Wiki bootstrap (#224)** — Added repo-tracked `docs/wiki/` (10 pages), `scripts/sync-gitea-wiki.sh`, PR template gate, and sync safety tests for Gitea-Tools publication.
+
+## Prior milestones
+
+- Gated review/merge path (#16), task capability resolver (#69), issue-write tool gates.
+- Canonical JSON execution profiles (#19) and thin MCP launchers.
+- Role session router (#206) and review decision lock (#211).

docs/wiki/Home.md

@@ -0,0 +1,35 @@
+# Gitea-Tools Project Wiki
+
+Welcome to the version-controlled wiki for the Gitea-Tools MCP server and CLI tooling.
+
+## Navigation
+
+- [Home](Home.md)
+- [Operator Guide](Operator-Guide.md)
+- [Repositories Map](Repositories.md)
+- [Identity and Profiles](Identity-and-Profiles.md)
+- [Workflow Model](Workflow.md)
+- [Safety and Gates](Safety-and-Gates.md)
+- [MCP Tools Reference](MCP-Tools.md)
+- [Operator Runbooks](Runbooks.md)
+- [Open Decisions](Open-Decisions.md)
+- [Project History](History.md)
+
+## Gitea Wiki mirror
+
+These repo-tracked pages are the **source of truth**. The Gitea native Wiki
+for this repository is a read-only convenience mirror generated from this
+directory with `scripts/sync-gitea-wiki.sh` (dry-run by default; see
+[Runbooks](Runbooks.md)). Never edit the Gitea Wiki directly — change the
+pages here through a PR, then sync.
+
+## Project overview
+
+Gitea-Tools provides the Gitea MCP server, execution-profile configuration,
+identity handling, and CLI helpers used across MCP Control Plane workflows.
+It enforces author/reviewer separation, gated review/merge, task-capability
+resolution, and fail-closed safety rails in code.
+
+Canonical long-form docs also live under `docs/` in the repository (for example
+`docs/gitea-execution-profiles.md` and `docs/llm-workflow-runbooks.md`). The
+wiki summarizes operator-facing rules; the repo docs carry implementation detail.

docs/wiki/Identity-and-Profiles.md

@@ -0,0 +1,39 @@
+# Identity and Profiles
+
+## Navigation
+
+- [Home](Home.md) | [Operator Guide](Operator-Guide.md) | [Repositories Map](Repositories.md) | [Identity and Profiles](Identity-and-Profiles.md) | [Workflow Model](Workflow.md) | [Safety and Gates](Safety-and-Gates.md) | [MCP Tools Reference](MCP-Tools.md) | [Operator Runbooks](Runbooks.md) | [Open Decisions](Open-Decisions.md) | [Project History](History.md)
+
+The LLM is not the role — the **MCP execution profile** is the role. Profiles
+bind an authenticated Gitea identity to an allowed operation set.
+
+## Reference profiles (prgs)
+
+### Author / implementer
+
+- **Profile:** `prgs-author`
+- **Typical identity:** `jcwalker3`
+- **Allowed:** branch create/push, PR create, issue comment/create/close, repo commit, read.
+- **Forbidden:** PR approve, merge, request_changes.
+
+### Reviewer / merger
+
+- **Profile:** `prgs-reviewer`
+- **Typical identity:** `sysadmin`
+- **Allowed:** PR review/approve/merge/request_changes, issue comment, read.
+- **Forbidden:** branch push, PR create, repo commit.
+
+## Configuration
+
+Profiles are defined in the canonical JSON config (`GITEA_MCP_CONFIG`, typically
+`~/.config/gitea-tools/profiles.json`). Launchers are thin: they set
+`GITEA_MCP_PROFILE` and point at the config file. Credentials resolve from
+keychain or env references — never inline in client configs.
+
+See `docs/gitea-execution-profiles.md` in the repository for the full model.
+
+## Profile switching
+
+Use separate MCP server namespaces (`gitea-tools` author vs `gitea-reviewer`)
+or distinct launcher entries. Runtime in-place profile switching is disabled by
+default (fail closed).

docs/wiki/MCP-Tools.md

@@ -0,0 +1,34 @@
+# MCP Tools Reference
+
+## Navigation
+
+- [Home](Home.md) | [Operator Guide](Operator-Guide.md) | [Repositories Map](Repositories.md) | [Identity and Profiles](Identity-and-Profiles.md) | [Workflow Model](Workflow.md) | [Safety and Gates](Safety-and-Gates.md) | [MCP Tools Reference](MCP-Tools.md) | [Operator Runbooks](Runbooks.md) | [Open Decisions](Open-Decisions.md) | [Project History](History.md)
+
+## Identity and capability
+
+- `gitea_whoami` — authenticated user and active profile metadata.
+- `gitea_get_profile` / `gitea_get_runtime_context` — allowed and forbidden operations.
+- `gitea_resolve_task_capability` — required pre-flight for gated mutations.
+- `gitea_route_task_session` — role/session router before task execution.
+
+## Author tools
+
+- `gitea_create_issue`, `gitea_create_issue_comment`, `gitea_close_issue`
+- `gitea_mark_issue`, `gitea_set_issue_labels`, `gitea_lock_issue`
+- `gitea_create_pr`, `gitea_edit_pr`, `gitea_commit_files`
+- `gitea_delete_branch`
+
+## Reviewer tools
+
+- `gitea_check_pr_eligibility` — read-only eligibility check.
+- `gitea_dry_run_pr_review` — validation-phase review mechanics.
+- `gitea_mark_final_review_decision` — mark validation complete.
+- `gitea_submit_pr_review` / `gitea_review_pr` — gated live review.
+- `gitea_merge_pr` — gated merge (only merge path).
+
+## Read tools
+
+- `gitea_list_prs`, `gitea_view_pr`, `gitea_list_issues`, `gitea_view_issue`
+- `gitea_get_file`, `gitea_list_labels`, `gitea_mirror_refs`
+
+See the repository `README.md` for the full tool table and client setup.

docs/wiki/Open-Decisions.md

@@ -0,0 +1,11 @@
+# Open Decisions
+
+## Navigation
+
+- [Home](Home.md) | [Operator Guide](Operator-Guide.md) | [Repositories Map](Repositories.md) | [Identity and Profiles](Identity-and-Profiles.md) | [Workflow Model](Workflow.md) | [Safety and Gates](Safety-and-Gates.md) | [MCP Tools Reference](MCP-Tools.md) | [Operator Runbooks](Runbooks.md) | [Open Decisions](Open-Decisions.md) | [Project History](History.md)
+
+Pending architectural and workflow decisions:
+
+- **Operation-scoped role selection (#228)** — Move from launcher-profile-dependent routing to per-operation profile resolution.
+- **Gitea-Tools wiki for dadeschools remote** — This bootstrap covers `prgs`; dadeschools instance wiki parity is undecided.
+- **Server-side self-merge block** — Complement tool gates with Gitea branch protection where available.

docs/wiki/Operator-Guide.md

@@ -0,0 +1,32 @@
+# Operator Guide
+
+## Navigation
+
+- [Home](Home.md) | [Operator Guide](Operator-Guide.md) | [Repositories Map](Repositories.md) | [Identity and Profiles](Identity-and-Profiles.md) | [Workflow Model](Workflow.md) | [Safety and Gates](Safety-and-Gates.md) | [MCP Tools Reference](MCP-Tools.md) | [Operator Runbooks](Runbooks.md) | [Open Decisions](Open-Decisions.md) | [Project History](History.md)
+
+Handbook for LLM operators and human developers using the Gitea-Tools MCP server.
+
+## Key rules
+
+1. **Verify identity first** — Run `gitea_whoami` and confirm the active profile before any mutation.
+2. **Resolve task capability** — Call `gitea_resolve_task_capability` for the intended task before gated tools.
+3. **One unit of work per session** — Implement one claimed issue *or* review/merge one PR; do not mix author and reviewer mutations in one session.
+4. **No self-review / no self-merge** — The authenticated Gitea user must not approve or merge a PR they authored.
+5. **Follow the gates** — Prompts express intent; MCP tools enforce safety. Never bypass gates via prompt instructions.
+6. **Global LLM Worktree Rule** — Main checkout stays on `master`/`main`/`dev`; all mutations happen under `branches/`. Prove project root, `cwd`, branch, stable main-checkout branch, and session worktree path before editing. No exceptions.
+
+## Supported Gitea instances
+
+| Remote | Host | Default org/repo |
+|--------|------|------------------|
+| `dadeschools` | `gitea.dadeschools.net` | `Contractor / Timesheet` |
+| `prgs` | `gitea.prgs.cc` | `Scaled-Tech-Consulting / Timesheet` |
+
+Always pass `remote` explicitly on tool calls. The server default is `dadeschools`; forgetting `remote` on a `prgs` task hits the wrong host.
+
+## New session checklist
+
+1. `gitea_whoami` — confirm authenticated user and profile.
+2. `gitea_get_runtime_context` — allowed/forbidden operations for this session.
+3. `gitea_resolve_task_capability` — prove the session may perform the planned task.
+4. For reviewer work: dry-run validation (`gitea_dry_run_pr_review`) before live review mutations.

docs/wiki/Repositories.md

@@ -0,0 +1,38 @@
+# Repositories Map
+
+## Navigation
+
+- [Home](Home.md) | [Operator Guide](Operator-Guide.md) | [Repositories Map](Repositories.md) | [Identity and Profiles](Identity-and-Profiles.md) | [Workflow Model](Workflow.md) | [Safety and Gates](Safety-and-Gates.md) | [MCP Tools Reference](MCP-Tools.md) | [Operator Runbooks](Runbooks.md) | [Open Decisions](Open-Decisions.md) | [Project History](History.md)
+
+Active MCP Control Plane repositories (authoritative inventory for wiki publication gate #224 / #87):
+
+| Repository | Purpose | Wiki required |
+|------------|---------|---------------|
+| `Scaled-Tech-Consulting/Gitea-Tools` | Gitea MCP server, execution profiles, workflow tooling | Yes — live Gitea Wiki on Wiki tab |
+| `Scaled-Tech-Consulting/mcp-control-plane` | Orchestrators, audit trails, multi-service controller workflows | Yes — live Gitea Wiki on Wiki tab |
+
+Repo-tracked `docs/wiki/` is the source of truth; the Gitea Wiki is a mirror.
+Wiki-related issues cannot be closed until the live Wiki is verified — see
+[Safety and Gates](Safety-and-Gates.md) and [Runbooks](Runbooks.md).
+
+### Gitea-Tools
+
+- **Repository:** `Scaled-Tech-Consulting/Gitea-Tools`
+- **Purpose:** Gitea MCP server, profile configuration, CLI scripts, safety gates.
+- **Base branch:** `master`
+
+### mcp-control-plane
+
+- **Repository:** `Scaled-Tech-Consulting/mcp-control-plane`
+- **Purpose:** Controller workflows, Jenkins/GlitchTip integrations, audit orchestration.
+- **Base branch:** `master`
+
+## Wiki publication status (#224 readiness gate)
+
+| Repository | `docs/wiki/` source | Gitea Wiki published | Proof |
+|---|---|---|---|
+| `Scaled-Tech-Consulting/Gitea-Tools` | yes (10 pages) | published (verified 2026-07-06) | [Wiki Home](https://gitea.prgs.cc/Scaled-Tech-Consulting/Gitea-Tools/wiki/Home); 10 pages; wiki git log head `d1f0693` |
+| `Scaled-Tech-Consulting/mcp-control-plane` | yes (10 pages) | published (verified 2026-07-06) | [Wiki Home](https://gitea.prgs.cc/Scaled-Tech-Consulting/mcp-control-plane/wiki/Home); 10 pages (History, Home, Identity-and-Profiles, MCP-Tools, Open-Decisions, Operator-Guide, Repositories, Runbooks, Safety-and-Gates, Workflow); wiki git log head `ef3dec2` |
+
+
+Update this table whenever a wiki is published, re-synced, or found stale.

docs/wiki/Runbooks.md

@@ -0,0 +1,40 @@
+# Operator Runbooks
+
+## Navigation
+
+- [Home](Home.md) | [Operator Guide](Operator-Guide.md) | [Repositories Map](Repositories.md) | [Identity and Profiles](Identity-and-Profiles.md) | [Workflow Model](Workflow.md) | [Safety and Gates](Safety-and-Gates.md) | [MCP Tools Reference](MCP-Tools.md) | [Operator Runbooks](Runbooks.md) | [Open Decisions](Open-Decisions.md) | [Project History](History.md)
+
+## PR review and merge
+
+1. `gitea_resolve_task_capability(task="review_pr")`
+2. `gitea_check_pr_eligibility` for review and merge actions.
+3. Validate locally: tests, `py_compile`, `git diff --check`.
+4. `gitea_mark_final_review_decision` → approve via `gitea_review_pr`.
+5. `gitea_merge_pr` with pinned head SHA and `confirmation="MERGE PR <n>"`.
+
+## Gitea Wiki sync
+
+The Gitea Wiki mirrors `docs/wiki/` (source of truth). After merging wiki changes:
+
+1. Preview (no network):
+   ```bash
+   scripts/sync-gitea-wiki.sh
+   ```
+2. Operator-confirmed push:
+   ```bash
+   GITEA_WIKI_SYNC_CONFIRM="SYNC WIKI Gitea-Tools" scripts/sync-gitea-wiki.sh --push
+   ```
+3. If clone fails on first run, bootstrap Home via Gitea API or UI, then re-run.
+
+The script mirrors only `docs/wiki/*.md`, never deletes wiki pages, and never
+prints credentials.
+
+## Wiki Publication Readiness Gate (#224)
+
+Actual Gitea Wiki publication is a **required repo readiness gate**.
+
+1. **Closure prevention** — No wiki issue may close on markdown/helper work alone.
+   Closing requires live-Wiki proof: Wiki Home link plus page listing or wiki git log.
+2. **Reviewer checklist** — PR template requires verifying the repo **Wiki tab**.
+3. **Publication authority** — `--push` requires exact `GITEA_WIKI_SYNC_CONFIRM` phrase.
+4. **Per-repo status** — Update [Repositories Map](Repositories.md) when published.

docs/wiki/Safety-and-Gates.md

@@ -0,0 +1,19 @@
+# Safety and Gates
+
+## Navigation
+
+- [Home](Home.md) | [Operator Guide](Operator-Guide.md) | [Repositories Map](Repositories.md) | [Identity and Profiles](Identity-and-Profiles.md) | [Workflow Model](Workflow.md) | [Safety and Gates](Safety-and-Gates.md) | [MCP Tools Reference](MCP-Tools.md) | [Operator Runbooks](Runbooks.md) | [Open Decisions](Open-Decisions.md) | [Project History](History.md)
+
+*Prompts express intent; MCP tools enforce safety.*
+
+## Primary gates
+
+1. **Fail closed** — Unknown tasks, missing capability resolution, or profile mismatches block mutations.
+2. **Task capability map** — `gitea_resolve_task_capability` must precede gated issue/PR mutations.
+3. **Issue lock** — `gitea_lock_issue` required before author implementation on a tracked issue.
+4. **Head SHA pinning** — Reviews and merges refuse when the PR head moved.
+5. **Explicit merge confirmation** — `gitea_merge_pr` requires `confirmation="MERGE PR <n>"`.
+6. **No self-review / self-merge** — Authenticated user must differ from PR author for approve/merge.
+7. **Review decision lock** — Live review mutations require validation-phase dry-run and `gitea_mark_final_review_decision`.
+8. **Redaction** — Tokens, passwords, and keychain material never appear in tool output.
+9. **Wiki publication (#224)** — `docs/wiki/` and the sync helper are prerequisites only. Closing a wiki issue requires live Gitea Wiki proof on the repo Wiki tab. See [Runbooks](Runbooks.md#wiki-publication-readiness-gate-224).

docs/wiki/Workflow.md

@@ -0,0 +1,38 @@
+# Workflow Model
+
+## Navigation
+
+- [Home](Home.md) | [Operator Guide](Operator-Guide.md) | [Repositories Map](Repositories.md) | [Identity and Profiles](Identity-and-Profiles.md) | [Workflow Model](Workflow.md) | [Safety and Gates](Safety-and-Gates.md) | [MCP Tools Reference](MCP-Tools.md) | [Operator Runbooks](Runbooks.md) | [Open Decisions](Open-Decisions.md) | [Project History](History.md)
+
+## Step 1: Review queue first (reviewer profile)
+
+1. `gitea_resolve_task_capability(task="review_pr")`
+2. List open PRs; pick the oldest eligible PR (not self-authored, mergeable).
+3. Pin head SHA; validate diff scope and run tests locally.
+4. `gitea_mark_final_review_decision` → `gitea_review_pr` / `gitea_submit_pr_review`
+5. `gitea_merge_pr` only with `confirmation="MERGE PR <n>"` and pinned head SHA.
+
+## Step 2: Implement issues (author profile)
+
+0. Work Selection Rule — verify a work lease before any mutations (open PRs,
+   issue-linked PRs, branches, worktrees, dirty worktrees, active leases/
+   handoffs, merged-PR completion). Stop if another session owns the lease.
+   `gitea_lock_issue` records an operation-scoped `author_issue_work` lease
+   with issue, branch, worktree, claimant, created, expiry, and heartbeat
+   fields; active or expired same-operation leases require recovery review
+   before takeover.
+0b. Global LLM Worktree Rule — main checkout on `master`/`main`/`dev` only;
+   mutate only from a `branches/` worktree after proving root, cwd, branch,
+   stable main-checkout branch, and session worktree path (no exceptions).
+1. `gitea_resolve_task_capability` for the author task.
+2. `gitea_lock_issue` before implementation mutations.
+3. Claim with `gitea_mark_issue` / `status:in-progress` label.
+4. Branch, implement, test, push, `gitea_create_pr`.
+5. Release claim when done; never self-review the PR.
+
+## Step 3: Operator follow-ups
+
+Wiki publication, credential provisioning, and cross-repo mirror operations are
+operator-confirmed actions — see [Runbooks](Runbooks.md).
+
+Full Gitea-specific runbooks: `docs/llm-workflow-runbooks.md` in the repository.

gitea_audit.py

@@ -163,12 +163,13 @@ def audit_enabled():
 def build_event(*, action, result, remote=None, server=None, repository=None,
                 issue_number=None, pr_number=None, profile_name=None,
                 audit_label=None, authenticated_username=None, target_branch=None,
-                head_sha=None, reason=None, request_metadata=None, now=None):
+                head_sha=None, reason=None, request_metadata=None, now=None,
+                mcp_namespace=None, task_role=None, operation=None):
     """Build a redacted, JSON-able audit record for a mutating action."""
     ts = now or datetime.datetime.now(datetime.timezone.utc)
     if isinstance(ts, datetime.datetime):
         ts = ts.isoformat()
-    return {
+    event = {
         "timestamp": ts,
         "action": action,
         "action_type": "mutating",
@@ -186,6 +187,13 @@ def build_event(*, action, result, remote=None, server=None, repository=None,
         "reason": _redact_str(reason) if reason else reason,
         "request_metadata": redact(request_metadata) if request_metadata is not None else None,
     }
+    if mcp_namespace is not None:
+        event["mcp_namespace"] = mcp_namespace
+    if task_role is not None:
+        event["task_role"] = task_role
+    if operation is not None:
+        event["operation"] = operation
+    return event
 
 
 def write_event(event, path=None):

gitea_auth.py

@@ -420,6 +420,43 @@ def api_get_all(url, auth_header, *, limit=None, page_size=50, max_pages=100,
     return results
 
 
+def api_fetch_page(url, auth_header, *, page=1, limit=50, **kwargs):
+    """Fetch one page from a Gitea list endpoint with explicit pagination metadata.
+
+    Returns ``(items, pagination)`` where *pagination* includes ``has_more``,
+    ``next_page``, and ``is_final_page`` derived from the returned page length.
+    """
+    page = max(1, int(page))
+    limit = max(1, min(50, int(limit)))
+    page_url = _add_query(url, page=page, limit=limit)
+    data = api_request("GET", page_url, auth_header, **kwargs)
+    if data is None:
+        pagination = {
+            "page": page,
+            "per_page": limit,
+            "returned_count": 0,
+            "has_more": False,
+            "next_page": None,
+            "is_final_page": True,
+        }
+        return [], pagination
+    if not isinstance(data, list):
+        raise RuntimeError(
+            f"expected a list page from Gitea, got {type(data).__name__}"
+        )
+    returned = len(data)
+    has_more = returned >= limit
+    pagination = {
+        "page": page,
+        "per_page": limit,
+        "returned_count": returned,
+        "has_more": has_more,
+        "next_page": page + 1 if has_more else None,
+        "is_final_page": not has_more,
+    }
+    return data, pagination
+
+
 def gitea_url(host, path):
     """Build a full URL for *host* and *path*, using http for loopback and https for others."""
     if not path.startswith("/"):

gitea_config.py

@@ -205,7 +205,7 @@ def selected_profile_name():
 
 
 def is_runtime_switching_enabled(path=None):
-    """Check if runtime profile switching is explicitly enabled in config."""
+    """Check if runtime profile switching is enabled in config."""
     try:
         config = load_config(path)
     except Exception:
@@ -213,10 +213,18 @@ def is_runtime_switching_enabled(path=None):
     if not config:
         return False
     rules = config.get("rules") or {}
+    if rules.get("allow_runtime_switching") is False:
+        return False
+    if config.get("allow_runtime_switching") is False:
+        return False
     if rules.get("allow_runtime_switching") is True:
         return True
     if config.get("allow_runtime_switching") is True:
         return True
+    # Default to True if multiple profiles exist in the config
+    profiles = config.get("profiles") or {}
+    if len(profiles) > 1:
+        return True
     return False
 
 

issue_claim_heartbeat.py

@@ -0,0 +1,295 @@
+"""Issue claim heartbeat leases and stale-claim reconciliation (#268).
+
+Structured issue-thread comments prove live ownership beyond the
+``status:in-progress`` label alone. Queue inventory can classify claims as
+active, stale, reclaimable, PR-backed, or phantom.
+"""
+
+from __future__ import annotations
+
+import re
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+MARKER = "<!-- gitea-issue-claim-heartbeat:v1 -->"
+IN_PROGRESS_LABEL = "status:in-progress"
+
+_KIND_CLAIM = "claim"
+_KIND_PROGRESS = "progress"
+_KIND_CLEANUP = "cleanup"
+
+_FIELD_RE = re.compile(
+    r"^\s*-\s*([a-z_]+)\s*:\s*(.+?)\s*$",
+    re.IGNORECASE | re.MULTILINE,
+)
+_ISSUE_REF_RE = re.compile(r"issue-(\d+)", re.IGNORECASE)
+
+
+def _parse_timestamp(value: str | None) -> datetime | None:
+    if not value:
+        return None
+    text = value.strip()
+    if text.endswith("Z"):
+        text = text[:-1] + "+00:00"
+    try:
+        parsed = datetime.fromisoformat(text)
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        return parsed.replace(tzinfo=timezone.utc)
+    return parsed
+
+
+def format_heartbeat_body(
+    *,
+    kind: str,
+    issue_number: int,
+    branch: str,
+    phase: str,
+    profile: str | None = None,
+    pr: str = "none",
+    next_action: str = "none",
+    blocker: str = "none",
+) -> str:
+    """Return a structured, machine-parseable issue comment body."""
+    profile_value = (profile or "unknown").strip() or "unknown"
+    lines = [
+        MARKER,
+        "**Issue claim heartbeat**",
+        f"- kind: {kind}",
+        f"- issue: #{issue_number}",
+        f"- branch: {branch}",
+        f"- phase: {phase}",
+        f"- profile: {profile_value}",
+        f"- pr: {pr}",
+        f"- blocker: {blocker}",
+        f"- next_action: {next_action}",
+    ]
+    return "\n".join(lines)
+
+
+def parse_heartbeat_comment(body: str) -> dict[str, Any] | None:
+    """Parse one structured heartbeat comment, or None when not a heartbeat."""
+    text = body or ""
+    if MARKER not in text:
+        return None
+    fields: dict[str, str] = {}
+    for match in _FIELD_RE.finditer(text):
+        fields[match.group(1).strip().lower()] = match.group(2).strip()
+    if not fields:
+        return None
+    issue_raw = fields.get("issue", "")
+    issue_digits = re.sub(r"[^\d]", "", issue_raw)
+    issue_number = int(issue_digits) if issue_digits.isdigit() else None
+    return {
+        "kind": fields.get("kind"),
+        "issue_number": issue_number,
+        "branch": fields.get("branch"),
+        "phase": fields.get("phase"),
+        "profile": fields.get("profile"),
+        "pr": fields.get("pr"),
+        "blocker": fields.get("blocker"),
+        "next_action": fields.get("next_action"),
+        "raw_fields": fields,
+    }
+
+
+def extract_issue_heartbeats(
+    comments: list[dict],
+    *,
+    issue_number: int | None = None,
+) -> list[dict]:
+    """Return parsed heartbeats newest-last, optionally filtered to *issue_number*."""
+    heartbeats: list[dict] = []
+    for comment in comments or []:
+        parsed = parse_heartbeat_comment(comment.get("body") or "")
+        if not parsed:
+            continue
+        if issue_number is not None and parsed.get("issue_number") != issue_number:
+            continue
+        heartbeats.append(
+            {
+                **parsed,
+                "comment_id": comment.get("id"),
+                "author": (comment.get("user") or {}).get("login")
+                or comment.get("author"),
+                "created_at": comment.get("created_at"),
+                "updated_at": comment.get("updated_at"),
+            }
+        )
+    return heartbeats
+
+
+def issue_has_in_progress_label(issue: dict) -> bool:
+    labels = issue.get("labels") or []
+    for label in labels:
+        name = label if isinstance(label, str) else label.get("name")
+        if name == IN_PROGRESS_LABEL:
+            return True
+    return False
+
+
+def _linked_open_pr(issue_number: int, open_prs: list[dict]) -> dict | None:
+    pattern = f"issue-{issue_number}"
+    closes = f"closes #{issue_number}"
+    fixes = f"fixes #{issue_number}"
+    for pr in open_prs or []:
+        head = (pr.get("head") or {}).get("ref") or ""
+        text = f"{pr.get('title', '')} {pr.get('body', '')}".lower()
+        if pattern in head.lower():
+            return pr
+        if closes in text or fixes in text:
+            return pr
+    return None
+
+
+def _matching_branch_names(issue_number: int, branch_names: list[str]) -> list[str]:
+    pattern = f"issue-{issue_number}"
+    return [name for name in branch_names if pattern in (name or "").lower()]
+
+
+def classify_issue_claim(
+    *,
+    issue: dict,
+    comments: list[dict],
+    open_prs: list[dict] | None = None,
+    branch_names: list[str] | None = None,
+    now: datetime | None = None,
+    heartbeat_lease_minutes: int = 30,
+    reclaim_after_minutes: int = 60,
+) -> dict[str, Any]:
+    """Classify one issue's claim state from labels, heartbeats, PRs, and branches."""
+    issue_number = int(issue.get("number") or 0)
+    open_prs = open_prs or []
+    branch_names = branch_names or []
+    current = now or datetime.now(timezone.utc)
+
+    has_label = issue_has_in_progress_label(issue)
+    heartbeats = extract_issue_heartbeats(comments, issue_number=issue_number)
+    latest = heartbeats[-1] if heartbeats else None
+    latest_at = _parse_timestamp(
+        (latest or {}).get("updated_at") or (latest or {}).get("created_at")
+    )
+    age_minutes = None
+    if latest_at:
+        age_minutes = int((current - latest_at).total_seconds() // 60)
+
+    linked_pr = _linked_open_pr(issue_number, open_prs)
+    matching_branches = _matching_branch_names(issue_number, branch_names)
+
+    if not has_label:
+        status = "not_claimed"
+        reasons = ["issue lacks status:in-progress label"]
+    elif linked_pr:
+        status = "awaiting_review"
+        reasons = [f"open PR #{linked_pr.get('number')} covers this issue"]
+    elif not heartbeats:
+        status = "phantom"
+        reasons = [
+            "status:in-progress label present without structured claim heartbeat"
+        ]
+    elif latest_at is None:
+        status = "phantom"
+        reasons = ["heartbeat comments present but timestamps could not be parsed"]
+    elif age_minutes is not None and age_minutes <= heartbeat_lease_minutes:
+        status = "active"
+        reasons = [f"heartbeat age {age_minutes}m within {heartbeat_lease_minutes}m lease"]
+    elif matching_branches and age_minutes is not None and age_minutes <= reclaim_after_minutes:
+        status = "active"
+        reasons = [
+            f"matching branch(es) {', '.join(matching_branches)} with heartbeat "
+            f"age {age_minutes}m"
+        ]
+    elif age_minutes is not None and age_minutes > reclaim_after_minutes and not matching_branches:
+        status = "reclaimable"
+        reasons = [
+            f"no heartbeat within {reclaim_after_minutes}m and no matching branch"
+        ]
+    elif age_minutes is not None and age_minutes > heartbeat_lease_minutes:
+        status = "stale"
+        reasons = [
+            f"heartbeat age {age_minutes}m exceeds {heartbeat_lease_minutes}m lease"
+        ]
+    else:
+        status = "active"
+        reasons = ["claim has structured heartbeat proof"]
+
+    return {
+        "issue_number": issue_number,
+        "title": issue.get("title"),
+        "status": status,
+        "has_in_progress_label": has_label,
+        "heartbeat_count": len(heartbeats),
+        "latest_heartbeat": latest,
+        "heartbeat_age_minutes": age_minutes,
+        "linked_open_pr": linked_pr.get("number") if linked_pr else None,
+        "matching_branches": matching_branches,
+        "reasons": reasons,
+        "reclaimable": status == "reclaimable",
+        "stale": status in {"stale", "phantom", "reclaimable"},
+    }
+
+
+def build_claim_inventory(
+    *,
+    issues: list[dict],
+    comments_by_issue: dict[int, list[dict]],
+    open_prs: list[dict],
+    branch_names: list[str],
+    now: datetime | None = None,
+    heartbeat_lease_minutes: int = 30,
+    reclaim_after_minutes: int = 60,
+) -> dict[str, Any]:
+    """Build a queue inventory report for in-progress issue claims."""
+    entries: list[dict] = []
+    for issue in issues or []:
+        if not issue_has_in_progress_label(issue):
+            continue
+        number = int(issue["number"])
+        entry = classify_issue_claim(
+            issue=issue,
+            comments=comments_by_issue.get(number, []),
+            open_prs=open_prs,
+            branch_names=branch_names,
+            now=now,
+            heartbeat_lease_minutes=heartbeat_lease_minutes,
+            reclaim_after_minutes=reclaim_after_minutes,
+        )
+        entries.append(entry)
+
+    counts: dict[str, int] = {}
+    for entry in entries:
+        counts[entry["status"]] = counts.get(entry["status"], 0) + 1
+
+    return {
+        "entries": entries,
+        "counts": counts,
+        "heartbeat_lease_minutes": heartbeat_lease_minutes,
+        "reclaim_after_minutes": reclaim_after_minutes,
+        "in_progress_total": len(entries),
+    }
+
+
+def build_cleanup_plan(inventory: dict[str, Any]) -> list[dict]:
+    """Return stale/reclaimable/phantom claims that may be cleaned up."""
+    plan: list[dict] = []
+    for entry in inventory.get("entries") or []:
+        if entry.get("status") in {"reclaimable", "phantom"}:
+            plan.append(
+                {
+                    "issue_number": entry["issue_number"],
+                    "status": entry["status"],
+                    "action": "remove_status_in_progress_and_comment",
+                    "reasons": list(entry.get("reasons") or []),
+                }
+            )
+        elif entry.get("status") == "stale" and not entry.get("linked_open_pr"):
+            plan.append(
+                {
+                    "issue_number": entry["issue_number"],
+                    "status": entry["status"],
+                    "action": "report_only",
+                    "reasons": list(entry.get("reasons") or []),
+                }
+            )
+    return plan

issue_lock_adoption.py

@@ -0,0 +1,272 @@
+"""Own-branch lock adoption / recovery for ``gitea_lock_issue`` (#442 / #443).
+
+When an issue's own already-pushed branch exists, lock reacquisition must be
+allowed (adoption) instead of being treated as #400 duplicate competing work.
+This module isolates the pure decision so it can be unit-tested apart from the
+MCP server's live Gitea calls.
+
+Adoption is granted only for the issue's *exact* requested branch. Any other
+branch that merely contains the same ``issue-<n>`` marker is competing work and
+stays fail-closed. Open-PR, competing-live-lock, capability, and worktree
+safety checks are enforced by the caller before this decision is consulted;
+this module additionally records whether they passed for proof purposes.
+"""
+
+from __future__ import annotations
+
+import re
+
+ADOPT = "adopt_existing_branch"
+BLOCK_COMPETING = "block_competing_branch"
+NO_MATCH = "no_matching_branch"
+
+# Citable decision labels aligned with the ``assess_own_branch_adoption``
+# outcomes, surfaced verbatim in the live ``gitea_lock_issue`` response so
+# recovery reports (#473-style) can quote the lock tool output directly
+# instead of inferring adoption from separate offline checks (#477).
+DECISION_LABELS = {
+    ADOPT: "ADOPT",
+    BLOCK_COMPETING: "BLOCK_COMPETING",
+    NO_MATCH: "NO_MATCH",
+}
+
+_SAFE_NEXT_ACTIONS = {
+    ADOPT: (
+        "Own existing branch adopted for lock recovery; proceed to "
+        "gitea_create_pr for this issue and cite this adoption proof."
+    ),
+    BLOCK_COMPETING: (
+        "Competing same-issue branch(es) exist; resolve branch ownership "
+        "before locking. No adoption performed (fail closed)."
+    ),
+    NO_MATCH: (
+        "No existing branch carries this issue marker; normal lock path "
+        "applied. No adoption performed."
+    ),
+}
+
+
+def decision_label(outcome: str) -> str:
+    """Map an ``assess_own_branch_adoption`` outcome to its citable label."""
+    return DECISION_LABELS.get(outcome, "UNKNOWN")
+
+
+def safe_next_action(outcome: str) -> str:
+    """Return the safe next action string for an adoption *outcome*."""
+    return _SAFE_NEXT_ACTIONS.get(
+        outcome, "Unknown adoption outcome; treat as fail closed."
+    )
+
+
+def _branch_name(entry) -> str:
+    if isinstance(entry, dict):
+        return str(entry.get("name") or "")
+    return str(entry or "")
+
+
+def _branch_sha(entry) -> str | None:
+    if isinstance(entry, dict):
+        sha = entry.get("commit_sha")
+        if sha:
+            return str(sha)
+    return None
+
+
+def _branch_carries_issue_marker(branch_name: str, issue_number: int) -> bool:
+    """Return True when *branch_name* references issue *issue_number* exactly.
+
+    Uses a numeric word-boundary so ``issue-42`` does not match inside
+    ``issue-420`` (AC6 / #440).
+    """
+    name = (branch_name or "").strip()
+    if not name:
+        return False
+    pattern = rf"(?:^|/)issue-{int(issue_number)}(?![0-9])"
+    return re.search(pattern, name) is not None
+
+
+def assess_own_branch_adoption(
+    *,
+    issue_number: int,
+    requested_branch: str,
+    existing_branches,
+) -> dict:
+    """Decide whether an existing matching branch is adoptable.
+
+    Args:
+        issue_number: The tracking issue number being locked.
+        requested_branch: The exact branch the caller wants to lock.
+        existing_branches: Iterable of remote branch entries — either names or
+            dicts with ``name`` and optional ``commit_sha``.
+
+    Returns:
+        dict with:
+          * ``outcome`` — one of ADOPT / BLOCK_COMPETING / NO_MATCH
+          * ``adopt`` (bool), ``block`` (bool)
+          * ``reason`` (str)
+          * ``matched_branch`` (str | None), ``matched_head_sha`` (str | None)
+          * ``competing_branches`` (list[str])
+
+    ADOPT: the issue's exact branch exists and no other same-issue branch does.
+    BLOCK_COMPETING: at least one same-issue branch is not the requested branch.
+    NO_MATCH: no branch carries the issue marker — normal lock path applies.
+    """
+    requested = (requested_branch or "").strip()
+
+    matches: list[tuple[str, str | None]] = []
+    for entry in existing_branches or []:
+        name = _branch_name(entry).strip()
+        if _branch_carries_issue_marker(name, issue_number):
+            matches.append((name, _branch_sha(entry)))
+
+    competing = sorted({name for name, _ in matches if name != requested})
+    exact = [(name, sha) for name, sha in matches if name == requested]
+
+    # Fail closed whenever any non-requested same-issue branch exists, even if
+    # the requested branch is also present: ownership is then ambiguous.
+    if competing:
+        return {
+            "outcome": BLOCK_COMPETING,
+            "adopt": False,
+            "block": True,
+            "reason": (
+                f"issue #{issue_number} already has matching branch(es) "
+                f"{competing} that are not the requested branch "
+                f"'{requested}' (fail closed)"
+            ),
+            "matched_branch": None,
+            "matched_head_sha": None,
+            "competing_branches": competing,
+        }
+
+    if exact:
+        name, sha = exact[0]
+        return {
+            "outcome": ADOPT,
+            "adopt": True,
+            "block": False,
+            "reason": (
+                f"existing branch '{name}' is the exact requested branch for "
+                f"issue #{issue_number}; adopting it for lock recovery"
+            ),
+            "matched_branch": name,
+            "matched_head_sha": sha,
+            "competing_branches": [],
+        }
+
+    return {
+        "outcome": NO_MATCH,
+        "adopt": False,
+        "block": False,
+        "reason": f"no existing branch matches issue #{issue_number}",
+        "matched_branch": None,
+        "matched_head_sha": None,
+        "competing_branches": [],
+    }
+
+
+def _matcher_summary(issue_number: int, assessment: dict) -> str:
+    """Explain, citably, why the assessed branch did or did not qualify.
+
+    Names the numeric word-boundary rule so reports can show that
+    ``issue-42`` was not matched inside ``issue-420`` (#440 / #477 AC3).
+    """
+    outcome = assessment.get("outcome")
+    matched = assessment.get("matched_branch")
+    competing = assessment.get("competing_branches") or []
+    if outcome == ADOPT and matched:
+        return (
+            f"branch '{matched}' exactly matches the issue-{int(issue_number)} "
+            f"marker (numeric word-boundary; 'issue-{int(issue_number)}' is not "
+            f"matched inside 'issue-{int(issue_number)}0')"
+        )
+    if outcome == BLOCK_COMPETING:
+        return (
+            f"competing same-issue branch(es) {competing} carry the "
+            f"issue-{int(issue_number)} marker but are not the requested "
+            f"branch; ownership is ambiguous (fail closed)"
+        )
+    return (
+        f"no existing branch carries the issue-{int(issue_number)} marker "
+        f"under the numeric word-boundary rule"
+    )
+
+
+def _competing_branch_check(assessment: dict) -> dict:
+    """Structured competing-branch verdict for the proof block."""
+    competing = list(assessment.get("competing_branches") or [])
+    return {
+        "result": "blocked" if competing else "clear",
+        "competing_branches": competing,
+    }
+
+
+def build_adoption_proof(
+    *,
+    issue_number: int,
+    branch_name: str,
+    assessment: dict,
+    open_pr_checked: bool,
+    competing_lock_checked: bool,
+    lock_file_path: str,
+    lock_file_status: str,
+) -> dict:
+    """Assemble the proof block returned by ``gitea_lock_issue`` on adoption.
+
+    Requirement #4: adoption results must carry issue number, branch name,
+    branch head commit, adoption reason, no-existing-PR proof, no-competing-
+    live-lock proof, and lock file path/status.
+
+    #477: additionally surface explicit, citable adoption-proof fields tied to
+    the ``assess_own_branch_adoption`` outcome (``adoption_decision``,
+    ``adopted``, ``adopted_branch``, ``adopted_branch_head``,
+    ``matcher_summary``, ``competing_branch_check``, ``safe_next_action``) so a
+    recovery session can quote the live lock response directly. The explicit
+    fields are populated for any outcome; ``adopted_branch`` /
+    ``adopted_branch_head`` are set only when the outcome is ADOPT so a
+    non-adoption proof can never be misread as claiming adoption.
+    """
+    outcome = assessment.get("outcome")
+    adopted = outcome == ADOPT
+    return {
+        "issue_number": issue_number,
+        "branch_name": branch_name,
+        "branch_head_commit": assessment.get("matched_head_sha"),
+        "adoption_reason": assessment.get("reason"),
+        "no_existing_pr_proof": bool(open_pr_checked),
+        "no_competing_live_lock_proof": bool(competing_lock_checked),
+        "lock_file_path": lock_file_path,
+        "lock_file_status": lock_file_status,
+        # Explicit citable fields (#477).
+        "adoption_decision": decision_label(outcome),
+        "adopted": adopted,
+        "adopted_branch": branch_name if adopted else None,
+        "adopted_branch_head": assessment.get("matched_head_sha") if adopted else None,
+        "matcher_summary": _matcher_summary(issue_number, assessment),
+        "competing_branch_check": _competing_branch_check(assessment),
+        "safe_next_action": safe_next_action(outcome),
+    }
+
+
+def build_non_adoption_lock_proof(*, issue_number: int, branch_name: str) -> dict:
+    """Safe, adoption-free proof metadata for a normal (NO_MATCH) lock.
+
+    Requirement #477 AC2: non-adoption lock responses must stay clear and must
+    not imply adoption. This returns explicit ``adopted: False`` metadata with
+    the ``NO_MATCH`` decision so a normal lock response can carry citable proof
+    without ever asserting a branch was adopted.
+    """
+    return {
+        "issue_number": issue_number,
+        "branch_name": branch_name,
+        "adoption_decision": DECISION_LABELS[NO_MATCH],
+        "adopted": False,
+        "adopted_branch": None,
+        "adopted_branch_head": None,
+        "matcher_summary": (
+            f"no existing branch carries the issue-{int(issue_number)} marker; "
+            f"normal lock path (no adoption)"
+        ),
+        "competing_branch_check": {"result": "clear", "competing_branches": []},
+        "safe_next_action": safe_next_action(NO_MATCH),
+    }

issue_lock_provenance.py

@@ -0,0 +1,269 @@
+"""Issue-lock provenance and external-state disclosure (#447).
+
+Sanctioned locks are written only by ``gitea_lock_issue`` (or adoption recovery
+#442). Manual seeding of ``/tmp/gitea_issue_lock.json`` is unsafe and must be
+blocked at PR creation unless explicit operator override proof is recorded.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from datetime import datetime, timezone
+
+ISSUE_LOCK_FILE = os.environ.get("GITEA_ISSUE_LOCK_FILE", "/tmp/gitea_issue_lock.json")
+
+SOURCE_LOCK_ISSUE = "gitea_lock_issue"
+SOURCE_LOCK_ADOPTION = "gitea_lock_issue_adoption"
+SOURCE_OPERATOR_OVERRIDE = "operator_override"
+
+SANCTIONED_LOCK_SOURCES = frozenset({
+    SOURCE_LOCK_ISSUE,
+    SOURCE_LOCK_ADOPTION,
+    SOURCE_OPERATOR_OVERRIDE,
+})
+
+_OPERATOR_OVERRIDE_ENV = "GITEA_ISSUE_LOCK_OPERATOR_OVERRIDE"
+
+_ISSUE_LOCK_PATH_RE = re.compile(
+    r"(?:/tmp/)?gitea_issue_lock\.json",
+    re.IGNORECASE,
+)
+_LOCK_SEED_RE = re.compile(
+    r"(?:seed(?:ed|ing)?|restor(?:e|ed|ing)|wrote|written|write|programmatically|"
+    r"hand[- ]forg|manual(?:ly)?).{0,80}gitea_issue_lock",
+    re.IGNORECASE | re.DOTALL,
+)
+_LOCK_REMOVE_RE = re.compile(
+    r"(?:\brm\b|remove|deleted?|unlink).{0,80}gitea_issue_lock",
+    re.IGNORECASE | re.DOTALL,
+)
+_LOCK_READ_RE = re.compile(
+    r"(?:read|loaded?|parsed?).{0,80}gitea_issue_lock",
+    re.IGNORECASE | re.DOTALL,
+)
+_EXTERNAL_NONE_RE = re.compile(
+    r"external[- ]state mutations\s*:\s*none\b",
+    re.IGNORECASE,
+)
+_EXTERNAL_FIELD_RE = re.compile(
+    r"external[- ]state mutations\s*:\s*(.+)$",
+    re.IGNORECASE | re.MULTILINE,
+)
+_CLEANUP_ONLY_RE = re.compile(
+    r"cleanup mutations\s*:\s*(?:none|lock removed|removed issue lock)",
+    re.IGNORECASE,
+)
+_PR_CREATED_RE = re.compile(
+    r"(?:\bgitea_create_pr\b|PR\s*#\s*\d+\s+created|created\s+PR\s*#|opened\s+PR\s*#|"
+    r"PR\s+creation\s+(?:succeeded|complete))",
+    re.IGNORECASE,
+)
+_REVIEW_APPROVE_RE = re.compile(
+    r"(?:submitted\s+(?:['\"]approve['\"]|approve\s+review)|"
+    r"review decision\s*:\s*approve|approved\s+PR\s*#|gitea_review_pr.*approve)",
+    re.IGNORECASE,
+)
+_OVERRIDE_PROOF_RE = re.compile(
+    r"operator[- ]override\s+proof\s*:\s*(.+)$",
+    re.IGNORECASE | re.MULTILINE,
+)
+
+
+def _utc_now_iso() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def build_sanctioned_lock_provenance(
+    *,
+    tool: str,
+    source: str = SOURCE_LOCK_ISSUE,
+    claimant: dict | None = None,
+    adoption: dict | None = None,
+) -> dict:
+    """Return provenance metadata stored with a sanctioned lock write."""
+    entry = {
+        "source": source,
+        "written_at": _utc_now_iso(),
+        "written_by_tool": tool,
+        "lock_file_path": ISSUE_LOCK_FILE,
+    }
+    if claimant:
+        entry["claimant"] = claimant
+    if adoption:
+        entry["adoption"] = adoption
+    return entry
+
+
+def operator_override_requested() -> bool:
+    return os.environ.get(_OPERATOR_OVERRIDE_ENV, "").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+    }
+
+
+def build_operator_override_provenance(*, reason: str, claimant: dict | None = None) -> dict:
+    text = (reason or "").strip()
+    if not text:
+        raise ValueError(
+            "operator override requires a non-empty override reason (fail closed)"
+        )
+    entry = build_sanctioned_lock_provenance(
+        tool="operator_override",
+        source=SOURCE_OPERATOR_OVERRIDE,
+        claimant=claimant,
+    )
+    entry["override_reason"] = text
+    return entry
+
+
+def assess_lock_file_for_create_pr(lock_data: dict | None) -> dict:
+    """Fail closed when lock file lacks sanctioned provenance (#447)."""
+    data = lock_data if isinstance(lock_data, dict) else {}
+    reasons: list[str] = []
+    provenance = data.get("lock_provenance")
+    if not isinstance(provenance, dict):
+        reasons.append(
+            "issue lock file lacks sanctioned lock_provenance; manual seeding is "
+            "not a normal recovery path — call gitea_lock_issue or use #442 adoption"
+        )
+        return _provenance_result(False, reasons, provenance)
+
+    source = str(provenance.get("source") or "").strip()
+    if source not in SANCTIONED_LOCK_SOURCES:
+        reasons.append(
+            f"issue lock provenance source '{source or '(missing)'}' is not sanctioned"
+        )
+
+    if source == SOURCE_OPERATOR_OVERRIDE and not str(
+        provenance.get("override_reason") or ""
+    ).strip():
+        reasons.append(
+            "operator_override lock provenance requires override_reason proof"
+        )
+
+    if not data.get("work_lease"):
+        reasons.append("issue lock file missing work_lease metadata")
+
+    if not str(provenance.get("written_by_tool") or "").strip():
+        reasons.append("issue lock provenance missing written_by_tool")
+
+    proven = not reasons
+    return _provenance_result(proven, reasons, provenance)
+
+
+def _provenance_result(proven: bool, reasons: list[str], provenance: dict | None) -> dict:
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "lock_provenance": provenance,
+    }
+
+
+def format_lock_provenance_error(assessment: dict) -> str:
+    reasons = "; ".join(assessment.get("reasons") or ["unknown lock provenance violation"])
+    return f"Issue lock provenance guard (#447): {reasons} (fail closed)"
+
+
+def _lock_activity_detected(text: str) -> dict[str, bool]:
+    body = text or ""
+    return {
+        "seed_or_restore": bool(_LOCK_SEED_RE.search(body)),
+        "remove": bool(_LOCK_REMOVE_RE.search(body)),
+        "read": bool(_LOCK_READ_RE.search(body)),
+    }
+
+
+def _external_state_discloses_lock(text: str) -> bool:
+    match = _EXTERNAL_FIELD_RE.search(text or "")
+    if not match:
+        return False
+    value = (match.group(1) or "").strip().lower()
+    if value in {"", "none", "n/a"}:
+        return False
+    return "lock" in value or "gitea_issue_lock" in value or "issue-lock" in value
+
+
+def assess_issue_lock_external_state_report(report_text: str) -> dict:
+    """Require explicit external-state disclosure for issue-lock mutations (#447)."""
+    text = report_text or ""
+    activity = _lock_activity_detected(text)
+    if not any(activity.values()):
+        return {"proven": True, "block": False, "reasons": [], "activity": activity}
+
+    reasons: list[str] = []
+    disclosed = _external_state_discloses_lock(text)
+
+    if activity["seed_or_restore"] and _EXTERNAL_NONE_RE.search(text):
+        reasons.append(
+            "report mentions seeding/restoring gitea_issue_lock.json but claims "
+            "External-state mutations: none"
+        )
+    elif activity["seed_or_restore"] and not disclosed:
+        reasons.append(
+            "report mentions issue-lock file activity but External-state mutations "
+            "does not disclose read/write of gitea_issue_lock.json"
+        )
+
+    if activity["remove"]:
+        if _EXTERNAL_NONE_RE.search(text):
+            reasons.append(
+                "report mentions removing gitea_issue_lock.json but claims "
+                "External-state mutations: none"
+            )
+        elif not disclosed and _CLEANUP_ONLY_RE.search(text):
+            reasons.append(
+                "report removes issue lock but classifies it as cleanup only; "
+                "record under External-state mutations"
+            )
+        elif not disclosed:
+            reasons.append(
+                "report mentions deleting issue lock without External-state "
+                "mutation disclosure"
+            )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "activity": activity,
+    }
+
+
+def assess_manual_lock_pr_without_override(report_text: str) -> dict:
+    """Block reports that created a PR via manual lock seed without override proof."""
+    text = report_text or ""
+    seeded = bool(_LOCK_SEED_RE.search(text))
+    created = bool(_PR_CREATED_RE.search(text))
+    if not (seeded and created):
+        return {"proven": True, "block": False, "reasons": []}
+
+    if _OVERRIDE_PROOF_RE.search(text):
+        return {"proven": True, "block": False, "reasons": []}
+
+    return {
+        "proven": False,
+        "block": True,
+        "reasons": [
+            "report created/opened a PR after manual issue-lock seeding without "
+            "operator override proof"
+        ],
+    }
+
+
+def assess_author_reviewer_same_run_report(report_text: str) -> dict:
+    """Reviewer handoff must not create and approve the same PR in one run (#447)."""
+    text = report_text or ""
+    if not (_PR_CREATED_RE.search(text) and _REVIEW_APPROVE_RE.search(text)):
+        return {"proven": True, "block": False, "reasons": []}
+    return {
+        "proven": False,
+        "block": True,
+        "reasons": [
+            "report mixes author-side PR creation and reviewer approval in one "
+            "final handoff; split author and reviewer sessions"
+        ],
+    }

issue_lock_store.py

@@ -0,0 +1,612 @@
+"""Keyed, persistent issue-lock storage (#443) with flock hardening (#438).
+
+Replaces the single global ``/tmp/gitea_issue_lock.json`` slot with per-issue
+lock files under ``GITEA_ISSUE_LOCK_DIR`` (default
+``~/.cache/gitea-tools/issue-locks``). Each MCP session binds its active lock
+via a per-process pointer file so concurrent repos/issues never clobber each
+other. Acquisition is serialized per issue with ``fcntl.flock``.
+"""
+
+from __future__ import annotations
+
+import errno
+import fcntl
+import json
+import os
+import re
+import tempfile
+from contextlib import contextmanager
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+LOCK_DIR_ENV = "GITEA_ISSUE_LOCK_DIR"
+DEFAULT_LOCK_DIR = os.path.expanduser("~/.cache/gitea-tools/issue-locks")
+WORK_LEASE_TTL_HOURS = 4
+AUTHOR_ISSUE_WORK_LEASE = "author_issue_work"
+
+_SAFE_SEGMENT_RE = re.compile(r"[^A-Za-z0-9._+-]+")
+
+
+class LockContentionError(RuntimeError):
+    """Raised when an exclusive per-issue lock cannot be acquired."""
+
+
+def default_lock_dir() -> str:
+    raw = (os.environ.get(LOCK_DIR_ENV) or DEFAULT_LOCK_DIR).strip()
+    return raw or DEFAULT_LOCK_DIR
+
+
+def _sanitize_segment(value: str) -> str:
+    text = (value or "").strip()
+    if not text:
+        return "_"
+    return _SAFE_SEGMENT_RE.sub("_", text)
+
+
+def lock_key(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    issue_number: int,
+) -> str:
+    return "-".join(
+        _sanitize_segment(part)
+        for part in (remote, org, repo, str(issue_number))
+    )
+
+
+def lock_file_path(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    issue_number: int,
+    lock_dir: str | None = None,
+) -> str:
+    root = (lock_dir or default_lock_dir()).strip()
+    return os.path.join(root, f"{lock_key(remote=remote, org=org, repo=repo, issue_number=issue_number)}.json")
+
+
+def session_pointer_path(lock_dir: str | None = None) -> str:
+    root = (lock_dir or default_lock_dir()).strip()
+    return os.path.join(root, f"session-{os.getpid()}.json")
+
+
+def _ensure_lock_dir(lock_dir: str | None = None) -> str:
+    root = (lock_dir or default_lock_dir()).strip()
+    os.makedirs(root, mode=0o700, exist_ok=True)
+    return root
+
+
+def flock_path(json_path: str) -> str:
+    return f"{json_path}.lock"
+
+
+def is_process_alive(pid: int | None) -> bool:
+    if not pid or pid <= 0:
+        return False
+    try:
+        os.kill(int(pid), 0)
+        return True
+    except OSError as exc:
+        return exc.errno != errno.ESRCH
+    except (TypeError, ValueError):
+        return False
+
+
+@contextmanager
+def _exclusive_file_lock(lock_path: str):
+    os.makedirs(os.path.dirname(lock_path) or ".", exist_ok=True)
+    fd = os.open(lock_path, os.O_CREAT | os.O_RDWR, 0o600)
+    try:
+        try:
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError as exc:
+            raise LockContentionError(
+                f"could not acquire exclusive lock on '{lock_path}'"
+            ) from exc
+        yield fd
+    finally:
+        try:
+            fcntl.flock(fd, fcntl.LOCK_UN)
+        finally:
+            os.close(fd)
+
+
+def read_lock_file(path: str) -> dict[str, Any] | None:
+    lock_path = (path or "").strip()
+    if not lock_path or not os.path.exists(lock_path):
+        return None
+    try:
+        with open(lock_path, encoding="utf-8") as handle:
+            data = json.load(handle)
+    except (OSError, json.JSONDecodeError):
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def save_lock_file(path: str, data: dict[str, Any]) -> None:
+    lock_path = (path or "").strip()
+    if not lock_path:
+        raise ValueError("lock path is required (fail closed)")
+    parent = os.path.dirname(lock_path) or "."
+    os.makedirs(parent, mode=0o700, exist_ok=True)
+    payload = json.dumps(data, indent=2, sort_keys=True) + "\n"
+    fd, temp_path = tempfile.mkstemp(prefix=".lock-", suffix=".json", dir=parent)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            handle.write(payload)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(temp_path, lock_path)
+    finally:
+        if os.path.exists(temp_path):
+            try:
+                os.remove(temp_path)
+            except OSError:
+                pass
+
+
+def bind_session_lock(lock_data: dict[str, Any], lock_dir: str | None = None) -> str:
+    """Persist a keyed lock and bind it to the current process session."""
+    remote = str(lock_data.get("remote") or "")
+    org = str(lock_data.get("org") or "")
+    repo = str(lock_data.get("repo") or "")
+    issue_number = int(lock_data.get("issue_number") or 0)
+    if not remote or not org or not repo or issue_number <= 0:
+        raise ValueError("lock record must include remote, org, repo, and issue_number")
+
+    root = _ensure_lock_dir(lock_dir)
+    path = lock_file_path(
+        remote=remote,
+        org=org,
+        repo=repo,
+        issue_number=issue_number,
+        lock_dir=root,
+    )
+    record = dict(lock_data)
+    record["lock_file_path"] = path
+    record["session_pid"] = os.getpid()
+    record.setdefault("pid", os.getpid())
+
+    pointer = {
+        "pid": os.getpid(),
+        "lock_file_path": path,
+        "issue_number": issue_number,
+        "branch_name": record.get("branch_name"),
+        "remote": remote,
+        "org": org,
+        "repo": repo,
+    }
+    sentinel = flock_path(path)
+    try:
+        with _exclusive_file_lock(sentinel):
+            existing = read_lock_file(path)
+            overwrite_block = assess_foreign_lock_overwrite(existing, record)
+            if overwrite_block:
+                raise RuntimeError(overwrite_block)
+            lease_block = assess_same_issue_lease_conflict(
+                existing,
+                issue_number=issue_number,
+                branch_name=str(record.get("branch_name") or ""),
+                worktree_path=str(record.get("worktree_path") or ""),
+            )
+            if lease_block:
+                raise RuntimeError(lease_block)
+            save_lock_file(path, record)
+            save_lock_file(session_pointer_path(root), pointer)
+    except LockContentionError as exc:
+        competing = read_lock_file(path)
+        if competing:
+            owner_pid = competing.get("session_pid") or competing.get("pid")
+            raise RuntimeError(
+                f"Issue #{issue_number} lock contention: {exc}; competing owner "
+                f"pid={owner_pid} (fail closed)"
+            ) from exc
+        raise RuntimeError(f"Issue #{issue_number} lock contention: {exc} (fail closed)") from exc
+    return path
+
+
+def read_session_issue_lock(lock_dir: str | None = None) -> dict[str, Any] | None:
+    root = (lock_dir or default_lock_dir()).strip()
+    pointer = read_lock_file(session_pointer_path(root))
+    if not pointer:
+        return None
+    lock_path = str(pointer.get("lock_file_path") or "").strip()
+    if not lock_path:
+        return None
+    return read_lock_file(lock_path)
+
+
+def load_issue_lock(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    issue_number: int,
+    lock_dir: str | None = None,
+) -> dict[str, Any] | None:
+    return read_lock_file(
+        lock_file_path(
+            remote=remote,
+            org=org,
+            repo=repo,
+            issue_number=issue_number,
+            lock_dir=lock_dir,
+        )
+    )
+
+
+def iter_lock_files(lock_dir: str | None = None) -> list[str]:
+    root = (lock_dir or default_lock_dir()).strip()
+    if not os.path.isdir(root):
+        return []
+    paths: list[str] = []
+    for name in os.listdir(root):
+        if not name.endswith(".json") or name.startswith("session-"):
+            continue
+        paths.append(os.path.join(root, name))
+    return sorted(paths)
+
+
+def find_lock_for_branch(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    branch_name: str,
+    lock_dir: str | None = None,
+) -> dict[str, Any] | None:
+    target = (branch_name or "").strip()
+    if not target:
+        return None
+    for path in iter_lock_files(lock_dir):
+        lock = read_lock_file(path)
+        if not lock:
+            continue
+        if (
+            str(lock.get("remote") or "") == remote
+            and str(lock.get("org") or "") == org
+            and str(lock.get("repo") or "") == repo
+            and str(lock.get("branch_name") or "").strip() == target
+        ):
+            lock = dict(lock)
+            lock.setdefault("lock_file_path", path)
+            return lock
+    return None
+
+
+def _lease_now(now: datetime | None = None) -> datetime:
+    return now or datetime.now(timezone.utc)
+
+
+def _parse_lease_timestamp(value: str | None) -> datetime | None:
+    text = (value or "").strip()
+    if not text:
+        return None
+    try:
+        return datetime.fromisoformat(text.replace("Z", "+00:00")).astimezone(timezone.utc)
+    except ValueError:
+        return None
+
+
+def lease_expires_at(lock: dict[str, Any] | None) -> datetime | None:
+    if not lock:
+        return None
+    lease = lock.get("work_lease")
+    if not isinstance(lease, dict):
+        return None
+    return _parse_lease_timestamp(lease.get("expires_at"))
+
+
+def is_lease_expired(lock: dict[str, Any] | None, *, now: datetime | None = None) -> bool:
+    expires = lease_expires_at(lock)
+    if expires is None:
+        return False
+    return expires <= _lease_now(now)
+
+
+def is_lease_live(lock: dict[str, Any] | None, *, now: datetime | None = None) -> bool:
+    return assess_lock_freshness(lock, now=now)["live"]
+
+
+def assess_lock_freshness(
+    lock_data: dict[str, Any] | None,
+    *,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    """Classify a lock as live, expired, stale, or absent."""
+    current = _lease_now(now)
+    if not lock_data:
+        return {
+            "status": "absent",
+            "live": False,
+            "stale": False,
+            "reason": "no lock record",
+        }
+
+    expires_at = lease_expires_at(lock_data)
+    lease = lock_data.get("work_lease")
+    heartbeat_at = _parse_lease_timestamp(lock_data.get("last_heartbeat_at"))
+    if heartbeat_at is None and isinstance(lease, dict):
+        heartbeat_at = _parse_lease_timestamp(lease.get("last_heartbeat_at"))
+
+    pid = lock_data.get("session_pid")
+    if pid is None:
+        pid = lock_data.get("pid")
+    pid_alive = is_process_alive(pid) if pid is not None else False
+
+    if expires_at and expires_at <= current:
+        return {
+            "status": "expired",
+            "live": False,
+            "stale": True,
+            "reason": f"lease expired at {expires_at.isoformat()}",
+            "pid_alive": pid_alive,
+        }
+
+    if pid is not None and not pid_alive:
+        return {
+            "status": "stale",
+            "live": False,
+            "stale": True,
+            "reason": f"owner pid {pid} is not alive",
+            "pid_alive": False,
+        }
+
+    return {
+        "status": "live",
+        "live": True,
+        "stale": False,
+        "reason": "lock heartbeat and lease are fresh",
+        "pid_alive": pid_alive,
+        "heartbeat_at": heartbeat_at.isoformat() if heartbeat_at else None,
+        "expires_at": expires_at.isoformat() if expires_at else None,
+    }
+
+
+def _same_realpath(left: str | None, right: str | None) -> bool:
+    if not left or not right:
+        return False
+    try:
+        return os.path.realpath(left) == os.path.realpath(right)
+    except OSError:
+        return left == right
+
+
+def assess_same_issue_lease_conflict(
+    existing_lock: dict[str, Any] | None,
+    *,
+    issue_number: int,
+    branch_name: str,
+    worktree_path: str,
+    operation_type: str = AUTHOR_ISSUE_WORK_LEASE,
+    now: datetime | None = None,
+) -> str | None:
+    """Return a fail-closed error when a competing live lease blocks acquisition."""
+    if not existing_lock:
+        return None
+
+    existing_issue = existing_lock.get("issue_number")
+    lease = existing_lock.get("work_lease")
+    existing_operation = (
+        lease.get("operation_type")
+        if isinstance(lease, dict)
+        else AUTHOR_ISSUE_WORK_LEASE
+    )
+    if existing_issue != issue_number or existing_operation != operation_type:
+        return None
+
+    existing_branch = existing_lock.get("branch_name")
+    existing_worktree = existing_lock.get("worktree_path")
+    same_owner = (
+        existing_branch == branch_name
+        and _same_realpath(str(existing_worktree or ""), worktree_path)
+    )
+    if is_lease_expired(existing_lock, now=now):
+        return (
+            f"Issue #{issue_number} has an expired {operation_type} lease on "
+            f"branch '{existing_branch}' from worktree '{existing_worktree}'. "
+            "Recovery review is required before takeover (fail closed)"
+        )
+    if same_owner:
+        return None
+    return (
+        f"Issue #{issue_number} already has an active {operation_type} lease on "
+        f"branch '{existing_branch}' from worktree '{existing_worktree}' "
+        "(fail closed)"
+    )
+
+
+def assess_foreign_lock_overwrite(
+    existing_lock: dict[str, Any] | None,
+    incoming_lock: dict[str, Any],
+    *,
+    now: datetime | None = None,
+) -> str | None:
+    """Block writes that would clobber an unrelated live lease on the same key."""
+    if not existing_lock:
+        return None
+
+    same_issue = existing_lock.get("issue_number") == incoming_lock.get("issue_number")
+    same_branch = existing_lock.get("branch_name") == incoming_lock.get("branch_name")
+    same_worktree = _same_realpath(
+        str(existing_lock.get("worktree_path") or ""),
+        str(incoming_lock.get("worktree_path") or ""),
+    )
+    if same_issue and same_branch and same_worktree:
+        return None
+    if not is_lease_live(existing_lock, now=now):
+        return None
+    return (
+        "Refusing to overwrite a live foreign issue lock "
+        f"(issue #{existing_lock.get('issue_number')}, "
+        f"branch '{existing_lock.get('branch_name')}', "
+        f"worktree '{existing_lock.get('worktree_path')}') (fail closed)"
+    )
+
+
+def find_live_lock_for_branch(
+    branch_name: str,
+    lock_dir: str | None = None,
+) -> dict[str, Any] | None:
+    target = (branch_name or "").strip()
+    if not target:
+        return None
+    for path in iter_lock_files(lock_dir):
+        lock = read_lock_file(path)
+        if not lock:
+            continue
+        if str(lock.get("branch_name") or "").strip() != target:
+            continue
+        if not is_lease_live(lock):
+            continue
+        record = dict(lock)
+        record.setdefault("lock_file_path", path)
+        return record
+    return None
+
+
+def resolve_locked_branch_for_session(
+    branch_name: str | None = None,
+    lock_dir: str | None = None,
+) -> str:
+    if branch_name:
+        lock = find_live_lock_for_branch(branch_name, lock_dir)
+        if lock:
+            return str(lock.get("branch_name") or "")
+    lock = read_session_issue_lock(lock_dir)
+    return str((lock or {}).get("branch_name") or "")
+
+
+def has_active_issue_lock(
+    branch: str,
+    *,
+    lock_dir: str | None = None,
+) -> bool:
+    target = (branch or "").strip()
+    if not target:
+        return False
+    for path in iter_lock_files(lock_dir):
+        lock = read_lock_file(path)
+        if not lock:
+            continue
+        if str(lock.get("branch_name") or "").strip() != target:
+            continue
+        if is_lease_live(lock):
+            return True
+    return False
+
+
+def verify_lock_for_mutation(
+    lock_data: dict[str, Any] | None,
+    *,
+    issue_number: int | None = None,
+    branch_name: str | None = None,
+    worktree_path: str | None = None,
+) -> dict[str, Any]:
+    """Re-check lock ownership immediately before a mutation (#438)."""
+    reasons: list[str] = []
+    if not lock_data:
+        return {"proven": False, "block": True, "reasons": ["issue lock is missing (fail closed)"]}
+
+    freshness = assess_lock_freshness(lock_data)
+    if not freshness["live"]:
+        reasons.append(f"issue lock is not live: {freshness['reason']} (fail closed)")
+
+    if issue_number is not None and lock_data.get("issue_number") != issue_number:
+        reasons.append(
+            f"issue lock targets #{lock_data.get('issue_number')}, expected #{issue_number} (fail closed)"
+        )
+
+    if branch_name is not None and lock_data.get("branch_name") != branch_name:
+        reasons.append(
+            f"issue lock branch '{lock_data.get('branch_name')}' does not match "
+            f"'{branch_name}' (fail closed)"
+        )
+
+    if worktree_path is not None:
+        locked = os.path.realpath(str(lock_data.get("worktree_path") or ""))
+        declared = os.path.realpath(worktree_path)
+        if locked != declared:
+            reasons.append(
+                f"issue lock worktree '{locked}' does not match declared '{declared}' (fail closed)"
+            )
+
+    return {
+        "proven": not reasons,
+        "block": bool(reasons),
+        "reasons": reasons,
+        "freshness": freshness,
+        "lock_proof": format_lock_proof(lock_data, freshness=freshness),
+    }
+
+
+def list_live_locks(
+    *,
+    lock_dir: str | None = None,
+    now: datetime | None = None,
+) -> list[dict[str, Any]]:
+    """Return live per-issue locks for queue visibility."""
+    live: list[dict[str, Any]] = []
+    for path in iter_lock_files(lock_dir):
+        record = read_lock_file(path)
+        if not record:
+            continue
+        freshness = assess_lock_freshness(record, now=now)
+        if not freshness["live"]:
+            continue
+        live.append(
+            {
+                "issue_number": record.get("issue_number"),
+                "branch_name": record.get("branch_name"),
+                "remote": record.get("remote"),
+                "org": record.get("org"),
+                "repo": record.get("repo"),
+                "worktree_path": record.get("worktree_path"),
+                "pid": record.get("session_pid") or record.get("pid"),
+                "claimant": (
+                    record.get("claimant")
+                    or (record.get("work_lease") or {}).get("claimant")
+                ),
+                "freshness": freshness,
+                "lock_path": record.get("lock_file_path") or path,
+            }
+        )
+    return live
+
+
+def format_lock_proof(
+    lock_data: dict[str, Any] | None,
+    *,
+    freshness: dict[str, Any] | None = None,
+    competing_live_locks: list[dict[str, Any]] | None = None,
+    released: bool | None = None,
+) -> str:
+    """Canonical issue-lock proof string for final reports."""
+    if not lock_data:
+        return "issue lock proof: not acquired"
+    fresh = freshness or assess_lock_freshness(lock_data)
+    owner = lock_data.get("claimant") or {}
+    if not owner and isinstance(lock_data.get("work_lease"), dict):
+        owner = lock_data["work_lease"].get("claimant") or {}
+    parts = [
+        "issue lock proof:",
+        f"acquired issue #{lock_data.get('issue_number')}",
+        f"branch {lock_data.get('branch_name')}",
+        f"owner {owner.get('profile') or 'unknown'}",
+        f"pid {lock_data.get('session_pid') or lock_data.get('pid')}",
+        f"freshness {fresh.get('status')}",
+    ]
+    if competing_live_locks is not None:
+        parts.append(
+            "no competing live lock"
+            if not competing_live_locks
+            else f"competing live locks {len(competing_live_locks)}"
+        )
+    if released is True:
+        parts.append("lock released")
+    elif released is False:
+        parts.append("lock retained")
+    return "; ".join(parts)

