fix: isolate review-mutation ledger from host session-state (#590)

Tests that call patch.dict(os.environ, clear=True) dropped
GITEA_MCP_SESSION_STATE_DIR and re-adopted the operator host cache
under ~/.cache/gitea-tools/session-state. A residual terminal
request_changes mutation then tripped the #332 hard-stop before
test_unknown_profile_blocks could assert the empty-profile gate.

- Pin mcp_session_state.default_state_dir / DEFAULT_STATE_DIR to a
  per-test temp dir in conftest (still honors an explicit env override)
- Clear the decision lock at the start of each TestMergePR test
- Add regression coverage for env-clear isolation

Closes #590

controller_closure_baseline_proof.py

@@ -1,63 +0,0 @@
-"""Controller-closure baseline-proof gate (#529, criterion 6).
-
-A controller (or any session) may close a tracking issue with a closure
-report that summarizes validation. When that report calls a non-zero
-test-suite exit an "expected pre-existing failure" (or baseline / known
-failure) it must carry pre-merge proof; otherwise the closure buries an
-unproven regression as an accepted baseline and weakens controller
-confidence in the durable state.
-
-This module fails closed on exactly that case by reusing the pre-merge
-baseline proof verifier (#533). A closure report is allowed when it is
-empty (no validation claim), a clean pass, or a baseline failure proven on
-the PR pre-merge base commit (or a documented known-failure record that
-predates the PR).
-"""
-
-from __future__ import annotations
-
-from typing import Any
-
-from premerge_baseline_proof import CLEAN_PASS, assess_premerge_baseline_proof
-
-
-def assess_controller_closure_baseline_proof(
-    closure_report: str | None,
-) -> dict[str, Any]:
-    """Assess whether an issue-closure report may proceed.
-
-    Returns a dict with ``block``, ``proven``, ``label``, ``reasons``,
-    ``skipped`` and ``safe_next_action``. Only blocks when the closure
-    report claims a non-zero validation exit is an expected
-    pre-existing/baseline failure without valid pre-merge proof.
-    """
-    text = (closure_report or "").strip()
-    if not text:
-        return {
-            "block": False,
-            "proven": True,
-            "label": CLEAN_PASS,
-            "reasons": [],
-            "skipped": True,
-            "safe_next_action": "",
-        }
-
-    result = assess_premerge_baseline_proof(text)
-    block = bool(result.get("block"))
-    return {
-        "block": block,
-        "proven": not block,
-        "label": result.get("label"),
-        "reasons": list(result.get("reasons") or []),
-        "skipped": bool(result.get("skipped", False)),
-        "safe_next_action": (
-            result.get("safe_next_action")
-            or (
-                "provide pre-merge baseline proof (base commit, tested commit, "
-                "command, exit status, failure signature) before closing on an "
-                "expected pre-existing failure"
-            )
-        )
-        if block
-        else "",
-    }

final_report_validator.py

@@ -40,7 +40,6 @@ FINAL_REPORT_TASK_KINDS = frozenset({
     "issue_filing",
     "issue_selection",
     "inventory",
-    "controller_close",
 })
 
 _TASK_KIND_ALIASES = {
@@ -52,9 +51,6 @@ _TASK_KIND_ALIASES = {
     "reconcile_already_landed": "reconcile_already_landed",
     "work-issue": "work_issue",
     "create_issue": "issue_filing",
-    "close_issue": "controller_close",
-    "close-issue": "controller_close",
-    "controller-close": "controller_close",
 }
 
 _HANDOFF_ROLE_BY_TASK = {
@@ -66,7 +62,6 @@ _HANDOFF_ROLE_BY_TASK = {
     "issue_filing": "issue_filing",
     "issue_selection": None,
     "inventory": "inventory",
-    "controller_close": None,
 }
 
 _LEGACY_WORKSPACE_MUTATIONS_RE = re.compile(
@@ -855,27 +850,6 @@ def _rule_reviewer_premerge_baseline_proof(report_text: str) -> list[dict[str, s
     )
 
 
-def _rule_reviewer_post_merge_validation(report_text: str) -> list[dict[str, str]]:
-    """Block active approval on an already-merged/closed PR, and post-merge moot
-    validation claimed without merged-state + merge-commit proof (#529)."""
-    from post_merge_validation import assess_post_merge_validation
-
-    result = assess_post_merge_validation(report_text)
-    if not result.get("block"):
-        return []
-    return _findings_from_reasons(
-        "reviewer.post_merge_validation",
-        result.get("reasons") or [],
-        field="Validation status",
-        severity="block",
-        safe_next_action=result.get("safe_next_action")
-        or (
-            "record post-merge moot validation instead of an active approval; "
-            "cite PR state merged/closed and the merge commit SHA"
-        ),
-    )
-
-
 def _rule_reviewer_validation_status_vocabulary(
     report_text: str,
     *,
@@ -1540,7 +1514,6 @@ _RULES_BY_TASK: dict[str, list[Callable[..., list[dict[str, str]]]]] = {
         _rule_reviewer_linked_issue,
         _rule_reviewer_baseline_on_failure,
         _rule_reviewer_premerge_baseline_proof,
-        _rule_reviewer_post_merge_validation,
         _rule_reviewer_validation_status_vocabulary,
         _rule_reviewer_main_checkout_baseline,
         _rule_reviewer_main_checkout_path,
@@ -1633,13 +1606,6 @@ _RULES_BY_TASK: dict[str, list[Callable[..., list[dict[str, str]]]]] = {
         *_SHARED_CANONICAL_COMMENT_RULES,
         *_SHARED_ISSUE_LOCK_RULES,
     ],
-    # Controller issue closure (#529): a closure report must not bury an
-    # unproven non-zero suite exit as an "expected pre-existing failure".
-    # Kept intentionally narrow so a closure pre-check does not demand the
-    # full reviewer/author handoff schema.
-    "controller_close": [
-        _rule_reviewer_premerge_baseline_proof,
-    ],
 }
 
 

gitea_mcp_server.py

@@ -222,21 +222,6 @@ def _effective_workspace_role() -> str:
     )
 
 
-def _profile_role_kind(profile: dict) -> str:
-    """Resolve a profile's declared role before inferring from permissions."""
-    role = (profile.get("role") or profile.get("role_kind") or "").strip()
-    if role:
-        return role
-    profile_name = (profile.get("profile_name") or "").strip().lower()
-    for candidate in ("reconciler", "merger", "reviewer", "author"):
-        if candidate in profile_name:
-            return candidate
-    return _role_kind(
-        profile.get("allowed_operations") or [],
-        profile.get("forbidden_operations") or [],
-    )
-
-
 def _actual_profile_role() -> str:
     """Resolve the workspace role from the ACTIVE PROFILE alone (#540).
 
@@ -249,7 +234,10 @@ def _actual_profile_role() -> str:
     ``author`` here, so author blocking is preserved.
     """
     profile = get_profile()
-    role = _profile_role_kind(profile)
+    role = _role_kind(
+        profile.get("allowed_operations") or [],
+        profile.get("forbidden_operations") or [],
+    )
     return nwb.normalize_role_kind(
         role,
         profile_name=profile.get("profile_name"),
@@ -6321,7 +6309,6 @@ def gitea_close_issue(
     host: str | None = None,
     org: str | None = None,
     repo: str | None = None,
-    closure_report: str | None = None,
 ) -> dict:
     """Close an issue by setting its state to 'closed'.
 
@@ -6331,9 +6318,6 @@ def gitea_close_issue(
         host: Override the Gitea host.
         org: Override the owner/organization.
         repo: Override the repository name.
-        closure_report: Optional validation/closure summary. When it claims a
-            non-zero test-suite exit is an "expected pre-existing"/baseline
-            failure without pre-merge proof, the close fails closed (#529).
 
     Returns:
         dict with 'success' boolean and 'message'.
@@ -6343,25 +6327,6 @@ def gitea_close_issue(
     if blocked:
         return blocked
     verify_preflight_purity(remote, task="close_issue")
-
-    # #529: block closure that buries an unproven non-zero suite exit as an
-    # "expected pre-existing failure". Skipped when no closure report is given.
-    from controller_closure_baseline_proof import (
-        assess_controller_closure_baseline_proof,
-    )
-    closure_gate = assess_controller_closure_baseline_proof(closure_report)
-    if closure_gate["block"]:
-        return {
-            "success": False,
-            "blocked": True,
-            "message": (
-                f"Issue #{issue_number} close blocked (#529): closure report "
-                "claims an expected pre-existing/baseline failure without "
-                "pre-merge proof."
-            ),
-            "reasons": closure_gate["reasons"],
-            "safe_next_action": closure_gate["safe_next_action"],
-        }
     h, o, r = _resolve(remote, host, org, repo)
     auth = _auth(h)
     url = f"{repo_api_url(h, o, r)}/issues/{issue_number}"
@@ -6609,39 +6574,10 @@ def _try_auto_switch_for_operation(op: str, host: str | None = None) -> bool:
     return False
 
 
-def _git_default_remote_name(root: str) -> str:
-    """First configured git remote name for *root*, defaulting to 'origin'.
-
-    Used to resolve the live remote master target for parity (#610). Best
-    effort: any failure falls back to 'origin' so callers never raise.
-    """
-    try:
-        res = subprocess.run(
-            ["git", "-C", root, "remote"],
-            capture_output=True, text=True, check=False,
-        )
-    except Exception:
-        return "origin"
-    if res.returncode != 0:
-        return "origin"
-    names = [n.strip() for n in (res.stdout or "").splitlines() if n.strip()]
-    return names[0] if names else "origin"
-
-
 def _current_master_parity() -> dict:
-    """Assess this process's code against local and live remote master (#420/#610).
+    """Assess this process's code against the on-disk master HEAD (#420)."""
-
-    Compares the daemon's startup commit, the on-disk checkout HEAD, and the
-    live remote master target. A stale daemon relative to live master fails
-    closed for mutations even when the local checkout HEAD still matches the
-    startup commit. The live-remote read is best effort: an unresolved live
-    head leaves read-only diagnostics unblocked but is never mutation-safe.
-    """
     current_head = master_parity_gate.read_git_head(PROJECT_ROOT)
-    live_head = master_parity_gate.read_remote_master_head(
+    return master_parity_gate.assess_master_parity(_STARTUP_PARITY, current_head)
-        PROJECT_ROOT, remote=_git_default_remote_name(PROJECT_ROOT))
-    return master_parity_gate.assess_master_parity(
-        _STARTUP_PARITY, current_head, live_remote_head=live_head)
 
 
 def _master_parity_block(op: str) -> list[str]:
@@ -7218,62 +7154,6 @@ def gitea_assess_reviewer_pr_lease(
     }
 
