Merge branch 'master' into feat/issue-642-sanctioned-restart-controls

Adds a gated `system.restart_namespace` action so operators and workers can
restart or gracefully reload MCP namespaces through an authorized, audited
path instead of manual host process killing (#630).

- webui/sanctioned_restart.py: restart/reload operation model, dry-run
  intent preview, confirmation-string enforcement, audit emission, and
  post-restart health verification. Fails closed on unknown auth, missing
  capability, or ambiguous target namespace.
- webui/console_authz.py: RBAC entries for the restart capability with
  secret redaction preserved.
- webui/gated_actions.py: registers the restart action in the gated action
  framework so it cannot be invoked without capability + confirmation.
- task_capability_map.py: capability mapping for the restart operation.
- docs/sanctioned-restart-controls.md: operator documentation for the
  sanctioned path and the explicit prohibition on pkill recovery.
- docs/webui-authz-audit.md: audit model updated for restart events.
- tests/test_webui_sanctioned_restart.py: authorized preview, unauthorized
  deny, confirmation enforcement, contamination classification, and audit
  emission coverage.

No unrestricted kill path is exposed; manual pkill remains classified as
contamination and continues to block clean claims.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

control_plane_db.py

@@ -599,35 +599,6 @@ class ControlPlaneDB:
                 (_ts(), session_id),
             )
 
-    def list_sessions(
-        self,
-        *,
-        statuses: Sequence[str] | None = None,
-        limit: int = 500,
-    ) -> list[dict[str, Any]]:
-        """List session rows for restart / impact analysis (#658).
-
-        Read-only. Sessions are the process-level unit an MCP restart
-        disrupts, so the restart coordinator inventories them to compute blast
-        radius. Optional ``statuses`` filter (e.g. ``('active',)``) narrows to
-        live rows. Never returns secrets — only operational metadata.
-        """
-        clauses: list[str] = []
-        params: list[Any] = []
-        if statuses:
-            placeholders = ", ".join("?" for _ in statuses)
-            clauses.append(f"status IN ({placeholders})")
-            params.extend(statuses)
-        where = ("WHERE " + " AND ".join(clauses)) if clauses else ""
-        sql = (
-            f"SELECT * FROM sessions {where} "
-            "ORDER BY last_heartbeat_at DESC LIMIT ?"
-        )
-        params.append(max(1, int(limit)))
-        with self._tx(immediate=False) as conn:
-            rows = conn.execute(sql, params).fetchall()
-            return [dict(r) for r in rows]
-
     # ── work items ────────────────────────────────────────────────────────
 
     def upsert_work_item(

docs/mcp-restart-coordinator.md

@@ -1,95 +0,0 @@
-# MCP restart coordinator and impact analysis (#658)
-
-Before any sanctioned MCP restart, a central coordinator evaluates the live
-control-plane state and produces an **impact preview** so operators and the web
-console (#642 / #652) can see the blast radius *before* concurrent LLM work is
-disrupted. Uncoordinated restarts destroy in-flight author/reviewer/merger work
-and give operators no way to see what they are about to break.
-
-This lands the coordinator + impact DTO + a dry-run MCP tool. It is the single
-sanctioned entry point for restart evaluation post-#657 (which inventoried the
-restart/reload/kill paths). The **mutative apply** path — actually performing a
-restart — is a later child gated by a drain proof and is explicitly out of
-scope here.
-
-## Components
-
-| Piece | Where | Responsibility |
-|-------|-------|----------------|
-| `restart_coordinator.evaluate_restart_impact` | `restart_coordinator.py` | Pure classification: inventory → impact report DTO. No I/O, no restart. |
-| `RestartImpactReport` / `SessionImpact` / `LeaseImpact` | `restart_coordinator.py` | Console-facing DTO (`.as_dict()` is JSON-serializable). |
-| `ControlPlaneDB.list_sessions` | `control_plane_db.py` | Read-only session inventory (the process-level unit a restart kills). |
-| `gitea_request_mcp_restart` | `gitea_mcp_server.py` | MCP tool: gathers inventory from the #613 DB, calls the coordinator, returns the report. Dry-run only. |
-
-## Dimensions evaluated
-
-The coordinator classifies the inventory across the dimensions #658 requires:
-
-- **Sessions** — every active MCP session; a restart terminates all of them.
-  Liveness = `status == active` **and** the owner pid is alive **and** the
-  heartbeat is fresh (default window 15 min). Dead/stale sessions do not count
-  toward blast radius.
-- **Leases / locks** — control-plane leases joined with work items and their
-  freshness (`lease_lifecycle.classify_lease_freshness`). Only `active` (live
-  owner) leases are *disruptive*; expired / released / dead-process leases never
-  withhold a restart.
-- **Issue / PR work** — the issues and PRs behind disruptive leases.
-- **Mutations / critical sections** — a live lease carrying an author worktree
-  or a mutating phase (`implementing`, `publishing`, `merging`, …) is a
-  critical section a restart must not sever.
-- **Terminal (merge) lock** — an active terminal lock always makes a restart
-  unsafe.
-- **Prior recovery attempts** — narrower recovery already tried (e.g. sanctioned
-  client reconnects) is echoed so the operator sees the escalation history.
-
-## Verdict
-
-Exactly three verdicts, matching the acceptance criteria:
-
-| Verdict | `allow_restart` | Meaning |
-|---------|-----------------|---------|
-| `safe` | `true` | No other live sessions, no live leases, no terminal lock. |
-| `unsafe` | `false` | Live work would be disrupted and no operator override is present — **or** the inventory could not be completed (fail closed). |
-| `override` | `true` | Live work present, but an operator override accepts the blast radius. |
-
-`override_would_allow` tells the console whether an override path exists for the
-current state. `blast_radius` is a `none` / `low` / `medium` / `high` severity
-band derived from the affected session and work counts.
-
-### Fail closed
-
-If the control-plane inventory cannot be completed (DB unavailable, a listing
-failed), `inventory_complete` is `false` and the verdict is `unsafe` / deny. An
-incomplete evaluation must never green-light a restart.
-
-### Operator override authority
-
-Override authority is read from the environment variable
-`GITEA_OPERATOR_RESTART_OVERRIDE_AUTHORIZATION` and **never** from a tool
-argument. A worker session cannot set an environment variable on an
-already-running daemon, so override cannot be self-asserted (same pattern as the
-#630 daemon-maintenance authorization). The `request_override` tool argument only
-expresses caller intent; it takes effect solely when the environment
-authorization is present.
-
-## The tool
-
-```text
-gitea_request_mcp_restart(remote, host, org, repo,
-                          dry_run=True, request_override=False,
-                          session_id=None, limit=200)
-```
-
-Read-only, dry-run, and it **never restarts anything**. `apply_supported` is
-always `false`; passing `dry_run=False` performs no restart and reports that
-apply is gated by a drain proof (a separate child).
-
-## Audit
-
-Every evaluation carries an `audit_record` (event, coordinator version, verdict,
-allow decision, blast radius, counts, timestamp) so restart decisions are
-auditable. No secrets flow through the coordinator — session ids, pids, and
-profiles are operational metadata only.
-
-A representative dry-run report is in
-[`mcp-restart-impact-sample.json`](./mcp-restart-impact-sample.json).

docs/mcp-restart-impact-sample.json

@@ -1,148 +0,0 @@
-{
-  "coordinator_version": "1.0.0-issue-658",
-  "evaluated_at": "2026-07-24T06:00:00+00:00",
-  "dry_run": true,
-  "restart_performed": false,
-  "inventory_complete": true,
-  "incomplete_reasons": [],
-  "verdict": "unsafe",
-  "allow_restart": false,
-  "override_would_allow": true,
-  "operator_override": false,
-  "blast_radius": "high",
-  "reasons": [
-    "live work would be disrupted; restart denied without operator override",
-    "1 critical section(s) in flight (active lease with a live owner)"
-  ],
-  "affected_sessions": [
-    {
-      "session_id": "prgs-author-30988-d6f43c25",
-      "role": "author",
-      "profile": "prgs-author",
-      "pid": 1,
-      "status": "active",
-      "alive": true,
-      "heartbeat_stale": false,
-      "is_requester": false,
-      "live": true
-    },
-    {
-      "session_id": "prgs-reviewer-4157-0ce9",
-      "role": "reviewer",
-      "profile": "prgs-reviewer",
-      "pid": 1,
-      "status": "active",
-      "alive": true,
-      "heartbeat_stale": false,
-      "is_requester": true,
-      "live": true
-    }
-  ],
-  "affected_leases": [
-    {
-      "lease_id": "lease-abc",
-      "session_id": "prgs-author-30988-d6f43c25",
-      "role": "author",
-      "phase": "implementing",
-      "freshness": "active",
-      "work_kind": "issue",
-      "work_number": 658,
-      "worktree_path": "/repo/branches/feat-issue-658",
-      "disruptive": true,
-      "is_mutation": true,
-      "is_critical_section": true
-    },
-    {
-      "lease_id": "lease-dead",
-      "session_id": "prgs-author-91485",
-      "role": "author",
-      "phase": "allocated",
-      "freshness": "stale_dead_process",
-      "work_kind": "issue",
-      "work_number": 651,
-      "worktree_path": null,
-      "disruptive": false,
-      "is_mutation": false,
-      "is_critical_section": false
-    }
-  ],
-  "critical_sections": [
-    {
-      "lease_id": "lease-abc",
-      "session_id": "prgs-author-30988-d6f43c25",
-      "role": "author",
-      "phase": "implementing",
-      "freshness": "active",
-      "work_kind": "issue",
-      "work_number": 658,
-      "worktree_path": "/repo/branches/feat-issue-658",
-      "disruptive": true,
-      "is_mutation": true,
-      "is_critical_section": true
-    }
-  ],
-  "affected_issues": [
-    658
-  ],
-  "affected_prs": [],
-  "mutations": [
-    {
-      "lease_id": "lease-abc",
-      "session_id": "prgs-author-30988-d6f43c25",
-      "role": "author",
-      "phase": "implementing",
-      "freshness": "active",
-      "work_kind": "issue",
-      "work_number": 658,
-      "worktree_path": "/repo/branches/feat-issue-658",
-      "disruptive": true,
-      "is_mutation": true,
-      "is_critical_section": true
-    }
-  ],
-  "terminal_lock": null,
-  "ack_state": {
-    "prgs-author-30988-d6f43c25": "pending"
-  },
-  "prior_recovery_attempts": [
-    {
-      "kind": "client_reconnect",
-      "at": "2026-07-24T06:00:00+00:00",
-      "outcome": "insufficient"
-    }
-  ],
-  "counts": {
-    "sessions_total": 2,
-    "sessions_live_other": 1,
-    "leases_total": 2,
-    "leases_disruptive": 1,
-    "critical_sections": 1,
-    "mutations": 1,
-    "affected_issues": 1,
-    "affected_prs": 0,
-    "prior_recovery_attempts": 1
-  },
-  "audit_record": {
-    "event": "restart_impact_evaluated",
-    "coordinator_version": "1.0.0-issue-658",
-    "evaluated_at": "2026-07-24T06:00:00+00:00",
-    "dry_run": true,
-    "operator_override": false,
-    "requesting_session_id": "prgs-reviewer-4157-0ce9",
-    "inventory_complete": true,
-    "verdict": "unsafe",
-    "allow_restart": false,
-    "blast_radius": "high",
-    "counts": {
-      "sessions_total": 2,
-      "sessions_live_other": 1,
-      "leases_total": 2,
-      "leases_disruptive": 1,
-      "critical_sections": 1,
-      "mutations": 1,
-      "affected_issues": 1,
-      "affected_prs": 0,
-      "prior_recovery_attempts": 1
-    }
-  }
-}