issue_lock_worktree.py

@@ -0,0 +1,244 @@
+"""Issue-lock worktree validation (#249).
+
+Author issue locks must validate the caller's own scratch clone (or declared
+worktree path), not the shared MCP server working directory. A clean scratch at
+``master``/``main`` must remain lockable while an unrelated session leaves the
+shared dev worktree dirty or on a feature branch.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+
+from reviewer_worktree import parse_dirty_tracked_files
+
+AUTHOR_WORKTREE_ENV = "GITEA_AUTHOR_WORKTREE"
+BASE_BRANCHES = frozenset({"master", "main", "dev"})
+
+
+def resolve_author_worktree_path(
+    explicit: str | None,
+    project_root: str,
+) -> str:
+    """Resolve the author worktree path for lock/PR gates."""
+    path = (explicit or "").strip()
+    if not path:
+        path = (os.environ.get(AUTHOR_WORKTREE_ENV) or "").strip()
+    if not path:
+        path = project_root
+    return os.path.realpath(os.path.abspath(path))
+
+
+def read_worktree_git_state(
+    worktree_path: str,
+    extra_bases: tuple[str, ...] | list[str] = (),
+) -> dict:
+    """Read branch name and porcelain status from a git worktree.
+
+    ``extra_bases`` names additional branches (e.g. an approved stacked base)
+    that may anchor base-equivalence in addition to master/main/dev. When empty
+    (the default), only the normal base branches are considered.
+    """
+    path = (worktree_path or "").strip()
+    if not path:
+        return {"current_branch": None, "porcelain_status": ""}
+
+    branch_res = subprocess.run(
+        ["git", "-C", path, "branch", "--show-current"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    current_branch = (branch_res.stdout or "").strip() or None
+
+    status_res = subprocess.run(
+        ["git", "-C", path, "status", "--porcelain"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    root_res = subprocess.run(
+        ["git", "-C", path, "rev-parse", "--show-toplevel"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    head_res = subprocess.run(
+        ["git", "-C", path, "rev-parse", "HEAD"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    head_sha = (head_res.stdout or "").strip() if head_res.returncode == 0 else None
+    base_branch, base_sha = _find_matching_base_ref(path, head_sha, extra_bases)
+    return {
+        "current_branch": current_branch,
+        "porcelain_status": status_res.stdout or "",
+        "inspected_git_root": (root_res.stdout or "").strip() if root_res.returncode == 0 else None,
+        "head_sha": head_sha,
+        "base_branch": base_branch,
+        "base_sha": base_sha,
+        "base_equivalent": bool(head_sha and base_sha and head_sha == base_sha),
+    }
+
+
+def assess_issue_lock_worktree(
+    *,
+    worktree_path: str,
+    current_branch: str | None,
+    porcelain_status: str,
+    base_equivalent: bool | None = None,
+    inspected_git_root: str | None = None,
+    base_branch: str | None = None,
+    base_branches: frozenset[str] | None = None,
+) -> dict:
+    """Fail closed when lock preconditions are not met on the declared worktree."""
+    bases = base_branches or BASE_BRANCHES
+    reasons: list[str] = []
+    path = (worktree_path or "").strip()
+    if not path:
+        reasons.append("worktree path not declared for issue lock; fail closed")
+        return _assessment(False, reasons, path, None, [])
+
+    branch = (current_branch or "").strip()
+    dirty_files = parse_dirty_tracked_files(porcelain_status)
+
+    if dirty_files:
+        reasons.append(
+            "tracked file edits exist before issue lock; "
+            f"lock must precede implementation work in '{path}' "
+            f"(dirty files: {', '.join(dirty_files)})"
+        )
+
+    if base_equivalent is False:
+        reasons.append(
+            "issue lock worktree must be base-equivalent to one of "
+            f"{_base_list(bases)} before implementation work; inspected "
+            f"branch '{branch or '(detached)'}' at '{path}'"
+        )
+    elif base_equivalent is None:
+        if not branch:
+            reasons.append(
+                "current branch unknown (detached HEAD?); issue lock base-equivalence "
+                f"to {_base_list(bases)} could not be proven"
+            )
+        elif branch not in bases:
+            reasons.append(
+                "issue lock worktree base-equivalence could not be proven; "
+                f"branch '{branch}' is not {_base_list(bases)}"
+            )
+
+    proven = not reasons
+    return _assessment(
+        proven,
+        reasons,
+        path,
+        branch or None,
+        dirty_files,
+        inspected_git_root=inspected_git_root,
+        base_branch=base_branch,
+        base_equivalent=base_equivalent,
+    )
+
+
+def format_issue_lock_worktree_error(assessment: dict) -> str:
+    """Format a single fail-closed error for ``gitea_lock_issue``."""
+    reasons = list(assessment.get("reasons") or [])
+    if not reasons:
+        reasons = ["issue lock worktree validation failed"]
+    return "; ".join(reasons) + " (fail closed)"
+
+
+def verify_pr_worktree_matches_lock(
+    locked_worktree_path: str | None,
+    declared_worktree_path: str | None,
+    project_root: str,
+) -> dict:
+    """PR creation must use the same worktree the lock was validated against."""
+    locked = (locked_worktree_path or "").strip()
+    if not locked:
+        return {"proven": True, "block": False, "reasons": []}
+
+    declared = resolve_author_worktree_path(declared_worktree_path, project_root)
+    locked_real = os.path.realpath(locked)
+    declared_real = os.path.realpath(declared)
+    if locked_real != declared_real:
+        return {
+            "proven": False,
+            "block": True,
+            "reasons": [
+                f"PR worktree '{declared_real}' does not match locked worktree "
+                f"'{locked_real}' (fail closed)"
+            ],
+            "locked_worktree_path": locked_real,
+            "declared_worktree_path": declared_real,
+        }
+    return {
+        "proven": True,
+        "block": False,
+        "reasons": [],
+        "locked_worktree_path": locked_real,
+        "declared_worktree_path": declared_real,
+    }
+
+
+def _base_list(bases: frozenset[str]) -> str:
+    return "/".join(sorted(bases))
+
+
+def _assessment(
+    proven: bool,
+    reasons: list[str],
+    worktree_path: str,
+    current_branch: str | None,
+    dirty_files: list[str],
+    *,
+    inspected_git_root: str | None = None,
+    base_branch: str | None = None,
+    base_equivalent: bool | None = None,
+) -> dict:
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "worktree_path": worktree_path or None,
+        "inspected_git_root": inspected_git_root,
+        "current_branch": current_branch,
+        "dirty_files": dirty_files,
+        "base_branch": base_branch,
+        "base_equivalent": base_equivalent,
+    }
+
+
+def _find_matching_base_ref(
+    path: str,
+    head_sha: str | None,
+    extra_bases: tuple[str, ...] | list[str] = (),
+) -> tuple[str | None, str | None]:
+    """Return the stable branch ref whose commit matches HEAD, if any.
+
+    Normal base branches (master/main/dev) are always considered. ``extra_bases``
+    adds explicitly-approved stacked bases; each is checked as a local ref and via
+    the ``prgs``/``origin`` remotes.
+    """
+    if not head_sha:
+        return None, None
+    candidates: list[str] = []
+    for branch in sorted(BASE_BRANCHES):
+        candidates.extend((f"origin/{branch}", branch))
+    for branch in extra_bases:
+        name = (branch or "").strip()
+        if name:
+            candidates.extend((f"prgs/{name}", f"origin/{name}", name))
+    for ref in candidates:
+        res = subprocess.run(
+            ["git", "-C", path, "rev-parse", "--verify", ref],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        sha = (res.stdout or "").strip()
+        if res.returncode == 0 and sha == head_sha:
+            return ref, sha
+    return None, None

issue_work_duplicate_gate.py

@@ -0,0 +1,180 @@
+"""Early duplicate-work detection for author work-issue sessions (#400)."""
+
+from __future__ import annotations
+
+from typing import Any
+
+import issue_claim_heartbeat as claim_hb
+
+PHASE_LOCK = "lock_issue"
+PHASE_COMMIT = "commit"
+PHASE_PUSH = "push"
+PHASE_CREATE_PR = "create_pr"
+
+OUTCOME_DUPLICATE_PR_PREVENTED = "duplicate_pr_prevented"
+OUTCOME_DUPLICATE_BRANCH_PREVENTED = "duplicate_branch_prevented"
+OUTCOME_DUPLICATE_COMMIT_PREVENTED = "duplicate_commit_prevented"
+OUTCOME_DUPLICATE_WORK_NOT_PREVENTED = "duplicate_work_not_prevented"
+
+_ACTIVE_CLAIM_STATUSES = frozenset({"active", "awaiting_review"})
+
+
+def _issue_pattern(issue_number: int) -> str:
+    return f"issue-{int(issue_number)}"
+
+
+def _linked_open_pr(issue_number: int, open_prs: list[dict]) -> dict | None:
+    return claim_hb._linked_open_pr(issue_number, open_prs)
+
+
+def _matching_branches(
+    issue_number: int,
+    branch_names: list[str],
+    *,
+    locked_branch: str | None = None,
+) -> list[str]:
+    pattern = _issue_pattern(issue_number)
+    matches = [
+        name for name in (branch_names or [])
+        if pattern in (name or "").lower()
+    ]
+    if locked_branch:
+        locked = locked_branch.strip()
+        matches = [name for name in matches if name != locked]
+    return matches
+
+
+def assess_work_issue_duplicate_gate(
+    issue_number: int,
+    *,
+    open_prs: list[dict] | None = None,
+    branch_names: list[str] | None = None,
+    claim_entry: dict | None = None,
+    locked_branch: str | None = None,
+    phase: str = PHASE_LOCK,
+) -> dict[str, Any]:
+    """Fail closed when duplicate work is already in flight for an issue."""
+    reasons: list[str] = []
+    outcome = OUTCOME_DUPLICATE_WORK_NOT_PREVENTED
+    prs = list(open_prs or [])
+    branches = list(branch_names or [])
+    pattern = _issue_pattern(issue_number)
+
+    linked = _linked_open_pr(issue_number, prs)
+    if linked:
+        reasons.append(
+            f"open PR #{linked.get('number')} already covers issue "
+            f"#{issue_number} (fail closed)"
+        )
+        outcome = OUTCOME_DUPLICATE_PR_PREVENTED
+
+    conflicting_branches = _matching_branches(
+        issue_number, branches, locked_branch=locked_branch
+    )
+    if conflicting_branches:
+        names = ", ".join(conflicting_branches[:5])
+        reasons.append(
+            f"remote branch(es) already match issue pattern '{pattern}': "
+            f"{names} (fail closed)"
+        )
+        if outcome == OUTCOME_DUPLICATE_WORK_NOT_PREVENTED:
+            outcome = OUTCOME_DUPLICATE_BRANCH_PREVENTED
+
+    entry = claim_entry or {}
+    if entry.get("linked_open_pr") and not linked:
+        reasons.append(
+            f"claim inventory reports open PR #{entry['linked_open_pr']} "
+            f"for issue #{issue_number} (fail closed)"
+        )
+        outcome = OUTCOME_DUPLICATE_PR_PREVENTED
+
+    status = (entry.get("status") or "").strip().lower()
+    if status in _ACTIVE_CLAIM_STATUSES and not linked:
+        heartbeat = entry.get("latest_heartbeat") or {}
+        claim_branch = (heartbeat.get("branch") or "").strip()
+        if locked_branch and claim_branch and claim_branch != locked_branch:
+            reasons.append(
+                f"active claim lease on branch '{claim_branch}' blocks "
+                f"work on '{locked_branch}' for issue #{issue_number} "
+                "(fail closed)"
+            )
+            if outcome == OUTCOME_DUPLICATE_WORK_NOT_PREVENTED:
+                outcome = OUTCOME_DUPLICATE_BRANCH_PREVENTED
+        elif not locked_branch and status == "active":
+            reasons.append(
+                f"issue #{issue_number} has an active claim lease "
+                "(fail closed)"
+            )
+            if outcome == OUTCOME_DUPLICATE_WORK_NOT_PREVENTED:
+                outcome = OUTCOME_DUPLICATE_BRANCH_PREVENTED
+
+    if phase in {PHASE_COMMIT, PHASE_PUSH} and reasons:
+        if outcome == OUTCOME_DUPLICATE_PR_PREVENTED:
+            outcome = OUTCOME_DUPLICATE_COMMIT_PREVENTED
+        elif outcome == OUTCOME_DUPLICATE_BRANCH_PREVENTED:
+            outcome = OUTCOME_DUPLICATE_COMMIT_PREVENTED
+
+    block = bool(reasons)
+    return {
+        "block": block,
+        "performed": not block,
+        "issue_number": issue_number,
+        "phase": phase,
+        "outcome": outcome,
+        "linked_open_pr": linked.get("number") if linked else entry.get("linked_open_pr"),
+        "conflicting_branches": conflicting_branches,
+        "claim_status": status or None,
+        "reasons": reasons,
+        "safe_next_action": (
+            "stop before mutating; preserve local work and produce a "
+            "reconciliation handoff if a concurrent PR appeared after push"
+            if block and phase == PHASE_CREATE_PR
+            else "stop before mutating; do not commit or push duplicate work"
+            if block
+            else "proceed"
+        ),
+    }
+
+
+def assess_work_issue_duplicate_report(report_text: str) -> dict[str, Any]:
+    """Require explicit duplicate-work outcome wording in work-issue reports."""
+    text = (report_text or "").lower()
+    markers = {
+        OUTCOME_DUPLICATE_PR_PREVENTED: (
+            "duplicate pr prevented",
+            "duplicate_pr_prevented",
+        ),
+        OUTCOME_DUPLICATE_BRANCH_PREVENTED: (
+            "duplicate branch prevented",
+            "duplicate_branch_prevented",
+        ),
+        OUTCOME_DUPLICATE_COMMIT_PREVENTED: (
+            "duplicate commit prevented",
+            "duplicate_commit_prevented",
+        ),
+        OUTCOME_DUPLICATE_WORK_NOT_PREVENTED: (
+            "duplicate work not prevented",
+            "duplicate_work_not_prevented",
+            "no duplicate work",
+        ),
+    }
+    matched = [
+        key for key, phrases in markers.items()
+        if any(phrase in text for phrase in phrases)
+    ]
+    if len(matched) != 1:
+        return {
+            "complete": False,
+            "downgraded": True,
+            "reasons": [
+                "work-issue report must state exactly one duplicate-work "
+                "outcome (duplicate PR/branch/commit prevented, or "
+                "duplicate work not prevented)"
+            ],
+        }
+    return {
+        "complete": True,
+        "downgraded": False,
+        "outcome": matched[0],
+        "reasons": [],
+    }

mcp_discoverability.py

@@ -0,0 +1,259 @@
+#!/usr/bin/env python3
+"""MCP Discoverability Validation Tool for external servers (Issue #155)."""
+import os
+import sys
+import json
+import argparse
+import subprocess
+
+EXPECTED_JENKINS_TOOLS = {
+    "jenkins_whoami",
+    "jenkins_list_jobs",
+    "jenkins_latest_build",
+    "jenkins_build_status",
+    "jenkins_get_build",
+}
+
+EXPECTED_GLITCHTIP_TOOLS = {
+    "glitchtip_whoami",
+    "glitchtip_list_projects",
+    "glitchtip_list_unresolved",
+    "glitchtip_get_issue",
+    "glitchtip_recent_events",
+    "glitchtip_search",
+}
+
+RELOAD_INSTRUCTIONS = """
+=== MCP CLIENT RELOAD/RECONNECT RUNBOOK ===
+After registering or changing external MCP servers, reload your client to discover the new tools:
+- Codex: Click 'Reload Developer Tools' or restart the editor.
+- Gemini / Grok / ChatGPT Desktop: Restart the client or run the reload slash command if available.
+- Claude Desktop: Use 'Developer -> Reload' or restart the app.
+- General MCP Clients: Restart the process or reload the server config.
+===========================================
+"""
+
+def parse_gitea_mcp_config(path):
+    if not path or not os.path.exists(path):
+        return {}
+    with open(path, "r", encoding="utf-8") as fh:
+        try:
+            return json.load(fh)
+        except Exception:
+            return {}
+
+def read_json_rpc_response(proc, req_id):
+    import time
+    start_time = time.time()
+    while time.time() - start_time < 5.0:
+        line = proc.stdout.readline()
+        if not line:
+            break
+        try:
+            data = json.loads(line)
+            if data.get("id") == req_id:
+                return data
+        except json.JSONDecodeError:
+            continue
+    return None
+
+def query_live_tools(command, args, env):
+    run_env = os.environ.copy()
+    if env:
+        run_env.update(env)
+
+    proc = subprocess.Popen(
+        [command] + args,
+        stdin=subprocess.PIPE,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        env=run_env,
+        text=True,
+        bufsize=1
+    )
+
+    tools = []
+    try:
+        # 1. Send initialize
+        init_req = {
+            "jsonrpc": "2.0",
+            "id": 1,
+            "method": "initialize",
+            "params": {
+                "protocolVersion": "2024-11-05",
+                "capabilities": {},
+                "clientInfo": {"name": "mcp-discoverability-check", "version": "1.0.0"}
+            }
+        }
+        proc.stdin.write(json.dumps(init_req) + "\n")
+        proc.stdin.flush()
+
+        # Read init response
+        init_resp = read_json_rpc_response(proc, 1)
+        if init_resp:
+            # Send initialized notification
+            init_notif = {
+                "jsonrpc": "2.0",
+                "method": "notifications/initialized"
+            }
+            proc.stdin.write(json.dumps(init_notif) + "\n")
+            proc.stdin.flush()
+
+            # 2. Send tools/list
+            tools_req = {
+                "jsonrpc": "2.0",
+                "id": 2,
+                "method": "tools/list",
+                "params": {}
+            }
+            proc.stdin.write(json.dumps(tools_req) + "\n")
+            proc.stdin.flush()
+
+            tools_resp = read_json_rpc_response(proc, 2)
+            if tools_resp and "result" in tools_resp and "tools" in tools_resp["result"]:
+                for t in tools_resp["result"]["tools"]:
+                    tools.append(t["name"])
+    except Exception as e:
+        print(f"Error querying live tools: {e}", file=sys.stderr)
+    finally:
+        proc.terminate()
+        try:
+            proc.wait(timeout=2)
+        except Exception:
+            proc.kill()
+
+    return set(tools)
+
+def validate_mcp_client_config(client_config_path, gitea_config_path=None, live=False):
+    if not client_config_path or not os.path.exists(client_config_path):
+        print(f"SKIPPED: MCP client config not found at '{client_config_path}'", file=sys.stderr)
+        return True
+
+    with open(client_config_path, "r", encoding="utf-8") as fh:
+        try:
+            config_data = json.load(fh)
+        except Exception as e:
+            print(f"Error parsing client config: {e}", file=sys.stderr)
+            return False
+
+    mcp_servers = config_data.get("mcpServers", {})
+
+    # Check for stale server names
+    stale_names = {"jenkins-readonly", "glitchtip-readonly"}
+    for name in mcp_servers:
+        if name in stale_names:
+            print(f"ERROR: Stale server name '{name}' configured. Use canonical names 'jenkins-mcp' or 'glitchtip-mcp'.", file=sys.stderr)
+            return False
+
+    gitea_data = parse_gitea_mcp_config(gitea_config_path)
+    enabled_services = set()
+    contexts = gitea_data.get("contexts", {})
+
+    profile_name = os.environ.get("GITEA_MCP_PROFILE")
+    if profile_name and "profiles" in gitea_data:
+        profile = gitea_data["profiles"].get(profile_name)
+        if profile and "context" in profile:
+            ctx_name = profile["context"]
+            ctx = contexts.get(ctx_name, {})
+            if ctx.get("enabled"):
+                services = ctx.get("services", {})
+                for s_name, s_data in services.items():
+                    if s_data.get("enabled"):
+                        enabled_services.add(s_name)
+    else:
+        for ctx_name, ctx in contexts.items():
+            if ctx.get("enabled"):
+                services = ctx.get("services", {})
+                for s_name, s_data in services.items():
+                    if s_data.get("enabled"):
+                        enabled_services.add(s_name)
+
+    if not enabled_services:
+        print("No external services enabled in Gitea contexts. Discoverability check complete.", file=sys.stderr)
+        return True
+
+    success = True
+    for service in enabled_services:
+        canonical_name = f"{service}-mcp"
+        if canonical_name not in mcp_servers:
+            stale_match = f"{service}-readonly"
+            if stale_match in mcp_servers:
+                print(f"ERROR: Server '{canonical_name}' references stale name '{stale_match}' (fail closed).", file=sys.stderr)
+                success = False
+                continue
+            print(f"ERROR: Enabled service '{service}' is not registered under canonical name '{canonical_name}' in client config.", file=sys.stderr)
+            success = False
+            continue
+
+        server_conf = mcp_servers[canonical_name]
+        command = server_conf.get("command")
+        args = server_conf.get("args") or []
+        env = server_conf.get("env") or {}
+
+        if not command:
+            print(f"ERROR: Server '{canonical_name}' has no command configured.", file=sys.stderr)
+            success = False
+            continue
+
+        expected_module = f"{service}_mcp"
+        if "-m" not in args or expected_module not in args:
+            print(f"ERROR: Server '{canonical_name}' args do not point to expected module '{expected_module}' (args: {args}).", file=sys.stderr)
+            success = False
+            continue
+
+        profile_var = f"{service.upper()}_MCP_PROFILE"
+        config_var = f"{service.upper()}_MCP_CONFIG"
+        if profile_var not in env or config_var not in env:
+            print(f"ERROR: Server '{canonical_name}' env is missing required variables '{profile_var}' or '{config_var}'.", file=sys.stderr)
+            success = False
+            continue
+
+        if live:
+            tools = query_live_tools(command, args, env)
+            if not tools:
+                print("SKIPPED: server enabled but no usable tools visible", file=sys.stdout)
+                success = False
+                continue
+
+            expected = EXPECTED_JENKINS_TOOLS if service == "jenkins" else EXPECTED_GLITCHTIP_TOOLS
+            missing = expected - tools
+            if missing:
+                print(f"ERROR: Server '{canonical_name}' is missing expected tools: {', '.join(missing)}", file=sys.stderr)
+                success = False
+            else:
+                print(f"SUCCESS: Server '{canonical_name}' discoverability verified.", file=sys.stderr)
+        else:
+            print(f"SUCCESS: Server '{canonical_name}' static registration verified.", file=sys.stderr)
+
+    return success
+
+def main():
+    parser = argparse.ArgumentParser(description="MCP client registration discoverability checks.")
+    parser.add_argument("--client-config", help="Path to MCP client config JSON file.")
+    parser.add_argument("--gitea-config", help="Path to Gitea MCP config JSON file.")
+    parser.add_argument("--live", action="store_true", help="Perform live stdio checks on configured servers.")
+    parser.add_argument("--runbook", action="store_true", help="Print reload/reconnect guide runbook instructions.")
+
+    args = parser.parse_args()
+
+    if args.runbook:
+        print(RELOAD_INSTRUCTIONS)
+        return 0
+
+    if not args.client_config:
+        print("ERROR: --client-config must be specified.", file=sys.stderr)
+        return 2
+
+    ok = validate_mcp_client_config(
+        client_config_path=args.client_config,
+        gitea_config_path=args.gitea_config,
+        live=args.live
+    )
+
+    if not ok:
+        print(RELOAD_INSTRUCTIONS, file=sys.stderr)
+        return 1
+    return 0
+
+if __name__ == "__main__":
+    sys.exit(main())

merge_approval_gate.py

@@ -0,0 +1,61 @@
+"""Merge approval must pin the current PR head SHA (#471).
+
+Formal APPROVED reviews that predate the live PR head must not satisfy
+``gitea_merge_pr`` eligibility. Pure assessment helpers are isolated here
+for hermetic unit tests apart from MCP HTTP calls.
+"""
+
+from __future__ import annotations
+
+
+def assess_merge_approval_head(
+    *,
+    current_head_sha: str | None,
+    latest_by_reviewer: dict,
+) -> dict:
+    """Return whether a visible approval applies to the live PR head.
+
+    Args:
+        current_head_sha: Current PR head commit SHA.
+        latest_by_reviewer: Map of reviewer login → review entry dicts with
+            ``verdict``, ``dismissed``, and ``reviewed_head_sha`` keys.
+
+    Returns:
+        dict with ``approval_at_current_head``, ``latest_approved_head_sha``,
+        and ``stale_approval_block_reason`` (set when merge must fail closed).
+    """
+    current = (current_head_sha or "").strip()
+    approved_entries = [
+        entry
+        for entry in (latest_by_reviewer or {}).values()
+        if (entry.get("verdict") or "").upper() == "APPROVED"
+        and not entry.get("dismissed")
+    ]
+    at_current = any(
+        (entry.get("reviewed_head_sha") or "").strip() == current
+        for entry in approved_entries
+        if current
+    )
+    latest_approved = None
+    if approved_entries:
+        latest_entry = sorted(
+            approved_entries,
+            key=lambda entry: (
+                entry.get("submitted_at") or "",
+                entry.get("reviewed_head_sha") or "",
+            ),
+        )[-1]
+        latest_approved = (latest_entry.get("reviewed_head_sha") or "").strip() or None
+    reason = None
+    if approved_entries and not at_current:
+        reason = (
+            f"stale approval: approved SHA '{latest_approved}' does not match "
+            f"current live PR head SHA '{current or '(unknown)'}' (fail closed); "
+            "required next action: re-review PR at current head before merge"
+        )
+
+    return {
+        "approval_at_current_head": at_current,
+        "latest_approved_head_sha": latest_approved,
+        "stale_approval_block_reason": reason,
+    }

merged_cleanup_reconcile.py

@@ -0,0 +1,329 @@
+"""Merged PR branch and worktree cleanup reconciliation (#269).
+
+Builds dry-run reports for merged pull requests and optionally executes
+remote branch deletion and local worktree removal when every safety gate passes.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+from typing import Any
+
+from reviewer_worktree import parse_dirty_tracked_files
+import issue_lock_store
+
+PROTECTED_BRANCHES = frozenset({"master", "main", "dev"})
+CLOSES_FIXES_RE = re.compile(r"\b(?:closes|fixes)\s+#(\d+)\b", re.IGNORECASE)
+
+
+def extract_linked_issue(title: str, body: str) -> int | None:
+    """Return the first Closes/Fixes issue number from PR metadata."""
+    for text in (title or "", body or ""):
+        match = CLOSES_FIXES_RE.search(text)
+        if match:
+            return int(match.group(1))
+    return None
+
+
+def branch_worktree_folder(branch: str) -> str:
+    return (branch or "").replace("/", "-")
+
+
+def resolve_worktree_path(project_root: str, branch: str) -> str:
+    return os.path.join(project_root, "branches", branch_worktree_folder(branch))
+
+
+def read_issue_lock(path: str | None = None) -> dict[str, Any] | None:
+    if path:
+        return issue_lock_store.read_lock_file(path.strip())
+    return issue_lock_store.read_session_issue_lock()
+
+
+def has_active_issue_lock(branch: str, lock_path: str | None = None) -> bool:
+    if lock_path:
+        lock = issue_lock_store.read_lock_file(lock_path.strip())
+        if not lock:
+            return False
+        return (lock.get("branch_name") or "").strip() == (branch or "").strip()
+    return issue_lock_store.has_active_issue_lock(branch)
+
+
+def collect_open_pr_heads(open_prs: list[dict[str, Any]]) -> set[str]:
+    heads: set[str] = set()
+    for pr in open_prs or []:
+        head = pr.get("head")
+        if isinstance(head, dict):
+            ref = head.get("ref")
+        else:
+            ref = head
+        if ref:
+            heads.add(str(ref))
+    return heads
+
+
+def read_local_worktree_state(worktree_path: str) -> dict[str, Any]:
+    path = (worktree_path or "").strip()
+    if not path or not os.path.isdir(path):
+        return {
+            "exists": False,
+            "clean": None,
+            "current_branch": None,
+            "head_sha": None,
+            "dirty_files": [],
+        }
+
+    branch_res = subprocess.run(
+        ["git", "-C", path, "branch", "--show-current"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    current_branch = (branch_res.stdout or "").strip() or None
+
+    status_res = subprocess.run(
+        ["git", "-C", path, "status", "--porcelain"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    dirty_files = parse_dirty_tracked_files(status_res.stdout or "")
+
+    head_res = subprocess.run(
+        ["git", "-C", path, "rev-parse", "HEAD"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    head_sha = (head_res.stdout or "").strip() if head_res.returncode == 0 else None
+
+    return {
+        "exists": True,
+        "clean": not dirty_files,
+        "current_branch": current_branch,
+        "head_sha": head_sha,
+        "dirty_files": dirty_files,
+    }
+
+
+def is_head_ancestor_of_ref(project_root: str, head_sha: str | None, base_ref: str) -> bool | None:
+    if not head_sha:
+        return None
+    res = subprocess.run(
+        ["git", "-C", project_root, "merge-base", "--is-ancestor", head_sha, base_ref],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if res.returncode == 0:
+        return True
+    if res.returncode == 1:
+        return False
+    return None
+
+
+def assess_remote_branch_cleanup(
+    *,
+    pr_number: int,
+    head_branch: str,
+    merged: bool,
+    remote_branch_exists: bool,
+    open_pr_heads: set[str],
+    protected_branches: frozenset[str] | None = None,
+    head_on_master: bool | None,
+    delete_capability_allowed: bool,
+    active_lock: bool,
+) -> dict[str, Any]:
+    protected = protected_branches or PROTECTED_BRANCHES
+    reasons: list[str] = []
+    if not merged:
+        reasons.append("PR is not merged")
+    if not remote_branch_exists:
+        reasons.append("remote branch already absent")
+    if head_branch in protected:
+        reasons.append(f"branch '{head_branch}' is protected")
+    if head_branch in open_pr_heads:
+        reasons.append("an open PR still references this head branch")
+    if active_lock:
+        reasons.append("active issue lock references this branch")
+    if head_on_master is False:
+        reasons.append("PR head is not an ancestor of master")
+    if not delete_capability_allowed:
+        reasons.append("delete_branch capability is not allowed in the active profile")
+
+    safe = merged and remote_branch_exists and not reasons
+    return {
+        "pr_number": pr_number,
+        "head_branch": head_branch,
+        "remote_branch_exists": remote_branch_exists,
+        "safe_to_delete_remote": safe,
+        "block_reasons": reasons,
+        "recommended_action": "delete_remote_branch" if safe else "keep_remote_branch",
+    }
+
+
+def assess_local_worktree_cleanup(
+    *,
+    pr_number: int,
+    head_branch: str,
+    merged: bool,
+    worktree_state: dict[str, Any],
+    active_lock: bool,
+) -> dict[str, Any]:
+    reasons: list[str] = []
+    exists = bool(worktree_state.get("exists"))
+    if not merged:
+        reasons.append("PR is not merged")
+    if not exists:
+        reasons.append("local worktree not present")
+    if exists and worktree_state.get("clean") is False:
+        dirty = worktree_state.get("dirty_files") or []
+        reasons.append(
+            "local worktree has tracked edits"
+            + (f" ({', '.join(dirty)})" if dirty else "")
+        )
+    if exists:
+        current_branch = worktree_state.get("current_branch")
+        if current_branch and current_branch != head_branch:
+            reasons.append(
+                f"worktree branch '{current_branch}' does not match PR head '{head_branch}'"
+            )
+    if active_lock:
+        reasons.append("active issue lock references this branch")
+
+    safe = merged and exists and not reasons
+    return {
+        "pr_number": pr_number,
+        "head_branch": head_branch,
+        "worktree_path": worktree_state.get("worktree_path"),
+        "worktree_exists": exists,
+        "worktree_clean": worktree_state.get("clean"),
+        "safe_to_remove_worktree": safe,
+        "block_reasons": reasons,
+        "recommended_action": "remove_local_worktree" if safe else "keep_local_worktree",
+    }
+
+
+def build_pr_cleanup_entry(
+    *,
+    pr: dict[str, Any],
+    project_root: str,
+    open_pr_heads: set[str],
+    remote_branch_exists: bool,
+    head_on_master: bool | None,
+    delete_capability_allowed: bool,
+    issue_lock_path: str | None = None,
+    protected_branches: frozenset[str] | None = None,
+) -> dict[str, Any]:
+    pr_number = int(pr["number"])
+    head_branch = pr.get("head") or ""
+    if isinstance(head_branch, dict):
+        head_branch = head_branch.get("ref") or ""
+    title = pr.get("title") or ""
+    body = pr.get("body") or ""
+    merged = bool(pr.get("merged_at"))
+    worktree_path = resolve_worktree_path(project_root, head_branch)
+    worktree_state = read_local_worktree_state(worktree_path)
+    worktree_state["worktree_path"] = worktree_path
+    active_lock = has_active_issue_lock(head_branch, issue_lock_path)
+
+    remote = assess_remote_branch_cleanup(
+        pr_number=pr_number,
+        head_branch=head_branch,
+        merged=merged,
+        remote_branch_exists=remote_branch_exists,
+        open_pr_heads=open_pr_heads,
+        protected_branches=protected_branches,
+        head_on_master=head_on_master,
+        delete_capability_allowed=delete_capability_allowed,
+        active_lock=active_lock,
+    )
+    local = assess_local_worktree_cleanup(
+        pr_number=pr_number,
+        head_branch=head_branch,
+        merged=merged,
+        worktree_state=worktree_state,
+        active_lock=active_lock,
+    )
+    return {
+        "pr_number": pr_number,
+        "issue_number": extract_linked_issue(title, body),
+        "title": title,
+        "head_branch": head_branch,
+        "merge_commit_sha": pr.get("merge_commit_sha"),
+        "merged_at": pr.get("merged_at"),
+        "merged": merged,
+        "remote_branch": remote,
+        "local_worktree": local,
+    }
+
+
+def build_reconciliation_report(
+    *,
+    project_root: str,
+    closed_prs: list[dict[str, Any]],
+    open_prs: list[dict[str, Any]],
+    remote_branch_exists: dict[str, bool],
+    head_on_master: dict[int, bool | None],
+    delete_capability_allowed: bool,
+    issue_lock_path: str | None = None,
+    protected_branches: frozenset[str] | None = None,
+) -> dict[str, Any]:
+    open_heads = collect_open_pr_heads(open_prs)
+    entries: list[dict[str, Any]] = []
+    for pr in closed_prs or []:
+        if not pr.get("merged_at"):
+            continue
+        pr_number = int(pr["number"])
+        head = pr.get("head") or ""
+        if isinstance(head, dict):
+            head = head.get("ref") or ""
+        entries.append(
+            build_pr_cleanup_entry(
+                pr=pr,
+                project_root=project_root,
+                open_pr_heads=open_heads,
+                remote_branch_exists=bool(remote_branch_exists.get(head)),
+                head_on_master=head_on_master.get(pr_number),
+                delete_capability_allowed=delete_capability_allowed,
+                issue_lock_path=issue_lock_path,
+                protected_branches=protected_branches,
+            )
+        )
+    return {
+        "project_root": os.path.realpath(project_root),
+        "merged_pr_count": len(entries),
+        "entries": entries,
+        "dry_run": True,
+        "executed": False,
+    }
+
+
+def remove_local_worktree(project_root: str, branch: str) -> dict[str, Any]:
+    worktree_path = resolve_worktree_path(project_root, branch)
+    if not os.path.isdir(worktree_path):
+        return {
+            "success": False,
+            "performed": False,
+            "message": f"worktree not found: {worktree_path}",
+        }
+    res = subprocess.run(
+        ["git", "-C", project_root, "worktree", "remove", worktree_path],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if res.returncode != 0:
+        return {
+            "success": False,
+            "performed": False,
+            "message": (res.stderr or res.stdout or "worktree remove failed").strip(),
+        }
+    return {
+        "success": True,
+        "performed": True,
+        "message": f"removed worktree {worktree_path}",
+        "worktree_path": worktree_path,
+    }

migrate_profiles.py

@@ -31,6 +31,8 @@ REVIEWER_DEFAULT_FORBIDDEN = ["branch", "commit", "push", "open_pr"]
 def infer_role(name, execution_profile):
     """Return the unambiguous role for a legacy profile name, or None."""
     haystack = f"{name} {execution_profile or ''}".lower()
+    if "reconciler" in haystack:
+        return "reconciler"
     has_author = "author" in haystack
     has_reviewer = "reviewer" in haystack
     if has_author == has_reviewer:

namespace_workspace_binding.py

@@ -0,0 +1,307 @@
+"""Namespace-scoped MCP workspace binding (#510).
+
+Each role namespace (author, reviewer, merger, reconciler) resolves its own
+active task workspace. Foreign role worktree environment variables must not
+poison workspace purity checks in another namespace.
+"""
+
+from __future__ import annotations
+
+import os
+
+import author_mutation_worktree as amw
+
+ACTIVE_WORKTREE_ENV = amw.ACTIVE_WORKTREE_ENV
+AUTHOR_WORKTREE_ENV = amw.AUTHOR_WORKTREE_ENV
+REVIEWER_WORKTREE_ENV = "GITEA_REVIEWER_WORKTREE"
+MERGER_WORKTREE_ENV = "GITEA_MERGER_WORKTREE"
+RECONCILER_WORKTREE_ENV = "GITEA_RECONCILER_WORKTREE"
+
+ROLE_WORKTREE_ENVS: dict[str, str] = {
+    "author": AUTHOR_WORKTREE_ENV,
+    "reviewer": REVIEWER_WORKTREE_ENV,
+    "merger": MERGER_WORKTREE_ENV,
+    "reconciler": RECONCILER_WORKTREE_ENV,
+}
+
+NON_AUTHOR_ROLES = frozenset({"reviewer", "merger", "reconciler"})
+
+
+def normalize_role_kind(
+    role_kind: str | None,
+    *,
+    profile_name: str | None = None,
+) -> str:
+    """Map profile/task role to a workspace namespace key."""
+    role = (role_kind or "author").strip().lower()
+    profile = (profile_name or "").strip().lower()
+    if role == "reviewer" and "merger" in profile:
+        return "merger"
+    if role in ROLE_WORKTREE_ENVS:
+        return role
+    return "author"
+
+
+def _env_value(env: dict[str, str] | os._Environ, key: str) -> str | None:
+    text = (env.get(key) or "").strip()
+    return text or None
+
+
+def resolve_namespace_workspace(
+    *,
+    role_kind: str,
+    worktree_path: str | None = None,
+    worktree: str | None = None,
+    process_project_root: str,
+    env: dict[str, str] | os._Environ | None = None,
+    session_lease_worktree: str | None = None,
+    profile_name: str | None = None,
+) -> tuple[str, str]:
+    """Return ``(resolved_path, binding_source)`` for *role_kind*."""
+    env_map = env if env is not None else os.environ
+    role = normalize_role_kind(role_kind, profile_name=profile_name)
+    role_env_key = ROLE_WORKTREE_ENVS[role]
+
+    for candidate, source in (
+        (worktree_path, "worktree_path argument"),
+        (worktree, "worktree argument"),
+        (_env_value(env_map, ACTIVE_WORKTREE_ENV), f"{ACTIVE_WORKTREE_ENV} environment variable"),
+        (_env_value(env_map, role_env_key), f"{role_env_key} environment variable"),
+        (session_lease_worktree if role in {"reviewer", "merger"} else None,
+         "reviewer PR lease worktree"),
+    ):
+        text = (candidate or "").strip()
+        if text:
+            return os.path.realpath(os.path.abspath(text)), source
+
+    return os.path.realpath(process_project_root), "MCP server process root (default)"
+
+
+def resolve_namespace_mutation_context(
+    *,
+    role_kind: str,
+    worktree_path: str | None,
+    process_project_root: str,
+    env: dict[str, str] | os._Environ | None = None,
+    session_lease_worktree: str | None = None,
+    worktree: str | None = None,
+    profile_name: str | None = None,
+) -> dict:
+    """Shared workspace resolution for runtime_context and mutation guards."""
+    workspace, binding_source = resolve_namespace_workspace(
+        role_kind=role_kind,
+        worktree_path=worktree_path,
+        worktree=worktree,
+        process_project_root=process_project_root,
+        env=env,
+        session_lease_worktree=session_lease_worktree,
+        profile_name=profile_name,
+    )
+    process_root = os.path.realpath(process_project_root)
+    role = normalize_role_kind(role_kind, profile_name=profile_name)
+    pollution = assess_foreign_role_worktree_pollution(
+        role_kind=role,
+        resolved_workspace=workspace,
+        binding_source=binding_source,
+        env=env,
+        profile_name=profile_name,
+    )
+    canonical_root = amw.resolve_canonical_repo_root(process_root, process_root)
+    return {
+        "workspace_path": workspace,
+        "workspace_binding_source": binding_source,
+        "workspace_role_kind": role,
+        "ignored_bindings": pollution.get("ignored_bindings") or [],
+        "process_project_root": process_root,
+        "canonical_repo_root": canonical_root,
+        "roots_aligned": canonical_root == process_root,
+    }
+
+
+def assess_foreign_role_worktree_pollution(
+    *,
+    role_kind: str,
+    resolved_workspace: str,
+    binding_source: str,
+    env: dict[str, str] | os._Environ | None = None,
+    profile_name: str | None = None,
+) -> dict:
+    """Detect when a foreign role env would have hijacked workspace binding."""
+    env_map = env if env is not None else os.environ
+    role = normalize_role_kind(role_kind, profile_name=profile_name)
+    if role == "author":
+        return {"would_pollute": False, "ignored_bindings": []}
+
+    ignored: list[str] = []
+    author_path = _env_value(env_map, AUTHOR_WORKTREE_ENV)
+    if author_path:
+        author_real = os.path.realpath(os.path.abspath(author_path))
+        resolved_real = os.path.realpath(resolved_workspace)
+        if author_real != resolved_real and binding_source != f"{AUTHOR_WORKTREE_ENV} environment variable":
+            ignored.append(
+                f"{AUTHOR_WORKTREE_ENV}={author_real} (ignored for {role} namespace)"
+            )
+    return {
+        "would_pollute": bool(ignored),
+        "ignored_bindings": ignored,
+    }
+
+
+def assess_metadata_only_worktree_binding(
+    *,
+    role_kind: str,
+    declared_worktree_path: str | None,
+    mutation_workspace: str,
+    process_project_root: str,
+    profile_name: str | None = None,
+) -> dict:
+    """Fail closed when declared worktree_path would not redirect mutations."""
+    declared = (declared_worktree_path or "").strip()
+    process_root = os.path.realpath(process_project_root)
+    mutation_root = os.path.realpath(mutation_workspace)
+    role = normalize_role_kind(role_kind, profile_name=profile_name)
+    if not declared:
+        return {"block": False, "reasons": [], "metadata_only": False}
+
+    declared_root = os.path.realpath(os.path.abspath(declared))
+    if declared_root == mutation_root:
+        return {"block": False, "reasons": [], "metadata_only": False}
+
+    if declared_root != process_root and mutation_root == process_root:
+        return {
+            "block": True,
+            "metadata_only": True,
+            "reasons": [
+                f"worktree_path is metadata-only for {role} mutations: preflight "
+                f"inspected '{declared_root}' but mutation tools would still "
+                f"validate MCP server process root '{process_root}'"
+            ],
+            "declared_worktree_path": declared_root,
+            "mutation_workspace": mutation_root,
+            "process_project_root": process_root,
+        }
+
+    return {"block": False, "reasons": [], "metadata_only": False}
+
+
+def format_namespace_workspace_binding_error(
+    *,
+    role_kind: str,
+    workspace_path: str,
+    binding_source: str,
+    reasons: list[str] | None = None,
+    ignored_bindings: list[str] | None = None,
+    dirty_files: list[str] | None = None,
+) -> str:
+    """Canonical error when namespace workspace binding blocks mutations."""
+    role = normalize_role_kind(role_kind)
+    workspace = os.path.realpath(workspace_path)
+    parts = [
+        f"Namespace workspace binding blocked ({role} namespace, #510): "
+        f"resolved workspace '{workspace}' via {binding_source}."
+    ]
+    if ignored_bindings:
+        parts.append(
+            "Foreign role bindings ignored: " + "; ".join(ignored_bindings) + "."
+        )
+    if dirty_files:
+        parts.append(
+            "Dirty tracked files in active task workspace: "
+            + ", ".join(dirty_files)
+            + "."
+        )
+    if reasons:
+        parts.append("Details: " + "; ".join(reasons) + ".")
+    parts.append(
+        "Remediation: reconnect or relaunch the MCP server from a clean dedicated "
+        f"branches/ {role} worktree, set "
+        f"{ROLE_WORKTREE_ENVS.get(role, ACTIVE_WORKTREE_ENV)} or {ACTIVE_WORKTREE_ENV} "
+        "to that path, or pass worktree_path on mutation tools. Do not clean or "
+        "reset foreign role worktrees to unblock this namespace."
+    )
+    return " ".join(parts)
+
+
+def assess_namespace_mutation_workspace(
+    *,
+    role_kind: str,
+    worktree_path: str | None,
+    worktree: str | None,
+    process_project_root: str,
+    env: dict[str, str] | os._Environ | None = None,
+    session_lease_worktree: str | None = None,
+    profile_name: str | None = None,
+    current_branch: str | None = None,
+) -> dict:
+    """Evaluate namespace workspace binding before preflight/mutation."""
+    ctx = resolve_namespace_mutation_context(
+        role_kind=role_kind,
+        worktree_path=worktree_path,
+        worktree=worktree,
+        process_project_root=process_project_root,
+        env=env,
+        session_lease_worktree=session_lease_worktree,
+        profile_name=profile_name,
+    )
+    mutation_workspace = ctx["workspace_path"]
+    binding_source = ctx["workspace_binding_source"]
+    role = ctx["workspace_role_kind"]
+    process_root = ctx["process_project_root"]
+
+    metadata = assess_metadata_only_worktree_binding(
+        role_kind=role,
+        declared_worktree_path=worktree_path,
+        mutation_workspace=mutation_workspace,
+        process_project_root=process_root,
+        profile_name=profile_name,
+    )
+    pollution = assess_foreign_role_worktree_pollution(
+        role_kind=role,
+        resolved_workspace=mutation_workspace,
+        binding_source=binding_source,
+        env=env,
+        profile_name=profile_name,
+    )
+
+    reasons = list(metadata.get("reasons") or [])
+    if role == "author":
+        branches = amw.assess_author_mutation_worktree(
+            workspace_path=mutation_workspace,
+            project_root=ctx["canonical_repo_root"],
+            current_branch=current_branch,
+        )
+        if branches["block"]:
+            reasons.extend(branches["reasons"])
+    elif (
+        role == "reviewer"
+        and mutation_workspace == process_root
+        and not amw.is_path_under_branches(mutation_workspace, ctx["canonical_repo_root"])
+    ):
+        reasons.append(
+            f"{role} mutation blocked: workspace is the stable control checkout; "
+            f"create or reconnect to a session-owned worktree under branches/ "
+            f"or set {ROLE_WORKTREE_ENVS[role]} / {ACTIVE_WORKTREE_ENV}"
+        )
+    elif (
+        role in {"reviewer", "merger"}
+        and mutation_workspace != process_root
+        and not amw.is_path_under_branches(mutation_workspace, ctx["canonical_repo_root"])
+    ):
+        reasons.append(
+            f"{role} mutation blocked: workspace '{mutation_workspace}' is not under "
+            f"'{ctx['canonical_repo_root']}/branches/'"
+        )
+
+    block = bool(reasons)
+    return {
+        "block": block,
+        "reasons": reasons,
+        "mutation_workspace": mutation_workspace,
+        "workspace_binding_source": binding_source,
+        "workspace_role_kind": role,
+        "process_project_root": process_root,
+        "canonical_repo_root": ctx["canonical_repo_root"],
+        "metadata_only": metadata.get("metadata_only", False),
+        "declared_worktree_path": metadata.get("declared_worktree_path"),
+        "ignored_bindings": pollution.get("ignored_bindings") or [],
+    }

native_mcp_preference.py

@@ -0,0 +1,369 @@
+"""Native MCP preference gate and shell health circuit breaker (#270).
+
+Gitea mutations must use native MCP tools first. Shell scripts, direct API
+calls, browser helpers, and improvised encoders are blocked when MCP is
+available unless explicit recovery-mode proof is supplied.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from reviewer_fallback import LOCAL_GITEA_SCRIPT_NAMES
+
+# Tasks that must prefer native MCP over shell/API/helper fallbacks.
+GITEA_MUTATION_TASKS = frozenset({
+    "comment_issue",
+    "mark_issue",
+    "lock_issue",
+    "set_issue_labels",
+    "create_issue",
+    "close_issue",
+    "create_branch",
+    "push_branch",
+    "create_pr",
+    "close_pr",
+    "comment_pr",
+    "review_pr",
+    "merge_pr",
+    "approve_pr",
+    "request_changes_pr",
+    "commit_files",
+    "gitea_commit_files",
+    "delete_branch",
+    "address_pr_change_requests",
+})
+
+ALLOWED_PATH_KINDS = frozenset({
+    "mcp_native",
+    "recovery_fallback",
+})
+
+BLOCKED_PATH_KINDS = frozenset({
+    "shell_script",
+    "direct_api",
+    "webfetch",
+    "playwright",
+    "helper_script",
+    "unsafe_helper",
+    "mcp_server_touch",
+})
+
+SHELL_SPAWN_FAILURE_THRESHOLD = 2
+
+TERMINAL_REPORT_HEADING = (
+    "MCP transport unavailable or shell circuit breaker tripped. "
+    "No unsafe Gitea fallback performed."
+)
+
+_RECOVERY_MODE_RE = re.compile(
+    r"\b(?:recovery mode|explicit recovery|mcp unavailable|mcp not available|"
+    r"mcp tools unavailable|no mcp path)\b",
+    re.IGNORECASE,
+)
+_LOCAL_SCRIPT_RE = re.compile(
+    r"(?:^|[\s\"'`/])(?:python3?|bash|sh)?\s*(?:"
+    + "|".join(re.escape(name) for name in LOCAL_GITEA_SCRIPT_NAMES)
+    + r")",
+    re.IGNORECASE,
+)
+_WEBFETCH_RE = re.compile(r"\b(?:webfetch|mcp_web_fetch|fetch\s+url)\b", re.IGNORECASE)
+_PLAYWRIGHT_RE = re.compile(r"\b(?:playwright|browser_navigate|browser_click)\b", re.IGNORECASE)
+_HELPER_SCRIPT_RE = re.compile(
+    r"(?:^|[\s\"'`/])(?:_encode_|_emit_|_inline_)[\w-]+\.py",
+    re.IGNORECASE,
+)
+_MANUAL_BASE64_RE = re.compile(
+    r"\b(?:manual\s+base64|llm-generated\s+base64|base64-encode\s+in\s+chat)\b",
+    re.IGNORECASE,
+)
+_DIRECT_API_RE = re.compile(
+    r"\b(?:api_request|urllib\.request|requests\.(?:post|patch|put)|curl\s+-X\s+POST)\b",
+    re.IGNORECASE,
+)
+_MCP_SERVER_TOUCH_RE = re.compile(
+    r"\b(?:kill|pkill|restart|reload|touch|edit|modify|write)\b.{0,40}\b(?:mcp_server|mcp-server|gitea_mcp_server)\b",
+    re.IGNORECASE,
+)
+_CLI_AUTH_DIVERGENCE_RE = re.compile(
+    r"GITEA_MCP_PROFILE\s*=\s*['\"]?([^\s'\";]+)",
+    re.IGNORECASE,
+)
+
+_session_shell: dict[str, Any] = {
+    "consecutive_spawn_failures": 0,
+    "shell_unavailable": False,
+    "hard_stopped": False,
+    "last_exit_code": None,
+}
+
+
+def _clean(value: str | None) -> str:
+    return (value or "").strip()
+
+
+def is_spawn_failure(
+    *,
+    exit_code: int | None = None,
+    stdout: str | None = None,
+    stderr: str | None = None,
+    spawn_failure: bool | None = None,
+) -> bool:
+    """True for executor spawn failures (exit_code -1, empty output)."""
+    if spawn_failure is True:
+        return True
+    if spawn_failure is False:
+        return False
+    if exit_code != -1:
+        return False
+    return not (_clean(stdout) or _clean(stderr))
+
+
+def record_shell_spawn_outcome(
+    *,
+    exit_code: int | None = None,
+    stdout: str | None = None,
+    stderr: str | None = None,
+    spawn_failure: bool | None = None,
+    probe_attempted: bool = False,
+    probe_succeeded: bool | None = None,
+) -> dict[str, Any]:
+    """Track shell spawn outcomes and trip the session circuit breaker (#270 AC4)."""
+    global _session_shell
+    failed = is_spawn_failure(
+        exit_code=exit_code,
+        stdout=stdout,
+        stderr=stderr,
+        spawn_failure=spawn_failure,
+    )
+
+    if failed:
+        _session_shell["consecutive_spawn_failures"] = (
+            int(_session_shell.get("consecutive_spawn_failures") or 0) + 1
+        )
+        _session_shell["last_exit_code"] = exit_code
+        if probe_attempted and probe_succeeded is False:
+            _session_shell["shell_unavailable"] = True
+    else:
+        _session_shell["consecutive_spawn_failures"] = 0
+        _session_shell["shell_unavailable"] = False
+        _session_shell["hard_stopped"] = False
+        _session_shell["last_exit_code"] = exit_code
+
+    failures = int(_session_shell["consecutive_spawn_failures"])
+    if failures >= SHELL_SPAWN_FAILURE_THRESHOLD:
+        _session_shell["shell_unavailable"] = True
+        _session_shell["hard_stopped"] = True
+
+    return shell_health_status()
+
+
+def shell_health_status() -> dict[str, Any]:
+    """Return the current shell health / circuit-breaker state."""
+    failures = int(_session_shell.get("consecutive_spawn_failures") or 0)
+    hard_stopped = bool(_session_shell.get("hard_stopped"))
+    shell_unavailable = bool(_session_shell.get("shell_unavailable"))
+    return {
+        "consecutive_spawn_failures": failures,
+        "shell_unavailable": shell_unavailable,
+        "hard_stopped": hard_stopped,
+        "threshold": SHELL_SPAWN_FAILURE_THRESHOLD,
+        "shell_use_allowed": not hard_stopped,
+        "last_exit_code": _session_shell.get("last_exit_code"),
+        "safe_next_action": (
+            "emit terminal recovery report; prefer native MCP for remaining Gitea mutations"
+            if hard_stopped
+            else (
+                "probe shell once with echo/pwd; if probe fails mark shell unavailable"
+                if failures == 1
+                else "shell healthy"
+            )
+        ),
+    }
+
+
+def clear_shell_health_for_tests() -> None:
+    """Reset session shell state (tests only)."""
+    global _session_shell
+    _session_shell = {
+        "consecutive_spawn_failures": 0,
+        "shell_unavailable": False,
+        "hard_stopped": False,
+        "last_exit_code": None,
+    }
+
+
+def classify_command_path(command_or_detail: str | None) -> str:
+    """Classify a proposed command/detail into a path kind."""
+    text = command_or_detail or ""
+    if _MCP_SERVER_TOUCH_RE.search(text):
+        return "mcp_server_touch"
+    if _WEBFETCH_RE.search(text):
+        return "webfetch"
+    if _PLAYWRIGHT_RE.search(text):
+        return "playwright"
+    if _HELPER_SCRIPT_RE.search(text) or _MANUAL_BASE64_RE.search(text):
+        return "unsafe_helper"
+    if _LOCAL_SCRIPT_RE.search(text):
+        return "shell_script"
+    if _DIRECT_API_RE.search(text):
+        return "direct_api"
+    return "mcp_native"
+
+
+def detect_cli_auth_divergence(
+    command_or_detail: str | None,
+    *,
+    active_profile: str | None,
+) -> list[str]:
+    """Flag shell commands that override GITEA_MCP_PROFILE away from the session."""
+    reasons: list[str] = []
+    text = command_or_detail or ""
+    active = _clean(active_profile)
+    match = _CLI_AUTH_DIVERGENCE_RE.search(text)
+    if not match or not active:
+        return reasons
+    requested = _clean(match.group(1))
+    if requested and requested != active:
+        reasons.append(
+            f"CLI auth divergence: command sets GITEA_MCP_PROFILE='{requested}' "
+            f"but active session profile is '{active}' (fail closed)"
+        )
+    return reasons
+
+
+def format_mcp_unavailable_terminal_report(
+    *,
+    task: str | None = None,
+    reasons: list[str] | None = None,
+) -> str:
+    """Terminal report when MCP is broken and unsafe recovery is forbidden (#270 AC3)."""
+    lines = [TERMINAL_REPORT_HEADING, ""]
+    if task:
+        lines.append(f"Blocked task: {task}")
+    if reasons:
+        lines.extend(["", "Reasons:"])
+        lines.extend(f"- {reason}" for reason in reasons)
+    lines.extend([
+        "",
+        "Required recovery (no improvised fallback):",
+        "- Restart the MCP session",
+        "- Kill hung background terminals holding the shell executor",
+        "- Retry the native MCP tool once after reconnect",
+        "- If MCP remains unavailable, stop and hand off to the operator",
+        "- Do not run local Gitea scripts, WebFetch, Playwright, or manual base64 encoders",
+    ])
+    return "\n".join(lines)
+
+
+def assess_gitea_operation_path(
+    *,
+    task: str,
+    path_kind: str | None = None,
+    command_or_detail: str | None = None,
+    mcp_available: bool = True,
+    mcp_tool_visible: bool = True,
+    recovery_mode: bool = False,
+    recovery_proof_complete: bool = False,
+    role: str | None = None,
+    active_profile: str | None = None,
+) -> dict[str, Any]:
+    """Fail closed when a Gitea mutation would bypass native MCP (#270)."""
+    task_name = _clean(task)
+    resolved_kind = _clean(path_kind) or classify_command_path(command_or_detail)
+    reasons: list[str] = []
+
+    if task_name and task_name not in GITEA_MUTATION_TASKS:
+        reasons.append(
+            f"unknown or non-mutation Gitea task '{task_name}'; "
+            "native MCP preference gate applies only to Gitea mutations"
+        )
+
+    shell = shell_health_status()
+    if shell["hard_stopped"] and resolved_kind != "mcp_native":
+        reasons.append(
+            "shell circuit breaker is hard-stopped after consecutive spawn failures; "
+            "use native MCP or emit terminal recovery report"
+        )
+
+    recovery_declared = recovery_mode or bool(
+        _RECOVERY_MODE_RE.search(command_or_detail or "")
+    )
+    recovery_allowed = (
+        recovery_declared
+        and recovery_proof_complete
+        and not mcp_available
+        and resolved_kind in BLOCKED_PATH_KINDS - {"mcp_server_touch"}
+    )
+
+    if resolved_kind in BLOCKED_PATH_KINDS and not recovery_allowed:
+        reasons.append(f"path kind '{resolved_kind}' is not an approved Gitea mutation path")
+
+    if resolved_kind == "mcp_server_touch":
+        if _clean(role) == "reviewer" or (
+            active_profile and "reviewer" in active_profile.lower()
+        ):
+            reasons.append(
+                "reviewer workflows must not touch, restart, or kill MCP server files/processes"
+            )
+        else:
+            reasons.append(
+                "MCP server files/processes must not be modified during normal Gitea workflows"
+            )
+
+    reasons.extend(
+        detect_cli_auth_divergence(command_or_detail, active_profile=active_profile)
+    )
+
+    if (
+        mcp_available
+        and mcp_tool_visible
+        and resolved_kind != "mcp_native"
+        and not recovery_allowed
+    ):
+        if not recovery_declared:
+            reasons.append(
+                "native MCP tools are available; shell/API/helper fallback is forbidden"
+            )
+        elif not recovery_proof_complete:
+            reasons.append(
+                "recovery-mode fallback requires complete recovery proof before proceeding"
+            )
+
+    if not mcp_available and resolved_kind != "mcp_native" and not recovery_allowed:
+        if not recovery_declared:
+            reasons.append(
+                "MCP transport unavailable; produce terminal recovery report instead of "
+                "improvising unsafe fallback"
+            )
+
+    block = bool(reasons)
+    terminal_report = None
+    if block and (not mcp_available or shell["hard_stopped"]):
+        terminal_report = format_mcp_unavailable_terminal_report(
+            task=task_name or None,
+            reasons=reasons,
+        )
+
+    return {
+        "task": task_name or None,
+        "path_kind": resolved_kind,
+        "mcp_available": mcp_available,
+        "mcp_tool_visible": mcp_tool_visible,
+        "recovery_mode": recovery_declared,
+        "shell_health": shell,
+        "block": block,
+        "allowed": not block,
+        "reasons": reasons,
+        "terminal_report": terminal_report,
+        "safe_next_action": (
+            "use the native MCP tool for this task"
+            if mcp_available and mcp_tool_visible and block
+            else (
+                terminal_report or "proceed with native MCP"
+                if block
+                else "proceed with native MCP"
+            )
+        ),
+    }

