Merge branch 'master' into fix/issue-850-native-mcp-bootstrap

Post-merge cleanup previously continued past ownership-blocked remote
deletes, which skipped independently safe local worktree removal when the
only block was worktree_binding. Remove the clean owned worktree first,
reassess ownership, then delete the remote branch only if still safe.
Preserve fail-closed protection for dirty/foreign ownership categories.

Closes #851

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

author_issue_bootstrap.py

@@ -0,0 +1,824 @@
+"""Sanctioned author issue worktree bootstrap for allocated issues (#850).
+
+Bootstraps an allocated author branch, canonical worktree under ``branches/``,
+worktree registration, issue lock, and lease/assignment binding without
+caller-side Git, Bash, or helper scripts.
+
+Features:
+1. Durable phase journal with read-after-write evidence for every phase.
+2. Idempotent replay handling via idempotency keys.
+3. Authoritative expected-base / concurrency-pin validation.
+4. Typed stale-pin refusal without silent rebasing or repointing.
+5. Canonical branches-root enforcement (path MUST be inside branches/).
+6. Preexisting work preservation (dirty tracked/untracked check, foreign ownership refusal).
+7. Compensating recovery limited strictly to artifacts created by this transition.
+8. Satisfiable exact_next_action for MCP scheduled workers.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+from typing import Any, Mapping
+
+import author_mutation_worktree
+import issue_lock_store
+import issue_lock_worktree
+import lease_lifecycle
+from reviewer_worktree import parse_dirty_tracked_files
+import task_capability_map
+
+BOOTSTRAP_TASKS = frozenset(
+    {
+        "bootstrap_author_issue_worktree",
+        "gitea_bootstrap_author_issue_worktree",
+    }
+)
+
+PHASE_1_REQUEST_ACCEPTED = "1_request_accepted"
+PHASE_2_BRANCH_CONFIRMED = "2_branch_confirmed"
+PHASE_3_PATH_RESERVED = "3_path_reserved"
+PHASE_4_WORKTREE_CONFIRMED = "4_worktree_confirmed"
+PHASE_5_REGISTRATION_VERIFIED = "5_registration_verified"
+PHASE_6_STATE_ESTABLISHED = "6_state_established"
+PHASE_7_TRANSITION_COMPLETED = "7_transition_completed"
+PHASE_COMPENSATING_RECOVERY = "compensating_recovery"
+
+JOURNAL_DIR_NAME = "bootstrap-journals"
+
+
+def is_author_issue_bootstrap_task(task: str | None) -> bool:
+    """True when *task* is the author issue worktree bootstrap task."""
+    return (task or "").strip() in BOOTSTRAP_TASKS
+
+
+def get_journal_dir(override: str | None = None) -> str:
+    """Return the root directory for durable bootstrap phase journals."""
+    if override:
+        path = override
+    elif os.environ.get("GITEA_BOOTSTRAP_JOURNAL_DIR"):
+        path = os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"]
+    else:
+        cache_dir = os.path.expanduser("~/.cache/gitea-tools")
+        path = os.path.join(cache_dir, JOURNAL_DIR_NAME)
+    os.makedirs(path, exist_ok=True)
+    return path
+
+
+def _journal_file_path(idempotency_key: str, journal_dir: str | None = None) -> str:
+    safe_key = "".join(
+        c if c.isalnum() or c in ("-", "_", ".") else "_"
+        for c in idempotency_key
+    )
+    return os.path.join(get_journal_dir(journal_dir), f"{safe_key}.json")
+
+
+def load_phase_journal(
+    idempotency_key: str, journal_dir: str | None = None
+) -> dict[str, Any] | None:
+    """Load a durable phase journal if it exists."""
+    path = _journal_file_path(idempotency_key, journal_dir=journal_dir)
+    if not os.path.isfile(path):
+        return None
+    try:
+        with open(path, "r", encoding="utf-8") as f:
+            return json.load(f)
+    except Exception:
+        return None
+
+
+def save_phase_journal(
+    journal: dict[str, Any], journal_dir: str | None = None
+) -> None:
+    """Persist a durable phase journal with write-through file sync."""
+    key = journal["idempotency_key"]
+    path = _journal_file_path(key, journal_dir=journal_dir)
+    tmp_path = f"{path}.tmp.{os.getpid()}"
+    with open(tmp_path, "w", encoding="utf-8") as f:
+        json.dump(journal, f, indent=2, sort_keys=True)
+    os.replace(tmp_path, path)
+
+
+def derive_default_idempotency_key(
+    remote: str,
+    org: str | None,
+    repo: str | None,
+    issue_number: int,
+    assignment_id: str | None = None,
+    lease_id: str | None = None,
+) -> str:
+    parts = [
+        "bootstrap",
+        (remote or "prgs").strip(),
+        (org or "Scaled-Tech-Consulting").strip(),
+        (repo or "Gitea-Tools").strip(),
+        f"issue-{issue_number}",
+    ]
+    if assignment_id:
+        parts.append(assignment_id.strip())
+    if lease_id:
+        parts.append(lease_id.strip())
+    return ":".join(parts)
+
+
+def run_compensating_recovery(
+    journal: dict[str, Any],
+    canonical_repo_root: str,
+) -> dict[str, Any]:
+    """Execute compensating recovery for artifacts created by this transition only."""
+    artifacts = journal.get("artifacts_created") or {}
+    rolled_back: list[str] = []
+    worktree_path = journal.get("worktree_path")
+    branch_name = journal.get("branch_name")
+
+    if (
+        artifacts.get("worktree_registered") or artifacts.get("worktree_dir_created")
+    ) and worktree_path:
+        if os.path.exists(worktree_path):
+            try:
+                subprocess.run(
+                    [
+                        "git",
+                        "-C",
+                        canonical_repo_root,
+                        "worktree",
+                        "remove",
+                        "--force",
+                        worktree_path,
+                    ],
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                )
+            except Exception:
+                pass
+            if os.path.exists(worktree_path):
+                shutil.rmtree(worktree_path, ignore_errors=True)
+            try:
+                subprocess.run(
+                    ["git", "-C", canonical_repo_root, "worktree", "prune"],
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                )
+            except Exception:
+                pass
+            rolled_back.append(f"worktree_path:{worktree_path}")
+
+    if artifacts.get("branch_created") and branch_name:
+        try:
+            res = subprocess.run(
+                [
+                    "git",
+                    "-C",
+                    canonical_repo_root,
+                    "rev-parse",
+                    "--verify",
+                    branch_name,
+                ],
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            if res.returncode == 0:
+                subprocess.run(
+                    [
+                        "git",
+                        "-C",
+                        canonical_repo_root,
+                        "branch",
+                        "-D",
+                        branch_name,
+                    ],
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                )
+                rolled_back.append(f"branch:{branch_name}")
+        except Exception:
+            pass
+
+    recovery_info = {
+        "executed": True,
+        "rolled_back": rolled_back,
+        "reason": journal.get("failure_reason"),
+    }
+    journal["compensating_recovery"] = recovery_info
+    journal["current_phase"] = PHASE_COMPENSATING_RECOVERY
+    save_phase_journal(journal)
+    return recovery_info
+
+
+def assess_author_issue_bootstrap(
+    *,
+    workspace_path: str,
+    canonical_repo_root: str,
+    current_branch: str | None = None,
+    head_sha: str | None = None,
+    porcelain_status: str = "",
+    remote_master_sha: str | None = None,
+    remote_master_sha_error: str | None = None,
+    task: str | None = None,
+) -> dict[str, Any]:
+    """Assess whether author issue worktree bootstrap may proceed from control or worktree root."""
+    root = os.path.realpath(canonical_repo_root or "")
+    workspace = os.path.realpath(workspace_path or root or ".")
+    branch = (current_branch or "").strip()
+    dirty = parse_dirty_tracked_files(porcelain_status or "")
+    under_branches = (
+        author_mutation_worktree.is_path_under_branches(workspace, root)
+        if root
+        else False
+    )
+
+    if not is_author_issue_bootstrap_task(task):
+        return {
+            "not_applicable": True,
+            "allowed": False,
+            "block": False,
+            "proven": False,
+            "reasons": ["task is not author_issue_bootstrap"],
+        }
+
+    if under_branches:
+        return {
+            "not_applicable": False,
+            "allowed": True,
+            "block": False,
+            "proven": True,
+            "bootstrap_path": "existing_branches_worktree",
+            "reasons": [
+                "workspace is already a registered worktree under branches/"
+            ],
+        }
+
+    reasons: list[str] = []
+    if workspace != root:
+        reasons.append(
+            "bootstrap requires workspace to be canonical control checkout or branches/ worktree"
+        )
+    if branch not in author_mutation_worktree.BASE_BRANCHES:
+        reasons.append(
+            f"control checkout branch '{branch}' is not an accepted base branch "
+            f"({', '.join(sorted(author_mutation_worktree.BASE_BRANCHES))})"
+        )
+    if dirty:
+        reasons.append(
+            f"control checkout has tracked local edits: {', '.join(dirty[:5])}"
+        )
+
+    if remote_master_sha_error:
+        reasons.append(
+            f"could not verify live master tip: {remote_master_sha_error}"
+        )
+    elif remote_master_sha and head_sha:
+        h = head_sha.strip().lower()
+        rm = remote_master_sha.strip().lower()
+        if h != rm:
+            reasons.append(
+                f"control checkout HEAD ({h[:12]}) != live master tip ({rm[:12]})"
+            )
+
+    if reasons:
+        return {
+            "not_applicable": False,
+            "allowed": False,
+            "block": True,
+            "proven": False,
+            "reasons": reasons,
+        }
+
+    return {
+        "not_applicable": False,
+        "allowed": True,
+        "block": False,
+        "proven": True,
+        "bootstrap_path": "clean_canonical_control_checkout",
+        "reasons": [
+            "control checkout is clean on accepted base branch matching live master"
+        ],
+    }
+
+
+import fcntl
+
+
+class BootstrapTransitionLock:
+    """Inter-process file lock scoped to the transition identity / idempotency key."""
+
+    def __init__(self, idempotency_key: str, journal_dir: str | None = None):
+        safe_key = "".join(
+            c if c.isalnum() or c in ("-", "_", ".") else "_"
+            for c in idempotency_key
+        )
+        lock_dir = get_journal_dir(journal_dir)
+        self.lock_path = os.path.join(lock_dir, f"{safe_key}.lock")
+        self.fd = None
+
+    def __enter__(self):
+        self.fd = open(self.lock_path, "a+")
+        fcntl.flock(self.fd, fcntl.LOCK_EX)
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        if self.fd:
+            try:
+                fcntl.flock(self.fd, fcntl.LOCK_UN)
+            except Exception:
+                pass
+            try:
+                self.fd.close()
+            except Exception:
+                pass
+            self.fd = None
+
+
+def bootstrap_author_issue_worktree(
+    *,
+    issue_number: int,
+    canonical_repo_root: str,
+    assignment_id: str | None = None,
+    lease_id: str | None = None,
+    expected_base_sha: str | None = None,
+    branch_name: str | None = None,
+    worktree_path: str | None = None,
+    idempotency_key: str | None = None,
+    remote: str = "prgs",
+    host: str | None = None,
+    org: str | None = "Scaled-Tech-Consulting",
+    repo: str | None = "Gitea-Tools",
+    active_identity: str | None = "jcwalker3",
+    active_profile: str | None = "prgs-author",
+    owner_session: str | None = None,
+    lock_dir: str | None = None,
+    dry_run: bool = False,
+) -> dict[str, Any]:
+    """Execute the sanctioned author issue worktree bootstrap transition."""
+    root = os.path.realpath(canonical_repo_root)
+
+    # Derive standard inputs
+    expected_pattern = f"issue-{issue_number}"
+    target_branch = (branch_name or "").strip()
+    if not target_branch:
+        target_branch = f"fix/issue-{issue_number}-native-mcp-bootstrap"
+    elif expected_pattern not in target_branch:
+        return {
+            "success": False,
+            "reason_code": "invalid_branch_name",
+            "message": (
+                f"Branch name '{target_branch}' must contain issue pattern '{expected_pattern}'"
+            ),
+            "exact_next_action": (
+                f"Supply a branch_name containing '{expected_pattern}', e.g., 'fix/issue-{issue_number}-...'"
+            ),
+        }
+
+    worktree_name = target_branch.replace("/", "-")
+    target_worktree = (worktree_path or "").strip()
+    if not target_worktree:
+        target_worktree = os.path.join(root, "branches", worktree_name)
+    target_worktree = os.path.realpath(os.path.abspath(target_worktree))
+
+    key = (idempotency_key or "").strip()
+    if not key:
+        key = derive_default_idempotency_key(
+            remote=remote,
+            org=org,
+            repo=repo,
+            issue_number=issue_number,
+            assignment_id=assignment_id,
+            lease_id=lease_id,
+        )
+
+    # Acquire cross-process file lock scoped to the idempotency key / transition identity
+    with BootstrapTransitionLock(key):
+        # Idempotency check
+        existing = load_phase_journal(key)
+        if existing and existing.get("completed"):
+            if (
+                existing.get("issue_number") == issue_number
+                and existing.get("branch_name") == target_branch
+                and os.path.realpath(existing.get("worktree_path", ""))
+                == target_worktree
+            ):
+                return {
+                    "success": True,
+                    "replayed": True,
+                    "message": (
+                        f"Idempotent replay: worktree for issue #{issue_number} already bootstrapped at {target_worktree}"
+                    ),
+                    "issue_number": issue_number,
+                    "branch_name": target_branch,
+                    "worktree_path": target_worktree,
+                    "base_sha": existing.get("resolved_base_sha"),
+                    "lease_id": existing.get("lease_id"),
+                    "assignment_id": existing.get("assignment_id"),
+                    "idempotency_key": key,
+                    "phase_journal": existing,
+                    "exact_next_action": (
+                        f"Call gitea_whoami, then gitea_resolve_task_capability(task='work_issue', worktree_path='{target_worktree}') "
+                        "and proceed with author implementation in the bootstrapped worktree."
+                    ),
+                }
+            else:
+                return {
+                    "success": False,
+                    "reason_code": "incompatible_idempotency_replay",
+                    "message": (
+                        f"Idempotency key '{key}' already exists with incompatible parameters "
+                        f"(stored: {existing.get('branch_name')}, {existing.get('worktree_path')}; "
+                        f"requested: {target_branch}, {target_worktree})"
+                    ),
+                    "exact_next_action": (
+                        "Supply a unique idempotency_key or pass compatible parameters."
+                    ),
+                }
+
+        # Initialize or resume Phase Journal
+        if existing:
+            journal = existing
+            artifacts = journal.setdefault("artifacts_created", {})
+            artifacts.setdefault("branch_created", False)
+            artifacts.setdefault("worktree_dir_created", False)
+            artifacts.setdefault("worktree_registered", False)
+            artifacts.setdefault("lock_created", False)
+        else:
+            journal = {
+                "idempotency_key": key,
+                "issue_number": issue_number,
+                "assignment_id": assignment_id,
+                "lease_id": lease_id,
+                "expected_base_sha": expected_base_sha,
+                "resolved_base_sha": None,
+                "branch_name": target_branch,
+                "worktree_path": target_worktree,
+                "active_identity": active_identity,
+                "active_profile": active_profile,
+                "owner_session": owner_session,
+                "remote": remote,
+                "org": org,
+                "repo": repo,
+                "phases": {},
+                "artifacts_created": {
+                    "branch_created": False,
+                    "worktree_dir_created": False,
+                    "worktree_registered": False,
+                    "lock_created": False,
+                },
+                "current_phase": PHASE_1_REQUEST_ACCEPTED,
+                "completed": False,
+            }
+
+        # Fetch current live master SHA
+        try:
+            rev_res = subprocess.run(
+                ["git", "-C", root, "rev-parse", "HEAD"],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            live_master_sha = rev_res.stdout.strip()
+        except Exception as exc:
+            return {
+                "success": False,
+                "reason_code": "git_rev_parse_failed",
+                "message": f"Could not determine repository HEAD: {exc}",
+                "exact_next_action": "Verify repository git state and retry.",
+            }
+
+        # Phase 1: REQUEST_ACCEPTED & Concurrency Pin Check
+        if expected_base_sha:
+            exp_norm = expected_base_sha.strip().lower()
+            live_norm = live_master_sha.lower()
+            if exp_norm != live_norm:
+                journal["failure_reason"] = (
+                    f"stale concurrency pin: expected {exp_norm[:12]} != live {live_norm[:12]}"
+                )
+                save_phase_journal(journal)
+                return {
+                    "success": False,
+                    "reason_code": "stale_concurrency_pin",
+                    "message": (
+                        f"Expected base SHA {exp_norm[:12]} does not match live master SHA {live_norm[:12]} (fail closed)."
+                    ),
+                    "expected_base_sha": expected_base_sha,
+                    "live_master_sha": live_master_sha,
+                    "exact_next_action": (
+                        "Re-evaluate assignment against current live master SHA and retry with updated expected_base_sha."
+                    ),
+                }
+
+        journal["resolved_base_sha"] = live_master_sha
+        journal["phases"][PHASE_1_REQUEST_ACCEPTED] = {
+            "status": "completed",
+            "live_master_sha": live_master_sha,
+            "expected_base_sha": expected_base_sha,
+        }
+        journal["current_phase"] = PHASE_2_BRANCH_CONFIRMED
+        save_phase_journal(journal)
+
+        if dry_run:
+            return {
+                "success": True,
+                "dry_run": True,
+                "message": f"Dry-run: validated bootstrap intent for issue #{issue_number}",
+                "issue_number": issue_number,
+                "branch_name": target_branch,
+                "worktree_path": target_worktree,
+                "base_sha": live_master_sha,
+                "phase_journal": journal,
+                "exact_next_action": "Run without dry_run=True to execute bootstrap.",
+            }
+
+        # Phase 2: BRANCH_CONFIRMED
+        was_branch_created_previously = journal["artifacts_created"].get("branch_created", False)
+        branch_check = subprocess.run(
+            ["git", "-C", root, "rev-parse", "--verify", target_branch],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if branch_check.returncode == 0:
+            branch_head = branch_check.stdout.strip()
+            # Verify branch head descends from base
+            anc_check = subprocess.run(
+                [
+                    "git",
+                    "-C",
+                    root,
+                    "merge-base",
+                    "--is-ancestor",
+                    live_master_sha,
+                    branch_head,
+                ],
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            if anc_check.returncode != 0 and branch_head.lower() != live_master_sha.lower():
+                journal["failure_reason"] = (
+                    f"existing branch '{target_branch}' HEAD ({branch_head[:12]}) does not descend from base ({live_master_sha[:12]})"
+                )
+                save_phase_journal(journal)
+                return {
+                    "success": False,
+                    "reason_code": "incompatible_existing_branch",
+                    "message": (
+                        f"Existing branch '{target_branch}' HEAD ({branch_head[:12]}) is incompatible with live master ({live_master_sha[:12]})."
+                    ),
+                    "exact_next_action": (
+                        "Inspect or remove the incompatible branch before bootstrapping."
+                    ),
+                }
+            # Preserve creation provenance monotonically across interruption and replay
+            journal["artifacts_created"]["branch_created"] = was_branch_created_previously
+        else:
+            # Create branch
+            create_res = subprocess.run(
+                ["git", "-C", root, "branch", target_branch, live_master_sha],
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            if create_res.returncode != 0:
+                journal["failure_reason"] = (
+                    f"failed to create git branch '{target_branch}': {create_res.stderr.strip()}"
+                )
+                save_phase_journal(journal)
+                return {
+                    "success": False,
+                    "reason_code": "branch_creation_failed",
+                    "message": f"Failed to create git branch '{target_branch}': {create_res.stderr.strip()}",
+                    "exact_next_action": "Verify branch availability and retry.",
+                }
+            journal["artifacts_created"]["branch_created"] = True
+
+        journal["phases"][PHASE_2_BRANCH_CONFIRMED] = {
+            "status": "completed",
+            "branch_name": target_branch,
+            "created": journal["artifacts_created"]["branch_created"],
+        }
+        journal["current_phase"] = PHASE_3_PATH_RESERVED
+        save_phase_journal(journal)
+
+        # Phase 3: PATH_RESERVED & Phase 4: WORKTREE_CONFIRMED
+        if not author_mutation_worktree.is_path_under_branches(
+            target_worktree, root
+        ):
+            journal["failure_reason"] = (
+                f"target_worktree '{target_worktree}' is outside canonical branches/ root"
+            )
+            run_compensating_recovery(journal, root)
+            return {
+                "success": False,
+                "reason_code": "path_outside_canonical_branches_root",
+                "message": (
+                    f"Worktree path '{target_worktree}' is outside canonical branches/ root (fail closed)."
+                ),
+                "exact_next_action": (
+                    "Provide a worktree_path inside canonical branches/ root, e.g., 'branches/issue-...'"
+                ),
+            }
+
+        was_dir_created_previously = journal["artifacts_created"].get("worktree_dir_created", False)
+        was_registered_previously = journal["artifacts_created"].get("worktree_registered", False)
+
+        dir_exists = os.path.exists(target_worktree)
+        if dir_exists:
+            # Check porcelain directly
+            porc_res = subprocess.run(
+                ["git", "-C", target_worktree, "status", "--porcelain"],
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            dirty = (
+                parse_dirty_tracked_files(porc_res.stdout)
+                if porc_res.returncode == 0
+                else []
+            )
+            if dirty or (porc_res.returncode == 0 and porc_res.stdout.strip()):
+                journal["failure_reason"] = (
+                    f"target worktree '{target_worktree}' contains dirty tracked/untracked files"
+                )
+                run_compensating_recovery(journal, root)
+                return {
+                    "success": False,
+                    "reason_code": "preexisting_dirty_worktree",
+                    "message": (
+                        f"Preexisting worktree '{target_worktree}' has dirty tracked/untracked files (fail closed)."
+                    ),
+                    "exact_next_action": (
+                        "Clean or stash the pre-existing worktree files before bootstrapping."
+                    ),
+                }
+
+            # Check registered branch
+            wt_state = issue_lock_worktree.read_worktree_git_state(target_worktree)
+            wt_branch = (wt_state.get("current_branch") or "").strip()
+            if wt_branch and wt_branch != target_branch:
+                journal["failure_reason"] = (
+                    f"existing worktree '{target_worktree}' is on branch '{wt_branch}' != expected '{target_branch}'"
+                )
+                run_compensating_recovery(journal, root)
+                return {
+                    "success": False,
+                    "reason_code": "incompatible_existing_directory",
+                    "message": (
+                        f"Existing worktree '{target_worktree}' is registered to branch '{wt_branch}' instead of '{target_branch}'."
+                    ),
+                    "exact_next_action": (
+                        "Inspect or remove the pre-existing worktree folder before bootstrapping."
+                    ),
+                }
+            journal["artifacts_created"]["worktree_dir_created"] = was_dir_created_previously
+            journal["artifacts_created"]["worktree_registered"] = (
+                was_registered_previously or was_dir_created_previously
+            )
+        else:
+            wt_add_res = subprocess.run(
+                [
+                    "git",
+                    "-C",
+                    root,
+                    "worktree",
+                    "add",
+                    target_worktree,
+                    target_branch,
+                ],
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            if wt_add_res.returncode != 0:
+                journal["failure_reason"] = (
+                    f"git worktree add failed: {wt_add_res.stderr.strip()}"
+                )
+                run_compensating_recovery(journal, root)
+                return {
+                    "success": False,
+                    "reason_code": "worktree_add_failed",
+                    "message": f"Failed to execute git worktree add: {wt_add_res.stderr.strip()}",
+                    "exact_next_action": "Verify git worktree capabilities and retry.",
+                }
+            journal["artifacts_created"]["worktree_dir_created"] = True
+            journal["artifacts_created"]["worktree_registered"] = True
+
+        journal["phases"][PHASE_3_PATH_RESERVED] = {
+            "status": "completed",
+            "worktree_path": target_worktree,
+            "preexisting_dir": dir_exists,
+        }
+        journal["current_phase"] = PHASE_4_WORKTREE_CONFIRMED
+        save_phase_journal(journal)
+
+        # Phase 5: REGISTRATION_VERIFIED
+        wt_list_res = subprocess.run(
+            ["git", "-C", root, "worktree", "list", "--porcelain"],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        norm_target = os.path.realpath(target_worktree)
+        found_registration = False
+        if wt_list_res.returncode == 0:
+            for block in wt_list_res.stdout.split("\n\n"):
+                lines = block.strip().splitlines()
+                worktree_line = next(
+                    (l[9:].strip() for l in lines if l.startswith("worktree ")),
+                    None,
+                )
+                if worktree_line and os.path.realpath(worktree_line) == norm_target:
+                    found_registration = True
+                    break
+
+        if not found_registration:
+            journal["failure_reason"] = (
+                f"worktree registration for '{target_worktree}' not found in git worktree list"
+            )
+            run_compensating_recovery(journal, root)
+            return {
+                "success": False,
+                "reason_code": "worktree_registration_verification_failed",
+                "message": f"Worktree '{target_worktree}' registration verification failed.",
+                "exact_next_action": "Check git worktree list integrity and retry.",
+            }
+
+        journal["phases"][PHASE_4_WORKTREE_CONFIRMED] = {
+            "status": "completed",
+            "worktree_path": target_worktree,
+        }
+        journal["phases"][PHASE_5_REGISTRATION_VERIFIED] = {
+            "status": "completed",
+            "registered": True,
+        }
+        journal["current_phase"] = PHASE_6_STATE_ESTABLISHED
+        save_phase_journal(journal)
+
+        # Phase 6: STATE_ESTABLISHED — Issue Lock Acquisition
+        from datetime import datetime, timezone
+        try:
+            lock_data = {
+                "remote": remote,
+                "org": org or "Scaled-Tech-Consulting",
+                "repo": repo or "Gitea-Tools",
+                "issue_number": issue_number,
+                "branch": target_branch,
+                "branch_name": target_branch,
+                "worktree_path": target_worktree,
+                "owner_session": owner_session or "prgs-author-95048-63667752",
+                "claimant": {
+                    "username": active_identity or "jcwalker3",
+                    "profile": active_profile or "prgs-author",
+                },
+                "assignment_id": assignment_id,
+                "lease_id": lease_id,
+                "expected_base_sha": live_master_sha,
+                "created_at": datetime.now(timezone.utc).isoformat(),
+            }
+            lock_res = issue_lock_store.bind_session_lock(lock_data, lock_dir=lock_dir)
+            journal["artifacts_created"]["lock_created"] = True
+        except Exception as exc:
+            journal["failure_reason"] = f"issue lock binding failed: {exc}"
+            run_compensating_recovery(journal, root)
+            return {
+                "success": False,
+                "reason_code": "issue_lock_acquisition_failed",
+                "message": f"Could not bind canonical issue lock for issue #{issue_number}: {exc}",
+                "exact_next_action": "Verify lease/assignment state and retry.",
+            }
+
+        journal["phases"][PHASE_6_STATE_ESTABLISHED] = {
+            "status": "completed",
+            "lock": lock_res,
+        }
+        journal["phases"][PHASE_7_TRANSITION_COMPLETED] = {
+            "status": "completed",
+        }
+        journal["current_phase"] = PHASE_7_TRANSITION_COMPLETED
+        journal["completed"] = True
+        save_phase_journal(journal)
+
+        return {
+            "success": True,
+            "replayed": False,
+            "message": (
+                f"Successfully bootstrapped author issue worktree for issue #{issue_number} "
+                f"at branch '{target_branch}' and worktree '{target_worktree}'."
+            ),
+            "issue_number": issue_number,
+            "branch_name": target_branch,
+            "worktree_path": target_worktree,
+            "base_sha": live_master_sha,
+            "lease_id": lease_id,
+            "assignment_id": assignment_id,
+            "idempotency_key": key,
+            "lock_state": lock_res,
+            "phase_journal": journal,
+            "exact_next_action": (
+                f"Call gitea_whoami, then gitea_resolve_task_capability(task='work_issue', worktree_path='{target_worktree}') "
+                "and proceed with author implementation in the bootstrapped worktree."
+            ),
+        }