 
-@mcp.tool()
-def gitea_diagnose_reviewer_pr_lease_handoff(
-    pr_number: int,
-    proposed_worktree: str | None = None,
-    instructed_session_id: str | None = None,
-    instructed_comment_id: int | None = None,
-    remote: str = "dadeschools",
-    host: str | None = None,
-    org: str | None = None,
-    repo: str | None = None,
-) -> dict:
-    """Read-only: diagnose open-PR reviewer lease handoff and emit next action (#599).
-
-    Classifies no-lease / own / foreign / instructed-lease-missing-with-replacement
-    and worktree binding mismatch. Returns a canonical ``next_action`` without
-    mutating Gitea state. Never steals foreign leases.
-    """
-    read_block = _profile_operation_gate("gitea.read")
-    if read_block:
-        return {
-            "success": False,
-            "reasons": read_block,
-            "permission_report": _permission_block_report("gitea.read"),
-        }
-    comments = _fetch_pr_comments(
-        pr_number, remote=remote, host=host, org=org, repo=repo)
-    h, _o, _r = _resolve(remote, host, org, repo)
-    try:
-        username = _authenticated_username(h)
-    except Exception:
-        username = None
-    session_lease = reviewer_pr_lease.get_session_lease() or {}
-    env_wt = (
-        (os.environ.get("GITEA_REVIEWER_WORKTREE") or "").strip()
-        or (os.environ.get("GITEA_ACTIVE_WORKTREE") or "").strip()
-        or None
-    )
-    # Prefer in-session lease id when present; otherwise diagnose as a fresh
-    # caller without inventing ownership of an on-thread lease.
-    session_id = (session_lease.get("session_id") or "").strip() or None
-    diagnosis = reviewer_pr_lease.diagnose_reviewer_pr_lease_handoff(
-        comments,
-        pr_number=pr_number,
-        current_session_id=session_id,
-        current_reviewer_identity=username,
-        proposed_worktree=proposed_worktree,
-        env_bound_worktree=env_wt,
-        instructed_session_id=instructed_session_id,
-        instructed_comment_id=instructed_comment_id,
-    )
-    diagnosis["success"] = True
-    diagnosis["remote"] = remote
-    diagnosis["authenticated_user"] = username
-    return diagnosis
-
-
 @mcp.tool()
 def gitea_cleanup_post_merge_moot_lease(
     pr_number: int,
@@ -8971,34 +8851,15 @@ def gitea_get_runtime_context(
         "restart_required": parity["restart_required"],
         "startup_head": parity["startup_head"],
         "current_head": parity["current_head"],
-        # #610 distinguished mutation-safety signals:
-        "daemon_start_head": parity["daemon_start_head"],
-        "local_head": parity["local_head"],
-        "live_remote_head": parity["live_remote_head"],
-        "live_known": parity["live_known"],
-        "live_stale": parity["live_stale"],
-        "mutation_safe": parity["mutation_safe"],
         "summary": master_parity_gate.format_parity(parity),
         "mutation_gate_enforced": not master_parity_gate.gate_disabled(),
-        # #610: the capability resolver is authoritative for mutation safety;
-        # local parity alone must never authorize a mutation.
-        "resolver_authoritative_for_mutation_safety": True,
     }
-    if parity["restart_required"] and not master_parity_gate.gate_disabled():
+    if parity["stale"] and not master_parity_gate.gate_disabled():
-        if parity["live_stale"]:
+        safe_next_action = (
-            safe_next_action = (
+            "Server code is stale relative to master; restart the Gitea MCP "
-                "Daemon is stale relative to LIVE remote master "
+            "server to load current capability gates before mutating. "
-                f"(started {parity['startup_head'][:12] if parity['startup_head'] else 'unknown'}, "
+            f"({master_parity_gate.format_parity(parity)})"
-                f"live master {parity['live_remote_head'][:12] if parity['live_remote_head'] else 'unknown'}); "
+        )
-                "restart/reconnect the Gitea MCP server before mutating. The "
-                "capability resolver is authoritative for mutation safety."
-            )
-        else:
-            safe_next_action = (
-                "Server code is stale relative to master; restart the Gitea MCP "
-                "server to load current capability gates before mutating. "
-                f"({master_parity_gate.format_parity(parity)})"
-            )
         result["safe_next_action"] = safe_next_action
 
     if reveal and h:
@@ -9037,19 +8898,12 @@ def gitea_assess_master_parity(
         "determinable": parity["determinable"],
         "startup_head": parity["startup_head"],
         "current_head": parity["current_head"],
-        # #610 distinguished mutation-safety signals:
-        "daemon_start_head": parity["daemon_start_head"],
-        "local_head": parity["local_head"],
-        "live_remote_head": parity["live_remote_head"],
-        "live_known": parity["live_known"],
-        "live_stale": parity["live_stale"],
-        "mutation_safe": parity["mutation_safe"],
         "mutation_gate_enforced": enforced,
         "summary": master_parity_gate.format_parity(parity),
         "reasons": parity["reasons"],
         "process_root": PROJECT_ROOT,
     }
-    if parity["restart_required"] and enforced:
+    if parity["stale"] and enforced:
         out["report"] = master_parity_gate.parity_report(parity)
     return out
 def gitea_record_pre_review_command(
@@ -10345,24 +10199,6 @@ def gitea_resolve_task_capability(
 
     required_permission = task_capability_map.required_permission(task)
     required_role = task_capability_map.required_role(task)
-    role_exclusive_tasks = {
-        "review_pr",
-        "approve_pr",
-        "request_changes_pr",
-        "blind_pr_queue_review",
-        "pr_queue_cleanup",
-        "pr-queue-cleanup",
-        "merge_pr",
-        "create_branch",
-        "push_branch",
-        "create_pr",
-        "commit_files",
-        "gitea_commit_files",
-        "address_pr_change_requests",
-        "delete_branch",
-        "work_issue",
-        "work-issue",
-    }
 
     infra_assessment = role_session_router.assess_infra_stop(PROJECT_ROOT)
     if required_role == "reviewer":
@@ -10457,26 +10293,11 @@ def gitea_resolve_task_capability(
     # Load active permissions
     active_allowed = profile.get("allowed_operations") or []
     active_forbidden = profile.get("forbidden_operations") or []
-    active_role_kind = _profile_role_kind(profile)
 
     # Check if allowed in current session
-    permission_allowed_in_current_session, _ = gitea_config.check_operation(
+    allowed_in_current_session, _ = gitea_config.check_operation(
         required_permission, active_allowed, active_forbidden
     )
-    role_matches_current_session = (
-        task not in role_exclusive_tasks
-        or active_role_kind == required_role
-    )
-    role_mismatch_reason = None
-    if not role_matches_current_session:
-        role_mismatch_reason = (
-            f"Active profile role '{active_role_kind}' cannot perform "
-            f"{required_role} task '{task}' even if nearby permissions are "
-            "present (fail closed)."
-        )
-    allowed_in_current_session = (
-        permission_allowed_in_current_session and role_matches_current_session
-    )
 
     switching = gitea_config.is_runtime_switching_enabled()
     available_in_session = allowed_in_current_session
@@ -10503,13 +10324,7 @@ def gitea_resolve_task_capability(
                 except Exception:
                     pass
             ok, _ = gitea_config.check_operation(required_permission, p_allowed_n, p_forbidden_n)
-            p_role = (p_data.get("role") or "").strip()
+            if ok:
-            p_role_ok = (
-                task not in role_exclusive_tasks
-                or not p_role
-                or p_role == required_role
-            )
-            if ok and p_role_ok:
                 matching_profiles.append(p_name)
 
     configured = len(matching_profiles) > 0
@@ -10537,8 +10352,6 @@ def gitea_resolve_task_capability(
             reason_msg = (
                 f"No profile configured with permission '{required_permission}'."
             )
-        elif role_mismatch_reason:
-            reason_msg = role_mismatch_reason
     different_namespace_required = False
     next_safe_action = "None; ready for operations."
 
@@ -10570,8 +10383,6 @@ def gitea_resolve_task_capability(
     # into author-side mutations.
     stop_required = not allowed_in_current_session
     task_role_guidance = []
-    if role_mismatch_reason:
-        task_role_guidance.append(f"STOP: {role_mismatch_reason}")
     if required_role == "reviewer":
         if allowed_in_current_session:
             task_role_guidance.append(
@@ -10617,9 +10428,7 @@ def gitea_resolve_task_capability(
         "required_role_kind": required_role,
         "active_profile": profile["profile_name"],
         "active_identity": username,
-        "active_role_kind": active_role_kind,
         "active_profile_allowed_operations": active_allowed,
-        "active_profile_permission_allowed": permission_allowed_in_current_session,
         "allowed_in_current_session": allowed_in_current_session,
         "available_in_session": available_in_session,
         "configured": configured,

issue_workflow_labels.py

@@ -42,38 +42,12 @@ STATUS_LABEL_SPECS: tuple[LabelSpec, ...] = (
     LabelSpec("status:wontfix", "000000", "Issue will not be fixed"),
 )
 
-# Durable validation-outcome labels (#529): the four canonical distinctions a
-# reviewer report can carry. These are orthogonal to the single active status:*
-# label, so they use their own prefix and are not subject to the one-status
-# invariant.
-VALIDATION_LABEL_SPECS: tuple[LabelSpec, ...] = (
-    LabelSpec("validation:clean-pass", "0e8a16", "Validation was a clean pass"),
-    LabelSpec(
-        "validation:baseline-accepted",
-        "fbca04",
-        "Validation passed with a baseline-proven unrelated failure",
-    ),
-    LabelSpec(
-        "validation:blocked",
-        "b60205",
-        "Validation blocked by an unresolved failure",
-    ),
-    LabelSpec(
-        "validation:post-merge-moot",
-        "5319e7",
-        "Validation is post-merge moot (PR already merged/closed before review)",
-    ),
-)
-
 CANONICAL_LABEL_SPECS: tuple[LabelSpec, ...] = (
-    TYPE_LABEL_SPECS + STATUS_LABEL_SPECS + VALIDATION_LABEL_SPECS
+    TYPE_LABEL_SPECS + STATUS_LABEL_SPECS
 )
 
 TYPE_LABELS: frozenset[str] = frozenset(spec.name for spec in TYPE_LABEL_SPECS)
 STATUS_LABELS: frozenset[str] = frozenset(spec.name for spec in STATUS_LABEL_SPECS)
-VALIDATION_LABELS: frozenset[str] = frozenset(
-    spec.name for spec in VALIDATION_LABEL_SPECS
-)
 CANONICAL_LABELS: frozenset[str] = frozenset(
     spec.name for spec in CANONICAL_LABEL_SPECS
 )

master_parity_gate.py

@@ -24,26 +24,12 @@ from __future__ import annotations
 
 import os
 import subprocess
-import time
-
-# Live-remote head cache: the parity gate runs on every mutation and every
-# runtime-context read, so the ``git ls-remote`` result is cached briefly to
-# avoid a network round-trip per call (#610). Keyed by (root, remote, branch).
-_REMOTE_HEAD_CACHE: dict[tuple[str, str, str], tuple[float, str | None]] = {}
-_REMOTE_HEAD_TTL = 60.0
-
-
-def _clear_remote_head_cache() -> None:
-    """Reset the live-remote head cache (test isolation / forced refresh)."""
-    _REMOTE_HEAD_CACHE.clear()
 