post_merge_cleanup_proof.py

@@ -0,0 +1,239 @@
+"""Post-merge cleanup proof verifier for reviewer final reports (#402)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+CLEANUP_SKIPPED = "CLEANUP_SKIPPED"
+CLEANUP_PERFORMED = "CLEANUP_PERFORMED"
+
+_CLEANUP_SECTION_HINT = re.compile(
+    r"(?:cleanup (?:status|result|mutations)|post-merge cleanup|"
+    r"gitea_delete_branch|remote branch.*deleted|worktree remove)",
+    re.IGNORECASE,
+)
+_CLEANUP_SKIPPED_RE = re.compile(r"\bCLEANUP_SKIPPED\b", re.IGNORECASE)
+_CLEANUP_BLOCKER_RE = re.compile(
+    r"(?:cleanup blocker|cleanup skip(?:ped)? reason)\s*:\s*(.+)",
+    re.IGNORECASE,
+)
+_REMOTE_DELETE_CLAIM_RE = re.compile(
+    r"(?:gitea_delete_branch|remote (?:head )?branch (?:was )?deleted|"
+    r"deleted remote branch|delete_branch)",
+    re.IGNORECASE,
+)
+_WORKTREE_REMOVE_CLAIM_RE = re.compile(
+    r"(?:git worktree remove|worktree (?:was )?removed|removed (?:local )?worktree|"
+    r"worktree cleanup performed)",
+    re.IGNORECASE,
+)
+_DELETE_CAPABILITY_RE = re.compile(
+    r"(?:delete[- ]branch capability resolved|gitea\.branch\.delete)\s*:\s*"
+    r".*(?:gitea\.branch\.delete|delete_branch).*(?:resolved|allowed|proven)|"
+    r"gitea\.branch\.delete\s+(?:resolved|allowed|proven)",
+    re.IGNORECASE,
+)
+_DELETE_TASK_RE = re.compile(
+    r"(?:delete_branch|cleanup_branch|reconcile_merged_cleanups)",
+    re.IGNORECASE,
+)
+_MERGE_RESULT_RE = re.compile(
+    r"merge result\s*:\s*(?:merged|success|performed)",
+    re.IGNORECASE,
+)
+_MERGE_COMMIT_SHA_RE = re.compile(
+    r"(?:merge commit sha|merged commit sha|merge commit)\s*:\s*([0-9a-f]{7,40})",
+    re.IGNORECASE,
+)
+_PR_HEAD_BRANCH_RE = re.compile(
+    r"(?:merged pr head branch|pr head branch|deleted branch)\s*:\s*(\S+)",
+    re.IGNORECASE,
+)
+_BRANCH_NOT_PROTECTED_RE = re.compile(
+    r"branch (?:is )?not protected|branch protection\s*:\s*(?:none|false|no)",
+    re.IGNORECASE,
+)
+_OPEN_PR_INVENTORY_RE = re.compile(
+    r"(?:no other open pr(?:\s+references)?(?:\s+\S+)?|open pr inventory proof|"
+    r"open pr references).*(?:none|zero|0|clear|inventory complete)|"
+    r"no other open pr references branch",
+    re.IGNORECASE,
+)
+_ACTIVE_CLAIM_LEASE_RE = re.compile(
+    r"(?:no active (?:heartbeat|claim|lease)|"
+    r"(?:active )?(?:heartbeat|claim|lease)(?:/(?:claim|lease))*\s*:\s*none)",
+    re.IGNORECASE,
+)
+_SESSION_OWNED_WORKTREE_RE = re.compile(
+    r"(?:removed worktree path|cleanup worktree path|session-owned worktree)\s*:\s*(\S+)",
+    re.IGNORECASE,
+)
+_BRANCHES_PATH_RE = re.compile(r"\bbranches/", re.IGNORECASE)
+_CLEAN_TRACKED_RE = re.compile(
+    r"(?:pre-removal tracked state|tracked state before removal)\s*:\s*clean",
+    re.IGNORECASE,
+)
+_CLEAN_UNTRACKED_RE = re.compile(
+    r"(?:pre-removal untracked state|untracked state before removal)\s*:\s*clean",
+    re.IGNORECASE,
+)
+_WORKTREE_LIST_AFTER_RE = re.compile(
+    r"(?:git worktree list after|post-removal worktree list|worktree list after)",
+    re.IGNORECASE,
+)
+_WRONG_BRANCH_RE = re.compile(
+    r"deleted branch (?:does not match|!=|differs from) (?:merged )?pr head",
+    re.IGNORECASE,
+)
+
+
+def _claims_remote_delete(text: str) -> bool:
+    return bool(_REMOTE_DELETE_CLAIM_RE.search(text))
+
+
+def _claims_worktree_remove(text: str) -> bool:
+    return bool(_WORKTREE_REMOVE_CLAIM_RE.search(text))
+
+
+def _branch_safety_fields_present(text: str) -> list[str]:
+    missing: list[str] = []
+    if not _DELETE_CAPABILITY_RE.search(text):
+        missing.append("delete-branch capability resolved (gitea.branch.delete)")
+    if not _DELETE_TASK_RE.search(text):
+        missing.append("delete-branch task named (delete_branch or cleanup)")
+    if not _MERGE_RESULT_RE.search(text):
+        missing.append("merge result: merged")
+    if not _MERGE_COMMIT_SHA_RE.search(text):
+        missing.append("merge commit SHA")
+    if not _PR_HEAD_BRANCH_RE.search(text):
+        missing.append("merged PR head branch / deleted branch name")
+    if not _BRANCH_NOT_PROTECTED_RE.search(text):
+        missing.append("branch not protected proof")
+    if not _OPEN_PR_INVENTORY_RE.search(text):
+        missing.append("open PR inventory proof (no other PR references branch)")
+    if not _ACTIVE_CLAIM_LEASE_RE.search(text):
+        missing.append("no active heartbeat/claim/lease proof")
+    return missing
+
+
+def _worktree_cleanup_fields_present(text: str) -> list[str]:
+    missing: list[str] = []
+    match = _SESSION_OWNED_WORKTREE_RE.search(text)
+    path = match.group(1).strip() if match else ""
+    if not path:
+        missing.append("session-owned worktree path")
+    elif not _BRANCHES_PATH_RE.search(path.replace("\\", "/")):
+        missing.append("worktree path under branches/")
+    if not _CLEAN_TRACKED_RE.search(text):
+        missing.append("pre-removal tracked state: clean")
+    if not _CLEAN_UNTRACKED_RE.search(text):
+        missing.append("pre-removal untracked state: clean")
+    if not _WORKTREE_LIST_AFTER_RE.search(text):
+        missing.append("git worktree list after removal")
+    return missing
+
+
+def assess_post_merge_cleanup_proof(
+    report_text: str,
+    *,
+    cleanup_session: dict | None = None,
+) -> dict[str, Any]:
+    """Validate post-merge cleanup claims carry safety-gate proof (#402)."""
+    text = report_text or ""
+    session = dict(cleanup_session or {})
+    reasons: list[str] = []
+
+    if _CLEANUP_SKIPPED_RE.search(text) or session.get("outcome") == CLEANUP_SKIPPED:
+        blocker = (session.get("blocker") or "").strip()
+        if not blocker:
+            match = _CLEANUP_BLOCKER_RE.search(text)
+            blocker = match.group(1).strip() if match else ""
+        if blocker.upper() == CLEANUP_SKIPPED:
+            blocker = ""
+        if not blocker:
+            reasons.append(
+                "CLEANUP_SKIPPED requires exact cleanup blocker reason (#402)"
+            )
+        return {
+            "block": bool(reasons),
+            "proven": not reasons,
+            "outcome": CLEANUP_SKIPPED,
+            "remote_delete_claimed": False,
+            "worktree_remove_claimed": False,
+            "reasons": reasons,
+            "safe_next_action": (
+                "report CLEANUP_SKIPPED with exact blocker; do not claim performed cleanup"
+                if reasons
+                else "proceed"
+            ),
+        }
+
+    if not _CLEANUP_SECTION_HINT.search(text) and not session.get("cleanup_claimed"):
+        return {
+            "block": False,
+            "proven": True,
+            "outcome": None,
+            "remote_delete_claimed": False,
+            "worktree_remove_claimed": False,
+            "reasons": [],
+            "safe_next_action": "proceed",
+        }
+
+    remote_delete = bool(
+        session.get("remote_delete_claimed") or _claims_remote_delete(text)
+    )
+    worktree_remove = bool(
+        session.get("worktree_remove_claimed") or _claims_worktree_remove(text)
+    )
+
+    if _WRONG_BRANCH_RE.search(text):
+        reasons.append(
+            "cleanup report claims deleted branch that is not the merged PR head branch"
+        )
+
+    if remote_delete:
+        reasons.extend(
+            f"remote branch deletion missing {field}"
+            for field in _branch_safety_fields_present(text)
+        )
+
+    if worktree_remove:
+        reasons.extend(
+            f"worktree removal missing {field}"
+            for field in _worktree_cleanup_fields_present(text)
+        )
+
+    if (remote_delete or worktree_remove) and not (remote_delete or worktree_remove):
+        pass
+
+    if not remote_delete and not worktree_remove:
+        cleanup_mutations = re.search(
+            r"cleanup mutations\s*:\s*(?!none\b)\S",
+            text,
+            re.IGNORECASE,
+        )
+        if cleanup_mutations:
+            reasons.append(
+                "cleanup mutations reported without post-merge cleanup proof checklist"
+            )
+
+    outcome = CLEANUP_PERFORMED if (remote_delete or worktree_remove) and not reasons else None
+    if remote_delete or worktree_remove:
+        outcome = CLEANUP_PERFORMED if not reasons else "CLEANUP_CLAIMED_UNPROVEN"
+
+    block = bool(reasons)
+    return {
+        "block": block,
+        "proven": not block,
+        "outcome": outcome,
+        "remote_delete_claimed": remote_delete,
+        "worktree_remove_claimed": worktree_remove,
+        "reasons": reasons,
+        "safe_next_action": (
+            "report CLEANUP_SKIPPED with exact blocker or include the full cleanup "
+            "checklist before claiming remote delete or worktree removal"
+            if reasons
+            else "proceed"
+        ),
+    }

pr_queue_cleanup.py

@@ -0,0 +1,225 @@
+"""PR-only queue cleanup mode gates and report verifier (#390).
+
+Cleanup mode dispatches exactly one canonical review run per PR. It forbids
+author-side mutations (issue claiming, branch creation, implementation edits,
+issue filing) and enforces the terminal-mutation chain: stop after
+``REQUEST_CHANGES``; after ``APPROVED`` continue only to same-PR merge when
+merge is explicitly authorized for that PR and merge gates pass; stop after
+merge or a merge blocker. The next PR always requires a fresh run.
+"""
+
+from __future__ import annotations
+
+import re
+
+CLEANUP_WORKFLOW_PATH = "workflows/pr-queue-cleanup.md"
+
+# Author-side resolver tasks that must never run inside cleanup mode.
+CLEANUP_FORBIDDEN_TASKS = frozenset({
+    "claim_issue",
+    "mark_issue",
+    "lock_issue",
+    "create_issue",
+    "create_branch",
+    "push_branch",
+    "create_pr",
+    "commit_files",
+    "gitea_commit_files",
+    "address_pr_change_requests",
+})
+
+# Run-state outcomes for one cleanup dispatch.
+STOP_AFTER_REQUEST_CHANGES = "STOP_AFTER_REQUEST_CHANGES"
+STOP_AFTER_DECISION = "STOP_AFTER_DECISION"
+CONTINUE_TO_SAME_PR_MERGE = "CONTINUE_TO_SAME_PR_MERGE"
+STOP_APPROVED_NO_MERGE_AUTH = "STOP_APPROVED_NO_MERGE_AUTH"
+STOP_APPROVED_MERGE_GATES_FAILED = "STOP_APPROVED_MERGE_GATES_FAILED"
+STOP_AFTER_MERGE = "STOP_AFTER_MERGE"
+STOP_AFTER_MERGE_BLOCKER = "STOP_AFTER_MERGE_BLOCKER"
+STOP_GATE_NOT_PROVEN = "STOP_GATE_NOT_PROVEN"
+
+_TERMINAL_DECISIONS = frozenset({"approved", "request_changes", "comment", "skip"})
+
+
+def resolve_cleanup_run_state(
+    decision: str | None,
+    *,
+    merge_authorized_for_pr: bool = False,
+    merge_gates_passed: bool | None = None,
+    merge_completed: bool = False,
+    merge_blocker: bool = False,
+) -> dict:
+    """Resolve what one cleanup run may do after its terminal review decision.
+
+    Fail closed: unknown decisions stop the run with no further mutation.
+    """
+    normalized = (decision or "").strip().lower()
+
+    if normalized not in _TERMINAL_DECISIONS:
+        return {
+            "outcome": STOP_GATE_NOT_PROVEN,
+            "further_mutation_allowed": False,
+            "reasons": [
+                f"unknown terminal decision {decision!r}; cleanup run stops "
+                "(fail closed)"
+            ],
+        }
+
+    if normalized == "request_changes":
+        return {
+            "outcome": STOP_AFTER_REQUEST_CHANGES,
+            "further_mutation_allowed": False,
+            "reasons": ["REQUEST_CHANGES is terminal in cleanup mode"],
+        }
+
+    if normalized in {"comment", "skip"}:
+        return {
+            "outcome": STOP_AFTER_DECISION,
+            "further_mutation_allowed": False,
+            "reasons": [f"{normalized} decision ends the cleanup run"],
+        }
+
+    # normalized == "approved"
+    if merge_completed:
+        return {
+            "outcome": STOP_AFTER_MERGE,
+            "further_mutation_allowed": False,
+            "reasons": ["merge completed; cleanup run stops"],
+        }
+    if merge_blocker:
+        return {
+            "outcome": STOP_AFTER_MERGE_BLOCKER,
+            "further_mutation_allowed": False,
+            "reasons": ["merge blocker recorded; cleanup run stops"],
+        }
+    if not merge_authorized_for_pr:
+        return {
+            "outcome": STOP_APPROVED_NO_MERGE_AUTH,
+            "further_mutation_allowed": False,
+            "reasons": [
+                "APPROVED without explicit per-PR merge authorization; "
+                "cleanup run stops"
+            ],
+        }
+    if merge_gates_passed is not True:
+        return {
+            "outcome": STOP_APPROVED_MERGE_GATES_FAILED,
+            "further_mutation_allowed": False,
+            "reasons": [
+                "merge gates not proven passed; cleanup run stops before merge"
+            ],
+        }
+    return {
+        "outcome": CONTINUE_TO_SAME_PR_MERGE,
+        "further_mutation_allowed": True,
+        "reasons": [],
+        "allowed_mutation": "merge same PR only",
+    }
+
+
+def check_cleanup_task_allowed(task: str) -> tuple[bool, list[str]]:
+    """Fail closed on any author-side mutation task inside cleanup mode."""
+    normalized = (task or "").strip().lower()
+    if normalized in CLEANUP_FORBIDDEN_TASKS:
+        return False, [
+            f"task '{normalized}' is forbidden in PR-only cleanup mode: "
+            "no issue claiming, branch creation, implementation edits, or "
+            "issue filing"
+        ]
+    return True, []
+
+
+_SELECTED_PR_RE = re.compile(
+    r"^\s*[-*]?\s*selected pr\s*:\s*#?(\d+)", re.IGNORECASE | re.MULTILINE
+)
+_NEXT_SUGGESTED_RE = re.compile(
+    r"^\s*[-*]?\s*next suggested pr\s*:", re.IGNORECASE | re.MULTILINE
+)
+_TERMINAL_MUTATION_RE = re.compile(
+    r"^\s*[-*]?\s*(?:review (?:decision|verdict)|terminal (?:review )?"
+    r"(?:decision|mutation))\s*:\s*"
+    r"(approved|request_changes|request changes|merged|comment)",
+    re.IGNORECASE | re.MULTILINE,
+)
+_PAGINATION_HINT_RE = re.compile(
+    r"inventory_complete|final page|has_more\s*[=:]\s*false|total[_ ]count",
+    re.IGNORECASE,
+)
+_MERGE_RESULT_RE = re.compile(
+    r"^\s*[-*]?\s*merge result\s*:\s*(?!none\b|not attempted\b)\S",
+    re.IGNORECASE | re.MULTILINE,
+)
+_MERGE_AUTHORIZED_RE = re.compile(
+    r"^\s*[-*]?\s*merge authorized(?: for pr)?\s*:\s*true",
+    re.IGNORECASE | re.MULTILINE,
+)
+_ISSUE_MUTATION_CLAIM_RE = re.compile(
+    r"^\s*[-*]?\s*issue mutations\s*:\s*(?!none\b)\S",
+    re.IGNORECASE | re.MULTILINE,
+)
+_BRANCH_MUTATION_CLAIM_RE = re.compile(
+    r"^\s*[-*]?\s*branch mutations\s*:\s*(?!none\b)\S",
+    re.IGNORECASE | re.MULTILINE,
+)
+
+
+def assess_pr_queue_cleanup_report(report_text: str) -> dict:
+    """Validate a PR-only cleanup run report (single dispatch, fail closed)."""
+    reasons: list[str] = []
+    text = report_text or ""
+
+    if CLEANUP_WORKFLOW_PATH not in text:
+        reasons.append(
+            f"report must cite the canonical cleanup workflow "
+            f"({CLEANUP_WORKFLOW_PATH})"
+        )
+
+    selected = _SELECTED_PR_RE.findall(text)
+    if len(selected) == 0:
+        reasons.append("report must name exactly one Selected PR")
+    elif len(set(selected)) > 1:
+        reasons.append(
+            "cleanup run selected multiple PRs "
+            f"({', '.join(sorted(set(selected)))}); one canonical review per "
+            "PR per run"
+        )
+
+    terminal = _TERMINAL_MUTATION_RE.findall(text)
+    if len(terminal) > 1:
+        reasons.append(
+            "multiple terminal review mutations reported in one cleanup run"
+        )
+
+    if not _PAGINATION_HINT_RE.search(text):
+        reasons.append(
+            "report missing PR inventory pagination proof "
+            "(inventory_complete / final page / total_count)"
+        )
+
+    if not _NEXT_SUGGESTED_RE.search(text):
+        reasons.append(
+            "report must include 'Next suggested PR' (without continuing to it)"
+        )
+
+    if _MERGE_RESULT_RE.search(text) and not _MERGE_AUTHORIZED_RE.search(text):
+        reasons.append(
+            "merge reported without explicit per-PR merge authorization "
+            "('Merge authorized: true')"
+        )
+
+    if _ISSUE_MUTATION_CLAIM_RE.search(text):
+        reasons.append("issue mutations are forbidden in PR-only cleanup mode")
+    if _BRANCH_MUTATION_CLAIM_RE.search(text):
+        reasons.append("branch mutations are forbidden in PR-only cleanup mode")
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "safe_next_action": (
+            "proceed" if proven else
+            "fix the cleanup report: one PR, one terminal mutation, pagination "
+            "proof, next-suggested-PR field, and no issue/branch mutations"
+        ),
+    }

pr_work_lease.py

@@ -0,0 +1,482 @@
+"""Conflict-fix and reviewer PR work leases (#399, #407 reader).
+
+Structured PR/issue comments prove exclusive phases so author conflict-fix
+pushes cannot race reviewer validation/approval/merge on the same head.
+"""
+
+from __future__ import annotations
+
+import re
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+REVIEWER_LEASE_MARKER = "<!-- mcp-review-lease:v1 -->"
+CONFLICT_FIX_LEASE_MARKER = "<!-- mcp-conflict-fix-lease:v1 -->"
+
+_FULL_SHA = re.compile(r"^[0-9a-f]{40}$", re.IGNORECASE)
+
+_FIELD_RE = re.compile(
+    r"^\s*([a-z_]+)\s*:\s*(.+?)\s*$",
+    re.IGNORECASE | re.MULTILINE,
+)
+
+_TERMINAL_REVIEWER_PHASES = frozenset({"done", "released", "blocked"})
+_ACTIVE_REVIEWER_PHASES = frozenset({
+    "claimed",
+    "validating",
+    "approved",
+    "request-changes",
+    "merging",
+})
+_TERMINAL_CONFLICT_FIX_PHASES = frozenset({"released", "blocked", "done"})
+_ACTIVE_CONFLICT_FIX_PHASES = frozenset({"claimed", "pushing", "pushed"})
+
+DEFAULT_CONFLICT_FIX_TTL_MINUTES = 120
+DEFAULT_REVIEWER_LEASE_TTL_MINUTES = 120
+
+
+def _parse_timestamp(value: str | None) -> datetime | None:
+    if not value:
+        return None
+    text = value.strip()
+    if text.endswith("Z"):
+        text = text[:-1] + "+00:00"
+    try:
+        parsed = datetime.fromisoformat(text)
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        return parsed.replace(tzinfo=timezone.utc)
+    return parsed.astimezone(timezone.utc)
+
+
+def _normalize_sha(value: str | None) -> str | None:
+    text = (value or "").strip().lower()
+    if not text:
+        return None
+    return text if _FULL_SHA.match(text) else None
+
+
+def _parse_pr_ref(value: str | None) -> int | None:
+    digits = re.sub(r"[^\d]", "", value or "")
+    return int(digits) if digits.isdigit() else None
+
+
+def _parse_marker_comment(body: str, marker: str) -> dict[str, str] | None:
+    text = body or ""
+    if marker not in text:
+        return None
+    fields: dict[str, str] = {}
+    for match in _FIELD_RE.finditer(text):
+        fields[match.group(1).strip().lower()] = match.group(2).strip()
+    return fields or None
+
+
+def parse_reviewer_lease_comment(body: str) -> dict[str, Any] | None:
+    fields = _parse_marker_comment(body, REVIEWER_LEASE_MARKER)
+    if not fields:
+        return None
+    return {
+        "lease_kind": "reviewer",
+        "pr_number": _parse_pr_ref(fields.get("pr")),
+        "issue_number": _parse_pr_ref(fields.get("issue")),
+        "reviewer_identity": fields.get("reviewer_identity"),
+        "profile": fields.get("profile"),
+        "session_id": fields.get("session_id"),
+        "worktree": fields.get("worktree"),
+        "phase": (fields.get("phase") or "").strip().lower() or None,
+        "candidate_head": _normalize_sha(fields.get("candidate_head")),
+        "target_branch": fields.get("target_branch"),
+        "target_branch_sha": _normalize_sha(fields.get("target_branch_sha")),
+        "last_activity": fields.get("last_activity"),
+        "expires_at": fields.get("expires_at"),
+        "blocker": fields.get("blocker"),
+        "raw_fields": fields,
+    }
+
+
+def parse_conflict_fix_lease_comment(body: str) -> dict[str, Any] | None:
+    fields = _parse_marker_comment(body, CONFLICT_FIX_LEASE_MARKER)
+    if not fields:
+        return None
+    ff = (fields.get("fast_forward") or "").strip().lower()
+    reviewer_active = (fields.get("reviewer_active") or "").strip().lower()
+    return {
+        "lease_kind": "conflict_fix",
+        "pr_number": _parse_pr_ref(fields.get("pr")),
+        "branch": fields.get("branch"),
+        "worktree": fields.get("worktree"),
+        "profile": fields.get("profile"),
+        "session_id": fields.get("session_id"),
+        "phase": (fields.get("phase") or "").strip().lower() or None,
+        "head_before": _normalize_sha(fields.get("head_before")),
+        "head_after": _normalize_sha(fields.get("head_after")),
+        "expires_at": fields.get("expires_at"),
+        "reviewer_active": reviewer_active in {"yes", "true", "1"},
+        "fast_forward": ff in {"yes", "true", "1"},
+        "raw_fields": fields,
+    }
+
+
+def _comment_entries(comments: list[dict], *, pr_number: int | None) -> list[dict]:
+    entries: list[dict] = []
+    for comment in comments or []:
+        body = comment.get("body") or ""
+        for parser in (parse_reviewer_lease_comment, parse_conflict_fix_lease_comment):
+            parsed = parser(body)
+            if not parsed:
+                continue
+            if pr_number is not None and parsed.get("pr_number") not in (None, pr_number):
+                continue
+            entries.append({
+                **parsed,
+                "comment_id": comment.get("id"),
+                "author": (comment.get("user") or {}).get("login") or comment.get("author"),
+                "created_at": comment.get("created_at"),
+                "updated_at": comment.get("updated_at"),
+            })
+            break
+    return entries
+
+
+def _lease_expired(lease: dict, *, now: datetime) -> bool:
+    expires_at = _parse_timestamp(lease.get("expires_at"))
+    return bool(expires_at and expires_at <= now)
+
+
+def _lease_phase_active(lease: dict, *, active_phases: frozenset[str]) -> bool:
+    phase = (lease.get("phase") or "").strip().lower()
+    if phase in _TERMINAL_REVIEWER_PHASES or phase in _TERMINAL_CONFLICT_FIX_PHASES:
+        return False
+    return phase in active_phases or bool(phase and phase not in (
+        _TERMINAL_REVIEWER_PHASES | _TERMINAL_CONFLICT_FIX_PHASES
+    ))
+
+
+def find_active_reviewer_lease(
+    comments: list[dict],
+    *,
+    pr_number: int,
+    now: datetime | None = None,
+) -> dict[str, Any] | None:
+    """Return the newest unexpired reviewer lease for *pr_number*, if any."""
+    now = now or datetime.now(timezone.utc)
+    candidates = [
+        entry for entry in _comment_entries(comments, pr_number=pr_number)
+        if entry.get("lease_kind") == "reviewer"
+    ]
+    for lease in reversed(candidates):
+        if _lease_expired(lease, now=now):
+            continue
+        phase = (lease.get("phase") or "").strip().lower()
+        if phase in _TERMINAL_REVIEWER_PHASES:
+            continue
+        if phase in _ACTIVE_REVIEWER_PHASES or phase:
+            return lease
+    return None
+
+
+def find_active_conflict_fix_lease(
+    comments: list[dict],
+    *,
+    pr_number: int,
+    now: datetime | None = None,
+) -> dict[str, Any] | None:
+    """Return the newest unexpired conflict-fix lease for *pr_number*, if any."""
+    now = now or datetime.now(timezone.utc)
+    candidates = [
+        entry for entry in _comment_entries(comments, pr_number=pr_number)
+        if entry.get("lease_kind") == "conflict_fix"
+    ]
+    for lease in reversed(candidates):
+        if _lease_expired(lease, now=now):
+            continue
+        phase = (lease.get("phase") or "").strip().lower()
+        if phase in _TERMINAL_CONFLICT_FIX_PHASES:
+            continue
+        if phase in _ACTIVE_CONFLICT_FIX_PHASES or phase:
+            return lease
+    return None
+
+
+def format_conflict_fix_lease_body(
+    *,
+    pr_number: int,
+    branch: str,
+    worktree: str,
+    profile: str,
+    head_before: str,
+    phase: str = "claimed",
+    session_id: str = "unknown",
+    expires_at: datetime | None = None,
+    reviewer_active: bool = False,
+) -> str:
+    expires = expires_at or (
+        datetime.now(timezone.utc) + timedelta(minutes=DEFAULT_CONFLICT_FIX_TTL_MINUTES)
+    )
+    expires_text = expires.astimezone(timezone.utc).replace(microsecond=0).isoformat().replace(
+        "+00:00", "Z"
+    )
+    lines = [
+        CONFLICT_FIX_LEASE_MARKER,
+        f"pr: #{pr_number}",
+        f"branch: {branch}",
+        f"worktree: {worktree}",
+        f"profile: {profile}",
+        f"session_id: {session_id}",
+        f"phase: {phase}",
+        f"head_before: {head_before}",
+        f"expires_at: {expires_text}",
+        f"reviewer_active: {'yes' if reviewer_active else 'no'}",
+    ]
+    return "\n".join(lines)
+
+
+def assess_head_sha_equality(
+    reviewed_head_sha: str | None,
+    live_head_sha: str | None,
+) -> dict[str, Any]:
+    """Fail closed when reviewed and live PR heads differ."""
+    reviewed = _normalize_sha(reviewed_head_sha)
+    live = _normalize_sha(live_head_sha)
+    reasons: list[str] = []
+    if not reviewed or not live:
+        reasons.append(
+            "reviewed/live head SHA missing or not full 40-hex; fail closed"
+        )
+    elif reviewed != live:
+        reasons.append(
+            "PR head changed after validation; re-pin and re-validate before "
+            "approval or merge"
+        )
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "reviewed_head_sha": reviewed,
+        "live_head_sha": live,
+        "head_changed": bool(reviewed and live and reviewed != live),
+    }
+
+
+def assess_conflict_fix_push(
+    *,
+    pr_number: int,
+    comments: list[dict],
+    branch_head_before: str | None,
+    branch_head_after: str | None,
+    worktree_path: str | None,
+    push_cwd: str | None,
+    is_fast_forward: bool | None,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    """Author pre-push gate: block when a reviewer holds an active lease."""
+    now = now or datetime.now(timezone.utc)
+    reasons: list[str] = []
+    reviewer_lease = find_active_reviewer_lease(comments, pr_number=pr_number, now=now)
+    conflict_lease = find_active_conflict_fix_lease(comments, pr_number=pr_number, now=now)
+
+    if reviewer_lease:
+        reasons.append(
+            f"active reviewer lease on PR #{pr_number} "
+            f"(phase={reviewer_lease.get('phase')}); author push blocked"
+        )
+
+    head_before = _normalize_sha(branch_head_before)
+    head_after = _normalize_sha(branch_head_after)
+    if not head_before:
+        reasons.append("branch head before push missing or invalid SHA")
+    if head_after and head_before and head_before == head_after:
+        reasons.append("branch head unchanged; no push to perform")
+
+    worktree = (worktree_path or "").strip()
+    cwd = (push_cwd or "").strip()
+    if not worktree:
+        reasons.append("worktree path required for conflict-fix push proof")
+    elif cwd and worktree and not cwd.rstrip("/").endswith(worktree.rstrip("/").split("/")[-1]):
+        if worktree not in cwd:
+            reasons.append(
+                f"push cwd '{cwd}' does not match session worktree '{worktree}'"
+            )
+
+    if is_fast_forward is False:
+        reasons.append("non-fast-forward push rejected for conflict-fix (fail closed)")
+
+    if conflict_lease and conflict_lease.get("phase") == "pushing":
+        owner = conflict_lease.get("worktree")
+        if owner and worktree and owner != worktree:
+            reasons.append(
+                f"sibling conflict-fix lease active from worktree '{owner}'"
+            )
+
+    push_allowed = not reasons
+    return {
+        "push_allowed": push_allowed,
+        "block": not push_allowed,
+        "reasons": reasons,
+        "active_reviewer_lease": reviewer_lease,
+        "active_conflict_fix_lease": conflict_lease,
+        "branch_head_before": head_before,
+        "branch_head_after": head_after,
+        "reviewer_was_active": bool(reviewer_lease),
+        "fast_forward": is_fast_forward,
+    }
+
+
+def assess_reviewer_mutation_blocked(
+    *,
+    pr_number: int,
+    comments: list[dict],
+    reviewed_head_sha: str | None,
+    live_head_sha: str | None,
+    mutation: str,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    """Reviewer gate: block when conflict-fix lease active or head moved."""
+    now = now or datetime.now(timezone.utc)
+    reasons: list[str] = []
+    conflict_lease = find_active_conflict_fix_lease(comments, pr_number=pr_number, now=now)
+    if conflict_lease and (conflict_lease.get("phase") or "") in _ACTIVE_CONFLICT_FIX_PHASES:
+        reasons.append(
+            f"active conflict-fix lease on PR #{pr_number} "
+            f"(phase={conflict_lease.get('phase')}); reviewer {mutation} blocked"
+        )
+
+    head_check = assess_head_sha_equality(reviewed_head_sha, live_head_sha)
+    if head_check["block"]:
+        reasons.extend(head_check["reasons"])
+
+    if not _normalize_sha(reviewed_head_sha):
+        reasons.append(
+            f"reviewed head SHA required before reviewer {mutation} (fail closed)"
+        )
+
+    allowed = not reasons
+    return {
+        "mutation_allowed": allowed,
+        "block": not allowed,
+        "reasons": reasons,
+        "active_conflict_fix_lease": conflict_lease,
+        "head_check": head_check,
+        "reviewed_head_sha": head_check.get("reviewed_head_sha"),
+        "live_head_sha": head_check.get("live_head_sha"),
+        "push_during_validation": bool(
+            conflict_lease and conflict_lease.get("phase") in {"pushing", "pushed"}
+        ),
+    }
+
+
+_REVIEWED_HEAD_RE = re.compile(
+    r"reviewed head sha\s*:\s*([0-9a-f]{40})",
+    re.IGNORECASE,
+)
+_LIVE_HEAD_BEFORE_APPROVAL_RE = re.compile(
+    r"(?:live head sha before approval|final live head sha before approval)\s*:\s*([0-9a-f]{40})",
+    re.IGNORECASE,
+)
+_LIVE_HEAD_BEFORE_MERGE_RE = re.compile(
+    r"(?:live head sha before merge|final live head sha before merge)\s*:\s*([0-9a-f]{40})",
+    re.IGNORECASE,
+)
+_PUSH_DURING_VALIDATION_RE = re.compile(
+    r"push(?:es)? occurred during validation\s*:\s*(yes|no|true|false)",
+    re.IGNORECASE,
+)
+_CONFLICT_HEAD_BEFORE_RE = re.compile(
+    r"branch head before push\s*:\s*([0-9a-f]{40})",
+    re.IGNORECASE,
+)
+_CONFLICT_HEAD_AFTER_RE = re.compile(
+    r"branch head after push\s*:\s*([0-9a-f]{40})",
+    re.IGNORECASE,
+)
+_REVIEWER_LEASE_STATUS_RE = re.compile(
+    r"active reviewer lease status\s*:\s*(.+)$",
+    re.IGNORECASE | re.MULTILINE,
+)
+_FAST_FORWARD_RE = re.compile(
+    r"whether push was fast-forward\s*:\s*(yes|no|true|false)",
+    re.IGNORECASE,
+)
+_REVIEWER_ACTIVE_RE = re.compile(
+    r"whether any reviewer was active\s*:\s*(yes|no|true|false)",
+    re.IGNORECASE,
+)
+
+
+def assess_reviewer_stale_head_final_report(report_text: str) -> dict[str, Any]:
+    """Final-report proof for reviewed vs live head SHAs (#399 AC 6)."""
+    text = report_text or ""
+    reasons: list[str] = []
+    reviewed = _normalize_sha(_REVIEWED_HEAD_RE.search(text).group(1) if _REVIEWED_HEAD_RE.search(text) else None)
+    live_approval = _normalize_sha(
+        _LIVE_HEAD_BEFORE_APPROVAL_RE.search(text).group(1)
+        if _LIVE_HEAD_BEFORE_APPROVAL_RE.search(text)
+        else None
+    )
+    live_merge = _normalize_sha(
+        _LIVE_HEAD_BEFORE_MERGE_RE.search(text).group(1)
+        if _LIVE_HEAD_BEFORE_MERGE_RE.search(text)
+        else None
+    )
+    push_during = _PUSH_DURING_VALIDATION_RE.search(text)
+
+    if not reviewed:
+        reasons.append("reviewed head SHA not stated in final report")
+    if not live_approval:
+        reasons.append("final live head SHA before approval not stated")
+    if not live_merge:
+        reasons.append("final live head SHA before merge not stated")
+    if not push_during:
+        reasons.append("whether push occurred during validation not stated")
+    elif reviewed and live_approval and reviewed != live_approval:
+        reasons.append("live head before approval differs from reviewed head SHA")
+    elif reviewed and live_merge and reviewed != live_merge:
+        reasons.append("live head before merge differs from reviewed head SHA")
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "reviewed_head_sha": reviewed,
+        "live_head_sha_before_approval": live_approval,
+        "live_head_sha_before_merge": live_merge,
+        "push_during_validation": (push_during.group(1).lower() if push_during else None),
+    }
+
+
+def assess_conflict_fix_final_report(report_text: str) -> dict[str, Any]:
+    """Final-report proof for conflict-fix push sessions (#399 AC 7)."""
+    text = report_text or ""
+    reasons: list[str] = []
+    head_before = _normalize_sha(
+        _CONFLICT_HEAD_BEFORE_RE.search(text).group(1)
+        if _CONFLICT_HEAD_BEFORE_RE.search(text)
+        else None
+    )
+    head_after = _normalize_sha(
+        _CONFLICT_HEAD_AFTER_RE.search(text).group(1)
+        if _CONFLICT_HEAD_AFTER_RE.search(text)
+        else None
+    )
+    if not head_before:
+        reasons.append("branch head before push not stated")
+    if not head_after:
+        reasons.append("branch head after push not stated")
+    if not _REVIEWER_LEASE_STATUS_RE.search(text):
+        reasons.append("active reviewer lease status not stated")
+    if not _FAST_FORWARD_RE.search(text):
+        reasons.append("whether push was fast-forward not stated")
+    if not _REVIEWER_ACTIVE_RE.search(text):
+        reasons.append("whether any reviewer was active not stated")
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "branch_head_before": head_before,
+        "branch_head_after": head_after,
+    }

reconciler_profile.py

@@ -0,0 +1,94 @@
+"""Reconciler profile model for already-landed PR closure (#304).
+
+Defines the narrowly scoped operation set for a dedicated reconciler profile
+such as ``prgs-reconciler``. Close MCP tooling and ancestry gates ship in the
+#310 stack; this module validates profile shape only.
+"""
+
+from __future__ import annotations
+
+import gitea_config
+
+RECONCILER_REQUIRED_OPERATIONS = (
+    "gitea.read",
+    "gitea.pr.close",
+)
+
+RECONCILER_RECOMMENDED_OPERATIONS = (
+    "gitea.pr.comment",
+    "gitea.issue.comment",
+    "gitea.issue.close",
+)
+
+RECONCILER_FORBIDDEN_OPERATIONS = (
+    "gitea.pr.approve",
+    "gitea.pr.merge",
+    "gitea.pr.review",
+    "gitea.pr.create",
+    "gitea.branch.push",
+    "gitea.repo.commit",
+)
+
+
+def _normalized_allowed(allowed: list[str]) -> set[str]:
+    normalized: set[str] = set()
+    for entry in allowed or []:
+        try:
+            normalized.add(gitea_config.normalize_operation(entry))
+        except gitea_config.ConfigError:
+            continue
+    return normalized
+
+
+def _forbidden_in_allowed(allowed: list[str], ops: tuple[str, ...]) -> list[str]:
+    """Return forbidden ops that are explicitly listed in *allowed*."""
+    allowed_n = _normalized_allowed(allowed)
+    present: list[str] = []
+    for op in ops:
+        try:
+            if gitea_config.normalize_operation(op) in allowed_n:
+                present.append(op)
+        except gitea_config.ConfigError:
+            continue
+    return present
+
+
+def is_reconciler_profile(allowed: list[str], forbidden: list[str]) -> bool:
+    """Return True when *allowed*/*forbidden* describe a reconciler profile."""
+    def can(op: str) -> bool:
+        return gitea_config.check_operation(op, allowed, forbidden)[0]
+
+    if not can("gitea.pr.close"):
+        return False
+    if _forbidden_in_allowed(allowed, RECONCILER_FORBIDDEN_OPERATIONS):
+        return False
+    return True
+
+
+def assess_reconciler_profile(allowed: list[str], forbidden: list[str]) -> dict:
+    """Validate reconciler profile operations (read-only, fail closed)."""
+    allowed = list(allowed or [])
+    forbidden = list(forbidden or [])
+    reasons: list[str] = []
+
+    for op in RECONCILER_REQUIRED_OPERATIONS:
+        ok, _ = gitea_config.check_operation(op, allowed, forbidden)
+        if not ok:
+            reasons.append(f"missing required operation {op}")
+
+    for op in _forbidden_in_allowed(allowed, RECONCILER_FORBIDDEN_OPERATIONS):
+        reasons.append(f"forbidden operation must not be allowed: {op}")
+
+    missing_recommended = [
+        op for op in RECONCILER_RECOMMENDED_OPERATIONS
+        if not gitea_config.check_operation(op, allowed, forbidden)[0]
+    ]
+
+    return {
+        "is_reconciler_profile": is_reconciler_profile(allowed, forbidden),
+        "valid": not reasons and is_reconciler_profile(allowed, forbidden),
+        "reasons": reasons,
+        "missing_recommended_operations": missing_recommended,
+        "required_operations": list(RECONCILER_REQUIRED_OPERATIONS),
+        "forbidden_operations": list(RECONCILER_FORBIDDEN_OPERATIONS),
+    }

reconciliation_workflow.py

@@ -0,0 +1,292 @@
+"""Already-landed PR reconciliation workflow helpers (#301).
+
+Read-only assessment and capability planning for reconciling open PRs whose
+heads are already ancestors of the target branch. Does not invoke review or
+merge paths.
+"""
+
+from __future__ import annotations
+
+import subprocess
+from typing import Any
+
+import gitea_config
+from merged_cleanup_reconcile import extract_linked_issue, is_head_ancestor_of_ref
+
+ELIGIBILITY_ALREADY_LANDED = "ALREADY_LANDED_RECONCILE_REQUIRED"
+ELIGIBILITY_NOT_LANDED = "NOT_ALREADY_LANDED"
+ELIGIBILITY_STALE_TARGET = "TARGET_BRANCH_UNVERIFIED"
+ELIGIBILITY_PR_NOT_OPEN = "PR_NOT_OPEN"
+
+OUTCOME_FULL_RECONCILE = "FULL_RECONCILE_CLOSE_ALLOWED"
+OUTCOME_PARTIAL_COMMENT = "PARTIAL_RECONCILE_COMMENT_THEN_STOP"
+OUTCOME_RECOVERY_HANDOFF = "RECOVERY_HANDOFF_ONLY"
+OUTCOME_NOT_LANDED = "NOT_LANDED_NO_ACTION"
+OUTCOME_GATE_NOT_PROVEN = "GATE_NOT_PROVEN"
+
+RECONCILE_WORKFLOW_MARKERS = (
+    "workflows/reconcile-landed-pr.md",
+    "reconcile-landed-pr.md",
+)
+
+RECONCILE_TASK_MARKERS = (
+    "reconcile-landed-pr",
+    "reconcile already-landed",
+    "reconcile_already_landed",
+)
+
+
+def fetch_target_branch(project_root: str, remote: str, branch: str) -> dict[str, Any]:
+    """Fetch *branch* from *remote* and return the resolved SHA."""
+    ref = f"{remote}/{branch}"
+    fetch = subprocess.run(
+        ["git", "-C", project_root, "fetch", remote, branch],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if fetch.returncode != 0:
+        return {
+            "success": False,
+            "target_branch": branch,
+            "target_ref": ref,
+            "target_branch_sha": None,
+            "reasons": [
+                f"git fetch {remote} {branch} failed: "
+                f"{(fetch.stderr or fetch.stdout or '').strip()}"
+            ],
+        }
+
+    rev = subprocess.run(
+        ["git", "-C", project_root, "rev-parse", ref],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if rev.returncode != 0:
+        return {
+            "success": False,
+            "target_branch": branch,
+            "target_ref": ref,
+            "target_branch_sha": None,
+            "reasons": [
+                f"git rev-parse {ref} failed: "
+                f"{(rev.stderr or rev.stdout or '').strip()}"
+            ],
+        }
+
+    return {
+        "success": True,
+        "target_branch": branch,
+        "target_ref": ref,
+        "target_branch_sha": (rev.stdout or "").strip(),
+        "reasons": [],
+        "git_fetch_command": f"git fetch {remote} {branch}",
+    }
+
+
+def profile_reconciliation_capabilities(
+    allowed: list[str] | None,
+    forbidden: list[str] | None,
+) -> dict[str, bool]:
+    """Map active profile operations to reconciliation capabilities."""
+    allowed = allowed or []
+    forbidden = forbidden or []
+
+    def can(op: str) -> bool:
+        return gitea_config.check_operation(op, allowed, forbidden)[0]
+
+    return {
+        "read": can("gitea.read"),
+        "comment_pr": can("gitea.pr.comment"),
+        "comment_issue": can("gitea.issue.comment"),
+        "close_pr": can("gitea.pr.close"),
+        "close_issue": can("gitea.issue.close"),
+        "review_pr": can("gitea.pr.review") or can("gitea.pr.approve"),
+        "merge_pr": can("gitea.pr.merge"),
+    }
+
+
+def assess_open_pr_reconciliation(
+    *,
+    pr: dict[str, Any],
+    project_root: str,
+    remote: str,
+    target_branch: str,
+    target_fetch: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    """Assess whether an open PR is eligible for already-landed reconciliation."""
+    pr_number = int(pr.get("number") or 0)
+    pr_state = (pr.get("state") or "").strip().lower()
+    head = pr.get("head") or {}
+    head_sha = head.get("sha") if isinstance(head, dict) else None
+    head_ref = head.get("ref") if isinstance(head, dict) else None
+    base = pr.get("base") or {}
+    base_ref = base.get("ref") if isinstance(base, dict) else None
+    title = pr.get("title") or ""
+    body = pr.get("body") or ""
+
+    fetch_result = target_fetch or fetch_target_branch(
+        project_root, remote, target_branch
+    )
+    linked_issue = extract_linked_issue(title, body)
+
+    result: dict[str, Any] = {
+        "pr_number": pr_number,
+        "pr_state": pr_state,
+        "candidate_head_sha": head_sha,
+        "head_ref": head_ref,
+        "base_ref": base_ref or target_branch,
+        "target_branch": target_branch,
+        "target_branch_sha": fetch_result.get("target_branch_sha"),
+        "linked_issue": linked_issue,
+        "git_ref_mutations": [],
+        "reasons": [],
+        "review_merge_allowed": False,
+    }
+    if fetch_result.get("git_fetch_command"):
+        result["git_ref_mutations"].append(fetch_result["git_fetch_command"])
+
+    if pr_state != "open":
+        result["eligibility_class"] = ELIGIBILITY_PR_NOT_OPEN
+        result["ancestor_proof"] = None
+        result["reconciliation_allowed"] = False
+        result["reasons"].append(f"PR #{pr_number} state is {pr_state!r}, not open")
+        return result
+
+    if not fetch_result.get("success"):
+        result["eligibility_class"] = ELIGIBILITY_STALE_TARGET
+        result["ancestor_proof"] = None
+        result["reconciliation_allowed"] = False
+        result["reasons"].extend(fetch_result.get("reasons") or [])
+        return result
+
+    target_ref = fetch_result.get("target_ref") or f"{remote}/{target_branch}"
+    ancestor = is_head_ancestor_of_ref(project_root, head_sha, target_ref)
+    result["ancestor_proof"] = ancestor
+
+    if ancestor is None:
+        result["eligibility_class"] = ELIGIBILITY_STALE_TARGET
+        result["reconciliation_allowed"] = False
+        result["reasons"].append(
+            f"ancestor check failed for head {head_sha!r} against {target_ref}"
+        )
+        return result
+
+    if ancestor:
+        result["eligibility_class"] = ELIGIBILITY_ALREADY_LANDED
+        result["reconciliation_allowed"] = True
+        return result
+
+    result["eligibility_class"] = ELIGIBILITY_NOT_LANDED
+    result["reconciliation_allowed"] = False
+    result["reasons"].append(
+        f"PR head {head_sha} is not an ancestor of {target_ref}"
+    )
+    return result
+
+
+def resolve_reconciliation_plan(
+    *,
+    assessment: dict[str, Any],
+    capabilities: dict[str, bool] | None,
+) -> dict[str, Any]:
+    """Map eligibility + profile capabilities to a reconciliation outcome."""
+    caps = capabilities or {}
+    reasons: list[str] = []
+
+    if not assessment.get("reconciliation_allowed"):
+        outcome = OUTCOME_NOT_LANDED
+        if assessment.get("eligibility_class") in {
+            ELIGIBILITY_STALE_TARGET,
+            ELIGIBILITY_PR_NOT_OPEN,
+        }:
+            outcome = OUTCOME_GATE_NOT_PROVEN
+        reasons.extend(assessment.get("reasons") or [])
+        return {
+            "outcome": outcome,
+            "close_pr_allowed": False,
+            "comment_pr_allowed": False,
+            "close_issue_allowed": False,
+            "comment_issue_allowed": False,
+            "review_merge_allowed": False,
+            "missing_capabilities": _missing_reconciliation_capabilities(caps),
+            "safe_next_action": (
+                "Do not reconcile via review/merge; repair missing proof first."
+            ),
+            "reasons": reasons,
+        }
+
+    close_pr = bool(caps.get("close_pr"))
+    comment_pr = bool(caps.get("comment_pr"))
+    close_issue = bool(caps.get("close_issue"))
+    comment_issue = bool(caps.get("comment_issue"))
+
+    if caps.get("review_pr") or caps.get("merge_pr"):
+        reasons.append(
+            "reconciliation path must not use review/merge capabilities"
+        )
+
+    if close_pr:
+        outcome = OUTCOME_FULL_RECONCILE
+        safe_next_action = (
+            "Run reconciliation close via exact gitea.pr.close after proof; "
+            "do not approve or merge."
+        )
+    elif comment_pr:
+        outcome = OUTCOME_PARTIAL_COMMENT
+        safe_next_action = (
+            "Post one reconciliation comment with ancestor proof, then stop "
+            "for an authorized close profile."
+        )
+    else:
+        outcome = OUTCOME_RECOVERY_HANDOFF
+        safe_next_action = (
+            "Produce a recovery handoff naming missing gitea.pr.close and/or "
+            "gitea.pr.comment; do not loop through review/merge."
+        )
+        reasons.append("gitea.pr.close is not available in the active profile")
+
+    return {
+        "outcome": outcome,
+        "close_pr_allowed": close_pr,
+        "comment_pr_allowed": comment_pr,
+        "close_issue_allowed": close_issue,
+        "comment_issue_allowed": comment_issue,
+        "review_merge_allowed": False,
+        "missing_capabilities": _missing_reconciliation_capabilities(caps),
+        "safe_next_action": safe_next_action,
+        "reasons": reasons,
+    }
+
+
+def _missing_reconciliation_capabilities(caps: dict[str, bool]) -> list[str]:
+    missing = []
+    if not caps.get("read"):
+        missing.append("gitea.read")
+    if not caps.get("close_pr"):
+        missing.append("gitea.pr.close")
+    if not caps.get("comment_pr"):
+        missing.append("gitea.pr.comment")
+    return missing
+
+
+def assess_reconcile_workflow_source(report_text: str) -> dict[str, Any]:
+    """Reconciliation reports must cite the canonical workflow file."""
+    lower = (report_text or "").lower()
+    reasons = []
+    if not any(marker in lower for marker in RECONCILE_WORKFLOW_MARKERS):
+        reasons.append(
+            "reconciliation report missing workflow source "
+            "(workflows/reconcile-landed-pr.md)"
+        )
+    if not any(marker in lower for marker in RECONCILE_TASK_MARKERS):
+        reasons.append(
+            "reconciliation report missing task mode declaration "
+            "(reconcile-landed-pr)"
+        )
+    return {
+        "complete": not reasons,
+        "downgraded": bool(reasons),
+        "reasons": reasons,
+    }

review_final_report_schema.py

@@ -0,0 +1,321 @@
+"""Reviewer final-report schema verification before session output (#391).
+
+Composes the composable ``assess_final_report_validator`` (#327) with
+review-specific schema gates required before a reviewer session completes.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from final_report_validator import (
+    assess_final_report_validator,
+    validator_finding,
+    _handoff_fields,
+)
+
+_LEGACY_STALE_FIELDS = (
+    "pinned reviewed head",
+    "scratch worktree used",
+    "workspace mutations",
+)
+
+_REVIEWED_HEAD_RE = re.compile(
+    r"(?:pinned reviewed head|reviewed head sha)\s*:\s*([0-9a-f]{7,40})",
+    re.IGNORECASE,
+)
+_VALIDATION_PASS_RE = re.compile(
+    r"validation\s*:\s*(?:pass|passed|strong|ok|green)",
+    re.IGNORECASE,
+)
+_MERGED_CLAIM_RE = re.compile(
+    r"\b(?:merged|merge result\s*:\s*merged|pr\s+#\d+\s+merged)\b",
+    re.IGNORECASE,
+)
+_MERGE_RESULT_RE = re.compile(r"merge result\s*:", re.IGNORECASE)
+_ANCESTRY_PROOF_RE = re.compile(
+    r"(?:ancestor proof|target branch sha|merge commit)",
+    re.IGNORECASE,
+)
+_ISSUE_CLOSED_RE = re.compile(
+    r"(?:linked issue(?:\s+live)?\s+status\s*:\s*closed|issue\s+#\d+\s+closed)",
+    re.IGNORECASE,
+)
+_LIVE_ISSUE_PROOF_RE = re.compile(
+    r"gitea_view_issue|(?:issue|linked issue).{0,40}fetched live|live fetch proof",
+    re.IGNORECASE,
+)
+_FULL_SUITE_PASS_RE = re.compile(
+    r"(?:full suite passed|full test suite passed|\d+\s+passed,\s*0\s+failed)",
+    re.IGNORECASE,
+)
+_TESTS_IGNORED_RE = re.compile(
+    r"(?:ignored tests|tests?\s+ignored|skipped tests|not run|tests?\s+skipped)",
+    re.IGNORECASE,
+)
+_BLOCKED_HANDOFF_RE = re.compile(
+    r"(?:blocker\s*:|recovery handoff|infra_stop|capability stop|mutation blocked)",
+    re.IGNORECASE,
+)
+_REPLAY_COMMAND_RE = re.compile(
+    r"(?:gitea_submit_pr_review|gitea_merge_pr|gitea_review_pr|"
+    r"submitted\s+['\"]approve['\"]|replay approve|replay merge)",
+    re.IGNORECASE,
+)
+_PENDING_RE = re.compile(r"\bPENDING\b", re.IGNORECASE)
+_APPROVED_RE = re.compile(
+    r"(?:review decision\s*:\s*approve|submitted\s+approve|official review submitted)",
+    re.IGNORECASE,
+)
+_DRY_RUN_RE = re.compile(r"dry[- ]run", re.IGNORECASE)
+_FINDING_READY_RE = re.compile(
+    r"(?:finding ready|ready to submit|not yet submitted)",
+    re.IGNORECASE,
+)
+_NARRATIVE_APPROVE_RE = re.compile(
+    r"(?:^|\n)\s*(?:##\s+)?(?:summary|verdict|recommendation)\b[^\n]*\bapprove\b",
+    re.IGNORECASE | re.MULTILINE,
+)
+_HANDOFF_DECISION_RE = re.compile(
+    r"review decision\s*:\s*(\w+)",
+    re.IGNORECASE,
+)
+
+
+def _rule_legacy_stale_fields(report_text: str) -> list[dict[str, str]]:
+    fields = _handoff_fields(report_text)
+    findings: list[dict[str, str]] = []
+    for stale in _LEGACY_STALE_FIELDS:
+        if stale in fields and fields[stale].lower() not in {"", "none", "n/a"}:
+            findings.append(
+                validator_finding(
+                    "reviewer.legacy_stale_field",
+                    "block",
+                    stale.title(),
+                    f"legacy or stale handoff field '{stale}' must not appear in "
+                    "canonical reviewer final reports",
+                    "remove stale fields; use Candidate head SHA and precise "
+                    "mutation categories instead",
+                )
+            )
+    return findings
+
+
+def _rule_reviewed_head_without_validation(report_text: str) -> list[dict[str, str]]:
+    text = report_text or ""
+    if not _REVIEWED_HEAD_RE.search(text):
+        return []
+    if _VALIDATION_PASS_RE.search(text):
+        return []
+    return [
+        validator_finding(
+            "reviewer.reviewed_head_without_validation",
+            "block",
+            "Pinned reviewed head",
+            "reviewed/pinned head SHA reported without validation pass proof",
+            "document validation command, cwd, and pass result before pinning head SHA",
+        )
+    ]
+
+
+def _rule_merged_without_proof(report_text: str) -> list[dict[str, str]]:
+    text = report_text or ""
+    if not _MERGED_CLAIM_RE.search(text):
+        return []
+    if _MERGE_RESULT_RE.search(text) and _ANCESTRY_PROOF_RE.search(text):
+        return []
+    return [
+        validator_finding(
+            "reviewer.merged_without_proof",
+            "block",
+            "Merge result",
+            "merged outcome claimed without merge result and target ancestry proof",
+            "include Merge result, target branch SHA, and ancestor proof before claiming merged",
+        )
+    ]
+
+
+def _rule_issue_closed_without_live_proof(report_text: str) -> list[dict[str, str]]:
+    text = report_text or ""
+    if not _ISSUE_CLOSED_RE.search(text):
+        return []
+    fields = _handoff_fields(text)
+    status_value = fields.get("linked issue live status", "")
+    readonly_value = fields.get("read-only diagnostics", "")
+    proof_blob = f"{status_value} {readonly_value}".lower()
+    if _LIVE_ISSUE_PROOF_RE.search(proof_blob):
+        return []
+    return [
+        validator_finding(
+            "reviewer.issue_closed_without_live_proof",
+            "block",
+            "Linked issue",
+            "issue closed claimed without live linked-issue verification proof",
+            "fetch linked issue live (gitea_view_issue) and record Linked issue live status",
+        )
+    ]
+
+
+def _rule_full_suite_pass_ignored_tests(report_text: str) -> list[dict[str, str]]:
+    text = report_text or ""
+    if not (_FULL_SUITE_PASS_RE.search(text) and _TESTS_IGNORED_RE.search(text)):
+        return []
+    if re.search(r"explicitly\s+(?:ignored|skipped)", text, re.IGNORECASE):
+        return []
+    return [
+        validator_finding(
+            "reviewer.full_suite_pass_ignored_tests",
+            "block",
+            "Validation",
+            "full suite pass claimed while tests were ignored or skipped without "
+            "explicit disclosure",
+            "state which tests were ignored/skipped or downgrade validation verdict",
+        )
+    ]
+
+
+def _rule_blocked_handoff_replay(report_text: str) -> list[dict[str, str]]:
+    text = report_text or ""
+    if not _BLOCKED_HANDOFF_RE.search(text):
+        return []
+    if not _REPLAY_COMMAND_RE.search(text):
+        return []
+    return [
+        validator_finding(
+            "reviewer.blocked_handoff_replay",
+            "block",
+            "Safe next action",
+            "blocked recovery handoff includes direct approve or merge replay commands",
+            "restart the full workflow after the blocker clears; do not replay mutations",
+        )
+    ]
+
+
+def _rule_narrative_handoff_drift(report_text: str) -> list[dict[str, str]]:
+    text = report_text or ""
+    narrative_approve = bool(_NARRATIVE_APPROVE_RE.search(text))
+    decision_match = _HANDOFF_DECISION_RE.search(text)
+    if not narrative_approve or not decision_match:
+        return []
+    handoff_decision = decision_match.group(1).strip().lower()
+    if handoff_decision in {"approve", "approved"}:
+        return []
+    return [
+        validator_finding(
+            "reviewer.narrative_handoff_drift",
+            "block",
+            "Review decision",
+            f"narrative approves PR but controller handoff says '{handoff_decision}'",
+            "align narrative summary with controller handoff Review decision field",
+        )
+    ]
+
+
+def _rule_review_state_ambiguous(report_text: str) -> list[dict[str, str]]:
+    text = report_text or ""
+    findings: list[dict[str, str]] = []
+    if _PENDING_RE.search(text) and _APPROVED_RE.search(text):
+        findings.append(
+            validator_finding(
+                "reviewer.pending_vs_approved",
+                "block",
+                "Review decision",
+                "report conflates PENDING review state with APPROVED outcome",
+                "distinguish official submitted review from pending or ready-to-submit state",
+            )
+        )
+    if _DRY_RUN_RE.search(text) and _APPROVED_RE.search(text):
+        if "dry-run only" not in text.lower():
+            findings.append(
+                validator_finding(
+                    "reviewer.dry_run_vs_submitted",
+                    "block",
+                    "Review mutations",
+                    "dry-run language mixed with official approve/submitted claims",
+                    "mark dry-run explicitly or document the live review mutation proof",
+                )
+            )
+    if _FINDING_READY_RE.search(text) and _APPROVED_RE.search(text):
+        findings.append(
+            validator_finding(
+                "reviewer.finding_ready_vs_submitted",
+                "downgrade",
+                "Review decision",
+                "finding-ready wording combined with submitted-approve claims",
+                "state whether review was submitted live or only prepared for submission",
+            )
+        )
+    return findings
+
+
+_SCHEMA_RULES = (
+    _rule_legacy_stale_fields,
+    _rule_reviewed_head_without_validation,
+    _rule_merged_without_proof,
+    _rule_issue_closed_without_live_proof,
+    _rule_full_suite_pass_ignored_tests,
+    _rule_blocked_handoff_replay,
+    _rule_narrative_handoff_drift,
+    _rule_review_state_ambiguous,
+)
+
+
+def _merge_validator_results(
+    base: dict[str, Any],
+    extra_findings: list[dict[str, str]],
+) -> dict[str, Any]:
+    findings = list(base.get("findings") or []) + extra_findings
+    blocked = base.get("blocked") or any(f["severity"] == "block" for f in extra_findings)
+    downgraded = base.get("downgraded") or any(
+        f["severity"] == "downgrade" for f in extra_findings
+    )
+    grade = base.get("grade", "A")
+    if blocked:
+        grade = "blocked"
+    elif downgraded and grade == "A":
+        grade = "downgraded"
+    reasons = [f"{f['rule_id']}: {f['reason']}" for f in findings]
+    safe_next = base.get("safe_next_action") or "none"
+    if extra_findings:
+        safe_next = extra_findings[0].get("safe_next_action", safe_next)
+    return {
+        **base,
+        "grade": grade,
+        "blocked": blocked,
+        "downgraded": downgraded,
+        "findings": findings,
+        "reasons": reasons,
+        "safe_next_action": safe_next,
+        "complete": grade == "A",
+        "schema_rules_applied": len(_SCHEMA_RULES),
+    }
+
+
+def assess_review_final_report_schema(
+    report_text: str,
+    *,
+    review_decision_lock: dict | None = None,
+    linked_issue_lock: dict | None = None,
+    validation_report: dict | None = None,
+    action_log: list[dict] | None = None,
+    mutations_observed: bool = False,
+    local_edits: bool = False,
+    validation_session: dict | None = None,
+) -> dict[str, Any]:
+    """Validate reviewer final report text before session completion (#391)."""
+    base = assess_final_report_validator(
+        report_text,
+        "review_pr",
+        review_decision_lock=review_decision_lock,
+        linked_issue_lock=linked_issue_lock,
+        validation_report=validation_report,
+        action_log=action_log,
+        mutations_observed=mutations_observed,
+        local_edits=local_edits,
+        validation_session=validation_session,
+    )
+    extra: list[dict[str, str]] = []
+    for rule in _SCHEMA_RULES:
+        extra.extend(rule(report_text))
+    return _merge_validator_results(base, extra)