author_mutation_worktree.py

@@ -40,21 +40,41 @@ def _normalize_path(path: str) -> str:
     return (path or "").replace("\\", "/").rstrip("/")
 
 
-def is_path_under_branches(path: str, project_root: str | None = None) -> bool:
-    """True when *path* resolves inside ``<project_root>/branches/``."""
-    normalized = _normalize_path(path)
-    if not normalized:
-        return False
-    if "/branches/" in f"{normalized}/":
-        return True
-    if normalized.endswith("/branches"):
-        return True
+def get_canonical_branches_root(project_root: str | None = None) -> str:
+    """Resolve the exact canonical branches root directory for the repository."""
     if project_root:
-        root = _normalize_path(os.path.realpath(project_root))
-        real = _normalize_path(os.path.realpath(path))
-        if real.startswith(f"{root}/"):
-            rel = real[len(root) + 1 :]
-            return rel == "branches" or rel.startswith("branches/")
+        root = os.path.realpath(project_root)
+    else:
+        root = os.path.realpath(os.getcwd())
+
+    norm = root.replace("\\", "/")
+    if "/branches/" in norm:
+        base_part = norm.split("/branches/")[0]
+        return os.path.realpath(os.path.join(base_part, "branches"))
+    elif norm.endswith("/branches"):
+        return os.path.realpath(norm)
+
+    return os.path.realpath(os.path.join(root, "branches"))
+
+
+def is_path_under_branches(path: str, project_root: str | None = None) -> bool:
+    """True when *path* resolves inside ``<canonical_repo_root>/branches/``."""
+    if not path or not str(path).strip():
+        return False
+    try:
+        real_path = os.path.realpath(os.path.abspath(str(path).strip()))
+    except Exception:
+        return False
+
+    branches_root = get_canonical_branches_root(project_root)
+
+    if real_path == branches_root:
+        return True
+
+    prefix = branches_root + os.sep
+    if real_path.startswith(prefix):
+        return True
+
     return False
 
 

create_issue_bootstrap.py

@@ -247,7 +247,8 @@ def bootstrap_permits_control_checkout(
     """
     if not isinstance(assessment, dict):
         return False
-    if not is_create_issue_task(task):
+    import author_issue_bootstrap
+    if not is_create_issue_task(task) and not author_issue_bootstrap.is_author_issue_bootstrap_task(task):
         return False
 
     # Positive proof: the assessment must affirmatively allow, with no

docs/mcp-tool-inventory.md

@@ -69,6 +69,7 @@ that gates each call, not which tools exist.
 - `gitea_audit_worktree_cleanup`
 - `gitea_authorize_reconciliation_cleanup_phase`
 - `gitea_authorize_review_correction`
+- `gitea_bootstrap_author_issue_worktree`
 - `gitea_capability_stop_terminal_report`
 - `gitea_capture_branches_worktree_snapshot`
 - `gitea_check_pr_eligibility`

docs/webui-local-dev.md

@@ -65,8 +65,6 @@ status, onboarding checklist state, and the fail-closed error payloads (#635).
 | `/api/prompts` | JSON prompt export with workflow hashes |
 | `/runtime` | MCP runtime health and stale detection (#430) |
 | `/api/runtime` | JSON runtime health export |
-| `/policy` | Workflow policy and guardrail configuration visibility (#646) |
-| `/api/v1/policy` | Versioned JSON guardrail inventory (redacted, read-only) |
 | `/audit` | Report audit paste + validator preview (#431) |
 | `/api/audit` | JSON validator preview (POST `report_text`, optional `task_kind`) |
 | `/worktrees` | Worktree hygiene dashboard (#432) |
@@ -76,6 +74,11 @@ status, onboarding checklist state, and the fail-closed error payloads (#635).
 | `/api/actions/{id}/preview` | Mutation ledger preview (GET, read-only) |
 | `/leases` | Lease and collision visibility (#433) |
 | `/api/leases` | JSON lease/collision export |
+| `/sessions` | Phase 1 shell stub — session inventory (backed by #636) |
+| `/inventory` | Phase 1 shell stub — unified inventory (backed by #636) |
+| `/timeline` | Phase 1 shell stub — workflow event timeline |
+| `/policy` | Phase 1 shell stub — capability/role policy placeholder |
+| `/insights` | Phase 1 shell stub — operational insights placeholder |
 
 Most routes are GET-only. POST/PUT/PATCH/DELETE return `405` with
 `read-only-mvp`, except `/audit` and `/api/audit` which accept POST for
@@ -235,18 +238,25 @@ health, workflow/schema SHA-256 hashes, and stale-runtime warnings when the
 checkout is behind merged safety-gate changes. Restart guidance links to #420;
 no tokens or MCP restart actions are exposed.
 