docs/mcp-tool-inventory.md

@@ -135,7 +135,6 @@ that gates each call, not which tools exist.
 - `gitea_release_merger_pr_lease`
 - `gitea_release_reviewer_pr_lease`
 - `gitea_release_workflow_lease`
-- `gitea_request_mcp_restart`
 - `gitea_resolve_task_capability`
 - `gitea_resume_review_draft`
 - `gitea_review_pr`

docs/sanctioned-restart-controls.md

@@ -0,0 +1,122 @@
+# Sanctioned restart and graceful reload controls (#642)
+
+Sessions used to recover MCP connectivity by killing the host daemon
+(`pkill -f mcp_server.py`, #630). That is forbidden and stays forbidden: it
+kills every namespace on the host, contaminates whichever session survives, and
+leaves no audit trail. This document describes the sanctioned replacement,
+implemented in `webui/sanctioned_restart.py`.
+
+## What the console will and will not do
+
+The console **never** restarts anything. It authorizes an intent, records it,
+and hands off to a host supervisor. There is no code path in which the console
+sends a signal, spawns a process, or renders a kill command — a regression test
+asserts the module contains no `subprocess`, `signal`, `os.kill`, `os.system`,
+or `popen` reference, and that no returned payload contains a kill command.
+
+## Operations
+
+| Mode | Action | Minimum role | Behaviour |
+|------|--------|--------------|-----------|
+| `reload` | `system.reload_namespace` | controller | Host supervisor reloads the namespace in place, draining in-flight requests. |
+| `restart` | `system.restart_namespace` | admin | Host supervisor restarts the namespace. In-flight requests are lost. |
+
+Scope is always exactly one namespace. A fleet-wide restart is an explicit
+non-goal: `all`, `*`, `fleet`, and an empty scope are refused with
+`fleet_scope_not_permitted`, because that is precisely the blast radius the
+forbidden kill already had. An unrecognised namespace is refused rather than
+passed through to the host.
+
+## The gate sequence
+
+`assess_restart_request()` applies every gate in order and reports the first
+failure with a stable reason code:
+
+| Order | Gate | Reason code on failure |
+|-------|------|------------------------|
+| 1 | Mode is `restart` or `reload` | `unknown_mode` |
+| 2 | Scope is a single known namespace | `fleet_scope_not_permitted`, `unknown_namespace` |
+| 3 | Principal holds the required console role | `unauthorized` |
+| 4 | Confirmation phrase supplied | `confirmation_required` |
+| 5 | Confirmation names this namespace and mode | `confirmation_mismatch` |
+| 6 | Out-of-band operator authorization present | `operator_authorization_missing` |
+| 7 | Runtime is not contaminated | `contaminated_runtime` |
+| 8 | Host restart hook configured | `restart_hook_not_configured` |
+
+Passing every gate yields `host_action_required`, never "restarted".
+
+### Confirmation binds the namespace
+
+The required phrase is `"<mode> <namespace>"` — for example
+`restart gitea-author`. Binding the namespace into the phrase is the point: a
+confirmation typed for one namespace cannot be replayed against another.
+
+### Operator authorization is not self-assertable
+
+Host daemon maintenance is authorized out of band through
+`GITEA_OPERATOR_DAEMON_MAINTENANCE_AUTHORIZATION`, read from the process
+environment and nowhere else (#630; #710 finding F1). A worker session cannot
+set an environment variable for an already-running daemon, so this cannot be
+faked the way a tool argument could.
+
+### The host hook
+
+`GITEA_SANCTIONED_RESTART_HOOK` holds an opaque reference the *host* resolves —
+a supervisor label such as a launchd job name, never a command line. With no
+hook configured the request is refused; the console does not fall back to a
+process kill. The value is read server-side and never rendered to a client.
+
+## Manual kill remains contamination
+
+`classify_restart_command()` classifies an operator-proposed recovery command.
+A manual `pkill`/`kill`/`killall` of the MCP daemon is contamination, not a
+restart: it returns `clean_claim_allowed: false` and builds a durable
+contamination marker (redacted command only, never secrets) naming
+`system.restart_namespace` as the sanctioned alternative.
+
+A live, uncleared contamination marker also blocks a restart. This is stricter
+than #630's task-scoped gate, which deliberately lets a contaminated worker keep
+commenting and handing off: restarting a contaminated runtime would launder the
+contamination rather than resolve it. Clear the marker through the reconciler
+path first.
+
+## Post-restart health verification
+
+After the host supervisor acts, `verify_post_restart_health()` decides whether
+the session may claim to be clean:
+
+| Status | Meaning | Clean claim |
+|--------|---------|-------------|
+| `clean` | Required tool callable, proven through the live client namespace | Allowed |
+| `unproven` | Reported healthy without live client-namespace evidence | Refused |
+| `unhealthy` | Probe failed | Refused |
+
+Only `probe_source=client_namespace` evidence clears a session. Static tool
+registration is not proof, and neither is an offline subprocess probe — an IDE
+client can hold a registered tool list while live calls fail with
+`client is closing: EOF` (see
+[`mcp-namespace-health.md`](mcp-namespace-health.md)).
+
+## Audit
+
+Every attempt — allowed or denied — is recorded through
+`webui.console_audit` with actor, target namespace, mode, result, and reason
+code, and is redacted before it is persisted. `system.restart_namespace` is
+break-glass, so its records are retained for 730 days. Records carry
+`process_kill_executed: false`, which is a fact about the code path rather than
+a claim: no such path exists.
+
+## Environment variables
+
+| Variable | Purpose |
+|----------|---------|
+| `GITEA_SANCTIONED_RESTART_HOOK` | Host supervisor reference; absent means restart is refused. |
+| `GITEA_OPERATOR_DAEMON_MAINTENANCE_AUTHORIZATION` | Out-of-band operator authorization reference. |
+| `WEBUI_AUDIT_LOG` | Console audit sink; absent means records are built but not persisted. |
+
+## Non-goals
+
+* No unrestricted `kill` from the UI, in any role, in any phase.
+* No fleet-wide restart.
+* No silent auto-restart loop: every attempt is confirmed and audited.
+* This does not implement the Phase 1 health API (#634).

docs/webui-authz-audit.md

@@ -91,6 +91,8 @@ already define, and a regression test asserts each mapping matches.
 | `close_pr` | controller | privileged | `gitea.pr.close` | Yes | No | No | 3 |
 | `merge_pr` | controller | privileged | `gitea.pr.merge` | Yes | **Yes** | **Yes** | 3 |
 | `delete_branch` | admin | destructive | `gitea.branch.delete` | Yes | **Yes** | **Yes** | 3 |
+| `system.reload_namespace` | controller | privileged | `runtime.reload_namespace` | Yes | No | No | 2 |
+| `system.restart_namespace` | admin | destructive | `runtime.restart_namespace` | Yes | **Yes** | **Yes** | 2 |
 
 **Dual control** means the acting principal may not be the sole authority: a
 second distinct principal must confirm. **Break-glass** means the action is
@@ -102,6 +104,13 @@ honouring it.
 `delete_branch` is admin-only rather than controller because it is the one
 irreversible action in the set.
 