review_merge_state_machine.py

@@ -0,0 +1,332 @@
+"""Enforced PR review/merge workflow state machine (#290).
+
+Review and merge must advance through explicit states. Any failed upstream
+gate forbids downstream approve/merge mutations until the full workflow is
+restarted after blockers clear.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+REVIEW_MERGE_STATES: tuple[str, ...] = (
+    "PRECHECK",
+    "INVENTORY",
+    "SELECT_PR",
+    "PIN_HEAD_SHA",
+    "CREATE_BRANCHES_WORKTREE",
+    "VALIDATE",
+    "REVIEW_DECISION",
+    "APPROVE_OR_REQUEST_CHANGES",
+    "PRE_MERGE_RECHECK",
+    "MERGE",
+    "POST_MERGE_REPORT",
+)
+
+TERMINAL_BLOCKED_HEADING = (
+    "PR review/merge workflow blocked. Restart the full workflow after blockers clear."
+)
+
+_FORBIDDEN_RECOVERY_REPLAY_RE = re.compile(
+    r"\b(?:approve(?:\s+pr)?\s*#?\d+|merge(?:\s+pr)?\s*#?\d+|gitea_merge_pr|"
+    r"gitea_submit_pr_review|submit\s+approve|run\s+merge)\b",
+    re.IGNORECASE,
+)
+_RESTART_WORKFLOW_RE = re.compile(
+    r"restart(?:\s+the)?\s+full\s+workflow|rerun\s+the\s+full\s+workflow",
+    re.IGNORECASE,
+)
+_READY_TO_MERGE_RE = re.compile(
+    r"\bready\s+to\s+merge\b",
+    re.IGNORECASE,
+)
+_REVIEWED_VALIDATED_RE = re.compile(
+    r"\b(?:reviewed|validated|approval\s+submitted)\b",
+    re.IGNORECASE,
+)
+
+_PRE_MERGE_REQUIRED_GATES = (
+    "whoami_verified",
+    "profile_runtime_verified",
+    "merge_capability_verified",
+    "pr_refetched",
+    "reviewed_head_sha_unchanged",
+    "pr_mergeable",
+    "checks_passed",
+    "reviewer_not_author",
+    "worktree_clean",
+)
+
+
+def _clean(value: str | None) -> str:
+    return (value or "").strip()
+
+
+def state_index(state: str) -> int:
+    name = _clean(state).upper()
+    try:
+        return REVIEW_MERGE_STATES.index(name)
+    except ValueError as exc:
+        raise ValueError(f"unknown review/merge state '{state}' (fail closed)") from exc
+
+
+def downstream_states(from_state: str) -> list[str]:
+    idx = state_index(from_state)
+    return list(REVIEW_MERGE_STATES[idx + 1 :])
+
+
+def _completed_through(state_completion: dict[str, bool], state: str) -> bool:
+    return bool(state_completion.get(state))
+
+
+def _first_incomplete_state(state_completion: dict[str, bool]) -> str | None:
+    for state in REVIEW_MERGE_STATES:
+        if not _completed_through(state_completion, state):
+            return state
+    return None
+
+
+def assess_workflow_blockers(
+    *,
+    infra_stop: bool = False,
+    capability_blocked: bool = False,
+    mcp_reconnect_failed: bool = False,
+    stale_capability_state: bool = False,
+) -> dict[str, Any]:
+    """Return hard blockers that forbid all PR queue work (#290 AC3)."""
+    reasons: list[str] = []
+    if infra_stop:
+        reasons.append("infra_stop is active; PR selection/review/merge is forbidden")
+    if capability_blocked:
+        reasons.append("gitea_resolve_task_capability returned blocked/stop_required")
+    if mcp_reconnect_failed:
+        reasons.append("MCP reconnect failed; stale session state cannot be reused")
+    if stale_capability_state:
+        reasons.append("stale MCP capability state detected after reconnect failure")
+    return {
+        "block": bool(reasons),
+        "reasons": reasons,
+        "forbidden_states": list(REVIEW_MERGE_STATES) if reasons else [],
+        "safe_next_action": (
+            TERMINAL_BLOCKED_HEADING if reasons else "proceed with PRECHECK"
+        ),
+    }
+
+
+def assess_state_advancement(
+    state_completion: dict[str, bool] | None,
+    *,
+    target_state: str,
+    infra_stop: bool = False,
+    capability_blocked: bool = False,
+) -> dict[str, Any]:
+    """Fail closed when *target_state* is requested before upstream gates pass."""
+    completion = dict(state_completion or {})
+    target = _clean(target_state).upper()
+    blockers = assess_workflow_blockers(
+        infra_stop=infra_stop,
+        capability_blocked=capability_blocked,
+    )
+    reasons = list(blockers["reasons"])
+
+    try:
+        target_idx = state_index(target)
+    except ValueError as exc:
+        return {
+            "target_state": target,
+            "allowed": False,
+            "block": True,
+            "reasons": [str(exc)],
+            "next_allowed_state": None,
+            "safe_next_action": TERMINAL_BLOCKED_HEADING,
+        }
+
+    if blockers["block"]:
+        return {
+            "target_state": target,
+            "allowed": False,
+            "block": True,
+            "reasons": reasons,
+            "next_allowed_state": None,
+            "safe_next_action": blockers["safe_next_action"],
+        }
+
+    next_allowed = _first_incomplete_state(completion)
+    if next_allowed is None:
+        allowed = target_idx == len(REVIEW_MERGE_STATES) - 1
+        if not allowed:
+            reasons.append("workflow already completed through POST_MERGE_REPORT")
+    else:
+        allowed = state_index(next_allowed) >= target_idx
+        if not allowed:
+            reasons.append(
+                f"state '{target}' is forbidden until '{next_allowed}' completes"
+            )
+
+    return {
+        "target_state": target,
+        "allowed": allowed and not reasons,
+        "block": bool(reasons),
+        "reasons": reasons,
+        "next_allowed_state": next_allowed,
+        "completed_states": [s for s in REVIEW_MERGE_STATES if completion.get(s)],
+        "safe_next_action": (
+            f"complete state '{next_allowed}' before advancing"
+            if next_allowed and not allowed
+            else (
+                TERMINAL_BLOCKED_HEADING
+                if reasons
+                else f"advance to {target}"
+            )
+        ),
+    }
+
+
+def can_approve(state_completion: dict[str, bool] | None, **blocker_kwargs) -> dict[str, Any]:
+    """Approval requires all states through REVIEW_DECISION (#290 AC)."""
+    required = REVIEW_MERGE_STATES[: REVIEW_MERGE_STATES.index("REVIEW_DECISION") + 1]
+    completion = dict(state_completion or {})
+    advance = assess_state_advancement(
+        completion,
+        target_state="APPROVE_OR_REQUEST_CHANGES",
+        **blocker_kwargs,
+    )
+    missing = [s for s in required if not completion.get(s)]
+    reasons = list(advance["reasons"])
+    if missing:
+        reasons.append(
+            "approval blocked: incomplete states: " + ", ".join(missing)
+        )
+    block = bool(reasons) or advance["block"]
+    return {
+        "allowed": not block,
+        "block": block,
+        "reasons": reasons,
+        "missing_states": missing,
+        "safe_next_action": advance["safe_next_action"],
+    }
+
+
+def can_merge(
+    state_completion: dict[str, bool] | None,
+    *,
+    pre_merge_gates: dict[str, bool] | None = None,
+    **blocker_kwargs,
+) -> dict[str, Any]:
+    """Merge requires approve path plus fresh PRE_MERGE_RECHECK gates (#290 AC6)."""
+    completion = dict(state_completion or {})
+    approve = can_approve(completion, **blocker_kwargs)
+    reasons = list(approve["reasons"])
+
+    if not completion.get("APPROVE_OR_REQUEST_CHANGES"):
+        reasons.append("merge blocked: APPROVE_OR_REQUEST_CHANGES not completed")
+
+    gate_map = dict(pre_merge_gates or {})
+    missing_gates = [g for g in _PRE_MERGE_REQUIRED_GATES if not gate_map.get(g)]
+    if missing_gates:
+        reasons.append(
+            "merge blocked: pre-merge gates incomplete: " + ", ".join(missing_gates)
+        )
+
+    advance = assess_state_advancement(
+        completion,
+        target_state="MERGE",
+        **blocker_kwargs,
+    )
+    reasons.extend(advance["reasons"])
+
+    block = bool(reasons)
+    return {
+        "allowed": not block,
+        "block": block,
+        "reasons": reasons,
+        "missing_pre_merge_gates": missing_gates,
+        "safe_next_action": (
+            "complete PRE_MERGE_RECHECK with fresh whoami/capability/PR re-fetch "
+            "before merge"
+            if block
+            else "merge allowed"
+        ),
+    }
+
+
+def assess_blocked_recovery_handoff(report_text: str) -> dict[str, Any]:
+    """Blocked handoffs must not replay approve/merge commands (#290 AC4)."""
+    text = report_text or ""
+    reasons: list[str] = []
+    if _FORBIDDEN_RECOVERY_REPLAY_RE.search(text):
+        reasons.append(
+            "blocked recovery handoff contains direct approve/merge replay command"
+        )
+    if reasons and not _RESTART_WORKFLOW_RE.search(text):
+        reasons.append(
+            "blocked recovery handoff must direct operator to restart full workflow"
+        )
+    return {
+        "block": bool(reasons),
+        "allowed": not reasons,
+        "reasons": reasons,
+        "safe_next_action": (
+            "remove approve/merge replay commands and say to restart full workflow "
+            "after blockers clear"
+            if reasons
+            else "recovery handoff wording acceptable"
+        ),
+    }
+
+
+def assess_final_report_state_claims(
+    report_text: str,
+    *,
+    state_completion: dict[str, bool] | None = None,
+    approve_completed: bool = False,
+    merge_completed: bool = False,
+) -> dict[str, Any]:
+    """Reports must not claim reviewed/ready-to-merge without gate proof (#290 AC10)."""
+    text = report_text or ""
+    completion = dict(state_completion or {})
+    reasons: list[str] = []
+
+    if _READY_TO_MERGE_RE.search(text) and not (
+        merge_completed or completion.get("PRE_MERGE_RECHECK")
+    ):
+        reasons.append(
+            "report claims ready-to-merge without PRE_MERGE_RECHECK completion"
+        )
+
+    if _REVIEWED_VALIDATED_RE.search(text):
+        if not (approve_completed or completion.get("VALIDATE")):
+            reasons.append(
+                "report claims reviewed/validated without VALIDATE/APPROVE proof"
+            )
+
+    return {
+        "block": bool(reasons),
+        "allowed": not reasons,
+        "reasons": reasons,
+        "safe_next_action": (
+            "remove stale reviewed/ready-to-merge claims unless gates passed"
+            if reasons
+            else "final report state claims consistent with workflow"
+        ),
+    }
+
+
+def workflow_status(
+    state_completion: dict[str, bool] | None,
+    **blocker_kwargs,
+) -> dict[str, Any]:
+    """Summarize current state-machine position for MCP/runtime reporting."""
+    completion = dict(state_completion or {})
+    blockers = assess_workflow_blockers(**blocker_kwargs)
+    next_state = _first_incomplete_state(completion)
+    return {
+        "states": list(REVIEW_MERGE_STATES),
+        "completed_states": [s for s in REVIEW_MERGE_STATES if completion.get(s)],
+        "next_required_state": next_state,
+        "workflow_complete": next_state is None,
+        "approve_allowed": can_approve(completion, **blocker_kwargs)["allowed"],
+        "merge_allowed": can_merge(completion, **blocker_kwargs)["allowed"],
+        "blockers": blockers,
+    }

review_pr.py

@@ -7,16 +7,16 @@ making any API call. Merge is handled solely by the gated `gitea_merge_pr` MCP
 workflow (#16), which enforces identity/profile/eligibility, explicit
 confirmation, expected head SHA checking, and self-merge protection.
 
-Usage (review only):
+Live review submission is also disabled (#211): use the gated
+``gitea_submit_pr_review`` MCP workflow, which enforces validation-phase
+dry-run, final decision marking, and single-terminal review mutation rules.
+
+Usage (review only — disabled):
     review_pr.py --pr-number 12 --event APPROVE --body "Approved and signed off"
 """
 import os
 import sys
-import json
-import base64
 import argparse
-import urllib.request
-import urllib.error
 
 # Auto-execute using the project's local virtual environment Python
 PROJECT_ROOT = os.path.dirname(os.path.abspath(__file__))
@@ -24,7 +24,7 @@ venv_python = os.path.join(PROJECT_ROOT, "venv", "bin", "python3")
 if os.path.exists(venv_python) and sys.executable != venv_python:
     os.execv(venv_python, [venv_python] + sys.argv)
 
-from gitea_auth import get_auth_header, resolve_remote, add_remote_args, api_request, repo_api_url, get_profile
+from gitea_auth import add_remote_args
 
 
 def main(argv=None):
@@ -42,95 +42,26 @@ def main(argv=None):
                         help="Ignored — CLI merge is disabled (see --merge).")
     args = parser.parse_args(argv)
 
-    # Fail closed: direct CLI merge is disabled (#16). LLM automations were
-    # using this flag as an ungated merge bypass. Merge is only available via
-    # the gated `gitea_merge_pr` MCP workflow, which enforces
-    # identity/profile/eligibility, explicit confirmation, expected head SHA,
-    # and self-merge protection. No API call is made here.
     if args.merge:
         print(
             "Direct CLI merge is disabled. Merge is only available through the "
             "gated #16 workflow (MCP tool 'gitea_merge_pr'), which enforces "
             "identity/profile/eligibility, explicit confirmation, expected head "
             "SHA checking, and self-merge protection. Re-run without --merge to "
-            "submit a review only.",
+            "see the review-submission guard message.",
             file=sys.stderr,
         )
         return 2
 
-    host, org, repo = resolve_remote(args)
-
-    # ── Reviewer mutation side-channel wall (#199, refs #194) ──
-    # The launching MCP session exports GITEA_SESSION_PROFILE_LOCK with the
-    # profile it was started with; child processes inherit it. If this CLI
-    # resolves a different profile — e.g. an ad-hoc GITEA_MCP_PROFILE
-    # override escalating an author-bound session to reviewer — refuse
-    # before any API call. No lock in the environment means no session
-    # context (direct operator CLI use), which stays allowed. Unlike a /tmp
-    # lock file, the environment is per-process-tree: other sessions cannot
-    # spoof it and it cannot go stale across sessions.
-    session_lock = (os.environ.get("GITEA_SESSION_PROFILE_LOCK") or "").strip()
-    if session_lock:
-        try:
-            cli_profile = (get_profile().get("profile_name") or "").strip()
-        except Exception as e:
-            print(f"Mutation authority check failed: {e}", file=sys.stderr)
-            return 3
-        if cli_profile != session_lock:
-            print(
-                f"Mismatched active profile vs session profile lock "
-                f"(CLI override rejected): CLI profile '{cli_profile}' does "
-                f"not match locked session profile '{session_lock}' "
-                f"(fail closed)",
-                file=sys.stderr,
-            )
-            return 3
-
-    body = args.body
-    if args.body_file:
-        if args.body_file == "-":
-            body = sys.stdin.read()
-        else:
-            with open(args.body_file, "r", encoding="utf-8") as fh:
-                body = fh.read()
-
-    auth = get_auth_header(host)
-    if not auth:
-        print(f"Could not get credentials or token for {host}.", file=sys.stderr)
-        return 1
-
-    # 1. Fetch PR to get the latest head commit SHA (required for review validation)
-    pr_url = f"{repo_api_url(host, org, repo)}/pulls/{args.pr_number}"
-    try:
-        pr_data = api_request("GET", pr_url, auth)
-    except Exception as e:
-        print(f"Error fetching PR #{args.pr_number}: {e}", file=sys.stderr)
-        return 1
-
-    commit_sha = pr_data.get("head", {}).get("sha")
-    if not commit_sha:
-        print(f"Could not find head commit SHA for PR #{args.pr_number}.", file=sys.stderr)
-        return 1
-
-    # 2. Submit the PR review
-    review_url = f"{repo_api_url(host, org, repo)}/pulls/{args.pr_number}/reviews"
-    payload = {
-        "body": body,
-        "event": args.event,
-        "commit_id": commit_sha
-    }
-    
-    try:
-        api_request("POST", review_url, auth, payload)
-        print(f"Successfully submitted review for PR #{args.pr_number}: event={args.event}")
-    except Exception as e:
-        print(f"Error submitting review: {e}", file=sys.stderr)
-        return 1
-
-    # Merge is intentionally not performed here — see the fail-closed guard
-    # above. Use the gated `gitea_merge_pr` MCP workflow (#16) to merge.
-    return 0
+    print(
+        "Direct CLI review submission is disabled (#211). Use the gated "
+        "'gitea_submit_pr_review' MCP workflow, which enforces validation-phase "
+        "dry-run, gitea_mark_final_review_decision, and single-terminal review "
+        "mutation rules.",
+        file=sys.stderr,
+    )
+    return 2
 
 
 if __name__ == "__main__":
-    sys.exit(main())
+    sys.exit(main())

reviewer_already_landed_classification.py

@@ -0,0 +1,143 @@
+"""Already-landed PR classification verifier for reviewer reports (#295)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+ALREADY_LANDED_ELIGIBILITY_CLASS = "ALREADY_LANDED_RECONCILE_REQUIRED"
+
+_LANDED_CONTEXT_RE = re.compile(
+    r"already[- ]landed|ancestor proof\s*:\s*passed|"
+    r"eligibility class\s*:\s*already_landed",
+    re.IGNORECASE,
+)
+_ELIGIBILITY_CLASS_LINE_RE = re.compile(
+    r"eligibility class\s*:\s*(.+)$",
+    re.IGNORECASE | re.MULTILINE,
+)
+_INELIGIBLE_SELECTION_RE = re.compile(
+    r"\b(?:next|oldest)\s+eligible\s+pr\b",
+    re.IGNORECASE,
+)
+_REVIEW_ELIGIBLE_RE = re.compile(
+    r"\beligible for (?:review|merge)\b|\bready for (?:review|merge)\b",
+    re.IGNORECASE,
+)
+_PINNED_REVIEWED_HEAD_RE = re.compile(
+    r"\bpinned reviewed head\s*:",
+    re.IGNORECASE,
+)
+_CANDIDATE_HEAD_RE = re.compile(
+    r"\bcandidate head sha\s*:",
+    re.IGNORECASE,
+)
+_REVIEWED_HEAD_NONE_RE = re.compile(
+    r"\breviewed head sha\s*:\s*none\b",
+    re.IGNORECASE,
+)
+_VALIDATION_PROOF_RE = re.compile(
+    r"(?:validation passed|pytest.*passed|diff review passed|"
+    r"validated on pinned head)",
+    re.IGNORECASE,
+)
+_QUEUE_BLOCKED_RE = re.compile(
+    r"queue blocked by already[- ]landed|"
+    r"reconciliation(?:-only)?\s+(?:next step|required)",
+    re.IGNORECASE,
+)
+
+
+def _landed_context(report_text: str, eligibility_class: str | None) -> bool:
+    if (eligibility_class or "").strip().upper() == ALREADY_LANDED_ELIGIBILITY_CLASS:
+        return True
+    return bool(_LANDED_CONTEXT_RE.search(report_text or ""))
+
+
+def assess_already_landed_classification_report(
+    report_text: str,
+    *,
+    eligibility_class: str | None = None,
+    selected_pr_already_landed: bool | None = None,
+) -> dict[str, Any]:
+    """#295: already-landed PRs are reconciliation-only, not review eligible."""
+    text = report_text or ""
+    reasons: list[str] = []
+
+    landed = _landed_context(text, eligibility_class)
+    if selected_pr_already_landed is True:
+        landed = True
+    if not landed:
+        return {
+            "proven": True,
+            "block": False,
+            "landed_context": False,
+            "reasons": [],
+            "safe_next_action": "proceed",
+        }
+
+    if _INELIGIBLE_SELECTION_RE.search(text):
+        reasons.append(
+            "already-landed PR must not be described as oldest/next eligible PR; "
+            "use 'Oldest open PR requiring action' and "
+            f"'Eligibility class: {ALREADY_LANDED_ELIGIBILITY_CLASS}'"
+        )
+
+    if _REVIEW_ELIGIBLE_RE.search(text):
+        reasons.append(
+            "already-landed PR must not be described as eligible for review or merge"
+        )
+
+    class_match = _ELIGIBILITY_CLASS_LINE_RE.search(text)
+    if class_match:
+        declared = class_match.group(1).strip().upper()
+        if declared != ALREADY_LANDED_ELIGIBILITY_CLASS:
+            reasons.append(
+                "already-landed PR eligibility class must be "
+                f"{ALREADY_LANDED_ELIGIBILITY_CLASS}"
+            )
+    elif selected_pr_already_landed is True:
+        reasons.append(
+            f"already-landed selected PR must declare Eligibility class: "
+            f"{ALREADY_LANDED_ELIGIBILITY_CLASS}"
+        )
+
+    if _PINNED_REVIEWED_HEAD_RE.search(text):
+        if not _VALIDATION_PROOF_RE.search(text):
+            reasons.append(
+                "already-landed pre-review report must use Candidate head SHA, "
+                "not Pinned reviewed head, unless validation and diff review passed"
+            )
+
+    if selected_pr_already_landed is True and not _CANDIDATE_HEAD_RE.search(text):
+        if _PINNED_REVIEWED_HEAD_RE.search(text) or "head sha" in text.lower():
+            reasons.append(
+                "already-landed ancestry check must report Candidate head SHA"
+            )
+
+    if selected_pr_already_landed is True and not _REVIEWED_HEAD_NONE_RE.search(text):
+        if _PINNED_REVIEWED_HEAD_RE.search(text) and not _VALIDATION_PROOF_RE.search(text):
+            reasons.append(
+                "already-landed report must state 'Reviewed head SHA: none' "
+                "when validation did not run"
+            )
+
+    if selected_pr_already_landed is True and not _QUEUE_BLOCKED_RE.search(text):
+        reasons.append(
+            "already-landed queue blocker must state reconciliation requirement "
+            "or queue blocked wording"
+        )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "landed_context": True,
+        "reasons": reasons,
+        "safe_next_action": (
+            "classify as ALREADY_LANDED_RECONCILE_REQUIRED, use Candidate head SHA, "
+            "and stop normal review"
+            if not proven
+            else "proceed"
+        ),
+    }

reviewer_already_landed_handoff.py

@@ -0,0 +1,216 @@
+"""Already-landed controller handoff consistency verifier (#299)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from review_proofs import git_ref_mutating_commands
+
+ALREADY_LANDED_STATE = "ALREADY_LANDED_RECONCILE_REQUIRED"
+
+_HANDOFF_SECTION_RE = re.compile(r"^##\s*Controller Handoff\s*$", re.I | re.M)
+
+_STALE_HANDOFF_FIELDS = (
+    "pinned reviewed head",
+    "scratch worktree used",
+)
+
+_LEGACY_MUTATIONS_NONE_RE = re.compile(
+    r"^\s*[-*]?\s*mutations\s*:\s*none\s*$",
+    re.I | re.M,
+)
+_LEGACY_WORKSPACE_NONE_RE = re.compile(
+    r"^\s*[-*]?\s*workspace\s+mutations\s*:\s*none\s*$",
+    re.I | re.M,
+)
+
+_FORBIDDEN_REVIEW_STATES_RE = re.compile(
+    r"review decision\s*:\s*approved?\b|"
+    r"merge result\s*:\s*merged\b|"
+    r"\bready[_ ]to[_ ]merge\b",
+    re.I,
+)
+
+_NARRATIVE_ELIGIBILITY_RE = re.compile(
+    r"eligibility class\s*:\s*([^\n]+)",
+    re.I,
+)
+_NARRATIVE_REVIEWED_SHA_RE = re.compile(
+    r"reviewed head sha\s*:\s*([^\n]+)",
+    re.I,
+)
+_NARRATIVE_WORKTREE_RE = re.compile(
+    r"review worktree used\s*:\s*([^\n]+)",
+    re.I,
+)
+
+
+def _handoff_field_map(report_text: str) -> dict[str, str]:
+    text = report_text or ""
+    match = _HANDOFF_SECTION_RE.search(text)
+    if not match:
+        return {}
+    fields: dict[str, str] = {}
+    for line in text[match.end() :].splitlines():
+        stripped = line.strip().lstrip("-*").strip()
+        if ":" not in stripped:
+            continue
+        key, value = stripped.split(":", 1)
+        fields[key.strip().lower()] = value.strip()
+    return fields
+
+
+def _narrative_before_handoff(report_text: str) -> str:
+    text = report_text or ""
+    match = _HANDOFF_SECTION_RE.search(text)
+    if not match:
+        return text
+    return text[: match.start()]
+
+
+def _is_truthy(value: str) -> bool:
+    lowered = (value or "").strip().lower()
+    return lowered not in {"", "none", "n/a", "not applicable", "false", "no", "—", "-"}
+
+
+def _gate_active(text: str, fields: dict[str, str], session: dict) -> bool:
+    if session.get("gate_fired") or session.get("already_landed_gate_fired"):
+        return True
+    eligibility = (fields.get("eligibility class") or "").upper()
+    if ALREADY_LANDED_STATE in eligibility:
+        return True
+    return ALREADY_LANDED_STATE.lower() in text.lower()
+
+
+def assess_already_landed_handoff_report(
+    report_text: str,
+    *,
+    handoff_session: dict | None = None,
+    command_log: list | None = None,
+) -> dict[str, Any]:
+    """Reject stale handoff fields and narrative/handoff drift after the gate (#299)."""
+    text = report_text or ""
+    session = dict(handoff_session or {})
+    fields = _handoff_field_map(text)
+    reasons: list[str] = []
+
+    if not _gate_active(text, fields, session):
+        return {
+            "proven": True,
+            "block": False,
+            "reasons": [],
+            "gate_active": False,
+            "safe_next_action": "proceed",
+        }
+
+    for stale_field in _STALE_HANDOFF_FIELDS:
+        if stale_field in fields:
+            reasons.append(
+                f"already-landed handoff must not include stale field "
+                f"'{stale_field.title()}' (#299)"
+            )
+
+    if _LEGACY_WORKSPACE_NONE_RE.search(text):
+        reasons.append(
+            "already-landed handoff must not include legacy "
+            "'Workspace mutations: None' (#299)"
+        )
+
+    ref_commands = git_ref_mutating_commands(command_log or session.get("command_log"))
+    mutations_observed = bool(
+        ref_commands
+        or session.get("mutations_observed")
+        or session.get("mcp_mutations")
+        or session.get("review_mutations")
+    )
+    if mutations_observed and _LEGACY_MUTATIONS_NONE_RE.search(text):
+        reasons.append(
+            "already-landed handoff must not claim 'Mutations: None' when "
+            "git ref, MCP, review, merge, or cleanup mutations occurred (#299)"
+        )
+
+    git_ref_value = fields.get("git ref mutations", "").strip().lower()
+    if ref_commands and (not git_ref_value or git_ref_value == "none"):
+        reasons.append(
+            "git fetch/ref updates must be reported under Git ref mutations (#299)"
+        )
+
+    reviewed_sha = fields.get("reviewed head sha", "")
+    if reviewed_sha and _is_truthy(reviewed_sha):
+        reasons.append(
+            "already-landed handoff must use 'Reviewed head SHA: none' (#299)"
+        )
+
+    worktree_used = fields.get("review worktree used", "")
+    if worktree_used and _is_truthy(worktree_used):
+        reasons.append(
+            "already-landed handoff must set Review worktree used: false (#299)"
+        )
+
+    candidate_sha = fields.get("candidate head sha", "")
+    if not candidate_sha or candidate_sha.lower() in {"none", "n/a", "unknown"}:
+        reasons.append(
+            "already-landed handoff must include Candidate head SHA (#299)"
+        )
+
+    if _FORBIDDEN_REVIEW_STATES_RE.search(text):
+        reasons.append(
+            "already-landed handoff must not claim approved/merged/ready-to-merge (#299)"
+        )
+
+    narrative = _narrative_before_handoff(text)
+    handoff_eligibility = (fields.get("eligibility class") or "").strip()
+    narrative_eligibility = (
+        _NARRATIVE_ELIGIBILITY_RE.search(narrative).group(1).strip()
+        if _NARRATIVE_ELIGIBILITY_RE.search(narrative)
+        else ""
+    )
+    if handoff_eligibility and narrative_eligibility:
+        if handoff_eligibility.upper() != narrative_eligibility.upper():
+            reasons.append(
+                "narrative Eligibility class disagrees with controller handoff (#299)"
+            )
+
+    narrative_reviewed = (
+        _NARRATIVE_REVIEWED_SHA_RE.search(narrative).group(1).strip()
+        if _NARRATIVE_REVIEWED_SHA_RE.search(narrative)
+        else ""
+    )
+    if narrative_reviewed and reviewed_sha:
+        if narrative_reviewed.lower() != reviewed_sha.lower():
+            reasons.append(
+                "narrative Reviewed head SHA disagrees with controller handoff (#299)"
+            )
+
+    narrative_worktree = (
+        _NARRATIVE_WORKTREE_RE.search(narrative).group(1).strip()
+        if _NARRATIVE_WORKTREE_RE.search(narrative)
+        else ""
+    )
+    if narrative_worktree and worktree_used:
+        if narrative_worktree.lower() != worktree_used.lower():
+            reasons.append(
+                "narrative Review worktree used disagrees with controller handoff (#299)"
+            )
+
+    git_ref_narrative = "git ref mutations" in narrative.lower()
+    if git_ref_narrative and git_ref_value:
+        if "none" in git_ref_value and ref_commands:
+            reasons.append(
+                "narrative and handoff disagree on git ref mutation reporting (#299)"
+            )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": list(dict.fromkeys(reasons)),
+        "gate_active": True,
+        "safe_next_action": (
+            "emit canonical ALREADY_LANDED_RECONCILE_REQUIRED handoff without "
+            "stale review/merge fields; align narrative and controller handoff"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_blocker_skip.py

@@ -0,0 +1,164 @@
+"""Prior-blocker skip proof verifier for reviewer queue reports (#318)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_FULL_SHA = re.compile(r"\b[0-9a-f]{40}\b", re.IGNORECASE)
+_SHORT_SHA = re.compile(r"\b[0-9a-f]{7,39}\b", re.IGNORECASE)
+_PR_NUMBER_RE = re.compile(r"(?:\bPR\s*#?|#)(\d+)\b", re.IGNORECASE)
+_BLOCKING_DECISION_RE = re.compile(
+    r"(?:blocking review decision|review decision|blocking decision)\s*:\s*request[_ ]changes|"
+    r"request[_ ]changes",
+    re.IGNORECASE,
+)
+_BLOCKING_HEAD_RE = re.compile(
+    r"(?:blocking review head(?:\s+sha)?|blocker head(?:\s+sha)?|review head at blocker)",
+    re.IGNORECASE,
+)
+_HEAD_CHANGED_RE = re.compile(
+    r"(?:head (?:changed|unchanged)|head sha (?:changed|unchanged)|"
+    r"head changed (?:after|since) (?:the )?blocker|head unchanged since blocker)",
+    re.IGNORECASE,
+)
+_BLOCKER_REASON_RE = re.compile(
+    r"(?:reason (?:it )?remains blocked|remains blocked because|blocking category)",
+    re.IGNORECASE,
+)
+_LIVE_BLOCKER_PROOF_RE = re.compile(
+    r"(?:blocker revalidated live|live proof|gitea_get_pr_review_feedback|"
+    r"gitea_view_pr|review feedback fetched|current review state)",
+    re.IGNORECASE,
+)
+_BLOCKER_UNVERIFIED_RE = re.compile(r"\bBLOCKER_STATUS_UNVERIFIED\b")
+
+
+def _pr_section(text: str, pr_number: int) -> str:
+    lines = (text or "").splitlines()
+    chunks: list[str] = []
+    capture = False
+    token = f"#{pr_number}"
+    for line in lines:
+        lower = line.lower()
+        if token in lower or f"pr {pr_number}" in lower or f"pr#{pr_number}" in lower.replace(" ", ""):
+            capture = True
+            chunks.append(line)
+            continue
+        if capture:
+            if _PR_NUMBER_RE.search(line) and token not in line.lower():
+                break
+            if line.strip() == "" and len(chunks) > 3:
+                break
+            chunks.append(line)
+    if chunks:
+        return "\n".join(chunks)
+    return text or ""
+
+
+def _has_head_sha(text: str, head_sha: str | None) -> bool:
+    if not head_sha:
+        return bool(_FULL_SHA.search(text) or _SHORT_SHA.search(text))
+    head = head_sha.strip().lower()
+    if head in text.lower():
+        return True
+    if len(head) >= 7 and head[:7] in text.lower():
+        return True
+    return bool(_FULL_SHA.search(text))
+
+
+def assess_prior_blocker_skip_proof(
+    report_text: str,
+    *,
+    skipped_prs: list[dict] | None = None,
+) -> dict[str, Any]:
+    """Validate live blocker proof for skipped earlier open PRs (#318)."""
+    text = report_text or ""
+    reasons: list[str] = []
+    assessments: list[dict[str, Any]] = []
+
+    for entry in skipped_prs or []:
+        pr_number = entry.get("pr_number")
+        if pr_number is None:
+            reasons.append("skipped PR entry missing pr_number")
+            continue
+        pr_number = int(pr_number)
+        section = _pr_section(text, pr_number)
+        verified = entry.get("blocker_verified")
+        head_changed = entry.get("head_changed_since_blocker")
+        blocking_head = (entry.get("blocking_review_head_sha") or "").strip() or None
+        current_head = (entry.get("head_sha") or "").strip() or None
+        skip_reason = (entry.get("skip_reason") or entry.get("blocking_decision") or "").lower()
+
+        item_reasons: list[str] = []
+
+        if head_changed is True:
+            item_reasons.append(
+                f"PR #{pr_number} head changed after blocker; it cannot be skipped "
+                "based on stale REQUEST_CHANGES"
+            )
+
+        if f"#{pr_number}" not in text.lower() and f"pr {pr_number}" not in text.lower():
+            item_reasons.append(f"skipped PR #{pr_number} not documented in final report")
+
+        if "request_changes" in skip_reason or entry.get("blocking_decision") == "request_changes":
+            if verified is False:
+                if not _BLOCKER_UNVERIFIED_RE.search(section):
+                    item_reasons.append(
+                        f"PR #{pr_number} blocker proof unavailable; report must classify "
+                        "BLOCKER_STATUS_UNVERIFIED"
+                    )
+            else:
+                if not _BLOCKING_DECISION_RE.search(section):
+                    item_reasons.append(
+                        f"PR #{pr_number} skip missing blocking review decision proof"
+                    )
+                if not _has_head_sha(section, current_head):
+                    item_reasons.append(
+                        f"PR #{pr_number} skip missing current head SHA"
+                    )
+                if blocking_head and not _BLOCKING_HEAD_RE.search(section):
+                    if blocking_head.lower() not in section.lower():
+                        item_reasons.append(
+                            f"PR #{pr_number} skip missing blocking review head SHA"
+                        )
+                if head_changed is False and not _HEAD_CHANGED_RE.search(section):
+                    item_reasons.append(
+                        f"PR #{pr_number} skip missing head-changed-since-blocker proof"
+                    )
+                if not _BLOCKER_REASON_RE.search(section):
+                    item_reasons.append(
+                        f"PR #{pr_number} skip missing reason-it-remains-blocked"
+                    )
+                if not _LIVE_BLOCKER_PROOF_RE.search(section):
+                    item_reasons.append(
+                        f"PR #{pr_number} skip missing live blocker proof for this session"
+                    )
+
+        proven = not item_reasons
+        assessments.append({
+            "pr_number": pr_number,
+            "proven": proven,
+            "classification": (
+                "BLOCKER_STATUS_UNVERIFIED"
+                if verified is False
+                else "BLOCKED_SKIPPED"
+            ),
+            "reasons": item_reasons,
+        })
+        reasons.extend(item_reasons)
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "downgraded": False,
+        "assessments": assessments,
+        "reasons": reasons,
+        "safe_next_action": (
+            "fetch live review feedback and document blocker proof for each skipped PR, "
+            "or classify BLOCKER_STATUS_UNVERIFIED"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_fallback.py

@@ -0,0 +1,213 @@
+"""Reviewer local-fallback detection for normal PR review workflows (#324).
+
+Normal reviewer runs must use MCP tools. Reading profile secret files or
+running local Gitea helper scripts while MCP is available is a fail-closed
+violation. Explicit recovery mode may use local fallback only with full proof.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+LOCAL_GITEA_SCRIPT_NAMES = (
+    "list_prs.py",
+    "view_pr.py",
+    "create_pr.py",
+    "merge_pr.py",
+    "edit_pr.py",
+    "list_issues.py",
+    "delete_branch.py",
+    "create_issue.py",
+    "close_issue.py",
+    "review_pr.py",
+    "mark_issue.py",
+    "mirror_refs.sh",
+)
+
+PROFILE_SECRET_MARKERS = (
+    "profiles.json",
+    ".config/gitea-tools/profiles",
+    "gitea_auth.py",
+    "gitea_config.py",
+    "keychain",
+    "credential fill",
+    "token store",
+)
+
+_RECOVERY_MODE_RE = re.compile(
+    r"\b(?:recovery mode|explicit recovery|mcp unavailable|mcp not available|"
+    r"mcp tools unavailable|no mcp path)\b",
+    re.IGNORECASE,
+)
+_FALLBACK_CLASSIFICATION_RE = re.compile(
+    r"\b(?:local fallback|fallback mode|used local gitea|ran local script)\b",
+    re.IGNORECASE,
+)
+_MCP_TOOL_USE_RE = re.compile(
+    r"\b(?:gitea_list_prs|gitea_view_pr|gitea_review_pr|gitea_merge_pr|"
+    r"gitea_resolve_task_capability|gitea_whoami|mcp tool)\b",
+    re.IGNORECASE,
+)
+_LOCAL_SCRIPT_RE = re.compile(
+    r"(?:^|[\s\"'`/])(?:" + "|".join(re.escape(name) for name in LOCAL_GITEA_SCRIPT_NAMES) + r")",
+    re.IGNORECASE,
+)
+_PROFILE_ACCESS_RE = re.compile(
+    r"(?:read|open|inspect|cat|view|access(?:ed)?|loaded?)\s+(?:file\s+)?[`'\"]?"
+    r"[^`'\"]*profiles\.json|profiles\.json[`'\"]?\s+(?:read|opened|inspected|accessed)|"
+    r"~/?\.config/gitea-tools/profiles",
+    re.IGNORECASE,
+)
+_LOCAL_ENV_SCRIPT_RE = re.compile(
+    r"GITEA_MCP_(?:CONFIG|PROFILE)=.*\b(?:python\s+)?(?:list_prs|view_pr|create_pr|merge_pr)\.py",
+    re.IGNORECASE,
+)
+_RECOVERY_PROOF_FIELDS = (
+    ("identity proof", ("identity proof", "exact identity proof")),
+    ("profile proof", ("profile proof", "exact profile proof")),
+    ("repo proof", ("repo proof", "exact repo proof")),
+    ("capability proof", ("capability proof", "exact capability proof")),
+    ("mcp unavailable reason", (
+        "why mcp was unavailable",
+        "mcp unavailable",
+        "mcp unavailability",
+    )),
+)
+
+
+def _collect_observed_text(
+    report_text: str,
+    action_log: list[dict] | None,
+) -> str:
+    chunks = [report_text or ""]
+    for entry in action_log or []:
+        for key in ("command", "action", "detail", "path", "script"):
+            value = entry.get(key)
+            if value:
+                chunks.append(str(value))
+    return "\n".join(chunks)
+
+
+def _detect_profile_secret_access(text: str) -> list[str]:
+    reasons = []
+    lower = text.lower()
+    if _PROFILE_ACCESS_RE.search(text):
+        reasons.append("report or action log shows profiles.json/profile secret access")
+    for marker in PROFILE_SECRET_MARKERS:
+        if marker == "profiles.json":
+            continue
+        if marker in lower and "do not" not in lower and "must not" not in lower:
+            if any(verb in lower for verb in ("read ", "open ", "inspect ", "cat ", "loaded ")):
+                reasons.append(f"profile secret surface '{marker}' accessed during review")
+    return reasons
+
+
+def _detect_local_script_use(text: str) -> list[str]:
+    reasons = []
+    match = _LOCAL_SCRIPT_RE.search(text)
+    if match:
+        reasons.append(
+            f"local Gitea helper script invoked ({match.group(0).strip()})"
+        )
+    if _LOCAL_ENV_SCRIPT_RE.search(text):
+        reasons.append(
+            "local Gitea script run with GITEA_MCP_CONFIG/GITEA_MCP_PROFILE env overrides"
+        )
+    return reasons
+
+
+def _recovery_proof_missing(text: str) -> list[str]:
+    lower = text.lower()
+    missing = []
+    for label, aliases in _RECOVERY_PROOF_FIELDS:
+        if not any(alias in lower for alias in aliases):
+            missing.append(label)
+    if not _FALLBACK_CLASSIFICATION_RE.search(text):
+        missing.append("fallback classification")
+    if not _RECOVERY_MODE_RE.search(text):
+        missing.append("recovery mode declaration")
+    return missing
+
+
+def assess_reviewer_fallback_report(
+    report_text: str,
+    *,
+    action_log: list[dict] | None = None,
+    recovery_mode: bool = False,
+    mcp_available: bool = True,
+    mcp_tools_used: bool | None = None,
+) -> dict[str, Any]:
+    """Fail closed when normal reviewer workflows use local Gitea fallbacks (#324)."""
+    text = _collect_observed_text(report_text, action_log)
+    lower = (report_text or "").lower()
+
+    profile_violations = _detect_profile_secret_access(text)
+    script_violations = _detect_local_script_use(text)
+    violations = profile_violations + script_violations
+
+    if mcp_tools_used is None:
+        mcp_tools_used = bool(_MCP_TOOL_USE_RE.search(report_text or ""))
+    elif mcp_tools_used is False and _MCP_TOOL_USE_RE.search(report_text or ""):
+        mcp_tools_used = True
+
+    reasons: list[str] = []
+    recovery_declared = recovery_mode or bool(_RECOVERY_MODE_RE.search(report_text or ""))
+
+    if violations and mcp_available and not recovery_declared:
+        reasons.extend(violations)
+        if mcp_tools_used:
+            reasons.append(
+                "MCP tools were available and used; local fallback/profile access is forbidden"
+            )
+        else:
+            reasons.append(
+                "MCP path is available; normal review must not use local Gitea fallbacks"
+            )
+
+    if violations and recovery_declared:
+        missing = _recovery_proof_missing(report_text or "")
+        if missing:
+            reasons.append(
+                "recovery-mode fallback missing proof fields: "
+                + ", ".join(missing)
+            )
+
+    if (
+        not violations
+        and recovery_declared
+        and _FALLBACK_CLASSIFICATION_RE.search(report_text or "")
+        and not recovery_mode
+    ):
+        missing = _recovery_proof_missing(report_text or "")
+        if missing:
+            reasons.append(
+                "report claims local fallback but recovery proof is incomplete: "
+                + ", ".join(missing)
+            )
+
+    proven = not reasons
+    blocked = bool(reasons) and not recovery_declared or any(
+        "recovery-mode fallback missing" in r or "recovery proof is incomplete" in r
+        for r in reasons
+    )
+    return {
+        "proven": proven,
+        "block": blocked or (bool(reasons) and mcp_available and not recovery_declared),
+        "downgraded": bool(reasons) and not blocked,
+        "recovery_mode": recovery_declared,
+        "mcp_available": mcp_available,
+        "mcp_tools_used": mcp_tools_used,
+        "profile_violations": profile_violations,
+        "script_violations": script_violations,
+        "reasons": reasons,
+        "safe_next_action": (
+            "use MCP reviewer tools only; do not read profiles.json or run local Gitea scripts"
+            if reasons and not recovery_declared
+            else (
+                "complete recovery-mode fallback proof before claiming local fallback"
+                if reasons
+                else "proceed with MCP tools"
+            )
+        ),
+    }

reviewer_infra_stop_handoff.py

@@ -0,0 +1,162 @@
+"""Infra-stop repair handoff verifier for blocked reviewer workflows (#289)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from capability_stop_terminal import (
+    TERMINAL_REPORT_HEADING,
+    assess_capability_stop_report,
+)
+
+_REPAIR_HANDOFF_RE = re.compile(
+    r"repair handoff|control-checkout repair mode",
+    re.IGNORECASE,
+)
+_CONTROL_REPAIR_RE = re.compile(r"control-checkout repair mode", re.IGNORECASE)
+_PR_QUEUE_ADVANCE_RE = re.compile(
+    r"(?:selected pr|pr #\d+ (?:to review|selected)|eligible pr|"
+    r"next (?:eligible )?pr(?: to review)?|oldest eligible pr|pinned (?:review )?head)",
+    re.IGNORECASE,
+)
+_REVIEW_MUTATION_RE = re.compile(
+    r"(?:gitea_review_pr|gitea_merge_pr|request_changes|submitted\s+approve|"
+    r"merge result|review decision\s*:\s*approve)",
+    re.IGNORECASE,
+)
+_BACKGROUND_TOOL_RE = re.compile(r"\b(?:schedule|manage_task)\b", re.IGNORECASE)
+_PR_REVIEW_REPORT_RE = re.compile(
+    r"(?:review summary|merge recommendation|validation result\s*:\s*pass|"
+    r"queue status report with selected pr)",
+    re.IGNORECASE,
+)
+
+_DIAGNOSTIC_FIELDS = {
+    "mcp process root": re.compile(r"mcp process root\s*:", re.IGNORECASE),
+    "inspected git root": re.compile(r"inspected git root\s*:", re.IGNORECASE),
+    "conflict marker path": re.compile(
+        r"(?:conflict marker path|exact conflict marker path)\s*:",
+        re.IGNORECASE,
+    ),
+    "merge/rebase control path": re.compile(
+        r"(?:merge/rebase control path|exact merge/rebase control path)\s*:",
+        re.IGNORECASE,
+    ),
+    "safe next repair action": re.compile(
+        r"safe next (?:repair )?action\s*:",
+        re.IGNORECASE,
+    ),
+}
+
+
+def assess_infra_stop_handoff_report(
+    report_text: str,
+    *,
+    stop_session: dict | None = None,
+) -> dict[str, Any]:
+    """Validate repair handoff purity when infra_stop blocks reviewer capability (#289)."""
+    text = report_text or ""
+    session = dict(stop_session or {})
+    reasons: list[str] = []
+
+    infra_stop = bool(
+        session.get("infra_stop")
+        or session.get("infra_stop_blocked")
+        or session.get("route_result") == "infra_stop"
+    )
+    if not infra_stop:
+        return {
+            "proven": True,
+            "block": False,
+            "reasons": [],
+            "infra_stop": False,
+            "safe_next_action": "proceed",
+        }
+
+    lower = text.lower()
+    repair_handoff = bool(
+        _REPAIR_HANDOFF_RE.search(text)
+        or TERMINAL_REPORT_HEADING.lower() in lower
+    )
+    if not repair_handoff:
+        reasons.append(
+            "infra_stop requires a repair handoff, not a PR review report"
+        )
+
+    if _PR_REVIEW_REPORT_RE.search(text) and not _REPAIR_HANDOFF_RE.search(text):
+        reasons.append(
+            "final output must be a repair handoff instead of stale PR review state"
+        )
+
+    if _PR_QUEUE_ADVANCE_RE.search(text):
+        reasons.append(
+            "infra_stop blocks PR queue advancement; do not select or advance next PR"
+        )
+
+    if _REVIEW_MUTATION_RE.search(text):
+        reasons.append(
+            "review, approval, request-changes, merge, or comment mutations "
+            "forbidden while infra_stop is active"
+        )
+
+    if session.get("pinned_head_sha") or re.search(
+        r"pinned (?:review )?head sha\s*:", text, re.IGNORECASE
+    ):
+        if session.get("capability_cleared") is not True:
+            reasons.append(
+                "cannot pin PR head SHA while review capability never cleared"
+            )
+
+    if session.get("main_checkout_diagnostics") and not _CONTROL_REPAIR_RE.search(text):
+        reasons.append(
+            "main-checkout diagnostics must be labeled CONTROL-CHECKOUT REPAIR MODE"
+        )
+
+    if _BACKGROUND_TOOL_RE.search(text):
+        reasons.append(
+            "background schedule/manage_task tools must not be used during "
+            "blocked infra_stop recovery"
+        )
+
+    assessment = session.get("infra_stop_assessment") or {}
+    if assessment.get("infra_stop") or infra_stop:
+        missing = [
+            label
+            for label, pattern in _DIAGNOSTIC_FIELDS.items()
+            if not pattern.search(text)
+        ]
+        if missing and session.get("require_infra_diagnostics", True):
+            reasons.append(
+                "infra_stop repair handoff missing diagnostic fields: "
+                + ", ".join(missing)
+            )
+        conflict_file = assessment.get("conflict_file")
+        if conflict_file and conflict_file.lower() not in lower:
+            reasons.append(
+                f"infra_stop assessment conflict file {conflict_file!r} "
+                "not reflected in repair handoff"
+            )
+
+    capability = assess_capability_stop_report(
+        text,
+        trust_gate_status=session.get("trust_gate_status"),
+        capability_denied=True,
+    )
+    if not capability.get("pure"):
+        reasons.extend(capability.get("reasons") or [])
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": list(dict.fromkeys(reasons)),
+        "infra_stop": True,
+        "repair_handoff": repair_handoff,
+        "safe_next_action": (
+            "stop PR queue work; emit CONTROL-CHECKOUT REPAIR MODE handoff "
+            "with infra diagnostics and safe next repair action"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_inventory_worktree.py

@@ -0,0 +1,308 @@
+"""Reviewer inventory completeness and worktree state verifier (#293)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_PAGINATION_FINALITY_EVIDENCE = re.compile(
+    r"pagination_complete\s*:\s*true|inventory_complete\s*:\s*true|"
+    r"is_final_page\s*:\s*true|pages_fetched|has_more\s*:\s*false|"
+    r"no next page|final[- ]page|pr_inventory_trust_gate\.status|"
+    r"total_count\s*:|pagination.*(?:final|complete)",
+    re.I,
+)
+
+_INCOMPLETE_PAGINATION_PROOF = re.compile(
+    r"first page only|partial page|page 1 only|truncated|"
+    r"returned \d+ open prs?(?:\s*$|\s*[,;])",
+    re.I,
+)
+
+_DEFAULT_PAGE_SIZE_ASSUMPTION = re.compile(
+    r"(?:less|fewer) than (?:the )?(?:default )?(?:gitea )?page[- ]?(?:size|limit)|"
+    r"default (?:gitea )?page[- ]?size|under (?:the )?50[- ]?(?:item )?limit|"
+    r"(?:complete|exhaustive).*(?:default )?page[- ]?size|"
+    r"page[- ]?size assumption|assumed complete",
+    re.I,
+)
+
+_ELIGIBILITY_CLAIM_RE = re.compile(
+    r"\b(?:oldest eligible pr|next eligible pr|next pr to review|"
+    r"inventory (?:is )?complete|inventory exhaustive|exhaustive inventory)\b",
+    re.I,
+)
+
+_EXACT_PAGE_LIMIT_RE = re.compile(
+    r"(?:returned|listed|fetched)\s+(\d+)\s+open prs?|"
+    r"open pr count\s*:\s*(\d+)|"
+    r"page[- ]?size\s*(?:=|:)\s*(\d+)",
+    re.I,
+)
+
+_LEGACY_SCRATCH_FALSE_RE = re.compile(
+    r"scratch worktree used\s*:\s*false",
+    re.I,
+)
+
+_BRANCHES_WORKTREE_RE = re.compile(r"\bbranches/", re.I)
+
+_CONTRADICTORY_HEAD_RE = re.compile(
+    r"detached head\s*/\s*branch\s+master|"
+    r"branch\s+master\s*/\s*detached head|"
+    r"detached head.*branch\s+(?:master|main|dev)\b.*detached|"
+    r"checkout\s*:\s*detached head\s*/\s*branch",
+    re.I,
+)
+
+_MAIN_CHECKOUT_BRANCH_RE = re.compile(
+    r"main checkout branch\s*:\s*(\S+)",
+    re.I,
+)
+
+_REVIEW_HEAD_STATE_RE = re.compile(
+    r"review worktree head state\s*:\s*(\S+)",
+    re.I,
+)
+
+_HANDOFF_SECTION_RE = re.compile(
+    r"^##\s*Controller Handoff\s*$",
+    re.I | re.M,
+)
+
+
+def _handoff_field_map(report_text: str) -> dict[str, str]:
+    """Parse ``- Field: value`` lines from the Controller Handoff section."""
+    text = report_text or ""
+    match = _HANDOFF_SECTION_RE.search(text)
+    if not match:
+        return {}
+    section = text[match.end() :]
+    fields: dict[str, str] = {}
+    for line in section.splitlines():
+        stripped = line.strip().lstrip("-*").strip()
+        if ":" not in stripped:
+            continue
+        key, value = stripped.split(":", 1)
+        fields[key.strip().lower()] = value.strip()
+    return fields
+
+
+def _truthy_field(value: str) -> bool:
+    lowered = (value or "").strip().lower()
+    if not lowered:
+        return False
+    if lowered in {"false", "no", "none", "not applicable", "n/a", "—", "-"}:
+        return False
+    return True
+
+
+def _field_proves_pagination(value: str) -> bool:
+    proof = (value or "").strip()
+    if not proof or proof.lower() in {"none", "n/a", "not applicable", "unknown"}:
+        return False
+    if _DEFAULT_PAGE_SIZE_ASSUMPTION.search(proof):
+        return False
+    if _INCOMPLETE_PAGINATION_PROOF.search(proof):
+        return False
+    return bool(_PAGINATION_FINALITY_EVIDENCE.search(proof))
+
+
+def _pagination_proven(text: str, session: dict, *, pagination_field: str = "") -> bool:
+    if session.get("pagination_complete") or session.get("inventory_complete"):
+        return True
+    session_proof = session.get("inventory_pagination_proof") or ""
+    if _field_proves_pagination(str(session_proof)):
+        return True
+    if _field_proves_pagination(pagination_field):
+        return True
+    if _PAGINATION_FINALITY_EVIDENCE.search(text):
+        return True
+    return False
+
+
+def _exact_page_limit_unproven(
+    text: str, session: dict, *, pagination_proven: bool = False
+) -> bool:
+    """True when a full page was returned without final-page proof."""
+    if pagination_proven:
+        return False
+    requested = session.get("requested_page_size")
+    returned = session.get("returned_page_size")
+    if isinstance(requested, int) and isinstance(returned, int):
+        if returned >= requested > 0:
+            return True
+    for match in _EXACT_PAGE_LIMIT_RE.finditer(text):
+        count = next((g for g in match.groups() if g), None)
+        if not count:
+            continue
+        try:
+            n = int(count)
+        except ValueError:
+            continue
+        if n in {10, 20, 50}:
+            return True
+    return False
+
+
+def assess_inventory_worktree_report(
+    report_text: str,
+    *,
+    inventory_session: dict | None = None,
+) -> dict[str, Any]:
+    """Validate PR inventory pagination proof and worktree field consistency (#293)."""
+    text = report_text or ""
+    session = dict(inventory_session or {})
+    reasons: list[str] = []
+
+    fields = _handoff_field_map(text)
+    pagination_proof_field = fields.get("inventory pagination proof", "")
+
+    pagination_proven = _pagination_proven(
+        text, session, pagination_field=pagination_proof_field
+    )
+
+    if _ELIGIBILITY_CLAIM_RE.search(text):
+        if not pagination_proven:
+            reasons.append(
+                "oldest/next eligible PR or inventory-complete claim requires "
+                "final-page/no-next-page/pagination_complete proof"
+            )
+
+    if _DEFAULT_PAGE_SIZE_ASSUMPTION.search(text):
+        if not pagination_proven:
+            reasons.append(
+                "inventory pagination assumed from default page size without "
+                "final-page/no-next-page/total-count/traversal proof"
+            )
+
+    if pagination_proof_field:
+        if _DEFAULT_PAGE_SIZE_ASSUMPTION.search(pagination_proof_field):
+            reasons.append(
+                "Inventory pagination proof field relies on page-size assumption"
+            )
+        elif _INCOMPLETE_PAGINATION_PROOF.search(pagination_proof_field):
+            reasons.append(
+                "Inventory pagination proof field does not prove final page"
+            )
+        elif not _field_proves_pagination(pagination_proof_field):
+            if _ELIGIBILITY_CLAIM_RE.search(text) or _EXACT_PAGE_LIMIT_RE.search(text):
+                reasons.append(
+                    "Inventory pagination proof field missing final-page metadata"
+                )
+
+    if _exact_page_limit_unproven(text, session, pagination_proven=pagination_proven):
+        reasons.append(
+            "exactly-full first page returned without final-page or "
+            "no-next-page proof"
+        )
+
+    review_worktree_used = fields.get("review worktree used", "")
+    review_worktree_path = fields.get("review worktree path", "")
+    scratch_used = fields.get("scratch worktree used", "")
+    inside_branches = fields.get("review worktree inside branches:", "") or fields.get(
+        "review worktree inside branches", ""
+    )
+
+    branches_path_in_text = bool(
+        _BRANCHES_WORKTREE_RE.search(review_worktree_path)
+        or _BRANCHES_WORKTREE_RE.search(text)
+    )
+
+    if branches_path_in_text:
+        if review_worktree_used and not _truthy_field(review_worktree_used):
+            reasons.append(
+                "reports using a branches/ review worktree must set "
+                "Review worktree used: true"
+            )
+        if scratch_used and re.search(r"\bfalse\b", scratch_used, re.I):
+            reasons.append(
+                "Scratch worktree used: false rejected when a branches/ "
+                "review worktree was created or used"
+            )
+        if _LEGACY_SCRATCH_FALSE_RE.search(text) and not _truthy_field(
+            review_worktree_used
+        ):
+            reasons.append(
+                "legacy Scratch worktree used: false contradicts branches/ "
+                "review worktree usage"
+            )
+
+    if review_worktree_path and _truthy_field(review_worktree_used):
+        if "branches/" not in review_worktree_path.replace("\\", "/").lower():
+            reasons.append(
+                "Review worktree path must be under branches/ when "
+                "Review worktree used is true"
+            )
+        if inside_branches and re.search(r"\bfalse\b", inside_branches, re.I):
+            reasons.append(
+                "Review worktree inside branches must be true when path is "
+                "under branches/"
+            )
+
+    main_branch = (
+        fields.get("main checkout branch", "")
+        or _MAIN_CHECKOUT_BRANCH_RE.search(text).group(1)
+        if _MAIN_CHECKOUT_BRANCH_RE.search(text)
+        else ""
+    )
+    head_state = (
+        fields.get("review worktree head state", "")
+        or (
+            _REVIEW_HEAD_STATE_RE.search(text).group(1)
+            if _REVIEW_HEAD_STATE_RE.search(text)
+            else ""
+        )
+    )
+    if main_branch and head_state:
+        main_norm = main_branch.strip().lower()
+        head_norm = head_state.strip().lower()
+        if head_norm in {"branch", "on branch"} and main_norm in {
+            "master",
+            "main",
+            "dev",
+        }:
+            if "detached" in text.lower() and "review worktree" in text.lower():
+                reasons.append(
+                    "review worktree HEAD state must not reuse main checkout "
+                    "branch wording"
+                )
+
+    if _CONTRADICTORY_HEAD_RE.search(text):
+        reasons.append(
+            "contradictory checkout wording such as 'Detached HEAD / Branch master'"
+        )
+
+    if review_worktree_used and _truthy_field(review_worktree_used):
+        if not review_worktree_path or review_worktree_path.lower() in {
+            "none",
+            "n/a",
+            "not applicable",
+        }:
+            reasons.append(
+                "Review worktree used: true requires Review worktree path"
+            )
+        if not head_state or head_state.lower() in {
+            "none",
+            "n/a",
+            "not applicable",
+            "unknown",
+        }:
+            reasons.append(
+                "Review worktree used: true requires Review worktree HEAD state"
+            )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": list(dict.fromkeys(reasons)),
+        "pagination_proven": pagination_proven,
+        "branches_worktree_used": branches_path_in_text,
+        "safe_next_action": (
+            "prove inventory pagination with final-page metadata; align "
+            "Review worktree used/path/HEAD state with branches/ usage"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_merge_simulation.py