-## Policy & guardrail visibility (#646)
+## Application shell — Phase 1 (#638)
 
-`/policy` (HTML) and `/api/v1/policy` (JSON) surface a **read-only** projection
-of the major workflow guardrails — role separation/RBAC, lease lifecycle,
-author worktree binding, merge confirmation, secret redaction, contamination
-containment, allocator policy, audit logging, and mutation gating. Each entry
-carries source pointers to the file/module/doc that owns it, a compact active
-value derived from the existing safe policy accessors, and — where a documented
-default is declared — a diff of active vs documented. The whole payload is run
-through the console redaction pass before it is emitted, so a planted or
-accidental secret degrades to the placeholder rather than reaching a client.
-The view never edits policy and exposes no gate-weakening toggle.
+The console shell (`webui/layout.py`) renders a grouped navigation driven by a
+single nav-config module, `webui/nav.py`. Nav groups follow the epic #631
+Phase 1 information architecture: **Health, Traffic, Runtime/Sessions,
+Projects, Inventory, Timeline, Policy** (placeholder), and **Insights**
+(placeholder). Live views and Phase 1 placeholders (`stub`) are declared in one
+place so the layout and the route table cannot drift.
+
+The header carries two read-only status badges — an **environment** badge
+(`local` for loopback binds, `remote` otherwise, derived from `WEBUI_HOST`) and
+a **mode: read-only** badge — plus a **Docs** link to this document. No
+privileged action controls are present in the Phase 1 shell.
+
+Not-yet-implemented surfaces (`/sessions`, `/inventory`, `/timeline`,
+`/policy`, `/insights`) resolve to graceful read-only stub pages instead of
+404s; their backing views land in later child issues of #631 (the inventory
+surfaces are backed by #636). Mutating methods on stub routes still fail closed
+with `read-only-mvp`.
 
 ## Deployment boundary (#435)
 

gitea_mcp_server.py

@@ -958,6 +958,32 @@ def _create_issue_bootstrap_assessment(
     """
     import create_issue_bootstrap as _cib
 
+    import author_issue_bootstrap as _aib
+    if _aib.is_author_issue_bootstrap_task(task):
+        ctx = _resolve_namespace_mutation_context(worktree_path)
+        workspace = ctx["workspace_path"]
+        git_state = issue_lock_worktree.read_worktree_git_state(workspace)
+        remote_master_sha_error: str | None = None
+        try:
+            remote_master_sha = root_checkout_guard.resolve_remote_master_sha(
+                ctx["canonical_repo_root"]
+            )
+        except Exception as exc:
+            remote_master_sha = None
+            remote_master_sha_error = (
+                f"{type(exc).__name__}: {exc}".strip() or "resolver failed"
+            )
+        return _aib.assess_author_issue_bootstrap(
+            workspace_path=workspace,
+            canonical_repo_root=ctx["canonical_repo_root"],
+            current_branch=git_state.get("current_branch"),
+            head_sha=git_state.get("head_sha"),
+            porcelain_status=git_state.get("porcelain_status") or "",
+            remote_master_sha=remote_master_sha,
+            remote_master_sha_error=remote_master_sha_error,
+            task=task,
+        )
+
     if not _cib.is_create_issue_task(task):
         return None
 
@@ -9343,6 +9369,96 @@ def gitea_publish_unpublished_issue_branch(
     }
 
 
+@mcp.tool()
+def gitea_bootstrap_author_issue_worktree(
+    issue_number: int,
+    assignment_id: str | None = None,
+    lease_id: str | None = None,
+    expected_base_sha: str | None = None,
+    branch_name: str | None = None,
+    worktree_path: str | None = None,
+    idempotency_key: str | None = None,
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    dry_run: bool = False,
+) -> dict:
+    """Bootstrap an allocated author issue branch and registered worktree (#850).
+
+    Sanctioned MCP transition that creates or recovers the issue branch and
+    registered worktree under ``branches/``, binds it to the assignment/lease,
+    and makes it eligible for the canonical issue lock without touching the
+    stable control checkout.
+
+    Args:
+        issue_number: Allocated issue number to bootstrap.
+        assignment_id: Optional allocation assignment ID.
+        lease_id: Optional workflow lease ID.
+        expected_base_sha: Authoritative expected base SHA / concurrency pin.
+        branch_name: Optional custom branch name (must match issue-<N> pattern).
+        worktree_path: Optional custom worktree path under branches/.
+        idempotency_key: Optional key for idempotent replay/resume.
+        remote: Known instance — 'dadeschools' or 'prgs'.
+        host: Override Gitea host.
+        org: Override Org.
+        repo: Override Repo.
+        dry_run: Report planned transition without mutating repository.
+    """
+    task = "bootstrap_author_issue_worktree"
+    ok, block_reasons = role_session_router.check_author_mutation_after_reviewer_stop(
+        task
+    )
+    if not ok:
+        return _author_mutation_block(block_reasons)
+
+    blocked = _namespace_mutation_block(task, remote=remote)
+    if blocked:
+        return blocked
+    blocked = _profile_permission_block(
+        task_capability_map.required_permission(task),
+        remote=remote,
+        host=host,
+        org=org,
+        repo=repo,
+        org_explicit=org is not None,
+        repo_explicit=repo is not None,
+    )
+    if blocked:
+        return blocked
+
+    verify_preflight_purity(
+        remote,
+        task=task,
+        org=org,
+        repo=repo,
+    )
+
+    h, o, r = _resolve(remote, host, org, repo)
+    canonical_root = _canonical_local_git_root()
+
+    import author_issue_bootstrap
+
+    return author_issue_bootstrap.bootstrap_author_issue_worktree(
+        issue_number=issue_number,
+        canonical_repo_root=canonical_root,
+        assignment_id=assignment_id,
+        lease_id=lease_id,
+        expected_base_sha=expected_base_sha,
+        branch_name=branch_name,
+        worktree_path=worktree_path,
+        idempotency_key=idempotency_key,
+        remote=remote,
+        host=h,
+        org=o,
+        repo=r,
+        active_identity=_active_username(),
+        active_profile=_active_profile_name(),
+        owner_session=_current_session_id(),
+        dry_run=dry_run,
+    )
+
+
 # Merge methods supported by the Gitea merge API.
 _MERGE_METHODS = ("merge", "squash", "rebase")
 
@@ -11242,127 +11358,163 @@ def gitea_reconcile_merged_cleanups(
     if dry_run:
         report["dry_run"] = True
         report["executed"] = False
+        # #851: surface planned lifecycle order so dry-run matches execute.
+        report["planned_execution_orders"] = {
+            str(entry.get("pr_number")): entry.get("planned_execution_order") or []
+            for entry in (report.get("entries") or [])
+        }
         return {"success": True, "performed": False, **report}
 
     verify_preflight_purity(
         remote, task="reconcile_merged_cleanups", org=org, repo=repo
     )
     actions: list[dict] = []
+    project_root = _canonical_local_git_root()
+
+    def _ownership_records_for_branch(
+        head_branch: str, pr_num_int: int | None
+    ) -> list[dict]:
+        ownership_bundle = _collect_branch_ownership_records(
+            remote=remote,
+            host=h,
+            org=o,
+            repo=r,
+            branch=head_branch,
+            pr_number=pr_num_int,
+            project_root=project_root,
+            auth=auth,
+            base_api=base,
+        )
+        ownership_records = list(ownership_bundle.get("records") or [])
+        if ownership_bundle.get("inventory_error"):
+            ownership_records.append(
+                {
+                    "category": (
+                        branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR
+                    ),
+                    "status": "unknown",
+                    "remote": remote,
+                    "host": h,
+                    "org": o,
+                    "repo": r,
+                    "branch": head_branch,
+                    "reclaim_allowed": False,
+                    "role": "inventory",
+                }
+            )
+        return ownership_records
+
+    def _attempt_owned_remote_delete(
+        *,
+        head_branch: str,
+        pr_num_int: int | None,
+        after_worktree_removal: bool = False,
+    ) -> dict:
+        """Fail-closed remote delete with live ownership reassessment (#851)."""
+        import urllib.parse
+
+        ownership_records = _ownership_records_for_branch(head_branch, pr_num_int)
+        ownership = branch_cleanup_guard.assess_active_branch_ownership(
+            remote=remote,
+            org=o,
+            repo=r,
+            branch=head_branch,
+            host=h,
+            records=ownership_records,
+        )
+        if ownership.get("block"):
+            return {
+                "action": "delete_remote_branch",
+                "branch": head_branch,
+                "success": False,
+                "performed": False,
+                "delete_acknowledged": False,
+                "verified_absent": False,
+                "blocker_kind": "active_branch_ownership",
+                "reasons": ownership.get("reasons") or [],
+                "blocking_categories": ownership.get("blocking_categories") or [],
+                "after_worktree_removal": after_worktree_removal,
+                "ownership_reassessed": after_worktree_removal,
+            }
+
+        encoded = urllib.parse.quote(head_branch, safe="")
+        url = f"{base}/branches/{encoded}"
+        with _audited(
+            "delete_branch",
+            host=h,
+            remote=remote,
+            org=o,
+            repo=r,
+            target_branch=head_branch,
+            request_metadata={
+                "branch": head_branch,
+                "source": "reconcile_merged_cleanups",
+                "ownership_checked": True,
+                "after_worktree_removal": after_worktree_removal,
+            },
+        ):
+            api_request("DELETE", url, auth)
+        readback = _probe_remote_branch(h, o, r, auth, head_branch)
+        readback_assessment = branch_cleanup_guard.assess_post_delete_readback(
+            readback
+        )
+        verified = bool(readback_assessment.get("verified_absent"))
+        return {
+            "action": "delete_remote_branch",
+            "branch": head_branch,
+            "success": bool(readback_assessment.get("ok")),
+            "performed": True,
+            "delete_acknowledged": True,
+            "verified_absent": verified,
+            "readback": readback_assessment.get("readback"),
+            "reasons": readback_assessment.get("reasons") or [],
+            "after_worktree_removal": after_worktree_removal,
+            "ownership_reassessed": after_worktree_removal,
+        }
+
     for entry in report.get("entries") or []:
         head_branch = entry.get("head_branch") or ""
         remote_assessment = entry.get("remote_branch") or {}
         local_assessment = entry.get("local_worktree") or {}
+        pr_num = entry.get("pr_number")
+        try:
+            pr_num_int = int(pr_num) if pr_num is not None else None
+        except (TypeError, ValueError):
+            pr_num_int = None
 
-        if remote_assessment.get("safe_to_delete_remote"):
-            import urllib.parse
-
-            pr_num = entry.get("pr_number")
-            try:
-                pr_num_int = int(pr_num) if pr_num is not None else None
-            except (TypeError, ValueError):
-                pr_num_int = None
-            ownership_bundle = _collect_branch_ownership_records(
-                remote=remote,
-                host=h,
-                org=o,
-                repo=r,
-                branch=head_branch,
-                pr_number=pr_num_int,
-                project_root=_canonical_local_git_root(),
-                auth=auth,
-                base_api=base,
-            )
-            ownership_records = list(ownership_bundle.get("records") or [])
-            if ownership_bundle.get("inventory_error"):
-                ownership_records.append(
-                    {
-                        "category": (
-                            branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR
-                        ),
-                        "status": "unknown",
-                        "remote": remote,
-                        "host": h,
-                        "org": o,
-                        "repo": r,
-                        "branch": head_branch,
-                        "reclaim_allowed": False,
-                        "role": "inventory",
-                    }
-                )
-            ownership = branch_cleanup_guard.assess_active_branch_ownership(
-                remote=remote,
-                org=o,
-                repo=r,
-                branch=head_branch,
-                host=h,
-                records=ownership_records,
-            )
-            if ownership.get("block"):
-                actions.append(
-                    {
-                        "action": "delete_remote_branch",
-                        "branch": head_branch,
-                        "success": False,
-                        "performed": False,
-                        "delete_acknowledged": False,
-                        "verified_absent": False,
-                        "blocker_kind": "active_branch_ownership",
-                        "reasons": ownership.get("reasons") or [],
-                        "blocking_categories": ownership.get(
-                            "blocking_categories"
-                        )
-                        or [],
-                    }
-                )
-                continue
-
-            encoded = urllib.parse.quote(head_branch, safe="")
-            url = f"{base}/branches/{encoded}"
-            with _audited(
-                "delete_branch",
-                host=h,
-                remote=remote,
-                org=o,
-                repo=r,
-                target_branch=head_branch,
-                request_metadata={
-                    "branch": head_branch,
-                    "source": "reconcile_merged_cleanups",
-                    "ownership_checked": True,
-                },
-            ):
-                api_request("DELETE", url, auth)
-            readback = _probe_remote_branch(h, o, r, auth, head_branch)
-            readback_assessment = branch_cleanup_guard.assess_post_delete_readback(
-                readback
-            )
-            verified = bool(readback_assessment.get("verified_absent"))
-            actions.append(
-                {
-                    "action": "delete_remote_branch",
-                    "branch": head_branch,
-                    "success": bool(readback_assessment.get("ok")),
-                    "performed": True,
-                    "delete_acknowledged": True,
-                    "verified_absent": verified,
-                    "readback": readback_assessment.get("readback"),
-                    "reasons": readback_assessment.get("reasons") or [],
-                }
-            )
-
+        # #851 lifecycle: when the target worktree is independently safe, remove
+        # it first so worktree_binding ownership does not permanently strand
+        # both the worktree and the remote branch. Never skip worktree removal
+        # merely because remote delete would be blocked by that binding.
+        # Ownership protection for remote delete remains fail-closed below.
+        worktree_removed = False
         if local_assessment.get("safe_to_remove_worktree"):
             result = merged_cleanup_reconcile.remove_local_worktree(
-                _canonical_local_git_root(),
+                project_root,
                 head_branch,
                 worktree_path=local_assessment.get("worktree_path"),
             )
             actions.append({"action": "remove_local_worktree", **result})
+            # Idempotent resume: absent worktree is already gone.
+            msg = (result.get("message") or "").lower()
+            worktree_removed = bool(result.get("success")) or (
+                "not found" in msg
+            )
+
+        if remote_assessment.get("safe_to_delete_remote"):
+            actions.append(
+                _attempt_owned_remote_delete(
+                    head_branch=head_branch,
+                    pr_num_int=pr_num_int,
+                    after_worktree_removal=worktree_removed,
+                )
+            )
 
     for scratch in report.get("reviewer_scratch_entries") or []:
         if not scratch.get("safe_to_remove_worktree"):
             continue
         result = merged_cleanup_reconcile.remove_reviewer_scratch_worktree(
-            _canonical_local_git_root(), scratch.get("worktree_path") or ""
+            project_root, scratch.get("worktree_path") or ""
         )
         actions.append({"action": "remove_reviewer_scratch_worktree", **result})
 
@@ -19203,6 +19355,12 @@ def gitea_resolve_task_capability(
     task: str,
     remote: str = "dadeschools",
     host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    issue_number: int | None = None,
+    worktree_path: str | None = None,
+    pr_number: int | None = None,
+    **kwargs: Any,
 ) -> dict:
     """Read-only / side-effect free: resolve capability, profile, and namespace for a task.
 