 # Environment escape hatches (ops + tests):
 #   GITEA_MCP_DISABLE_PARITY_GATE  -> disable enforcement entirely (fail open).
 #   GITEA_TEST_CURRENT_HEAD        -> force the "current" HEAD read, for tests.
 ENV_DISABLE = "GITEA_MCP_DISABLE_PARITY_GATE"
 ENV_TEST_CURRENT_HEAD = "GITEA_TEST_CURRENT_HEAD"
-# GITEA_TEST_LIVE_REMOTE_HEAD -> force the live remote master read, for tests.
-ENV_TEST_LIVE_REMOTE_HEAD = "GITEA_TEST_LIVE_REMOTE_HEAD"
 
 
 def read_git_head(root: str) -> str | None:
@@ -72,57 +58,6 @@ def read_git_head(root: str) -> str | None:
     return (res.stdout or "").strip() or None
 
 
-def read_remote_master_head(
-    root: str,
-    remote: str = "origin",
-    branch: str = "master",
-    ttl: float = _REMOTE_HEAD_TTL,
-) -> str | None:
-    """Return the live remote ``branch`` commit SHA, or ``None`` (#610).
-
-    Resolves the *live* target commit via ``git ls-remote`` so parity can tell
-    a daemon that is behind the live remote master apart from one whose local
-    checkout simply hasn't been pulled. ``None`` means the live head could not
-    be resolved (offline, no such remote, git unavailable, error) -- callers
-    must treat unknown live state as *not mutation-safe* while never blocking
-    read-only diagnostics. A ``GITEA_TEST_LIVE_REMOTE_HEAD`` override takes
-    precedence so the wiring can be exercised deterministically and offline.
-
-    The result is cached for *ttl* seconds per (root, remote, branch) so the
-    gate does not run a network probe on every mutation/read (``ttl=0`` forces
-    a live probe). Both hits and ``None`` misses are cached to bound offline
-    latency; the env override bypasses the cache and the subprocess entirely.
-    """
-    forced = os.environ.get(ENV_TEST_LIVE_REMOTE_HEAD)
-    if forced is not None:
-        return forced.strip() or None
-    if not root:
-        return None
-    key = (root, remote, branch)
-    now = time.monotonic()
-    if ttl > 0:
-        cached = _REMOTE_HEAD_CACHE.get(key)
-        if cached is not None and (now - cached[0]) < ttl:
-            return cached[1]
-    sha: str | None = None
-    try:
-        res = subprocess.run(
-            ["git", "-C", root, "ls-remote", remote, f"refs/heads/{branch}"],
-            capture_output=True,
-            text=True,
-            check=False,
-            timeout=5,
-        )
-        if res.returncode == 0:
-            lines = (res.stdout or "").strip().splitlines()
-            if lines:
-                sha = lines[0].split("\t", 1)[0].split()[0].strip() or None
-    except Exception:
-        sha = None
-    _REMOTE_HEAD_CACHE[key] = (now, sha)
-    return sha
-
-
 def capture_startup_parity(root: str, head: str | None = None) -> dict:
     """Capture the process source-tree baseline once at server startup.
 
@@ -137,38 +72,18 @@ def _short(sha: str | None) -> str:
     return sha[:12] if sha else "unknown"
 
 
-def assess_master_parity(
+def assess_master_parity(startup: dict | None, current_head: str | None) -> dict:
-    startup: dict | None,
-    current_head: str | None,
-    live_remote_head: str | None = None,
-) -> dict:
     """Compare the startup baseline against the current on-disk ``HEAD``.
 
-    Pure: all HEADs are supplied by the caller. Returns a structured result:
+    Pure: both HEADs are supplied by the caller. Returns a structured result:
 
     - ``in_parity``    -- server code matches the on-disk master (or parity
       could not be determined, which is not treated as stale).
     - ``stale``        -- the on-disk master has definitively advanced past the
       running process.
-    - ``restart_required`` -- ``stale`` or ``live_stale``; the recovery action.
+    - ``restart_required`` -- alias of ``stale``; the recovery action.
-    - ``determinable`` -- whether both local HEADs were known well enough to
+    - ``determinable`` -- whether both HEADs were known well enough to compare.
-      compare.
     - ``startup_head`` / ``current_head`` / ``reasons``.
-
-    #610 adds live-remote awareness so a daemon that is stale relative to the
-    *live* remote master cannot report a mutation-safe result even when the
-    local checkout HEAD still matches the daemon's startup commit:
-
-    - ``daemon_start_head`` -- the commit the running process started at
-      (alias of ``startup_head``, named for clarity in reports).
-    - ``local_head`` -- the on-disk checkout HEAD (alias of ``current_head``).
-    - ``live_remote_head`` -- the live remote target commit, or ``None`` when it
-      could not be fetched.
-    - ``live_known`` -- whether the live remote target was resolved.
-    - ``live_stale`` -- the live remote master has advanced past the running
-      process (daemon is behind live master) even if local parity is green.
-    - ``mutation_safe`` -- the daemon code, local checkout, and live remote
-      target all agree; the only state in which a mutation may rely on parity.
     """
     startup_head = (startup or {}).get("startup_head")
     reasons: list[str] = []
@@ -176,56 +91,32 @@ def assess_master_parity(
     if startup_head is None:
         reasons.append(
             "startup commit was not captured; code parity cannot be enforced")
-        return _result(True, False, False, startup_head, current_head,
+        return _result(True, False, False, startup_head, current_head, reasons)
-                       live_remote_head, False, reasons)
 
     if current_head is None:
         reasons.append(
             "current workspace HEAD could not be read; code parity cannot be "
             "enforced")
-        return _result(True, False, False, startup_head, current_head,
+        return _result(True, False, False, startup_head, current_head, reasons)
-                       live_remote_head, False, reasons)
 
-    local_in_parity = startup_head == current_head
+    if startup_head == current_head:
-    local_stale = not local_in_parity
+        return _result(True, False, True, startup_head, current_head, reasons)
-    if local_stale:
-        reasons.append(
-            f"MCP server started at commit {_short(startup_head)} but the "
-            f"workspace master is now {_short(current_head)}; restart the "
-            f"server to load the current capability gates")
 
-    live_known = live_remote_head is not None
+    reasons.append(
-    live_stale = live_known and live_remote_head != startup_head
+        f"MCP server started at commit {_short(startup_head)} but the workspace "
-    if live_stale:
+        f"master is now {_short(current_head)}; restart the server to load the "
-        reasons.append(
+        f"current capability gates")
-            f"live remote master is {_short(live_remote_head)} but the MCP "
+    return _result(False, True, True, startup_head, current_head, reasons)
-            f"server started at {_short(startup_head)}; the daemon is stale "
-            f"relative to live master -- restart/reconnect before mutating")
-
-    return _result(
-        local_in_parity, local_stale, True, startup_head, current_head,
-        live_remote_head, live_stale, reasons)
 
 
-def _result(in_parity, stale, determinable, startup_head, current_head,
+def _result(in_parity, stale, determinable, startup_head, current_head, reasons):
-            live_remote_head, live_stale, reasons):
-    live_known = live_remote_head is not None
-    mutation_safe = (
-        determinable and in_parity and live_known and not live_stale)
     return {
         "in_parity": in_parity,
         "stale": stale,
-        "restart_required": stale or live_stale,
+        "restart_required": stale,
         "determinable": determinable,
         "startup_head": startup_head,
         "current_head": current_head,
-        # #610 distinguished signals:
-        "daemon_start_head": startup_head,
-        "local_head": current_head,
-        "live_remote_head": live_remote_head,
-        "live_known": live_known,
-        "live_stale": live_stale,
-        "mutation_safe": mutation_safe,
         "reasons": list(reasons),
     }
 
@@ -239,13 +130,11 @@ def parity_block_reasons(assessment: dict) -> list[str]:
     """Block reasons for a mutation gate (empty when the mutation may proceed).
 
     A disabled gate or an in-parity / non-determinable assessment yields no
-    reasons. A definitively stale server blocks, and (#610) a daemon that is
+    reasons; only a definitively stale server blocks.
-    stale relative to the *live* remote master blocks even when the local
-    checkout HEAD still matches the daemon's startup commit.
     """
     if gate_disabled():
         return []
-    if assessment.get("stale") or assessment.get("live_stale"):
+    if assessment.get("stale"):
         return list(assessment.get("reasons") or
                     ["server code is stale relative to master (fail closed)"])
     return []
@@ -258,10 +147,6 @@ def parity_report(assessment: dict) -> dict:
         "restart_required": True,
         "startup_head": assessment.get("startup_head"),
         "current_head": assessment.get("current_head"),
-        # #610: name the live remote target so the report distinguishes a
-        # local-code stale from a daemon-behind-live-master stale.
-        "live_remote_head": assessment.get("live_remote_head"),
-        "live_stale": bool(assessment.get("live_stale")),
         "reasons": list(assessment.get("reasons") or []),
         "recovery": [
             "The running MCP server is executing code older than the current "
@@ -272,45 +157,6 @@ def parity_report(assessment: dict) -> dict:
     }
 
 
-def parity_resolver_disagreement(
-    assessment: dict,
-    resolver_restart_required: bool,
-) -> dict | None:
-    """Typed blocker when the resolver requires restart but parity looks green.
-
-    The capability resolver (``gitea_resolve_task_capability``) detects stale
-    runtime authoritatively for mutation safety (#610). When it requires a
-    restart, local-only parity must never override it: this returns a typed,
-    fail-closed blocker that names the resolver as authoritative. Returns
-    ``None`` when the resolver does not require a restart.
-    """
-    if not resolver_restart_required:
-        return None
-    parity_optimistic = bool(assessment.get("in_parity")) and not (
-        assessment.get("stale") or assessment.get("live_stale"))
-    return {
-        "kind": "parity_resolver_disagreement",
-        "restart_required": True,
-        "resolver_authoritative": True,
-        "parity_optimistic": parity_optimistic,
-        "daemon_start_head": assessment.get("daemon_start_head"),
-        "local_head": assessment.get("local_head"),
-        "live_remote_head": assessment.get("live_remote_head"),
-        "reasons": [
-            "The capability resolver requires a restart/reconnect (stale "
-            "runtime) but master-parity reported local code as in-parity. "
-            "The resolver is authoritative for mutation safety; do not mutate "
-            "on local parity alone. Restart/reconnect the Gitea MCP server "
-            "and re-verify before mutating.",
-        ],
-        "recovery": [
-            "Trust the resolver: treat this session as stale.",
-            "Restart or /mcp reconnect the Gitea MCP namespace so it reloads "
-            "current master and live target state, then re-run preflight.",
-        ],
-    }
-
-
 def format_parity(assessment: dict) -> str:
     """One-line human summary for logs / runtime context."""
     if assessment.get("stale"):