+`system.restart_namespace` is admin-only for the same reason: restarting a
+namespace drops every in-flight request on it. `system.reload_namespace` drains
+first, so it is privileged but not destructive. Neither action is ever executed
+by the console — both hand off to a host supervisor, and neither exposes a raw
+process kill. See
+[`sanctioned-restart-controls.md`](sanctioned-restart-controls.md) (#642).
+
 ### Authorization decision
 
 `authorize(action_id, principal, for_execution=False)` returns a decision
@@ -199,8 +208,8 @@ breaking the request it describes.
 | Class | Applies to | Default |
 |-------|-----------|---------|
 | `standard` | Routine gated writes | 90 days |
-| `privileged` | `review_pr`, `close_pr`, and any unclassifiable action | 365 days |
-| `break_glass` | `merge_pr`, `delete_branch` | 730 days |
+| `privileged` | `review_pr`, `close_pr`, `system.reload_namespace`, and any unclassifiable action | 365 days |
+| `break_glass` | `merge_pr`, `delete_branch`, `system.restart_namespace` | 730 days |
 
 Each record carries its own class, day count, and computed `expires_at`, so
 retention is auditable per record rather than inferred from file age. An

gitea_mcp_server.py

@@ -2040,7 +2040,6 @@ import dependency_graph  # noqa: E402  # #784 durable dependency edges
 import control_plane_db  # noqa: E402
 import lease_lifecycle  # noqa: E402
 import workflow_dashboard  # noqa: E402  # #605 live queue/lease dashboard
-import restart_coordinator  # noqa: E402  # #658 MCP restart coordinator/impact
 import incident_bridge  # noqa: E402
 import sentry_observability  # noqa: E402  (#606 optional Sentry observability)
 import sentry_incident_bridge  # noqa: E402  (#607 Sentry→Gitea incident bridge)
@@ -21490,156 +21489,6 @@ def gitea_workflow_dashboard(
     return payload
 
 
-@mcp.tool()
-def gitea_request_mcp_restart(
-    remote: str = "dadeschools",
-    host: str | None = None,
-    org: str | None = None,
-    repo: str | None = None,
-    dry_run: bool = True,
-    request_override: bool = False,
-    session_id: str | None = None,
-    limit: int = 200,
-) -> dict:
-    """Evaluate a proposed MCP restart and return an impact preview (#658).
-
-    Central restart coordinator: gathers live control-plane state (sessions,
-    leases/locks, in-flight issue/PR work, mutations, worktrees) and returns a
-    blast-radius impact report with a ``safe`` / ``unsafe`` / ``override``
-    verdict, so the console (#642/#652) and operators can see what a restart
-    would disrupt *before* any concurrent LLM work is destroyed.
-
-    This tool is **dry-run and never restarts anything.** The mutative apply
-    path is a separate child gated by a drain proof (non-goal here); calling
-    with ``dry_run=False`` still performs no restart and reports that apply is
-    not yet available.
-
-    Operator override authority is read from the process environment
-    (``GITEA_OPERATOR_RESTART_OVERRIDE_AUTHORIZATION``), never self-asserted by
-    the requesting session: ``request_override`` only expresses caller intent
-    and takes effect solely when that environment authorization is present.
-
-    Fails closed: if the control-plane inventory cannot be completed, the
-    verdict is ``unsafe`` / deny (an incomplete evaluation must never green-light
-    a restart).
-    """
-    read_block = _profile_operation_gate("gitea.read")
-    if read_block:
-        return {
-            "success": False,
-            "read_only": True,
-            "dry_run": True,
-            "restart_performed": False,
-            "reasons": read_block,
-            "permission_report": _permission_block_report("gitea.read"),
-        }
-
-    try:
-        h, o, r = _resolve(remote, host, org, repo)
-    except ValueError as exc:
-        return {
-            "success": False,
-            "read_only": True,
-            "dry_run": True,
-            "restart_performed": False,
-            "reasons": [str(exc)],
-        }
-
-    inventory_complete = True
-    incomplete_reasons: list[str] = []
-    sessions: list[dict] = []
-    leases: list[dict] = []
-    terminal_lock: dict | None = None
-
-    db, db_errs = _control_plane_db_or_error()
-    if db is None:
-        inventory_complete = False
-        incomplete_reasons.extend(
-            db_errs or ["control-plane DB unavailable; cannot evaluate restart"]
-        )
-    else:
-        try:
-            sessions = db.list_sessions(statuses=("active",), limit=max(1, int(limit)))
-        except Exception as exc:  # noqa: BLE001
-            inventory_complete = False
-            incomplete_reasons.append(
-                f"session inventory failed: {_redact(str(exc))}"
-            )
-        try:
-            lease_result = lease_lifecycle.list_active_leases(
-                db,
-                remote=remote if remote in REMOTES else remote,
-                org=o,
-                repo=r,
-                role=None,
-                include_non_active=False,
-                limit=max(1, int(limit)),
-            )
-            leases = list(lease_result.get("leases") or [])
-        except Exception as exc:  # noqa: BLE001
-            inventory_complete = False
-            incomplete_reasons.append(
-                f"lease inventory failed: {_redact(str(exc))}"
-            )
-        try:
-            terminal = db.get_active_terminal_lock(
-                remote=remote if remote in REMOTES else remote,
-                org=o,
-                repo=r,
-            )
-            if terminal:
-                terminal_lock = dict(terminal)
-        except Exception as exc:  # noqa: BLE001
-            inventory_complete = False
-            incomplete_reasons.append(
-                f"terminal lock lookup failed: {_redact(str(exc))}"
-            )
-
-    profile = get_profile()
-    profile_name = (profile.get("profile_name") or "").strip() or "session"
-    sid = (session_id or "").strip() or f"{profile_name}-{os.getpid()}"
-
-    # Override authority is read from the environment only — a worker session
-    # cannot set an env var for an already-running daemon, so it cannot be
-    # self-asserted the way a tool argument could (#630/#710 F1 pattern).
-    operator_authorized = bool(
-        (os.environ.get("GITEA_OPERATOR_RESTART_OVERRIDE_AUTHORIZATION") or "").strip()
-    )
-    operator_override = bool(request_override and operator_authorized)
-
-    inventory = {
-        "sessions": sessions,
-        "leases": leases,
-        "terminal_lock": terminal_lock,
-        "inventory_complete": inventory_complete,
-        "incomplete_reasons": incomplete_reasons,
-    }
-
-    report = restart_coordinator.evaluate_restart_impact(
-        inventory,
-        operator_override=operator_override,
-        requesting_session_id=sid,
-        dry_run=True,  # coordinator is always analysis-only (#658)
-    )
-
-    payload = report.as_dict()
-    payload["success"] = True
-    payload["read_only"] = True
-    payload["remote"] = remote
-    payload["org"] = o
-    payload["repo"] = r
-    payload["requesting_session_id"] = sid
-    payload["operator_override_requested"] = bool(request_override)
-    payload["operator_override_authorized"] = operator_authorized
-    payload["apply_supported"] = False
-    if not dry_run:
-        payload["reasons"] = list(payload.get("reasons") or []) + [
-            "apply requested but not supported: sanctioned restart apply is "
-            "gated by a drain proof (separate child); no restart performed (#658)"
-        ]
-    return payload
-
-
 @mcp.tool()
 def gitea_inspect_workflow_lease(
     lease_id: str,