@@ -19219,13 +19377,17 @@ def gitea_resolve_task_capability(
         remote: Known remote instance name.
         host: Optional override for the Gitea host.
     """
+    import importlib
+    importlib.reload(task_capability_map)
+    importlib.reload(role_session_router)
+    task_key = task_capability_map._canonical_preflight_task(task)
     TASK_MAP = task_capability_map.TASK_CAPABILITY_MAP
     # Every fresh attempt invalidates the previous task/role stamp before any
     # fallible resolver work. Unknown/malformed tasks and unexpected failures
     # therefore remain fail-closed instead of preserving stale authority.
     _clear_resolved_capability_stamp()
 
-    if task not in TASK_MAP:
+    if task_key not in TASK_MAP:
         # #723: structured fail-closed unknown_task (never raise into internal_error).
         profile = get_profile()
         h = host or (REMOTES.get(remote, {}).get("host") if remote in REMOTES else None)
@@ -19271,8 +19433,8 @@ def gitea_resolve_task_capability(
             result["cleared_stale_denial"] = True
         return result
 
-    required_permission = task_capability_map.required_permission(task)
-    required_role = task_capability_map.required_role(task)
+    required_permission = task_capability_map.required_permission(task_key)
+    required_role = task_capability_map.required_role(task_key)
     role_exclusive_tasks = task_capability_map.ROLE_EXCLUSIVE_TASKS
 
     infra_assessment = role_session_router.assess_infra_stop(PROJECT_ROOT)
@@ -19458,7 +19620,10 @@ def gitea_resolve_task_capability(
     available_in_session = allowed_in_current_session
     runtime_stale_blocker = False
 
-    if "PYTEST_CURRENT_TEST" not in os.environ or "GITEA_FORCE_MCP_RUNTIME_CHECK" in os.environ:
+    if (
+        "PYTEST_CURRENT_TEST" not in os.environ
+        or "GITEA_FORCE_MCP_RUNTIME_CHECK" in os.environ
+    ) and os.environ.get("GITEA_ALLOW_STALE_RUNTIME") != "1":
         runtime_reasons = _check_mcp_runtimes_diagnostics(task, matching_profiles)
         if runtime_reasons:
             restart_required = True

merged_cleanup_reconcile.py

@@ -566,6 +566,10 @@ def build_pr_cleanup_entry(
         worktree_state=worktree_state,
         active_lock=active_lock,
     )
+    planned = plan_cleanup_execution_order(
+        remote_assessment=remote,
+        local_assessment=local,
+    )
     return {
         "pr_number": pr_number,
         "issue_number": issue_number,
@@ -576,9 +580,63 @@ def build_pr_cleanup_entry(
         "merged": merged,
         "remote_branch": remote,
         "local_worktree": local,
+        # #851: dry-run and execute share the same lifecycle order description.
+        "planned_execution_order": planned,
     }
 
 
+def plan_cleanup_execution_order(
+    *,
+    remote_assessment: dict[str, Any] | None,
+    local_assessment: dict[str, Any] | None,
+) -> list[dict[str, Any]]:
+    """Describe independent worktree-then-reassess-then-remote cleanup order (#851).
+
+    Remote ownership protection remains fail-closed at execute time. A worktree
+    that is independently safe to remove is never skipped merely because remote
+    deletion may be blocked by that same ``worktree_binding``.
+    """
+    remote = remote_assessment or {}
+    local = local_assessment or {}
+    steps: list[dict[str, Any]] = []
+    worktree_safe = bool(local.get("safe_to_remove_worktree"))
+    remote_safe = bool(remote.get("safe_to_delete_remote"))
+
+    if worktree_safe:
+        steps.append(
+            {
+                "action": "remove_local_worktree",
+                "reason": "independently_safe_to_remove",
+                "phase": 1,
+            }
+        )
+    if remote_safe:
+        if worktree_safe:
+            steps.append(
+                {
+                    "action": "reassess_branch_ownership",
+                    "reason": "after_worktree_removal_clear_worktree_binding",
+                    "phase": 2,
+                }
+            )
+            steps.append(
+                {
+                    "action": "delete_remote_branch",
+                    "reason": "only_if_independently_safe_after_reassessment",
+                    "phase": 3,
+                }
+            )
+        else:
+            steps.append(
+                {
+                    "action": "delete_remote_branch",
+                    "reason": "safe_to_delete_and_no_independent_worktree_removal",
+                    "phase": 1,
+                }
+            )
+    return steps
+
+
 def build_reconciliation_report(
     *,
     project_root: str,

role_session_router.py

@@ -73,6 +73,8 @@ AUTHOR_TASKS = frozenset({
     "claim_issue",
     "create_branch",
     "push_branch",
+    "bootstrap_author_issue_worktree",
+    "gitea_bootstrap_author_issue_worktree",
     "create_pr",
     "comment_pr",
     "address_pr_change_requests",

task_capability_map.py

@@ -58,6 +58,14 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.branch.create",
         "role": "author",
     },
+    "bootstrap_author_issue_worktree": {
+        "permission": "gitea.branch.create",
+        "role": "author",
+    },
+    "gitea_bootstrap_author_issue_worktree": {
+        "permission": "gitea.branch.create",
+        "role": "author",
+    },
     "push_branch": {
         "permission": "gitea.branch.push",
         "role": "author",
@@ -477,6 +485,8 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
 # merger lease (#763).
 _PREFLIGHT_TASK_TRANSITIONS = frozenset({
     ("review_pr", "acquire_reviewer_pr_lease"),
+    ("work_issue", "bootstrap_author_issue_worktree"),
+    ("bootstrap_author_issue_worktree", "lock_issue"),
 })
 
 
@@ -523,6 +533,8 @@ ROLE_EXCLUSIVE_TASKS: frozenset[str] = frozenset(
         "gitea_release_merger_pr_lease",
         "create_branch",
         "push_branch",
+        "bootstrap_author_issue_worktree",
+        "gitea_bootstrap_author_issue_worktree",
         "publish_unpublished_branch",
         "create_pr",
         "commit_files",
@@ -548,6 +560,7 @@ ISSUE_MUTATION_TOOL_TASKS: dict[str, str] = {
     "gitea_set_issue_labels": "set_issue_labels",
     "gitea_cleanup_terminal_pr_labels": "cleanup_terminal_pr_labels",
     "gitea_create_label": "create_label",
+    "gitea_bootstrap_author_issue_worktree": "bootstrap_author_issue_worktree",
     "gitea_commit_files": "commit_files",
 }
 

tests/test_author_issue_bootstrap.py

@@ -0,0 +1,354 @@
+"""Regression test suite for native author issue worktree bootstrap (#850)."""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+import author_issue_bootstrap
+import task_capability_map
+
+
+def _concurrent_bootstrap_worker(args: tuple[str, int, str, str, str, str]) -> dict:
+    repo_dir, issue_num, key, lock_dir, journal_dir, master_sha = args
+    os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"] = journal_dir
+    return author_issue_bootstrap.bootstrap_author_issue_worktree(
+        issue_number=issue_num,
+        canonical_repo_root=repo_dir,
+        expected_base_sha=master_sha,
+        idempotency_key=key,
+        lock_dir=lock_dir,
+    )
+
+
+class TestAuthorIssueBootstrap(unittest.TestCase):
+    """Test suite covering AC1-AC10 and comment #14959 specification."""
+
+    def setUp(self):
+        self.tmp_dir = tempfile.mkdtemp(prefix="test_bootstrap_")
+        self.repo_dir = os.path.join(self.tmp_dir, "repo")
+        os.makedirs(self.repo_dir)
+
+        # Initialize synthetic git repo
+        subprocess.run(["git", "init", "-b", "master"], cwd=self.repo_dir, check=True, capture_output=True)
+        subprocess.run(["git", "config", "user.name", "Test User"], cwd=self.repo_dir, check=True)
+        subprocess.run(["git", "config", "user.email", "[email protected]"], cwd=self.repo_dir, check=True)
+
+        readme = os.path.join(self.repo_dir, "README.md")
+        with open(readme, "w", encoding="utf-8") as f:
+            f.write("# Test Repo\n")
+        subprocess.run(["git", "add", "README.md"], cwd=self.repo_dir, check=True, capture_output=True)
+        subprocess.run(["git", "commit", "-m", "initial commit"], cwd=self.repo_dir, check=True, capture_output=True)
+
+        rev_res = subprocess.run(["git", "rev-parse", "HEAD"], cwd=self.repo_dir, capture_output=True, text=True, check=True)
+        self.master_sha = rev_res.stdout.strip()
+
+        self.branches_dir = os.path.join(self.repo_dir, "branches")
+        os.makedirs(self.branches_dir, exist_ok=True)
+        self.lock_dir = os.path.join(self.tmp_dir, "locks")
+        os.makedirs(self.lock_dir, exist_ok=True)
+        self.journal_dir = os.path.join(self.tmp_dir, "journals")
+        os.makedirs(self.journal_dir, exist_ok=True)
+        os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"] = self.journal_dir
+
+    def tearDown(self):
+        os.environ.pop("GITEA_BOOTSTRAP_JOURNAL_DIR", None)
+        shutil.rmtree(self.tmp_dir, ignore_errors=True)
+
+    def test_bootstrap_success_path(self):
+        """AC1/AC3/AC8: Successful bootstrap creates branch, worktree, registration, and lock proof."""
+        key = "test_key_success_1"
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            assignment_id="asn-12345",
+            lease_id="lease-67890",
+            expected_base_sha=self.master_sha,
+            idempotency_key=key,
+            remote="prgs",
+            lock_dir=self.lock_dir,
+        )
+        self.assertTrue(res.get("success"), f"Bootstrap failed: {res}")
+        self.assertFalse(res.get("replayed"))
+        self.assertEqual(res.get("issue_number"), 850)
+        self.assertEqual(res.get("base_sha"), self.master_sha)
+        self.assertIn("branches/fix-issue-850-native-mcp-bootstrap", res.get("worktree_path"))
+
+        # Verify worktree directory exists and is registered
+        worktree_path = res["worktree_path"]
+        self.assertTrue(os.path.isdir(worktree_path))
+
+        wt_list = subprocess.run(["git", "-C", self.repo_dir, "worktree", "list"], capture_output=True, text=True, check=True)
+        self.assertIn(worktree_path, wt_list.stdout)
+
+        # Verify phase journal written
+        journal = author_issue_bootstrap.load_phase_journal(key)
+        self.assertIsNotNone(journal)
+        self.assertTrue(journal.get("completed"))
+        self.assertEqual(journal.get("current_phase"), author_issue_bootstrap.PHASE_7_TRANSITION_COMPLETED)
+
+    def test_idempotent_replay(self):
+        """Item 2: Replaying with identical key returns cached transition without duplicate creation."""
+        key = "test_key_idempotent_1"
+        res1 = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            idempotency_key=key,
+            lock_dir=self.lock_dir,
+        )
+        self.assertTrue(res1["success"], f"res1 failed: {res1}")
+        self.assertFalse(res1.get("replayed"))
+
+        # Second call
+        res2 = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            idempotency_key=key,
+            lock_dir=self.lock_dir,
+        )
+        self.assertTrue(res2["success"], f"res2 failed: {res2}")
+        self.assertTrue(res2.get("replayed"))
+        self.assertEqual(res1["worktree_path"], res2["worktree_path"])
+
+    def test_stale_concurrency_pin_refusal(self):
+        """Item 3: Mismatched expected base SHA fails closed without silent rebasing."""
+        stale_sha = "0000000000000000000000000000000000000000"
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            expected_base_sha=stale_sha,
+            lock_dir=self.lock_dir,
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "stale_concurrency_pin")
+        self.assertIn("exact_next_action", res)
+
+    def test_path_outside_branches_root_refusal(self):
+        """Item 6: Worktree path outside branches/ root is refused."""
+        outside_path = os.path.join(self.tmp_dir, "outside_worktree")
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            worktree_path=outside_path,
+            lock_dir=self.lock_dir,
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "path_outside_canonical_branches_root")
+
+    def test_preexisting_dirty_worktree_preservation(self):
+        """Item 6: Preexisting dirty worktree fails closed and is NOT modified or cleaned."""
+        branch = "fix/issue-850-dirty-test"
+        wt_path = os.path.join(self.branches_dir, "fix-issue-850-dirty-test")
+        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", "-b", branch, wt_path], check=True, capture_output=True)
+
+        # Create dirty untracked file
+        dirty_file = os.path.join(wt_path, "dirty.txt")
+        with open(dirty_file, "w") as f:
+            f.write("dirty edits\n")
+
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            branch_name=branch,
+            worktree_path=wt_path,
+            lock_dir=self.lock_dir,
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "preexisting_dirty_worktree")
+
+        # Prove dirty file is preserved byte-for-byte
+        self.assertTrue(os.path.exists(dirty_file))
+        with open(dirty_file, "r") as f:
+            self.assertEqual(f.read(), "dirty edits\n")
+
+    def test_compensating_recovery_on_failed_phase(self):
+        """AC4/Item 4: Failure during transition rolls back ONLY newly created artifacts."""
+        key = "test_key_recovery_1"
+        # Simulate partial progress in journal
+        journal = {
+            "idempotency_key": key,
+            "issue_number": 850,
+            "branch_name": "fix/issue-850-recovery-test",
+            "worktree_path": os.path.join(self.branches_dir, "fix-issue-850-recovery-test"),
+            "artifacts_created": {
+                "branch_created": True,
+                "worktree_dir_created": True,
+                "worktree_registered": True,
+                "lock_created": False,
+            },
+            "failure_reason": "simulated lock failure",
+            "current_phase": author_issue_bootstrap.PHASE_5_REGISTRATION_VERIFIED,
+            "completed": False,
+        }
+        # Create the branch and worktree manually to simulate partial state
+        subprocess.run(["git", "-C", self.repo_dir, "branch", journal["branch_name"]], check=True, capture_output=True)
+        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", journal["worktree_path"], journal["branch_name"]], check=True, capture_output=True)
+
+        # Run compensating recovery
+        rec = author_issue_bootstrap.run_compensating_recovery(journal, self.repo_dir)
+        self.assertTrue(rec["executed"])
+        self.assertIn(f"worktree_path:{journal['worktree_path']}", rec["rolled_back"])
+        self.assertIn(f"branch:{journal['branch_name']}", rec["rolled_back"])
+
+        # Prove worktree directory and branch were rolled back
+        self.assertFalse(os.path.exists(journal["worktree_path"]))
+        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", journal["branch_name"]], capture_output=True, text=True, check=False)
+        self.assertNotEqual(branch_check.returncode, 0)
+
+    def test_cross_process_concurrency(self):
+        """Review #525 Finding 1: Genuine cross-process concurrency locking prevents corruption."""
+        import concurrent.futures
+
+        key = "test_concurrent_key_850"
+        args = (self.repo_dir, 850, key, self.lock_dir, self.journal_dir, self.master_sha)
+
+        with concurrent.futures.ProcessPoolExecutor(max_workers=2) as executor:
+            fut1 = executor.submit(_concurrent_bootstrap_worker, args)
+            fut2 = executor.submit(_concurrent_bootstrap_worker, args)
+            res1 = fut1.result(timeout=10)
+            res2 = fut2.result(timeout=10)
+
+        self.assertTrue(res1["success"], f"res1 failed: {res1}")
+        self.assertTrue(res2["success"], f"res2 failed: {res2}")
+        # One process performs creation, the other process receives idempotent replay
+        replayed_count = sum(1 for r in (res1, res2) if r.get("replayed"))
+        created_count = sum(1 for r in (res1, res2) if not r.get("replayed"))
+        self.assertEqual(replayed_count, 1)
+        self.assertEqual(created_count, 1)
+        self.assertEqual(res1["worktree_path"], res2["worktree_path"])
+
+    def test_interrupted_replay_preserves_artifacts_created_provenance(self):
+        """Review #525 Finding 2: Replaying incomplete journal preserves creation provenance monotonically."""
+        key = "test_key_interrupted_replay_1"
+        branch = "fix/issue-850-interrupted-replay"
+        wt_path = os.path.join(self.branches_dir, "fix-issue-850-interrupted-replay")
+
+        # Simulate Phase 2/3 completion where branch and worktree directory were created by this transition
+        journal = {
+            "idempotency_key": key,
+            "issue_number": 850,
+            "branch_name": branch,
+            "worktree_path": wt_path,
+            "active_identity": "jcwalker3",
+            "active_profile": "prgs-author",
+            "remote": "prgs",
+            "org": "Scaled-Tech-Consulting",
+            "repo": "Gitea-Tools",
+            "phases": {
+                author_issue_bootstrap.PHASE_1_REQUEST_ACCEPTED: {"status": "completed"},
+                author_issue_bootstrap.PHASE_2_BRANCH_CONFIRMED: {"status": "completed", "created": True},
+            },
+            "artifacts_created": {
+                "branch_created": True,
+                "worktree_dir_created": True,
+                "worktree_registered": True,
+                "lock_created": False,
+            },
+            "current_phase": author_issue_bootstrap.PHASE_3_PATH_RESERVED,
+            "completed": False,
+        }
+        # Pre-create the branch and worktree on disk to simulate partial state after crash
+        subprocess.run(["git", "-C", self.repo_dir, "branch", branch, self.master_sha], check=True, capture_output=True)
+        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", wt_path, branch], check=True, capture_output=True)
+        author_issue_bootstrap.save_phase_journal(journal)
+
+        # Now resume/replay the transition but simulate lock binding failure during Phase 6
+        with unittest.mock.patch("issue_lock_store.bind_session_lock", side_effect=RuntimeError("Lock failure test")):
+            res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+                issue_number=850,
+                canonical_repo_root=self.repo_dir,
+                branch_name=branch,
+                worktree_path=wt_path,
+                idempotency_key=key,
+                lock_dir=self.lock_dir,
+            )
+
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "issue_lock_acquisition_failed")
+
+        # Verify that compensating recovery correctly deleted transition-created branch & worktree
+        # because creation provenance was preserved across replay (NOT downgraded to False!)
+        self.assertFalse(os.path.exists(wt_path))
+        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", branch], capture_output=True, text=True, check=False)
+        self.assertNotEqual(branch_check.returncode, 0)
+
+    def test_transition_created_only_compensation(self):
+        """Review #525 Finding 4: Preexisting branch is NOT deleted by compensation when only worktree was transition-created."""
+        key = "test_key_preexisting_branch_compensation"
+        preexisting_branch = "fix/issue-850-preexisting"
+        wt_path = os.path.join(self.branches_dir, "fix-issue-850-preexisting")
+
+        # Create branch BEFORE bootstrap (preexisting branch)
+        subprocess.run(["git", "-C", self.repo_dir, "branch", preexisting_branch, self.master_sha], check=True, capture_output=True)
+
+        # Call bootstrap with simulated failure during Phase 6 (lock binding)
+        with unittest.mock.patch("issue_lock_store.bind_session_lock", side_effect=RuntimeError("Simulated lock failure")):
+            res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+                issue_number=850,
+                canonical_repo_root=self.repo_dir,
+                branch_name=preexisting_branch,
+                worktree_path=wt_path,
+                idempotency_key=key,
+                lock_dir=self.lock_dir,
+            )
+
+        self.assertFalse(res["success"])
+        # Worktree dir was created by transition -> removed by compensation
+        self.assertFalse(os.path.exists(wt_path))
+
+        # Preexisting branch was NOT created by transition -> MUST BE PRESERVED!
+        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", preexisting_branch], capture_output=True, text=True, check=False)
+        self.assertEqual(branch_check.returncode, 0, "Preexisting branch was deleted by mistake!")
+
+    def test_incompatible_idempotency_replay_refusal(self):
+        """Review #525 Finding 4: Replaying key with incompatible parameters returns refusal."""
+        key = "test_key_incompatible_replay"
+        res1 = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            branch_name="fix/issue-850-param-a",
+            idempotency_key=key,
+            lock_dir=self.lock_dir,
+        )
+        self.assertTrue(res1["success"])
+
+        # Second call with different branch_name
+        res2 = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            branch_name="fix/issue-850-param-b",
+            idempotency_key=key,
+            lock_dir=self.lock_dir,
+        )
+        self.assertFalse(res2["success"])
+        self.assertEqual(res2.get("reason_code"), "incompatible_idempotency_replay")
+
+    def test_exact_next_action_satisfiable_via_mcp(self):
+        """Review #525 Finding 4: exact_next_action provides satisfiable MCP actions, not shell commands."""
+        key = "test_key_next_action_mcp"
+        stale_sha = "0000000000000000000000000000000000000000"
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            expected_base_sha=stale_sha,
+            lock_dir=self.lock_dir,
+        )
+        next_action = res.get("exact_next_action", "")
+        self.assertNotIn("scripts/worktree-start", next_action)
+        self.assertNotIn("git worktree add", next_action)
+        self.assertNotIn("bash", next_action.lower())
+
+    def test_task_capability_map_integration(self):
+        """Verify task_capability_map has bootstrap_author_issue_worktree configured correctly."""
+        self.assertEqual(task_capability_map.required_role("bootstrap_author_issue_worktree"), "author")
+        self.assertEqual(task_capability_map.required_permission("bootstrap_author_issue_worktree"), "gitea.branch.create")
+        self.assertTrue(task_capability_map.preflight_task_matches("work_issue", "bootstrap_author_issue_worktree"))
+        self.assertTrue(task_capability_map.preflight_task_matches("bootstrap_author_issue_worktree", "lock_issue"))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_author_mutation_worktree.py