post_merge_validation.py

@@ -1,222 +0,0 @@
-"""Canonical post-merge (moot) validation outcome and wording gate (#529).
-
-When a PR is already merged or closed *before* a reviewer submits their
-verdict, an ordinary "approve" is misleading: the review never gated the
-merge, so a normal active approval overstates controller confidence. The
-sanctioned outcome for that case is a **post-merge moot validation** — the
-reviewer records what validation found, but classifies it as moot rather than
-an active approval.
-
-This module defines the four canonical validation distinctions #529 requires
-and enforces the post-merge case:
-
-- ``CLEAN_PASS_OUTCOME`` — clean validation pass on an open, reviewable PR.
-- ``BASELINE_ACCEPTED_OUTCOME`` — validation pass with a baseline-proven
-  unrelated failure (proof handled by :mod:`premerge_baseline_proof`).
-- ``BLOCKED_OUTCOME`` — validation blocked by an unresolved failure.
-- ``POST_MERGE_MOOT_OUTCOME`` — the PR was already merged/closed before review
-  submission; validation is recorded as post-merge moot, not an active
-  approval.
-
-The gate blocks two mistakes:
-
-1. Claiming an *active approval* on a PR that was already merged/closed before
-   review submission (must be recorded as post-merge moot validation instead).
-2. Claiming post-merge moot validation without proof the PR is actually
-   merged/closed (a merged-state field plus a merge commit SHA).
-
-Each outcome maps to a durable ``validation:*`` process-state label so PRs and
-issues carry the distinction (#529 acceptance criterion).
-"""
-
-from __future__ import annotations
-
-import re
-from typing import Any
-
-CLEAN_PASS_OUTCOME = "clean validation pass"
-BASELINE_ACCEPTED_OUTCOME = "validation pass with baseline-proven unrelated failure"
-BLOCKED_OUTCOME = "validation blocked by unresolved failure"
-POST_MERGE_MOOT_OUTCOME = "post-merge moot validation"
-
-# Canonical validation status label a reviewer writes in the report body for the
-# post-merge case; kept in sync with validation_status_vocabulary.
-POST_MERGE_MOOT_STATUS = "post-merge moot validation"
-
-# Durable process-state labels (registered in issue_workflow_labels).
-LABEL_CLEAN_PASS = "validation:clean-pass"
-LABEL_BASELINE_ACCEPTED = "validation:baseline-accepted"
-LABEL_BLOCKED = "validation:blocked"
-LABEL_POST_MERGE_MOOT = "validation:post-merge-moot"
-
-_OUTCOME_TO_LABEL: dict[str, str] = {
-    CLEAN_PASS_OUTCOME: LABEL_CLEAN_PASS,
-    BASELINE_ACCEPTED_OUTCOME: LABEL_BASELINE_ACCEPTED,
-    BLOCKED_OUTCOME: LABEL_BLOCKED,
-    POST_MERGE_MOOT_OUTCOME: LABEL_POST_MERGE_MOOT,
-}
-
-# The PR was already merged/closed before the review was submitted.
-_MERGED_BEFORE_REVIEW_RE = re.compile(
-    r"(?:already[- ]merged"
-    r"|merged\s+before\s+review"
-    r"|closed\s+before\s+review"
-    r"|pr\s+(?:is|was)\s+(?:already\s+)?(?:merged|closed)"
-    r"|pr\s+state\s*[:=]\s*(?:merged|closed)"
-    r"|merged\s*/\s*closed)",
-    re.IGNORECASE,
-)
-# An active approval verdict is being claimed.
-_ACTIVE_APPROVAL_RE = re.compile(
-    r"(?:review\s+decision\s*[:=]\s*approve"
-    r"|submitted\s+['\"]?approve['\"]?"
-    r"|active\s+approval"
-    r"|approving\s+the\s+pr"
-    r"|posting\s+an?\s+approval)",
-    re.IGNORECASE,
-)
-# The sanctioned post-merge moot validation wording.
-_POST_MERGE_MOOT_RE = re.compile(
-    r"post[- ]merge\s+(?:moot\s+)?validation"
-    r"|post[- ]merge\s+moot"
-    r"|moot\s+validation",
-    re.IGNORECASE,
-)
-# Proof the PR is genuinely merged/closed.
-_MERGED_STATE_PROOF_RE = re.compile(
-    r"(?:pr\s+state\s*[:=]\s*(?:merged|closed)"
-    r"|merged_at\s*[:=]\s*\S"
-    r"|closed_at\s*[:=]\s*\S"
-    r"|state\s*[:=]\s*(?:merged|closed))",
-    re.IGNORECASE,
-)
-_MERGE_COMMIT_SHA_RE = re.compile(
-    r"merge\s+commit(?:\s+sha)?\s*[:=]\s*[0-9a-f]{7,40}",
-    re.IGNORECASE,
-)
-
-
-POST_MERGE_VALIDATION_TEMPLATE = (
-    "Validation status: post-merge moot validation\n"
-    "PR state: merged\n"
-    "Merge commit sha: <40-hex merge commit>\n"
-    "Validation finding: <what the validation run showed, for the record>\n"
-    "Note: PR merged/closed before review submission; recorded as post-merge "
-    "moot validation, not an active approval."
-)
-
-
-def process_state_label(outcome: str) -> str | None:
-    """Return the durable ``validation:*`` label for a canonical outcome."""
-    return _OUTCOME_TO_LABEL.get(outcome)
-
-
-def assess_post_merge_validation(
-    report_text: str,
-    *,
-    pr_merged_or_closed: bool | None = None,
-) -> dict[str, Any]:
-    """Assess post-merge moot validation wording and proof (#529).
-
-    Args:
-        report_text: The reviewer final report text.
-        pr_merged_or_closed: Optional structured signal that the PR is already
-            merged/closed. When ``True`` it forces the merged-before-review
-            path even if the report text omits the phrasing; proof fields are
-            still required in the report body for durability.
-
-    Returns a dict with ``proven``, ``block``, ``outcome``,
-    ``process_state_label``, ``reasons``, ``skipped`` and ``safe_next_action``.
-    Only blocks when the report either claims an active approval on a
-    merged/closed PR, or claims post-merge moot validation without proof.
-    """
-    text = report_text or ""
-
-    merged_signal = bool(_MERGED_BEFORE_REVIEW_RE.search(text)) or bool(
-        pr_merged_or_closed
-    )
-    active_approval = bool(_ACTIVE_APPROVAL_RE.search(text))
-    moot_wording = bool(_POST_MERGE_MOOT_RE.search(text))
-
-    # Nothing about merged-state or moot validation — not applicable here.
-    if not merged_signal and not moot_wording:
-        return {
-            "proven": True,
-            "block": False,
-            "outcome": None,
-            "process_state_label": None,
-            "reasons": [],
-            "skipped": True,
-            "safe_next_action": "",
-        }
-
-    # An active approval on a PR already merged/closed before review, without
-    # the sanctioned moot wording, overstates confidence.
-    if merged_signal and active_approval and not moot_wording:
-        return {
-            "proven": False,
-            "block": True,
-            "outcome": POST_MERGE_MOOT_OUTCOME,
-            "process_state_label": LABEL_POST_MERGE_MOOT,
-            "reasons": [
-                "PR was already merged/closed before review submission; an "
-                "active approval overstates confidence — record 'post-merge "
-                "moot validation' instead of a normal approval"
-            ],
-            "skipped": False,
-            "safe_next_action": (
-                "classify the outcome as post-merge moot validation (not an "
-                "active approval); cite PR state merged/closed and the merge "
-                "commit SHA. Template:\n" + POST_MERGE_VALIDATION_TEMPLATE
-            ),
-        }
-
-    # Post-merge moot validation claimed — require merged-state + commit proof.
-    if moot_wording:
-        reasons: list[str] = []
-        if not _MERGED_STATE_PROOF_RE.search(text):
-            reasons.append(
-                "post-merge moot validation claimed without merged/closed state "
-                "proof (state: merged/closed, or merged_at/closed_at)"
-            )
-        if not _MERGE_COMMIT_SHA_RE.search(text):
-            reasons.append(
-                "post-merge moot validation claimed without a merge commit SHA"
-            )
-        if reasons:
-            return {
-                "proven": False,
-                "block": True,
-                "outcome": POST_MERGE_MOOT_OUTCOME,
-                "process_state_label": LABEL_POST_MERGE_MOOT,
-                "reasons": reasons,
-                "skipped": False,
-                "safe_next_action": (
-                    "prove the PR is merged/closed: cite PR state and the merge "
-                    "commit SHA. Template:\n" + POST_MERGE_VALIDATION_TEMPLATE
-                ),
-            }
-        return {
-            "proven": True,
-            "block": False,
-            "outcome": POST_MERGE_MOOT_OUTCOME,
-            "process_state_label": LABEL_POST_MERGE_MOOT,
-            "reasons": [],
-            "skipped": False,
-            "safe_next_action": "",
-        }
-
-    # Merged signal present but no approval claim and no moot wording yet —
-    # guide toward the moot outcome without blocking.
-    return {
-        "proven": True,
-        "block": False,
-        "outcome": POST_MERGE_MOOT_OUTCOME,
-        "process_state_label": LABEL_POST_MERGE_MOOT,
-        "reasons": [],
-        "skipped": False,
-        "safe_next_action": (
-            "PR appears merged/closed; if submitting a verdict, record "
-            "post-merge moot validation rather than an active approval"
-        ),
-    }