restart_coordinator.py

@@ -1,451 +0,0 @@
-"""MCP restart coordinator and impact analysis (#658).
-
-Before any sanctioned MCP restart, a central coordinator must evaluate the
-live control-plane state — active sessions, leases/locks, in-flight issue/PR
-work, mutations, worktrees, and recovery history — and produce an *impact
-preview* so operators (and the web console, #642/#652) can see the blast
-radius **before** concurrent LLM work is disrupted.
-
-Design rules (mirrors the read-only posture of ``workflow_dashboard`` /
-``lease_lifecycle``):
-
-* **Pure classification.** :func:`evaluate_restart_impact` takes an already
-  gathered inventory and returns a structured report. It never touches the
-  network, the filesystem, or a live process, so multi-session fixtures can
-  drive every branch in unit tests. The coordinator *never restarts anything*;
-  a mutative apply path is a later child gated by a drain proof (non-goal here).
-* **Fail closed.** If the inventory is not explicitly complete, the verdict is
-  ``unsafe`` / deny — an incomplete evaluation must never green-light a restart.
-* **No secrets.** Session ids, pids, and profiles are operational metadata, not
-  credentials; nothing secret flows through this module.
-
-The single sanctioned entry point post-#657 is the MCP tool
-``gitea_request_mcp_restart`` (dry-run by default), which gathers the inventory
-from the #613 control-plane DB and calls :func:`evaluate_restart_impact`.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass, field
-from datetime import datetime, timezone
-from typing import Any, Mapping, Sequence
-
-import lease_lifecycle
-
-COORDINATOR_VERSION = "1.0.0-issue-658"
-
-# Restart verdicts. Exactly the three the acceptance criteria name.
-VERDICT_SAFE = "safe"
-VERDICT_UNSAFE = "unsafe"
-VERDICT_OVERRIDE = "override"
-
-# Blast-radius severity bands.
-BLAST_NONE = "none"
-BLAST_LOW = "low"
-BLAST_MEDIUM = "medium"
-BLAST_HIGH = "high"
-
-# A live lease with a live owner process is treated as active in-flight work.
-LEASE_FRESHNESS_LIVE = "active"
-
-# Default staleness window for a session heartbeat (seconds). A session whose
-# last heartbeat is older than this is not counted as live even if its row is
-# still marked ``active`` — it is assumed dead/detached.
-DEFAULT_SESSION_HEARTBEAT_STALE_SECONDS = 900
-
-
-def _utc_now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def _parse_ts(value: str | None) -> datetime | None:
-    return lease_lifecycle._parse_ts(value)
-
-
-@dataclass(frozen=True)
-class SessionImpact:
-    """One MCP session a restart would terminate."""
-
-    session_id: str
-    role: str | None
-    profile: str | None
-    pid: int | None
-    status: str | None
-    alive: bool | None
-    heartbeat_stale: bool
-    is_requester: bool
-    live: bool
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "session_id": self.session_id,
-            "role": self.role,
-            "profile": self.profile,
-            "pid": self.pid,
-            "status": self.status,
-            "alive": self.alive,
-            "heartbeat_stale": self.heartbeat_stale,
-            "is_requester": self.is_requester,
-            "live": self.live,
-        }
-
-
-@dataclass(frozen=True)
-class LeaseImpact:
-    """One control-plane lease a restart would disrupt."""
-
-    lease_id: str | None
-    session_id: str | None
-    role: str | None
-    phase: str | None
-    freshness: str | None
-    work_kind: str | None
-    work_number: int | None
-    worktree_path: str | None
-    disruptive: bool
-    is_mutation: bool
-    is_critical_section: bool
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "lease_id": self.lease_id,
-            "session_id": self.session_id,
-            "role": self.role,
-            "phase": self.phase,
-            "freshness": self.freshness,
-            "work_kind": self.work_kind,
-            "work_number": self.work_number,
-            "worktree_path": self.worktree_path,
-            "disruptive": self.disruptive,
-            "is_mutation": self.is_mutation,
-            "is_critical_section": self.is_critical_section,
-        }
-
-
-@dataclass(frozen=True)
-class RestartImpactReport:
-    """Impact preview DTO returned to the console / operator (#642/#652)."""
-
-    coordinator_version: str
-    evaluated_at: str
-    dry_run: bool
-    restart_performed: bool
-    inventory_complete: bool
-    verdict: str
-    allow_restart: bool
-    override_would_allow: bool
-    operator_override: bool
-    blast_radius: str
-    reasons: list[str]
-    affected_sessions: list[SessionImpact]
-    affected_leases: list[LeaseImpact]
-    critical_sections: list[LeaseImpact]
-    affected_issues: list[int]
-    affected_prs: list[int]
-    mutations: list[LeaseImpact]
-    terminal_lock: dict[str, Any] | None
-    ack_state: dict[str, str]
-    prior_recovery_attempts: list[dict[str, Any]]
-    counts: dict[str, int]
-    audit_record: dict[str, Any]
-    incomplete_reasons: list[str] = field(default_factory=list)
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "coordinator_version": self.coordinator_version,
-            "evaluated_at": self.evaluated_at,
-            "dry_run": self.dry_run,
-            "restart_performed": self.restart_performed,
-            "inventory_complete": self.inventory_complete,
-            "incomplete_reasons": list(self.incomplete_reasons),
-            "verdict": self.verdict,
-            "allow_restart": self.allow_restart,
-            "override_would_allow": self.override_would_allow,
-            "operator_override": self.operator_override,
-            "blast_radius": self.blast_radius,
-            "reasons": list(self.reasons),
-            "affected_sessions": [s.as_dict() for s in self.affected_sessions],
-            "affected_leases": [l.as_dict() for l in self.affected_leases],
-            "critical_sections": [l.as_dict() for l in self.critical_sections],
-            "affected_issues": list(self.affected_issues),
-            "affected_prs": list(self.affected_prs),
-            "mutations": [l.as_dict() for l in self.mutations],
-            "terminal_lock": self.terminal_lock,
-            "ack_state": dict(self.ack_state),
-            "prior_recovery_attempts": list(self.prior_recovery_attempts),
-            "counts": dict(self.counts),
-            "audit_record": dict(self.audit_record),
-        }
-
-
-def _classify_session(
-    row: Mapping[str, Any],
-    *,
-    now: datetime,
-    requesting_session_id: str | None,
-    heartbeat_stale_seconds: int,
-) -> SessionImpact:
-    session_id = str(row.get("session_id") or "")
-    pid = row.get("pid")
-    status = (row.get("status") or "").strip().lower() or None
-    alive = lease_lifecycle.is_process_alive(pid) if pid is not None else None
-    hb = _parse_ts(row.get("last_heartbeat_at"))
-    heartbeat_stale = bool(
-        hb is not None and (now - hb).total_seconds() > heartbeat_stale_seconds
-    )
-    live = bool(status == "active" and alive is not False and not heartbeat_stale)
-    return SessionImpact(
-        session_id=session_id,
-        role=row.get("role"),
-        profile=row.get("profile"),
-        pid=pid,
-        status=status,
-        alive=alive,
-        heartbeat_stale=heartbeat_stale,
-        is_requester=bool(
-            requesting_session_id and session_id == requesting_session_id
-        ),
-        live=live,
-    )
-
-
-# Lease phases that represent an active mutation in flight (as opposed to a
-# mere allocation/claim with no work committed yet). An active lease in any of
-# these phases is a critical section a restart must not sever.
-_MUTATING_PHASES = frozenset(
-    {
-        "implementing",
-        "publishing",
-        "pushing",
-        "committing",
-        "reviewing",
-        "merging",
-        "reconciling",
-        "conflict_fix",
-    }
-)
-
-
-def _classify_lease(row: Mapping[str, Any]) -> LeaseImpact:
-    freshness_obj = row.get("freshness")
-    if isinstance(freshness_obj, Mapping):
-        freshness = str(freshness_obj.get("freshness") or "").strip().lower() or None
-    else:
-        freshness = str(freshness_obj or "").strip().lower() or None
-    phase = (row.get("phase") or "").strip().lower() or None
-    worktree = row.get("worktree_path")
-    disruptive = freshness == LEASE_FRESHNESS_LIVE
-    # A live lease is a mutation-in-flight if it carries an author worktree or
-    # its phase names a mutating step. All disruptive leases are critical
-    # sections a restart would sever regardless.
-    is_mutation = bool(
-        disruptive and (bool(worktree) or (phase in _MUTATING_PHASES))
-    )
-    number = row.get("work_number")
-    try:
-        number = int(number) if number is not None else None
-    except (TypeError, ValueError):
-        number = None
-    return LeaseImpact(
-        lease_id=row.get("lease_id"),
-        session_id=row.get("session_id"),
-        role=row.get("role"),
-        phase=phase,
-        freshness=freshness,
-        work_kind=(str(row.get("work_kind") or "").strip().lower() or None),
-        work_number=number,
-        worktree_path=worktree,
-        disruptive=disruptive,
-        is_mutation=is_mutation,
-        is_critical_section=disruptive,
-    )
-
-
-def _blast_radius(*, session_count: int, work_count: int, mutation_count: int) -> str:
-    if mutation_count > 0 or work_count >= 3 or session_count >= 3:
-        return BLAST_HIGH
-    if work_count > 0 or session_count == 2:
-        return BLAST_MEDIUM
-    if session_count == 1:
-        return BLAST_LOW
-    return BLAST_NONE
-
-
-def evaluate_restart_impact(
-    inventory: Mapping[str, Any],
-    *,
-    now: datetime | None = None,
-    operator_override: bool = False,
-    requesting_session_id: str | None = None,
-    dry_run: bool = True,
-    session_heartbeat_stale_seconds: int = DEFAULT_SESSION_HEARTBEAT_STALE_SECONDS,
-) -> RestartImpactReport:
-    """Evaluate a proposed MCP restart and return an impact preview.
-
-    ``inventory`` is a mapping with:
-
-    * ``sessions`` — session rows (session_id, role, profile, pid, status,
-      last_heartbeat_at).
-    * ``leases`` — control-plane lease rows, each ideally carrying an enriched
-      ``freshness`` dict (as :func:`lease_lifecycle.list_active_leases` returns);
-      a bare string freshness is also accepted.
-    * ``terminal_lock`` — the active terminal (merge) lock, if any.
-    * ``prior_recovery_attempts`` — narrower recovery attempts already tried
-      (e.g. sanctioned reconnects) so the operator sees escalation history.
-    * ``inventory_complete`` — bool. **Must** be explicitly True; a missing or
-      falsy value forces a deny (fail closed).
-    * ``incomplete_reasons`` — optional reasons the inventory is incomplete.
-
-    The coordinator never restarts anything: ``restart_performed`` is always
-    False and the mutative apply path is a later drain-gated child.
-    """
-    moment = now or _utc_now()
-    reasons: list[str] = []
-
-    inventory_complete = bool(inventory.get("inventory_complete", False))
-    incomplete_reasons = [str(r) for r in (inventory.get("incomplete_reasons") or [])]
-
-    sessions_raw: Sequence[Mapping[str, Any]] = inventory.get("sessions") or []
-    leases_raw: Sequence[Mapping[str, Any]] = inventory.get("leases") or []
-    terminal_lock = inventory.get("terminal_lock") or None
-    prior_recovery_attempts = [
-        dict(a) for a in (inventory.get("prior_recovery_attempts") or [])
-    ]
-
-    session_impacts = [
-        _classify_session(
-            s,
-            now=moment,
-            requesting_session_id=requesting_session_id,
-            heartbeat_stale_seconds=session_heartbeat_stale_seconds,
-        )
-        for s in sessions_raw
-    ]
-    lease_impacts = [_classify_lease(l) for l in leases_raw]
-
-    # Only *other* live sessions and live leases constitute blast radius: a
-    # restart that would kill only the requesting session with no other work in
-    # flight is safe.
-    other_live_sessions = [
-        s for s in session_impacts if s.live and not s.is_requester
-    ]
-    disruptive_leases = [l for l in lease_impacts if l.disruptive]
-    critical_sections = [l for l in lease_impacts if l.is_critical_section]
-    mutations = [l for l in lease_impacts if l.is_mutation]
-
-    affected_issues = sorted(
-        {
-            l.work_number
-            for l in disruptive_leases
-            if l.work_kind == "issue" and l.work_number is not None
-        }
-    )
-    affected_prs = sorted(
-        {
-            l.work_number
-            for l in disruptive_leases
-            if l.work_kind == "pr" and l.work_number is not None
-        }
-    )
-
-    disruptive = bool(disruptive_leases or other_live_sessions or terminal_lock)
-
-    if not inventory_complete:
-        verdict = VERDICT_UNSAFE
-        allow_restart = False
-        reasons.append(
-            "inventory incomplete: restart evaluation cannot confirm blast "
-            "radius — deny (fail closed, #658)"
-        )
-        reasons.extend(incomplete_reasons)
-    elif not disruptive:
-        verdict = VERDICT_SAFE
-        allow_restart = True
-        reasons.append("no other live sessions, live leases, or terminal lock")
-    elif operator_override:
-        verdict = VERDICT_OVERRIDE
-        allow_restart = True
-        reasons.append(
-            "live work present; operator override accepts the blast radius"
-        )
-    else:
-        verdict = VERDICT_UNSAFE
-        allow_restart = False
-        reasons.append(
-            "live work would be disrupted; restart denied without operator "
-            "override"
-        )
-
-    if critical_sections and inventory_complete:
-        reasons.append(
-            f"{len(critical_sections)} critical section(s) in flight "
-            "(active lease with a live owner)"
-        )
-    if terminal_lock:
-        reasons.append("active terminal (merge) lock present")
-
-    override_would_allow = bool(inventory_complete and disruptive)
-
-    blast_radius = _blast_radius(
-        session_count=len(other_live_sessions),
-        work_count=len(affected_issues) + len(affected_prs),
-        mutation_count=len(mutations),
-    )
-
-    # Acknowledgement is a later child (drain protocol); expose per-session
-    # placeholders so the console can render the ack column now.
-    ack_state = {s.session_id: "pending" for s in other_live_sessions}
-
-    counts = {
-        "sessions_total": len(session_impacts),
-        "sessions_live_other": len(other_live_sessions),
-        "leases_total": len(lease_impacts),
-        "leases_disruptive": len(disruptive_leases),
-        "critical_sections": len(critical_sections),
-        "mutations": len(mutations),
-        "affected_issues": len(affected_issues),
-        "affected_prs": len(affected_prs),
-        "prior_recovery_attempts": len(prior_recovery_attempts),
-    }
-
-    audit_record = {
-        "event": "restart_impact_evaluated",
-        "coordinator_version": COORDINATOR_VERSION,
-        "evaluated_at": moment.isoformat(),
-        "dry_run": dry_run,
-        "operator_override": bool(operator_override),
-        "requesting_session_id": requesting_session_id,
-        "inventory_complete": inventory_complete,
-        "verdict": verdict,
-        "allow_restart": allow_restart,
-        "blast_radius": blast_radius,
-        "counts": counts,
-    }
-
-    return RestartImpactReport(
-        coordinator_version=COORDINATOR_VERSION,
-        evaluated_at=moment.isoformat(),
-        dry_run=dry_run,
-        restart_performed=False,
-        inventory_complete=inventory_complete,
-        verdict=verdict,
-        allow_restart=allow_restart,
-        override_would_allow=override_would_allow,
-        operator_override=bool(operator_override),
-        blast_radius=blast_radius,
-        reasons=reasons,
-        affected_sessions=session_impacts,
-        affected_leases=lease_impacts,
-        critical_sections=critical_sections,
-        affected_issues=affected_issues,
-        affected_prs=affected_prs,
-        mutations=mutations,
-        terminal_lock=dict(terminal_lock)
-        if isinstance(terminal_lock, Mapping)
-        else terminal_lock,
-        ack_state=ack_state,
-        prior_recovery_attempts=prior_recovery_attempts,
-        counts=counts,
-        audit_record=audit_record,
-        incomplete_reasons=incomplete_reasons,
-    )