@@ -0,0 +1,148 @@
+"""Merge-simulation worktree mutation verifier for reviewer reports (#317)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_WORKTREE_INDEX_FIELD_RE = re.compile(
+    r"^\s*worktree/index mutations\s*:\s*(.+?)\s*$",
+    re.IGNORECASE | re.MULTILINE,
+)
+_READONLY_DIAG_RE = re.compile(
+    r"read[- ]only diagnostics\s*:\s*(.+)$",
+    re.IGNORECASE | re.MULTILINE,
+)
+_WORKTREE_PATH_RE = re.compile(
+    r"(?:worktree path|diagnostic worktree|simulation worktree)\s*:",
+    re.IGNORECASE,
+)
+_PRE_CLEAN_RE = re.compile(
+    r"(?:pre[- ]simulation|before simulation|clean before).*(?:clean|status)",
+    re.IGNORECASE,
+)
+_MERGE_RESULT_RE = re.compile(
+    r"(?:merge result|simulation result|conflict status|merge conflict)",
+    re.IGNORECASE,
+)
+_ABORT_RE = re.compile(
+    r"(?:merge --abort|abort/reset command|abort command|git merge --abort)",
+    re.IGNORECASE,
+)
+_POST_CLEAN_RE = re.compile(
+    r"(?:post[- ]abort|after abort|clean after).*(?:clean|status)",
+    re.IGNORECASE,
+)
+
+
+def _command_text(entry: Any) -> str:
+    if isinstance(entry, dict):
+        return str(entry.get("command") or "").strip()
+    return str(entry or "").strip()
+
+
+def _git_subcommand_line(command: str) -> str | None:
+    tokens = command.split()
+    if not tokens or tokens[0] != "git":
+        return None
+    return " ".join(tokens[1:])
+
+
+def merge_simulation_commands(command_log: list | None) -> list[str]:
+    """Return logged commands that perform local merge simulation (#317)."""
+    out: list[str] = []
+    for entry in command_log or []:
+        command = _command_text(entry)
+        rest = _git_subcommand_line(command)
+        if rest is None:
+            continue
+        lower = command.lower()
+        if rest.startswith("merge"):
+            if "--no-commit" in lower or (
+                "--no-ff" in lower and "merge" in lower and "--commit" not in lower
+            ):
+                out.append(command)
+            elif "--abort" in lower:
+                out.append(command)
+    return out
+
+
+def assess_merge_simulation_report(
+    report_text: str,
+    *,
+    command_log: list | None = None,
+) -> dict[str, Any]:
+    """Reject merge simulation classified as read-only; require worktree proof (#317)."""
+    text = report_text or ""
+    lower = text.lower()
+    reasons: list[str] = []
+    simulation_commands = merge_simulation_commands(command_log)
+    has_abort = any("--abort" in c.lower() for c in simulation_commands)
+    has_simulation = any(
+        "--no-commit" in c.lower() or (
+            "--no-ff" in c.lower() and "--abort" not in c.lower()
+        )
+        for c in simulation_commands
+    )
+
+    if not simulation_commands:
+        return {
+            "proven": True,
+            "block": False,
+            "reasons": [],
+            "simulation_commands": [],
+            "safe_next_action": "proceed",
+        }
+
+    field = _WORKTREE_INDEX_FIELD_RE.search(text)
+    value = (field.group(1).strip().lower() if field else "") or ""
+    if not value or value in {"none", "n/a", "no"}:
+        reasons.append(
+            "merge simulation commands ran but report lacks "
+            "'Worktree/index mutations' entry"
+        )
+    elif "merge" not in value and "simulation" not in value:
+        if not any(cmd.lower() in lower for cmd in simulation_commands):
+            reasons.append(
+                "Worktree/index mutations must document merge simulation commands"
+            )
+
+    readonly = _READONLY_DIAG_RE.search(text)
+    if readonly:
+        readonly_value = readonly.group(1)
+        for command in simulation_commands:
+            if command.lower() in readonly_value.lower():
+                reasons.append(
+                    "merge simulation may not be listed under read-only diagnostics"
+                )
+        if has_simulation and "merge simulation" in readonly_value.lower():
+            reasons.append(
+                "merge simulation may not be classified as read-only diagnostics"
+            )
+
+    if has_simulation:
+        if not _WORKTREE_PATH_RE.search(text):
+            reasons.append("merge simulation report missing worktree path")
+        if not _PRE_CLEAN_RE.search(text):
+            reasons.append("merge simulation report missing pre-simulation clean status")
+        if not _MERGE_RESULT_RE.search(text):
+            reasons.append("merge simulation report missing merge result/conflict status")
+    if has_abort or has_simulation:
+        if has_abort and not _ABORT_RE.search(text):
+            reasons.append("merge simulation report missing abort/reset command proof")
+        if has_abort and not _POST_CLEAN_RE.search(text):
+            reasons.append("merge simulation report missing post-abort clean status")
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "simulation_commands": simulation_commands,
+        "safe_next_action": (
+            "classify merge simulation under Worktree/index mutations with full "
+            "pre/merge/abort/post-clean proof; never list as read-only diagnostics"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_mergeability_skip.py

@@ -0,0 +1,159 @@
+"""Non-mergeable PR skip conflict-proof verifier for reviewer reports (#322)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_FULL_SHA = re.compile(r"\b[0-9a-f]{40}\b", re.IGNORECASE)
+_SHORT_SHA = re.compile(r"\b[0-9a-f]{7,39}\b", re.IGNORECASE)
+_PR_NUMBER_RE = re.compile(r"(?:\bPR\s*#?|#)(\d+)\b", re.IGNORECASE)
+_MERGEABILITY_FALSE_RE = re.compile(
+    r"(?:mergeable\s*:\s*false|not mergeable|non[- ]mergeable|mergeability\s*:\s*false|"
+    r"mergeability result\s*:\s*false)",
+    re.IGNORECASE,
+)
+_CONFLICT_PROOF_RE = re.compile(
+    r"(?:merge-tree|git merge-tree|gitea_view_pr|gitea_check_pr_eligibility|"
+    r"conflict proof|mergeability tool|merge simulation|conflicting files?)",
+    re.IGNORECASE,
+)
+_CONFLICTING_FILES_RE = re.compile(
+    r"(?:conflicting files?|conflict files?)\s*:\s*(.+)$",
+    re.IGNORECASE | re.MULTILINE,
+)
+_HEAD_CHANGED_RE = re.compile(
+    r"(?:head (?:changed|unchanged)|head sha (?:changed|unchanged)|"
+    r"head changed since|head unchanged since)",
+    re.IGNORECASE,
+)
+_MERGEABILITY_UNVERIFIED_RE = re.compile(
+    r"\bMERGEABILITY_UNVERIFIED\b",
+)
+
+
+def _pr_section(text: str, pr_number: int) -> str:
+    """Return report lines likely describing one skipped PR."""
+    lines = (text or "").splitlines()
+    chunks: list[str] = []
+    capture = False
+    token = f"#{pr_number}"
+    for line in lines:
+        lower = line.lower()
+        if token in lower or f"pr {pr_number}" in lower or f"pr#{pr_number}" in lower.replace(" ", ""):
+            capture = True
+            chunks.append(line)
+            continue
+        if capture:
+            if _PR_NUMBER_RE.search(line) and token not in line.lower():
+                break
+            if line.strip() == "" and len(chunks) > 3:
+                break
+            chunks.append(line)
+    if chunks:
+        return "\n".join(chunks)
+    return text or ""
+
+
+def _has_head_sha(text: str, head_sha: str | None) -> bool:
+    if not head_sha:
+        return bool(_FULL_SHA.search(text) or _SHORT_SHA.search(text))
+    head = head_sha.strip().lower()
+    if head in text.lower():
+        return True
+    if len(head) >= 7 and head[:7] in text.lower():
+        return True
+    return bool(_FULL_SHA.search(text))
+
+
+def assess_non_mergeable_skip_proof(
+    report_text: str,
+    *,
+    skipped_prs: list[dict] | None = None,
+) -> dict[str, Any]:
+    """Validate skipped non-mergeable PR documentation in reviewer reports (#322)."""
+    text = report_text or ""
+    reasons: list[str] = []
+    assessments: list[dict[str, Any]] = []
+
+    for entry in skipped_prs or []:
+        pr_number = entry.get("pr_number")
+        if pr_number is None:
+            reasons.append("skipped PR entry missing pr_number")
+            continue
+        pr_number = int(pr_number)
+        section = _pr_section(text, pr_number)
+        mergeable = entry.get("mergeable")
+        verified = entry.get("mergeability_verified")
+        classification = (entry.get("classification") or "").strip().upper()
+        head_sha = (entry.get("head_sha") or "").strip() or None
+
+        item_reasons: list[str] = []
+
+        if f"#{pr_number}" not in text.lower() and f"pr {pr_number}" not in text.lower():
+            item_reasons.append(f"skipped PR #{pr_number} not documented in final report")
+
+        if mergeable is False or verified is False:
+            if not _MERGEABILITY_UNVERIFIED_RE.search(section) and verified is False:
+                if "MERGEABILITY_UNVERIFIED" not in classification:
+                    item_reasons.append(
+                        f"PR #{pr_number} conflict proof unavailable; report must classify "
+                        "MERGEABILITY_UNVERIFIED"
+                    )
+            elif verified is not False:
+                if not _MERGEABILITY_FALSE_RE.search(section):
+                    item_reasons.append(
+                        f"PR #{pr_number} skip missing mergeability:false proof"
+                    )
+                if not _has_head_sha(section, head_sha):
+                    item_reasons.append(
+                        f"PR #{pr_number} skip missing current head SHA"
+                    )
+                if not _CONFLICT_PROOF_RE.search(section):
+                    item_reasons.append(
+                        f"PR #{pr_number} skip missing conflict proof command/tool"
+                    )
+                if entry.get("head_changed_since_prior_blocker") is not None:
+                    if not _HEAD_CHANGED_RE.search(section):
+                        item_reasons.append(
+                            f"PR #{pr_number} skip missing head-changed-since-blocker proof"
+                        )
+
+        if (
+            entry.get("conflicting_files")
+            and not _CONFLICTING_FILES_RE.search(section)
+            and not any(
+                path.lower() in section.lower()
+                for path in (entry.get("conflicting_files") or [])
+            )
+        ):
+            item_reasons.append(
+                f"PR #{pr_number} has conflicting files in session proof but "
+                "report omits file-level conflict proof"
+            )
+
+        proven = not item_reasons
+        assessments.append({
+            "pr_number": pr_number,
+            "proven": proven,
+            "classification": classification or (
+                "MERGEABILITY_UNVERIFIED" if verified is False else "NON_MERGEABLE_SKIPPED"
+            ),
+            "reasons": item_reasons,
+        })
+        reasons.extend(item_reasons)
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "downgraded": False,
+        "assessments": assessments,
+        "reasons": reasons,
+        "safe_next_action": (
+            "document each skipped non-mergeable PR with head SHA, mergeability result, "
+            "conflict proof command, conflicting files, and head-change status"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_mutation_categories.py

@@ -0,0 +1,130 @@
+"""Precise mutation category verifier for reviewer controller handoffs (#319)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_CONTROLLER_HANDOFF_RE = re.compile(r"controller handoff", re.IGNORECASE)
+_WORKSPACE_MUTATIONS_RE = re.compile(
+    r"^\s*[-*]?\s*workspace\s+mutations\s*:",
+    re.IGNORECASE | re.MULTILINE,
+)
+_VAGUE_MUTATIONS_NONE_RE = re.compile(
+    r"^\s*[-*]?\s*mutations\s*:\s*none\s*$",
+    re.IGNORECASE | re.MULTILINE,
+)
+
+_REQUIRED_CATEGORIES = (
+    "file edits by reviewer",
+    "worktree/index mutations",
+    "git ref mutations",
+)
+_WORKTREE_FIELD_ALIASES = (
+    "worktree/index mutations",
+    "worktree mutations",
+)
+
+
+def _has_category(text: str, category: str) -> bool:
+    pattern = re.compile(
+        rf"^\s*[-*]?\s*{re.escape(category)}\s*:",
+        re.IGNORECASE | re.MULTILINE,
+    )
+    return bool(pattern.search(text))
+
+
+def _has_worktree_category(text: str) -> bool:
+    return any(_has_category(text, alias) for alias in _WORKTREE_FIELD_ALIASES)
+
+
+def _normalize_for_consistency_check(text: str) -> str:
+    """Map #319 precise labels to #313 field names for consistency delegation."""
+    normalized = text
+    if _has_category(text, "worktree/index mutations") and not _has_category(
+        text, "worktree mutations"
+    ):
+        normalized = re.sub(
+            r"(worktree/index mutations\s*:)",
+            "Worktree mutations:",
+            normalized,
+            flags=re.IGNORECASE,
+        )
+    return normalized
+
+
+def assess_mutation_categories_report(
+    report_text: str,
+    *,
+    handoff_session: dict | None = None,
+    observed_commands: list | None = None,
+) -> dict[str, Any]:
+    """Require precise mutation categories in reviewer controller handoffs (#319)."""
+    text = report_text or ""
+    session = dict(handoff_session or {})
+    reasons: list[str] = []
+    lower = text.lower()
+
+    is_controller = bool(
+        session.get("controller_handoff")
+        or _CONTROLLER_HANDOFF_RE.search(text)
+    )
+    if not is_controller and not session.get("require_categories"):
+        return {
+            "proven": True,
+            "block": False,
+            "reasons": [],
+            "controller_handoff": False,
+            "safe_next_action": "proceed",
+        }
+
+    if _WORKSPACE_MUTATIONS_RE.search(text):
+        reasons.append(
+            "controller handoffs must not use legacy 'Workspace mutations'; "
+            "use precise mutation category fields"
+        )
+
+    if _VAGUE_MUTATIONS_NONE_RE.search(text):
+        reasons.append(
+            "controller handoffs must not use vague 'Mutations: none'; "
+            "report each precise category separately"
+        )
+
+    missing = [
+        category
+        for category in _REQUIRED_CATEGORIES
+        if category != "worktree/index mutations" and not _has_category(text, category)
+    ]
+    if not _has_worktree_category(text):
+        missing.append("worktree/index mutations")
+
+    if missing:
+        reasons.append(
+            "controller handoff missing precise mutation categories: "
+            + ", ".join(missing)
+        )
+
+    commands = observed_commands or session.get("observed_commands")
+    if commands:
+        from review_proofs import assess_workspace_mutation_consistency
+
+        consistency = assess_workspace_mutation_consistency(
+            _normalize_for_consistency_check(text),
+            commands,
+        )
+        if not consistency.get("complete"):
+            reasons.extend(consistency.get("reasons") or [])
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "controller_handoff": True,
+        "safe_next_action": (
+            "replace Workspace mutations with file edits, worktree/index, git ref, "
+            "and other precise mutation category fields"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_pr_lease.py

@@ -0,0 +1,382 @@
+"""Per-PR reviewer leases for safe parallel review sessions (#407)."""
+
+from __future__ import annotations
+
+import os
+import re
+import uuid
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+MARKER = "<!-- mcp-review-lease:v1 -->"
+
+_FIELD_RE = re.compile(
+    r"^\s*([a-z_]+)\s*:\s*(.+?)\s*$",
+    re.IGNORECASE | re.MULTILINE,
+)
+_FULL_SHA = re.compile(r"^[0-9a-f]{40}$", re.IGNORECASE)
+
+_TERMINAL_PHASES = frozenset({"done", "released", "blocked"})
+_ACTIVE_PHASES = frozenset({
+    "claimed",
+    "validating",
+    "approved",
+    "request-changes",
+    "merging",
+})
+
+DEFAULT_LEASE_TTL_MINUTES = 120
+STALE_WARNING_MINUTES = 30
+RECLAIMABLE_MINUTES = 60
+
+_SESSION_LEASE: dict[str, Any] | None = None
+
+
+def _parse_timestamp(value: str | None) -> datetime | None:
+    if not value:
+        return None
+    text = value.strip()
+    if text.endswith("Z"):
+        text = text[:-1] + "+00:00"
+    try:
+        parsed = datetime.fromisoformat(text)
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        return parsed.replace(tzinfo=timezone.utc)
+    return parsed.astimezone(timezone.utc)
+
+
+def _normalize_sha(value: str | None) -> str | None:
+    text = (value or "").strip().lower()
+    return text if text and _FULL_SHA.match(text) else None
+
+
+def _parse_pr_ref(value: str | None) -> int | None:
+    digits = re.sub(r"[^\d]", "", value or "")
+    return int(digits) if digits.isdigit() else None
+
+
+def new_session_id() -> str:
+    return f"{os.getpid()}-{uuid.uuid4().hex[:12]}"
+
+
+def format_lease_body(
+    *,
+    repo: str,
+    pr_number: int,
+    issue_number: int | None,
+    reviewer_identity: str,
+    profile: str,
+    session_id: str,
+    worktree: str,
+    phase: str,
+    candidate_head: str | None,
+    target_branch: str,
+    target_branch_sha: str | None,
+    last_activity: datetime | None = None,
+    expires_at: datetime | None = None,
+    blocker: str = "none",
+) -> str:
+    now = last_activity or datetime.now(timezone.utc)
+    expires = expires_at or (now + timedelta(minutes=DEFAULT_LEASE_TTL_MINUTES))
+    last_text = now.astimezone(timezone.utc).replace(microsecond=0).isoformat().replace(
+        "+00:00", "Z"
+    )
+    expires_text = expires.astimezone(timezone.utc).replace(microsecond=0).isoformat().replace(
+        "+00:00", "Z"
+    )
+    issue_text = f"#{issue_number}" if issue_number else "none"
+    lines = [
+        MARKER,
+        f"repo: {repo}",
+        f"pr: #{pr_number}",
+        f"issue: {issue_text}",
+        f"reviewer_identity: {reviewer_identity}",
+        f"profile: {profile}",
+        f"session_id: {session_id}",
+        f"worktree: {worktree}",
+        f"phase: {phase}",
+        f"candidate_head: {candidate_head or 'none'}",
+        f"target_branch: {target_branch}",
+        f"target_branch_sha: {target_branch_sha or 'none'}",
+        f"last_activity: {last_text}",
+        f"expires_at: {expires_text}",
+        f"blocker: {blocker}",
+    ]
+    return "\n".join(lines)
+
+
+def parse_lease_comment(body: str) -> dict[str, Any] | None:
+    text = body or ""
+    if MARKER not in text:
+        return None
+    fields: dict[str, str] = {}
+    for match in _FIELD_RE.finditer(text):
+        fields[match.group(1).strip().lower()] = match.group(2).strip()
+    if not fields:
+        return None
+    return {
+        "repo": fields.get("repo"),
+        "pr_number": _parse_pr_ref(fields.get("pr")),
+        "issue_number": _parse_pr_ref(fields.get("issue")),
+        "reviewer_identity": fields.get("reviewer_identity"),
+        "profile": fields.get("profile"),
+        "session_id": fields.get("session_id"),
+        "worktree": fields.get("worktree"),
+        "phase": (fields.get("phase") or "").strip().lower() or None,
+        "candidate_head": _normalize_sha(fields.get("candidate_head")),
+        "target_branch": fields.get("target_branch"),
+        "target_branch_sha": _normalize_sha(fields.get("target_branch_sha")),
+        "last_activity": fields.get("last_activity"),
+        "expires_at": fields.get("expires_at"),
+        "blocker": fields.get("blocker"),
+        "raw_fields": fields,
+    }
+
+
+def _lease_entries(comments: list[dict], *, pr_number: int) -> list[dict]:
+    entries: list[dict] = []
+    for comment in comments or []:
+        parsed = parse_lease_comment(comment.get("body") or "")
+        if not parsed:
+            continue
+        if parsed.get("pr_number") not in (None, pr_number):
+            continue
+        entries.append({
+            **parsed,
+            "comment_id": comment.get("id"),
+            "author": (comment.get("user") or {}).get("login") or comment.get("author"),
+            "created_at": comment.get("created_at"),
+            "updated_at": comment.get("updated_at"),
+        })
+    return entries
+
+
+def _lease_expired(lease: dict, *, now: datetime) -> bool:
+    expires_at = _parse_timestamp(lease.get("expires_at"))
+    return bool(expires_at and expires_at <= now)
+
+
+def _minutes_since_activity(lease: dict, *, now: datetime) -> float | None:
+    last = _parse_timestamp(lease.get("last_activity"))
+    if not last:
+        return None
+    return (now - last).total_seconds() / 60.0
+
+
+def classify_lease_freshness(lease: dict, *, now: datetime | None = None) -> str:
+    """Return active, stale_warning, reclaimable, expired, or terminal."""
+    now = now or datetime.now(timezone.utc)
+    phase = (lease.get("phase") or "").strip().lower()
+    if phase in _TERMINAL_PHASES:
+        return "terminal"
+    if _lease_expired(lease, now=now):
+        return "expired"
+    minutes = _minutes_since_activity(lease, now=now)
+    if minutes is None:
+        return "active"
+    if minutes >= RECLAIMABLE_MINUTES:
+        return "reclaimable"
+    if minutes >= STALE_WARNING_MINUTES:
+        return "stale_warning"
+    return "active"
+
+
+def find_active_reviewer_lease(
+    comments: list[dict],
+    *,
+    pr_number: int,
+    now: datetime | None = None,
+) -> dict[str, Any] | None:
+    """Newest non-terminal, unexpired lease for *pr_number*."""
+    now = now or datetime.now(timezone.utc)
+    for lease in reversed(_lease_entries(comments, pr_number=pr_number)):
+        phase = (lease.get("phase") or "").strip().lower()
+        if phase in _TERMINAL_PHASES:
+            continue
+        if _lease_expired(lease, now=now):
+            continue
+        if phase in _ACTIVE_PHASES or phase:
+            lease = dict(lease)
+            lease["freshness"] = classify_lease_freshness(lease, now=now)
+            return lease
+    return None
+
+
+def assess_acquire_lease(
+    comments: list[dict],
+    *,
+    pr_number: int,
+    reviewer_identity: str,
+    profile: str,
+    session_id: str,
+    repo: str,
+    issue_number: int | None,
+    worktree: str,
+    candidate_head: str | None,
+    target_branch: str,
+    target_branch_sha: str | None,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    """Fail closed when another session holds an active lease."""
+    now = now or datetime.now(timezone.utc)
+    reasons: list[str] = []
+    existing = find_active_reviewer_lease(comments, pr_number=pr_number, now=now)
+    if existing:
+        owner_session = (existing.get("session_id") or "").strip()
+        freshness = existing.get("freshness") or classify_lease_freshness(existing, now=now)
+        if owner_session and owner_session != session_id and freshness in {
+            "active", "stale_warning"
+        }:
+            reasons.append(
+                f"PR #{pr_number} already has active reviewer lease "
+                f"(session_id={owner_session}, phase={existing.get('phase')})"
+            )
+        elif owner_session and owner_session != session_id and freshness == "reclaimable":
+            reasons.append(
+                f"PR #{pr_number} lease is reclaimable but still held by "
+                f"session_id={owner_session}; explicit reclaim not implemented "
+                "(fail closed)"
+            )
+
+    if not (reviewer_identity or "").strip():
+        reasons.append("reviewer identity required for lease acquisition")
+    if not (session_id or "").strip():
+        reasons.append("session_id required for lease acquisition")
+    if not (worktree or "").strip():
+        reasons.append("worktree path required for lease acquisition")
+
+    allowed = not reasons
+    body = None
+    if allowed:
+        body = format_lease_body(
+            repo=repo,
+            pr_number=pr_number,
+            issue_number=issue_number,
+            reviewer_identity=reviewer_identity,
+            profile=profile,
+            session_id=session_id,
+            worktree=worktree,
+            phase="claimed",
+            candidate_head=candidate_head,
+            target_branch=target_branch,
+            target_branch_sha=target_branch_sha,
+            last_activity=now,
+        )
+    return {
+        "acquire_allowed": allowed,
+        "reasons": reasons,
+        "existing_lease": existing,
+        "lease_body": body,
+        "session_id": session_id,
+    }
+
+
+def record_session_lease(lease: dict[str, Any]) -> dict[str, Any]:
+    global _SESSION_LEASE
+    _SESSION_LEASE = dict(lease)
+    return dict(_SESSION_LEASE)
+
+
+def clear_session_lease() -> None:
+    global _SESSION_LEASE
+    _SESSION_LEASE = None
+
+
+def get_session_lease() -> dict[str, Any] | None:
+    return dict(_SESSION_LEASE) if _SESSION_LEASE else None
+
+
+def assess_mutation_lease_gate(
+    *,
+    pr_number: int,
+    comments: list[dict],
+    reviewer_identity: str,
+    session_id: str | None,
+    mutation: str,
+    live_head_sha: str | None,
+    pinned_head_sha: str | None,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    """Reviewer mutations require an owned, current PR lease."""
+    now = now or datetime.now(timezone.utc)
+    reasons: list[str] = []
+    session = get_session_lease()
+    active = find_active_reviewer_lease(comments, pr_number=pr_number, now=now)
+
+    if not session:
+        reasons.append(
+            f"no in-session reviewer lease recorded; acquire via "
+            f"gitea_acquire_reviewer_pr_lease before {mutation}"
+        )
+    elif session.get("pr_number") != pr_number:
+        reasons.append(
+            f"session lease is for PR #{session.get('pr_number')}, not #{pr_number}"
+        )
+    elif (session.get("session_id") or "") != (session_id or session.get("session_id")):
+        reasons.append("session lease session_id mismatch (fail closed)")
+
+    if active:
+        owner = (active.get("session_id") or "").strip()
+        if owner and session_id and owner != session_id:
+            reasons.append(
+                f"active PR lease owned by session_id={owner}; current session "
+                f"cannot {mutation}"
+            )
+        pinned = _normalize_sha(pinned_head_sha)
+        live = _normalize_sha(live_head_sha)
+        lease_head = active.get("candidate_head")
+        if pinned and live and pinned != live:
+            reasons.append(
+                "PR head changed during lease; stop and re-validate before "
+                f"reviewer {mutation}"
+            )
+        if lease_head and live and lease_head != live:
+            reasons.append(
+                "live PR head differs from lease candidate_head; refresh lease "
+                f"before {mutation}"
+            )
+        freshness = active.get("freshness") or classify_lease_freshness(active, now=now)
+        if freshness in {"expired", "reclaimable"}:
+            reasons.append(f"reviewer lease freshness is '{freshness}' (fail closed)")
+    else:
+        reasons.append(f"no active reviewer lease found on PR #{pr_number}")
+
+    allowed = not reasons
+    return {
+        "mutation_allowed": allowed,
+        "block": not allowed,
+        "reasons": reasons,
+        "active_lease": active,
+        "session_lease": session,
+    }
+
+
+def assess_lease_inventory(
+    comments_by_pr: dict[int, list[dict]],
+    *,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    """Summarize lease states across PR comment threads."""
+    now = now or datetime.now(timezone.utc)
+    active: list[dict] = []
+    stale: list[dict] = []
+    reclaimable: list[dict] = []
+    for pr_number, comments in (comments_by_pr or {}).items():
+        lease = find_active_reviewer_lease(comments, pr_number=pr_number, now=now)
+        if not lease:
+            continue
+        freshness = lease.get("freshness") or classify_lease_freshness(lease, now=now)
+        entry = {"pr_number": pr_number, "session_id": lease.get("session_id"), "freshness": freshness}
+        if freshness == "stale_warning":
+            stale.append(entry)
+        elif freshness == "reclaimable":
+            reclaimable.append(entry)
+        else:
+            active.append(entry)
+    return {
+        "active_review_leases": active,
+        "stale_review_leases": stale,
+        "reclaimable_review_leases": reclaimable,
+    }

reviewer_proof_backed_handoff.py

@@ -0,0 +1,217 @@
+"""Proof-backed reviewer handoff claim verifier (#395)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_PAGINATION_FINALITY = re.compile(
+    r"has_more\s*:\s*false|is_final_page\s*:\s*true|"
+    r"inventory_complete\s*:\s*true|pages_fetched|total_count\s*:",
+    re.I,
+)
+_PAGE_SIZE_ONLY = re.compile(
+    r"(?:less|fewer) than (?:the )?(?:default )?page[- ]?size|"
+    r"under (?:the )?50[- ]?(?:item )?limit|"
+    r"returned \d+ (?:open )?prs?.*less than 50",
+    re.I,
+)
+_INVENTORY_COMPLETE_CLAIM = re.compile(
+    r"\b(?:inventory (?:is )?complete|inventory exhaustive|"
+    r"complete (?:pr )?inventory)\b",
+    re.I,
+)
+_SKIP_CLAIM = re.compile(
+    r"\b(?:earlier prs? skipped|skipped (?:earlier )?pr|"
+    r"skip(?:ped)? pr #?\d+|non-mergeable|prior request.changes)\b",
+    re.I,
+)
+_CONFLICT_PROOF = re.compile(
+    r"merge simulation|git merge --no-commit|conflicting files|"
+    r"conflict proof|merge_exit|non-mergeable",
+    re.I,
+)
+_BASELINE_CLAIM = re.compile(
+    r"\b(?:baseline (?:validation|worktree|comparison)|"
+    r"same as master|pre-existing (?:on )?master|"
+    r"failure signatures match)\b",
+    re.I,
+)
+_BASELINE_PATH = re.compile(r"baseline worktree path\s*:\s*(\S+)", re.I)
+_BASELINE_SHA = re.compile(r"baseline (?:target )?sha\s*:\s*([0-9a-f]{7,40})", re.I)
+_BASELINE_DIRTY_BEFORE = re.compile(
+    r"baseline.*dirty before|dirty before.*baseline", re.I
+)
+_BASELINE_DIRTY_AFTER = re.compile(
+    r"baseline.*dirty after|dirty after.*baseline", re.I
+)
+_BASELINE_COMMAND = re.compile(
+    r"baseline.*(?:validation )?command|pytest.*baseline", re.I
+)
+_BASELINE_RESULT = re.compile(
+    r"baseline.*(?:validation )?result|baseline_exit|baseline failures", re.I
+)
+_MASTER_INTEGRATION = re.compile(
+    r"\b(?:merged master into|merge(?:d)? (?:remote[- ]tracking )?branch.*master|"
+    r"master integration|integrated master|rebase.*master)\b",
+    re.I,
+)
+_CLEANUP_CLAIM = re.compile(
+    r"\b(?:worktree(?:s)? (?:were )?cleaned|cleanup (?:result|mutations)|"
+    r"removed (?:session[- ]owned )?worktree|git worktree remove)\b",
+    re.I,
+)
+_WORKTREE_LIST = re.compile(r"git worktree list|worktree list proof", re.I)
+_PROOF_SOURCE = re.compile(
+    r"proof source\s*:\s*(command|mcp metadata|prior blocker|not checked)",
+    re.I,
+)
+_HANDOFF_SECTION = re.compile(r"^##\s*Controller Handoff\s*$", re.I | re.M)
+
+
+def _handoff_fields(report_text: str) -> dict[str, str]:
+    text = report_text or ""
+    match = _HANDOFF_SECTION.search(text)
+    if not match:
+        return {}
+    fields: dict[str, str] = {}
+    for line in text[match.end() :].splitlines():
+        stripped = line.strip().lstrip("-*").strip()
+        if ":" not in stripped:
+            continue
+        key, value = stripped.split(":", 1)
+        fields[key.strip().lower()] = value.strip()
+    return fields
+
+
+def _command_text(entry: Any) -> str:
+    if isinstance(entry, dict):
+        return str(entry.get("command") or entry.get("tool") or "").strip()
+    return str(entry or "").strip()
+
+
+def _action_log_has(action_log: list | None, pattern: re.Pattern[str]) -> bool:
+    for entry in action_log or []:
+        blob = " ".join(
+            filter(
+                None,
+                [
+                    _command_text(entry),
+                    str(entry.get("result") or "") if isinstance(entry, dict) else "",
+                    str(entry.get("reason") or "") if isinstance(entry, dict) else "",
+                ],
+            )
+        )
+        if pattern.search(blob):
+            return True
+    return False
+
+
+def assess_proof_backed_handoff_report(
+    report_text: str,
+    *,
+    action_log: list | None = None,
+    inventory_session: dict | None = None,
+    baseline_session: dict | None = None,
+    skip_session: list[dict] | None = None,
+) -> dict[str, Any]:
+    """Require explicit command/tool evidence for proof-sensitive review claims (#395)."""
+    text = report_text or ""
+    fields = _handoff_fields(text)
+    reasons: list[str] = []
+    inventory = dict(inventory_session or {})
+    baseline = dict(baseline_session or {})
+    skips = list(skip_session or [])
+
+    pagination_field = fields.get("inventory pagination proof", "")
+    if _INVENTORY_COMPLETE_CLAIM.search(text) or _PAGE_SIZE_ONLY.search(text):
+        has_meta = bool(
+            inventory.get("inventory_complete")
+            or inventory.get("pagination_complete")
+            or _PAGINATION_FINALITY.search(pagination_field)
+            or _PAGINATION_FINALITY.search(text)
+            or _action_log_has(action_log, re.compile(r"gitea_list_prs", re.I))
+        )
+        if _PAGE_SIZE_ONLY.search(text) and not has_meta:
+            reasons.append(
+                "inventory completeness claimed from page-size assumption only; "
+                "require has_more=false, is_final_page=true, or inventory_complete=true"
+            )
+        elif _INVENTORY_COMPLETE_CLAIM.search(text) and not has_meta:
+            reasons.append(
+                "inventory complete claim lacks explicit pagination metadata proof"
+            )
+
+    if _SKIP_CLAIM.search(text) or fields.get("earlier prs skipped", "").lower() not in {
+        "",
+        "none",
+        "n/a",
+    }:
+        skip_proof = bool(
+            skips
+            or _CONFLICT_PROOF.search(text)
+            or _action_log_has(
+                action_log, re.compile(r"git merge --no-commit|gitea_get_pr_review_feedback", re.I)
+            )
+        )
+        if not skip_proof:
+            reasons.append(
+                "earlier PR skip claim lacks command/tool conflict or blocker proof"
+            )
+
+    if _BASELINE_CLAIM.search(text) or fields.get("baseline worktree used", "").lower() == "true":
+        baseline_ok = bool(
+            baseline.get("complete")
+            or (
+                _BASELINE_PATH.search(text)
+                and _BASELINE_SHA.search(text)
+                and (_BASELINE_DIRTY_BEFORE.search(text) or baseline.get("clean_before"))
+                and (_BASELINE_COMMAND.search(text) or baseline.get("command"))
+                and (_BASELINE_RESULT.search(text) or baseline.get("result"))
+                and (_BASELINE_DIRTY_AFTER.search(text) or baseline.get("clean_after"))
+            )
+        )
+        if not baseline_ok:
+            reasons.append(
+                "baseline validation claim missing worktree path, target SHA, "
+                "dirty-before/after status, command, or result proof"
+            )
+
+    if _MASTER_INTEGRATION.search(text):
+        if not _action_log_has(
+            action_log,
+            re.compile(r"git merge.*master|git rebase.*master", re.I),
+        ) and not re.search(r"merge_exit\s*=\s*\d+|merge simulation", text, re.I):
+            reasons.append(
+                "master integration claim lacks exact merge/rebase command and result"
+            )
+
+    if _CLEANUP_CLAIM.search(text) or fields.get("cleanup mutations", "").lower() not in {
+        "",
+        "none",
+        "n/a",
+    }:
+        if not (_WORKTREE_LIST.search(text) or _action_log_has(action_log, _WORKTREE_LIST)):
+            reasons.append(
+                "cleanup claim lacks final git worktree list or equivalent proof"
+            )
+
+    if re.search(r"\blive proof\b", text, re.I) and not _PROOF_SOURCE.search(text):
+        if not action_log:
+            reasons.append(
+                "live proof wording requires proof source classification "
+                "(command, MCP metadata, prior blocker, or not checked)"
+            )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "safe_next_action": (
+            "cite explicit command/tool evidence or structured MCP pagination metadata "
+            "for each proof-sensitive claim"
+            if not proven
+            else "proceed"
+        ),
+    }

reviewer_reconcile_inventory.py

@@ -0,0 +1,162 @@
+"""Reconciliation PR inventory pagination proof verifier (#308)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_COMPLETE_SCAN_CLAIM_RE = re.compile(
+    r"\b(?:all already[- ]landed(?:\s+prs?)?(?:\s+were)?\s+found|"
+    r"complete queue scan|all open prs? (?:were )?(?:found|checked|inventoried|listed)|"
+    r"inventory (?:is )?complete|exhaustive (?:pr )?inventory|"
+    r"no additional already[- ]landed|scanned (?:the )?(?:full )?open pr queue)\b",
+    re.I,
+)
+
+_FINALITY_RE = re.compile(
+    r"is_final_page\s*:\s*true|has_more\s*:\s*false|no next page|final[- ]page|"
+    r"pagination_complete\s*:\s*true|inventory pagination proof\s*:\s*(?!assumed|none\b).+",
+    re.I,
+)
+
+_REQUESTED_PAGE_SIZE_RE = re.compile(
+    r"requested page size\s*:\s*(\d+)|page[- ]?size\s*(?:=|:)\s*(\d+)",
+    re.I,
+)
+_PAGES_FETCHED_RE = re.compile(
+    r"pages? fetched\s*:\s*(\d+)|page count\s*:\s*(\d+)",
+    re.I,
+)
+_RETURNED_PER_PAGE_RE = re.compile(
+    r"returned pr count(?: per page)?\s*:|open pr count per page|"
+    r"returned \d+ open prs? per page|per[- ]page counts?\s*:",
+    re.I,
+)
+_EXACT_LIMIT_RETURN_RE = re.compile(
+    r"returned\s+(\d+)\s+open prs?|listed\s+(\d+)\s+open prs?",
+    re.I,
+)
+
+_DEFAULT_PAGE_SIZE_ASSUMPTION = re.compile(
+    r"(?:less|fewer) than (?:the )?(?:default )?(?:gitea )?page[- ]?(?:size|limit)|"
+    r"default (?:gitea )?page[- ]?size|assumed complete",
+    re.I,
+)
+
+
+def _int_from_groups(match: re.Match[str] | None) -> int | None:
+    if not match:
+        return None
+    for group in match.groups():
+        if group:
+            return int(group)
+    return None
+
+
+def _pagination_proven(text: str, session: dict) -> bool:
+    if session.get("pagination_complete") or session.get("inventory_complete"):
+        return True
+    if _FINALITY_RE.search(text):
+        return True
+    pages = session.get("pages_fetched")
+    if isinstance(pages, int) and pages >= 1 and session.get("is_final_page"):
+        return True
+    return False
+
+
+def _metadata_present(text: str, session: dict) -> list[str]:
+    missing: list[str] = []
+    has_page_size = bool(
+        _REQUESTED_PAGE_SIZE_RE.search(text)
+        or session.get("requested_page_size")
+    )
+    has_pages_fetched = bool(
+        _PAGES_FETCHED_RE.search(text) or session.get("pages_fetched")
+    )
+    has_returned_counts = bool(
+        _RETURNED_PER_PAGE_RE.search(text) or session.get("returned_per_page")
+    )
+    if not has_page_size:
+        missing.append("requested page size")
+    if not has_pages_fetched:
+        missing.append("page count fetched")
+    if not has_returned_counts:
+        missing.append("returned PR count per page")
+    if not _pagination_proven(text, session):
+        missing.append("final-page/no-next-page proof")
+    return missing
+
+
+def assess_reconcile_inventory_report(
+    report_text: str,
+    *,
+    inventory_session: dict | None = None,
+) -> dict[str, Any]:
+    """Validate PR inventory pagination proof in reconciliation reports (#308)."""
+    text = report_text or ""
+    session = dict(inventory_session or {})
+    reasons: list[str] = []
+
+    claims_scan = bool(_COMPLETE_SCAN_CLAIM_RE.search(text))
+    lists_open_prs = bool(
+        re.search(r"open prs? listed|listed open prs?|pr inventory", text, re.I)
+    )
+
+    if not claims_scan and not lists_open_prs and not session.get("inventory_required"):
+        return {
+            "proven": True,
+            "block": False,
+            "reasons": [],
+            "inventory_claimed": False,
+            "safe_next_action": "proceed",
+        }
+
+    if _DEFAULT_PAGE_SIZE_ASSUMPTION.search(text) and not _pagination_proven(text, session):
+        reasons.append(
+            "reconciliation inventory assumed complete from page-size guess "
+            "without final-page proof (#308)"
+        )
+
+    if claims_scan and not _pagination_proven(text, session):
+        reasons.append(
+            "complete queue scan or all already-landed claim requires "
+            "pagination finality proof (#308)"
+        )
+
+    missing = _metadata_present(text, session)
+    if (claims_scan or lists_open_prs) and missing:
+        reasons.append(
+            "reconciliation inventory missing pagination metadata: "
+            + ", ".join(missing)
+        )
+
+    requested = session.get("requested_page_size")
+    returned = session.get("returned_page_size")
+    if isinstance(requested, int) and isinstance(returned, int):
+        if returned >= requested > 0 and not _pagination_proven(text, session):
+            reasons.append(
+                "exactly-full first reconciliation page without final-page proof (#308)"
+            )
+    else:
+        for match in _EXACT_LIMIT_RETURN_RE.finditer(text):
+            count = _int_from_groups(match)
+            if count in {10, 20, 50} and not _pagination_proven(text, session):
+                reasons.append(
+                    "exactly-full first reconciliation page without final-page proof (#308)"
+                )
+                break
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": list(dict.fromkeys(reasons)),
+        "inventory_claimed": claims_scan or lists_open_prs,
+        "pagination_proven": _pagination_proven(text, session),
+        "safe_next_action": (
+            "include requested page size, pages fetched, per-page counts, and "
+            "final-page/no-next-page proof before claiming complete scan"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_reconcile_linked_issue.py

@@ -0,0 +1,191 @@
+"""Reconciliation linked-issue live proof verifier (#300)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_HANDOFF_SECTION_RE = re.compile(r"^##\s*Controller Handoff\s*$", re.I | re.M)
+
+_LINKED_ISSUE_FIELD_RE = re.compile(
+    r"linked issue\s*:\s*(.+)$",
+    re.I | re.M,
+)
+_LINKED_ISSUE_STATUS_RE = re.compile(
+    r"linked issue(?:\s+live)?\s+status\s*:\s*(.+)$",
+    re.I | re.M,
+)
+
+_STATUS_CLAIM_RE = re.compile(
+    r"\b(?:issue\s+#?\d+\s*\()?(open|closed|resolved)\b|"
+    r"issue\s+(?:is\s+)?(open|closed|resolved)\b|"
+    r"linked issue.*\b(open|closed|resolved)\b",
+    re.I,
+)
+_NOT_VERIFIED_RE = re.compile(r"not verified in this session", re.I)
+
+_LIVE_FETCH_PROOF_RE = re.compile(
+    r"gitea_view_issue|issue fetched live|live issue fetch|"
+    r"fetched linked issue.*(?:current|this) session|"
+    r"linked issue (?:fetch|proof).*(?:current|this) session|"
+    r"live linked issue proof",
+    re.I,
+)
+
+_ISSUE_ACTION_RECOMMEND_RE = re.compile(
+    r"(?:recommend(?:ed)?|should|must)\s+(?:close|reopen|comment on)\s+"
+    r"(?:the\s+)?(?:linked\s+)?issue|"
+    r"(?:close|reopen|comment on)\s+linked issue\s+#?\d+",
+    re.I,
+)
+_CAPABILITY_PROOF_RE = re.compile(
+    r"capability proof|exact capability|gitea_close_issue|"
+    r"gitea_mark_issue|gitea_create_issue_comment|gitea_edit_issue",
+    re.I,
+)
+
+_NO_LINKED_ISSUE_VALUES = frozenset({
+    "",
+    "none",
+    "n/a",
+    "not applicable",
+    "no linked issue",
+    "unknown",
+})
+
+
+def _handoff_field_map(report_text: str) -> dict[str, str]:
+    text = report_text or ""
+    match = _HANDOFF_SECTION_RE.search(text)
+    if not match:
+        return {}
+    fields: dict[str, str] = {}
+    for line in text[match.end() :].splitlines():
+        stripped = line.strip().lstrip("-*").strip()
+        if ":" not in stripped:
+            continue
+        key, value = stripped.split(":", 1)
+        fields[key.strip().lower()] = value.strip()
+    return fields
+
+
+def _extract_linked_issue_number(text: str, fields: dict[str, str]) -> int | None:
+    linked = fields.get("linked issue", "")
+    if linked.lower() in _NO_LINKED_ISSUE_VALUES:
+        return None
+    match = re.search(r"#?(\d+)", linked)
+    if match:
+        return int(match.group(1))
+    field_match = _LINKED_ISSUE_FIELD_RE.search(text)
+    if field_match:
+        num = re.search(r"#?(\d+)", field_match.group(1))
+        if num:
+            return int(num.group(1))
+    return None
+
+
+def _status_value(text: str, fields: dict[str, str]) -> str:
+    for key in ("linked issue live status", "linked issue status"):
+        if fields.get(key):
+            return fields[key]
+    match = _LINKED_ISSUE_STATUS_RE.search(text)
+    return match.group(1).strip() if match else ""
+
+
+def _live_proof_present(text: str, session: dict, issue_number: int | None) -> bool:
+    if session.get("live_fetched") or session.get("verified_live"):
+        return True
+    if session.get("issue_fetch_proof"):
+        return True
+    if _LIVE_FETCH_PROOF_RE.search(text):
+        return True
+    if issue_number is not None:
+        pattern = re.compile(
+            rf"gitea_view_issue.*#?{issue_number}|"
+            rf"issue\s+#?{issue_number}.*(?:fetched|viewed).*(?:current|this) session",
+            re.I,
+        )
+        if pattern.search(text):
+            return True
+    return False
+
+
+def assess_reconcile_linked_issue_report(
+    report_text: str,
+    *,
+    reconcile_session: dict | None = None,
+) -> dict[str, Any]:
+    """Validate linked issue status claims in reconciliation handoffs (#300)."""
+    text = report_text or ""
+    session = dict(reconcile_session or {})
+    fields = _handoff_field_map(text)
+    reasons: list[str] = []
+
+    issue_number = session.get("linked_issue_number")
+    if issue_number is None:
+        issue_number = _extract_linked_issue_number(text, fields)
+
+    if issue_number is None:
+        status = _status_value(text, fields)
+        if status and status.lower() not in _NO_LINKED_ISSUE_VALUES:
+            if _STATUS_CLAIM_RE.search(status):
+                reasons.append(
+                    "linked issue status reported without identifying the linked issue (#300)"
+                )
+        if not reasons:
+            return {
+                "proven": True,
+                "block": False,
+                "reasons": [],
+                "linked_issue_number": None,
+                "safe_next_action": "proceed",
+            }
+
+    status = _status_value(text, fields)
+    status_lower = status.lower()
+
+    if session.get("issue_missing"):
+        if status_lower and "not verified" not in status_lower:
+            reasons.append(
+                "missing linked issue must be reported as "
+                "'not verified in this session' (#300)"
+            )
+    elif status:
+        if _NOT_VERIFIED_RE.search(status):
+            pass
+        elif _STATUS_CLAIM_RE.search(status):
+            if not _live_proof_present(text, session, issue_number):
+                reasons.append(
+                    "linked issue open/closed/resolved status requires live "
+                    "gitea_view_issue proof in the current session (#300)"
+                )
+        elif status_lower not in _NO_LINKED_ISSUE_VALUES:
+            if not _live_proof_present(text, session, issue_number):
+                reasons.append(
+                    "linked issue status claim requires live fetch proof or "
+                    "'not verified in this session' (#300)"
+                )
+
+    if _ISSUE_ACTION_RECOMMEND_RE.search(text):
+        if not _CAPABILITY_PROOF_RE.search(text) and not session.get(
+            "issue_action_capability_proven"
+        ):
+            reasons.append(
+                "recommended linked issue close/reopen/comment requires "
+                "exact capability proof (#300)"
+            )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": list(dict.fromkeys(reasons)),
+        "linked_issue_number": issue_number,
+        "live_proof_present": _live_proof_present(text, session, issue_number),
+        "safe_next_action": (
+            "fetch linked issue with gitea_view_issue in this session or "
+            "report 'Linked issue status: not verified in this session'"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_validation_cwd_proof.py

@@ -0,0 +1,233 @@
+"""Explicit worktree and cwd proof for PR review validation (#398)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_FULL_SHA = re.compile(r"^[0-9a-f]{40}$", re.IGNORECASE)
+
+_PWD_RE = re.compile(
+    r"(?:^|\n)\s*(?:pwd|working\s+directory|cwd)\s*:\s*(\S+)",
+    re.IGNORECASE,
+)
+_HEAD_RE = re.compile(
+    r"(?:git\s+rev-parse\s+head|observed\s+head\s+sha)\s*:\s*([0-9a-f]{7,40})",
+    re.IGNORECASE | re.MULTILINE,
+)
+_EXPECTED_HEAD_RE = re.compile(
+    r"(?:expected\s+(?:pr\s+)?head\s+sha|candidate\s+head\s+sha|pinned\s+head)\s*:\s*([0-9a-f]{7,40})",
+    re.IGNORECASE,
+)
+_STATUS_RE = re.compile(
+    r"git\s+status\s+(?:--short\s+--branch|--short|-sb)\s*:\s*(.+)",
+    re.IGNORECASE,
+)
+_VALIDATION_CMD_RE = re.compile(
+    r"validation\s+command\s*:\s*(.+)",
+    re.IGNORECASE,
+)
+_GIT_C_CMD_RE = re.compile(r"git\s+-C\s+\S+", re.IGNORECASE)
+_CD_CMD_RE = re.compile(r"(?:^|&&\s*)cd\s+\S+", re.IGNORECASE)
+_BASELINE_CWD_RE = re.compile(
+    r"baseline\s+(?:worktree|working\s+directory|cwd)\s*:\s*(\S+)",
+    re.IGNORECASE,
+)
+_BASELINE_SHA_RE = re.compile(
+    r"baseline\s+(?:target\s+)?sha\s*:\s*([0-9a-f]{7,40})",
+    re.IGNORECASE,
+)
+_BASELINE_CMD_RE = re.compile(
+    r"baseline\s+validation\s+command\s*:\s*(.+)",
+    re.IGNORECASE,
+)
+
+
+def _normalize_path(path: str) -> str:
+    return (path or "").replace("\\", "/").rstrip("/")
+
+
+def _path_under_branches(path: str, project_root: str | None = None) -> bool:
+    normalized = _normalize_path(path)
+    if not normalized:
+        return False
+    if "/branches/" in f"{normalized}/":
+        return True
+    if normalized.endswith("/branches"):
+        return True
+    if project_root:
+        root = _normalize_path(project_root)
+        if normalized.startswith(f"{root}/"):
+            rel = normalized[len(root) + 1 :]
+            return rel == "branches" or rel.startswith("branches/")
+    return False
+
+
+def _expand_sha(sha: str) -> str:
+    return (sha or "").strip().lower()
+
+
+def _sha_matches(expected: str, observed: str) -> bool:
+    exp = _expand_sha(expected)
+    obs = _expand_sha(observed)
+    if not exp or not obs:
+        return False
+    if len(exp) == 40 and len(obs) == 40:
+        return exp == obs
+    return obs.startswith(exp) or exp.startswith(obs)
+
+
+def _command_has_explicit_cwd(command: str, cwd: str) -> bool:
+    text = (command or "").strip()
+    if not text:
+        return False
+    if _GIT_C_CMD_RE.search(text):
+        return True
+    if _CD_CMD_RE.search(text):
+        return True
+    if cwd and cwd in text:
+        return True
+    return False
+
+
+def assess_validation_cwd_proof_report(
+    report_text: str,
+    *,
+    validation_session: dict | None = None,
+    project_root: str | None = None,
+) -> dict[str, Any]:
+    """Require cwd/HEAD proof before reviewer validation claims (#398)."""
+    text = report_text or ""
+    session = dict(validation_session or {})
+    reasons: list[str] = []
+    violations: list[str] = []
+
+    claims_validation = bool(
+        session.get("validation_ran")
+        or _VALIDATION_CMD_RE.search(text)
+        or session.get("command")
+    )
+    if not claims_validation:
+        return {
+            "proven": True,
+            "block": False,
+            "claims_validation": False,
+            "reasons": [],
+            "violations": [],
+            "safe_next_action": "proceed",
+        }
+
+    expected_head = (
+        session.get("expected_head_sha")
+        or session.get("candidate_head_sha")
+        or ""
+    ).strip()
+    if not expected_head:
+        match = _EXPECTED_HEAD_RE.search(text)
+        expected_head = (match.group(1) if match else "").strip()
+
+    observed_head = (session.get("observed_head_sha") or "").strip()
+    if not observed_head:
+        match = _HEAD_RE.search(text)
+        observed_head = (match.group(1) if match else "").strip()
+
+    cwd = (
+        session.get("working_directory")
+        or session.get("cwd")
+        or session.get("pwd")
+        or ""
+    ).strip()
+    if not cwd:
+        match = _PWD_RE.search(text)
+        cwd = (match.group(1) if match else "").strip().rstrip(",.;")
+
+    command = (session.get("command") or "").strip()
+    if not command:
+        match = _VALIDATION_CMD_RE.search(text)
+        command = (match.group(1) if match else "").strip().rstrip(".;")
+
+    if not cwd:
+        reasons.append(
+            "validation claimed without pwd/working-directory proof (#398)"
+        )
+    elif not _path_under_branches(cwd, project_root):
+        violations.append(
+            f"validation cwd {cwd!r} is not under branches/ (#398)"
+        )
+        reasons.append(
+            "reviewer validation must run from a branches/ worktree, "
+            "not the main checkout (#398)"
+        )
+
+    if not observed_head:
+        reasons.append(
+            "validation claimed without git rev-parse HEAD / observed HEAD SHA "
+            "proof (#398)"
+        )
+    elif expected_head and not _sha_matches(expected_head, observed_head):
+        violations.append(
+            f"observed HEAD {observed_head} does not match expected "
+            f"PR head {expected_head} (#398)"
+        )
+        reasons.append("validation HEAD SHA must match pinned PR head (#398)")
+
+    if not _STATUS_RE.search(text) and session.get("git_status") is None:
+        reasons.append(
+            "validation claimed without git status --short --branch proof (#398)"
+        )
+
+    if command and cwd and not _command_has_explicit_cwd(command, cwd):
+        if session.get("tool_working_directory") is not True:
+            reasons.append(
+                "validation command must use git -C <worktree>, "
+                "cd <worktree> && ..., or tool-provided cwd metadata (#398)"
+            )
+
+    baseline_ran = bool(
+        session.get("baseline_validation_ran")
+        or _BASELINE_CMD_RE.search(text)
+    )
+    if baseline_ran:
+        baseline_cwd = (session.get("baseline_worktree_path") or "").strip()
+        if not baseline_cwd:
+            match = _BASELINE_CWD_RE.search(text)
+            baseline_cwd = (match.group(1) if match else "").strip().rstrip(",.;")
+        if not baseline_cwd or not _path_under_branches(baseline_cwd, project_root):
+            reasons.append(
+                "baseline validation claimed without baseline worktree cwd "
+                "under branches/ (#398)"
+            )
+        baseline_sha = (session.get("baseline_target_sha") or "").strip()
+        if not baseline_sha:
+            match = _BASELINE_SHA_RE.search(text)
+            baseline_sha = (match.group(1) if match else "").strip()
+        if not baseline_sha:
+            reasons.append(
+                "baseline validation claimed without baseline target SHA (#398)"
+            )
+        baseline_cmd = (session.get("baseline_command") or "").strip()
+        if not baseline_cmd:
+            match = _BASELINE_CMD_RE.search(text)
+            baseline_cmd = (match.group(1) if match else "").strip()
+        if not baseline_cmd:
+            reasons.append(
+                "baseline validation claimed without exact baseline command (#398)"
+            )
+
+    proven = not reasons and not violations
+    return {
+        "proven": proven,
+        "block": bool(violations) or not proven,
+        "claims_validation": True,
+        "expected_head_sha": expected_head or None,
+        "observed_head_sha": observed_head or None,
+        "working_directory": cwd or None,
+        "reasons": reasons,
+        "violations": violations,
+        "safe_next_action": (
+            "before validation record pwd, git rev-parse HEAD, git status, "
+            "expected PR head SHA; run commands with git -C or cd in the same line"
+            if not proven
+            else "proceed"
+        ),
+    }

reviewer_validation_failure_history.py

@@ -0,0 +1,198 @@
+"""Transient validation failure history verifier (#396).
+
+Reviewer sessions may observe validation failures that later pass on rerun.
+Final reports must document every failure observed during the session, not
+only the last passing result.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_SECTION_RE = re.compile(
+    r"validation failure history",
+    re.IGNORECASE,
+)
+_FAILURE_ENTRY_RE = re.compile(
+    r"(?:failure\s*(?:#|entry)?\s*\d+|validation failure)\s*:",
+    re.IGNORECASE,
+)
+_COMMAND_RE = re.compile(
+    r"(?:command|validation command)\s*:\s*(.+)",
+    re.IGNORECASE,
+)
+_FAILING_TEST_RE = re.compile(
+    r"(?:failing test|failure|error)\s*:\s*(.+)",
+    re.IGNORECASE,
+)
+_CAUSE_RE = re.compile(
+    r"(?:suspected cause|cause)\s*:\s*(.+)",
+    re.IGNORECASE,
+)
+_REPRODUCED_RE = re.compile(
+    r"(?:reproduced|reproduces)\s*:\s*(yes|no|unknown)",
+    re.IGNORECASE,
+)
+_BASELINE_RE = re.compile(
+    r"(?:on baseline master|baseline master|exists on baseline)\s*:\s*(yes|no|unknown|not checked)",
+    re.IGNORECASE,
+)
+_PR_CAUSED_RE = re.compile(
+    r"(?:pr[- ]caused|pr caused)\s*:\s*(yes|no|unknown|not proven)",
+    re.IGNORECASE,
+)
+_TRANSIENT_STATUS_RE = re.compile(
+    r"(?:passed after transient failure investigation|transient failure investigation)",
+    re.IGNORECASE,
+)
+_PLAIN_PASS_RE = re.compile(
+    r"validation\s*:\s*(?:pass|passed|strong|ok|green)\b",
+    re.IGNORECASE,
+)
+_ENV_CLEANUP_RE = re.compile(
+    r"(?:environmental cleanup|state cleaned|what changed between runs)\s*:",
+    re.IGNORECASE,
+)
+_UNKNOWN_CAUSE_RE = re.compile(
+    r"(?:suspected cause|cause)\s*:\s*(?:unknown|unexplained|not determined)",
+    re.IGNORECASE,
+)
+
+
+def _failure_documented_in_text(text: str, failure: dict[str, Any]) -> bool:
+    """Return True when *failure* appears documented in free-form report text."""
+    command = (failure.get("command") or "").strip()
+    failing = (failure.get("failing_test") or failure.get("error") or "").strip()
+    if command and command not in text:
+        return False
+    if failing and failing not in text:
+        return False
+    return bool(command or failing)
+
+
+def _section_has_structured_fields(text: str) -> bool:
+    if not _SECTION_RE.search(text):
+        return False
+    section_start = _SECTION_RE.search(text).start()
+    section = text[section_start:]
+    has_command = bool(_COMMAND_RE.search(section))
+    has_failure = bool(_FAILING_TEST_RE.search(section))
+    return has_command and has_failure
+
+
+def assess_validation_failure_history_report(
+    report_text: str,
+    *,
+    validation_session: dict | None = None,
+) -> dict[str, Any]:
+    """Require final reports to account for transient validation failures (#396)."""
+    text = report_text or ""
+    session = dict(validation_session or {})
+    reasons: list[str] = []
+    violations: list[str] = []
+
+    observed = list(session.get("observed_failures") or [])
+    final_status = (session.get("final_validation_status") or "").strip().lower()
+    cause_unknown = any(
+        (f.get("suspected_cause") or "").strip().lower() in {
+            "unknown", "unexplained", "not determined", ""
+        }
+        and not (f.get("pr_caused") or "").strip().lower() in {"yes", "no"}
+        for f in observed
+    ) or bool(session.get("cause_unknown"))
+
+    if not observed:
+        return {
+            "proven": True,
+            "block": False,
+            "reasons": [],
+            "violations": [],
+            "observed_failure_count": 0,
+            "safe_next_action": "proceed",
+        }
+
+    documented = _section_has_structured_fields(text)
+    if not documented:
+        for failure in observed:
+            if _failure_documented_in_text(text, failure):
+                documented = True
+                break
+
+    if not documented:
+        violations.append(
+            "session observed validation failure(s) but final report omits "
+            "Validation failure history"
+        )
+        reasons.append(
+            "every validation failure observed during the session must appear "
+            "in a Validation failure history section"
+        )
+
+    if documented and not _SECTION_RE.search(text):
+        reasons.append(
+            "failure details must appear under an explicit "
+            "'Validation failure history' heading"
+        )
+
+    for idx, failure in enumerate(observed, start=1):
+        prefix = f"failure #{idx}"
+        if not _failure_documented_in_text(text, failure) and documented:
+            reasons.append(
+                f"{prefix}: command and failing test/error not documented in report"
+            )
+        command = (failure.get("command") or "").strip()
+        failing = (failure.get("failing_test") or failure.get("error") or "").strip()
+        if not command:
+            reasons.append(f"{prefix}: missing command in session failure record")
+        if not failing:
+            reasons.append(
+                f"{prefix}: missing failing test or error in session failure record"
+            )
+
+    plain_pass = bool(_PLAIN_PASS_RE.search(text))
+    transient_wording = bool(_TRANSIENT_STATUS_RE.search(text))
+    final_passed = final_status in {
+        "passed",
+        "pass",
+        "passed_after_transient_failure_investigation",
+    }
+
+    if (final_passed or plain_pass) and observed:
+        if cause_unknown and not transient_wording:
+            violations.append(
+                "unknown transient failure cause cannot be erased as plain 'passed'"
+            )
+            reasons.append(
+                "when cause is unknown, use status "
+                "'passed after transient failure investigation'"
+            )
+        elif not transient_wording and final_status != "passed_after_transient_failure_investigation":
+            if not _ENV_CLEANUP_RE.search(text):
+                reasons.append(
+                    "later passing rerun must document what changed between runs "
+                    "or environmental cleanup performed"
+                )
+
+    if session.get("environmental_contamination") and not _ENV_CLEANUP_RE.search(text):
+        reasons.append(
+            "environmental /tmp state contamination must document cleanup or "
+            "what changed before the passing rerun"
+        )
+
+    proven = not reasons and not violations
+    return {
+        "proven": proven,
+        "block": bool(violations) or not proven,
+        "reasons": reasons,
+        "violations": violations,
+        "observed_failure_count": len(observed),
+        "documented": documented,
+        "safe_next_action": (
+            "add Validation failure history with command, failing test, cause, "
+            "reproduction, baseline comparison, and PR-caused evidence; use "
+            "'passed after transient failure investigation' when appropriate"
+            if not proven
+            else "proceed"
+        ),
+    }

reviewer_validation_integrity.py

@@ -0,0 +1,148 @@
+"""PR-head vs diagnostic validation integrity verifier (#316)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_DIAGNOSTIC_LABEL_RE = re.compile(
+    r"diagnostic local experiment|not pr-head validation|diagnostic-only validation",
+    re.IGNORECASE,
+)
+_OFFICIAL_VALIDATION_RE = re.compile(
+    r"(?:official validation|pr-head validation|validation integrity)",
+    re.IGNORECASE,
+)
+_OFFICIAL_COMMAND_RE = re.compile(
+    r"(?:official validation command|pr-head validation command|validation command)",
+    re.IGNORECASE,
+)
+_OFFICIAL_RESULT_RE = re.compile(
+    r"(?:official validation result|pr-head validation result|validation result|validation integrity status)",
+    re.IGNORECASE,
+)
+_DIRTY_AFTER_RE = re.compile(
+    r"(?:worktree dirty after (?:official )?validation|dirty (?:state )?after (?:official )?validation|"
+    r"validation worktree dirty after)",
+    re.IGNORECASE,
+)
+_DIAGNOSTIC_EDIT_RE = re.compile(
+    r"(?:diagnostic edit(?:ed)? path|file edits by reviewer|diagnostic local edit)",
+    re.IGNORECASE,
+)
+_DIAGNOSTIC_COMMAND_RE = re.compile(
+    r"(?:diagnostic (?:validation )?command|diagnostic test run|diagnostic result)",
+    re.IGNORECASE,
+)
+_SUGGESTED_FIX_RE = re.compile(
+    r"(?:diagnostic results? (?:were )?used only for suggested fix|suggested fix only|"
+    r"not used as official validation)",
+    re.IGNORECASE,
+)
+_INTEGRITY_STATUS_RE = re.compile(
+    r"validation integrity status\s*:\s*(passed|failed|not run|contaminated)",
+    re.IGNORECASE,
+)
+_POST_EDIT_AS_OFFICIAL_RE = re.compile(
+    r"(?:official validation(?:\s+result)?\s*:\s*pass|validation passed after (?:local )?edit|"
+    r"full suite passed after diagnostic edit)",
+    re.IGNORECASE,
+)
+
+
+def _performed_edits(action_log: list[dict] | None) -> list[str]:
+    paths: list[str] = []
+    for entry in action_log or []:
+        if entry.get("gated_rejected") or entry.get("performed") is False:
+            continue
+        path = entry.get("path")
+        if path and entry.get("kind", "file_edit") in {"file_edit", "edit", "write"}:
+            paths.append(str(path))
+    return paths
+
+
+def assess_validation_integrity_report(
+    report_text: str,
+    *,
+    validation_session: dict | None = None,
+    action_log: list[dict] | None = None,
+) -> dict[str, Any]:
+    """Separate official PR-head validation from diagnostic edited-worktree tests (#316)."""
+    text = report_text or ""
+    session = dict(validation_session or {})
+    reasons: list[str] = []
+
+    diagnostic_edits = list(session.get("diagnostic_edits") or [])
+    if not diagnostic_edits:
+        diagnostic_edits = _performed_edits(action_log)
+    diagnostic_ran = bool(
+        session.get("diagnostic_validation_ran")
+        or session.get("diagnostic_runs")
+    )
+    official_ran = bool(session.get("official_validation_ran", True))
+    official_result = (session.get("official_result") or "").strip().lower()
+    diagnostic_result = (session.get("diagnostic_result") or "").strip().lower()
+    dirty_after = session.get("worktree_dirty_after_official")
+    contaminated = bool(session.get("contaminated"))
+
+    if official_ran:
+        if not _OFFICIAL_VALIDATION_RE.search(text) and not _OFFICIAL_COMMAND_RE.search(text):
+            reasons.append("report missing official PR-head validation section")
+        if not _OFFICIAL_COMMAND_RE.search(text) and "validation:" not in text.lower():
+            reasons.append("report missing official validation command")
+        if not _OFFICIAL_RESULT_RE.search(text):
+            reasons.append("report missing official validation result or integrity status")
+        if dirty_after is not None and not _DIRTY_AFTER_RE.search(text):
+            reasons.append(
+                "report missing worktree dirty state after official validation"
+            )
+        elif dirty_after is None and official_ran and not _DIRTY_AFTER_RE.search(text):
+            reasons.append(
+                "report missing worktree dirty state after official validation"
+            )
+
+    if diagnostic_edits or diagnostic_ran:
+        if not _DIAGNOSTIC_LABEL_RE.search(text):
+            reasons.append(
+                "post-edit diagnostic runs must be labeled "
+                "'Diagnostic local experiment — not PR-head validation'"
+            )
+        if diagnostic_edits and not _DIAGNOSTIC_EDIT_RE.search(text):
+            reasons.append("report missing diagnostic edit path")
+        if diagnostic_ran and not _DIAGNOSTIC_COMMAND_RE.search(text):
+            reasons.append("report missing diagnostic command/result")
+        if not _SUGGESTED_FIX_RE.search(text):
+            reasons.append(
+                "report must state diagnostic results were used only for suggested fix"
+            )
+        if _POST_EDIT_AS_OFFICIAL_RE.search(text):
+            reasons.append(
+                "post-edit diagnostic results cannot be reported as official PR-head validation"
+            )
+        if diagnostic_result == "pass" and official_result == "fail":
+            if "request_changes" not in text.lower() and "failed" not in text.lower():
+                reasons.append(
+                    "request-changes must cite unmodified PR-head failure, not diagnostic pass"
+                )
+
+    if contaminated:
+        status = _INTEGRITY_STATUS_RE.search(text)
+        if not status or "contaminated" not in status.group(1).lower():
+            reasons.append(
+                "contaminated validation must report integrity status "
+                "'contaminated — recovery required'"
+            )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "diagnostic_edits": diagnostic_edits,
+        "safe_next_action": (
+            "separate official PR-head validation from diagnostic experiments; "
+            "report dirty-after-validation state"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_validation_worktree_edits.py