reviewer_pr_lease.py

@@ -522,241 +522,4 @@ def assess_lease_inventory(
         "active_review_leases": active,
         "stale_review_leases": stale,
         "reclaimable_review_leases": reclaimable,
-    }
+    }
-
-# Canonical next-action vocabulary for reviewer lease handoff (#599).
-NEXT_ACTION_ACQUIRE = "acquire"
-NEXT_ACTION_WAIT = "wait"
-NEXT_ACTION_RESUME_EXACT_OWNER_SESSION = "resume_exact_owner_session"
-NEXT_ACTION_RELEASE_EXPIRED_LEASE = "release_expired_lease"
-NEXT_ACTION_OPERATOR_AUTHORIZED_CLEANUP = "operator_authorized_cleanup"
-NEXT_ACTION_REPAIR_WORKTREE_BINDING = "repair_worktree_binding"
-
-_HANDOFF_CLASSIFICATIONS = frozenset({
-    "no_lease",
-    "own_active",
-    "own_expired",
-    "foreign_active",
-    "foreign_reclaimable",
-    "foreign_expired",
-    "instructed_lease_missing_with_replacement",
-    "worktree_binding_mismatch",
-})
-
-
-def _norm_path(value: str | None) -> str:
-    text = (value or "").strip()
-    if not text:
-        return ""
-    return os.path.normpath(text.rstrip("/"))
-
-
-def diagnose_reviewer_pr_lease_handoff(
-    comments: list[dict],
-    *,
-    pr_number: int,
-    current_session_id: str | None,
-    current_reviewer_identity: str | None,
-    proposed_worktree: str | None = None,
-    env_bound_worktree: str | None = None,
-    instructed_session_id: str | None = None,
-    instructed_comment_id: int | None = None,
-    now: datetime | None = None,
-) -> dict[str, Any]:
-    """Classify open-PR reviewer lease handoff and emit a canonical next action (#599).
-
-    Read-only diagnosis. Never steals, releases, or adopts a foreign lease.
-    Fail-closed acquisition rules for active foreign leases remain intact.
-
-    Returns a structured diagnosis with:
-    - classification
-    - next_action (one of wait / resume_exact_owner_session /
-      release_expired_lease / operator_authorized_cleanup /
-      repair_worktree_binding / acquire)
-    - active_lease identity fields when present
-    - worktree_binding match result
-    - instructed-lease mismatch flags
-    """
-    now = now or datetime.now(timezone.utc)
-    session_id = (current_session_id or "").strip()
-    identity = (current_reviewer_identity or "").strip()
-    instructed_sid = (instructed_session_id or "").strip()
-    reasons: list[str] = []
-
-    active = find_active_reviewer_lease(comments, pr_number=pr_number, now=now)
-    session_lease = get_session_lease()
-
-    # Worktree binding: env-bound vs proposed vs active lease worktree.
-    env_wt = _norm_path(env_bound_worktree)
-    prop_wt = _norm_path(proposed_worktree)
-    lease_wt = _norm_path((active or {}).get("worktree") if active else None)
-    binding_mismatch = False
-    binding_details: dict[str, Any] = {
-        "env_bound_worktree": env_bound_worktree or None,
-        "proposed_worktree": proposed_worktree or None,
-        "lease_worktree": (active or {}).get("worktree") if active else None,
-        "match": True,
-    }
-    paths = [p for p in (env_wt, prop_wt, lease_wt) if p]
-    if len(paths) >= 2 and len(set(paths)) > 1:
-        binding_mismatch = True
-        binding_details["match"] = False
-        reasons.append(
-            "worktree binding mismatch: env/proposed/lease worktree paths disagree"
-        )
-
-    # Instructed lease gone while a different lease is active (PR #592-style).
-    instructed_missing_with_replacement = False
-    if instructed_sid or instructed_comment_id is not None:
-        if not active:
-            reasons.append(
-                "instructed lease is gone and no active replacement lease remains"
-            )
-        else:
-            owner = (active.get("session_id") or "").strip()
-            cid = active.get("comment_id")
-            sid_mismatch = bool(instructed_sid and owner and owner != instructed_sid)
-            cid_mismatch = (
-                instructed_comment_id is not None
-                and cid is not None
-                and int(cid) != int(instructed_comment_id)
-            )
-            if sid_mismatch or cid_mismatch:
-                instructed_missing_with_replacement = True
-                reasons.append(
-                    "instructed lease is gone; a different active lease replaced it "
-                    f"(active session_id={owner}, comment_id={cid})"
-                )
-
-    # Classification + next_action.
-    classification = "no_lease"
-    next_action = NEXT_ACTION_ACQUIRE
-
-    if active:
-        owner = (active.get("session_id") or "").strip()
-        freshness = active.get("freshness") or classify_lease_freshness(
-            active, now=now
-        )
-        owner_identity = (active.get("reviewer_identity") or "").strip()
-        is_own = bool(session_id and owner and owner == session_id)
-        # Same identity alone is NOT ownership for resume; session_id must match.
-        same_identity = bool(
-            identity and owner_identity and identity == owner_identity
-        )
-
-        if is_own and freshness in {"active", "stale_warning"}:
-            classification = "own_active"
-            next_action = NEXT_ACTION_RESUME_EXACT_OWNER_SESSION
-        elif is_own and freshness in {"reclaimable", "expired"}:
-            classification = "own_expired"
-            next_action = NEXT_ACTION_RELEASE_EXPIRED_LEASE
-            reasons.append(
-                f"own lease freshness is '{freshness}'; release via "
-                "gitea_release_reviewer_pr_lease then re-acquire"
-            )
-        elif not is_own and freshness in {"active", "stale_warning"}:
-            classification = "foreign_active"
-            next_action = NEXT_ACTION_WAIT
-            reasons.append(
-                f"foreign active reviewer lease (session_id={owner}, "
-                f"phase={active.get('phase')}, freshness={freshness}); "
-                "do not submit; do not steal"
-            )
-            if same_identity:
-                reasons.append(
-                    "lease identity matches current reviewer but session_id differs; "
-                    "resume only from the exact owner session_id or wait"
-                )
-        elif not is_own and freshness == "reclaimable":
-            classification = "foreign_reclaimable"
-            next_action = NEXT_ACTION_RELEASE_EXPIRED_LEASE
-            reasons.append(
-                f"foreign reclaimable lease (session_id={owner}); clear only via "
-                "sanctioned gitea_release_reviewer_pr_lease when reclaimable"
-            )
-        elif not is_own and freshness == "expired":
-            classification = "foreign_expired"
-            next_action = NEXT_ACTION_RELEASE_EXPIRED_LEASE
-            reasons.append(
-                f"foreign expired lease (session_id={owner}); use sanctioned release"
-            )
-        else:
-            classification = "foreign_active"
-            next_action = NEXT_ACTION_WAIT
-            reasons.append(
-                f"unclassified active lease state (session_id={owner}, "
-                f"freshness={freshness}); wait fail-closed"
-            )
-
-        if instructed_missing_with_replacement and classification.startswith(
-            "foreign"
-        ):
-            classification = "instructed_lease_missing_with_replacement"
-            # Foreign active still means wait; reclaimable still release.
-            if next_action == NEXT_ACTION_WAIT:
-                reasons.append(
-                    "replacement foreign lease is active — wait; "
-                    "operator_authorized_cleanup only with explicit operator authority"
-                )
-    else:
-        classification = "no_lease"
-        next_action = NEXT_ACTION_ACQUIRE
-        reasons.append("no active reviewer lease; acquire via gitea_acquire_reviewer_pr_lease")
-
-    # Binding mismatch is a first-class blocker before submit, but does not
-    # erase foreign-lease wait/release guidance. Override next_action only when
-    # the session would otherwise be free to acquire or resume (submit path).
-    if binding_mismatch:
-        if next_action in {
-            NEXT_ACTION_ACQUIRE,
-            NEXT_ACTION_RESUME_EXACT_OWNER_SESSION,
-        }:
-            classification = "worktree_binding_mismatch"
-            next_action = NEXT_ACTION_REPAIR_WORKTREE_BINDING
-        else:
-            reasons.append(
-                "also repair worktree binding before submit "
-                f"(next_action remains {next_action})"
-            )
-
-    lease_summary = None
-    if active:
-        lease_summary = {
-            "comment_id": active.get("comment_id"),
-            "session_id": active.get("session_id"),
-            "phase": active.get("phase"),
-            "candidate_head": active.get("candidate_head"),
-            "expires_at": active.get("expires_at"),
-            "last_activity": active.get("last_activity"),
-            "freshness": active.get("freshness")
-            or classify_lease_freshness(active, now=now),
-            "reviewer_identity": active.get("reviewer_identity"),
-            "profile": active.get("profile"),
-            "worktree": active.get("worktree"),
-            "blocker": active.get("blocker"),
-        }
-
-    return {
-        "pr_number": pr_number,
-        "classification": classification,
-        "next_action": next_action,
-        "active_lease": lease_summary,
-        "session_lease": session_lease,
-        "worktree_binding": binding_details,
-        "instructed_session_id": instructed_session_id,
-        "instructed_comment_id": instructed_comment_id,
-        "instructed_lease_missing_with_replacement": instructed_missing_with_replacement,
-        "mutation_allowed": (
-            next_action == NEXT_ACTION_RESUME_EXACT_OWNER_SESSION
-            and not binding_mismatch
-            and bool(session_lease)
-        ),
-        "reasons": reasons,
-        "forbidden": [
-            "manual lock deletion",
-            "raw API bypass",
-            "mtime manipulation",
-            "direct _SESSION_LEASE seeding",
-            "silent foreign lease steal",
-        ],
-    }

role_session_router.py

@@ -55,6 +55,7 @@ def skip_python_scan_walk_root(project_root: str, walk_root: str) -> bool:
 
 REVIEWER_TASKS = frozenset({
     "review_pr",
+    "merge_pr",
     "blind_pr_queue_review",
     "pr_queue_cleanup",
     "pr-queue-cleanup",
@@ -62,10 +63,6 @@ REVIEWER_TASKS = frozenset({
     "approve_pr",
 })
 
-MERGER_TASKS = frozenset({
-    "merge_pr",
-})
-
 AUTHOR_TASKS = frozenset({
     "create_issue",
     "comment_issue",
@@ -101,7 +98,7 @@ TASK_REQUIRED_ROLE = {
     "address_pr_change_requests": "author",
     "delete_branch": "author",
     "review_pr": "reviewer",
-    "merge_pr": "merger",
+    "merge_pr": "reviewer",
     "blind_pr_queue_review": "reviewer",
     "pr_queue_cleanup": "reviewer",
     "pr-queue-cleanup": "reviewer",
@@ -131,10 +128,6 @@ WRONG_ROLE_RECONCILER_MSG = (
     "MCP namespace/profile with exact close capability."
 )
 
-WRONG_ROLE_MERGER_MSG = (
-    "Wrong role/session for merger task. Launch merger MCP namespace."
-)
-
 _session_last_route: dict | None = None
 
 
@@ -250,25 +243,6 @@ def route_task_session(
         _record_route(result)
         return result
 