task_capability_map.py

@@ -346,6 +346,21 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "role": "controller",
     },
 
+    # #642: sanctioned host-daemon lifecycle controls. Deliberately *not* a
+    # ``gitea.*`` operation — restarting an MCP namespace is a host action, not
+    # a Gitea API call, and no configured Gitea profile should be able to
+    # satisfy it by accident. Authority comes from the console RBAC model plus
+    # out-of-band operator authorization (#630); these entries exist so the
+    # console cannot invent an authority the capability layer never declared.
+    "restart_namespace": {
+        "permission": "runtime.restart_namespace",
+        "role": "controller",
+    },
+    "reload_namespace": {
+        "permission": "runtime.reload_namespace",
+        "role": "controller",
+    },
+
     # #601 first-class lease lifecycle — inspect/list need read; mutations gate on
     # ownership in the control-plane DB (not a separate Gitea write permission).
     "list_workflow_leases": {

tests/test_restart_coordinator.py

@@ -1,340 +0,0 @@
-"""Tests for the MCP restart coordinator and impact analysis (#658).
-
-Multi-session fixtures exercise every verdict branch: safe, unsafe (live work),
-override, and the fail-closed deny on incomplete inventory. Also covers the
-critical-section deny path and the new ``ControlPlaneDB.list_sessions``.
-"""
-
-from __future__ import annotations
-
-import os
-import tempfile
-import unittest
-from datetime import datetime, timedelta, timezone
-
-import restart_coordinator as rc
-from control_plane_db import ControlPlaneDB
-
-
-NOW = datetime(2026, 7, 24, 6, 0, 0, tzinfo=timezone.utc)
-
-
-def _ts(dt: datetime) -> str:
-    return dt.isoformat()
-
-
-def _live_pid() -> int:
-    return os.getpid()
-
-
-def _dead_pid() -> int:
-    # A pid that is essentially never alive. os.kill(0) on it raises
-    # ProcessLookupError → is_process_alive False.
-    return 2_000_000_000
-
-
-def _session(session_id, *, pid, status="active", heartbeat=None, role="author"):
-    return {
-        "session_id": session_id,
-        "role": role,
-        "profile": "prgs-author",
-        "pid": pid,
-        "status": status,
-        "last_heartbeat_at": _ts(heartbeat or NOW),
-    }
-
-
-def _lease(
-    lease_id,
-    *,
-    session_id,
-    freshness,
-    kind="issue",
-    number=658,
-    phase="allocated",
-    worktree=None,
-    role="author",
-):
-    return {
-        "lease_id": lease_id,
-        "session_id": session_id,
-        "role": role,
-        "phase": phase,
-        "work_kind": kind,
-        "work_number": number,
-        "worktree_path": worktree,
-        "freshness": {"freshness": freshness},
-    }
-
-
-class EvaluateRestartImpactTest(unittest.TestCase):
-    def test_incomplete_inventory_denies_fail_closed(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {"inventory_complete": False, "incomplete_reasons": ["db down"]},
-            now=NOW,
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertFalse(report.allow_restart)
-        self.assertFalse(report.restart_performed)
-        self.assertIn("db down", report.incomplete_reasons)
-        self.assertTrue(
-            any("fail closed" in reasoning for reasoning in report.reasons)
-        )
-
-    def test_missing_completeness_flag_denies(self) -> None:
-        # No inventory_complete key at all → treated as incomplete.
-        report = rc.evaluate_restart_impact({}, now=NOW)
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertFalse(report.allow_restart)
-
-    def test_no_other_work_is_safe(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("requester", pid=_live_pid())],
-                "leases": [],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_SAFE)
-        self.assertTrue(report.allow_restart)
-        self.assertEqual(report.blast_radius, rc.BLAST_NONE)
-        self.assertEqual(report.affected_issues, [])
-
-    def test_dead_foreign_session_and_lease_are_not_disruptive(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [
-                    _session("requester", pid=_live_pid()),
-                    _session("dead", pid=_dead_pid()),
-                ],
-                "leases": [
-                    _lease("l-dead", session_id="dead", freshness="stale_dead_process")
-                ],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_SAFE)
-        self.assertTrue(report.allow_restart)
-        self.assertEqual(report.counts["leases_disruptive"], 0)
-        self.assertEqual(report.counts["sessions_live_other"], 0)
-
-    def test_live_foreign_lease_denies_without_override(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [
-                    _session("requester", pid=_live_pid()),
-                    _session("worker", pid=_live_pid()),
-                ],
-                "leases": [
-                    _lease(
-                        "l1",
-                        session_id="worker",
-                        freshness="active",
-                        worktree="/tmp/wt-658",
-                        phase="implementing",
-                    )
-                ],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertFalse(report.allow_restart)
-        # Critical section detected: active lease with a live owner.
-        self.assertEqual(len(report.critical_sections), 1)
-        self.assertEqual(report.affected_issues, [658])
-        self.assertEqual(report.counts["mutations"], 1)
-        self.assertTrue(report.override_would_allow)
-        self.assertEqual(report.blast_radius, rc.BLAST_HIGH)
-        # Placeholder ack state for the affected session.
-        self.assertEqual(report.ack_state.get("worker"), "pending")
-
-    def test_operator_override_allows_despite_live_work(self) -> None:
-        inv = {
-            "inventory_complete": True,
-            "sessions": [
-                _session("requester", pid=_live_pid()),
-                _session("worker", pid=_live_pid()),
-            ],
-            "leases": [_lease("l1", session_id="worker", freshness="active")],
-        }
-        report = rc.evaluate_restart_impact(
-            inv,
-            now=NOW,
-            requesting_session_id="requester",
-            operator_override=True,
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_OVERRIDE)
-        self.assertTrue(report.allow_restart)
-        self.assertFalse(report.restart_performed)
-
-    def test_deny_when_critical_section_open(self) -> None:
-        # A single live author lease in a mutating phase is a critical section
-        # that must deny an un-overridden restart.
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("worker", pid=_live_pid())],
-                "leases": [
-                    _lease(
-                        "l1",
-                        session_id="worker",
-                        freshness="active",
-                        phase="merging",
-                        kind="pr",
-                        number=900,
-                    )
-                ],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertFalse(report.allow_restart)
-        self.assertEqual(report.affected_prs, [900])
-        self.assertEqual(len(report.critical_sections), 1)
-
-    def test_terminal_lock_makes_restart_unsafe(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("requester", pid=_live_pid())],
-                "leases": [],
-                "terminal_lock": {"terminal_pr": 812},
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertFalse(report.allow_restart)
-        self.assertIsNotNone(report.terminal_lock)
-        self.assertTrue(
-            any("terminal" in reasoning for reasoning in report.reasons)
-        )
-
-    def test_other_live_session_without_lease_is_disruptive(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [
-                    _session("requester", pid=_live_pid()),
-                    _session("idle-but-live", pid=_live_pid()),
-                ],
-                "leases": [],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertEqual(report.counts["sessions_live_other"], 1)
-
-    def test_stale_heartbeat_session_not_counted_live(self) -> None:
-        stale = NOW - timedelta(hours=2)
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [
-                    _session("requester", pid=_live_pid()),
-                    _session("stale", pid=_live_pid(), heartbeat=stale),
-                ],
-                "leases": [],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_SAFE)
-        self.assertEqual(report.counts["sessions_live_other"], 0)
-
-    def test_prior_recovery_attempts_echoed(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("requester", pid=_live_pid())],
-                "leases": [],
-                "prior_recovery_attempts": [
-                    {"kind": "client_reconnect", "at": _ts(NOW)}
-                ],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(len(report.prior_recovery_attempts), 1)
-        self.assertEqual(report.counts["prior_recovery_attempts"], 1)
-
-    def test_bare_string_freshness_accepted(self) -> None:
-        lease = _lease("l1", session_id="worker", freshness="active")
-        lease["freshness"] = "active"  # bare string, not a dict
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("worker", pid=_live_pid())],
-                "leases": [lease],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.counts["leases_disruptive"], 1)
-
-    def test_as_dict_is_serializable_dto(self) -> None:
-        import json
-
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("requester", pid=_live_pid())],
-                "leases": [],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        payload = report.as_dict()
-        # Round-trips through JSON — safe for the console DTO.
-        encoded = json.dumps(payload)
-        decoded = json.loads(encoded)
-        self.assertEqual(decoded["verdict"], rc.VERDICT_SAFE)
-        self.assertIn("audit_record", decoded)
-        self.assertEqual(decoded["audit_record"]["event"], "restart_impact_evaluated")
-        self.assertFalse(decoded["restart_performed"])
-        self.assertIn("coordinator_version", decoded)
-
-
-class ListSessionsTest(unittest.TestCase):
-    def setUp(self) -> None:
-        self._tmp = tempfile.TemporaryDirectory()
-        self.db = ControlPlaneDB(os.path.join(self._tmp.name, "cp.sqlite3"))
-
-    def tearDown(self) -> None:
-        self._tmp.cleanup()
-
-    def test_list_sessions_filters_by_status(self) -> None:
-        self.db.upsert_session(session_id="a", role="author", pid=1, status="active")
-        self.db.upsert_session(session_id="b", role="author", pid=2, status="ended")
-        active = self.db.list_sessions(statuses=("active",))
-        ids = {row["session_id"] for row in active}
-        self.assertEqual(ids, {"a"})
-        every = self.db.list_sessions()
-        self.assertEqual({row["session_id"] for row in every}, {"a", "b"})
-
-    def test_list_sessions_feeds_coordinator(self) -> None:
-        self.db.upsert_session(
-            session_id="requester", role="author", pid=os.getpid(), status="active"
-        )
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": self.db.list_sessions(statuses=("active",)),
-                "leases": [],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.counts["sessions_total"], 1)
-
-
-if __name__ == "__main__":  # pragma: no cover
-    unittest.main()