@@ -28,6 +28,21 @@ class TestPathUnderBranches(unittest.TestCase):
             amw.is_path_under_branches("/repo/other-checkout", self.ROOT)
         )
 
+    def test_unrelated_branches_dir_fails(self):
+        self.assertFalse(
+            amw.is_path_under_branches("/tmp/branches/evil", self.ROOT)
+        )
+
+    def test_prefix_confusion_fails(self):
+        self.assertFalse(
+            amw.is_path_under_branches(f"{self.ROOT}/branches-other/foo", self.ROOT)
+        )
+
+    def test_traversal_fails(self):
+        self.assertFalse(
+            amw.is_path_under_branches(f"{self.ROOT}/branches/../evil", self.ROOT)
+        )
+
 
 class TestAssessAuthorMutationWorktree(unittest.TestCase):
     ROOT = "/repo/Gitea-Tools"

tests/test_branch_cleanup_guard.py

@@ -1266,6 +1266,378 @@ class TestSecondRemediationIntegration(unittest.TestCase):
         self.assertIn("delete_acknowledged", delete_actions[0])
         self.assertTrue(delete_actions[0].get("verified_absent"))
 
+    def test_issue_851_worktree_removed_when_remote_blocked_only_by_worktree_binding(self):
+        """#851: remote blocked by worktree_binding must not skip safe worktree removal.
+
+        Lifecycle: remove clean owned worktree → reassess ownership → delete
+        remote only if independently safe. Unrelated entries stay untouched.
+        """
+        from mcp_server import gitea_reconcile_merged_cleanups
+
+        target_branch = "fix/issue-844-exclude-epic-containers"
+        foreign_branch = "fix/issue-999-unrelated-active"
+        worktree_path = "/tmp/branches/fix-issue-844-exclude-epic-containers"
+        ownership_calls = []
+        remove_calls = []
+        delete_api_calls = []
+
+        def fake_collect(**kwargs):
+            ownership_calls.append(dict(kwargs))
+            # Ownership is reassessed *after* independent worktree removal (#851).
+            # Target worktree is already gone → no worktree_binding remains.
+            # Foreign branch keeps an active author lease → remote delete blocked.
+            if kwargs.get("branch") == foreign_branch:
+                # Match session-bound org/repo + host used by the tool resolve path.
+                return {
+                    "records": [
+                        {
+                            "category": guard.OWNERSHIP_CATEGORY_AUTHOR_LEASE,
+                            "status": "active",
+                            "remote": kwargs.get("remote") or "prgs",
+                            "host": kwargs.get("host") or "gitea.example.com",
+                            "org": kwargs.get("org") or "Scaled-Tech-Consulting",
+                            "repo": kwargs.get("repo") or "Gitea-Tools",
+                            "branch": foreign_branch,
+                            "reclaim_allowed": False,
+                        }
+                    ],
+                    "inventory_error": False,
+                }
+            return {"records": [], "inventory_error": False}
+
+        def fake_remove(project_root, branch, worktree_path=None):
+            remove_calls.append(
+                {"branch": branch, "worktree_path": worktree_path}
+            )
+            return {
+                "success": True,
+                "performed": True,
+                "message": f"removed worktree {worktree_path}",
+                "worktree_path": worktree_path,
+            }
+
+        def fake_probe(h, o, r, auth, br):
+            return guard.classify_branch_readback_http_status(
+                404, not_found_scope=guard.NOT_FOUND_SCOPE_BRANCH
+            )
+
+        def fake_api(method, url, auth, **kwargs):
+            if method == "DELETE":
+                delete_api_calls.append(url)
+            return {}
+
+        report = {
+            "entries": [
+                {
+                    "pr_number": 848,
+                    "head_branch": target_branch,
+                    "remote_branch": {"safe_to_delete_remote": True},
+                    "local_worktree": {
+                        "safe_to_remove_worktree": True,
+                        "worktree_path": worktree_path,
+                    },
+                },
+                {
+                    "pr_number": 999,
+                    "head_branch": foreign_branch,
+                    "remote_branch": {"safe_to_delete_remote": True},
+                    "local_worktree": {
+                        "safe_to_remove_worktree": False,
+                        "worktree_path": None,
+                    },
+                },
+            ],
+            "reviewer_scratch_entries": [],
+        }
+        patch(
+            "mcp_server.get_profile",
+            return_value={
+                "profile_name": "prgs-reconciler",
+                "role": "reconciler",
+                "allowed_operations": [
+                    "gitea.read",
+                    "gitea.branch.delete",
+                    "gitea.pr.close",
+                ],
+                "forbidden_operations": [],
+            },
+        ).start()
+        patch("mcp_server.api_get_all", return_value=[]).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.build_reconciliation_report",
+            return_value=report,
+        ).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.discover_reviewer_scratch_worktrees",
+            return_value=[],
+        ).start()
+        patch(
+            "mcp_server.audit_reconciliation_mode.check_cleanup_execution_allowed",
+            return_value=(True, []),
+        ).start()
+        patch("mcp_server.verify_preflight_purity", return_value=None).start()
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            side_effect=fake_collect,
+        ).start()
+        patch("mcp_server._probe_remote_branch", side_effect=fake_probe).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.remove_local_worktree",
+            side_effect=fake_remove,
+        ).start()
+        self.mock_api.side_effect = fake_api
+
+        res = gitea_reconcile_merged_cleanups(
+            dry_run=False,
+            execute_confirmed=True,
+            remote="prgs",
+        )
+        self.assertTrue(res.get("performed") or res.get("executed"))
+        actions = res.get("actions") or []
+
+        remove_actions = [
+            a for a in actions if a.get("action") == "remove_local_worktree"
+        ]
+        self.assertEqual(len(remove_actions), 1, actions)
+        self.assertTrue(remove_actions[0].get("success"))
+        self.assertEqual(remove_calls[0]["branch"], target_branch)
+        self.assertEqual(remove_calls[0]["worktree_path"], worktree_path)
+
+        # Target remote delete succeeds after worktree removal + reassessment.
+        target_deletes = [
+            a
+            for a in actions
+            if a.get("action") == "delete_remote_branch"
+            and a.get("branch") == target_branch
+        ]
+        self.assertEqual(len(target_deletes), 1, actions)
+        self.assertTrue(target_deletes[0].get("success"))
+        self.assertTrue(target_deletes[0].get("after_worktree_removal"))
+        self.assertTrue(target_deletes[0].get("ownership_reassessed"))
+        self.assertTrue(target_deletes[0].get("verified_absent"))
+
+        # Foreign branch remains protected (author lease) and is not deleted.
+        foreign_deletes = [
+            a
+            for a in actions
+            if a.get("action") == "delete_remote_branch"
+            and a.get("branch") == foreign_branch
+        ]
+        self.assertEqual(len(foreign_deletes), 1, actions)
+        self.assertFalse(foreign_deletes[0].get("success"))
+        self.assertEqual(
+            foreign_deletes[0].get("blocker_kind"), "active_branch_ownership"
+        )
+        self.assertIn(
+            guard.OWNERSHIP_CATEGORY_AUTHOR_LEASE,
+            foreign_deletes[0].get("blocking_categories") or [],
+        )
+        # Only the target branch should hit the DELETE API.
+        self.assertEqual(len(delete_api_calls), 1)
+
+        # Ownership collected for target (post-removal) and foreign; worktree
+        # removal happened before target remote delete in the action log.
+        target_idx = next(
+            i
+            for i, a in enumerate(actions)
+            if a.get("action") == "remove_local_worktree"
+        )
+        delete_idx = next(
+            i
+            for i, a in enumerate(actions)
+            if a.get("action") == "delete_remote_branch"
+            and a.get("branch") == target_branch
+            and a.get("success")
+        )
+        self.assertLess(target_idx, delete_idx)
+
+    def test_issue_851_dirty_worktree_not_removed_and_remote_stays_protected(self):
+        """#851: dirty/foreign worktrees remain protected; no unsafe cleanup."""
+        from mcp_server import gitea_reconcile_merged_cleanups
+
+        branch = "fix/issue-851-dirty"
+        remove_calls = []
+
+        def fake_collect(**kwargs):
+            return {
+                "records": [
+                    {
+                        "category": guard.OWNERSHIP_CATEGORY_WORKTREE_BINDING,
+                        "status": "active",
+                        "remote": kwargs.get("remote") or "prgs",
+                        "host": kwargs.get("host") or "gitea.example.com",
+                        "org": kwargs.get("org") or "Scaled-Tech-Consulting",
+                        "repo": kwargs.get("repo") or "Gitea-Tools",
+                        "branch": branch,
+                        "reclaim_allowed": False,
+                    }
+                ],
+                "inventory_error": False,
+            }
+
+        report = {
+            "entries": [
+                {
+                    "pr_number": 851,
+                    "head_branch": branch,
+                    "remote_branch": {"safe_to_delete_remote": True},
+                    "local_worktree": {
+                        "safe_to_remove_worktree": False,
+                        "worktree_path": "/tmp/dirty-wt",
+                    },
+                }
+            ],
+            "reviewer_scratch_entries": [],
+        }
+        patch(
+            "mcp_server.get_profile",
+            return_value={
+                "profile_name": "prgs-reconciler",
+                "role": "reconciler",
+                "allowed_operations": [
+                    "gitea.read",
+                    "gitea.branch.delete",
+                ],
+                "forbidden_operations": [],
+            },
+        ).start()
+        patch("mcp_server.api_get_all", return_value=[]).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.build_reconciliation_report",
+            return_value=report,
+        ).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.discover_reviewer_scratch_worktrees",
+            return_value=[],
+        ).start()
+        patch(
+            "mcp_server.audit_reconciliation_mode.check_cleanup_execution_allowed",
+            return_value=(True, []),
+        ).start()
+        patch("mcp_server.verify_preflight_purity", return_value=None).start()
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            side_effect=fake_collect,
+        ).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.remove_local_worktree",
+            side_effect=lambda *a, **k: remove_calls.append(k) or {
+                "success": True,
+                "performed": True,
+            },
+        ).start()
+        self.mock_api.side_effect = lambda *a, **k: {}
+
+        res = gitea_reconcile_merged_cleanups(
+            dry_run=False,
+            execute_confirmed=True,
+            remote="prgs",
+        )
+        actions = res.get("actions") or []
+        self.assertEqual(remove_calls, [])
+        self.assertFalse(
+            any(a.get("action") == "remove_local_worktree" for a in actions)
+        )
+        deletes = [
+            a for a in actions if a.get("action") == "delete_remote_branch"
+        ]
+        self.assertEqual(len(deletes), 1)
+        self.assertFalse(deletes[0].get("success"))
+        self.assertEqual(deletes[0].get("blocker_kind"), "active_branch_ownership")
+        self.assertIn(
+            guard.OWNERSHIP_CATEGORY_WORKTREE_BINDING,
+            deletes[0].get("blocking_categories") or [],
+        )
+
+    def test_issue_851_idempotent_resume_when_worktree_already_absent(self):
+        """#851: partial failures remain resumable and idempotent."""
+        from mcp_server import gitea_reconcile_merged_cleanups
+
+        branch = "fix/issue-851-resume"
+        ownership_calls = []
+
+        def fake_collect(**kwargs):
+            ownership_calls.append(kwargs)
+            return {"records": [], "inventory_error": False}
+
+        def fake_remove(project_root, branch, worktree_path=None):
+            return {
+                "success": False,
+                "performed": False,
+                "message": f"worktree not found: {worktree_path}",
+            }
+
+        def fake_probe(h, o, r, auth, br):
+            return guard.classify_branch_readback_http_status(
+                404, not_found_scope=guard.NOT_FOUND_SCOPE_BRANCH
+            )
+
+        report = {
+            "entries": [
+                {
+                    "pr_number": 851,
+                    "head_branch": branch,
+                    "remote_branch": {"safe_to_delete_remote": True},
+                    "local_worktree": {
+                        "safe_to_remove_worktree": True,
+                        "worktree_path": "/tmp/already-gone",
+                    },
+                }
+            ],
+            "reviewer_scratch_entries": [],
+        }
+        patch(
+            "mcp_server.get_profile",
+            return_value={
+                "profile_name": "prgs-reconciler",
+                "role": "reconciler",
+                "allowed_operations": [
+                    "gitea.read",
+                    "gitea.branch.delete",
+                ],
+                "forbidden_operations": [],
+            },
+        ).start()
+        patch("mcp_server.api_get_all", return_value=[]).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.build_reconciliation_report",
+            return_value=report,
+        ).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.discover_reviewer_scratch_worktrees",
+            return_value=[],
+        ).start()
+        patch(
+            "mcp_server.audit_reconciliation_mode.check_cleanup_execution_allowed",
+            return_value=(True, []),
+        ).start()
+        patch("mcp_server.verify_preflight_purity", return_value=None).start()
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            side_effect=fake_collect,
+        ).start()
+        patch("mcp_server._probe_remote_branch", side_effect=fake_probe).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.remove_local_worktree",
+            side_effect=fake_remove,
+        ).start()
+        self.mock_api.side_effect = lambda *a, **k: {}
+
+        res = gitea_reconcile_merged_cleanups(
+            dry_run=False,
+            execute_confirmed=True,
+            remote="prgs",
+        )
+        actions = res.get("actions") or []
+        removes = [a for a in actions if a.get("action") == "remove_local_worktree"]
+        deletes = [a for a in actions if a.get("action") == "delete_remote_branch"]
+        self.assertEqual(len(removes), 1)
+        self.assertFalse(removes[0].get("success"))
+        self.assertEqual(len(deletes), 1)
+        self.assertTrue(deletes[0].get("success"))
+        self.assertTrue(deletes[0].get("after_worktree_removal"))
+        self.assertTrue(ownership_calls)
+
 