-    if required_role == "merger":
-        result = {
-            "task_type": task_type,
-            "required_role": required_role,
-            "active_role": active_role_kind,
-            "active_profile": active_profile,
-            "route_result": ROUTE_WRONG_ROLE,
-            "downstream_allowed": False,
-            "reasons": [
-                WRONG_ROLE_MERGER_MSG,
-                "Merger tasks cannot run in author or reviewer sessions.",
-            ],
-            "message": WRONG_ROLE_MERGER_MSG,
-            "runtime_switching_supported": runtime_switching_supported,
-            "profile_switch_blocked": not runtime_switching_supported,
-        }
-        _record_route(result)
-        return result
-
     if required_role == "author":
         route = ROUTE_TO_AUTHOR
         message = (

tests/test_controller_closure_baseline_proof.py

@@ -1,113 +0,0 @@
-"""Controller-closure baseline-proof gate tests (#529, criterion 6)."""
-
-import unittest
-
-from controller_closure_baseline_proof import (
-    assess_controller_closure_baseline_proof,
-)
-from premerge_baseline_proof import (
-    CLEAN_PASS,
-    PREMERGE_BASELINE_PROVEN_FAILURE,
-    UNRESOLVED_REGRESSION_RISK,
-)
-from final_report_validator import assess_final_report_validator
-
-# Complete pre-merge proof fields for a baseline claim (see #533).
-_PROOF_FIELDS = (
-    "Pre-merge base commit: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b\n"
-    "Tested commit: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b\n"
-    "Command: venv/bin/python -m pytest tests/test_foo.py -q\n"
-    "Exit status: 1\n"
-    "Failure signature: AssertionError: None is not true\n"
-)
-
-
-class TestControllerClosureBaselineProof(unittest.TestCase):
-    def test_empty_report_skipped_and_allowed(self):
-        result = assess_controller_closure_baseline_proof("")
-        self.assertFalse(result["block"])
-        self.assertTrue(result["skipped"])
-        self.assertEqual(result["label"], CLEAN_PASS)
-
-    def test_none_report_allowed(self):
-        result = assess_controller_closure_baseline_proof(None)
-        self.assertFalse(result["block"])
-        self.assertTrue(result["skipped"])
-
-    def test_clean_pass_closure_allowed(self):
-        result = assess_controller_closure_baseline_proof(
-            "Closing #529. Validation: full suite passed, exit status 0. Clean pass."
-        )
-        self.assertFalse(result["block"])
-        self.assertEqual(result["label"], CLEAN_PASS)
-
-    def test_expected_preexisting_failure_without_proof_blocked(self):
-        report = (
-            "Closing #529. Full suite: 1 failed. This is an expected "
-            "pre-existing failure, safe to close."
-        )
-        result = assess_controller_closure_baseline_proof(report)
-        self.assertTrue(result["block"])
-        self.assertFalse(result["proven"])
-        self.assertEqual(result["label"], UNRESOLVED_REGRESSION_RISK)
-        self.assertTrue(result["reasons"])
-        self.assertTrue(result["safe_next_action"])
-
-    def test_current_master_reproduction_only_blocked(self):
-        report = (
-            "Closing #529. Full suite: 1 failed. Pre-existing baseline failure — "
-            "reproduced on current master after merge.\n"
-            "Command: venv/bin/python -m pytest tests/test_foo.py -q\n"
-            "Exit status: 1\n"
-            "Failure signature: AssertionError: None is not true\n"
-        )
-        result = assess_controller_closure_baseline_proof(report)
-        self.assertTrue(result["block"])
-
-    def test_proven_baseline_closure_allowed(self):
-        report = (
-            "Closing #529. Full suite: 1 failed, an expected pre-existing "
-            "baseline failure proven on the PR pre-merge base commit.\n"
-            + _PROOF_FIELDS
-        )
-        result = assess_controller_closure_baseline_proof(report)
-        self.assertFalse(result["block"])
-        self.assertEqual(result["label"], PREMERGE_BASELINE_PROVEN_FAILURE)
-
-
-class TestControllerCloseTaskKind(unittest.TestCase):
-    """The composable validator must cover the controller_close task kind."""
-
-    def test_controller_close_blocks_unproven_baseline(self):
-        report = (
-            "Full suite: 1 failed. Expected pre-existing failure, closing the "
-            "tracking issue."
-        )
-        result = assess_final_report_validator(report, "controller_close")
-        self.assertTrue(result["blocked"])
-        self.assertTrue(
-            any(
-                "premerge_baseline_proof" in f["rule_id"]
-                for f in result["findings"]
-            )
-        )
-
-    def test_controller_close_alias_close_issue(self):
-        report = (
-            "Full suite: 1 failed. Expected pre-existing failure, closing the "
-            "tracking issue."
-        )
-        result = assess_final_report_validator(report, "close_issue")
-        self.assertTrue(result["blocked"])
-
-    def test_controller_close_allows_proven_baseline(self):
-        report = (
-            "Full suite: 1 failed, expected pre-existing baseline failure proven "
-            "on the PR pre-merge base commit.\n" + _PROOF_FIELDS
-        )
-        result = assess_final_report_validator(report, "controller_close")
-        self.assertFalse(result["blocked"])
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_master_parity_gate.py

@@ -78,95 +78,6 @@ class TestBlockReasonsAndReport(unittest.TestCase):
         self.assertTrue(report["recovery"])
 
 
-class TestLiveRemoteParity(unittest.TestCase):
-    """#610: parity must account for the live remote master, not just local.
-
-    The daemon can be stale relative to the live remote target while the local
-    checkout HEAD still matches the daemon's startup commit, so local parity
-    reports green even though a mutation would run against outdated code.
-    """
-
-    SHA_C = "c" * 40
-
-    def test_distinguishes_three_shas(self):
-        res = mp.assess_master_parity(
-            {"startup_head": SHA_A}, SHA_A, live_remote_head=SHA_B)
-        self.assertEqual(res["daemon_start_head"], SHA_A)
-        self.assertEqual(res["local_head"], SHA_A)
-        self.assertEqual(res["live_remote_head"], SHA_B)
-
-    def test_mutation_safe_only_when_all_three_match(self):
-        res = mp.assess_master_parity(
-            {"startup_head": SHA_A}, SHA_A, live_remote_head=SHA_A)
-        self.assertTrue(res["mutation_safe"])
-        self.assertTrue(res["live_known"])
-        self.assertFalse(res["live_stale"])
-
-    def test_live_stale_when_remote_advanced_past_daemon(self):
-        # Local checkout still matches the daemon start (local parity green),
-        # but the live remote master has advanced -> daemon is live-stale.
-        res = mp.assess_master_parity(
-            {"startup_head": SHA_A}, SHA_A, live_remote_head=SHA_B)
-        self.assertTrue(res["in_parity"])  # local parity still green
-        self.assertTrue(res["live_stale"])
-        self.assertFalse(res["mutation_safe"])
-        self.assertTrue(any("live" in r.lower() for r in res["reasons"]))
-
-    def test_live_unknown_is_not_mutation_safe_but_not_stale(self):
-        # Non-goal: unfetchable live remote must not be treated as stale for
-        # read-only, but a mutation-safe claim fails closed.
-        res = mp.assess_master_parity(
-            {"startup_head": SHA_A}, SHA_A, live_remote_head=None)
-        self.assertFalse(res["live_known"])
-        self.assertFalse(res["mutation_safe"])
-        self.assertFalse(res["live_stale"])
-        self.assertTrue(res["in_parity"])
-
-    def test_default_live_remote_preserves_legacy_shape(self):
-        # Callers that do not supply a live head keep the pre-#610 behavior:
-        # in-parity, not live-stale, no live-derived block.
-        res = mp.assess_master_parity({"startup_head": SHA_A}, SHA_A)
-        self.assertFalse(res["live_stale"])
-        self.assertEqual(mp.parity_block_reasons(res), [])
-
-
-class TestLiveStaleBlockAndReport(unittest.TestCase):
-    """#610: live-staleness must block mutations and surface a typed blocker."""
-
-    def test_live_stale_produces_block_reasons(self):
-        res = mp.assess_master_parity(
-            {"startup_head": SHA_A}, SHA_A, live_remote_head=SHA_B)
-        self.assertTrue(mp.parity_block_reasons(res))
-
-    def test_disable_env_suppresses_live_stale_block(self):
-        res = mp.assess_master_parity(
-            {"startup_head": SHA_A}, SHA_A, live_remote_head=SHA_B)
-        with patch.dict(os.environ, {mp.ENV_DISABLE: "1"}):
-            self.assertEqual(mp.parity_block_reasons(res), [])
-
-    def test_resolver_disagreement_returns_typed_blocker(self):
-        # Parity says local-green, resolver says restart required -> disagreement
-        # is a typed, fail-closed blocker naming the resolver as authoritative.
-        res = mp.assess_master_parity({"startup_head": SHA_A}, SHA_A)
-        blocker = mp.parity_resolver_disagreement(res, resolver_restart_required=True)
-        self.assertIsNotNone(blocker)
-        self.assertEqual(blocker["kind"], "parity_resolver_disagreement")
-        self.assertTrue(blocker["restart_required"])
-        self.assertTrue(blocker["resolver_authoritative"])
-
-    def test_no_disagreement_when_resolver_agrees(self):
-        res = mp.assess_master_parity({"startup_head": SHA_A}, SHA_A)
-        self.assertIsNone(
-            mp.parity_resolver_disagreement(res, resolver_restart_required=False))
-
-    def test_live_stale_report_names_live_remote(self):
-        res = mp.assess_master_parity(
-            {"startup_head": SHA_A}, SHA_A, live_remote_head=SHA_B)
-        report = mp.parity_report(res)
-        self.assertEqual(report["live_remote_head"], SHA_B)
-        self.assertTrue(report["restart_required"])
-
-
 class TestReadGitHead(unittest.TestCase):
     def test_test_override_takes_precedence(self):
         with patch.dict(os.environ, {mp.ENV_TEST_CURRENT_HEAD: SHA_B}):
@@ -184,78 +95,6 @@ class TestReadGitHead(unittest.TestCase):
             self.assertIsNone(mp.read_git_head(""))
 
 
-class TestReadRemoteMasterHead(unittest.TestCase):
-    """#610: live remote master head reader (env-overridable, fails to None)."""
-
-    def test_test_override_takes_precedence(self):
-        with patch.dict(os.environ, {mp.ENV_TEST_LIVE_REMOTE_HEAD: SHA_B}):
-            self.assertEqual(mp.read_remote_master_head("/nonexistent"), SHA_B)
-
-    def test_blank_override_is_none(self):
-        with patch.dict(os.environ, {mp.ENV_TEST_LIVE_REMOTE_HEAD: "   "}):
-            self.assertIsNone(mp.read_remote_master_head("/nonexistent"))
-
-    def test_unfetchable_remote_is_none(self):
-        # No override; a bogus root/remote must fail closed to None, never raise.
-        env = {k: v for k, v in os.environ.items()
-               if k != mp.ENV_TEST_LIVE_REMOTE_HEAD}
-        with patch.dict(os.environ, env, clear=True):
-            self.assertIsNone(
-                mp.read_remote_master_head("/nonexistent", remote="nope"))
-
-
-class TestRemoteHeadCache(unittest.TestCase):
-    """#610: live remote reads are cached with a TTL to stay off the network.
-
-    The parity gate runs on every mutation and every runtime-context read, so an
-    unbounded ``git ls-remote`` per call would be a latency/flakiness regression.
-    """
-
-    def setUp(self):
-        mp._clear_remote_head_cache()
-        env = {k: v for k, v in os.environ.items()
-               if k != mp.ENV_TEST_LIVE_REMOTE_HEAD}
-        self._env = patch.dict(os.environ, env, clear=True)
-        self._env.start()
-        self.addCleanup(self._env.stop)
-        self.addCleanup(mp._clear_remote_head_cache)
-
-    def _fake_run(self, sha):
-        class _R:
-            returncode = 0
-            stdout = f"{sha}\trefs/heads/master\n"
-        calls = {"n": 0}
-
-        def run(*args, **kwargs):
-            calls["n"] += 1
-            return _R()
-        return run, calls
-
-    def test_second_call_within_ttl_uses_cache(self):
-        run, calls = self._fake_run(SHA_B)
-        with patch.object(mp.subprocess, "run", run):
-            a = mp.read_remote_master_head("/repo", remote="prgs", ttl=100)
-            b = mp.read_remote_master_head("/repo", remote="prgs", ttl=100)
-        self.assertEqual(a, SHA_B)
-        self.assertEqual(b, SHA_B)
-        self.assertEqual(calls["n"], 1)
-
-    def test_zero_ttl_bypasses_cache(self):
-        run, calls = self._fake_run(SHA_B)
-        with patch.object(mp.subprocess, "run", run):
-            mp.read_remote_master_head("/repo", remote="prgs", ttl=0)
-            mp.read_remote_master_head("/repo", remote="prgs", ttl=0)
-        self.assertEqual(calls["n"], 2)
-
-    def test_env_override_never_touches_subprocess(self):
-        run, calls = self._fake_run(SHA_B)
-        with patch.dict(os.environ, {mp.ENV_TEST_LIVE_REMOTE_HEAD: SHA_A}):
-            with patch.object(mp.subprocess, "run", run):
-                self.assertEqual(
-                    mp.read_remote_master_head("/repo", remote="prgs"), SHA_A)
-        self.assertEqual(calls["n"], 0)
-
-
 class TestServerWiring(unittest.TestCase):
     """Integration with the gate choke point in the server namespace."""
 