tests/test_webui_sanctioned_restart.py

@@ -0,0 +1,502 @@
+"""Sanctioned restart / graceful reload control tests (#642).
+
+Acceptance criteria under test:
+
+1. The sanctioned restart path is implemented behind gates (capability,
+   confirmation, operator authorization, host hook).
+2. Manual ``pkill`` stays forbidden and is classified as contamination.
+3. Post-restart mutations require clean health/session proof.
+4. Authorized restart preview, unauthorized deny, contamination classification.
+5. No entry point exposes a raw kill.
+"""
+
+import json
+import os
+import tempfile
+import unittest
+
+import mcp_namespace_health
+import runtime_recovery_guard
+from task_capability_map import TASK_CAPABILITY_MAP
+from webui import console_audit, console_authz, gated_actions, sanctioned_restart
+
+NAMESPACE = "gitea-author"
+
+# An operator-authorized, hook-configured host. Passed explicitly so no test
+# depends on (or mutates) the real process environment.
+READY_ENV = {
+    sanctioned_restart.RESTART_HOOK_ENV: "launchd:cc.prgs.gitea-author",
+    runtime_recovery_guard.OPERATOR_AUTHORIZATION_ENV: "ops-ticket-4821",
+}
+
+
+def admin(subject: str = "[email protected]") -> console_authz.Principal:
+    return console_authz.Principal(
+        subject=subject,
+        role=console_authz.ADMIN,
+        identity_source=console_authz.IDENTITY_ACCESS_PROXY,
+        authenticated=True,
+    )
+
+
+def viewer() -> console_authz.Principal:
+    return console_authz.Principal(
+        subject="[email protected]",
+        role=console_authz.VIEWER,
+        identity_source=console_authz.IDENTITY_ACCESS_PROXY,
+        authenticated=True,
+    )
+
+
+class TestCapabilityWiring(unittest.TestCase):
+    """AC1: authority is declared, not invented by the console."""
+
+    def test_actions_resolve_through_the_capability_map(self):
+        for action_id in (
+            sanctioned_restart.ACTION_RESTART_NAMESPACE,
+            sanctioned_restart.ACTION_RELOAD_NAMESPACE,
+        ):
+            with self.subTest(action=action_id):
+                action = console_authz.get_action(action_id)
+                self.assertIsNotNone(action)
+                self.assertIn(action.task_key, TASK_CAPABILITY_MAP)
+                self.assertEqual(
+                    action.mcp_permission,
+                    TASK_CAPABILITY_MAP[action.task_key]["permission"],
+                )
+
+    def test_restart_permission_is_not_a_gitea_operation(self):
+        """No configured Gitea profile should satisfy a host restart."""
+        permission = TASK_CAPABILITY_MAP["restart_namespace"]["permission"]
+        self.assertFalse(permission.startswith("gitea."))
+
+    def test_restart_is_destructive_dual_control_break_glass(self):
+        action = console_authz.get_action(
+            sanctioned_restart.ACTION_RESTART_NAMESPACE
+        )
+        self.assertEqual(action.action_class, console_authz.CLASS_DESTRUCTIVE)
+        self.assertEqual(action.minimum_role, console_authz.ADMIN)
+        self.assertTrue(action.dual_control)
+        self.assertTrue(action.break_glass)
+        self.assertTrue(action.requires_confirmation)
+
+    def test_reload_is_privileged_but_not_destructive(self):
+        action = console_authz.get_action(
+            sanctioned_restart.ACTION_RELOAD_NAMESPACE
+        )
+        self.assertEqual(action.action_class, console_authz.CLASS_PRIVILEGED)
+        self.assertTrue(action.requires_confirmation)
+
+
+class TestPreview(unittest.TestCase):
+    """AC4: an authorized preview renders the plan without executing it."""
+
+    def test_preview_lists_the_mutation_ledger(self):
+        preview = sanctioned_restart.build_restart_preview(
+            NAMESPACE, principal=admin(), env=READY_ENV
+        )
+        steps = [entry["step"] for entry in preview["mutation_ledger"]]
+        self.assertEqual(
+            steps, ["quiesce", "host_restart_hook", "health_recheck", "audit"]
+        )
+        self.assertTrue(preview["scope_valid"])
+        self.assertTrue(preview["post_restart_verification_required"])
+
+    def test_reload_preview_drains_instead_of_restarting(self):
+        preview = sanctioned_restart.build_restart_preview(
+            NAMESPACE, sanctioned_restart.MODE_RELOAD,
+            principal=admin(), env=READY_ENV,
+        )
+        steps = [entry["step"] for entry in preview["mutation_ledger"]]
+        self.assertIn("host_graceful_reload", steps)
+        self.assertNotIn("host_restart_hook", steps)
+
+    def test_preview_never_enables_execution(self):
+        preview = sanctioned_restart.build_restart_preview(
+            NAMESPACE, principal=admin(), env=READY_ENV
+        )
+        self.assertFalse(preview["execution_enabled"])
+        self.assertFalse(preview["authorization"]["execution_enabled"])
+
+    def test_confirmation_phrase_binds_the_namespace(self):
+        self.assertTrue(
+            sanctioned_restart.confirmation_matches(
+                NAMESPACE, sanctioned_restart.MODE_RESTART,
+                "restart gitea-author",
+            )
+        )
+        # A phrase typed for one namespace must not authorize another.
+        self.assertFalse(
+            sanctioned_restart.confirmation_matches(
+                "gitea-merger", sanctioned_restart.MODE_RESTART,
+                "restart gitea-author",
+            )
+        )
+
+
+class TestGates(unittest.TestCase):
+    """AC1/AC4: every gate denies with a stable reason code."""
+
+    def _assess(self, **kwargs):
+        params = {
+            "principal": admin(),
+            "confirmation": f"restart {NAMESPACE}",
+            "env": READY_ENV,
+        }
+        params.update(kwargs)
+        namespace = params.pop("namespace", NAMESPACE)
+        mode = params.pop("mode", sanctioned_restart.MODE_RESTART)
+        return sanctioned_restart.assess_restart_request(
+            namespace, mode, **params
+        )
+
+    def test_authorized_confirmed_request_passes_every_gate(self):
+        result = self._assess()
+        self.assertTrue(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.ALLOW_HOST_ACTION_REQUIRED
+        )
+
+    def test_passing_every_gate_is_not_an_execution_grant(self):
+        """An allowed request still never lets the console touch the process."""
+        result = self._assess()
+        self.assertTrue(result["allowed"])
+        self.assertFalse(result["execution_enabled"])
+        self.assertFalse(result["console_executes"])
+
+    def test_unauthorized_principal_is_denied(self):
+        result = self._assess(principal=viewer())
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_UNAUTHORIZED
+        )
+
+    def test_anonymous_principal_is_denied(self):
+        result = self._assess(principal=None)
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_UNAUTHORIZED
+        )
+
+    def test_missing_confirmation_is_denied(self):
+        result = self._assess(confirmation=None)
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_CONFIRMATION_MISSING
+        )
+
+    def test_confirmation_for_another_namespace_is_denied(self):
+        result = self._assess(confirmation="restart gitea-merger")
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_CONFIRMATION_MISMATCH
+        )
+
+    def test_missing_operator_authorization_is_denied(self):
+        env = {sanctioned_restart.RESTART_HOOK_ENV: "launchd:cc.prgs.author"}
+        result = self._assess(env=env)
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"],
+            sanctioned_restart.DENY_OPERATOR_AUTHORIZATION,
+        )
+
+    def test_missing_host_hook_is_denied_without_kill_fallback(self):
+        env = {
+            runtime_recovery_guard.OPERATOR_AUTHORIZATION_ENV: "ops-ticket-1",
+        }
+        result = self._assess(env=env)
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_HOOK_NOT_CONFIGURED
+        )
+
+    def test_fleet_scope_is_refused(self):
+        for scope in ("all", "*", "fleet"):
+            with self.subTest(scope=scope):
+                result = self._assess(
+                    namespace=scope, confirmation=f"restart {scope}"
+                )
+                self.assertFalse(result["allowed"])
+                self.assertEqual(
+                    result["reason_code"], sanctioned_restart.DENY_FLEET_SCOPE
+                )
+
+    def test_unknown_namespace_is_refused(self):
+        result = self._assess(
+            namespace="gitea-nope", confirmation="restart gitea-nope"
+        )
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_UNKNOWN_NAMESPACE
+        )
+
+    def test_unknown_mode_is_refused(self):
+        result = self._assess(mode="obliterate")
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_UNKNOWN_MODE
+        )
+
+    def test_live_contamination_marker_blocks_restart(self):
+        marker = runtime_recovery_guard.build_contamination_record(
+            reason_class=runtime_recovery_guard.REASON_MANUAL_DAEMON_KILL,
+            command_redacted="pkill -f mcp_server.py",
+        )
+        result = self._assess(contamination_marker=marker)
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_CONTAMINATED_RUNTIME
+        )
+
+    def test_reconciler_cleared_marker_no_longer_blocks(self):
+        marker = runtime_recovery_guard.build_contamination_record(
+            reason_class=runtime_recovery_guard.REASON_MANUAL_DAEMON_KILL,
+            command_redacted="pkill -f mcp_server.py",
+        )
+        marker = dict(marker, cleared_by_reconciler=True)
+        result = self._assess(contamination_marker=marker)
+        self.assertTrue(result["allowed"])
+
+
+class TestExecutionNeverKills(unittest.TestCase):
+    """AC5: no path exposes or runs a raw process kill."""
+
+    def test_authorized_execution_defers_to_the_host_supervisor(self):