@@ -0,0 +1,184 @@
+"""PR validation worktree read-only edit verifier (#315)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_VALIDATION_WORKTREE_RE = re.compile(
+    r"branches/(?:review-pr\d+[\w/-]*|review-[\w-]+)",
+    re.IGNORECASE,
+)
+_DIAGNOSTIC_WORKTREE_RE = re.compile(
+    r"branches/(?:diagnostic[\w/-]*|scratch[\w/-]*)",
+    re.IGNORECASE,
+)
+_FILE_EDITS_NONE_RE = re.compile(
+    r"file edits by reviewer\s*:\s*none\b",
+    re.IGNORECASE,
+)
+_FILE_EDITS_FIELD_RE = re.compile(
+    r"file edits by reviewer\s*:\s*(.+)",
+    re.IGNORECASE,
+)
+_VALIDATION_WORKTREE_PATH_RE = re.compile(
+    r"(?:validation worktree path|review worktree path)\s*:\s*(\S+)",
+    re.IGNORECASE,
+)
+_DIAGNOSTIC_WORKTREE_PATH_RE = re.compile(
+    r"(?:diagnostic (?:scratch )?worktree path|diagnostic worktree)\s*:\s*(\S+)",
+    re.IGNORECASE,
+)
+_DIAGNOSTIC_LABEL_RE = re.compile(
+    r"diagnostic local experiment|not pr-head validation|diagnostic-only",
+    re.IGNORECASE,
+)
+_OFFICIAL_VALIDATION_RE = re.compile(
+    r"(?:official (?:pr-head )?validation|pr-head validation result)",
+    re.IGNORECASE,
+)
+_POST_EDIT_OFFICIAL_RE = re.compile(
+    r"(?:official validation(?:\s+result)?\s*:\s*pass|validation passed after (?:local )?edit)",
+    re.IGNORECASE,
+)
+
+_PERFORMED_EDIT_KINDS = frozenset({"file_edit", "edit", "write", "edited", "created", "wrote"})
+
+
+def _normalize_path(path: str) -> str:
+    return (path or "").replace("\\", "/").strip()
+
+
+def _is_validation_worktree(path: str) -> bool:
+    return bool(_VALIDATION_WORKTREE_RE.search(_normalize_path(path)))
+
+
+def _is_diagnostic_worktree(path: str) -> bool:
+    normalized = _normalize_path(path)
+    return bool(
+        _DIAGNOSTIC_WORKTREE_RE.search(normalized)
+        or "diagnostic" in normalized.lower()
+    )
+
+
+def _performed_edits(action_log: list[dict] | None) -> list[dict[str, str]]:
+    edits: list[dict[str, str]] = []
+    for entry in action_log or []:
+        if entry.get("gated_rejected") or entry.get("performed") is False:
+            continue
+        kind = (entry.get("kind") or entry.get("action") or "file_edit").strip().lower()
+        if kind not in _PERFORMED_EDIT_KINDS:
+            continue
+        path = (entry.get("path") or "").strip()
+        if not path:
+            continue
+        worktree = _normalize_path(str(entry.get("worktree_path") or entry.get("cwd") or ""))
+        edits.append({"path": path, "worktree_path": worktree})
+    return edits
+
+
+def _extract_validation_path(text: str, session: dict) -> str:
+    path = _normalize_path(str(session.get("validation_worktree_path") or ""))
+    if path:
+        return path
+    match = _VALIDATION_WORKTREE_PATH_RE.search(text or "")
+    return _normalize_path(match.group(1)) if match else ""
+
+
+def _extract_diagnostic_path(text: str, session: dict) -> str:
+    path = _normalize_path(str(session.get("diagnostic_worktree_path") or ""))
+    if path:
+        return path
+    match = _DIAGNOSTIC_WORKTREE_PATH_RE.search(text or "")
+    return _normalize_path(match.group(1)) if match else ""
+
+
+def assess_validation_worktree_edit_report(
+    report_text: str,
+    *,
+    validation_session: dict | None = None,
+    action_log: list[dict] | None = None,
+) -> dict[str, Any]:
+    """Block edits in PR validation worktrees; require diagnostic separation (#315)."""
+    text = report_text or ""
+    session = dict(validation_session or {})
+    reasons: list[str] = []
+
+    validation_path = _extract_validation_path(text, session)
+    diagnostic_path = _extract_diagnostic_path(text, session)
+    validation_edits = list(session.get("validation_worktree_edits") or [])
+    diagnostic_edits = list(session.get("diagnostic_edits") or [])
+    edits = _performed_edits(action_log)
+
+    if not validation_edits:
+        for entry in edits:
+            wt = entry.get("worktree_path") or validation_path
+            if wt and _is_validation_worktree(wt) and not _is_diagnostic_worktree(wt):
+                validation_edits.append(entry["path"])
+
+    if not diagnostic_edits:
+        for entry in edits:
+            wt = entry.get("worktree_path") or ""
+            if wt and _is_diagnostic_worktree(wt):
+                diagnostic_edits.append(entry["path"])
+            elif entry["path"] and diagnostic_path and not validation_edits:
+                if _is_diagnostic_worktree(diagnostic_path):
+                    diagnostic_edits.append(entry["path"])
+
+    claimed_none = bool(_FILE_EDITS_NONE_RE.search(text))
+    any_edits = bool(validation_edits or diagnostic_edits or edits)
+
+    if validation_edits:
+        reasons.append(
+            "reviewer must not edit files in the PR validation worktree; "
+            f"observed edits: {', '.join(validation_edits)}"
+        )
+
+    if diagnostic_edits or session.get("diagnostic_experiment"):
+        if not diagnostic_path and not _DIAGNOSTIC_WORKTREE_PATH_RE.search(text):
+            reasons.append(
+                "diagnostic experiments require a separate diagnostic scratch worktree path"
+            )
+        if not _DIAGNOSTIC_LABEL_RE.search(text):
+            reasons.append(
+                "diagnostic experiments must be labeled "
+                "'Diagnostic local experiment — not PR-head validation'"
+            )
+        if not _FILE_EDITS_FIELD_RE.search(text) or claimed_none:
+            reasons.append(
+                "diagnostic edits must be reported under 'File edits by reviewer'"
+            )
+
+    if any_edits and claimed_none:
+        reasons.append(
+            "report claims 'File edits by reviewer: none' but reviewer file edits occurred"
+        )
+
+    if session.get("official_validation_after_edit") or _POST_EDIT_OFFICIAL_RE.search(text):
+        if validation_edits or (validation_path and diagnostic_edits):
+            reasons.append(
+                "post-edit test results cannot be reported as official PR-head validation"
+            )
+
+    if validation_edits and _OFFICIAL_VALIDATION_RE.search(text):
+        if not _DIAGNOSTIC_LABEL_RE.search(text):
+            reasons.append(
+                "validation worktree was edited; official PR-head validation is no longer valid"
+            )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "validation_worktree_path": validation_path or None,
+        "diagnostic_worktree_path": diagnostic_path or None,
+        "validation_worktree_edits": validation_edits,
+        "diagnostic_edits": diagnostic_edits,
+        "safe_next_action": (
+            "keep PR validation worktrees read-only; use a separate diagnostic "
+            "scratch worktree and report all reviewer file edits"
+            if reasons
+            else "proceed"
+        ),
+    }

reviewer_worktree.py

@@ -0,0 +1,210 @@
+"""Fail-closed reviewer worktree and local-git safety proofs (#233).
+
+Reviewer sessions must never stash, reset, or otherwise manipulate unrelated
+local changes from another session. When the active worktree has dirty tracked
+files outside the PR scope, the workflow must stop or switch to a disposable
+scratch worktree (``scripts/worktree-review``).
+
+Git command policy (#243): reviewers use an allowlist, not a blocklist.
+Any ``git`` invocation that does not match ``_READONLY_REVIEWER_GIT`` is
+forbidden — including ``checkout HEAD --``, ``checkout .``, ``switch``,
+and uncommon ``stash`` subcommands that older blocklists missed.
+"""
+
+from __future__ import annotations
+
+import re
+import shlex
+
+# Read-only git operations reviewers may use for validation (#243 allowlist).
+_READONLY_REVIEWER_GIT = re.compile(
+    r"\bgit\b(?:\s+(?:-C\s+\S+\s+)?)?"
+    r"(?:fetch|status|diff|log|show|rev-parse|branch(?:\s+--show-current)?|"
+    r"worktree\s+list|worktree\s+add)",
+    re.IGNORECASE,
+)
+
+_GIT_INVOCATION = re.compile(r"\bgit\b", re.IGNORECASE)
+
+
+def parse_dirty_tracked_files(porcelain: str) -> list[str]:
+    """Return tracked paths with local modifications from ``git status --porcelain``.
+
+    Untracked entries (``??``) are ignored — they do not block reviewer work
+    when a scratch worktree is used, and authors may have unrelated untracked
+    files without implying reviewer interference.
+    """
+    paths: list[str] = []
+    for line in (porcelain or "").splitlines():
+        if not line or len(line) < 4:
+            continue
+        if line.startswith("??"):
+            continue
+        path = line[3:].strip()
+        if " -> " in path:
+            path = path.split(" -> ", 1)[1].strip()
+        if path:
+            paths.append(path)
+    return paths
+
+
+def files_outside_pr_scope(
+    dirty_files: list[str] | None,
+    pr_scope_files: list[str] | None,
+) -> list[str]:
+    """Dirty tracked files not explained by the PR diff file set."""
+    dirty = [p for p in (dirty_files or []) if p]
+    scope = {p for p in (pr_scope_files or []) if p}
+    if not dirty:
+        return []
+    if not scope:
+        return list(dirty)
+    return [path for path in dirty if path not in scope]
+
+
+def _is_git_command(command: str) -> bool:
+    return bool(_GIT_INVOCATION.search((command or "").strip()))
+
+
+def is_readonly_reviewer_git_command(command: str) -> bool:
+    """True when the command is an explicitly allowed read-only git operation."""
+    text = (command or "").strip()
+    if not text or not _is_git_command(text):
+        return False
+    return bool(_READONLY_REVIEWER_GIT.search(text))
+
+
+def is_forbidden_reviewer_git_command(command: str) -> bool:
+    """True when a git command is not on the reviewer readonly allowlist."""
+    text = (command or "").strip()
+    if not text or not _is_git_command(text):
+        return False
+    return not is_readonly_reviewer_git_command(text)
+
+
+def assess_reviewer_git_command_log(commands: list[str] | None) -> dict:
+    """Fail closed when reviewer shell history includes forbidden git mutations."""
+    forbidden = [
+        cmd for cmd in (commands or []) if is_forbidden_reviewer_git_command(cmd)
+    ]
+    if forbidden:
+        return {
+            "proven": False,
+            "block": True,
+            "forbidden_commands": forbidden,
+            "reasons": [
+                "reviewer workflow executed forbidden local git mutation: "
+                f"{cmd!r}"
+                for cmd in forbidden
+            ],
+            "safe_next_action": (
+                "stop; report worktree interference; do not stash/reset/checkout "
+                "unrelated files — use scripts/worktree-review instead"
+            ),
+        }
+    return {
+        "proven": True,
+        "block": False,
+        "forbidden_commands": [],
+        "reasons": [],
+        "safe_next_action": "proceed",
+    }
+
+
+def assess_reviewer_worktree_proof(proof: dict | None) -> dict:
+    """Evaluate reviewer worktree safety before checkout/diff/validation/review.
+
+    *proof* keys:
+    - ``worktree_path`` (required)
+    - ``porcelain_status`` or ``dirty_files``
+    - ``pr_scope_files`` (paths in the PR diff)
+    - ``scratch_used`` (bool)
+    - ``scratch_path`` (when scratch_used)
+    - ``git_commands`` (shell commands executed this session)
+    - ``unrelated_mutations_claimed`` (bool) — stash/reset/drop reported
+    """
+    proof = dict(proof or {})
+    reasons: list[str] = []
+    worktree_path = (proof.get("worktree_path") or "").strip()
+    if not worktree_path:
+        reasons.append("reviewer worktree path not reported; fail closed")
+
+    if proof.get("dirty_files") is not None:
+        dirty_files = list(proof.get("dirty_files") or [])
+    else:
+        dirty_files = parse_dirty_tracked_files(proof.get("porcelain_status") or "")
+
+    pr_scope = list(proof.get("pr_scope_files") or [])
+    unrelated = files_outside_pr_scope(dirty_files, pr_scope)
+    scratch_used = bool(proof.get("scratch_used"))
+    scratch_path = (proof.get("scratch_path") or "").strip()
+
+    is_dirty = bool(dirty_files)
+    unrelated_dirty = bool(unrelated)
+
+    if unrelated_dirty and not scratch_used:
+        reasons.append(
+            "worktree has dirty tracked files outside PR scope "
+            f"({', '.join(unrelated)}); stop or use a scratch worktree"
+        )
+    if scratch_used and not scratch_path:
+        reasons.append(
+            "scratch worktree was used but scratch_path was not reported"
+        )
+    if proof.get("unrelated_mutations_claimed"):
+        reasons.append(
+            "reviewer reported stash/reset/checkout cleanup of unrelated "
+            "local changes; this is forbidden"
+        )
+
+    command_assessment = assess_reviewer_git_command_log(
+        list(proof.get("git_commands") or [])
+    )
+    if command_assessment["block"]:
+        reasons.extend(command_assessment["reasons"])
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "worktree_path": worktree_path or None,
+        "is_dirty": is_dirty,
+        "dirty_files": dirty_files,
+        "unrelated_dirty_files": unrelated,
+        "scratch_used": scratch_used,
+        "scratch_path": scratch_path or None,
+        "unrelated_mutations_avoided": not bool(
+            proof.get("unrelated_mutations_claimed")
+            or command_assessment.get("forbidden_commands")
+        ),
+        "safe_next_action": (
+            "proceed"
+            if proven
+            else command_assessment.get("safe_next_action")
+            or "stop; use scripts/worktree-review or report dirty worktree"
+        ),
+        "forbidden_commands": command_assessment.get("forbidden_commands", []),
+    }
+
+
+def assess_author_worktree_continuity(proof: dict | None) -> dict:
+    """Authors may keep dirty feature worktrees; reviewers may not manipulate them.
+
+    This helper only proves the task role is author when dirty unrelated files
+    exist — it does not grant reviewers an exception.
+    """
+    proof = dict(proof or {})
+    role = (proof.get("task_role") or "").strip().lower()
+    dirty_files = list(proof.get("dirty_files") or [])
+    if role == "author" and dirty_files:
+        return {
+            "allowed": True,
+            "reasons": [
+                "author task may continue with dirty tracked files in its own "
+                "worktree; reviewer interference rules do not apply"
+            ],
+        }
+    if role == "reviewer" and dirty_files:
+        return assess_reviewer_worktree_proof(proof)
+    return {"allowed": True, "reasons": []}

reviewer_worktree_ownership.py

@@ -0,0 +1,207 @@
+"""Reviewer worktree ownership and safe-reuse proof verifier (#312)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_SESSION_OWNED_RE = re.compile(
+    r"branches/(?:review-pr\d+[\w/-]*|review-[\w-]+)",
+    re.IGNORECASE,
+)
+_WORKTREE_PATH_RE = re.compile(
+    r"(?:review worktree path|worktree path|session-owned worktree)\s*:\s*(\S+)",
+    re.IGNORECASE,
+)
+_BRANCHES_PATH_RE = re.compile(r"/branches/|\bbranches/", re.IGNORECASE)
+_MAIN_CHECKOUT_RE = re.compile(
+    r"main checkout|not (?:the )?main checkout|outside branches/",
+    re.IGNORECASE,
+)
+_SAFE_REUSE_RE = re.compile(r"safe[- ]reuse proof", re.IGNORECASE)
+_REUSE_POLICY_RE = re.compile(
+    r"(?:project policy|policy) (?:allows|allowing) (?:reuse|reset)",
+    re.IGNORECASE,
+)
+_CLEAN_TRACKED_RE = re.compile(
+    r"(?:clean tracked state|tracked state\s*:\s*clean|no uncommitted tracked)",
+    re.IGNORECASE,
+)
+_CLEAN_UNTRACKED_RE = re.compile(
+    r"(?:clean untracked state|untracked state\s*:\s*clean|no untracked files)",
+    re.IGNORECASE,
+)
+_NOT_OTHER_SESSION_RE = re.compile(
+    r"not owned by (?:another|other) (?:active )?(?:task|session)",
+    re.IGNORECASE,
+)
+_BRANCH_BEFORE_RESET_RE = re.compile(
+    r"(?:branch/head before reset|head before reset|branch before reset)\s*:\s*(\S+)",
+    re.IGNORECASE,
+)
+_RESET_TARGET_RE = re.compile(
+    r"(?:reset target sha|reset target)\s*:\s*([0-9a-f]{7,40})",
+    re.IGNORECASE,
+)
+_DESTRUCTIVE_CMD_RE = re.compile(
+    r"\bgit\b(?:\s+(?:-C\s+\S+\s+)?)?"
+    r"(?:reset\s+--hard|clean(?:\s+-[A-Za-z]+)*|checkout\s+(?!HEAD\s+--)|switch\s+)",
+    re.IGNORECASE,
+)
+_WORKSPACE_NONE_RE = re.compile(r"workspace mutations\s*:\s*none", re.IGNORECASE)
+_WORKTREE_MUTATION_RE = re.compile(
+    r"(?:worktree(?:/index)? mutations|destructive reset)\s*:\s*(?!none\b).+",
+    re.IGNORECASE,
+)
+_RESET_IN_REPORT_RE = re.compile(r"reset\s+--hard", re.IGNORECASE)
+
+
+def _command_text(entry) -> str:
+    if isinstance(entry, dict):
+        return str(entry.get("command") or "").strip()
+    return str(entry or "").strip()
+
+
+def _destructive_commands(command_log: list | None) -> list[str]:
+    return [
+        cmd
+        for cmd in (_command_text(entry) for entry in (command_log or []))
+        if cmd and _DESTRUCTIVE_CMD_RE.search(cmd)
+    ]
+
+
+def _extract_worktree_path(text: str, session: dict) -> str:
+    path = (session.get("worktree_path") or "").strip()
+    if path:
+        return path
+    match = _WORKTREE_PATH_RE.search(text or "")
+    return match.group(1).strip() if match else ""
+
+
+def _is_session_owned_path(path: str) -> bool:
+    normalized = (path or "").replace("\\", "/")
+    return bool(_SESSION_OWNED_RE.search(normalized))
+
+
+def _safe_reuse_fields_present(text: str) -> list[str]:
+    missing: list[str] = []
+    if not _WORKTREE_PATH_RE.search(text):
+        missing.append("exact worktree path")
+    if not _BRANCHES_PATH_RE.search(text):
+        missing.append("worktree inside branches/")
+    if not _MAIN_CHECKOUT_RE.search(text):
+        missing.append("worktree is not the main checkout")
+    if not _NOT_OTHER_SESSION_RE.search(text):
+        missing.append("worktree not owned by another active session")
+    if not _CLEAN_TRACKED_RE.search(text):
+        missing.append("clean tracked state")
+    if not _CLEAN_UNTRACKED_RE.search(text):
+        missing.append("clean untracked state")
+    if not _BRANCH_BEFORE_RESET_RE.search(text):
+        missing.append("branch/head before reset")
+    if not _RESET_TARGET_RE.search(text):
+        missing.append("reset target SHA")
+    if not _REUSE_POLICY_RE.search(text):
+        missing.append("explicit project policy allowing reuse/reset")
+    return missing
+
+
+def assess_worktree_ownership_report(
+    report_text: str,
+    *,
+    ownership_session: dict | None = None,
+    command_log: list | None = None,
+) -> dict[str, Any]:
+    """Prove reviewer worktree ownership before reset or validation (#312)."""
+    text = report_text or ""
+    session = dict(ownership_session or {})
+    reasons: list[str] = []
+
+    worktree_path = _extract_worktree_path(text, session)
+    destructive = _destructive_commands(command_log or session.get("command_log"))
+    if not destructive and session.get("destructive_reset"):
+        destructive = ["git reset --hard (session)"]
+
+    session_owned = bool(
+        session.get("session_owned")
+        or (worktree_path and _is_session_owned_path(worktree_path))
+    )
+    safe_reuse = bool(session.get("safe_reuse") or _SAFE_REUSE_RE.search(text))
+    main_checkout = bool(session.get("main_checkout"))
+    dirty_tracked = session.get("dirty_tracked")
+    dirty_untracked = session.get("dirty_untracked")
+    other_session_owned = bool(session.get("other_session_owned"))
+
+    if worktree_path or destructive or session.get("validation_ran"):
+        if not worktree_path:
+            reasons.append("report missing exact review worktree path")
+        elif main_checkout or "branches/" not in worktree_path.replace("\\", "/"):
+            reasons.append("review worktree must be inside branches/, not the main checkout")
+        elif not _BRANCHES_PATH_RE.search(worktree_path.replace("\\", "/")):
+            reasons.append("review worktree path must be under branches/")
+
+    if other_session_owned and not safe_reuse:
+        reasons.append(
+            "reused worktree appears owned by another active task/session; "
+            "safe-reuse proof required"
+        )
+
+    if dirty_tracked:
+        reasons.append(
+            "worktree has uncommitted tracked changes before reset or validation"
+        )
+    if dirty_untracked and safe_reuse:
+        reasons.append("safe-reuse proof requires clean untracked state")
+
+    if safe_reuse and not session_owned:
+        reasons.extend(
+            f"safe-reuse proof missing {field}"
+            for field in _safe_reuse_fields_present(text)
+        )
+
+    if destructive:
+        if not session_owned and not safe_reuse:
+            reasons.append(
+                "destructive worktree commands forbidden without session-owned "
+                "worktree or safe-reuse proof"
+            )
+        if _WORKSPACE_NONE_RE.search(text) and (
+            _RESET_IN_REPORT_RE.search(text) or any("reset" in c.lower() for c in destructive)
+        ):
+            reasons.append(
+                "final report must not claim 'Workspace mutations: none' when "
+                "git reset --hard occurred"
+            )
+        if not _WORKTREE_MUTATION_RE.search(text) and not _RESET_IN_REPORT_RE.search(text):
+            reasons.append(
+                "destructive reset must be reported under Worktree/index mutations "
+                "or destructive reset operations"
+            )
+
+    if (
+        worktree_path
+        and not session_owned
+        and not safe_reuse
+        and (destructive or session.get("validation_ran"))
+        and not _is_session_owned_path(worktree_path)
+    ):
+        reasons.append(
+            "reused branch-named worktree requires safe-reuse proof before reset or validation"
+        )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "worktree_path": worktree_path or None,
+        "session_owned": session_owned,
+        "safe_reuse": safe_reuse,
+        "destructive_commands": destructive,
+        "safe_next_action": (
+            "use a fresh session-owned review worktree under branches/review-pr<N>-* "
+            "or document full safe-reuse proof before destructive reset"
+            if reasons
+            else "proceed"
+        ),
+    }

role_namespace_gate.py

@@ -0,0 +1,89 @@
+"""Block author mutations from reviewer-bound MCP namespaces (#209).
+
+Every mutation must prove that the active profile role, inferred MCP
+namespace, and declared task role align. Reviewer sessions cannot silently
+perform author-side work (especially PR creation).
+"""
+
+from __future__ import annotations
+
+import gitea_config
+import role_session_router
+
+
+def infer_mcp_namespace(profile_name: str | None) -> str:
+    """Map a runtime profile name to its MCP namespace label."""
+    lower = (profile_name or "").strip().lower()
+    if "reviewer" in lower and "author" not in lower:
+        return "gitea-reviewer"
+    if "author" in lower:
+        return "gitea-author"
+    return profile_name or "gitea-default"
+
+
+def derive_role_kind(allowed, forbidden=()) -> str:
+    """Classify the active profile the same way as ``mcp_server._role_kind``."""
+
+    def can(op):
+        return gitea_config.check_operation(op, allowed, forbidden)[0]
+
+    review = can("gitea.pr.approve") or can("gitea.pr.merge")
+    author = can("gitea.pr.create") or can("gitea.branch.push")
+    if review and author:
+        return "mixed"
+    if review:
+        return "reviewer"
+    if author:
+        return "author"
+    return "limited"
+
+
+def check_author_mutation_namespace(
+    mutation_task: str,
+    profile: dict,
+) -> tuple[bool, list[str]]:
+    """Return (allowed, reasons). Fail closed on reviewer/author mismatch."""
+    required_role = role_session_router.required_role_for_task(mutation_task)
+    if required_role != "author":
+        return True, []
+
+    allowed = profile.get("allowed_operations") or []
+    forbidden = profile.get("forbidden_operations") or []
+    active_role = derive_role_kind(allowed, forbidden)
+    profile_name = profile.get("profile_name") or ""
+    namespace = infer_mcp_namespace(profile_name)
+
+    if mutation_task == "create_pr":
+        if active_role == "reviewer" or namespace == "gitea-reviewer":
+            return False, [
+                "author mutation 'create_pr' blocked in reviewer MCP namespace "
+                f"({namespace}); launch gitea-author",
+            ]
+
+    if active_role == "reviewer" or namespace == "gitea-reviewer":
+        if mutation_task == "create_issue":
+            ok, _ = gitea_config.check_operation(
+                "gitea.issue.create", allowed, forbidden)
+            if ok:
+                return True, []
+        return False, [
+            f"author mutation '{mutation_task}' blocked: active session is "
+            f"reviewer-bound ({profile_name} / {namespace})",
+        ]
+
+    return True, []
+
+
+def mutation_audit_context(mutation_task: str, profile: dict, *,
+                           remote=None, repository=None) -> dict:
+    """Structured mutation metadata for audit records (#209)."""
+    allowed = profile.get("allowed_operations") or []
+    forbidden = profile.get("forbidden_operations") or []
+    return {
+        "mcp_namespace": infer_mcp_namespace(profile.get("profile_name")),
+        "profile_name": profile.get("profile_name"),
+        "task_role": role_session_router.required_role_for_task(mutation_task),
+        "operation": mutation_task,
+        "remote": remote,
+        "repository": repository,
+    }

role_session_router.py

@@ -5,17 +5,60 @@ returns a route result before any downstream mutation tools run.
 """
 
 from __future__ import annotations
+import os
 
 ROUTE_ALLOWED = "allowed_current_session"
 ROUTE_WRONG_ROLE = "wrong_role_stop"
 ROUTE_TO_AUTHOR = "route_to_author_session"
 ROUTE_TO_REVIEWER = "route_to_reviewer_session"
 ROUTE_AMBIGUOUS = "ambiguous_task_stop"
+ROUTE_INFRA_STOP = "infra_stop"
+
+_CONFLICT_HEAD = b"<" * 7 + b" "
+_CONFLICT_TAIL = b">" * 7 + b" "
+_CONFLICT_SEPARATOR = b"=" * 7
+
+
+def python_bytes_have_conflict_markers(content: bytes) -> bool:
+    """Return True when *content* contains git merge-conflict marker lines."""
+    for line in content.splitlines():
+        stripped = line.rstrip(b"\r\n")
+        if stripped.startswith(_CONFLICT_HEAD):
+            return True
+        if stripped.startswith(_CONFLICT_TAIL):
+            return True
+        if stripped == _CONFLICT_SEPARATOR:
+            return True
+    return False
+
+
+def skip_python_scan_walk_root(project_root: str, walk_root: str) -> bool:
+    """Skip venv/git/cache and sibling worktrees under orchestration checkout.
+
+    When *project_root* is itself a worktree inside ``branches/``, still scan
+    that tree — do not treat the ``branches`` path segment as a skip signal.
+    """
+    rel = os.path.relpath(walk_root, project_root)
+    if rel == ".":
+        return False
+    head = rel.split(os.sep, 1)[0]
+    if head in ("venv", ".git", ".pytest_cache"):
+        return True
+    if head == "branches":
+        nested = os.path.join(project_root, "branches")
+        if os.path.isdir(nested) and (
+            walk_root == nested or walk_root.startswith(nested + os.sep)
+        ):
+            return True
+    return False
+
 
 REVIEWER_TASKS = frozenset({
     "review_pr",
     "merge_pr",
     "blind_pr_queue_review",
+    "pr_queue_cleanup",
+    "pr-queue-cleanup",
     "request_changes_pr",
     "approve_pr",
 })
@@ -31,6 +74,15 @@ AUTHOR_TASKS = frozenset({
     "comment_pr",
     "address_pr_change_requests",
     "delete_branch",
+    "work_issue",
+    "work-issue",
+    "reconcile_landed_pr",
+})
+
+RECONCILER_TASKS = frozenset({
+    "reconcile_already_landed_pr",
+    "reconcile_already_landed",
+    "reconcile-landed-pr",
 })
 
 TASK_REQUIRED_ROLE = {
@@ -47,14 +99,30 @@ TASK_REQUIRED_ROLE = {
     "review_pr": "reviewer",
     "merge_pr": "reviewer",
     "blind_pr_queue_review": "reviewer",
+    "pr_queue_cleanup": "reviewer",
+    "pr-queue-cleanup": "reviewer",
     "request_changes_pr": "reviewer",
     "approve_pr": "reviewer",
+    "work_issue": "author",
+    "work-issue": "author",
+    "reconcile_landed_pr": "author",
+    "reconcile_already_landed_pr": "reconciler",
+    "reconcile_already_landed": "reconciler",
+    "reconcile-landed-pr": "reconciler",
+    # #309: reconciler tasks close already-landed PRs/issues only.
+    "reconcile_close_landed_pr": "reconciler",
+    "reconcile_close_landed_issue": "reconciler",
 }
 
 WRONG_ROLE_REVIEWER_MSG = (
     "Wrong role/session for reviewer task. Launch reviewer MCP namespace."
 )
 
+WRONG_ROLE_RECONCILER_MSG = (
+    "Wrong role/session for reconciler task. Launch a reconciler-capable "
+    "MCP namespace/profile with exact close capability."
+)
+
 _session_last_route: dict | None = None
 
 
@@ -93,6 +161,29 @@ def route_task_session(
         _record_route(result)
         return result
 
+    if required_role == "reviewer":
+        infra = assess_infra_stop()
+        if infra["infra_stop"]:
+            detail = "; ".join(infra.get("infra_stop_reasons") or [])
+            message = (
+                "infra_stop: Unresolved merge conflict or mid-merge state detected "
+                f"in MCP runtime source ({detail}). Please resolve all conflicts "
+                "manually, finish/abort the merge, and retry."
+            )
+            result = {
+                "task_type": task_type,
+                "required_role": required_role,
+                "active_role": active_role_kind,
+                "active_profile": active_profile,
+                "route_result": ROUTE_INFRA_STOP,
+                "downstream_allowed": False,
+                "reasons": [message],
+                "message": message,
+                "infra_stop_assessment": infra,
+            }
+            _record_route(result)
+            return result
+
     if allowed_in_current_session:
         result = {
             "task_type": task_type,
@@ -127,6 +218,26 @@ def route_task_session(
         _record_route(result)
         return result
 
+    if required_role == "reconciler":
+        result = {
+            "task_type": task_type,
+            "required_role": required_role,
+            "active_role": active_role_kind,
+            "active_profile": active_profile,
+            "route_result": ROUTE_WRONG_ROLE,
+            "downstream_allowed": False,
+            "reasons": [
+                WRONG_ROLE_RECONCILER_MSG,
+                "Reconciler tasks cannot run in author or reviewer "
+                "sessions without exact close capability.",
+            ],
+            "message": WRONG_ROLE_RECONCILER_MSG,
+            "runtime_switching_supported": runtime_switching_supported,
+            "profile_switch_blocked": not runtime_switching_supported,
+        }
+        _record_route(result)
+        return result
+
     if required_role == "author":
         route = ROUTE_TO_AUTHOR
         message = (
@@ -175,11 +286,56 @@ def _record_route(result: dict):
     _session_last_route = dict(result)
 
 
+def sync_route_from_capability(capability: dict) -> None:
+    """Align sticky route state with operation-scoped capability resolution (#228)."""
+    capability = capability or {}
+    task = (capability.get("requested_task") or "").strip()
+    required_role = capability.get("required_role_kind")
+    if not task or not required_role:
+        return
+    if capability.get("allowed_in_current_session"):
+        _record_route({
+            "task_type": task,
+            "required_role": required_role,
+            "active_role": required_role,
+            "active_profile": capability.get("active_profile"),
+            "route_result": ROUTE_ALLOWED,
+            "downstream_allowed": True,
+            "reasons": [],
+            "message": (
+                f"Operation-scoped task '{task}' resolved for current session; "
+                "proceed."
+            ),
+        })
+        return
+    if required_role == "reviewer" and capability.get("stop_required"):
+        _record_route({
+            "task_type": task,
+            "required_role": required_role,
+            "active_role": capability.get("required_role_kind"),
+            "active_profile": capability.get("active_profile"),
+            "route_result": ROUTE_WRONG_ROLE,
+            "downstream_allowed": False,
+            "reasons": [WRONG_ROLE_REVIEWER_MSG],
+            "message": WRONG_ROLE_REVIEWER_MSG,
+        })
+
+
 def check_author_mutation_after_reviewer_stop(mutation_task: str) -> tuple[bool, list[str]]:
-    """Block author-side fallback after a reviewer wrong_role_stop (#206)."""
+    """Block author-side fallback after a reviewer wrong_role_stop (#206).
+
+    An explicit operation-scoped author capability resolution for the same
+    *mutation_task* clears the sticky reviewer denial (#228).
+    """
     last = _session_last_route
     if not last:
         return True, []
+    if (
+        last.get("route_result") == ROUTE_ALLOWED
+        and last.get("task_type") == mutation_task
+        and last.get("required_role") == "author"
+    ):
+        return True, []
     if last.get("route_result") != ROUTE_WRONG_ROLE:
         return True, []
     if last.get("required_role") != "reviewer":
@@ -188,8 +344,66 @@ def check_author_mutation_after_reviewer_stop(mutation_task: str) -> tuple[bool,
         return False, [
             WRONG_ROLE_REVIEWER_MSG,
             "Author-side mutations are blocked after a reviewer-task "
-            "wrong_role_stop unless the operator explicitly changes the "
-            "task and relaunches an author MCP session.",
+            "wrong_role_stop unless the operator explicitly resolves the "
+            "author task via gitea_resolve_task_capability.",
             f"Attempted fallback mutation: {mutation_task}",
         ]
-    return True, []
+    return True, []
+
+
+def first_conflict_marker_path(project_root: str | None = None) -> str | None:
+    """Return the first .py path containing a git conflict marker, or None."""
+    root_dir = project_root or os.path.dirname(os.path.abspath(__file__))
+    for root, dirs, files in os.walk(root_dir):
+        if skip_python_scan_walk_root(root_dir, root):
+            continue
+        for file in files:
+            if not file.endswith(".py"):
+                continue
+            file_path = os.path.join(root, file)
+            try:
+                with open(file_path, "rb") as f:
+                    if python_bytes_have_conflict_markers(f.read()):
+                        return file_path
+            except OSError:
+                pass
+    return None
+
+
+def _default_project_root() -> str:
+    override = (os.environ.get("GITEA_MCP_PROJECT_ROOT") or "").strip()
+    if override:
+        return os.path.realpath(override)
+    return os.path.dirname(os.path.abspath(__file__))
+
+
+def assess_infra_stop(project_root: str | None = None) -> dict:
+    """Recompute infra_stop from live git and source scan state (#285)."""
+    root_dir = os.path.realpath(project_root or _default_project_root())
+    reasons: list[str] = []
+    mid_merge = False
+    git_dir = os.path.join(root_dir, ".git")
+    if os.path.isdir(git_dir):
+        for marker in ("MERGE_HEAD", "rebase-merge", "rebase-apply"):
+            marker_path = os.path.join(git_dir, marker)
+            if os.path.exists(marker_path):
+                mid_merge = True
+                reasons.append(f"git state: {marker} present under {git_dir}")
+    conflict_file = first_conflict_marker_path(root_dir)
+    if conflict_file:
+        reasons.append(
+            f"conflict markers detected in {conflict_file} (project_root={root_dir})"
+        )
+    infra_stop = mid_merge or bool(conflict_file)
+    return {
+        "infra_stop": infra_stop,
+        "project_root": root_dir,
+        "conflict_file": conflict_file,
+        "mid_merge": mid_merge,
+        "infra_stop_reasons": reasons,
+    }
+
+
+def check_mid_merge(project_root: str | None = None) -> bool:
+    """Return True if the repository is mid-merge, mid-rebase, or has conflict markers."""
+    return assess_infra_stop(project_root)["infra_stop"]

scripts/run-webui

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "$script_dir/.." && pwd)"
+cd "$repo_root"
+exec python3 -m webui "$@"

scripts/sync-gitea-wiki.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# sync-gitea-wiki.sh — mirror the repo-tracked docs/wiki/ pages into the
+# Gitea native wiki. docs/wiki/ remains the source of truth; the Gitea Wiki
+# is a read convenience mirrored FROM it, never edited directly.
+#
+#   scripts/sync-gitea-wiki.sh            dry-run (default): print the plan
+#   scripts/sync-gitea-wiki.sh --push     actually sync, ONLY with the exact
+#                                         confirmation below
+#
+# Safety contract:
+# - Dry-run is the default and performs no network or repository-mutating
+#   operation (only a local read of the origin remote URL).
+# - A push requires GITEA_WIKI_SYNC_CONFIRM to equal exactly
+#   "SYNC WIKI <repo-name>" (repo name derived from the origin remote).
+#   Anything else refuses before any clone happens.
+# - The wiki remote is derived from the local origin remote; nothing is
+#   hardcoded here and no credential material is read, printed, or stored
+#   by this script — git's own configured auth is used as-is.
+# - Only *.md pages from docs/wiki/ are mirrored; nothing else is touched
+#   and no page is deleted from the wiki by this script.
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "$here/.." && pwd)"
+wiki_src="$repo_root/docs/wiki"
+
+[ -d "$wiki_src" ] || { echo "error: $wiki_src not found" >&2; exit 1; }
+
+if git -C "$repo_root" remote get-url origin >/dev/null 2>&1; then
+  origin_url="$(git -C "$repo_root" remote get-url origin)"
+elif git -C "$repo_root" remote get-url prgs >/dev/null 2>&1; then
+  origin_url="$(git -C "$repo_root" remote get-url prgs)"
+else
+  echo "error: configure an origin or prgs git remote" >&2
+  exit 1
+fi
+repo_name="$(basename "$origin_url" .git)"
+wiki_remote="${origin_url%.git}.wiki.git"
+expected_confirm="SYNC WIKI $repo_name"
+
+pages=()
+while IFS= read -r -d '' f; do
+  pages+=("$(basename "$f")")
+done < <(find "$wiki_src" -maxdepth 1 -name '*.md' -print0 | sort -z)
+
+mode="${1:-}"
+
+if [ "$mode" != "--push" ]; then
+  echo "dry-run: would sync ${#pages[@]} pages from docs/wiki/ to the '$repo_name' Gitea Wiki:"
+  for p in "${pages[@]}"; do
+    echo "  $p"
+  done
+  echo "dry-run: no git or network operation performed."
+  echo "To sync for real: GITEA_WIKI_SYNC_CONFIRM=\"$expected_confirm\" $0 --push"
+  exit 0
+fi
+
+if [ "${GITEA_WIKI_SYNC_CONFIRM:-}" != "$expected_confirm" ]; then
+  echo "refused: --push requires GITEA_WIKI_SYNC_CONFIRM to equal exactly:" >&2
+  echo "  $expected_confirm" >&2
+  exit 1
+fi
+
+workdir="$(mktemp -d)"
+trap 'rm -rf "$workdir"' EXIT
+
+echo "cloning wiki repository for '$repo_name'"
+if ! git clone --quiet -- "$wiki_remote" "$workdir/wiki" 2>/dev/null; then
+  echo "error: could not clone the wiki repository. If this repo's wiki has" >&2
+  echo "never been initialized, create its first page once in the Gitea UI" >&2
+  echo "(Wiki tab -> New Page), then re-run this script." >&2
+  exit 1
+fi
+
+cp "$wiki_src"/*.md "$workdir/wiki/"
+
+if git -C "$workdir/wiki" status --porcelain | grep -q .; then
+  git -C "$workdir/wiki" add -A
+  git -C "$workdir/wiki" commit --quiet -m "docs: sync from repo docs/wiki (source of truth)"
+  echo "pushing wiki update for '$repo_name'"
+  git -C "$workdir/wiki" push --quiet
+  echo "done: ${#pages[@]} pages synced."
+else
+  echo "done: wiki already up to date; nothing pushed."
+fi

scripts/worktree-start

@@ -38,8 +38,26 @@ fi
 branch="$1"
 start_ref="${2:-prgs/master}"
 
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "$script_dir/.." && pwd)"
+
 # Enforce issue-linked, traceable branch names (issue → branch → worktree → PR).
 if [[ "$allow_unlinked" -eq 0 ]]; then
+  locked_branch=$(python3 -c "
+import sys
+sys.path.insert(0, '$repo_root')
+import issue_lock_store
+print(issue_lock_store.resolve_locked_branch_for_session('$branch'))
+")
+  if [[ -z "$locked_branch" ]]; then
+    echo "Error: No session issue lock is bound. Call gitea_lock_issue before branch creation (fail closed)." >&2
+    exit 2
+  fi
+  if [[ "$branch" != "$locked_branch" ]]; then
+    echo "Error: Requested branch '$branch' does not match locked branch '$locked_branch' (fail closed)." >&2
+    exit 2
+  fi
+
   if [[ "$branch" =~ ^(fix|feat|docs|chore)/issue-[0-9]+-.+ ]] \
      || [[ "$branch" =~ ^review/pr-[0-9]+-.+ ]]; then
     :
@@ -58,8 +76,6 @@ EOF
   fi
 fi
 
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-repo_root="$(cd "$script_dir/.." && pwd)"
 worktree_name="${branch//\//-}"
 worktree_path="$repo_root/branches/$worktree_name"
 

skills/llm-project-workflow/SKILL.md

@@ -1,576 +1,185 @@
 ---
 name: llm-project-workflow
 description: >-
-  Portable, safe operating workflow for LLMs working on any Git/forge project:
-  issue-first, isolated branch worktrees, no self-review/self-merge, distinct
-  author/reviewer profiles, cleanup after merge, and fail-closed behavior.
-  Use at the start of any implementation, review, or merge task on a repo.
+  Router skill for safe LLM project work: identify task mode, load the matching
+  canonical workflow file, enforce mode isolation, and emit the correct final
+  report schema. Use at the start of any implementation, review, merge,
+  reconciliation, or issue-filing task.
 ---
 
-# LLM Project Workflow
+# LLM Project Workflow Skill
 
-A reusable workflow any LLM can follow to work on any repository safely. Copy
-this `skills/llm-project-workflow/` directory into another project unchanged;
-adapt only the forge-specific names in [Adapting to a project](#adapting-to-a-project).
+This skill is a **router**. Do not perform project work from this file alone.
 
-The core promise: **an LLM never does unsafe or untracked work.** Every change
-is tracked by an issue, isolated in its own worktree, reviewed by a different
-identity, and cleaned up only after a real merge.
+Before any project mutation, identify the task mode and load the matching
+workflow file.
+
+## Workflow modes
+
+| Task mode | Workflow | Final report schema |
+|-----------|----------|---------------------|
+| PR review / approval / merge | [`workflows/review-merge-pr.md`](workflows/review-merge-pr.md) | [`schemas/review-merge-final-report.md`](schemas/review-merge-final-report.md) |
+| Reconcile already-landed open PRs | [`workflows/reconcile-landed-pr.md`](workflows/reconcile-landed-pr.md) | [`schemas/reconcile-landed-final-report.md`](schemas/reconcile-landed-final-report.md) |
+| Create or update Gitea issues | [`workflows/create-issue.md`](workflows/create-issue.md) | [`schemas/create-issue-final-report.md`](schemas/create-issue-final-report.md) |
+| Work on an assigned issue / author code | [`workflows/work-issue.md`](workflows/work-issue.md) | [`schemas/work-issue-final-report.md`](schemas/work-issue-final-report.md) |
+| PR-only queue cleanup (one canonical review per PR) | [`workflows/pr-queue-cleanup.md`](workflows/pr-queue-cleanup.md) | [`schemas/pr-queue-cleanup-final-report.md`](schemas/pr-queue-cleanup-final-report.md) |
+
+## Universal rules
+
+- Prove identity, active profile, runtime context, and **exact** capability before
+  mutation.
+- A nearby capability does not count.
+- Do not self-review or self-merge.
+- Do not mix modes in one run.
+- If the required workflow cannot be loaded, stop and produce a recovery handoff
+  only.
+- Final report must use the schema for the loaded workflow.
+- If a task requires a different mode, stop and produce a handoff for the
+  correct workflow.
+
+## Mode isolation
+
+A run that starts in `review-merge-pr` mode may not create process issues,
+implement fixes, or edit source files.
+
+A run that starts in `reconcile-landed-pr` mode may not approve, request
+changes, merge, implement fixes, or create normal issues.
+
+A run that starts in `create-issue` mode may not review, approve, request
+changes, merge, implement fixes, create branches, commit, push, or create PRs.
+
+A run that starts in `work-issue` mode may not review, approve, request changes,
+merge, close PRs, or act as reviewer.
+
+A run that starts in `pr-queue-cleanup` mode may not claim issues, create
+branches, edit implementation files, file new issues, or review a second PR
+after any terminal review mutation.
+
+If the task requires a different mode, stop and produce a handoff for the
+correct workflow.
 
 ---
 
-
 ## Definitions
 
 - **Merged**: Gitea PR metadata says `merged=true`.
-- **Landed**: Equivalent content is present on remote `master`, but PR metadata may not say merged.
+- **Landed**: Equivalent content is present on remote `master`, but PR metadata
+  may not say merged.
 - **Closed-not-merged**: PR state is closed and `merged=false`.
-- **Reconciled**: A human/LLM verified whether closed-not-merged content landed, partially landed, or was lost, and repaired issue/label/tracker state.
+- **Reconciled**: Verified whether closed-not-merged or already-landed content
+  is present on the target branch; issue/label/tracker state repaired.
 
-## A. Issue-first rule
+## Work Selection Rule for LLMs
 
-**No repository change without a tracking issue.** This includes creating,
-editing, deleting, or `chmod`-ing files; docs; scripts; commits; pushes; and PRs.
+Before starting any issue or PR work, acquire or verify a work lease. Do not
+begin coding, reviewing, fixing, branching, committing, pushing, commenting, or
+creating a PR until you prove the target is not already being worked.
 
-1. Before any change, confirm a tracking issue exists.
-2. If none exists, create one first (title + problem + scope + acceptance).
-3. Claim it (assign yourself or apply the `status:in-progress` label) and comment
-   that work is starting, including the planned branch name.
-4. **If the issue cannot be created or claimed, stop.** Do not touch files.
+Required checks:
 
-Reading the repo, running read-only status/`git log`, and creating/claiming the
-issue itself are allowed from the orchestration checkout without a prior issue.
+1. List open PRs.
+2. Search for PRs linked to the target issue.
+3. Search local and remote branches for the issue number.
+4. Search registered worktrees for the issue branch.
+5. Check dirty worktrees.
+6. Check active leases or recent handoffs.
+7. Check whether the issue was already completed by a merged PR.
 
-Additional issue-first rules:
+If another active session owns the lease, stop with "work already claimed" or
+produce a handoff.
 
-- Do not implement code without an issue unless explicitly authorized.
-- **Design-only work uses a discussion/RFC issue** — create one or comment on
-  the existing one. Design debates belong on the issue, where other LLMs
-  comment directly. Discussion-only tasks must **not** create branches or PRs;
-  their comments should include recommendations, risks, open questions, and a
-  Controller Handoff (§K; compact format unless high-risk).
-- **If the repo/tracker home for the work is unclear, stop and ask for an
-  owner decision.** Do not create a new repository or a new tracker unless
-  explicitly approved by the owner.
+For Gitea-Tools: `gitea_lock_issue` is the fail-closed lease gate before author
+mutations; `status:in-progress` and claim comments are supporting lease signals.
 
-## B. Isolated worktree rule
+## Global LLM Worktree Rule
 
-**Never implement or review in the main checkout.** The main checkout is for
-orchestration and status only (issue creation, `git status`, creating worktrees).
+The main project checkout is a stable control checkout on `master`, `main`, or
+`dev`. All LLM task work must happen inside the project's `branches/` directory.
 
-- Each issue gets its own branch worktree under an ignored `branches/` directory.
-- Review work uses a **separate** review worktree, never the author's folder.
-- Dirty work in one branch folder must not block starting another issue.
-- No LLM may edit another issue's worktree unless explicitly assigned to it.
-- Branch folders are removed only after the PR is merged/closed **and** cleanup
-  is explicitly part of the task.
+If `cwd` is not inside `branches/`, stop before any file edit, test write,
+commit, merge, rebase, or cleanup. The main checkout is orchestration-only.
 
-Every implementation branch **must include its issue number** so it is
-traceable end to end: **issue → branch → worktree folder → PR → cleanup.**
+## Shell Spawn Hard-Stop Rule
 
-Allowed implementation patterns:
+`exit_code: -1` with empty stdout/stderr means the shell failed to spawn — not a
+command failure. After two consecutive spawn failures, hard-stop shell use for
+the session and emit a recovery report (#258).
 
-- `fix/issue-123-short-description`
-- `feat/issue-123-short-description`
-- `docs/issue-123-short-description`
-- `chore/issue-123-short-description`
+## Isolated worktree naming
 
-Review-only branches:
+Implementation: `(fix|feat|docs|chore)/issue-<number>-<short-description>`
 
-- `review/pr-456-short-description`
+Review: `review/pr-<number>-<short-description>`
 
-Use a filesystem-safe folder under `branches/` by replacing slashes with
-hyphens, for example `branches/fix-issue-123-short-description`.
+## Subagent Tool-Budget Guardrails
 
-`scripts/worktree-start` **enforces** this: it rejects an implementation branch
-that does not match `(fix|feat|docs|chore)/issue-<number>-…` (or a
-`review/pr-<number>-…` branch), unless `--allow-unlinked` is passed. Traceability
-is maintained by:
+General-purpose subagents on **single-step MCP tasks** (for example
+`gitea_commit_files`) must not expand into 100+ tool-call retry spirals with
+WebFetch/Playwright/manual-encoding fallbacks (issue #259).
 
-- the branch name (contains the issue number),
-- a claim comment on the issue, e.g.
-  `Claimed. Branch: fix/issue-123-short-description. Worktree: branches/fix-issue-123-short-description.`,
-- the PR body — `Closes #123` or `Fixes #123` when the PR should close the issue
-  (do NOT use `Implements #123` or `Refs #123` to close, as Gitea will not auto-close),
-- cleanup after merge — remove the remote branch, local branch, and the issue
-  worktree folder, and drop `status:in-progress`.
+Default budgets (stop when exceeded):
 
-For projects using `Gitea-Tools` helpers:
+- **Single-step MCP mutation** (`commit_files`, `create_pr`, `lock_issue`):
+  15 tool calls, 5 minutes wall time.
+- **Review / merge queue inspection**: 40 tool calls, 15 minutes.
+- **Non-mutating exploration**: 60 tool calls, 20 minutes.
 
-```bash
-scripts/worktree-start fix/issue-123-example      # → branches/fix-issue-123-example
-scripts/worktree-review fix/issue-123-example     # → branches/review-fix-issue-123-example (detached)
-scripts/worktree-clean  --delete-branch fix/issue-123-example
-```
+Rules:
 
-Manual equivalent:
+1. When the main session has `gitea.repo.commit`, call `gitea_commit_files`
+   directly — do not delegate commit to a subagent (#260).
+2. After shell spawn failure (#258), attempt the native MCP tool once before
+   any fallback; shell unavailability never authorizes WebFetch/Playwright/
+   manual base64.
+3. Never resume a failed subagent into a larger retry loop or spawn a second
+   subagent for the same deterministic step — stop and report.
+4. When `gitea_commit_files` is available, forbid WebFetch, Playwright,
+   manual encoding, and ad-hoc `_encode_*` / `_emit_*` helpers in the repo.
 
-```bash
-git fetch <remote> --prune
-git worktree add -b fix/issue-123-example branches/fix-issue-123-example <remote>/master
-cd branches/fix-issue-123-example
-```
+Worktree folder: branch with `/` replaced by `-` under `branches/`.
 
-`venv/` and similar are not copied into new worktrees — run checks with a known
-interpreter path, or create a venv inside the branch folder.
+Helpers: `scripts/worktree-start`, `scripts/worktree-review`,
+`scripts/worktree-clean`.
 
-## C. Identity and profile safety
+## Identity and profile safety
 
-- Use canonical execution profiles where available; the profile is the role, not the LLM. A task selects a profile; a profile is not permanently assigned.
-- **Author and reviewer identities must be distinct.**
-- Never place raw tokens/passwords in an LLM/MCP client config. Reference secrets by keychain id or environment variable name only. Prefer a single canonical config file selected by two env vars, e.g.:
-  - `GITEA_MCP_CONFIG` — path to the canonical profiles file
-  - `GITEA_MCP_PROFILE` — the profile to activate
-- **Dual-Profile MCP Launcher Pattern (Recommended):** To avoid relaunch bottlenecks and PR-author deadlocks, register multiple instances of the same MCP server in the client's configuration simultaneously (e.g., `gitea-author` and `gitea-reviewer`), each pointing to its respective `GITEA_MCP_PROFILE`.
-  - Tool calls become namespace-scoped: `mcp__gitea-author__*` and `mcp__gitea-reviewer__*`.
-  - **Trust Model:** Separate tokens remain separate. Profile gates enforce allowed operations, `whoami` is still checked, and self-review/self-merge prevention remains mandatory. This pattern is for convenience and does not bypass security gates.
-  - **Deadlock Warning:** Reviewer/merge identities must not be used to create PRs, as this makes the reviewer the PR author in Gitea and blocks independent review. PRs should normally be created by the author/work identity, keeping the reviewer identity available for reviews.
-  - **Fallback:** If a dual-server launcher is not available in the client, relaunch or restart the client with the correct profile environment variable before claiming work.
-- **If the authenticated user equals the PR author, stop** — no self-review, no self-merge.
+- Author and reviewer identities must be distinct.
+- Never place raw tokens in LLM/MCP config.
+- Use `gitea_whoami` and `gitea_resolve_task_capability` before mutating.
 