@@ -266,13 +105,6 @@ class TestServerWiring(unittest.TestCase):
         self._saved = self.srv._STARTUP_PARITY
         self.srv._STARTUP_PARITY = {"root": self.srv.PROJECT_ROOT,
                                     "startup_head": SHA_A}
-        # Keep the live-remote read hermetic (no real ls-remote network call):
-        # default the live master to the daemon start so parity is fully green
-        # unless a test overrides the live head explicitly (#610).
-        self._live_patch = patch.dict(
-            os.environ, {mp.ENV_TEST_LIVE_REMOTE_HEAD: SHA_A})
-        self._live_patch.start()
-        self.addCleanup(self._live_patch.stop)
 
     def tearDown(self):
         self.srv._STARTUP_PARITY = self._saved
@@ -315,36 +147,6 @@ class TestServerWiring(unittest.TestCase):
             self.assertTrue(out["in_parity"])
             self.assertNotIn("report", out)
 
-    # --- #610: live-remote wiring -------------------------------------------
-
-    def test_live_stale_blocks_mutation_though_local_green(self):
-        # Local checkout matches the daemon start (local parity green) but the
-        # live remote master has advanced -> mutations must fail closed.
-        with patch.dict(os.environ, {mp.ENV_TEST_CURRENT_HEAD: SHA_A,
-                                     mp.ENV_TEST_LIVE_REMOTE_HEAD: SHA_B}):
-            self.assertEqual(self.srv._master_parity_block("gitea.read"), [])
-            self.assertTrue(
-                self.srv._master_parity_block("gitea.pr.create"))
-
-    def test_assess_tool_exposes_three_distinct_shas(self):
-        with patch.dict(os.environ, {mp.ENV_TEST_CURRENT_HEAD: SHA_A,
-                                     mp.ENV_TEST_LIVE_REMOTE_HEAD: SHA_B}):
-            out = self.srv.gitea_assess_master_parity(remote="prgs")
-            self.assertEqual(out["daemon_start_head"], SHA_A)
-            self.assertEqual(out["local_head"], SHA_A)
-            self.assertEqual(out["live_remote_head"], SHA_B)
-            self.assertTrue(out["live_stale"])
-            self.assertFalse(out["mutation_safe"])
-            self.assertIn("report", out)
-
-    def test_assess_tool_mutation_safe_when_all_three_match(self):
-        with patch.dict(os.environ, {mp.ENV_TEST_CURRENT_HEAD: SHA_A,
-                                     mp.ENV_TEST_LIVE_REMOTE_HEAD: SHA_A}):
-            out = self.srv.gitea_assess_master_parity(remote="prgs")
-            self.assertTrue(out["mutation_safe"])
-            self.assertFalse(out["live_stale"])
-            self.assertNotIn("report", out)
-
 
 if __name__ == "__main__":
     unittest.main()

tests/test_mcp_server.py

@@ -776,6 +776,7 @@ class TestMergePR(unittest.TestCase):
 
         # Clean ledger each merge test so residual/host durable #332 state
         # cannot short-circuit eligibility gates (#590 / #594).
+        # Host durable state can otherwise leak in when tests clear os.environ.
         mcp_server._save_review_decision_lock(None)
         mcp_server.gitea_load_review_workflow()
         self._lease_patch = _install_owned_reviewer_lease(8)
@@ -2733,56 +2734,6 @@ class TestTrackerHygieneCleanup(unittest.TestCase):
         self.assertTrue(res["success"])
         self.assertEqual(res["cleanup_status"].get(1), "not present")
 
-    def test_close_issue_blocks_unproven_expected_preexisting_failure(self):
-        # #529: a closure report calling a non-zero suite exit an "expected
-        # pre-existing failure" without pre-merge proof must fail closed and
-        # never PATCH the issue state.
-        patched = []
-
-        def api_side_effect(method, url, auth, payload=None):
-            if method == "PATCH":
-                patched.append(url)
-            return {}
-        self.mock_api.side_effect = api_side_effect
-
-        res = gitea_close_issue(
-            issue_number=1,
-            closure_report=(
-                "Full suite: 1 failed. Expected pre-existing failure, safe to close."
-            ),
-        )
-        self.assertFalse(res["success"])
-        self.assertTrue(res.get("blocked"))
-        self.assertTrue(res.get("reasons"))
-        self.assertFalse(
-            patched, "must not PATCH issue state when the closure gate blocks"
-        )
-
-    def test_close_issue_allows_proven_baseline_closure(self):
-        def api_side_effect(method, url, auth, payload=None):
-            if method == "PATCH" and "issues/1" in url:
-                return {"state": "closed"}
-            if method == "GET" and "labels" in url and "issues" not in url:
-                return [{"name": "bug", "id": 2}]
-            if method == "GET" and "issues/1" in url:
-                return {"labels": [{"name": "bug"}]}
-            return {}
-        self.mock_api.side_effect = api_side_effect
-
-        res = gitea_close_issue(
-            issue_number=1,
-            closure_report=(
-                "Full suite: 1 failed, expected pre-existing baseline failure "
-                "proven on the PR pre-merge base commit.\n"
-                "Pre-merge base commit: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b\n"
-                "Tested commit: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b\n"
-                "Command: venv/bin/python -m pytest -q\n"
-                "Exit status: 1\n"
-                "Failure signature: AssertionError: None is not true\n"
-            ),
-        )
-        self.assertTrue(res["success"])
-
     def test_merge_pr_with_closes_removes_label(self):
         import reviewer_pr_lease
 

tests/test_post_merge_validation.py

@@ -1,119 +0,0 @@
-"""Post-merge moot validation wording + label tests (#529, criteria 1/4/5)."""
-
-import unittest
-
-from post_merge_validation import (
-    BASELINE_ACCEPTED_OUTCOME,
-    BLOCKED_OUTCOME,
-    CLEAN_PASS_OUTCOME,
-    LABEL_BASELINE_ACCEPTED,
-    LABEL_BLOCKED,
-    LABEL_CLEAN_PASS,
-    LABEL_POST_MERGE_MOOT,
-    POST_MERGE_MOOT_OUTCOME,
-    assess_post_merge_validation,
-    process_state_label,
-)
-from final_report_validator import assess_final_report_validator
-from issue_workflow_labels import CANONICAL_LABELS, VALIDATION_LABELS
-
-_MOOT_PROOF = (
-    "Validation status: post-merge moot validation\n"
-    "PR state: merged\n"
-    "Merge commit sha: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b\n"
-    "Validation finding: full suite passed, for the record.\n"
-)
-
-
-class TestPostMergeValidation(unittest.TestCase):
-    def test_not_applicable_when_no_merged_or_moot_signal(self):
-        result = assess_post_merge_validation(
-            "Review decision: approve. Validation: full suite passed."
-        )
-        self.assertFalse(result["block"])
-        self.assertTrue(result["skipped"])
-
-    def test_active_approval_on_merged_pr_blocked(self):
-        report = (
-            "PR is already merged. Review decision: approve. "
-            "Validation: full suite passed."
-        )
-        result = assess_post_merge_validation(report)
-        self.assertTrue(result["block"])
-        self.assertEqual(result["outcome"], POST_MERGE_MOOT_OUTCOME)
-        self.assertEqual(result["process_state_label"], LABEL_POST_MERGE_MOOT)
-
-    def test_active_approval_on_merged_pr_via_structured_signal_blocked(self):
-        report = "Review decision: approve. Validation: full suite passed."
-        result = assess_post_merge_validation(report, pr_merged_or_closed=True)
-        self.assertTrue(result["block"])
-
-    def test_moot_wording_without_proof_blocked(self):
-        report = "Recording post-merge moot validation for this PR."
-        result = assess_post_merge_validation(report)
-        self.assertTrue(result["block"])
-        self.assertTrue(result["reasons"])
-
-    def test_moot_wording_with_full_proof_allowed(self):
-        result = assess_post_merge_validation(_MOOT_PROOF)
-        self.assertFalse(result["block"])
-        self.assertEqual(result["outcome"], POST_MERGE_MOOT_OUTCOME)
-
-    def test_merged_signal_only_guides_without_blocking(self):
-        result = assess_post_merge_validation(
-            "PR was already merged before review; recording findings."
-        )
-        self.assertFalse(result["block"])
-        self.assertTrue(result["safe_next_action"])
-
-    def test_process_state_label_mapping(self):
-        self.assertEqual(process_state_label(CLEAN_PASS_OUTCOME), LABEL_CLEAN_PASS)
-        self.assertEqual(
-            process_state_label(BASELINE_ACCEPTED_OUTCOME), LABEL_BASELINE_ACCEPTED
-        )
-        self.assertEqual(process_state_label(BLOCKED_OUTCOME), LABEL_BLOCKED)
-        self.assertEqual(
-            process_state_label(POST_MERGE_MOOT_OUTCOME), LABEL_POST_MERGE_MOOT
-        )
-        self.assertIsNone(process_state_label("nonsense"))
-
-
-class TestValidationLabelsRegistered(unittest.TestCase):
-    def test_validation_labels_are_canonical(self):
-        for label in (
-            LABEL_CLEAN_PASS,
-            LABEL_BASELINE_ACCEPTED,
-            LABEL_BLOCKED,
-            LABEL_POST_MERGE_MOOT,
-        ):
-            self.assertIn(label, VALIDATION_LABELS)
-            self.assertIn(label, CANONICAL_LABELS)
-
-
-class TestPostMergeValidationWiredIntoReview(unittest.TestCase):
-    def test_review_pr_blocks_active_approval_on_merged_pr(self):
-        report = (
-            "PR is already merged. Review decision: approve. "
-            "Validation: full suite passed."
-        )
-        result = assess_final_report_validator(report, "review_pr")
-        self.assertTrue(result["blocked"])
-        self.assertTrue(
-            any(
-                f["rule_id"] == "reviewer.post_merge_validation"
-                for f in result["findings"]
-            )
-        )
-
-    def test_review_pr_allows_proven_post_merge_moot(self):
-        result = assess_final_report_validator(_MOOT_PROOF, "review_pr")
-        self.assertFalse(
-            any(
-                f["rule_id"] == "reviewer.post_merge_validation"
-                for f in result["findings"]
-            )
-        )
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_resolve_task_capability.py