+        result = sanctioned_restart.execute_restart(
+            NAMESPACE,
+            principal=admin(),
+            confirmation=f"restart {NAMESPACE}",
+            env=READY_ENV,
+        )
+        self.assertTrue(result["allowed"])
+        self.assertFalse(result["success"])
+        self.assertFalse(result["process_kill_executed"])
+        self.assertEqual(
+            result["outcome"], sanctioned_restart.ALLOW_HOST_ACTION_REQUIRED
+        )
+
+    def test_denied_execution_reports_the_refusing_gate(self):
+        result = sanctioned_restart.execute_restart(
+            NAMESPACE, principal=viewer(), confirmation=f"restart {NAMESPACE}",
+            env=READY_ENV,
+        )
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["outcome"], sanctioned_restart.DENY_UNAUTHORIZED
+        )
+        self.assertFalse(result["process_kill_executed"])
+
+    def test_module_never_spawns_a_process(self):
+        path = os.path.join(
+            os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+            "webui", "sanctioned_restart.py",
+        )
+        with open(path, encoding="utf-8") as handle:
+            source = handle.read()
+        for forbidden in (
+            "import subprocess", "import signal", "os.kill", "os.system",
+            "popen",
+        ):
+            with self.subTest(forbidden=forbidden):
+                self.assertNotIn(forbidden, source.lower())
+
+    def test_no_surface_returns_a_kill_command(self):
+        payloads = [
+            sanctioned_restart.build_restart_preview(
+                NAMESPACE, principal=admin(), env=READY_ENV
+            ),
+            sanctioned_restart.restart_policy(),
+            sanctioned_restart.execute_restart(
+                NAMESPACE, principal=admin(),
+                confirmation=f"restart {NAMESPACE}", env=READY_ENV,
+            ),
+        ]
+        for payload in payloads:
+            rendered = json.dumps(payload, default=str).lower()
+            self.assertNotIn("kill -9", rendered)
+            self.assertNotIn("pkill -f", rendered)
+
+    def test_policy_declares_no_raw_kill_and_no_silent_restart(self):
+        policy = sanctioned_restart.restart_policy()
+        self.assertFalse(policy["raw_kill_exposed"])
+        self.assertFalse(policy["console_executes_process_kill"])
+        self.assertFalse(policy["fleet_scope_permitted"])
+        self.assertFalse(policy["silent_auto_restart_permitted"])
+        self.assertTrue(policy["audit_required"])
+
+
+class TestContaminationClassification(unittest.TestCase):
+    """AC2: manual pkill is contamination, and it blocks clean claims."""
+
+    def test_manual_daemon_pkill_is_contamination(self):
+        result = sanctioned_restart.classify_restart_command(
+            "pkill -f mcp_server.py"
+        )
+        self.assertTrue(result["contamination"])
+        self.assertFalse(result["clean_claim_allowed"])
+        self.assertIsNotNone(result["contamination_marker"])
+        self.assertEqual(
+            result["sanctioned_alternative"],
+            sanctioned_restart.ACTION_RESTART_NAMESPACE,
+        )
+
+    def test_broad_process_kill_is_contamination(self):
+        result = sanctioned_restart.classify_restart_command("killall -9 Python")
+        self.assertTrue(result["contamination"])
+        self.assertFalse(result["clean_claim_allowed"])
+
+    def test_marker_names_the_sanctioned_alternative(self):
+        result = sanctioned_restart.classify_restart_command(
+            "pkill -f mcp_server.py"
+        )
+        marker = result["contamination_marker"]
+        self.assertIn(
+            sanctioned_restart.ACTION_RESTART_NAMESPACE, marker["detail"]
+        )
+
+    def test_benign_command_is_not_contamination(self):
+        result = sanctioned_restart.classify_restart_command("git status")
+        self.assertFalse(result["contamination"])
+        self.assertTrue(result["clean_claim_allowed"])
+
+    def test_no_command_is_not_contamination(self):
+        result = sanctioned_restart.classify_restart_command(None)
+        self.assertFalse(result["contamination"])
+        self.assertTrue(result["clean_claim_allowed"])
+
+
+class TestPostRestartHealth(unittest.TestCase):
+    """AC3: a clean post-restart claim needs live client-namespace proof."""
+
+    def test_live_client_probe_clears_the_session(self):
+        result = sanctioned_restart.verify_post_restart_health(
+            NAMESPACE,
+            probe_result={"success": True},
+            probe_source=mcp_namespace_health.PROBE_SOURCE_CLIENT,
+            registered_tools=["gitea_whoami"],
+            required_tool="gitea_whoami",
+        )
+        self.assertEqual(result["status"], sanctioned_restart.HEALTH_CLEAN)
+        self.assertTrue(result["clean_claim_allowed"])
+        self.assertTrue(result["mutations_allowed"])
+
+    def test_offline_probe_does_not_clear_the_session(self):
+        result = sanctioned_restart.verify_post_restart_health(
+            NAMESPACE,
+            probe_result={"success": True},
+            probe_source=mcp_namespace_health.PROBE_SOURCE_OFFLINE,
+            registered_tools=["gitea_whoami"],
+            required_tool="gitea_whoami",
+        )
+        self.assertFalse(result["clean_claim_allowed"])
+        self.assertFalse(result["mutations_allowed"])
+
+    def test_failed_probe_is_unhealthy(self):
+        result = sanctioned_restart.verify_post_restart_health(
+            NAMESPACE,
+            probe_result={"success": False, "error": "client is closing: EOF"},
+            probe_source=mcp_namespace_health.PROBE_SOURCE_CLIENT,
+            registered_tools=["gitea_whoami"],
+            required_tool="gitea_whoami",
+        )
+        self.assertEqual(result["status"], sanctioned_restart.HEALTH_UNHEALTHY)
+        self.assertFalse(result["clean_claim_allowed"])
+
+    def test_static_registration_alone_never_clears_the_session(self):
+        result = sanctioned_restart.verify_post_restart_health(
+            NAMESPACE,
+            registered_tools=["gitea_whoami"],
+            required_tool="gitea_whoami",
+        )
+        self.assertFalse(result["clean_claim_allowed"])
+
+
+class TestAuditEmission(unittest.TestCase):
+    """Every restart attempt is audited with actor, target, and result."""
+
+    def _run(self, principal, sink):
+        prior = os.environ.get(console_audit.AUDIT_LOG_ENV)
+        os.environ[console_audit.AUDIT_LOG_ENV] = sink
+        try:
+            return sanctioned_restart.execute_restart(
+                NAMESPACE,
+                principal=principal,
+                confirmation=f"restart {NAMESPACE}",
+                env=READY_ENV,
+                request_id="req-642",
+            )
+        finally:
+            if prior is None:
+                os.environ.pop(console_audit.AUDIT_LOG_ENV, None)
+            else:
+                os.environ[console_audit.AUDIT_LOG_ENV] = prior
+
+    def test_allowed_attempt_is_written_with_actor_and_target(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            sink = os.path.join(tmp, "audit.jsonl")
+            result = self._run(admin(), sink)
+            self.assertTrue(result["audit"]["written"])
+            with open(sink, encoding="utf-8") as handle:
+                record = json.loads(handle.read().strip())
+        self.assertEqual(
+            record["action"], sanctioned_restart.ACTION_RESTART_NAMESPACE
+        )
+        self.assertEqual(record["target"]["namespace"], NAMESPACE)
+        self.assertEqual(record["target"]["mode"], "restart")
+        self.assertEqual(record["result"], console_audit.RESULT_ALLOWED)
+        self.assertEqual(record["actor"]["subject"], "[email protected]")
+        self.assertFalse(record["metadata"]["process_kill_executed"])
+
+    def test_denied_attempt_is_audited_too(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            sink = os.path.join(tmp, "audit.jsonl")
+            self._run(viewer(), sink)
+            with open(sink, encoding="utf-8") as handle:
+                record = json.loads(handle.read().strip())
+        self.assertEqual(record["result"], console_audit.RESULT_DENIED)
+        self.assertEqual(
+            record["reason_code"], sanctioned_restart.DENY_UNAUTHORIZED
+        )
+
+    def test_restart_audit_uses_break_glass_retention(self):
+        action = console_authz.get_action(
+            sanctioned_restart.ACTION_RESTART_NAMESPACE
+        )
+        self.assertEqual(
+            console_audit.retention_class_for(action),
+            console_audit.RETENTION_BREAK_GLASS,
+        )
+
+
+class TestRegistrySurface(unittest.TestCase):
+    """AC5: the console surfaces the control, still disabled, with no kill."""
+
+    def test_registry_exposes_both_actions_disabled(self):
+        registry = gated_actions.load_action_registry()
+        for action_id in (
+            sanctioned_restart.ACTION_RESTART_NAMESPACE,
+            sanctioned_restart.ACTION_RELOAD_NAMESPACE,
+        ):
+            with self.subTest(action=action_id):
+                action = registry.get(action_id)
+                self.assertIsNotNone(action)
+                self.assertFalse(action.enabled)
+
+    def test_registry_preview_names_the_namespace_target(self):
+        preview = gated_actions.preview_action(
+            sanctioned_restart.ACTION_RESTART_NAMESPACE, namespace=NAMESPACE
+        )
+        target = preview["mutation_ledger"][0]["target"]
+        self.assertIn(NAMESPACE, target)
+        self.assertFalse(preview["enabled"])
+
+    def test_registry_attempt_fails_closed(self):
+        result = gated_actions.attempt_action(
+            sanctioned_restart.ACTION_RESTART_NAMESPACE, namespace=NAMESPACE
+        )
+        self.assertFalse(result["success"])
+
+
+if __name__ == "__main__":
+    unittest.main()