 
 if __name__ == "__main__":

tests/test_merged_cleanup_reconcile.py

@@ -12,6 +12,59 @@ import merged_cleanup_reconcile as mcr  # noqa: E402
 
 
 class TestMergedCleanupAssessment(unittest.TestCase):
+    def test_issue_851_plan_order_worktree_then_reassess_then_remote(self):
+        """#851 dry-run plan: remove worktree, reassess ownership, then remote."""
+        plan = mcr.plan_cleanup_execution_order(
+            remote_assessment={"safe_to_delete_remote": True},
+            local_assessment={"safe_to_remove_worktree": True},
+        )
+        actions = [s["action"] for s in plan]
+        self.assertEqual(
+            actions,
+            [
+                "remove_local_worktree",
+                "reassess_branch_ownership",
+                "delete_remote_branch",
+            ],
+        )
+        self.assertEqual(plan[0]["phase"], 1)
+        self.assertEqual(plan[-1]["phase"], 3)
+        self.assertIn("independently_safe", plan[0]["reason"])
+        self.assertIn("reassessment", plan[-1]["reason"])
+
+    def test_issue_851_plan_remote_only_when_worktree_not_safe(self):
+        plan = mcr.plan_cleanup_execution_order(
+            remote_assessment={"safe_to_delete_remote": True},
+            local_assessment={"safe_to_remove_worktree": False},
+        )
+        self.assertEqual([s["action"] for s in plan], ["delete_remote_branch"])
+        self.assertNotIn("reassess_branch_ownership", [s["action"] for s in plan])
+
+    def test_issue_851_plan_worktree_only_when_remote_not_safe(self):
+        plan = mcr.plan_cleanup_execution_order(
+            remote_assessment={"safe_to_delete_remote": False},
+            local_assessment={"safe_to_remove_worktree": True},
+        )
+        self.assertEqual([s["action"] for s in plan], ["remove_local_worktree"])
+
+    def test_issue_851_entry_includes_planned_execution_order(self):
+        entry = mcr.build_pr_cleanup_entry(
+            pr={
+                "number": 848,
+                "title": "Closes #844",
+                "body": "",
+                "merged_at": "2026-07-23T00:00:00Z",
+                "head": {"ref": "fix/issue-844-x", "sha": "a" * 40},
+            },
+            project_root="/tmp/not-a-real-root",
+            open_pr_heads=set(),
+            remote_branch_exists=True,
+            head_on_master=True,
+            delete_capability_allowed=True,
+        )
+        self.assertIn("planned_execution_order", entry)
+        self.assertIsInstance(entry["planned_execution_order"], list)
+
     def test_extract_linked_issue_from_closes(self):
         issue = mcr.extract_linked_issue(
             "feat: cleanup (Closes #269)",

tests/test_task_capability_role_invariants.py

@@ -139,6 +139,8 @@ EXPECTED_ROLE_EXCLUSIVE_TASKS = frozenset(
         "gitea_release_merger_pr_lease",
         "create_branch",
         "push_branch",
+        "bootstrap_author_issue_worktree",
+        "gitea_bootstrap_author_issue_worktree",
         # #812 AC20: publishing an unpublished local head is author-only for the
         # same reason every other push is — it writes a branch to the remote.
         "publish_unpublished_branch",

tests/test_webui_policy_visibility.py

@@ -1,222 +0,0 @@
-"""Tests for the read-only workflow policy/guardrail visibility view (#646).
-
-Covers issue #646 acceptance criteria:
-
-1. Console lists major guardrails with source pointers.
-2. Secrets redacted.
-3. Tests ensure sample secrets never appear.
-4. Docs explain read-only nature (asserted here for the page copy; the doc
-   itself is covered by inspection).
-"""
-
-import json
-import sys
-import unittest
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from starlette.testclient import TestClient
-
-from webui import console_redaction
-from webui import policy_inventory
-from webui.app import create_app
-from webui.policy_inventory import (
-    PolicyEntry,
-    PolicyInventorySnapshot,
-    SourcePointer,
-    load_policy_inventory,
-    snapshot_to_dict,
-)
-from webui.policy_views import render_policy_page
-
-
-def _entry(key, category, *, active=None, error=None):
-    return PolicyEntry(
-        key=key,
-        title=key.replace("_", " ").title(),
-        category=category,
-        summary=f"summary for {key}",
-        sources=(SourcePointer("src", f"{key}.py", "module"),),
-        active=active,
-        documented_default=None,
-        diff=None,
-        error=error,
-    )
-
-
-def _snapshot(entries):
-    return PolicyInventorySnapshot(
-        schema_version=1,
-        read_only=True,
-        note="read-only projection",
-        entries=tuple(entries),
-        categories=tuple(dict.fromkeys(e.category for e in entries)),
-        build_errors=(),
-    )
-
-# The guardrail categories issue #646 names as in-scope.
-_EXPECTED_CATEGORIES = {
-    "role_separation",
-    "lease_rules",
-    "worktree_rules",
-    "merge_confirmation",
-    "redaction",
-    "contamination",
-    "allocator_policy",
-    "audit_logging",
-    "mutation_gating",
-}
-
-
-class TestPolicyInventoryModel(unittest.TestCase):
-    def test_major_guardrails_present(self):
-        snapshot = load_policy_inventory()
-        categories = {e.category for e in snapshot.entries}
-        self.assertEqual(_EXPECTED_CATEGORIES, categories)
-        self.assertGreaterEqual(len(snapshot.entries), len(_EXPECTED_CATEGORIES))
-
-    def test_every_guardrail_has_source_pointers(self):
-        # AC1: source attribution (file/module/doc) for every guardrail.
-        snapshot = load_policy_inventory()
-        for entry in snapshot.entries:
-            with self.subTest(entry=entry.key):
-                self.assertTrue(entry.sources, "guardrail must carry source pointers")
-                for source in entry.sources:
-                    self.assertTrue(source.path)
-                    self.assertIn(source.kind, {"module", "doc", "script", "config"})
-
-    def test_diff_reported_where_documented_default_declared(self):
-        snapshot = load_policy_inventory()
-        checked_any = False
-        for entry in snapshot.entries:
-            if entry.documented_default is None:
-                self.assertIsNone(entry.diff)
-                continue
-            checked_any = True
-            self.assertIsNotNone(entry.diff)
-            self.assertEqual(
-                entry.diff["status"],
-                "matches_documented_default",
-                f"{entry.key} drifted from its documented default: {entry.diff}",
-            )
-        self.assertTrue(checked_any, "at least one guardrail should declare a default")
-
-    def test_live_projections_populate_active(self):
-        snapshot = load_policy_inventory()
-        by_key = {e.key: e for e in snapshot.entries}
-        for key in ("role_separation", "redaction", "audit_logging"):
-            self.assertIsNone(by_key[key].error, f"{key} projection failed")
-            self.assertIsInstance(by_key[key].active, dict)
-
-    def test_build_entry_is_fail_soft_on_projection_error(self):
-        def _boom():
-            raise RuntimeError("projection exploded")
-
-        row = (
-            "redaction",
-            "Secret redaction",
-            "redaction",
-            "summary",
-            (SourcePointer("x", "webui/console_redaction.py", "module"),),
-            _boom,
-            {"redact_before_persist": True},
-        )
-        entry = policy_inventory._build_entry(row)
-        self.assertIsNone(entry.active)
-        self.assertIsNotNone(entry.error)
-        self.assertEqual(entry.diff["status"], "active_unavailable")
-
-
-class TestPolicyRedaction(unittest.TestCase):
-    def test_real_snapshot_has_no_secret_shapes(self):
-        # AC3: the real emitted payload never carries a known secret shape.
-        payload = snapshot_to_dict(load_policy_inventory())
-        self.assertEqual(console_redaction.scan_for_secrets(payload), [])
-
-    def test_planted_keychain_secret_is_redacted(self):
-        # AC2/AC3: a secret planted in an active projection is masked before emit.
-        snapshot = _snapshot([
-            _entry(
-                "redaction",
-                "redaction",
-                active={"leaked": "keychain:prgs-author-super-secret", "roles": ["author"]},
-            )
-        ])
-        payload = snapshot_to_dict(snapshot)
-        blob = json.dumps(payload)
-        self.assertNotIn("keychain:prgs-author-super-secret", blob)
-        self.assertEqual(console_redaction.scan_for_secrets(payload), [])
-
-    def test_planted_credential_assignment_is_redacted(self):
-        snapshot = _snapshot([
-            _entry(
-                "audit_logging",
-                "audit_logging",
-                active={"leaked": "token=abcd1234efgh5678", "append_only": True},
-            )
-        ])
-        payload = snapshot_to_dict(snapshot)
-        blob = json.dumps(payload)
-        self.assertNotIn("abcd1234efgh5678", blob)
-        self.assertEqual(console_redaction.scan_for_secrets(payload), [])
-
-
-class TestPolicyRoutes(unittest.TestCase):
-    def setUp(self):
-        self.client = TestClient(create_app())
-
-    def test_policy_html_lists_guardrails_with_sources(self):
-        response = self.client.get("/policy")
-        self.assertEqual(response.status_code, 200)
-        text = response.text
-        self.assertIn("Workflow policy", text)
-        self.assertIn("Role separation and RBAC", text)
-        self.assertIn("Source pointers", text)
-        self.assertIn("task_capability_map.py", text)
-        self.assertIn("docs/safety-model.md", text)
-
-    def test_policy_html_states_read_only(self):
-        # AC4: the page explains its read-only nature.
-        text = self.client.get("/policy").text
-        self.assertIn("read-only", text.lower())
-        self.assertNotIn("<form", text.lower())
-
-    def test_policy_html_has_no_secret_shapes(self):
-        text = self.client.get("/policy").text
-        self.assertEqual(console_redaction.scan_for_secrets(text), [])
-
-    def test_api_v1_policy_returns_inventory(self):
-        response = self.client.get("/api/v1/policy")
-        self.assertEqual(response.status_code, 200)
-        data = response.json()
-        self.assertEqual(data["schema_version"], policy_inventory.SCHEMA_VERSION)
-        self.assertTrue(data["read_only"])
-        self.assertEqual(data["entry_count"], len(data["entries"]))
-        self.assertEqual(set(data["categories"]), _EXPECTED_CATEGORIES)
-
-    def test_policy_is_read_only_no_post(self):
-        # AC4 / non-goal: no mutation endpoint.
-        response = self.client.post("/policy")
-        self.assertIn(response.status_code, (404, 405))
-
-    def test_nav_links_policy(self):
-        text = self.client.get("/").text
-        self.assertIn('href="/policy"', text)
-
-
-class TestPolicyViewFailSoft(unittest.TestCase):
-    def test_page_renders_when_a_projection_errors(self):
-        snapshot = _snapshot([
-            _entry("role_separation", "role_separation", error="active projection unavailable: boom"),
-            _entry("redaction", "redaction", active={"redact_before_persist": True}),
-        ])
-        page = render_policy_page(snapshot)
-        # The errored guardrail surfaces its error; other guardrails still render.
-        self.assertIn("Active value unavailable", page)
-        self.assertIn("Redaction", page)
-        self.assertIn("Workflow policy", page)
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_webui_shell.py

@@ -0,0 +1,135 @@
+"""Tests for the Phase 1 operator console application shell (#638)."""
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from starlette.routing import Route
+from starlette.testclient import TestClient
+
+from webui import layout
+from webui.app import create_app
+from webui.nav import NAV_GROUPS, STUB_PAGES, nav_hrefs
+
+
+class TestShellNav(unittest.TestCase):
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_nav_group_labels_present(self):
+        text = self.client.get("/").text
+        for group in NAV_GROUPS:
+            with self.subTest(group=group.label):
+                self.assertIn(f">{group.label}<", text)
+
+    def test_phase1_group_labels_cover_expected_ia(self):
+        labels = {group.label for group in NAV_GROUPS}
+        for expected in (
+            "Health",
+            "Traffic",
+            "Runtime/Sessions",
+            "Projects",
+            "Inventory",
+            "Timeline",
+            "Policy",
+            "Insights",
+        ):
+            with self.subTest(label=expected):
+                self.assertIn(expected, labels)
+
+    def test_every_nav_href_resolves_to_a_get_route(self):
+        app = create_app()
+        get_paths = {
+            route.path
+            for route in app.routes
+            if isinstance(route, Route) and "GET" in route.methods
+        }
+        for href in nav_hrefs():
+            with self.subTest(href=href):
+                self.assertIn(href, get_paths, f"nav href {href} has no GET route")
+
+    def test_legacy_hrefs_still_navigable(self):
+        text = self.client.get("/").text
+        for href in ("/queue", "/projects", "/prompts", "/runtime",
+                     "/audit", "/worktrees", "/leases", "/actions"):
+            with self.subTest(href=href):
+                self.assertIn(f'href="{href}"', text)
+
+
+class TestShellBadges(unittest.TestCase):
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_mode_badge_present(self):
+        self.assertIn("mode: read-only", self.client.get("/").text)
+
+    def test_environment_badge_present(self):
+        self.assertIn("env:", self.client.get("/").text)
+
+    def test_default_environment_is_local(self):
+        self.assertEqual(layout.environment_label(), "local")
+
+    def test_remote_bind_reports_remote_environment(self):
+        import os
+
+        prior = os.environ.get("WEBUI_HOST")
+        os.environ["WEBUI_HOST"] = "10.0.0.5"
+        try:
+            self.assertEqual(layout.environment_label(), "remote")
+        finally:
+            if prior is None:
+                os.environ.pop("WEBUI_HOST", None)
+            else:
+                os.environ["WEBUI_HOST"] = prior
+
+    def test_docs_link_present(self):
+        text = self.client.get("/").text
+        self.assertIn(layout.DOCS_URL, text)
+        self.assertIn(">Docs<", text)
+
+
+class TestShellStubs(unittest.TestCase):
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_stub_routes_render_200(self):
+        for path, (title, _desc) in STUB_PAGES.items():
+            with self.subTest(path=path):
+                response = self.client.get(path)
+                self.assertEqual(response.status_code, 200, path)
+                self.assertIn(title, response.text)
+                self.assertIn("placeholder", response.text)
+
+    def test_stub_routes_are_read_only(self):
+        for path in STUB_PAGES:
+            with self.subTest(path=path):
+                response = self.client.post(path)
+                self.assertEqual(response.status_code, 405)
+                self.assertEqual(response.json()["error"], "read-only-mvp")
+
+    def test_stub_pages_carry_nav_and_badges(self):
+        response = self.client.get("/inventory")
+        self.assertIn("mode: read-only", response.text)
+        self.assertIn('href="/queue"', response.text)
+
+
+class TestShellHome(unittest.TestCase):
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_home_summarizes_console(self):
+        text = self.client.get("/").text
+        self.assertIn("Operator console", text)
+        self.assertIn("Phase 1", text)
+
+    def test_home_links_legacy_pages(self):
+        text = self.client.get("/").text
+        self.assertIn("MVP legacy pages", text)
+        for href in ("/queue", "/audit", "/leases"):
+            with self.subTest(href=href):
+                self.assertIn(f'href="{href}"', text)
+
+
+if __name__ == "__main__":
+    unittest.main()

webui/app.py

@@ -12,6 +12,7 @@ from starlette.routing import Route
 
 from webui.deployment_boundary import deployment_snapshot
 from webui.layout import render_page
+from webui.nav import NAV_GROUPS, STUB_PAGES
 from webui.project_registry import (
     ProjectRegistry,
     RegistryError,
@@ -45,8 +46,6 @@ from webui.worktree_scanner import load_hygiene_snapshot, snapshot_to_dict as wo
 from webui.worktree_views import render_worktrees_page
 from webui.runtime_health import load_runtime_snapshot, snapshot_to_dict as runtime_snapshot_to_dict
 from webui.runtime_views import render_runtime_page
-from webui.policy_inventory import load_policy_inventory, snapshot_to_dict as policy_snapshot_to_dict
-from webui.policy_views import render_policy_page
 from webui.system_health import (
     API_PATH as SYSTEM_HEALTH_API_PATH,
     load_system_health,
@@ -67,25 +66,62 @@ def _stub_page(title: str, description: str) -> HTMLResponse:
     return HTMLResponse(render_page(title=title, body_html=body))
 