@@ -287,49 +287,6 @@ class TestResolveTaskCapability(unittest.TestCase):
             self.assertEqual(res["required_operation_permission"], "gitea.pr.merge")
             self.assertEqual(res["required_role_kind"], "merger")
 
-    @patch("mcp_server.api_request", return_value={"login": "reviewer-user"})
-    @patch("mcp_server.get_auth_header", return_value="token reviewer-pass")
-    def test_reviewer_role_with_merge_permission_still_cannot_merge(self, _auth, _api):
-        # #539: exact permission alone is insufficient. The active profile
-        # role must also be merger for merge_pr.
-        config = json.loads(json.dumps(CONFIG_RESOLVER))
-        config["profiles"]["reviewer-with-merge"] = {
-            "enabled": True,
-            "context": "ctx",
-            "role": "reviewer",
-            "username": "reviewer-user",
-            "auth": {"type": "env", "name": "GITEA_TOKEN_REVIEWER"},
-            "allowed_operations": [
-                "gitea.read", "gitea.pr.review", "gitea.pr.approve",
-                "gitea.pr.merge",
-            ],
-            "forbidden_operations": ["gitea.pr.create", "gitea.branch.push"],
-            "execution_profile": "reviewer-with-merge",
-        }
-        self._write_config(config)
-        with patch.dict(os.environ, self._env("reviewer-with-merge")):
-            res = mcp_server.gitea_resolve_task_capability(
-                task="merge_pr", remote="prgs"
-            )
-        self.assertEqual(res["required_role_kind"], "merger")
-        self.assertEqual(res["active_role_kind"], "reviewer")
-        self.assertTrue(res["active_profile_permission_allowed"])
-        self.assertFalse(res["allowed_in_current_session"])
-        self.assertTrue(res["stop_required"])
-        self.assertIn("cannot perform merger task", " ".join(res["task_role_guidance"]))
-
-    @patch("mcp_server.api_request", return_value={"login": "merger-user"})
-    @patch("mcp_server.get_auth_header", return_value="token merger-pass")
-    def test_merger_profile_can_resolve_merge_task(self, _auth, _api):
-        with patch.dict(os.environ, self._env("merger-profile")):
-            res = mcp_server.gitea_resolve_task_capability(
-                task="merge_pr", remote="prgs"
-            )
-        self.assertEqual(res["required_role_kind"], "merger")
-        self.assertEqual(res["active_role_kind"], "merger")
-        self.assertTrue(res["allowed_in_current_session"])
-        self.assertFalse(res["stop_required"])
-
     @patch("mcp_server.api_request")
     def test_self_review_blocked_structured(self, mock_api):
         # Test that self-approve (self-review gate) is blocked and returns structured reasons

tests/test_reviewer_pr_lease.py

@@ -237,113 +237,5 @@ class TestReviewerLeaseMcpGate(unittest.TestCase):
         self.assertTrue(any("lease" in r.lower() for r in reasons))
 
 
-
-class TestReviewerLeaseHandoffDiagnose(unittest.TestCase):
-    """#599: canonical next-action diagnosis for open-PR lease handoff."""
-
-    def setUp(self):
-        leases.clear_session_lease()
-
-    def test_no_lease_next_action_acquire(self):
-        result = leases.diagnose_reviewer_pr_lease_handoff(
-            [],
-            pr_number=592,
-            current_session_id="me-1",
-            current_reviewer_identity="sysadmin",
-            proposed_worktree="branches/review-pr-592",
-        )
-        self.assertEqual(result["classification"], "no_lease")
-        self.assertEqual(result["next_action"], leases.NEXT_ACTION_ACQUIRE)
-        self.assertIsNone(result["active_lease"])
-
-    def test_foreign_active_wait_pr592_style(self):
-        # Instructed lease gone; newer foreign claim is active.
-        old = _lease_comment(592, "23139-da018dab43ba", phase="released")
-        old["id"] = 8640
-        active = _lease_comment(592, "51515-2bfb70f0685f", phase="claimed")
-        active["id"] = 8647
-        result = leases.diagnose_reviewer_pr_lease_handoff(
-            [old, active],
-            pr_number=592,
-            current_session_id="fresh-session",
-            current_reviewer_identity="sysadmin",
-            proposed_worktree="branches/review-pr-592-issue-590",
-            instructed_session_id="23139-da018dab43ba",
-            instructed_comment_id=8640,
-        )
-        self.assertEqual(
-            result["classification"],
-            "instructed_lease_missing_with_replacement",
-        )
-        self.assertEqual(result["next_action"], leases.NEXT_ACTION_WAIT)
-        self.assertTrue(result["instructed_lease_missing_with_replacement"])
-        self.assertEqual(result["active_lease"]["session_id"], "51515-2bfb70f0685f")
-        self.assertEqual(result["active_lease"]["comment_id"], 8647)
-        self.assertFalse(result["mutation_allowed"])
-
-    def test_foreign_reclaimable_release_expired(self):
-        reclaim = _lease_comment(
-            592, "foreign-old", phase="claimed", minutes_ago=65
-        )
-        reclaim["id"] = 99
-        result = leases.diagnose_reviewer_pr_lease_handoff(
-            [reclaim],
-            pr_number=592,
-            current_session_id="me-1",
-            current_reviewer_identity="sysadmin",
-            proposed_worktree="branches/review-pr-592",
-        )
-        self.assertEqual(result["classification"], "foreign_reclaimable")
-        self.assertEqual(
-            result["next_action"], leases.NEXT_ACTION_RELEASE_EXPIRED_LEASE
-        )
-
-    def test_own_active_resume(self):
-        head = "a" * 40
-        claim = _lease_comment(592, "me-1", phase="claimed", candidate_head=head)
-        claim["id"] = 10
-        leases.record_session_lease({
-            "pr_number": 592,
-            "session_id": "me-1",
-            "candidate_head": head,
-            "comment_id": 10,
-        }, lease_provenance=mla.build_lease_provenance(
-            source=mla.SOURCE_ACQUIRE,
-            comment_id=10,
-        ))
-        result = leases.diagnose_reviewer_pr_lease_handoff(
-            [claim],
-            pr_number=592,
-            current_session_id="me-1",
-            current_reviewer_identity="rev1",
-            proposed_worktree="branches/review-pr382",
-        )
-        self.assertEqual(result["classification"], "own_active")
-        self.assertEqual(
-            result["next_action"], leases.NEXT_ACTION_RESUME_EXACT_OWNER_SESSION
-        )
-        self.assertTrue(result["mutation_allowed"])
-
-    def test_worktree_binding_mismatch(self):
-        claim = _lease_comment(592, "me-1", phase="claimed")
-        claim["id"] = 11
-        # _lease_comment uses branches/review-pr382
-        result = leases.diagnose_reviewer_pr_lease_handoff(
-            [claim],
-            pr_number=592,
-            current_session_id="me-1",
-            current_reviewer_identity="rev1",
-            proposed_worktree="branches/review-pr-592-issue-590",
-            env_bound_worktree="branches/review-pr-538",
-        )
-        self.assertEqual(result["classification"], "worktree_binding_mismatch")
-        self.assertEqual(
-            result["next_action"], leases.NEXT_ACTION_REPAIR_WORKTREE_BINDING
-        )
-        self.assertFalse(result["worktree_binding"]["match"])
-        self.assertFalse(result["mutation_allowed"])
-
-
-
 if __name__ == "__main__":
     unittest.main()

tests/test_role_session_router.py

@@ -52,20 +52,6 @@ CONFIG = {
             ],
             "execution_profile": "prgs-reviewer",
         },
-        "prgs-merger": {
-            "enabled": True,
-            "context": "ctx",
-            "role": "merger",
-            "username": "sysadmin",
-            "auth": {"type": "env", "name": "GITEA_TOKEN_MERGER"},
-            "allowed_operations": [
-                "gitea.read", "gitea.pr.merge", "gitea.issue.comment",
-            ],
-            "forbidden_operations": [
-                "gitea.pr.create", "gitea.branch.push", "gitea.pr.approve",
-            ],
-            "execution_profile": "prgs-merger",
-        },
         "prgs-reconciler": {
             "enabled": True,
             "context": "ctx",
@@ -118,7 +104,6 @@ class TestRoleSessionRouter(unittest.TestCase):
             "GITEA_MCP_PROFILE": profile,
             "GITEA_TOKEN_AUTHOR": "author-pass",
             "GITEA_TOKEN_REVIEWER": "reviewer-pass",
-            "GITEA_TOKEN_MERGER": "merger-pass",
             "GITEA_TOKEN_RECONCILER": "reconciler-pass",
         }
 
@@ -242,31 +227,6 @@ class TestRoleSessionRouter(unittest.TestCase):
         self.assertEqual(route["route_result"], role_session_router.ROUTE_ALLOWED)
         self.assertTrue(route["downstream_allowed"])
 
-    @patch("mcp_server.api_request", return_value={"login": "sysadmin"})
-    @patch("mcp_server.get_auth_header", return_value="token reviewer-pass")
-    def test_merge_task_under_reviewer_profile_wrong_role_stop(self, _auth, _api):
-        # #539: a reviewer session must not pass the pre-task merge route
-        # even if its config accidentally includes gitea.pr.merge.
-        with patch.dict(os.environ, self._env("prgs-reviewer")):
-            route = mcp_server.gitea_route_task_session(
-                task_type="merge_pr", remote="prgs"
-            )
-        self.assertEqual(route["required_role"], "merger")
-        self.assertEqual(route["route_result"], role_session_router.ROUTE_WRONG_ROLE)
-        self.assertFalse(route["downstream_allowed"])
-        self.assertIn("merger", route["message"].lower())
-
-    @patch("mcp_server.api_request", return_value={"login": "sysadmin"})
-    @patch("mcp_server.get_auth_header", return_value="token merger-pass")
-    def test_merge_task_under_merger_profile_allowed(self, _auth, _api):
-        with patch.dict(os.environ, self._env("prgs-merger")):
-            route = mcp_server.gitea_route_task_session(
-                task_type="merge_pr", remote="prgs"
-            )
-        self.assertEqual(route["required_role"], "merger")
-        self.assertEqual(route["route_result"], role_session_router.ROUTE_ALLOWED)
-        self.assertTrue(route["downstream_allowed"])
-
     @patch("mcp_server.api_request", return_value={"login": "sysadmin"})
     @patch("mcp_server.get_auth_header", return_value="token reviewer-pass")
     def test_author_task_under_reviewer_profile_routes_to_author(self, _auth, _api):
@@ -374,4 +334,4 @@ class TestCheckMidMerge(unittest.TestCase):
 
 
 if __name__ == "__main__":
-    unittest.main()
+    unittest.main()