-## D. Branch naming
-
-```text
-fix/issue-123-short-description
-feat/issue-123-short-description
-docs/issue-123-short-description
-review/pr-456-scope-check
-```
-
-Worktree folder = branch with `/` replaced by `-`
-(`branches/fix-issue-123-short-description`).
-
-## E. Start-work workflow
-
-1. Verify the orchestration checkout (right repo, clean tree).
-2. Fetch/prune: `git fetch <remote> --prune`.
-3. Confirm local `master` equals remote `master` (`git rev-list --left-right --count <remote>/master...master` → `0	0`).
-4. Create/claim the issue (§A).
-5. Create the isolated worktree (§B) from latest remote `master`.
-6. Implement the narrow scope only — no unrelated refactors or formatting churn.
-7. Add/update focused tests when behavior changes.
-8. Run the checks (tests, compile/lint, `git diff --check`, secret scan).
-   Record the branch name and `HEAD` SHA at validation time — the drift
-   check in step 9 compares against exactly this state.
-9. **Branch proof before commit (#177):** prove and state, immediately
-   before staging/committing (`author_proofs.verify_branch_for_commit`,
-   `author_proofs.detect_branch_drift`):
-   - current branch (`git branch --show-current`) equals the intended
-     feature branch from the issue claim
-   - current branch is not `master`, `main`, `develop`, `development`, or
-     `dev`
-   - branch and `HEAD` have not changed since validation (step 8) — in a
-     shared checkout another session may switch branches mid-session;
-     treat that as expected and **stop before committing** when detected
-   If any check fails, stop and reconcile; do not commit.
-10. Commit with an issue-linked message.
-11. **Branch proof before push (#177):** prove that the local branch, the
-    push target branch, and the intended issue branch all match, and that
-    none of them is a protected branch
-    (`author_proofs.verify_push_target`). If a commit accidentally landed
-    on a protected branch, do **not** push: report the accident and the
-    exact repair steps (`author_proofs.assess_protected_branch_commit`) —
-    never silently continue after a repair.
-12. Push the branch.
-13. Open a PR to `master`. The final report must include the branch proofs
-    from steps 9 and 11 (`author_proofs.build_commit_push_report`).
-14. **If you are the author, stop before review/merge.**
-15. **Normal issue work must not directly push to `master`.** PR content should be merged through the forge PR merge mechanism.
-16. Direct push to `master` is allowed only as a documented recovery exception. If used, the final report must include:
-    - why the PR merge path could not be used
-    - exact commits pushed
-    - PR metadata state
-    - issue labels/state repaired
-    - whether the PR is closed-not-merged
-
-
-## F. Review workflow
-
-1. Use a separate review worktree (`scripts/worktree-review <branch>`), detached.
-2. Verify your authenticated identity.
-3. Verify the PR author — **you must not be the author.** Self-review
-   contamination must be *evidence-backed* (#173): state the authenticated
-   reviewer identity, the PR author identity, whether this session
-   authored/touched the PR branch, and the evidence source for any
-   "same-session author" claim. If the evidence is missing, report the
-   status as **unknown** — never declare contamination by assumption — and
-   choose another PR or stop (`review_proofs.assess_self_review_contamination`).
-4. Verify the worktree is clean.
-5. **Checkout proof (#173):** before reviewing or validating, prove and
-   state: the selected PR head SHA from Gitea (pinned), the local checkout
-   SHA (`git rev-parse HEAD`), that `HEAD ==` the pinned PR head SHA, and
-   that the diff base is the PR base branch. If `HEAD` does not match the
-   pinned head, **stop before review/merge**
-   (`review_proofs.verify_pinned_head_checkout`).
-6. **Inventory proof (#173 + repo disambiguation hardening):** a blind queue
-   review must prove listing completeness before claiming "only PRs found".
-   Use repo-name disambiguation:
-   - "Gitea-Tools" / "gitea tool" / "MCP Gitea tool" / "gitea MCP tool" /
-     "gitea-tools repo" resolve **only** to `Scaled-Tech-Consulting/Gitea-Tools`.
-   - "mcp-control-plane" resolves only to `Scaled-Tech-Consulting/mcp-control-plane`.
-   - Ambiguous ("open PRs", no explicit repo, "MCP Gitea tooling") → inventory
-     **both** configured repos.
-   Report must state exactly which repo(s) were checked. If only one checked:
-   "Only <repo> was checked. Other configured repos were not checked. This is
-   not a complete queue inventory." Never let a single-repo zero hide PRs in
-   the other.
-   Both configured repos must be reported with state filter, pagination proof,
-   and open-PR count (`review_proofs.assess_inventory_completeness` and
-   `resolve_repos_from_user_reference`).
-7. **Role-boundary proof (#175):** a reviewer queue task must not silently
-   become author implementation. If no eligible PR exists, stop with the
-   queue report. Do not claim issues, create branches, commit, push, or open
-   PRs unless the operator explicitly retasks the run as author work. Mixed
-   reviewer+author namespace use must be reported with a justification, and
-   scratch-only notes are not durable evidence unless posted or committed
-   intentionally (`review_proofs.assess_role_boundary`).
-8. Inspect the full diff; confirm scope matches the linked issue; flag unrelated files.
-9. Run the tests. Validation reporting must include the exact command and
-   exact results: pass/fail, counts of tests passed/skipped/failed, any
-   ignored paths and why they are safe to ignore, and whether the command
-   differs from the repository's canonical validation command. Only claim a
-   validation result after the command has completed and its output has
-   been read (`review_proofs.assess_validation_report`).
-10. **Do not merge if checks fail. Do not merge if the reviewer is the author.**
-11. **#179 A-bar proofs** (all fail closed when missing —
-    `review_proofs.assess_capability_evidence`, `assess_sweep_evidence`,
-    `assess_live_state_recheck`, `assess_role_boundary`):
-    - Capability claims must cite exact `gitea_resolve_task_capability`
-      output (or runtime context); a bare "capability checks passed" is
-      downgraded.
-    - The secret/provenance sweep must state the exact command/script/
-      pattern/named method and the scope scanned.
-    - Immediately before submitting a review verdict (and again before any
-      merge), re-read live PR state and prove: still open, live head ==
-      pinned head, base unchanged, no unresolved blocking review state.
-    - Reviewer runs stay in the reviewer namespace; any author-namespace
-      call requires an explicit justification in the report.
-12. The final report must distinguish (`review_proofs.build_final_report`):
-    identity eligible; PR author different from reviewer; session
-    contamination absent (with evidence); validation performed on the pinned
-    head; capability evidence; sweep verdict; live-state recheck; role
-    boundary; merge performed; issue status verified. If any proof is
-    missing, stop or downgrade the result instead of merging confidently.
-
-## G. Merge / cleanup workflow
-
-Only an eligible (non-author) reviewer merges. Before merging: always verify
-the authenticated identity **and** the PR author; cite exact capability
-evidence for merge_pr (#179); respect runtime profile gates; run independent
-validation (do not trust the author's reported results); perform the **final
-live-state recheck** (#179 — PR still open, live head == pinned head, base
-unchanged, no unresolved blocking review state) immediately before the merge
-mutation; and merge with a **pinned head SHA** and, where supported, the
-**expected changed-file set**, so a moved head or widened diff refuses the
-merge. After a real merge:
-
-1. Confirm remote `master` actually contains the merge commit or expected squashed changes via post-merge file-presence verification (A PR is not done just because `master` moved or is marked "closed". Verify that expected files added/modified in the PR are actually present on `master` using `git pull`, `git log --oneline -- <file>`, or `git merge-base --is-ancestor`; linked issues are closed; `status:in-progress` is removed).
-2. Close/release the issue.
-3. Whenever an issue is closed, check for `status:in-progress`: remove it, or report why it could not be removed.
-4. Do not delete the remote source branch until: PR `merged=true`, or reconciliation confirms content is safely landed, or the issue owner explicitly abandons the work.
-5. Remove the local branch.
-6. Remove the branch worktree folder (`scripts/worktree-clean --delete-branch <branch>`). Branches/worktrees are cleaned only after the above is verified.
-7. Fetch/prune.
-8. Confirm the main checkout is clean and current (`0	0` vs remote).
-9. Final merge/reconciliation reports must include: PR metadata (state, merged flag, merge commit/hash), Git content (remote master hash, expected content present or not), and the exact post-merge verification method used & results.
-
-Never run cleanup before the merge is confirmed on remote `master`.
-
-## H. Fail-closed cases
-
-**Stop and report — take no mutating action — if:**
-
-- No issue exists and one cannot be created.
-- Worktree state is unclear or unexpected.
-- Branch/PR state conflicts with the prompt (e.g. prompt says "merged" but it is not).
-- A PR is closed but not merged (closed with `merged=false`). In this case:
-  - stop normal review/merge
-  - do not delete branches/worktrees
-  - do not start dependent work
-  - run reconciliation
-- Local `master` is ahead of remote unexpectedly.
-- The authenticated user is the PR author (for review/merge).
-- Secrets/tokens appear in the diff.
-- Tests fail.
-- A cleanup step would delete unmerged work.
-
-When in doubt, stop and surface the discrepancy; do not guess or work around a gate.
-
-## I. Recovery patterns
-
-- **Dirty worktree from another issue:** do not touch it. Start your issue in its
-  own new worktree; unrelated dirty work must not block you.
-- **Local `master` ahead of remote unexpectedly:** do not push `master`. Confirm
-  the commits are preserved on a feature branch (local + remote) first, then
-  `git reset --hard <remote>/master` to realign. Never discard commits that are
-  not safely pushed elsewhere.
-- **PR closed but not merged (`merged=false`):** do not merge. Run reconciliation: compare PR content to remote `master` and decide:
-  - **fully landed:** comment that content is present on `master`, remove `status:in-progress`, keep/close issue as appropriate, clean up only after content equivalence is confirmed.
-  - **partially landed:** do not clean up, reopen issue if needed, create corrective issue/PR for missing pieces.
-  - **not landed:** reopen issue if needed, reopen PR or create replacement PR, do not clean up source branch/worktree.
-- **Branch deleted before merge:** if the commits still exist locally (a branch or
-  reflog), re-push them and reopen the PR; otherwise recover via
-  `git fsck --lost-found`. Preserve first, then proceed.
-- **Unauthorized/untracked file created:** do not commit it. Leave pre-existing
-  untracked artifacts (e.g. editor/agent dirs, reports) alone; stage only the
-  files your issue names (`git add <files>`, never blind `git add -A`).
-- **Preserve commits before a reset:** confirm the target commits are reachable
-  from a branch that is pushed to the remote, then reset. Verify with
-  `git branch --contains <sha>` and `git log <remote>/<branch>`.
-
-## J. Prompt snippets
-
-Ready-to-copy templates live in [`templates/`](templates/):
-
-- [`start-issue.md`](templates/start-issue.md) — start a new issue.
-- [`review-pr.md`](templates/review-pr.md) — review a PR.
-- [`merge-pr.md`](templates/merge-pr.md) — merge a PR (eligible reviewer only).
-- [`recover-bad-state.md`](templates/recover-bad-state.md) — recover from bad state.
-- [`reconcile-closed-not-merged-pr.md`](templates/reconcile-closed-not-merged-pr.md) — reconcile a closed-not-merged PR.
-- [`worktree-cleanup.md`](templates/worktree-cleanup.md) — clean up after merge.
-- [`release-tag.md`](templates/release-tag.md) — create a release tag.
-
-## K. Controller Handoff (required, every task)
-
-Every LLM task **must end with a `Controller Handoff`** (exact title) — whether the
-task was implementation, review, merge, issue triage, documentation,
-discussion-only, or blocked planning. It lets a controller LLM understand the
-current state immediately, without rereading the conversation.
-
-The section title must be exactly "Controller Handoff" (or "Controller Handoff Summary" for long form). Reports without it are downgraded (see review_proofs.assess_controller_handoff).
-
-**The compact format is the default.** It is written for controller-LLM
-readability, not as a full human status report. PR bodies still carry the
-full review detail — the handoff never replaces PR documentation.
-
-Compact format (default, canonical field set per issue #182):
-
-```md
 ## Controller Handoff
 
-- Task:
-- Repo:
-- Role:
-- Identity:
-- Issue/PR:
-- Branch/SHA:
-- Files changed:
-- Validation:
-- Mutations:
-- Current status:
-- Blockers:
-- Next:
-- Safety:
-```
+Every task must end with a section titled exactly `Controller Handoff`. Compact
+format canonical field set per issue #182; mode-specific schemas in
+`schemas/*-final-report.md` define required fields. Use the final report schema
+for the loaded workflow mode — not the legacy compact block alone.
+`review_proofs.assess_controller_handoff()` validates presence.
 
-Role-specific fields (append to the compact block):
+## Prompt templates
 
-- review/merge tasks: `Selected PR:`, `Reviewer eligibility:`,
-  `Pinned reviewed head:`, `Review decision:`, `Merge result:`,
-  `Linked issue status:`, `Cleanup status:`
-- author tasks: `Selected issue:`, `Claim/comment status:`,
-  `PR number opened:`, `No review/merge:` (explicit confirmation)
-- queue/inventory tasks: `Repositories checked:`, `Open PR counts:`,
-  `Selected PR or reason none selected:`, `Inventory completeness:`
+Ready-to-copy task prompts live in [`templates/`](templates/):
 
-The section title must be exactly `Controller Handoff`.
-`review_proofs.assess_controller_handoff()` validates this section; reports
-missing it (or missing required fields) are downgraded. The handoff never
-replaces the full report — it is the compact continuation summary at the end,
-and the full report must still carry exact validation results and mutation
-confirmation.
-
-The `Safety:` line is never omitted; it is usually:
-
-```text
-no self-review; no self-merge; no tags; no secrets; no prod
-```
-
-Rules (both formats):
-
-- Never omit the handoff, and never omit the safety confirmations.
-- Never bury blockers in earlier text only — they must appear here.
-- If you opened a PR, state clearly that review is needed.
-- If you reviewed but could not merge, name the exact gate that blocked it.
-- If you only commented on a discussion issue, say no code review is needed
-  but owner/design feedback may be needed.
-- If release state was touched, state exactly which tag/commit changed and why.
-- If blocked (permissions, missing repo, missing second reviewer identity,
-  stale dependency, unclear tracker home): stop and report clearly; **never
-  bypass classifiers, profile gates, missing permissions, or live-consent
-  requirements**; give the owner concrete options.
-
-**Use the long format below instead of the compact one only when the task was
-high-risk or complex** — i.e. when any of these happened:
-
-- a merge, tag, or release
-- failed validation
-- permissions/profile gates blocked work
-- secrets or production access were involved
-- a complicated owner decision
-- multiple repos or cross-issue state
-- the owner explicitly asks for the full format
-
-Long format (high-risk/complex tasks only):
-
-```md
-## Controller Handoff Summary
-
-### Work performed
-
-Briefly state what was done.
-
-### Current state
-
-Include:
-- current repo
-- current branch or master commit
-- issue number(s)
-- PR number(s), if any
-- whether work is complete, blocked, ready for review, or discussion-only
-
-### Files changed
-
-List files changed, or say `None`.
-
-### Validation
-
-List commands run and results, or say `Not applicable — discussion only`.
-
-### Issues encountered
-
-List errors, confusing state, permission/profile problems, stale branches,
-failing tests, missing labels, or blocked decisions.
-
-### Review needed?
-
-Say one of:
-- `No review needed — discussion/comment only`
-- `Review needed — PR is open`
-- `Independent non-author review needed`
-- `Owner decision needed`
-- `Blocked`
-
-### Next recommended action
-
-State exactly what should happen next.
-
-### Safety confirmations
-
-Confirm:
-- no self-review
-- no self-merge
-- no release/tag changes unless explicitly requested
-- no secrets committed
-- no production access used unless explicitly authorized
-```
-
-### Example blocked handoff
-
-```md
-## Example blocked handoff
-
-### Work performed
-
-Audited phase-2 MCP Control Plane planning. Found target repo
-`mcp-control-plane` does not exist. Prepared issue pack but did not file it.
-
-### Current state
-
-- Repo: `Scaled-Tech-Consulting/Gitea-Tools`, unmodified
-- Target repo: `mcp-control-plane`, missing
-- Issues: none open in Gitea-Tools
-- PRs: none open
-- Status: blocked pending owner decision
-
-### Files changed
-
-None.
-
-### Validation
-
-Tracker/repo audit only. No code validation required.
-
-### Issues encountered
-
-Repo creation was denied by permission/classifier because it would be scope
-escalation without live consent.
-
-### Review needed?
-
-Owner decision needed.
-
-### Next recommended action
-
-Owner must choose:
-1. create `Scaled-Tech-Consulting/mcp-control-plane`
-2. authorize repo creation while present
-3. file phase-2 issues in Gitea-Tools instead
-
-### Safety confirmations
-
-- no self-review
-- no self-merge
-- no release/tag changes
-- no secrets committed
-- no production access used
-```
+- [`start-issue.md`](templates/start-issue.md) — author work (loads `work-issue.md`)
+- [`review-pr.md`](templates/review-pr.md) — review (loads `review-merge-pr.md`)
+- [`pr-queue-cleanup.md`](templates/pr-queue-cleanup.md) — one PR per cleanup run
+- [`merge-pr.md`](templates/merge-pr.md) — merge (loads `review-merge-pr.md`)
+- [`recover-bad-state.md`](templates/recover-bad-state.md)
+- [`reconcile-closed-not-merged-pr.md`](templates/reconcile-closed-not-merged-pr.md)
+- [`worktree-cleanup.md`](templates/worktree-cleanup.md)
+- [`release-tag.md`](templates/release-tag.md)
 
 ## Adapting to a project
 
-Replace these project-specific names when copying the skill elsewhere:
-
-| Placeholder | Meaning | Example here |
-|-------------|---------|--------------|
-| `<remote>` | Git remote for the forge | `prgs` |
-| default branch | Integration branch | `master` |
-| profile env vars | Canonical config + profile selectors | `GITEA_MCP_CONFIG`, `GITEA_MCP_PROFILE` |
-| `branches/` | Ignored worktree directory | `branches/` |
-| helper scripts | Worktree helpers | `scripts/worktree-start` / `-review` / `-clean` |
-
-The rules in §A–§K are project-agnostic and should not change.
+| Placeholder | Example here |
+|-------------|--------------|
+| `<remote>` | `prgs` |
+| default branch | `master` |
+| profile env vars | `GITEA_MCP_CONFIG`, `GITEA_MCP_PROFILE` |
+| `branches/` | `branches/` |
+| helpers | `scripts/worktree-start` / `-review` / `-clean` |
 
 ## Versioning And Tagging
 
-Releases follow SemVer: **`vMAJOR.MINOR.PATCH`** (use **`v0.x.y`** while
-unstable). Choose the bump by the largest change since the last tag:
-
-- **PATCH** — bug fixes, docs, tests, wrappers, non-breaking workflow polish.
-- **MINOR** — new tools/helpers/config features; backward-compatible behavior.
-- **MAJOR** — breaking config/schema/API behavior or a changed MCP contract.
-
-Tags must:
-
-- be created **only from `master`** (the exact commit on remote `master`),
-- be created **only after the full test suite passes**,
-- be **annotated** tags (`git tag -a`), never lightweight,
-- include release notes / a changelog summary referencing the merged PRs/issues.
-
-**Never tag** feature branches, dirty worktrees, unreviewed or self-authored
-work, or commits not present on remote `master`.
-
-Additional tag rules:
-
-- Do **not** create, move, delete, or push tags unless explicitly instructed.
-- Tag only **after** the intended PR is merged, and tag only the **verified
-  final master merge commit** (never the PR branch head unless the merge
-  commit is exactly that commit).
-- Always **report the tag target commit** in the final report / handoff.
-
-Release process (see [`templates/release-tag.md`](templates/release-tag.md)):
-
-1. `git fetch <remote> --prune`.
-2. Verify local `master` equals remote `master` (`0	0`) and the tree is clean.
-3. Run the full test suite; stop on any failure.
-4. Inspect merged issues/PRs since the last tag
-   (`git log --oneline <last-tag>..<remote>/master`).
-5. Choose the version bump.
-6. Create the annotated tag on remote `master` with release notes.
-7. Push the tag.
-8. Create/update release notes if the forge supports it.
-
-Where present, `scripts/release-tag` automates this with all gates built in
-(SemVer, fetch/prune, on-master, clean tree, local==remote master, HEAD on
-remote master, no duplicate tag, tests, annotated-only). Safe by default: no
-push without `--push`; `--dry-run` changes nothing; `--skip-tests` must be
-explicit and warns.
+Releases follow SemVer from remote `master` only, after full test suite passes.
+See [`templates/release-tag.md`](templates/release-tag.md) and
+`scripts/release-tag`.

skills/llm-project-workflow/schemas/create-issue-final-report.md

@@ -0,0 +1,46 @@
+# Create-issue controller handoff schema
+
+**Task mode:** `create-issue`
+
+End every create-issue run with a section titled exactly `Controller Handoff`.
+Use this canonical field set. Do not omit fields — use `none` or
+`not verified in this session` where appropriate.
+
+Do not use legacy fields: `Workspace mutations`, `Mutations: None` (when
+mutations occurred).
+
+```md
+## Controller Handoff
+
+- Task:
+- Repo:
+- Role:
+- Identity:
+- Active profile:
+- Runtime context:
+- Requested issue task:
+- Workflow source:
+- Capability proof:
+- Duplicate search terms:
+- Duplicate search pagination proof:
+- Duplicates found:
+- Issues created:
+- Issues commented:
+- Issues edited:
+- Issues skipped as duplicates:
+- Labels/assignees/milestones changed:
+- File edits by issue creator:
+- Worktree/index mutations:
+- Git ref mutations:
+- MCP/Gitea mutations:
+- Issue mutations:
+- Label/assignment/milestone mutations:
+- External-state mutations:
+- Read-only diagnostics:
+- Blockers:
+- Current status:
+- Safe next action:
+- Safety statement:
+```
+
+Identity format: `username / profile` (not personal email unless required — #305).

skills/llm-project-workflow/schemas/pr-queue-cleanup-final-report.md

@@ -0,0 +1,31 @@
+# PR-queue-cleanup final report schema
+
+One report per cleanup run (one run = one PR). Fields must all be present;
+use `none` where nothing occurred. Validated by
+`pr_queue_cleanup.assess_pr_queue_cleanup_report` (fail closed).
+
+* Task: pr-queue-cleanup
+* Workflow source: workflows/pr-queue-cleanup.md (+ version/commit/hash)
+* Repo:
+* Role/profile:
+* Identity:
+* PR inventory pagination proof: (inventory_complete / final page / total_count)
+* Queue ordering proof:
+* Earlier PRs skipped: (with live per-PR proof)
+* Selected PR: (exactly one)
+* Pinned head SHA:
+* Review decision: (single terminal decision)
+* Merge authorized for PR: true/false (explicit per-PR operator authorization)
+* Merge gates result:
+* Merge result: (none / not attempted / merged SHA / blocker)
+* Run stop point: (which §4 chain rule ended the run)
+* Next suggested PR: (named, not continued to)
+* File edits by reviewer:
+* Worktree/index mutations:
+* Git ref mutations:
+* MCP/Gitea mutations:
+* Issue mutations: none (required — forbidden in cleanup mode)
+* Branch mutations: none (required — forbidden in cleanup mode)
+* Read-only diagnostics:
+* Blockers:
+* Safe next action: (fresh run for the next PR)

skills/llm-project-workflow/schemas/reconcile-landed-final-report.md

@@ -0,0 +1,53 @@
+# Reconcile-landed controller handoff schema
+
+**Task mode:** `reconcile-landed-pr`
+
+End every reconciliation run with a section titled exactly `Controller Handoff`.
+Use this canonical field set. Do not omit fields — use `none` or
+`not verified in this session` where appropriate.
+
+Reject stale author/reviewer fields: `PR number opened`, `Pinned reviewed head`,
+`Scratch worktree used`, `Workspace mutations`, `Mutations: None` (when mutations
+occurred).
+
+```md
+## Controller Handoff
+
+- Task:
+- Repo:
+- Role:
+- Identity:
+- Active profile:
+- Runtime context:
+- Selected PR:
+- PR live state:
+- Candidate head SHA:
+- Target branch:
+- Target branch SHA:
+- Ancestor proof:
+- Linked issue:
+- Linked issue live status:
+- Eligibility class:
+- Capabilities proven:
+- Missing capabilities:
+- PR comments posted:
+- Issue comments posted:
+- PRs closed:
+- Issues closed:
+- File edits by reconciler:
+- Worktree/index mutations:
+- Git ref mutations:
+- MCP/Gitea mutations:
+- Reconciliation mutations:
+- External-state mutations:
+- Read-only diagnostics:
+- Blockers:
+- Current status:
+- Safe next action:
+- Safety statement:
+- No review/merge confirmation:
+```
+
+Identity format: `username / profile` (not personal email unless required — #305).
+
+`git fetch` belongs under `Git ref mutations`, not read-only diagnostics (#297).

skills/llm-project-workflow/schemas/review-merge-final-report.md

@@ -0,0 +1,113 @@
+# Review-merge controller handoff schema
+
+**Task mode:** `review-merge-pr`
+
+End every review/merge run with a section titled exactly `Controller Handoff`.
+Use this canonical field set. Do not omit fields — use `none` or
+`not verified in this session` where appropriate.
+
+Do not use legacy fields: `Pinned reviewed head`, `Scratch worktree used`,
+`Workspace mutations`, `Mutations: None` (when mutations occurred).
+
+```md
+## Controller Handoff
+
+- Task:
+- Repo:
+- Role:
+- Identity:
+- Active profile:
+- Runtime context:
+- Selected PR:
+- Linked issue:
+- Eligibility class:
+- Queue ordering policy:
+- Inventory pagination proof:
+- Earlier PRs skipped:
+- Candidate head SHA:
+- Reviewed head SHA:
+- Target branch:
+- Target branch SHA:
+- Already-landed gate:
+- Author-safety result:
+- Prior request-changes state:
+- Review worktree used:
+- Review worktree path:
+- Review worktree inside branches:
+- Review worktree HEAD state:
+- Review worktree dirty before validation:
+- Review worktree dirty after validation:
+- Baseline worktree used:
+- Baseline worktree path:
+- Files reviewed:
+- Validation:
+- Official validation integrity status:
+- Terminal review mutation:
+- Review decision:
+- Merge preflight:
+- Merge result:
+- Linked issue status:
+- Main checkout branch:
+- Main checkout dirty state:
+- Main checkout updated:
+- File edits by reviewer:
+- Worktree/index mutations:
+- Git ref mutations:
+- MCP/Gitea mutations:
+- Review mutations:
+- Merge mutations:
+- Cleanup mutations:
+- External-state mutations:
+- Read-only diagnostics:
+- Blockers:
+- Current status:
+- Safe next action:
+- Safety statement:
+```
+
+### Already-landed handoff overrides
+
+When eligibility class is `ALREADY_LANDED_RECONCILE_REQUIRED`:
+
+- Reviewed head SHA: `none`
+- Review worktree used: `false`
+- Review worktree path: `none`
+- Review decision: `none`
+- Merge result: `none`
+
+Identity format: `username / profile` (not personal email unless required — #305).
+
+### Queue-status-only runs (no selected PR)
+
+When the run inventories the queue but selects no PR for review:
+
+- Selected PR: `none`
+- Already-landed gate, Author-safety result, Merge preflight: `not applicable` or `not run` — never `passed`
+- Review worktree detail fields: `not applicable` or `none` when Review worktree used is `false`
+- Blockers must not be `none` if the narrative says all open PRs are conflicted, blocked, or unverified
+- Inventory pagination proof must cite final-page metadata, not default page-size assumptions
+
+Verifier: `review_proofs.assess_queue_status_report()`.
+
+Narrative final report and controller handoff must agree on eligibility class,
+candidate/reviewed head SHA, mutation state, worktree usage, review decision,
+terminal review mutation, merge result, and linked issue status.
+
+### Proof-backed claims (#395)
+
+Proof-sensitive claims must cite explicit command/tool evidence in the report
+or structured MCP metadata — not narrative alone:
+
+- **Inventory complete:** `has_more=false`, `is_final_page=true`,
+  `inventory_complete=true`, and/or `total_count` from `gitea_list_prs`.
+- **Skipped earlier PRs:** merge-simulation command output, conflict file list,
+  or live `gitea_get_pr_review_feedback` / mergeability fields.
+- **Baseline validation:** baseline worktree path, baseline target SHA,
+  dirty-before/after, exact command, exact result.
+- **Master integration:** exact `git merge` / `git rebase` command and exit status.
+- **Cleanup:** final `git worktree list` (or remove commands) proving session
+  worktrees were removed.
+
+When a claim relies on prior-session blocker state or MCP metadata only, label
+the proof source explicitly (`command`, `MCP metadata`, `prior blocker`,
+`not checked`). Do not use `live proof` without that classification.

skills/llm-project-workflow/schemas/work-issue-final-report.md

@@ -0,0 +1,73 @@
+# Work-issue controller handoff schema
+
+**Task mode:** `work-issue`
+
+End every work-issue run with a section titled exactly `Controller Handoff`.
+Use this canonical field set. Do not omit fields — use `none` or
+`not verified in this session` where appropriate.
+
+Do not use legacy fields: `Workspace mutations`, `Mutations: None` (when
+mutations occurred).
+
+```md
+## Controller Handoff
+
+- Task:
+- Repo:
+- Role:
+- Identity:
+- Active profile:
+- Runtime context:
+- Selected issue:
+- Eligibility class:
+- Issue ordering policy:
+- Issue inventory pagination proof:
+- Earlier issues skipped:
+- Duplicate active work proof:
+- Claim/lock state:
+- Stable branch:
+- Stable branch SHA:
+- Branch name:
+- Worktree path:
+- Worktree inside branches:
+- Worktree branch/HEAD state:
+- Worktree dirty before implementation:
+- Files changed:
+- Validation:
+- Baseline comparison:
+- Commit SHA:
+- Push result:
+- PR number:
+- PR URL:
+- PR verification:
+- Main checkout branch:
+- Main checkout dirty state:
+- Main checkout used for task work:
+- File edits by author:
+- Worktree/index mutations:
+- Git ref mutations:
+- MCP/Gitea mutations:
+- Issue mutations:
+- Branch mutations:
+- Commit mutations:
+- Push mutations:
+- PR mutations:
+- Cleanup mutations:
+- External-state mutations:
+- Read-only diagnostics:
+- Blockers:
+- Current status:
+- Safe next action:
+- Safety statement:
+```
+
+Identity format: `username / profile` (not personal email unless required — #305).
+
+Narrative final report and controller handoff must agree on eligibility class,
+selected issue, and mutation ledger categories (#319, #320).
+
+`git fetch` and ref-updating commands belong under `Git ref mutations`, not
+`Read-only diagnostics` (#297).
+
+Forbidden claims without proof (#330): `next eligible issue`, `issue claimed`,
+`validation passed`, `PR created`, `worktree clean`, `all gates passed`, etc.

skills/llm-project-workflow/templates/merge-pr.md

@@ -5,6 +5,10 @@ Copy, fill the `<...>` fields, and paste as the task prompt.
 ```text
 Task: merge PR #<pr> for issue #<n> if it is eligible and checks pass.
 
+Load the canonical workflow first:
+`skills/llm-project-workflow/workflows/review-merge-pr.md` (task mode: review-merge-pr).
+Final report schema: `schemas/review-merge-final-report.md`.
+
 Rules (llm-project-workflow):
 - Only an eligible, NON-author reviewer merges. If authenticated user == PR
   author → STOP.

skills/llm-project-workflow/templates/pr-queue-cleanup.md

@@ -0,0 +1,25 @@
+# Template: PR-only queue cleanup (one PR per run)
+
+Copy, fill the `<...>` fields, and paste as the task prompt.
+
+```text
+Task: PR-only queue cleanup for <repo>.
+
+Load workflows/pr-queue-cleanup.md and workflows/review-merge-pr.md before any
+mutation. Route pr_queue_cleanup through gitea_route_task_session (reviewer
+profile required).
+
+Rules:
+- One run = exactly one selected PR = one terminal review decision.
+- Build full open-PR inventory with pagination proof before selection.
+- Forbidden: issue claiming, branch creation, implementation edits, issue filing,
+  reviewing a second PR after a terminal mutation in this run.
+- After REQUEST_CHANGES: stop. After APPROVED: merge only this PR and only if
+  operator explicitly authorized merge for this PR in this run.
+- Report Next suggested PR without continuing to it.
+
+Operator PR list (optional): <pr numbers or "oldest eligible from inventory">
+Merge authorized for selected PR in this run: <true|false>
+
+End with the pr-queue-cleanup final report schema.
+```

skills/llm-project-workflow/templates/review-pr.md

@@ -17,9 +17,36 @@ Repo name disambiguation (Gitea-Tools blind review hardening):
   configured repos were not checked. This is not a complete queue inventory."
 - A single-repo "no open PRs" result MUST NOT be reported as global "no open PRs"
   if the other configured repo was not inventoried.
+- PR inventory trust gate (#196): before reporting "no open PRs" or "queue empty",
+  the workflow must run `pr_inventory_trust_gate` (via the live inventory path or
+  `review_proofs.assess_reviewer_queue_inventory`). Only `trusted_empty` allows a
+  clean empty-queue stop. Report `pr_inventory_trust_gate.status`, reasons, and
+  corroboration in the final report. A bare `[]` from `gitea_list_prs` is never
+  sufficient proof.
+- Empty-queue report wall (#198): if the final report claims "no open PRs",
+  "queue empty", or "nothing to review", it must include verbatim:
+  `pr_inventory_trust_gate.status`, trust-gate reasons, corroboration,
+  remote/owner/repo/state filter, and the inventory MCP profile. A recent merge
+  commit is not valid corroboration. Author-bound sessions must not present
+  reviewer queue inventory as a reviewer decision.
+
+Load the canonical workflow first:
+`skills/llm-project-workflow/workflows/review-merge-pr.md` (task mode: review-merge-pr).
+Final report schema: `schemas/review-merge-final-report.md`.
 
 Rules (llm-project-workflow):
 - Review in a SEPARATE detached review worktree, never the author's folder.
+- Worktree safety (#233): before checkout, diff, validation, review, or merge,
+  report the starting worktree path and whether it was dirty. If unrelated
+  tracked files exist outside the PR scope, STOP or run
+  `scripts/worktree-review <pr-head-branch>` and validate in the scratch path.
+  Scratch-clone validation is the norm; tests must not assume the shared
+  development worktree or a repo-local ``venv/`` (#245).
+  NEVER run `git stash`, `git stash pop/drop`, `git checkout --`, `git reset`,
+  or `git clean` to manage another session's dirty files.
+- Final report must state: Worktree path, Worktree dirty (yes/no),
+  Scratch worktree used (yes/no + path if yes), and confirm no unrelated local
+  files were modified, stashed, reset, or dropped.
 - You must NOT be the PR author. If the authenticated user == PR author, stop.
   A different LLM-Agent-SHA does NOT make you a different actor — only a
   different authenticated Gitea user does (docs/llm-agent-sha.md).

skills/llm-project-workflow/templates/start-issue.md

@@ -5,6 +5,10 @@ Copy, fill the `<...>` fields, and paste as the task prompt.
 ```text
 Task: implement <issue title / one-line goal>.
 
+Load canonical workflow: skills/llm-project-workflow/workflows/work-issue.md
+Final report schema: skills/llm-project-workflow/schemas/work-issue-final-report.md
+Router: skills/llm-project-workflow/SKILL.md (task mode: work-issue)
+
 Rules (llm-project-workflow):
 - No repo changes without a tracking issue. If none exists, create one first;
   if it can't be created, stop.
@@ -13,6 +17,21 @@ Rules (llm-project-workflow):
 - Do not self-review or self-merge.
 
 Steps:
+0. Work Selection Rule — before any claim, branch, or file edits, acquire or
+   verify a work lease. Required checks: list open PRs; search PRs linked to
+   the target issue; search local/remote branches for the issue number; search
+   registered worktrees for the issue branch; check dirty worktrees; check
+   active leases or recent handoffs; check whether a merged PR already
+   completed the issue. If another session owns the lease, stop (continue only
+   as lease owner, review the existing PR, hand off, request takeover after
+   expiry, or report "work already claimed"). Never open a parallel branch/PR
+   unless the old branch is proven abandoned and takeover is recorded.
+0b. Global LLM Worktree Rule — before any mutation, prove and state: project
+   root; cwd; current branch; stable branch for the main checkout (master/main/dev);
+   session-owned worktree path under branches/. If cwd is not inside branches/,
+   STOP (no exceptions — not for docs, tests, small fixes, review fixes, conflicts,
+   or cleanup). Main checkout is control-only: read-only inspect, fetch, create
+   worktrees, stable-branch update after merge, explicit repair.
 1. Identity Checklist: Before claiming work, verify and state:
    - Required identity/profile for this task: author (allowed to push branches / create PRs)
    - Current authenticated identity (from whoami): <username>

skills/llm-project-workflow/workflows/create-issue.md

@@ -0,0 +1,666 @@
+---
+task_mode: create-issue
+canonical: true
+final_report_schema: ../schemas/create-issue-final-report.md
+---
+
+# Create issue workflow (canonical)
+
+**Task mode:** `create-issue`
+
+This file is the canonical issue-creation workflow for Gitea-Tools. Load it
+before any issue mutation. Final report schema:
+[`schemas/create-issue-final-report.md`](../schemas/create-issue-final-report.md).
+
+**Default task prompt:**
+
+> Create or update Gitea issues in this project only if every identity,
+> capability, duplicate-search, issue-scope, final-report, mutation-ledger,
+> and proof-wording gate passes.
+
+Do not improvise around the gates. Follow project skills, MCP gates, and
+workflow rules exactly.
+
+This is an issue-creation workflow. It is not a reviewer workflow and not an
+implementation workflow.
+
+---
+
+## 0. Load the canonical workflow first
+
+Before starting issue creation or issue update work, check whether the project provides a canonical create-issue workflow through a project skill, runbook, or MCP helper.
+
+If available, load it first and report:
+
+* workflow source
+* workflow version, commit, or hash
+* whether this prompt conflicts with the loaded workflow
+
+If the canonical workflow cannot be loaded and the project requires it, stop and produce a recovery handoff only.
+
+## 1. Mode isolation
+
+This run is `create-issue` mode only.
+
+Do not:
+
+* review PRs
+* approve PRs
+* request changes
+* merge PRs
+* close PRs
+* close issues unless the user explicitly asks and exact close capability is proven
+* implement code
+* edit repo files
+* create branches
+* create commits
+* push branches
+* create PRs
+* run tests unless the canonical workflow explicitly requires validation for issue creation
+* perform reviewer-only actions
+* perform author/coder-only actions
+* perform MCP repair
+
+If the task requires review, merge, issue implementation, or MCP repair mode, stop and produce a handoff for the correct workflow.
+
+Do not mix modes in one run.
+
+## 2. Start with live identity, profile, runtime, and capability checks
+
+Prove:
+
+* authenticated identity
+* active profile
+* repo/project
+* runtime context
+* exact capability for reading/searching issues
+* exact capability for creating issues, if creating issues
+* exact capability for commenting on issues, if commenting on existing issues
+* exact capability for editing issues, if editing existing issues
+* exact capability for applying labels, if applying labels
+* exact capability for assigning issues, if assigning issues
+* exact capability for closing issues, only if explicitly requested
+
+A nearby capability does not count.
+
+Examples:
+
+* `create_issue` does not authorize `issue_comment`
+* `issue_comment` does not authorize `create_issue`
+* `create_pr` does not authorize `create_issue`
+* `review_pr` does not authorize `create_issue`
+* `merge_pr` does not authorize `issue_comment`
+* `gitea.read` does not authorize creating, commenting, editing, labeling, assigning, or closing issues
+
+If exact capability cannot be proven, stop and produce a recovery handoff only.
+
+## 3. Stop immediately on blocked infrastructure
+
+If any of the following appears, stop immediately:
+
+* `infra_stop`
+* MCP reconnect failure
+* stale capability state
+* missing capability
+* workspace mismatch
+* dirty control checkout, if the canonical workflow treats that as blocking
+* broken canonical workflow loading
+* failed required preflight
+* capability resolver warning that says the current state may be unsafe
+* stale or inconsistent runtime context
+
+Do not continue duplicate search, issue creation, issue commenting, issue editing, labeling, assignment, or cleanup.
+
+Produce an executable recovery handoff only.
+
+Blocked recovery handoffs must not include direct issue-create or issue-comment replay commands.
+
+Blocked handoffs must say to rerun the full workflow after the blocker clears.
+
+## 4. Main checkout rule
+
+This workflow should not mutate repo files.
+
+Do not edit files in the main checkout.
+
+Do not create branches.
+
+Do not create commits.
+
+Do not push.
+
+Do not run implementation work.
+
+Do not run reviewer validation.
+
+Reading repository files is allowed only when needed to understand the requested issue and only if the canonical workflow permits it.
+
+If the main checkout is dirty and the project treats dirty control checkout as blocking, stop and produce a recovery handoff.
+
+## 5. No raw MCP repair during issue creation
+
+Do not run `pkill`, kill MCP processes, edit MCP config, restart servers, or perform control-checkout repair during issue creation.
+
+If MCP repair is required, stop issue creation and produce a separate `CONTROL-CHECKOUT REPAIR MODE` handoff.
+
+Do not mix MCP repair mode with create-issue mode.
+
+After repair, rerun the full workflow from the beginning.
+
+## 6. No background task tools
+
+Do not use `schedule`, `manage_task`, background jobs, async waits, delayed task tools, or monitoring tasks during issue creation.
+
+Use direct commands and MCP tools only.
+
+If a required action cannot complete synchronously, stop and produce a recovery handoff.
+
+Do not say “I will check later,” “I will monitor,” or “I will continue in the background.”
+
+## 7. No local Gitea fallback during normal issue creation
+
+During normal issue-creation workflows, do not read Gitea profile secret files.
+
+Do not inspect or open files such as:
+
+* `profiles.json`
+* local token stores
+* credential files
+* local Gitea auth/profile config files
+* `.env` files containing Gitea credentials
+* keychain dumps
+* token helper outputs
+
+Do not run local Gitea helper scripts when MCP tools are available.
+
+Use MCP tools for Gitea operations.
+
+Local fallback is allowed only in explicit recovery mode when MCP is unavailable and identity/profile/capability can be independently proven.
+
+If local fallback is used, report:
+
+* why MCP was unavailable
+* exact identity proof
+* exact profile proof
+* exact repo proof
+* exact capability proof
+* exact local command used
+
+Do not use local fallback to bypass MCP gates.
+
+## 8. Understand the requested issue work
+
+Before searching or creating issues, restate the requested issue-creation task in operational terms.
+
+Identify:
+
+* target repo/project
+* issue topic
+* issue type, if known
+* whether this is a new issue, duplicate check, issue update, or issue-comment task
+* whether the user provided exact title/body text
+* whether acceptance criteria were provided
+* whether multiple issues are requested
+* whether labels, assignees, milestones, or links are requested
+* whether any requested action requires capability beyond issue creation
+
+Do not invent missing requirements.
+
+If the request is ambiguous but safe to proceed, make a reasonable best-effort issue with clear assumptions.
+
+If ambiguity would cause unsafe or wrong mutation, stop and ask for clarification or produce a recovery handoff according to project policy.
+
+## 9. Duplicate search before mutation
+
+Before creating any issue, search open and closed issues for duplicates.
+
+Duplicate search must happen before each issue creation unless a batch search clearly covers all proposed issues.
+
+Search terms must include:
+
+* exact proposed issue title
+* key noun phrase from the problem
+* key workflow/tool name
+* key failure phrase or error phrase
+* likely alternate wording
+* linked PR number, issue number, or file name, if relevant
+
+If the user supplied search terms, use those too.
+
+For each proposed issue, report:
+
+* search terms used
+* matching issue numbers/titles
+* whether each match is open or closed
+* whether any match fully covers the requested issue
+* whether any match partially covers the requested issue
+* whether a new issue is still needed
+
+Do not create a duplicate issue if an existing issue fully covers the problem.
+
+If a duplicate exists and fully covers the problem, stop issue creation for that topic and report the duplicate.
+
+If a duplicate exists but is missing important acceptance criteria, comment on the existing issue only if exact `issue_comment` capability is proven and the user/task authorizes commenting.
+
+If commenting is not authorized, report the existing issue and the missing criteria in the final handoff.
+
+## 10. Issue inventory pagination rule
+
+If listing/searching issues returns paginated results, follow pagination until the tool proves there are no more pages.
+
+Do not assume search results or issue inventory are complete.
+
+Pagination proof must not rely on assumed default API page size.
+
+Search/inventory is complete only if one of the following is proven:
+
+* the MCP response explicitly says there is no next page / `has_more=false` / final page
+* the workflow traversed pages until an empty page or explicit final page was returned
+* the tool response includes total-count or pagination metadata proving all relevant issues were returned
+* the request explicitly set `page` / `limit` / `per_page`, and the response explicitly proves the server honored that page size and did not truncate results
+
+Do not say “duplicate search complete” merely because the result count is less than an assumed default page size.
+
+If pagination metadata is absent and the tool cannot page, report `ISSUE_SEARCH_PAGINATION_UNPROVEN`.
+
+If duplicate search cannot be trusted, do not create the issue unless the canonical workflow explicitly permits best-effort issue creation with that limitation disclosed.
+
+## 11. Issue creation scope rule
+
+Create only issues within the requested scope.
+
+Do not create extra issues just because related problems are noticed.
+
+Do not create process-hardening issues unless the user explicitly requested process-hardening or the current task is explicitly about workflow/tooling gaps.
+
+Do not create implementation issues during reviewer mode.
+
+Do not create reviewer issues during work-on-issue mode.
+
+Do not create issues in a different repository unless the user explicitly asked and exact capability is proven.
+
+If multiple issues are requested, create only the requested issues and only after duplicate search for each one.
+
+If a proposed issue is too broad, split it only if the user requested splitting or the canonical workflow requires issue granularity.
+
+## 12. Issue content quality rule
+
+Every created issue must be actionable.
+
+Include, when applicable:
+
+* title
+* problem statement
+* observed evidence
+* expected behavior
+* required behavior
+* acceptance criteria
+* affected workflow/tool/files
+* safety or security considerations
+* duplicate search summary
+* related issues or PRs
+* non-goals, if useful
+
+Acceptance criteria must be concrete and testable.
+
+Avoid vague issues like:
+
+* “make workflow better”
+* “fix LLM behavior”
+* “improve process”
+* “handle this better”
+
+Instead, describe the exact wall, gate, verifier, test, schema, helper, or prompt change required.
+
+## 13. Issue title rule
+
+Use concise, specific titles.
+
+Good title patterns:
+
+* `Enforce <specific gate>`
+* `Add verifier for <specific report/proof problem>`
+* `Split <large workflow> into <specific components>`
+* `Block <unsafe action> during <workflow mode>`
+* `Require <proof type> before <claim/action>`
+
+Avoid titles that are too broad or emotional.
+
+The title should be unique enough that duplicate search can find it later.
+
+## 14. Issue body rule
+
+Issue body must include the full acceptance criteria.
+
+Do not create placeholder issues.
+
+Do not create issues with only a title unless the user explicitly requested title-only creation.
+
+If the user supplied exact issue body text, preserve it unless it contains unsafe instructions, stale facts, or contradictions.
+
+If edits are needed, make the smallest correction necessary and report the correction.
+
+Do not silently change requested meaning.
+
+## 15. Labels, assignees, and metadata
+
+Apply labels, assignees, milestones, or project fields only if:
+
+* the user requested them, or
+* the canonical workflow requires them, and
+* exact capability is proven.
+
+Do not guess labels if project label policy is unknown.
+
+If labels are useful but capability or policy is unclear, mention recommended labels in the final report instead of applying them.
+
+Do not assign issues to people unless explicitly requested or required by project workflow.
+
+## 16. Comment-on-existing issue rule
+
+Comment on an existing issue only if:
+
+* an existing issue partially covers the requested work, or
+* the user asked to add information to an existing issue, or
+* the canonical workflow requires duplicate consolidation comments, and
+* exact `issue_comment` capability is proven.
+
+Comment must be specific and useful.
+
+Include:
+
+* why the existing issue is relevant
+* what acceptance criteria or evidence should be added
+* whether this avoids creating a duplicate
+
+Do not comment just to say “duplicate found” unless the project workflow requires it.
+
+Do not close duplicate issues unless explicitly requested and exact close capability is proven.
+
+## 17. No hidden mutations
+
+Do not perform unreported mutations.
+
+Every issue creation, issue comment, issue edit, label change, assignment, milestone change, close/reopen action, or external-state change must be reported.
+
+If a tool call is dry-run-only, confirmation-gated, rejected, or no-op, report it separately from performed mutations.
+
+A dry run is not a mutation.
+
+A rejected call is not a performed mutation.
+
+A successful issue creation is an issue mutation.
+
+A successful issue comment is an issue mutation.
+
+A successful label/assignment/milestone update is an issue mutation or external-state mutation.
+
+## 18. Issue creation gate
+
+Before creating each issue, verify:
+
+* identity is still valid
+* active profile is still valid
+* runtime context is still safe
+* exact `create_issue` capability is still valid
+* duplicate search was completed or limitation was explicitly allowed
+* proposed title is not a duplicate
+* proposed body includes actionable acceptance criteria
+* target repo is correct
+* no mode switch has occurred
+
+If any gate fails, do not create the issue.
+
+Produce a recovery handoff or duplicate report.
+
+## 19. Issue commenting gate
+
+Before commenting on an existing issue, verify:
+
+* identity is still valid
+* active profile is still valid
+* runtime context is still safe
+* exact `issue_comment` capability is still valid
+* target issue number is correct
+* comment body is specific and useful
+* comment will not duplicate an existing comment
+* no mode switch has occurred
+
+If any gate fails, do not comment.
+
+Produce a recovery handoff or report the intended comment as a recommendation only.
+
+## 20. Issue edit/update gate
+
+Before editing an existing issue, verify:
+
+* identity is still valid
+* active profile is still valid
+* runtime context is still safe
+* exact edit capability is still valid
+* target issue number is correct
+* update is explicitly requested or required by canonical workflow
+* update does not erase useful existing content
+* no mode switch has occurred
+
+If any gate fails, do not edit.
+
+Prefer commenting over editing unless the user explicitly requested an edit or the canonical workflow requires issue body updates.
+
+## 21. Final report must be precise
+
+Include:
+
+* canonical workflow source/version/hash, if available
+* authenticated identity/profile
+* repo/project
+* runtime context summary
+* exact capability proof summary
+* requested issue-creation task
+* duplicate search terms used
+* duplicate search result
+* pagination/final-page proof for issue search, if applicable
+* issues created, with issue numbers and URLs
+* existing issues commented, with issue numbers and URLs
+* existing issues edited, with issue numbers and URLs
+* issues skipped as duplicates, with issue numbers and titles
+* labels/assignees/milestones applied, if any
+* blockers, if stopped
+* confirmation that no PR review, approval, request-changes, merge, branch, checkout, commit, push, or repo-file mutation was performed
+
+If the report and actual tool/command log disagree, fix the report before final output.
+
+## 22. Final report must distinguish mutation types
+
+Do not use the legacy field `Workspace mutations`.
+
+Use only precise categories:
+
+* File edits by issue creator:
+* Worktree/index mutations:
+* Git ref mutations:
+* MCP/Gitea mutations:
+* Issue mutations:
+* Label/assignment/milestone mutations:
+* External-state mutations:
+* Read-only diagnostics:
+
+Use precise wording:
+
+* `File edits by issue creator: none`
+* `Worktree/index mutations: none`
+* `Git ref mutations: none`
+* `Issue mutations: ...`
+
+If no repo files were edited, say:
+
+`File edits by issue creator: none`
+
+If no branches/worktrees were touched, say:
+
+`Worktree/index mutations: none`
+
+If no git refs were updated, say:
+
+`Git ref mutations: none`
+
+Do not hide issue mutations inside vague `MCP/Gitea mutations`.
+
+## 23. Local artifact and report consistency rule
+
+Do not create local walkthrough, notes, markdown, JSON, or report artifacts during issue-creation runs unless the canonical workflow or operator explicitly requires it.
+
+If any file is edited, created, generated, or written, report it under `File edits by issue creator`.
+
+For each file write, report:
+
+* exact path
+* whether it was inside the repo
+* whether it was tracked or untracked
+* why it was created
+* whether final status was checked after the write
+
+Do not say `File edits by issue creator: none` if any file write occurred.
+
+Do not write files after the final clean-status check unless you rerun and report a new final clean-status check.
+
+Default behavior: do not create local artifacts during issue creation.
+
+## 24. Forbidden final-report claims unless proven
+
+Do not claim:
+
+* `duplicate search complete`
+* `no duplicate found`
+* `issue created`
+* `issue commented`
+* `issue updated`
+* `label applied`
+* `capability proven`
+* `runtime safe`
+* `all gates passed`
+* `no file edits`
+* `no unsafe mutation`
+* `no PR mutation`
+* `no repo mutation`
+* `pagination complete`
+* `final page`
+* `no next page`
+
+unless the corresponding proof is included.
+
+If anything blocks safe issue creation or issue update, stop immediately and produce an executable recovery handoff.
+
+Do not improvise around the gates.
+
+## 25. Proof wording enforcement
+
+The following phrases are forbidden unless directly supported by current-session evidence:
+
+* duplicate search complete
+* no duplicate found
+* issue created
+* issue commented
+* issue updated
+* labels applied
+* capability proven
+* runtime safe
+* all gates passed
+* no file edits
+* no unsafe mutation
+* no PR mutation
+* no repo mutation
+* pagination complete
+* final page
+* no next page
+
+If the proof comes from prior state rather than a command/tool run in the current session, label it as prior proof, not live proof.
+
+If a tool call was rejected, confirmation-gated, dry-run-only, or no-op, report it separately from performed mutations.
+
+## 26. Final self-check before output
+
+Before final output, check the report for contradictions.
+
+Verify:
+
+* if any file was edited, `File edits by issue creator` is not `none`
+* if any worktree was added/removed, `Worktree/index mutations` lists it
+* if any fetch happened, `Git ref mutations` lists it
+* if any issue was created, `Issue mutations` lists it
+* if any issue was commented, `Issue mutations` lists it
+* if any issue was edited, `Issue mutations` lists it
+* if any labels/assignees/milestones were changed, the correct mutation category lists it
+* if duplicate search is claimed complete, pagination/final-page proof is present or limitation is disclosed
+* if no duplicate is claimed, search terms and results are present
+* if issue created is claimed, issue number and URL are present
+* if no PR mutation is claimed, no PR tool/action was used
+* if no repo mutation is claimed, no branch/worktree/file/commit/push action occurred
+* if all gates passed is claimed, every required gate has proof
+
+If any contradiction exists, fix the final report before output.
+
+## 27. Controller handoff schema
+
+End every run with a controller handoff using this schema.
+
+Do not omit fields. Use `none` or `not verified in this session` where appropriate.
+
+Controller Handoff:
+
+* Task:
+* Repo:
+* Role:
+* Identity:
+* Active profile:
+* Runtime context:
+* Requested issue task:
+* Workflow source:
+* Capability proof:
+* Duplicate search terms:
+* Duplicate search pagination proof:
+* Duplicates found:
+* Issues created:
+* Issues commented:
+* Issues edited:
+* Issues skipped as duplicates:
+* Labels/assignees/milestones changed:
+* File edits by issue creator:
+* Worktree/index mutations:
+* Git ref mutations:
+* MCP/Gitea mutations:
+* Issue mutations:
+* Label/assignment/milestone mutations:
+* External-state mutations:
+* Read-only diagnostics:
+* Blockers:
+* Current status:
+* Safe next action:
+* Safety statement:
+
+## 28. Stop conditions summary
+
+Stop immediately and produce a recovery handoff if:
+
+* canonical workflow is required but cannot be loaded
+* identity/profile/capability cannot be proven
+* runtime context is blocked
+* infra stop appears
+* MCP reconnect fails
+* capability state is stale
+* duplicate search cannot be performed and best-effort creation is not allowed
+* issue search pagination cannot be proven and best-effort creation is not allowed
+* duplicate fully covers the requested issue
+* requested issue body is unsafe or not actionable
+* target repo cannot be proven
+* create_issue capability is missing
+* issue_comment capability is missing for a required comment
+* issue edit capability is missing for a required edit
+* mode switch would be required
+* any report contradiction cannot be resolved
+
+Blocked handoffs must not include direct issue-create or issue-comment replay commands.
+
+Blocked handoffs must say to rerun the full workflow after the blocker clears.
+
+Do not improvise around the gates.

skills/llm-project-workflow/workflows/pr-queue-cleanup.md

@@ -0,0 +1,86 @@
+---
+task_mode: pr-queue-cleanup
+canonical: true
+final_report_schema: ../schemas/pr-queue-cleanup-final-report.md
+---
+
+# PR-only queue cleanup workflow (canonical)
+
+**Task mode:** `pr-queue-cleanup`
+
+Reviewer-role mode for cleanup periods when the queue holds many open PRs.
+Each run dispatches **exactly one** canonical review for **exactly one** PR,
+then stops after any terminal review mutation. The next PR always requires a
+new run with fresh identity, capability, and inventory proof.
+
+This mode composes with the canonical review workflow: for the selected PR,
+load and follow [`workflows/review-merge-pr.md`](review-merge-pr.md) in full.
+This file adds the cleanup-mode boundaries around that per-PR run; it does
+not replace the review workflow.
+
+## 0. Load the canonical workflow first
+
+Load this file and `workflows/review-merge-pr.md` before any mutation and
+report source, version/commit/hash, and any conflict with the operator
+prompt. If either cannot be loaded, stop and produce a recovery handoff.
+
+## 1. Mode isolation — forbidden actions
+
+PR-only cleanup mode forbids, with no exceptions:
+
+* issue claiming (`claim_issue`, `mark_issue`, `lock_issue`)
+* branch creation or push (`create_branch`, `push_branch`)
+* implementation edits of any kind
+* new issue filing (`create_issue`)
+* PR creation (`create_pr`) and commit tools (`commit_files`)
+* reviewing a second PR after any terminal review mutation
+
+`pr_queue_cleanup.check_cleanup_task_allowed` fails closed on these tasks.
+If author-side work is needed, stop and hand off to `work-issue` mode in a
+separate session.
+
+## 2. Identity, capability, and routing
+
+Route `pr_queue_cleanup` through `gitea_route_task_session` — reviewer role
+required; author sessions receive `wrong_role_stop`. Prove `gitea.pr.review`
+capability before selection. Merge additionally requires `gitea.pr.merge`
+plus the explicit per-PR authorization in §4.
+
+## 3. Inventory and selection
+
+Build the complete open-PR inventory with pagination proof
+(`inventory_complete`, final page, `total_count`) before any selection
+claim. Select exactly one PR according to project queue ordering rules
+(oldest-first unless the operator queue says otherwise), skipping earlier
+PRs only with live per-PR proof. No multi-PR validation and no batch report
+may substitute for per-PR proof.
+
+## 4. Terminal mutation chain
+
+`pr_queue_cleanup.resolve_cleanup_run_state` is the authority:
+
+* After `REQUEST_CHANGES` → the run stops.
+* After `COMMENT` or a proof-backed skip → the run stops.
+* After `APPROVED` → the run may continue **only** to same-PR merge, and only
+  when the operator explicitly authorized merge for that specific PR in this
+  run (`Merge authorized: true`) and every merge gate passes.
+* After merge, or on any merge blocker → the run stops.
+* Any terminal mutation targeting a PR other than the selected PR is a hard
+  stop and must be reported as a violation.
+
+## 5. Fresh run per PR
+
+The next PR requires a new run with fresh identity, capability, inventory,
+and ordering proof. Do not carry pinned SHAs, eligibility classes, or
+validation results across runs.
+
+## 6. Final report
+
+Use the schema in
+[`schemas/pr-queue-cleanup-final-report.md`](../schemas/pr-queue-cleanup-final-report.md).
+The report must include the **Next suggested PR** (from the proven ordering)
+without continuing to it, exactly one **Selected PR**, the single terminal
+decision, pagination proof, and `Issue mutations: none` / `Branch mutations:
+none`. `pr_queue_cleanup.assess_pr_queue_cleanup_report` validates these
+fields and fails closed on batch reviews, missing pagination proof, missing
+next-suggested-PR, unauthorized merges, or any issue/branch mutation.

skills/llm-project-workflow/workflows/reconcile-landed-pr.md

@@ -0,0 +1,409 @@
+---
+task_mode: reconcile-landed-pr
+canonical: true
+final_report_schema: ../schemas/reconcile-landed-final-report.md
+---
+
+# Reconcile already-landed open PR workflow (canonical)
+
+**Task mode:** `reconcile-landed-pr`
+
+This file is the canonical reconciliation workflow for open PRs whose head SHA
+is already an ancestor of the target branch. Load it before any reconciliation
+mutation. Final report schema:
+[`schemas/reconcile-landed-final-report.md`](../schemas/reconcile-landed-final-report.md).
+
+**Default task prompt:**
+
+> Reconcile already-landed open PRs in this project. Do not review or merge
+> normal PRs. Close or comment only when exact capability is proven.
+
+Do not improvise around the gates. Follow project skills, MCP gates, and
+workflow rules exactly.
+
+This is a reconciliation workflow. It is not a normal PR review/merge workflow.
+
+---
+
+## 0. Load the canonical workflow first
+
+Before starting reconciliation work, check whether the project provides a
+canonical reconcile-landed-PR workflow through a project skill, runbook, or MCP
+helper.
+
+If available, load it first and report:
+
+* workflow source
+* workflow version, commit, or hash
+* whether this prompt conflicts with the loaded workflow
+
+If the canonical workflow cannot be loaded and the project requires it, stop and
+produce a recovery handoff only.
+
+## 1. Mode isolation
+
+This run is `reconcile-landed-pr` mode only.
+
+**Do not review or merge normal PRs.**
+
+Do not:
+
+* approve PRs
+* request changes on PRs
+* merge PRs
+* implement code
+* edit repo files
+* create branches
+* create commits
+* push branches
+* create PRs
+* run normal PR validation as review approval input
+* perform author/coder implementation work
+* perform raw MCP repair
+
+If the task requires review, merge, issue implementation, or MCP repair mode,
+stop and produce a handoff for the correct workflow.
+
+Do not mix modes in one run.
+
+## 2. Start with live identity, profile, runtime, and capability checks
+
+Prove:
+
+* authenticated identity
+* active profile (reconciler or author with close capabilities, as required)
+* repo/project
+* runtime context
+* exact capability for reading/listing PRs and issues
+* exact capability for PR inspect (`gitea.read` / view PR)
+* exact capability for issue inspect
+* exact capability for PR comment, if commenting
+* exact capability for issue comment, if commenting
+* exact capability for PR close, if closing PRs
+* exact capability for issue close, if closing issues
+
+A nearby capability does not count.
+
+Examples:
+
+* `review_pr` does not authorize PR close
+* `merge_pr` does not authorize PR close or issue close
+* `create_issue` does not authorize `issue_comment`
+* `issue_comment` does not authorize PR close
+* `gitea.read` does not authorize close or comment mutations
+
+If exact capability cannot be proven, stop and produce a recovery handoff only.
+
+## 3. Stop immediately on blocked infrastructure
+
+If any of the following appears, stop immediately:
+
+* `infra_stop`
+* MCP reconnect failure
+* stale capability state
+* missing capability
+* workspace mismatch
+* broken canonical workflow loading
+* failed required preflight
+* capability resolver warning that says the current state may be unsafe
+* stale or inconsistent runtime context
+
+Do not continue inventory, ancestry proof, commenting, closing, or cleanup.
+
+Produce an executable recovery handoff only.
+
+Blocked recovery handoffs must not include direct close or comment replay
+commands.
+
+Blocked handoffs must say to rerun the full workflow after the blocker clears.
+
+## 4. Main checkout rule
+
+This workflow should not mutate repo files.
+
+Do not edit files in the main checkout.
+
+Do not create branches, commits, or pushes.
+
+Do not run implementation or reviewer validation worktrees for code edits.
+
+Reading repository files is allowed only when needed to understand
+reconciliation scope and only if this workflow permits it.
+
+## 5. No raw MCP repair during reconciliation
+
+Do not run `pkill`, kill MCP processes, edit MCP config, restart servers, or
+perform control-checkout repair during reconciliation.
+
+If MCP repair is required, stop and produce a separate `CONTROL-CHECKOUT REPAIR
+MODE` handoff.
+
+After repair, rerun the full workflow from the beginning.
+
+## 6. No background task tools
+
+Do not use `schedule`, `manage_task`, background jobs, async waits, delayed task
+tools, or monitoring tasks during reconciliation.
+
+Use direct commands and MCP tools only.
+
+If a required action cannot complete synchronously, stop and produce a recovery
+handoff.
+
+## 7. No local Gitea fallback during normal reconciliation
+
+During normal reconciliation workflows, do not read Gitea profile secret files.
+
+Do not inspect `profiles.json`, local token stores, credential files, `.env`
+Gitea credentials, keychain dumps, or token helper outputs.
+
+Do not run local Gitea helper scripts when MCP tools are available.
+
+Use MCP tools for Gitea operations.
+
+Local fallback is allowed only in explicit recovery mode when MCP is unavailable
+and identity/profile/capability can be independently proven.
+
+## 8. Build a complete live open PR inventory
+
+List open PRs for the target repo according to project policy.
+
+Follow pagination until the tool proves there are no more pages.
+
+Do not assume inventory is complete.
+
+Pagination proof must not rely on assumed default API page size.
+
+Inventory is complete only if one of the following is proven:
+
+* the MCP response explicitly says there is no next page / `has_more=false` /
+  final page
+* the workflow traversed pages until an empty page or explicit final page was
+  returned
+* the tool response includes total-count or pagination metadata proving all
+  relevant PRs were returned
+* the request explicitly set `page` / `limit` / `per_page`, and the response
+  explicitly proves the server honored that page size and did not truncate results
+
+If pagination cannot be proven, report `INVENTORY_PAGINATION_UNPROVEN` and stop
+unless project policy allows best-effort reconciliation with that limitation
+disclosed.
+
+## 9. Already-landed proof
+
+For each candidate PR, prove whether the PR head SHA is already landed on the
+target branch.
+
+**Already-landed proof** must include:
+
+* PR number and title
+* candidate head SHA (full 40-hex)
+* target branch name
+* target branch SHA (full 40-hex) after fetch
+* ancestor proof method (`git merge-base --is-ancestor`, equivalent forge API, or
+  documented project helper)
+* ancestor proof result (true/false)
+* live PR state (open/closed, merged flag)
+
+Do not classify a PR as already-landed without live ancestor proof.
+
+If ancestry cannot be proven, classify as `ANCESTRY_UNPROVEN` and skip close
+mutations.
+
+## 10. Linked issue live verification
+
+If the PR claims to close or link an issue, fetch the linked issue live before
+reporting its status.
+
+If the linked issue was not fetched live in the current session, report:
+
+`Linked issue status: not verified in this session`
+
+Do not claim `issue open`, `issue closed`, or `issue resolved` without live
+proof.
+
+## 11. Reconciliation selection rules
+
+Select PRs eligible for reconciliation:
+
+* open PR state
+* `merged=false` unless project policy says otherwise
+* head SHA is ancestor of target branch (already-landed proof passed)
+* not selected for normal review/merge in this run
+
+Eligibility class for selected PRs: `ALREADY_LANDED_RECONCILE_REQUIRED`
+
+Do not select PRs that fail already-landed proof for normal review/merge
+treatment in this mode.
+
+## 12. Reconciliation comment policy
+
+Post a reconciliation comment only if:
+
+* exact PR-comment or issue-comment capability is proven
+* the comment adds durable evidence (ancestor proof summary, recommended close
+  action, linked issue status)
+* the comment will not duplicate an equivalent recent reconciliation comment
+
+If comment capability is missing, record the intended comment in the final
+handoff only.
+
+## 12A. Partial reconciliation policy (#302)
+
+The durable policy when `close_pr` capability is missing is
+**comment-then-stop** (`resolve_partial_reconciliation_plan` in
+`review_proofs.py` enforces it):
+
+* `close_pr` proven → full reconciliation: close the PR and report the
+  close result (`FULL_RECONCILE_CLOSE_ALLOWED`).
+* `close_pr` missing, `comment_pr` proven → post exactly one
+  reconciliation comment carrying PR head SHA, target branch SHA,
+  ancestor proof, linked issue status, and the required missing
+  capability, then stop for a human or authorized close
+  (`PARTIAL_RECONCILE_COMMENT_THEN_STOP`).
+* `comment_pr` also missing → no Gitea mutation; produce a recovery
+  handoff recording the intended comment and required capabilities
+  (`RECOVERY_HANDOFF_ONLY`).
+* Ancestry not proven → no mutation regardless of capability
+  (`GATE_NOT_PROVEN`).
+
+Final reports must explain why the comment was or was not posted and
+name the missing capability (`assess_partial_reconciliation_report`).
+
+## 13. PR close rules
+
+Close a PR only if:
+
+* already-landed proof passed in this session
+* exact PR-close capability is proven
+* PR is still open at mutation time (live re-fetch)
+* head SHA still matches the proved candidate head SHA
+
+If PR-close capability is missing, produce a recovery handoff with exact PR,
+proof, and required capability. Do not loop forever re-blocking the reviewer
+queue.
+
+## 14. Issue close rules
+
+Close a linked issue only if:
+
+* exact issue-close capability is proven
+* linked issue was fetched live
+* issue resolution is justified by landed content and project policy
+* issue is still open at mutation time
+
+If issue-close capability is missing, report the gap in the handoff.
+
+## 15. Missing capability behavior
+
+If any required mutation capability is missing:
+
+* do not improvise with review/merge tools
+* do not ask the operator to bypass capability gates
+* produce a recovery handoff listing exact missing capabilities
+* include safe next action (profile switch, human close, or dedicated reconciler
+  profile)
+
+## 16. Mutation classification
+
+Use precise mutation categories in the final report:
+
+* File edits by reconciler: (expect `none`)
+* Worktree/index mutations:
+* Git ref mutations: (`git fetch` belongs here, not read-only diagnostics)
+* MCP/Gitea mutations:
+* Reconciliation mutations: (PR comment, issue comment, PR close, issue close)
+* External-state mutations:
+* Read-only diagnostics:
+
+Do not use legacy `Workspace mutations`.
+
+## 17. Identity privacy rule
+
+Report identity as `username / profile` (#305).
+
+Do not disclose personal email in final reports unless explicitly required.
+
+## 18. Precise final report
+
+Include:
+
+* canonical workflow source/version/hash
+* authenticated identity/profile
+* repo/project
+* capability proof summary (separate lines for inspect, comment, PR close,
+  issue close)
+* inventory pagination proof
+* selected PR(s) with already-landed proof
+* linked issue live status
+* mutations performed or blocked
+* missing capabilities
+* confirmation that no normal review, approval, request-changes, or merge was
+  performed
+
+## 19. Local artifact and report consistency rule
+
+Do not create local walkthrough, notes, markdown, JSON, or report artifacts
+during reconciliation unless explicitly required.
+
+If any file is edited, report under `File edits by reconciler`.
+
+Default: no repo file edits.
+
+## 20. Forbidden unsupported claims unless proven
+
+Do not claim:
+
+* `already-landed`
+* `PR closed`
+* `issue closed`
+* `pagination complete`
+* `inventory complete`
+* `all gates passed`
+* `no unsafe mutation`
+
+unless the corresponding proof is included.
+
+## 21. Proof wording enforcement
+
+Forbidden unless supported by current-session evidence:
+
+* pagination complete
+* final page
+* no next page
+* PR closed
+* issue closed
+* all gates passed
+
+If proof comes from prior state, label as prior proof, not live proof.
+
+## 22. Final self-check before output
+
+Verify:
+
+* no normal review/merge mutations occurred
+* `git fetch` is under Git ref mutations if it occurred
+* already-landed proof is present for each selected PR
+* handoff uses reconciliation schema, not author/reviewer merge schema
+* no contradiction between narrative report and controller handoff
+
+## 23. Controller handoff schema
+
+End every run with `Controller Handoff` per
+[`schemas/reconcile-landed-final-report.md`](../schemas/reconcile-landed-final-report.md).
+
+## 24. Stop conditions summary
+
+Stop immediately and produce a recovery handoff if:
+
+* canonical workflow cannot be loaded
+* identity/profile/capability cannot be proven
+* runtime context is blocked
+* `infra_stop` appears
+* inventory pagination cannot be proven and best-effort is not allowed
+* already-landed proof cannot be completed
+* required close capability is missing and mutation was attempted
+* live PR/issue state contradicts proof
+* any report contradiction cannot be resolved
+
+Do not improvise around the gates.