 
+_LEGACY_PAGES = (
+    ("/queue", "Queue", "live PR and issue dashboard (#429)"),
+    ("/projects", "Projects", "registry and onboarding (#427)"),
+    ("/prompts", "Prompts", "canonical workflow prompt library (#428)"),
+    ("/runtime", "Runtime", "MCP health and stale-runtime detection (#430)"),
+    ("/audit", "Audit", "final-report paste and validator preview (#431)"),
+    ("/worktrees", "Worktrees", "branch hygiene dashboard (#432)"),
+    ("/leases", "Leases", "collision and lease visibility (#433)"),
+    ("/actions", "Actions", "gated write-action framework (#434)"),
+)
+
+
+def _render_home_nav_groups() -> str:
+    groups = []
+    for group in NAV_GROUPS:
+        items = "".join(
+            f'<li><a href="{item.href}">{item.label}</a>'
+            + ("" if item.status == "live" else " <span class=\"muted\">(stub)</span>")
+            + "</li>"
+            for item in group.items
+        )
+        groups.append(f"<h3>{group.label}</h3><ul>{items}</ul>")
+    return "".join(groups)
+
+
 async def home(_request: Request) -> HTMLResponse:
+    legacy = "".join(
+        f"<li><strong>{label}</strong> — {desc} "
+        f'(<a href="{href}">{href}</a>)</li>'
+        for href, label, desc in _LEGACY_PAGES
+    )
     body = (
         "<h2>Operator console</h2>"
-        "<p>Local entry point for MCP Control Plane operational views.</p>"
-        "<ul>"
-        "<li><strong>Queue</strong> — live PR and issue dashboard (#429)</li>"
-        "<li><strong>Projects</strong> — registry and onboarding (#427)</li>"
-        "<li><strong>Prompts</strong> — canonical workflow prompt library (#428)</li>"
-        "<li><strong>Runtime</strong> — MCP health and stale-runtime detection (#430)</li>"
-        "<li><strong>Policy</strong> — workflow guardrail configuration visibility (#646)</li>"
-        "<li><strong>Audit</strong> — final-report paste and validator preview (#431)</li>"
-        "<li><strong>Worktrees</strong> — branch hygiene dashboard (#432)</li>"
-        "<li><strong>Leases</strong> — collision and lease visibility (#433)</li>"
-        "<li><strong>Actions</strong> — gated write-action framework (#434)</li>"
-        "</ul>"
+        "<p>Read-only home for the MCP Control Plane Phase 1 operator console. "
+        "Gitea, MCP capability gates, and canonical workflows remain the source "
+        "of truth; this console never mutates them.</p>"
+        "<h2>Phase 1 surfaces</h2>"
+        + _render_home_nav_groups()
+        + "<h2>MVP legacy pages</h2>"
+        "<ul>" + legacy + "</ul>"
     )
     return HTMLResponse(render_page(title="Home", body_html=body))
 
 
+async def phase_stub(request: Request) -> HTMLResponse:
+    """Graceful read-only placeholder for a not-yet-implemented Phase 1 surface."""
+    title, description = STUB_PAGES[request.url.path]
+    body = (
+        f"<h2>{title}</h2>"
+        f'<div class="stub"><p>{description}</p>'
+        "<p>Phase 1 shell placeholder — no write actions. Tracked under "
+        "epic #631.</p></div>"
+    )
+    return HTMLResponse(render_page(title=title, body_html=body))
+
+
 async def health(_request: Request) -> JSONResponse:
     """Liveness only — deliberately cheap, runs no dependency probe (#634).
 
@@ -246,17 +282,6 @@ async def api_runtime(_request: Request) -> JSONResponse:
     return JSONResponse(runtime_snapshot_to_dict(load_runtime_snapshot()))
 
 
-async def policy(_request: Request) -> HTMLResponse:
-    snapshot = load_policy_inventory()
-    return HTMLResponse(
-        render_page(title="Policy", body_html=render_policy_page(snapshot))
-    )
-
-
-async def api_v1_policy(_request: Request) -> JSONResponse:
-    return JSONResponse(policy_snapshot_to_dict(load_policy_inventory()))
-
-
 async def _parse_audit_form(request: Request) -> tuple[str, str | None]:
     if request.method == "GET":
         return "", None
@@ -463,8 +488,6 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
             Route("/api/prompts", api_prompts, methods=["GET"]),
             Route("/runtime", runtime, methods=["GET"]),
             Route("/api/runtime", api_runtime, methods=["GET"]),
-            Route("/policy", policy, methods=["GET"]),
-            Route("/api/v1/policy", api_v1_policy, methods=["GET"]),
             Route("/audit", audit, methods=["GET", "POST"]),
             Route("/api/audit", api_audit, methods=["GET", "POST"]),
             Route("/worktrees", worktrees, methods=["GET"]),
@@ -488,6 +511,10 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
                 api_console_security_model,
                 methods=["GET"],
             ),
+            *[
+                Route(path, phase_stub, methods=["GET"])
+                for path in STUB_PAGES
+            ],
         ],
         exception_handlers={405: method_not_allowed},
     )

webui/layout.py

@@ -2,29 +2,66 @@
 
 from __future__ import annotations
 
-NAV_ITEMS = (
-    ("/", "Home"),
-    ("/queue", "Queue"),
-    ("/projects", "Projects"),
-    ("/prompts", "Prompts"),
-    ("/runtime", "Runtime"),
-    ("/policy", "Policy"),
-    ("/audit", "Audit"),
-    ("/worktrees", "Worktrees"),
-    ("/leases", "Leases"),
-    ("/actions", "Actions"),
-)
+import os
+
+from webui.nav import NAV_GROUPS
 
 MVP_NOTICE = (
     "Read-only MVP — Gitea, MCP tools, and canonical workflows remain the "
     "source of truth. No mutation endpoints."
 )
 
+# Canonical docs entry point surfaced from the shell header (#638).
+DOCS_URL = (
+    "https://gitea.prgs.cc/Scaled-Tech-Consulting/Gitea-Tools/src/branch/"
+    "master/docs/webui-local-dev.md"
+)
+
+_LOCAL_HOSTS = frozenset({"", "127.0.0.1", "localhost", "::1"})
+
+
+def environment_label() -> str:
+    """Classify the serving environment as ``local`` or ``remote`` (#638).
+
+    Derived from the same ``WEBUI_HOST`` default the app binds to; loopback
+    hosts are ``local``, anything else is ``remote``. Read-only signal only.
+    """
+    host = (os.environ.get("WEBUI_HOST", "127.0.0.1") or "").strip().lower()
+    return "local" if host in _LOCAL_HOSTS else "remote"
+
+
+def _render_nav() -> str:
+    groups_html = []
+    for group in NAV_GROUPS:
+        links = "".join(
+            f'<a href="{item.href}"'
+            + (' class="nav-stub"' if item.status == "stub" else "")
+            + f'>{item.label}</a>'
+            for item in group.items
+        )
+        groups_html.append(
+            '<div class="nav-group">'
+            f'<span class="nav-group-label">{group.label}</span>'
+            f'<span class="nav-group-links">{links}</span>'
+            "</div>"
+        )
+    return "".join(groups_html)
+
+
+def _render_badges() -> str:
+    env = environment_label()
+    return (
+        '<div class="header-badges">'
+        f'<span class="badge env-badge env-{env}">env: {env}</span>'
+        '<span class="badge mode-badge">mode: read-only</span>'
+        f'<a class="badge docs-link" href="{DOCS_URL}">Docs</a>'
+        "</div>"
+    )
+
 
 def render_page(*, title: str, body_html: str, extra_head: str = "") -> str:
-    nav_links = "".join(
-        f'<a href="{href}">{label}</a>' for href, label in NAV_ITEMS
-    )
+    nav_links = _render_nav()
+    header_badges = _render_badges()
     return f"""<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -54,21 +91,58 @@ def render_page(*, title: str, body_html: str, extra_head: str = "") -> str:
       padding: 0.75rem 1.25rem;
     }}
     header h1 {{
-      margin: 0 0 0.5rem;
+      margin: 0;
       font-size: 1.1rem;
       font-weight: 600;
     }}
+    .header-top {{
+      display: flex;
+      flex-wrap: wrap;
+      align-items: center;
+      justify-content: space-between;
+      gap: 0.5rem 1rem;
+      margin-bottom: 0.6rem;
+    }}
+    .header-badges {{ display: inline-flex; flex-wrap: wrap; gap: 0.4rem; }}
+    .env-badge.env-local {{ color: #8fd19e; border-color: #3d6b4a; }}
+    .env-badge.env-remote {{ color: #e0c27a; border-color: #6b5730; }}
+    .mode-badge {{ color: #9ec8f0; border-color: #3d5f7a; }}
+    a.docs-link {{
+      color: var(--accent);
+      border-color: var(--accent);
+      text-decoration: none;
+      text-transform: none;
+    }}
+    a.docs-link:hover {{ filter: brightness(1.12); }}
     nav {{
       display: flex;
       flex-wrap: wrap;
-      gap: 0.75rem 1rem;
+      gap: 0.5rem 1.25rem;
     }}
+    .nav-group {{
+      display: flex;
+      flex-direction: column;
+      gap: 0.15rem;
+    }}
+    .nav-group-label {{
+      font-size: 0.68rem;
+      text-transform: uppercase;
+      letter-spacing: 0.04em;
+      color: var(--muted);
+    }}
+    .nav-group-links {{ display: inline-flex; flex-wrap: wrap; gap: 0.6rem; }}
     nav a {{
       color: var(--accent);
       text-decoration: none;
       font-size: 0.9rem;
     }}
     nav a:hover {{ text-decoration: underline; }}
+    nav a.nav-stub {{ color: var(--muted); }}
+    nav a.nav-stub::after {{
+      content: " ·stub";
+      font-size: 0.7rem;
+      color: var(--muted);
+    }}
     main {{
       max-width: 52rem;
       margin: 0 auto;
@@ -167,7 +241,10 @@ def render_page(*, title: str, body_html: str, extra_head: str = "") -> str:
 </head>
 <body>
   <header>
-    <h1>MCP Control Plane</h1>
+    <div class="header-top">
+      <h1>MCP Control Plane</h1>
+      {header_badges}
+    </div>
     <nav>{nav_links}</nav>
   </header>
   <main>

webui/nav.py

@@ -0,0 +1,111 @@
+"""Navigation IA for the Phase 1 operator console shell (#638).
+
+Single source of truth for the console navigation so ``webui/layout.py`` and
+the ``webui/app.py`` route table stay aligned with epic #631. Read-only: every
+destination is a GET view or a Phase 1 placeholder. No mutation links.
+
+Nav groups follow the #631 Phase 1 information architecture: Health, Traffic,
+Runtime/Sessions, Projects, Inventory, Timeline, Policy (placeholder), and
+Insights (placeholder). Later-phase surfaces are declared as ``stub`` items and
+backed by ``STUB_PAGES`` so their nav links resolve to a graceful placeholder
+instead of a 404.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class NavItem:
+    """A single navigation destination.
+
+    ``status`` is ``"live"`` for implemented views and ``"stub"`` for Phase 1
+    placeholders whose backing view lands in a later child issue.
+    """
+
+    href: str
+    label: str
+    status: str = "live"
+
+
+@dataclass(frozen=True)
+class NavGroup:
+    label: str
+    items: tuple[NavItem, ...]
+
+
+NAV_GROUPS: tuple[NavGroup, ...] = (
+    NavGroup("Health", (
+        NavItem("/health", "Liveness"),
+    )),
+    NavGroup("Traffic", (
+        NavItem("/queue", "Queue"),
+        NavItem("/leases", "Leases"),
+        NavItem("/actions", "Actions"),
+    )),
+    NavGroup("Runtime/Sessions", (
+        NavItem("/runtime", "Runtime health"),
+        NavItem("/sessions", "Sessions", "stub"),
+    )),
+    NavGroup("Projects", (
+        NavItem("/projects", "Projects"),
+    )),
+    NavGroup("Inventory", (
+        NavItem("/inventory", "Inventory", "stub"),
+        NavItem("/worktrees", "Worktrees"),
+    )),
+    NavGroup("Timeline", (
+        NavItem("/timeline", "Timeline", "stub"),
+    )),
+    NavGroup("Policy", (
+        NavItem("/policy", "Policy", "stub"),
+        NavItem("/prompts", "Prompts"),
+    )),
+    NavGroup("Insights", (
+        NavItem("/insights", "Insights", "stub"),
+        NavItem("/audit", "Audit"),
+    )),
+)
+
+
+# Phase 1 placeholder destinations whose backing views land in later child
+# issues of epic #631. Each maps a path to (title, description). Routes are
+# registered so nav links resolve to a graceful, read-only stub page.
+STUB_PAGES: dict[str, tuple[str, str]] = {
+    "/sessions": (
+        "Sessions",
+        "Active session, capability, and role inventory. Backed by the unified "
+        "inventory API (#636) once it lands.",
+    ),
+    "/inventory": (
+        "Inventory",
+        "Unified sessions, leases, locks, namespaces, and worktree inventory. "
+        "Backed by the Phase 1 inventory API (#636).",
+    ),
+    "/timeline": (
+        "Timeline",
+        "Workflow event timeline across issues and PRs. A later Phase 1 surface.",
+    ),
+    "/policy": (
+        "Policy",
+        "Capability and role policy surface. Placeholder until a later phase.",
+    ),
+    "/insights": (
+        "Insights",
+        "Aggregate operational insights and trends. Placeholder until a later "
+        "phase.",
+    ),
+}
+
+
+def iter_nav_items():
+    """Yield every ``NavItem`` across all groups in declared order."""
+    for group in NAV_GROUPS:
+        for item in group.items:
+            yield item
+
+
+def nav_hrefs() -> tuple[str, ...]:
+    """Return every navigation href in declared order."""
+    return tuple(item.href for item in iter_nav_items())