skills/llm-project-workflow/workflows/work-issue.md

@@ -0,0 +1,969 @@
+---
+task_mode: work-issue
+canonical: true
+final_report_schema: ../schemas/work-issue-final-report.md
+---
+
+# Work issue workflow (canonical)
+
+**Task mode:** `work-issue`
+
+This file is the canonical author/coder workflow for Gitea-Tools. Load it
+before any issue implementation mutation. Final report schema:
+[`schemas/work-issue-final-report.md`](../schemas/work-issue-final-report.md).
+
+**Default task prompt:**
+
+> Find the next eligible issue in this project, work on it only if all gates
+> pass, and create a PR when complete.
+
+Do not improvise around the gates. Follow project skills, MCP gates, and
+workflow rules exactly.
+
+This is an author/coder workflow. It is not a reviewer workflow.
+
+---
+
+## 0. Load the canonical workflow first
+
+Before starting issue work, check whether the project provides a canonical work-on-issue workflow through a project skill, runbook, or MCP helper.
+
+If available, load it first and report:
+
+* workflow source
+* workflow version, commit, or hash
+* whether this prompt conflicts with the loaded workflow
+
+If the canonical workflow cannot be loaded and the project requires it, stop and produce a recovery handoff only.
+
+## 1. Mode isolation
+
+This run is `work-issue` mode only.
+
+Do not:
+
+* review PRs
+* approve PRs
+* request changes
+* merge PRs
+* close PRs unless the PR creation workflow explicitly does so through Gitea automation
+* close unrelated issues
+* mutate reviewer state
+* perform reviewer-only actions
+* create process-hardening issues unless explicitly authorized and the workflow switches to issue-creation mode
+
+If the task requires review, merge, issue creation, or MCP repair mode, stop and produce a handoff for the correct workflow.
+
+Do not mix modes in one run.
+
+## 2. Start with live identity, profile, runtime, and capability checks
+
+Prove:
+
+* authenticated identity
+* active author/coder profile
+* repo/project
+* runtime context
+* exact capability for reading issues
+* exact capability for claiming/locking issues, if available
+* exact capability for branch creation, if handled through MCP
+* exact capability for pushing branches, if applicable
+* exact capability for creating PRs
+* exact capability for commenting on issues or PRs, if needed
+
+A nearby capability does not count.
+
+Examples:
+
+* `create_issue` does not authorize `issue_comment`
+* `review_pr` does not authorize `merge_pr`
+* `create_pr` does not authorize `merge_pr`
+* `issue_comment` does not authorize `create_issue`
+* `gitea.read` does not authorize issue claim, PR creation, or branch mutation
+
+If capability cannot be proven, stop and produce a recovery handoff only.
+
+### 2A. Pre-task role routing (#139)
+
+Before issue selection or any mutation, resolve the composite author task:
+
+* `gitea_route_task_session(task_type="work-issue", remote=…)` — must return
+  `route_result: allowed_current_session` and `downstream_allowed: true`
+* `gitea_resolve_task_capability(task="work_issue", remote=…)` — must show
+  `required_role_kind: author` and `allowed_in_current_session: true`
+
+Hyphen (`work-issue`) and underscore (`work_issue`) aliases are equivalent.
+If routing returns `ambiguous_task_stop`, `wrong_role_stop`, or
+`route_to_author_session`, stop and produce a recovery handoff only — do not
+fall back to reviewer tools or guess a different profile.
+
+## 3. Stop immediately on blocked infrastructure
+
+If any of the following appears, stop immediately:
+
+* `infra_stop`
+* MCP reconnect failure
+* stale capability state
+* dirty control checkout
+* dirty task worktree
+* missing capability
+* workspace mismatch
+* stale target branch state
+* broken canonical workflow loading
+* failed required preflight
+* capability resolver warning that says the current state may be unsafe
+* stale or inconsistent runtime context
+
+Do not continue issue selection, claiming, implementation, validation, commit, push, PR creation, cleanup, or handoff mutation.
+
+Produce an executable recovery handoff only.
+
+Blocked recovery handoffs must not include direct commit, push, or PR replay commands.
+
+Blocked handoffs must say to rerun the full workflow after the blocker clears.
+
+## 4. Main checkout rule
+
+The main project checkout must stay on `master`, `main`, or `dev`.
+
+Do not do task work in the main checkout.
+
+Do not edit files in the main checkout.
+
+Do not run tests in the main checkout.
+
+Do not commit from the main checkout.
+
+Do not create PRs from the main checkout.
+
+All task work must happen under the project’s `branches/` directory.
+
+No exceptions for small fixes, docs, tests, cleanup, conflict resolution, emergencies, or “just one file.”
+
+If the main checkout is dirty before selection, stop and produce a recovery handoff.
+
+If the main checkout becomes dirty during the run, stop and produce a recovery handoff unless the change is explicitly allowed by the canonical workflow.
+
+### Stacked PRs (explicit exception, #484)
+
+Normal author work stays base-equivalent to `master`/`main`/`dev`. A **stacked PR** — deliberately based on another unmerged PR's branch — is the only sanctioned non-master base, and only when the operator/controller explicitly chooses it:
+
+- Branch the `branches/` worktree from the dependency's branch, then lock with `gitea_lock_issue(..., stacked_base_branch=<dep-branch>, stacked_base_pr=<open-PR#>)`. The lock fails closed unless that open PR owns the branch; arbitrary or stale branches are rejected.
+- Open the PR with `gitea_create_pr(base=<dep-branch>)`. The body must state: `Stacked on PR #<X> / issue #<Y>`, `Base branch: <dep-branch>`, `Head branch: <this-branch>`, `Do not merge before PR #<X>`, and note retarget/rebase to `master` after the dependency lands if required.
+- This does not relax the main-checkout rule or bypass the issue lock — work still happens under `branches/`, and the approved base is recorded on the lock.
+
+## 5. No raw MCP repair during normal issue work
+
+Do not run `pkill`, kill MCP processes, edit MCP config, restart servers, or perform control-checkout repair during normal issue work.
+
+If MCP repair is required, stop issue work and produce a separate `CONTROL-CHECKOUT REPAIR MODE` handoff.
+
+Do not mix MCP repair mode with work-on-issue mode.
+
+Do not use successful repair as permission to resume the same issue workflow. After repair, rerun the full workflow from the beginning.
+
+## 6. No background task tools
+
+Do not use `schedule`, `manage_task`, background jobs, async waits, delayed task tools, or monitoring tasks during issue work.
+
+Use direct commands and MCP tools only.
+
+If a required action cannot complete synchronously, stop and produce a recovery handoff.
+
+Long synchronous commands, such as a test suite, are allowed only if they are run directly and reported with exact command, working directory, and result.
+
+Do not say “I will check later,” “I will monitor,” or “I will continue in the background.”
+
+## 7. No local Gitea fallback during normal issue work
+
+During normal author/coder workflows, do not read Gitea profile secret files.
+
+Do not inspect or open files such as:
+
+* `profiles.json`
+* local token stores
+* credential files
+* local Gitea auth/profile config files
+* `.env` files containing Gitea credentials
+* keychain dumps
+* token helper outputs
+
+Do not run local Gitea helper scripts when MCP tools are available.
+
+Use MCP tools for Gitea operations.
+
+Local fallback is allowed only in explicit recovery mode when MCP is unavailable and identity/profile/capability can be independently proven.
+
+If local fallback is used, report:
+
+* why MCP was unavailable
+* exact identity proof
+* exact profile proof
+* exact repo proof
+* exact capability proof
+* exact local command used
+
+Do not use local fallback to bypass MCP gates.
+
+## 8. Build a complete live issue inventory
+
+List open issues according to the project’s issue selection policy.
+
+Follow pagination until the tool proves there are no more pages.
+
+Do not assume inventory is complete.
+
+Do not claim `next eligible issue`, `oldest eligible issue`, or complete issue inventory unless pagination is proven.
+
+Pagination proof must not rely on assumed default API page size.
+
+Inventory is complete only if one of the following is proven:
+
+* the MCP response explicitly says there is no next page / `has_more=false` / final page
+* the workflow traversed pages until an empty page or explicit final page was returned
+* the tool response includes total-count or pagination metadata proving all relevant issues were returned
+* the request explicitly set `page` / `limit` / `per_page`, and the response explicitly proves the server honored that page size and did not truncate results
+
+Do not say “inventory complete” merely because the result count is less than an assumed default page size.
+
+For each candidate issue, identify:
+
+* issue number
+* title
+* labels
+* status
+* author/requester, if relevant
+* assignee/owner, if any
+* linked PRs, if any
+* dependency/blocker labels, if any
+* whether it appears already claimed
+* whether it appears already implemented or superseded
+* whether it is eligible under project rules
+
+Final report must include pagination/final-page proof.
+
+## 9. Issue selection rules
+
+State the issue ordering policy before selecting an issue.
+
+If the project uses oldest-first, explicitly sort or reason by issue number or created date.
+
+Do not rely on API response order unless the tool proves that order matches the project policy.
+
+Do not pick:
+
+* already-claimed issues
+* issues assigned to another active worker
+* issues with an open PR already covering the work
+* duplicate issues
+* blocked issues
+* dependency-blocked issues
+* already implemented issues
+* issues outside the current requested scope
+* process-hardening issues unless this run was explicitly started for process-hardening work
+* reviewer-only issues if this is author/coder mode
+
+For every earlier issue skipped, report:
+
+* issue number
+* current status
+* blocking category
+* proof used
+* whether there is an open PR
+* whether there is an active claim
+* reason it is not eligible
+
+If eligibility cannot be proven, classify it as:
+
+`ISSUE_ELIGIBILITY_UNVERIFIED`
+
+Then stop or produce a recovery handoff according to project policy.
+
+Do not select an issue based only on memory from a previous session.
+
+## 10. Linked PR / duplicate active work proof
+
+Before claiming or working on an issue, check whether there is already an open PR, branch, or active claim for that issue.
+
+If an open PR already exists for the issue, do not implement duplicate work.
+
+Classify the issue as:
+
+`OPEN_PR_EXISTS`
+
+and skip it only if project policy allows skipping.
+
+If branch naming or PR title convention links issues to branches, search for matching branches or PRs.
+
+Report:
+
+* issue number
+* linked/open PRs found
+* matching branches found, if checked
+* active claims found
+* duplicate work status
+
+Do not create another branch/PR for the same issue unless the project explicitly allows taking over or updating existing work and exact capability is proven.
+
+### 10A. Duplicate-work gate phases (#400)
+
+Before any file edits, prove duplicate-work clearance with
+`gitea_assess_work_issue_duplicate` or `gitea_lock_issue` (which runs the same
+gate). The gate checks live:
+
+* open PRs linked to the issue (head branch or Closes/Fixes reference),
+* remote branches matching `issue-<number>`,
+* active claim leases from structured heartbeats.
+
+Re-check immediately before:
+
+* `gitea_commit_files` (commit),
+* branch push,
+* `gitea_create_pr` (PR creation).
+
+If a concurrent open PR appears after work begins:
+
+* before commit/push → stop and preserve local work without pushing,
+* after commit but before push → stop without pushing,
+* after push but before PR creation → stop and produce a reconciliation
+  handoff instead of opening a PR.
+
+Final reports must state exactly one duplicate-work outcome:
+
+* `duplicate PR prevented`
+* `duplicate branch prevented`
+* `duplicate commit prevented`
+* `duplicate work not prevented`
+
+## 11. Claim or lock the issue before implementation
+
+Claim/lock the issue before implementation if the project provides a claim/lock mechanism.
+
+If claim/lock requires a Gitea mutation, prove exact capability first.
+
+If claim/lock fails, stop.
+
+Do not implement unclaimed work.
+
+If the claim/lock gates are broken, produce a recovery handoff.
+
+Create a tooling issue only if this run is explicitly authorized to switch to issue-creation mode and exact `create_issue` capability is proven.
+
+Report:
+
+* claim mechanism used
+* claim result
+* claim timestamp, if available
+* issue owner/assignee after claim, if available
+
+## 12. Refresh stable branch before branch/worktree creation
+
+Fetch the stable target branch from the remote before creating a task branch or worktree.
+
+Do not rely on stale local `master`, `main`, or `dev`.
+
+Record the fetched stable branch SHA.
+
+If the stable branch cannot be fetched or verified, stop and produce a recovery handoff.
+
+`git fetch`, `git remote update`, and any command that updates refs must be reported under `Git ref mutations`, not read-only diagnostics.
+
+## 13. Branch and worktree ownership rule
+
+Create a fresh session-owned worktree under `branches/`.
+
+Prefer a branch name that includes the issue number, for example:
+
+`feat/issue-<ISSUE_NUMBER>-short-description`
+
+or:
+
+`fix/issue-<ISSUE_NUMBER>-short-description`
+
+Prefer a worktree path like:
+
+`branches/issue-<ISSUE_NUMBER>-short-description`
+
+Before any file edits, prove:
+
+* project root
+* current working directory
+* main checkout branch
+* stable branch
+* stable branch SHA
+* task branch name
+* session-owned worktree path
+* worktree path is inside `branches/`
+* worktree is not the main checkout
+* clean tracked state
+* clean untracked state
+* worktree HEAD/branch state
+
+Do not reuse an existing worktree unless safe-reuse proof passes.
+
+Safe-reuse proof must include:
+
+* exact worktree path
+* worktree is inside `branches/`
+* worktree is not the main checkout
+* worktree is not owned by another active task/session
+* clean tracked state
+* clean untracked state
+* current branch/head before reset
+* reset target SHA
+* explicit project policy allowing reuse/reset
+
+Do not run `git reset --hard`, `git clean`, checkout, or other destructive commands unless the worktree is session-owned or safe-reuse proof passes.
+
+If safe-reuse proof cannot be produced, create a fresh session-owned worktree.
+
+## 14. Implementation scope rule
+
+Implement only what is required for the selected issue.
+
+Do not perform opportunistic refactors.
+
+Do not fix unrelated tests unless they are required for the selected issue and clearly documented.
+
+Do not modify reviewer workflow files unless the selected issue explicitly requires workflow changes.
+
+Do not modify Gitea profiles, MCP authorization, tokens, secrets, deployment config, production config, or credentials unless the selected issue explicitly requires it and exact capability/proof gates pass.
+
+Do not introduce provenance markers, agent signatures, temporary files, debug dumps, or generated artifacts unless required.
+
+If implementation uncovers a separate issue, note it in the final report or create a follow-up issue only if exact capability is proven and project policy allows it.
+
+## 15. File edit rule
+
+All edits must happen only inside the session-owned issue worktree.
+
+Do not edit files in the main checkout.
+
+Do not edit files in reviewer worktrees.
+
+Do not edit unrelated worktrees.
+
+Track every edited, created, deleted, or generated file.
+
+If any file is edited, created, generated, or written, report it under `File edits by author`.
+
+For each file write, report:
+
+* exact path
+* whether it was inside the repo
+* whether it was tracked or untracked
+* why it was created
+* whether final `git status` was run after the write
+
+Do not say `File edits by author: none` if any file write occurred.
+
+Do not write files after the final clean-status check unless you rerun and report a new final clean-status check.
+
+## 16. Validation rule
+
+Run appropriate validation for the selected issue.
+
+Validation may include:
+
+* targeted tests
+* full test suite
+* compile checks
+* lint checks
+* type checks
+* diff checks
+* secret/provenance checks
+* dangerous artifact checks
+* project-specific validation
+
+If validation cannot run, explain why and include the exact failure.
+
+Do not hide failures.
+
+Do not claim success if tests failed.
+
+Do not skip required validation silently.
+
+Do not bypass MCP gates.
+
+Report every validation command with:
+
+* exact command
+* working directory
+* exit code or pass/fail result
+* summary count if available
+* whether it was targeted, full-suite, compile, lint, diff, secret/provenance, or diagnostic validation
+
+If using bare `pytest`, also report:
+
+* `which pytest`
+* `pytest --version`
+* whether it resolves to the project venv
+
+Prefer the project venv executable when available.
+
+## 17. Baseline comparison rule
+
+Do not run tests in the main checkout.
+
+If the full suite fails and you need to prove failures are pre-existing, create a clean baseline worktree under `branches/`, such as:
+
+`branches/baseline-master-issue-<ISSUE_NUMBER>`
+
+Baseline comparison must include:
+
+* baseline worktree path
+* baseline target SHA
+* task branch SHA
+* exact command run on both worktrees
+* baseline failures
+* task branch failures
+* proof the failure signatures match
+* proof the baseline worktree was clean before and after validation
+* proof the issue worktree was clean before and after validation
+
+Do not claim “same as master” unless the clean baseline worktree proof is included.
+
+Do not claim “full-suite failures are pre-existing” unless baseline proof is complete and the failure signatures match.
+
+If full-suite failures differ or proof is incomplete, do not create a PR unless project policy explicitly allows PR creation with documented validation failures.
+
+## 18. Pre-commit review
+
+Before committing, review the actual diff.
+
+Check:
+
+* correctness
+* tests
+* scope
+* security boundaries
+* workflow rule compliance
+* whether the implementation really satisfies the selected issue
+* unrelated changes
+* dangerous generated artifacts
+* secrets
+* provenance markers
+* temporary agent files
+* debug output
+* formatting-only churn
+* docs/tests consistency
+
+Run:
+
+* `git status`
+* `git diff --stat`
+* `git diff`
+* project-required diff checks
+
+Do not commit if unrelated or unsafe changes are present.
+
+## 19. Commit rules
+
+Commit only from the session-owned issue worktree.
+
+Do not commit from the main checkout.
+
+Commit only after implementation and required validation pass, unless project policy explicitly allows draft PRs with failing validation.
+
+Commit message must reference the issue number.
+
+Preferred format:
+
+`fix: short summary (Closes #<ISSUE_NUMBER>)`
+
+or:
+
+`feat: short summary (Closes #<ISSUE_NUMBER>)`
+
+Before commit, prove:
+
+* worktree path
+* branch name
+* selected issue number
+* staged files
+* diff summary
+* validation status
+
+After commit, record:
+
+* commit SHA
+* commit message
+* changed files
+
+Do not amend, reset, rebase, squash, or force-push unless the project workflow explicitly allows it and the worktree is session-owned.
+
+## 20. Push rules
+
+Push only the session-owned task branch.
+
+Do not push `master`, `main`, `dev`, tags, or unrelated branches.
+
+Before push, prove:
+
+* current branch
+* upstream/remote target
+* commit SHA being pushed
+* selected issue number
+* branch name matches the issue
+
+After push, report:
+
+* remote
+* branch
+* pushed commit SHA
+* push result
+
+If push fails, stop and produce a recovery handoff.
+
+## 20A. Conflict-fix lease and push gate (#399)
+
+When pushing to an existing PR branch to resolve merge conflicts:
+
+1. Call `gitea_acquire_conflict_fix_lease` before any push.
+2. Call `gitea_assess_conflict_fix_push` immediately before `git push` with:
+   * branch head before push
+   * branch head after push (local)
+   * session worktree path
+   * push cwd
+   * whether the push is fast-forward
+3. Do not push when a reviewer holds an active lease on the same PR.
+4. Do not force-push.
+5. Do not push from the main checkout or wrong cwd.
+
+Conflict-fix final reports must state:
+
+* branch head before push
+* branch head after push
+* active reviewer lease status
+* whether push was fast-forward
+* whether any reviewer was active
+
+## 21. PR creation rules
+
+Create a PR only if implementation and validation pass, unless project policy explicitly allows draft PRs with documented validation failures.
+
+Do not create a PR if:
+
+* issue was not claimed/locked
+* issue eligibility was unproven
+* duplicate open PR exists
+* task branch does not reference the issue
+* implementation is incomplete
+* validation failed without allowed exception
+* worktree is dirty
+* secrets/provenance/dangerous artifacts are present
+* capability for PR creation is missing
+* runtime context is blocked
+* authenticated identity/profile changed unexpectedly
+
+PR must reference or close the issue.
+
+PR body must include:
+
+* summary
+* linked issue
+* files changed
+* validation commands and results
+* risk
+* exact worktree path
+* branch name
+* commit SHA
+* known limitations, if any
+
+Do not merge your own PR.
+
+Do not approve your own PR.
+
+Do not request changes on your own PR.
+
+After PR creation, fetch or view the PR to verify:
+
+* PR number
+* PR URL
+* PR title
+* base branch
+* head branch
+* linked issue
+* head SHA
+* open status
+
+## 22. Cleanup rules
+
+Clean only session-owned temporary/baseline worktrees if the project workflow explicitly allows cleanup.
+
+Do not delete unrelated branches/worktrees.
+
+Do not delete the task worktree if the project expects it to remain for handoff unless policy says cleanup is allowed after PR creation.
+
+Do not update the main checkout unless the canonical workflow explicitly allows it.
+
+Any cleanup is a mutation and must be reported.
+
+## 23. Recovery handoff rules
+
+If blocked, produce a recovery handoff with:
+
+* exact blocker
+* failed tool/function, if any
+* repo/project
+* selected issue, if one was safely selected
+* eligibility class
+* claim/lock state
+* branch name, if created
+* worktree path, if created
+* stable branch and stable branch SHA, if known
+* files changed, if any
+* validation state
+* commit SHA, if committed
+* PR number/URL, if created
+* exact state reached before stopping
+* safe next action
+* statement that no unsafe mutation was attempted
+
+Blocked handoffs must not include direct commit, push, or PR replay commands.
+
+Blocked handoffs must say to rerun the full workflow after the blocker clears.
+
+## 24. Final report must be precise
+
+Include:
+
+* canonical workflow source/version/hash, if available
+* authenticated identity/profile
+* repo/project
+* capability proof summary
+* issue inventory proof, including pagination/final-page proof
+* issue ordering policy used
+* selected issue number/title
+* eligibility class
+* skipped earlier issues and proof, if any
+* duplicate active work proof
+* claim/lock result
+* stable branch and stable branch SHA
+* branch name
+* worktree path
+* worktree inside `branches/`: true/false
+* worktree branch/HEAD state
+* worktree dirty before implementation: true/false
+* files changed
+* validation commands and results
+* baseline comparison result, if used
+* pre-commit diff review result
+* commit SHA and commit message, if committed
+* push result, if pushed
+* PR number and URL, if created
+* PR verification result, if created
+* cleanup result
+* blockers, if stopped
+* confirmation that the main checkout was not used for task work
+
+If the report and actual tool/command log disagree, fix the report before final output.
+
+## 25. Final report must distinguish mutation types
+
+Do not use the legacy field `Workspace mutations`.
+
+Use only precise categories:
+
+* File edits by author:
+* Worktree/index mutations:
+* Git ref mutations:
+* MCP/Gitea mutations:
+* Issue mutations:
+* Branch mutations:
+* Commit mutations:
+* Push mutations:
+* PR mutations:
+* Cleanup mutations:
+* External-state mutations:
+* Read-only diagnostics:
+
+Issue-lock file (`/tmp/gitea_issue_lock.json`) read/write/delete is always an
+external-state mutation. Never claim `External-state mutations: none` after
+seeding, restoring, or removing that file. Manual lock seeding is not a normal
+recovery path (#447); use `gitea_lock_issue` or the #442 adoption recovery path
+instead. Link broader redesign: #438.
+
+`git fetch`, `git remote update`, and any command that updates refs must be listed under `Git ref mutations`, not read-only diagnostics.
+
+If `git reset --hard`, checkout, clean, worktree add/remove, merge simulation, merge abort, or similar commands occurred, report them under `Worktree/index mutations`.
+
+Use precise wording:
+
+* `File edits by author: none`
+* `Worktree/index mutations: ...`
+* `Git ref mutations: ...`
+* `MCP/Gitea mutations: ...`
+
+Do not collapse issue, branch, commit, push, PR, cleanup, or external-state mutations into vague wording.
+
+## 26. Forbidden final-report claims unless proven
+
+Do not claim:
+
+* `next eligible issue`
+* `oldest eligible issue`
+* `issue claimed`
+* `no duplicate work`
+* `no open PR`
+* `worktree clean`
+* `validation passed`
+* `same as master`
+* `full-suite failures are pre-existing`
+* `committed`
+* `pushed`
+* `PR created`
+* `issue closed`
+* `main checkout untouched`
+* `no file edits`
+* `no unsafe mutation`
+* `all gates passed`
+* `target branch up to date`
+
+unless the corresponding proof is included.
+
+If anything blocks safe work or PR creation, stop immediately and produce an executable recovery handoff.
+
+Do not improvise around the gates.
+
+## 27. Proof wording enforcement
+
+The following phrases are forbidden unless directly supported by current-session evidence:
+
+* next eligible issue
+* oldest eligible issue
+* inventory complete
+* no duplicate work
+* issue claimed
+* worktree clean
+* validation passed
+* same as master
+* full-suite failures are pre-existing
+* committed
+* pushed
+* PR created
+* issue closed
+* target branch up to date
+* all gates passed
+* no unsafe mutation
+* no file edits
+
+If the proof comes from prior state rather than a command/tool run in the current session, label it as prior proof, not live proof.
+
+If a tool call was rejected, confirmation-gated, dry-run-only, or no-op, report it separately from performed mutations.
+
+## 28. Final self-check before output
+
+Before final output, check the report for contradictions.
+
+Verify:
+
+* if any file was edited, `File edits by author` is not `none`
+* if any worktree was added/removed, `Worktree/index mutations` lists it
+* if any fetch happened, `Git ref mutations` lists it
+* if any issue was claimed/commented/updated, `Issue mutations` lists it
+* if any branch was created, `Branch mutations` lists it
+* if any commit was created, `Commit mutations` lists it
+* if any push occurred, `Push mutations` lists it
+* if any PR was created, `PR mutations` lists it
+* if any cleanup happened, `Cleanup mutations` lists it
+* if any issue/PR external state changed, `External-state mutations` lists it
+* if pagination is claimed complete, final-page proof is present
+* if same-as-master is claimed, baseline proof is complete
+* if selected issue is claimed next eligible, every earlier issue has proof-backed skip reasoning
+* if PR created is claimed, PR verification proof is present
+* if main checkout untouched is claimed, main checkout status proof is present
+
+If any contradiction exists, fix the final report before output.
+
+## 29. Controller handoff schema
+
+End every run with a controller handoff using this schema.
+
+Do not omit fields. Use `none` or `not verified in this session` where appropriate.
+
+Controller Handoff:
+
+* Task:
+* Repo:
+* Role:
+* Identity:
+* Active profile:
+* Runtime context:
+* Selected issue:
+* Eligibility class:
+* Issue ordering policy:
+* Issue inventory pagination proof:
+* Earlier issues skipped:
+* Duplicate active work proof:
+* Claim/lock state:
+* Stable branch:
+* Stable branch SHA:
+* Branch name:
+* Worktree path:
+* Worktree inside branches:
+* Worktree branch/HEAD state:
+* Worktree dirty before implementation:
+* Files changed:
+* Validation:
+* Baseline comparison:
+* Commit SHA:
+* Push result:
+* PR number:
+* PR URL:
+* PR verification:
+* Main checkout branch:
+* Main checkout dirty state:
+* Main checkout used for task work:
+* File edits by author:
+* Worktree/index mutations:
+* Git ref mutations:
+* MCP/Gitea mutations:
+* Issue mutations:
+* Branch mutations:
+* Commit mutations:
+* Push mutations:
+* PR mutations:
+* Cleanup mutations:
+* External-state mutations:
+* Read-only diagnostics:
+* Blockers:
+* Current status:
+* Safe next action:
+* Safety statement:
+
+## 30. Stop conditions summary
+
+Stop immediately and produce a recovery handoff if:
+
+* canonical workflow is required but cannot be loaded
+* identity/profile/capability cannot be proven
+* runtime context is blocked
+* infra stop appears
+* MCP reconnect fails
+* capability state is stale
+* issue inventory pagination cannot be proven
+* issue ordering cannot be proven
+* issue eligibility cannot be proven
+* duplicate active work cannot be checked
+* selected issue is already claimed by another worker
+* selected issue already has an open PR
+* claim/lock fails
+* stable branch cannot be fetched
+* task worktree cannot be created safely
+* task worktree is dirty before implementation
+* validation cannot run
+* validation fails without allowed exception
+* baseline comparison is required but incomplete
+* diff review finds unrelated or unsafe changes
+* commit fails
+* push fails
+* PR creation fails
+* PR verification fails
+* any report contradiction cannot be resolved
+
+Blocked handoffs must not include direct commit, push, or PR replay commands.
+
+Blocked handoffs must say to rerun the full workflow after the blocker clears.
+
+Do not improvise around the gates.

stacked_pr_support.py

@@ -0,0 +1,211 @@
+"""Stacked-PR support for author issue locks and PR creation (#484).
+
+Normal author work locks a worktree that is base-equivalent to ``master``/
+``main``/``dev`` and opens a PR against one of those base branches. A *stacked*
+PR is deliberately based on another unmerged PR's branch, so its worktree is not
+master-equivalent and its PR base is not a normal base branch.
+
+This module holds the pure decision logic that lets:
+
+* ``gitea_lock_issue`` approve a non-master base **only** when it is explicitly
+  declared and proven to correspond to an open pull request, and
+* ``gitea_create_pr`` accept that approved base while still rejecting arbitrary,
+  mismatched, or stale (merged/closed) branches.
+
+The normal master-based path is unchanged: when no stacked base is declared, and
+when the PR base is a normal base branch, these helpers are inert. Nothing here
+bypasses the issue lock — a stacked base is recorded *on* the lock and re-checked
+at PR time.
+"""
+
+from __future__ import annotations
+
+BASE_BRANCHES = frozenset({"master", "main", "dev"})
+
+# Phrases that satisfy the required merge-ordering statement in a stacked PR body.
+MERGE_ORDER_PHRASES = ("do not merge before", "do not merge until")
+
+
+def is_base_branch(base: str | None, base_branches: frozenset[str] | None = None) -> bool:
+    """True when ``base`` is a normal base branch (master/main/dev)."""
+    bases = base_branches or BASE_BRANCHES
+    return (base or "").strip() in bases
+
+
+def _pr_head_ref(pr: dict) -> str:
+    head = pr.get("head") or {}
+    if isinstance(head, dict):
+        return (head.get("ref") or "").strip()
+    return (str(head) if head else "").strip()
+
+
+def find_open_pr_for_branch(open_prs: list[dict] | None, branch: str | None) -> dict | None:
+    """Return the first OPEN PR whose head ref equals ``branch`` (else ``None``)."""
+    branch = (branch or "").strip()
+    if not branch:
+        return None
+    for pr in open_prs or []:
+        if (pr.get("state") or "").strip().lower() != "open":
+            continue
+        if _pr_head_ref(pr) == branch:
+            return pr
+    return None
+
+
+def assess_stacked_base_declaration(
+    *,
+    stacked_base_branch: str | None,
+    stacked_base_pr: int | None,
+    open_prs: list[dict] | None,
+) -> dict:
+    """Validate an explicit stacked-base declaration at lock time.
+
+    Returns a dict with ``block`` (fail closed), ``reasons``, ``declared``
+    (whether a stacked base was requested), and ``approved`` (the metadata to
+    persist on the lock when valid, else ``None``).
+    """
+    branch = (stacked_base_branch or "").strip()
+    if not branch:
+        # No stacked base requested — normal master-based lock path.
+        return {"block": False, "reasons": [], "approved": None, "declared": False}
+
+    if branch in BASE_BRANCHES:
+        return {
+            "block": True,
+            "declared": True,
+            "approved": None,
+            "reasons": [
+                f"stacked base '{branch}' is already a normal base branch; do not "
+                "declare a base branch as a stacked base"
+            ],
+        }
+
+    if stacked_base_pr is None:
+        return {
+            "block": True,
+            "declared": True,
+            "approved": None,
+            "reasons": [
+                "stacked base branch declared without stacked_base_pr; a stacked PR "
+                "must cite the open PR that owns the base branch"
+            ],
+        }
+
+    pr = find_open_pr_for_branch(open_prs, branch)
+    if pr is None:
+        return {
+            "block": True,
+            "declared": True,
+            "approved": None,
+            "reasons": [
+                f"stacked base branch '{branch}' does not correspond to any OPEN pull "
+                "request; arbitrary or stale branches are not allowed as stacked bases"
+            ],
+        }
+
+    if int(pr.get("number")) != int(stacked_base_pr):
+        return {
+            "block": True,
+            "declared": True,
+            "approved": None,
+            "reasons": [
+                f"declared stacked_base_pr #{stacked_base_pr} does not match the open "
+                f"PR #{pr.get('number')} that owns base branch '{branch}'"
+            ],
+        }
+
+    return {
+        "block": False,
+        "declared": True,
+        "reasons": [],
+        "approved": {
+            "branch": branch,
+            "pr_number": int(pr.get("number")),
+            "verified_open": True,
+        },
+    }
+
+
+def assess_stacked_pr_body(
+    body: str | None, *, base_branch: str | None, pr_number: int | None
+) -> list[str]:
+    """Return the list of missing stacked-PR documentation fields (empty = ok)."""
+    text = body or ""
+    low = text.lower()
+    missing: list[str] = []
+    if base_branch and base_branch not in text:
+        missing.append(f"base branch '{base_branch}'")
+    if pr_number is not None and f"#{pr_number}" not in text:
+        missing.append(f"stacked-on PR reference '#{pr_number}'")
+    if not any(phrase in low for phrase in MERGE_ORDER_PHRASES):
+        missing.append("merge-ordering statement (e.g. 'Do not merge before PR #<n>')")
+    return missing
+
+
+def assess_create_pr_base(
+    *,
+    base: str | None,
+    approved_stacked_base: dict | None,
+    body: str | None,
+    open_prs: list[dict] | None,
+    base_branches: frozenset[str] | None = None,
+) -> dict:
+    """Validate the PR base at create time.
+
+    Normal base branches pass through unchanged (``stacked`` False). A non-base
+    branch is allowed only when it matches the lock's approved stacked base, that
+    base still has an open PR, and the body documents the stack.
+    """
+    bases = base_branches or BASE_BRANCHES
+    base = (base or "").strip()
+    if base in bases:
+        return {"block": False, "reasons": [], "stacked": False}
+
+    approved = approved_stacked_base or {}
+    approved_branch = (approved.get("branch") or "").strip()
+    if not approved_branch:
+        return {
+            "block": True,
+            "stacked": True,
+            "reasons": [
+                f"PR base '{base}' is not one of {'/'.join(sorted(bases))} and the "
+                "issue lock has no approved stacked base; re-lock with an explicit, "
+                "proof-backed stacked base to open a stacked PR"
+            ],
+        }
+
+    if base != approved_branch:
+        return {
+            "block": True,
+            "stacked": True,
+            "reasons": [
+                f"PR base '{base}' does not match the issue lock's approved stacked "
+                f"base '{approved_branch}'"
+            ],
+        }
+
+    pr = find_open_pr_for_branch(open_prs, base)
+    if pr is None:
+        return {
+            "block": True,
+            "stacked": True,
+            "reasons": [
+                f"approved stacked base '{base}' no longer corresponds to an OPEN pull "
+                "request (dependency merged, closed, or stale); retarget/rebase onto "
+                "master or re-lock against a live base"
+            ],
+        }
+
+    pr_number = approved.get("pr_number") or pr.get("number")
+    missing = assess_stacked_pr_body(body, base_branch=base, pr_number=pr_number)
+    if missing:
+        return {
+            "block": True,
+            "stacked": True,
+            "reasons": [
+                "stacked PR body must document the stack; missing: "
+                + ", ".join(missing)
+            ],
+        }
+
+    return {"block": False, "reasons": [], "stacked": True, "stacked_base_pr": pr_number}

subagent_gate.py

@@ -0,0 +1,166 @@
+"""Fail-closed subagent delegation gates (#266).
+
+Subagents can bypass or lose context for worktree, capability, mutation,
+retry, and reporting rules. These helpers make delegation an explicit,
+provable decision instead of a default: deterministic write tasks stay
+inline unless the parent session records why a subagent is needed and
+hands the subagent the full gate context it must operate under.
+
+Like ``author_proofs``/``review_proofs``, the helpers are pure (no git,
+no API calls): the parent workflow gathers the facts and passes them in,
+so the same logic works from prompts, harness assertions, and tests.
+Nothing here weakens the review/merge/permission gates — a delegated
+subagent is subject to the same gates as its parent.
+"""
+
+# AC1: deterministic write workflows a subagent must never run by default.
+DETERMINISTIC_WRITE_TASKS = frozenset({
+    "claim_issue",
+    "create_branch",
+    "edit_code",
+    "commit",
+    "push_branch",
+    "create_pr",
+    "review_pr",
+    "merge_pr",
+    "cleanup_branch",
+    "close_issue",
+})
+
+# Read-only delegation that needs no explicit authorization.
+READ_ONLY_TASKS = frozenset({
+    "read_files",
+    "code_search",
+    "inventory_prs",
+    "summarize_issue",
+    "explore_codebase",
+})
+
+# AC3: context a subagent must inherit from the parent session before any
+# authorized write delegation may proceed.
+REQUIRED_INHERITED_CONTEXT = (
+    "issue_lock",
+    "branch",
+    "worktree_path",
+    "identity_profile",
+    "allowed_tool_class",
+    "command_deny_list",
+    "validation_ledger_requirement",
+    "final_report_schema",
+)
+
+# AC4: proof fields a subagent final report must carry — the same fields a
+# parent workflow's final report requires.
+REQUIRED_SUBAGENT_REPORT_FIELDS = (
+    "identity_profile",
+    "worktree_path",
+    "branch",
+    "changed_files",
+    "validation_results",
+    "workspace_mutations",
+)
+
+
+def _clean(value):
+    return (value or "").strip() if isinstance(value, str) else value
+
+
+def _classify_task(task_type):
+    task = _clean(task_type)
+    if not task:
+        return "", "unknown"
+    if task in DETERMINISTIC_WRITE_TASKS:
+        return task, "deterministic_write"
+    if task in READ_ONLY_TASKS:
+        return task, "read_only"
+    return task, "unknown"
+
+
+def _missing_context_fields(inherited_context):
+    context = inherited_context or {}
+    missing = []
+    for field in REQUIRED_INHERITED_CONTEXT:
+        value = context.get(field)
+        if not isinstance(value, str) or not value.strip():
+            missing.append(field)
+    return missing
+
+
+def assess_subagent_delegation(task_type, *, explicitly_allowed=False,
+                               justification=None, inherited_context=None):
+    """Decide whether delegating *task_type* to a subagent may proceed.
+
+    Fail closed: unknown tasks are blocked; deterministic write tasks are
+    blocked unless explicitly allowed (AC1) with a recorded justification
+    (AC2) and the full inherited gate context (AC3). Read-only delegation
+    is allowed without explicit authorization.
+
+    Returns {'block', 'allowed', 'task_type', 'task_class', 'reasons',
+    'missing_context'}.
+    """
+    task, task_class = _classify_task(task_type)
+    reasons = []
+    missing_context = []
+
+    if task_class == "unknown":
+        reasons.append(
+            f"task type '{task}' is not a recognized delegation class; "
+            "run it inline in the parent session (fail closed)"
+        )
+    elif task_class == "deterministic_write":
+        if not explicitly_allowed:
+            reasons.append(
+                f"deterministic write task '{task}' must run inline unless "
+                "subagent use is explicitly allowed by the parent session"
+            )
+        if not _clean(justification):
+            reasons.append(
+                "no recorded justification for why a subagent is needed; "
+                "the parent session must record one before delegating"
+            )
+        missing_context = _missing_context_fields(inherited_context)
+        if missing_context:
+            reasons.append(
+                "subagent would not inherit required gate context: "
+                + ", ".join(missing_context)
+            )
+
+    block = bool(reasons)
+    return {
+        "block": block,
+        "allowed": not block,
+        "task_type": task,
+        "task_class": task_class,
+        "reasons": reasons,
+        "missing_context": missing_context,
+    }
+
+
+def validate_subagent_report(report_fields):
+    """AC4: accept subagent output only with the parent-grade proof fields.
+
+    *report_fields* maps field name -> reported value. Missing or blank
+    proof fields make the report invalid (fail closed).
+
+    Returns {'valid', 'block', 'reasons', 'missing_fields'}.
+    """
+    reasons = []
+    report = report_fields or {}
+    missing = []
+    for field in REQUIRED_SUBAGENT_REPORT_FIELDS:
+        value = report.get(field)
+        if not isinstance(value, str) or not value.strip():
+            missing.append(field)
+    if missing:
+        reasons.append(
+            "subagent final report missing required proof fields: "
+            + ", ".join(missing)
+        )
+
+    valid = not reasons
+    return {
+        "valid": valid,
+        "block": not valid,
+        "reasons": reasons,
+        "missing_fields": missing,
+    }

task_capability_map.py

@@ -0,0 +1,180 @@
+"""Shared task→permission map for resolver and tool gates (#69).
+
+``gitea_resolve_task_capability`` and issue-mutating MCP tools must agree on
+which profile operation each task requires. This module is the single source
+of truth; regression tests assert tool gates cannot drift from it.
+"""
+
+from __future__ import annotations
+
+TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
+    "create_issue": {
+        "permission": "gitea.issue.create",
+        "role": "author",
+    },
+    "comment_issue": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+    "close_issue": {
+        "permission": "gitea.issue.close",
+        "role": "author",
+    },
+    "claim_issue": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+    "mark_issue": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+    "lock_issue": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+    "set_issue_labels": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+    "create_branch": {
+        "permission": "gitea.branch.create",
+        "role": "author",
+    },
+    "push_branch": {
+        "permission": "gitea.branch.push",
+        "role": "author",
+    },
+    "create_pr": {
+        "permission": "gitea.pr.create",
+        "role": "author",
+    },
+    "comment_pr": {
+        "permission": "gitea.pr.comment",
+        "role": "author",
+    },
+    "close_pr": {
+        "permission": "gitea.pr.close",
+        "role": "author",
+    },
+    "address_pr_change_requests": {
+        "permission": "gitea.branch.push",
+        "role": "author",
+    },
+    "review_pr": {
+        "permission": "gitea.pr.review",
+        "role": "reviewer",
+    },
+    "merge_pr": {
+        "permission": "gitea.pr.merge",
+        "role": "reviewer",
+    },
+    "blind_pr_queue_review": {
+        "permission": "gitea.pr.review",
+        "role": "reviewer",
+    },
+    "pr_queue_cleanup": {
+        "permission": "gitea.pr.review",
+        "role": "reviewer",
+    },
+    "pr-queue-cleanup": {
+        "permission": "gitea.pr.review",
+        "role": "reviewer",
+    },
+    "request_changes_pr": {
+        "permission": "gitea.pr.request_changes",
+        "role": "reviewer",
+    },
+    "approve_pr": {
+        "permission": "gitea.pr.approve",
+        "role": "reviewer",
+    },
+    "delete_branch": {
+        "permission": "gitea.branch.delete",
+        "role": "author",
+    },
+    "commit_files": {
+        "permission": "gitea.repo.commit",
+        "role": "author",
+    },
+    "gitea_commit_files": {
+        "permission": "gitea.repo.commit",
+        "role": "author",
+    },
+    "reconcile_merged_cleanups": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "work_issue": {
+        "permission": "gitea.pr.create",
+        "role": "author",
+    },
+    "work-issue": {
+        "permission": "gitea.pr.create",
+        "role": "author",
+    },
+    "reconcile_landed_pr": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "reconcile-landed-pr": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "reconcile_already_landed_pr": {
+        "permission": "gitea.pr.close",
+        "role": "reconciler",
+    },
+    # #309: dedicated reconciler path for already-landed open PRs. Exact
+    # close capabilities only — never review/approve/request_changes/merge.
+    "reconcile_close_landed_pr": {
+        "permission": "gitea.pr.close",
+        "role": "reconciler",
+    },
+    "reconcile_close_landed_issue": {
+        "permission": "gitea.issue.close",
+        "role": "reconciler",
+    },
+    "post_heartbeat": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+    "reconcile_issue_claims": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "cleanup_stale_claims": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+}
+
+# Issue-mutating MCP tools and their resolver task keys.
+ISSUE_MUTATION_TOOL_TASKS: dict[str, str] = {
+    "gitea_create_issue": "create_issue",
+    "gitea_close_issue": "close_issue",
+    "gitea_create_issue_comment": "comment_issue",
+    "gitea_mark_issue": "mark_issue",
+    "gitea_set_issue_labels": "set_issue_labels",
+    "gitea_commit_files": "commit_files",
+}
+
+
+def required_permission(task: str) -> str:
+    """Return the canonical operation a *task* requires (fail closed)."""
+    try:
+        return TASK_CAPABILITY_MAP[task]["permission"]
+    except KeyError as exc:
+        raise KeyError(f"Unknown task/action: {task!r} (fail closed)") from exc
+
+
+def required_role(task: str) -> str:
+    """Return author/reviewer role kind for *task* (fail closed)."""
+    try:
+        return TASK_CAPABILITY_MAP[task]["role"]
+    except KeyError as exc:
+        raise KeyError(f"Unknown task/action: {task!r} (fail closed)") from exc
+
+
+def tool_required_permission(tool_name: str) -> str:
+    """Return the operation an issue-mutating tool must gate on."""
+    return required_permission(ISSUE_MUTATION_TOOL_TASKS[tool_name])

tests/conftest.py

@@ -25,4 +25,15 @@ def _reset_mutation_authority(monkeypatch):
         return
     monkeypatch.setattr(mcp_server, "_MUTATION_AUTHORITY", None)
     monkeypatch.setattr(mcp_server, "_IDENTITY_CACHE", {})
+    monkeypatch.setattr(mcp_server, "_REVIEW_DECISION_LOCK", None)
+    try:
+        import capability_stop_terminal
+        capability_stop_terminal.clear()
+    except Exception:
+        pass
     yield
+    try:
+        import capability_stop_terminal
+        capability_stop_terminal.clear()
+    except Exception:
+        pass

tests/test_agent_temp_artifacts.py

@@ -0,0 +1,113 @@
+"""Tests for agent temp artifact detection and preflight warnings (#261)."""
+import json
+import os
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent))
+
+import agent_temp_artifacts
+import mcp_server
+
+
+class TestAgentTempArtifactPatterns(unittest.TestCase):
+    def test_detects_root_level_encode_emit_inline(self):
+        porcelain = (
+            "?? _encode_commit_payload.py\n"
+            "?? _emit_payload.py\n"
+            "?? _inline_b64.py\n"
+        )
+        self.assertEqual(
+            agent_temp_artifacts.find_agent_temp_artifacts_from_porcelain(porcelain),
+            ["_emit_payload.py", "_encode_commit_payload.py", "_inline_b64.py"],
+        )
+
+    def test_ignores_nested_and_unrelated_untracked(self):
+        porcelain = (
+            "?? scripts/_encode_x.py\n"
+            "?? README-draft.md\n"
+            " M task_capability_map.py\n"
+        )
+        self.assertEqual(
+            agent_temp_artifacts.find_agent_temp_artifacts_from_porcelain(porcelain),
+            [],
+        )
+
+
+class TestPreflightWarnings(unittest.TestCase):
+    def setUp(self):
+        self._snapshot = (
+            mcp_server._preflight_whoami_called,
+            mcp_server._preflight_capability_called,
+        )
+        mcp_server._preflight_whoami_called = True
+        mcp_server._preflight_capability_called = True
+
+    def tearDown(self):
+        mcp_server._preflight_whoami_called, mcp_server._preflight_capability_called = (
+            self._snapshot
+        )
+
+    @patch(
+        "mcp_server._get_workspace_porcelain",
+        return_value="?? _encode_commit_payload.py\n",
+    )
+    def test_assess_preflight_surfaces_warning_not_block(self, _porcelain):
+        status = mcp_server.assess_preflight_status()
+        self.assertTrue(status["preflight_ready"])
+        self.assertEqual(status["preflight_block_reasons"], [])
+        self.assertEqual(len(status["preflight_warnings"]), 1)
+        self.assertIn("_encode_commit_payload.py", status["preflight_warnings"][0])
+
+
+# Issue-write tools are profile-gated (#69); gitea_lock_issue requires
+# gitea.issue.comment (see task_capability_map), so the gate must be
+# seeded exactly like tests/test_mcp_server.py::TestIssueLocking (#359).
+ISSUE_WRITE_ENV = {
+    "GITEA_ALLOWED_OPERATIONS": (
+        "gitea.issue.create,gitea.issue.close,gitea.issue.comment"
+    ),
+}
+
+
+class TestIssueLockArtifactWarning(unittest.TestCase):
+    def setUp(self):
+        self._lock_dir = tempfile.TemporaryDirectory()
+        env = {**ISSUE_WRITE_ENV, "GITEA_ISSUE_LOCK_DIR": self._lock_dir.name}
+        self._env_patcher = patch.dict(os.environ, env, clear=True)
+        self._env_patcher.start()
+
+    def tearDown(self):
+        self._env_patcher.stop()
+        self._lock_dir.cleanup()
+
+    @patch(
+        "mcp_server.issue_duplicate_context_fetcher",
+        return_value=([], [], {"status": "not_claimed"}),
+    )
+    @patch("mcp_server.api_get_all", return_value=[])
+    @patch("mcp_server._auth", return_value="token x")
+    @patch("mcp_server._resolve", return_value=("h", "o", "r"))
+    @patch("issue_lock_worktree.read_worktree_git_state")
+    def test_lock_success_includes_artifact_warning(self, mock_state, *_mocks):
+        mock_state.return_value = {
+            "current_branch": "master",
+            "porcelain_status": "?? _emit_payload.py\n",
+            "base_equivalent": True,
+            "inspected_git_root": "/scratch/wt",
+            "base_branch": "origin/master",
+        }
+        result = mcp_server.gitea_lock_issue(
+            issue_number=261,
+            branch_name="docs/issue-261-agent-artifact-cleanup",
+            remote="prgs",
+        )
+        self.assertTrue(result["success"])
+        self.assertIn("warnings", result)
+        self.assertIn("_emit_payload.py", result["warnings"][0])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_already_landed_reconcile.py

@@ -0,0 +1,131 @@
+"""Tests for already-landed PR reconciliation gates (#310)."""
+import os
+import sys
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent))
+
+import already_landed_reconcile
+
+
+class TestAssessAlreadyLandedReconciliation(unittest.TestCase):
+    def test_open_pr_already_landed_allows_close(self):
+        with patch(
+            "already_landed_reconcile.is_head_ancestor_of_ref",
+            return_value=True,
+        ):
+            assessment = already_landed_reconcile.assess_already_landed_reconciliation(
+                pr={
+                    "number": 278,
+                    "state": "open",
+                    "title": "Fix thing (Closes #263)",
+                    "body": "",
+                    "head": {"ref": "feat/x", "sha": "abc123"},
+                    "base": {"ref": "master"},
+                },
+                project_root="/tmp/repo",
+                remote="prgs",
+                target_branch="master",
+                target_fetch={
+                    "success": True,
+                    "target_branch": "master",
+                    "target_ref": "prgs/master",
+                    "target_branch_sha": "deadbeef",
+                    "git_fetch_command": "git fetch prgs master",
+                },
+            )
+        self.assertTrue(assessment["close_allowed"])
+        self.assertEqual(
+            assessment["eligibility_class"],
+            already_landed_reconcile.ELIGIBILITY_ALREADY_LANDED,
+        )
+        self.assertEqual(assessment["linked_issue"], 263)
+        self.assertTrue(assessment["ancestor_proof"])
+
+    def test_not_landed_pr_denies_close(self):
+        with patch(
+            "already_landed_reconcile.is_head_ancestor_of_ref",
+            return_value=False,
+        ):
+            assessment = already_landed_reconcile.assess_already_landed_reconciliation(
+                pr={
+                    "number": 99,
+                    "state": "open",
+                    "title": "WIP",
+                    "body": "",
+                    "head": {"ref": "feat/y", "sha": "fff111"},
+                    "base": {"ref": "master"},
+                },
+                project_root="/tmp/repo",
+                remote="prgs",
+                target_branch="master",
+                target_fetch={
+                    "success": True,
+                    "target_branch": "master",
+                    "target_ref": "prgs/master",
+                    "target_branch_sha": "deadbeef",
+                },
+            )
+        self.assertFalse(assessment["close_allowed"])
+        self.assertEqual(
+            assessment["eligibility_class"],
+            already_landed_reconcile.ELIGIBILITY_NOT_LANDED,
+        )
+
+    def test_stale_target_branch_denies_close(self):
+        assessment = already_landed_reconcile.assess_already_landed_reconciliation(
+            pr={
+                "number": 99,
+                "state": "open",
+                "title": "WIP",
+                "body": "",
+                "head": {"ref": "feat/y", "sha": "fff111"},
+                "base": {"ref": "master"},
+            },
+            project_root="/tmp/repo",
+            remote="prgs",
+            target_branch="master",
+            target_fetch={
+                "success": False,
+                "target_branch": "master",
+                "target_ref": "prgs/master",
+                "target_branch_sha": None,
+                "reasons": ["git fetch failed"],
+            },
+        )
+        self.assertFalse(assessment["close_allowed"])
+        self.assertEqual(
+            assessment["eligibility_class"],
+            already_landed_reconcile.ELIGIBILITY_STALE_TARGET,
+        )
+
+    def test_closed_pr_denies_close(self):
+        assessment = already_landed_reconcile.assess_already_landed_reconciliation(
+            pr={
+                "number": 50,
+                "state": "closed",
+                "title": "Done",
+                "body": "",
+                "head": {"ref": "feat/z", "sha": "aaa"},
+                "base": {"ref": "master"},
+            },
+            project_root="/tmp/repo",
+            remote="prgs",
+            target_branch="master",
+            target_fetch={
+                "success": True,
+                "target_branch": "master",
+                "target_ref": "prgs/master",
+                "target_branch_sha": "deadbeef",
+            },
+        )
+        self.assertFalse(assessment["close_allowed"])
+        self.assertEqual(
+            assessment["eligibility_class"],
+            already_landed_reconcile.ELIGIBILITY_PR_NOT_OPEN,
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_already_landed_report_wording.py

@@ -0,0 +1,151 @@
+"""Tests for already-landed final-report wording validator (#298).
+
+An already-landed PR is reconciliation-only, never review/merge
+eligible, and a head SHA may not be called reviewed unless validation
+and diff review actually passed. Final reports and controller handoffs
+must use the reconciliation wording, not the legacy eligible/reviewed
+fields.
+"""
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from review_proofs import assess_already_landed_report_wording  # noqa: E402
+
+
+GOOD_ALREADY_LANDED = (
+    "Controller Handoff\n"
+    "- Oldest open PR requiring action: PR #278\n"
+    "- Eligibility class: ALREADY_LANDED_RECONCILE_REQUIRED\n"
+    "- Candidate head SHA: 2a544b7\n"
+    "- Reviewed head SHA: none\n"
+    "- Review worktree used: false\n"
+)
+
+
+class TestAlreadyLandedWording(unittest.TestCase):
+    def test_correct_reconciliation_wording_passes(self):
+        result = assess_already_landed_report_wording(
+            GOOD_ALREADY_LANDED, already_landed=True
+        )
+        self.assertTrue(result["complete"])
+        self.assertFalse(result["downgraded"])
+        self.assertEqual(result["reasons"], [])
+
+    def test_oldest_eligible_wording_fails(self):
+        report = GOOD_ALREADY_LANDED + "- oldest eligible PR: PR #278\n"
+        result = assess_already_landed_report_wording(
+            report, already_landed=True
+        )
+        self.assertFalse(result["complete"])
+        self.assertTrue(
+            any("oldest eligible pr" in r.lower() for r in result["reasons"])
+        )
+
+    def test_next_eligible_wording_fails(self):
+        report = GOOD_ALREADY_LANDED + "- next eligible PR: PR #278\n"
+        result = assess_already_landed_report_wording(
+            report, already_landed=True
+        )
+        self.assertFalse(result["complete"])
+
+    def test_pinned_reviewed_head_fails(self):
+        report = GOOD_ALREADY_LANDED + "- Pinned reviewed head: 2a544b7\n"
+        result = assess_already_landed_report_wording(
+            report, already_landed=True
+        )
+        self.assertFalse(result["complete"])
+        self.assertTrue(
+            any("pinned reviewed head" in r.lower() for r in result["reasons"])
+        )
+
+    def test_scratch_worktree_field_fails(self):
+        report = GOOD_ALREADY_LANDED + "- Scratch worktree used: False\n"
+        result = assess_already_landed_report_wording(
+            report, already_landed=True
+        )
+        self.assertFalse(result["complete"])
+
+    def test_missing_eligibility_class_fails(self):
+        report = (
+            "Controller Handoff\n"
+            "- Oldest open PR requiring action: PR #278\n"
+            "- Candidate head SHA: 2a544b7\n"
+            "- Reviewed head SHA: none\n"
+            "- Review worktree used: false\n"
+        )
+        result = assess_already_landed_report_wording(
+            report, already_landed=True
+        )
+        self.assertFalse(result["complete"])
+        self.assertTrue(
+            any("eligibility class" in r.lower() for r in result["reasons"])
+        )
+
+    def test_populated_reviewed_head_sha_fails(self):
+        report = GOOD_ALREADY_LANDED.replace(
+            "- Reviewed head SHA: none\n",
+            "- Reviewed head SHA: 2a544b7\n",
+        )
+        result = assess_already_landed_report_wording(
+            report, already_landed=True
+        )
+        self.assertFalse(result["complete"])
+        self.assertTrue(
+            any("reviewed head" in r.lower() for r in result["reasons"])
+        )
+
+
+class TestNonAlreadyLandedReports(unittest.TestCase):
+    def test_normal_reviewed_report_passes(self):
+        report = (
+            "- Selected PR: 281\n"
+            "- Pinned reviewed head: abc1234\n"
+            "- Review decision: approve\n"
+        )
+        result = assess_already_landed_report_wording(
+            report, already_landed=False, review_validated=True
+        )
+        self.assertTrue(result["complete"])
+
+    def test_blocked_infra_report_with_pinned_head_fails(self):
+        report = (
+            "- Selected PR: 281\n"
+            "- Pinned reviewed head: abc1234\n"
+            "- Current status: blocked on infra_stop\n"
+        )
+        result = assess_already_landed_report_wording(
+            report, already_landed=False, review_validated=False
+        )
+        self.assertFalse(result["complete"])
+        self.assertTrue(
+            any("before validation" in r.lower() for r in result["reasons"])
+        )
+
+    def test_validation_failed_report_with_reviewed_sha_fails(self):
+        report = (
+            "- Selected PR: 281\n"
+            "- Reviewed head SHA: abc1234\n"
+            "- Validation: full suite failed\n"
+        )
+        result = assess_already_landed_report_wording(
+            report, already_landed=False, review_validated=False
+        )
+        self.assertFalse(result["complete"])
+
+    def test_validation_failed_report_with_reviewed_none_passes(self):
+        report = (
+            "- Selected PR: 281\n"
+            "- Reviewed head SHA: none\n"
+            "- Validation: full suite failed\n"
+        )
+        result = assess_already_landed_report_wording(
+            report, already_landed=False, review_validated=False
+        )
+        self.assertTrue(result["complete"])
+
+
+if __name__ == "__main__":
+    unittest.main()