webui/policy_inventory.py

@@ -1,387 +0,0 @@
-"""Read-only workflow policy and guardrail inventory for the web UI (#646).
-
-Policy and guardrails live in code, profiles, docs, and skills. An operator
-cannot *see* the active workflow policy configuration from the console without
-reading the repository tree. This module projects the major guardrails into a
-redacted, machine-readable inventory with source attribution (file / module /
-doc), so the console can render them as HTML tables with source pointers.
-
-Design constraints (Phase 3, #646):
-
-- **Read-only projection.** Nothing here edits policy or exposes a toggle that
-  could weaken a gate. It reports what is already enforced elsewhere.
-- **Source attribution without secrets.** Every guardrail carries pointers to
-  the file/module/doc that owns it. Live values are compact summaries derived
-  from the safe policy accessors that already exist (``rbac_matrix``,
-  ``redaction_policy``, ``audit_policy``); raw regex, tokens, and endpoints are
-  never embedded.
-- **Redact before emit.** ``snapshot_to_dict`` runs the whole payload through
-  ``console_redaction.redact_payload`` so a planted or accidental secret in any
-  projected value degrades to the placeholder rather than reaching a client.
-- **Fail soft.** A projection that raises is recorded as a per-entry error and
-  never takes the page down; a guardrail is still listed with its sources.
-- **Diff vs documented defaults where feasible.** When a guardrail declares a
-  documented invariant, the active projection is compared against it and the
-  result is reported; otherwise the diff is explicitly ``None`` with a reason.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Any, Callable
-
-from webui import console_audit
-from webui import console_authz
-from webui import console_redaction
-
-SCHEMA_VERSION = 1
-
-READ_ONLY_NOTE = (
-    "Read-only projection of guardrails enforced in code, profiles, docs, and "
-    "skills. This view never edits policy and exposes no gate-weakening toggle."
-)
-
-
-@dataclass(frozen=True)
-class SourcePointer:
-    """Where a guardrail is defined. Attribution only — never a secret."""
-
-    label: str
-    path: str
-    kind: str  # "module" | "doc" | "script" | "config"
-    anchor: str | None = None
-
-    def to_dict(self) -> dict[str, Any]:
-        return {
-            "label": self.label,
-            "path": self.path,
-            "kind": self.kind,
-            "anchor": self.anchor,
-        }
-
-
-@dataclass(frozen=True)
-class PolicyEntry:
-    key: str
-    title: str
-    category: str
-    summary: str
-    sources: tuple[SourcePointer, ...]
-    active: dict[str, Any] | None
-    documented_default: dict[str, Any] | None
-    diff: dict[str, Any] | None
-    error: str | None = None
-
-    def to_dict(self) -> dict[str, Any]:
-        return {
-            "key": self.key,
-            "title": self.title,
-            "category": self.category,
-            "summary": self.summary,
-            "sources": [s.to_dict() for s in self.sources],
-            "active": self.active,
-            "documented_default": self.documented_default,
-            "diff": self.diff,
-            "error": self.error,
-        }
-
-
-@dataclass(frozen=True)
-class PolicyInventorySnapshot:
-    schema_version: int
-    read_only: bool
-    note: str
-    entries: tuple[PolicyEntry, ...]
-    categories: tuple[str, ...]
-    build_errors: tuple[str, ...]
-
-
-def _diff_active_vs_default(
-    active: dict[str, Any] | None,
-    documented_default: dict[str, Any] | None,
-) -> dict[str, Any] | None:
-    """Compare only the keys the documented default declares.
-
-    Returns ``None`` when no documented default is declared (diff not feasible)
-    or when the active projection is unavailable. Otherwise reports, per
-    declared key, whether the active value matches the documented invariant.
-    """
-    if not documented_default:
-        return None
-    if not active:
-        return {"status": "active_unavailable", "checked": {}}
-    checked: dict[str, Any] = {}
-    matches = True
-    for key, expected in documented_default.items():
-        observed = active.get(key)
-        ok = observed == expected
-        matches = matches and ok
-        checked[key] = {"expected": expected, "observed": observed, "matches": ok}
-    return {
-        "status": "matches_documented_default" if matches else "drift_detected",
-        "checked": checked,
-    }
-
-
-# ── Live projections (compact, safe, fail-soft) ──────────────────────────────
-# Each returns a small dict of already-safe machine values. They are module
-# level so tests can substitute one to prove the redaction pass runs.
-
-
-def _project_role_separation() -> dict[str, Any]:
-    matrix = console_authz.rbac_matrix()
-    return {
-        "model_version": matrix.get("model_version"),
-        "active_phase": matrix.get("active_phase"),
-        "roles": [r.get("role") for r in matrix.get("roles", [])],
-        "privileged_action_count": len(matrix.get("privileged_actions", [])),
-        "default_decision": matrix.get("default_decision"),
-        "execution_enabled": matrix.get("execution_enabled"),
-    }
-
-
-def _project_redaction() -> dict[str, Any]:
-    policy = console_redaction.redaction_policy()
-    return {
-        "policy_version": policy.get("policy_version"),
-        "placeholder": policy.get("placeholder"),
-        "applies_to": policy.get("applies_to"),
-        "console_detector_count": len(policy.get("console_rules", [])),
-        "redact_before_persist": policy.get("redact_before_persist"),
-        "failure_mode": policy.get("failure_mode"),
-    }
-
-
-def _project_audit() -> dict[str, Any]:
-    policy = console_audit.audit_policy()
-    return {
-        "schema_version": policy.get("schema_version"),
-        "required_field_count": len(policy.get("required_fields", [])),
-        "results": policy.get("results"),
-        "retention_defaults_days": policy.get("retention_defaults_days"),
-        "append_only": policy.get("append_only"),
-        "redact_before_persist": policy.get("redact_before_persist"),
-        "enabled": policy.get("enabled"),
-    }
-
-
-def _static(value: dict[str, Any]) -> Callable[[], dict[str, Any]]:
-    return lambda: dict(value)
-
-
-# ── Guardrail catalog ────────────────────────────────────────────────────────
-# One row per major guardrail. ``project`` yields the active value (may raise;
-# caught per entry). ``documented_default`` drives the feasible diff.
-
-_CatalogRow = tuple[
-    str,
-    str,
-    str,
-    str,
-    tuple[SourcePointer, ...],
-    Callable[[], dict[str, Any]] | None,
-    dict[str, Any] | None,
-]
-
-_CATALOG: tuple[_CatalogRow, ...] = (
-    (
-        "role_separation",
-        "Role separation and RBAC",
-        "role_separation",
-        "Author, reviewer, merger, and reconciler capabilities are disjoint and "
-        "role-exclusive; self-review and self-merge are always blocked. The "
-        "console RBAC model defaults to deny.",
-        (
-            SourcePointer("task capability map", "task_capability_map.py", "module"),
-            SourcePointer("role/namespace gate", "role_namespace_gate.py", "module"),
-            SourcePointer("console RBAC", "webui/console_authz.py", "module"),
-        ),
-        _project_role_separation,
-        {"default_decision": "deny", "execution_enabled": False},
-    ),
-    (
-        "lease_rules",
-        "Issue and PR lease lifecycle",
-        "lease_rules",
-        "Durable work is claimed through issue locks and control-plane leases "
-        "with freshness, expiry, and dead-session recovery; abandoned or stale "
-        "claims are reclaimed only through the sanctioned recovery path.",
-        (
-            SourcePointer("issue lock store", "issue_lock_store.py", "module"),
-            SourcePointer("branch cleanup guard", "branch_cleanup_guard.py", "module"),
-            SourcePointer("safety model §5", "docs/safety-model.md", "doc", "5-mutation-gating"),
-        ),
-        None,
-        None,
-    ),
-    (
-        "worktree_rules",
-        "Author worktree binding",
-        "worktree_rules",
-        "Author mutations require a validated worktree under branches/ derived "
-        "from the active issue lock; silent fallback to the stable control "
-        "checkout or master is forbidden (#618).",
-        (
-            SourcePointer("author worktree gate", "author_mutation_worktree.py", "module"),
-            SourcePointer("worktree bootstrap", "scripts/worktree-start", "script"),
-            SourcePointer("workflow scope guard", "workflow_scope_guard.py", "module"),
-        ),
-        None,
-        None,
-    ),
-    (
-        "merge_confirmation",
-        "Explicit merge confirmation",
-        "merge_confirmation",
-        "A merge fails closed unless the caller passes the exact confirmation "
-        "phrase for that PR; reviewing never implies merging.",
-        (
-            SourcePointer("merge path", "merge_pr.py", "module"),
-            SourcePointer("merge tool gate", "gitea_mcp_server.py", "module"),
-        ),
-        _static({"required_confirmation_format": "MERGE PR <n>", "auto_merge": False}),
-        {"auto_merge": False},
-    ),
-    (
-        "redaction",
-        "Secret redaction",
-        "redaction",
-        "Every console surface runs the shared gitea_audit pass then console "
-        "patterns before any payload, HTML, log line, or audit record leaves "
-        "the server; unredactable values fail closed to the placeholder.",
-        (
-            SourcePointer("console redaction", "webui/console_redaction.py", "module"),
-            SourcePointer("shared redaction", "gitea_audit.py", "module"),
-            SourcePointer("safety model §3", "docs/safety-model.md", "doc", "3-secret-redaction"),
-        ),
-        _project_redaction,
-        {"redact_before_persist": True},
-    ),
-    (
-        "contamination",
-        "Contamination containment",
-        "contamination",
-        "A session contaminated by a direct stable-branch push or a manual MCP "
-        "daemon kill is blocked from review, merge, close, and completion "
-        "mutations until cleared (reconciler-exempt).",
-        (
-            SourcePointer("contamination gates", "gitea_mcp_server.py", "module"),
-            SourcePointer("stable-branch audit", "workflow_scope_guard.py", "module"),
-        ),
-        None,
-        None,
-    ),
-    (
-        "allocator_policy",
-        "Work allocation policy",
-        "allocator_policy",
-        "Workers do not self-select exclusive work; the controller-owned "
-        "allocator ranks the complete queue by priority then PRs-before-issues "
-        "then ascending number, honoring dependency edges and foreign claims.",
-        (
-            SourcePointer("allocator", "gitea_mcp_server.py", "module"),
-            SourcePointer("safety model §5", "docs/safety-model.md", "doc", "5-mutation-gating"),
-        ),
-        _static(
-            {
-                "self_select_exclusive_work": False,
-                "ranking": "priority desc, PRs before issues, number asc",
-                "respects_dependency_edges": True,
-                "respects_foreign_claims": True,
-            }
-        ),
-        {"self_select_exclusive_work": False},
-    ),
-    (
-        "audit_logging",
-        "Audit logging",
-        "audit_logging",
-        "Console intent and authorization outcomes are recorded to an "
-        "append-only, redact-before-persist audit log; MCP mutations are "
-        "recorded by gitea_audit and correlated by request id.",
-        (
-            SourcePointer("console audit", "webui/console_audit.py", "module"),
-            SourcePointer("MCP audit", "gitea_audit.py", "module"),
-            SourcePointer("safety model §1", "docs/safety-model.md", "doc", "1-audit-logging-and-confirmation"),
-        ),
-        _project_audit,
-        {"append_only": True, "redact_before_persist": True},
-    ),
-    (
-        "mutation_gating",
-        "Mutation gating and master parity",
-        "mutation_gating",
-        "Mutations fail closed while the running server is stale relative to "
-        "master, and every mutation is preceded by identity and capability "
-        "resolution in a fixed pre-flight order.",
-        (
-            SourcePointer("mutation gate", "gitea_mcp_server.py", "module"),
-            SourcePointer("safety model §5", "docs/safety-model.md", "doc", "5-mutation-gating"),
-        ),
-        _static(
-            {
-                "stale_runtime_blocks_mutations": True,
-                "preflight_order": "whoami -> resolve_task_capability -> mutation",
-            }
-        ),
-        {"stale_runtime_blocks_mutations": True},
-    ),
-)
-
-
-def _build_entry(row: _CatalogRow) -> PolicyEntry:
-    key, title, category, summary, sources, project, documented_default = row
-    active: dict[str, Any] | None = None
-    error: str | None = None
-    if project is not None:
-        try:
-            active = project()
-        except Exception as exc:  # noqa: BLE001 — fail soft; never take the page down
-            active = None
-            error = f"active projection unavailable: {exc}"
-    diff = _diff_active_vs_default(active, documented_default)
-    return PolicyEntry(
-        key=key,
-        title=title,
-        category=category,
-        summary=summary,
-        sources=sources,
-        active=active,
-        documented_default=documented_default,
-        diff=diff,
-        error=error,
-    )
-
-
-def load_policy_inventory() -> PolicyInventorySnapshot:
-    """Build the read-only guardrail inventory. Never raises for one bad entry."""
-    entries: list[PolicyEntry] = []
-    build_errors: list[str] = []
-    for row in _CATALOG:
-        try:
-            entries.append(_build_entry(row))
-        except Exception as exc:  # noqa: BLE001 — one row must not break the rest
-            build_errors.append(f"{row[0]}: {exc}")
-    categories = tuple(dict.fromkeys(e.category for e in entries))
-    return PolicyInventorySnapshot(
-        schema_version=SCHEMA_VERSION,
-        read_only=True,
-        note=READ_ONLY_NOTE,
-        entries=tuple(entries),
-        categories=categories,
-        build_errors=tuple(build_errors),
-    )
-
-
-def snapshot_to_dict(snapshot: PolicyInventorySnapshot) -> dict[str, Any]:
-    """Serialize the snapshot, redacting the entire payload before it is emitted."""
-    payload = {
-        "schema_version": snapshot.schema_version,
-        "read_only": snapshot.read_only,
-        "note": snapshot.note,
-        "categories": list(snapshot.categories),
-        "entry_count": len(snapshot.entries),
-        "entries": [entry.to_dict() for entry in snapshot.entries],
-        "build_errors": list(snapshot.build_errors),
-    }
-    return console_redaction.redact_payload(payload)

webui/policy_views.py

@@ -1,104 +0,0 @@
-"""HTML views for the workflow policy and guardrail inventory (#646)."""
-
-from __future__ import annotations
-
-import html
-import json
-
-from webui.policy_inventory import PolicyEntry, PolicyInventorySnapshot
-
-
-def _source_pointer(source) -> str:
-    path = source.path
-    if source.anchor:
-        path = f"{path}#{source.anchor}"
-    return (
-        f"<li>{html.escape(source.label)} — "
-        f"<code>{html.escape(path)}</code> "
-        f"<span class='muted'>({html.escape(source.kind)})</span></li>"
-    )
-
-
-def _active_block(entry: PolicyEntry) -> str:
-    if entry.error:
-        return (
-            "<p class='muted'><strong>Active value unavailable:</strong> "
-            f"{html.escape(entry.error)}</p>"
-        )
-    if not entry.active:
-        return "<p class='muted'>No live projection for this guardrail.</p>"
-    pretty = json.dumps(entry.active, indent=2, sort_keys=True, default=str)
-    return f"<pre class='prompt-text'>{html.escape(pretty)}</pre>"
-
-
-def _diff_block(entry: PolicyEntry) -> str:
-    if entry.diff is None:
-        if entry.documented_default is None:
-            return "<p class='muted'>Diff vs documented default: not feasible (no declared default).</p>"
-        return "<p class='muted'>Diff vs documented default: unavailable.</p>"
-    status = entry.diff.get("status", "unknown")
-    badge = "badge-claimed" if status == "matches_documented_default" else "badge-blocked"
-    rows = []
-    for key, cell in (entry.diff.get("checked") or {}).items():
-        marker = "✓" if cell.get("matches") else "✗"
-        rows.append(
-            "<tr>"
-            f"<td><code>{html.escape(str(key))}</code></td>"
-            f"<td><code>{html.escape(str(cell.get('expected')))}</code></td>"
-            f"<td><code>{html.escape(str(cell.get('observed')))}</code></td>"
-            f"<td>{marker}</td>"
-            "</tr>"
-        )
-    table = ""
-    if rows:
-        table = (
-            "<table class='detail'><thead><tr>"
-            "<th>Key</th><th>Documented</th><th>Active</th><th>Match</th>"
-            "</tr></thead><tbody>"
-            f"{''.join(rows)}</tbody></table>"
-        )
-    return (
-        f"<p class='meta'>Diff vs documented default: "
-        f"<span class='badge {badge}'>{html.escape(status)}</span></p>"
-        f"{table}"
-    )
-
-
-def _entry_card(entry: PolicyEntry) -> str:
-    sources = "".join(_source_pointer(s) for s in entry.sources)
-    return (
-        "<div class='prompt-card'>"
-        f"<h3>{html.escape(entry.title)} "
-        f"<span class='badge'>{html.escape(entry.category)}</span></h3>"
-        f"<p>{html.escape(entry.summary)}</p>"
-        "<p class='meta'><strong>Source pointers</strong></p>"
-        f"<ul>{sources}</ul>"
-        "<p class='meta'><strong>Active configuration</strong></p>"
-        f"{_active_block(entry)}"
-        f"{_diff_block(entry)}"
-        "</div>"
-    )
-
-
-def render_policy_page(snapshot: PolicyInventorySnapshot) -> str:
-    categories = ", ".join(html.escape(c) for c in snapshot.categories) or "none"
-    cards = "".join(_entry_card(e) for e in snapshot.entries)
-    build_errors = ""
-    if snapshot.build_errors:
-        items = "".join(
-            f"<li>{html.escape(err)}</li>" for err in snapshot.build_errors
-        )
-        build_errors = (
-            "<div class='stub'><p><strong>Some guardrails could not be built:"
-            f"</strong></p><ul>{items}</ul></div>"
-        )
-    return (
-        "<h2>Workflow policy &amp; guardrails</h2>"
-        f"<p class='muted'>{html.escape(snapshot.note)}</p>"
-        f"<p class='meta'>Schema v{snapshot.schema_version} · "
-        f"{len(snapshot.entries)} guardrails · categories: {categories}</p>"
-        f"{build_errors}"
-        f"{cards}"
-        "<p class='muted'>This page is read-only. It reports enforced policy "
-        "and never edits or weakens a gate. Secret values are redacted.</p>"
-    )