webui/console_authz.py

@@ -236,6 +236,34 @@ _ACTION_SPECS: tuple[ConsoleAction, ...] = (
         phase=3,
         summary="Remove a remote feature branch.",
     ),
+    # #642: sanctioned daemon lifecycle. These exist so operators have an
+    # audited path off `pkill -f mcp_server.py` (#630). Restart drops every
+    # in-flight request on a namespace, so it carries the same dual-control and
+    # break-glass weight as a merge; reload drains first and is privileged but
+    # not destructive. Neither ever exposes a raw kill: execution is handed to
+    # a host supervisor by ``webui.sanctioned_restart``.
+    ConsoleAction(
+        action_id="system.reload_namespace",
+        task_key="reload_namespace",
+        action_class=CLASS_PRIVILEGED,
+        minimum_role=CONTROLLER,
+        requires_confirmation=True,
+        dual_control=False,
+        break_glass=False,
+        phase=2,
+        summary="Gracefully reload one MCP namespace via the host supervisor.",
+    ),
+    ConsoleAction(
+        action_id="system.restart_namespace",
+        task_key="restart_namespace",
+        action_class=CLASS_DESTRUCTIVE,
+        minimum_role=ADMIN,
+        requires_confirmation=True,
+        dual_control=True,
+        break_glass=True,
+        phase=2,
+        summary="Restart one MCP namespace via the host supervisor.",
+    ),
 )
 
 ACTIONS: dict[str, ConsoleAction] = {a.action_id: a for a in _ACTION_SPECS}

webui/gated_actions.py

@@ -110,6 +110,8 @@ def _format_target(action_id: str, params: dict[str, Any]) -> str:
         )
     if action_id == "create_issue":
         return f"issue {params.get('title', '?')!r}"
+    if action_id in {"system.restart_namespace", "system.reload_namespace"}:
+        return f"MCP namespace {params.get('namespace', '?')!r}"
     return "unspecified"
 
 
@@ -165,6 +167,17 @@ def build_action_registry() -> ActionRegistry:
          "gitea_create_issue_comment", "Post a PR review thread comment."),
         ("close_pr", "Close PR", "close_pr", "gitea_edit_pr",
          "Close a pull request without merge."),
+        # #642: the sanctioned replacement for the forbidden manual daemon-kill
+        # recovery path (#630). The "tool" is a host supervisor hook, not an MCP
+        # call — the console never signals a process. Preview and gating live in
+        # ``webui.sanctioned_restart``; these stay disabled like every other
+        # registry entry.
+        ("system.reload_namespace", "Reload MCP namespace", "reload_namespace",
+         "host.supervisor_reload",
+         "Gracefully reload one MCP namespace via the host supervisor."),
+        ("system.restart_namespace", "Restart MCP namespace",
+         "restart_namespace", "host.supervisor_restart",
+         "Restart one MCP namespace via the host supervisor."),
     )
     actions = tuple(
         GatedAction(

webui/sanctioned_restart.py

@@ -0,0 +1,613 @@
+"""Sanctioned MCP restart and graceful reload controls (#642, Phase 2).
+
+Sessions have historically recovered MCP connectivity by killing the host
+daemon (``pkill -f mcp_server.py``, #630). That path stays forbidden: it kills
+every namespace on the host, contaminates the surviving session, and leaves no
+audit trail. This module is the sanctioned replacement.
+
+A restart is modelled as a *gated action*, never as a command:
+
+1. **Capability** — the console action resolves through ``console_authz``
+   against ``task_capability_map``, so the console cannot invent an authority
+   the MCP layer does not already define.
+2. **Preview** — :func:`build_restart_preview` renders a mutation ledger and
+   the exact confirmation phrase. It never returns a shell command.
+3. **Confirmation** — the operator echoes a phrase naming the exact namespace
+   and mode. A phrase for one namespace never authorizes another.
+4. **Operator authorization** — host daemon maintenance is authorized out of
+   band through the environment (#630, and #710 finding F1: a worker session
+   cannot set an env var for an already-running daemon, so this cannot be
+   self-asserted the way a tool argument could).
+5. **Execution** — :func:`execute_restart` never spawns a process. Once every
+   gate passes it hands the request to the configured host-managed restart
+   hook; with no hook configured it fails closed.
+6. **Health recheck** — :func:`verify_post_restart_health` requires live
+   client-namespace probe evidence before any post-restart clean claim.
+
+Manual ``pkill`` remains forbidden and is classified as contamination by
+:func:`classify_restart_command`, which blocks clean claims (#630 AC3).
+
+This module performs no I/O beyond reading its own environment configuration,
+imports no MCP client, and holds no credential.
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import asdict, dataclass
+from typing import Any
+
+import mcp_namespace_health
+import runtime_recovery_guard
+from webui import console_audit, console_authz
+
+# --- Operations -------------------------------------------------------------
+
+MODE_RESTART = "restart"
+MODE_RELOAD = "reload"
+MODES: tuple[str, ...] = (MODE_RESTART, MODE_RELOAD)
+
+ACTION_RESTART_NAMESPACE = "system.restart_namespace"
+ACTION_RELOAD_NAMESPACE = "system.reload_namespace"
+
+ACTION_FOR_MODE: dict[str, str] = {
+    MODE_RESTART: ACTION_RESTART_NAMESPACE,
+    MODE_RELOAD: ACTION_RELOAD_NAMESPACE,
+}
+
+# Namespaces the console may target. An unlisted name fails closed rather than
+# being passed through to a host hook.
+KNOWN_NAMESPACES: tuple[str, ...] = tuple(
+    sorted(
+        set(mcp_namespace_health.DEFAULT_NAMESPACES)
+        | {"gitea-author", "gitea-reviewer", "gitea-merger",
+           "gitea-reconciler", "gitea-controller"}
+    )
+)
+
+# Scope tokens that would mean "everything at once". Explicit non-goal: the
+# console never offers a fleet-wide restart, because that is the blast radius
+# `pkill -f mcp_server.py` already had.
+_FLEET_TOKENS = frozenset({"*", "all", "fleet", "any", ""})
+
+# --- Environment configuration ----------------------------------------------
+# Read server-side only; the value is an opaque host hook reference (e.g. a
+# launchd label), never a command line, and is never rendered to a client.
+RESTART_HOOK_ENV = "GITEA_SANCTIONED_RESTART_HOOK"
+
+# --- Reason codes -----------------------------------------------------------
+
+DENY_UNKNOWN_MODE = "unknown_mode"
+DENY_UNKNOWN_NAMESPACE = "unknown_namespace"
+DENY_FLEET_SCOPE = "fleet_scope_not_permitted"
+DENY_UNAUTHORIZED = "unauthorized"
+DENY_CONFIRMATION_MISSING = "confirmation_required"
+DENY_CONFIRMATION_MISMATCH = "confirmation_mismatch"
+DENY_OPERATOR_AUTHORIZATION = "operator_authorization_missing"
+DENY_HOOK_NOT_CONFIGURED = "restart_hook_not_configured"
+DENY_CONTAMINATED_RUNTIME = "contaminated_runtime"
+
+ALLOW_HOST_ACTION_REQUIRED = "host_action_required"
+
+# Post-restart verification outcomes.
+HEALTH_CLEAN = "clean"
+HEALTH_UNPROVEN = "unproven"
+HEALTH_UNHEALTHY = "unhealthy"
+
+
+def _clean(value: Any) -> str:
+    return str(value or "").strip()
+
+
+# --- Mutation ledger --------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class RestartLedgerEntry:
+    """One planned step, shown before anything is asked of the host."""
+
+    sequence: int
+    step: str
+    summary: str
+    executes_process_kill: bool = False
+
+
+def _mutation_ledger(namespace: str, mode: str) -> tuple[RestartLedgerEntry, ...]:
+    if mode == MODE_RELOAD:
+        middle = RestartLedgerEntry(
+            sequence=2,
+            step="host_graceful_reload",
+            summary=(
+                f"Ask the configured host supervisor to reload {namespace} "
+                "in place, draining in-flight requests. The console does not "
+                "signal the process itself."
+            ),
+        )
+    else:
+        middle = RestartLedgerEntry(
+            sequence=2,
+            step="host_restart_hook",
+            summary=(
+                f"Ask the configured host supervisor to restart {namespace}. "
+                "The console never sends a signal and never runs a kill."
+            ),
+        )
+    return (
+        RestartLedgerEntry(
+            sequence=1,
+            step="quiesce",
+            summary=(
+                f"Stop admitting new gated mutations for {namespace} and "
+                "record the intent before anything restarts."
+            ),
+        ),
+        middle,
+        RestartLedgerEntry(
+            sequence=3,
+            step="health_recheck",
+            summary=(
+                f"Re-probe {namespace} through the live client namespace and "
+                "prove the required tool is callable again."
+            ),
+        ),
+        RestartLedgerEntry(
+            sequence=4,
+            step="audit",
+            summary=(
+                "Append actor, target namespace, mode, and result to the "
+                "console audit log."
+            ),
+        ),
+    )
+
+
+# --- Confirmation -----------------------------------------------------------
+
+
+def confirmation_phrase(namespace: str, mode: str) -> str:
+    """Exact phrase an operator must echo, naming the namespace and mode.
+
+    Binding the namespace into the phrase is the point: a confirmation typed
+    for ``gitea-author`` cannot be replayed against ``gitea-merger``.
+    """
+    return f"{_clean(mode)} {_clean(namespace)}"
+
+
+def confirmation_matches(
+    namespace: str, mode: str, confirmation: str | None
+) -> bool:
+    """Compare *confirmation* to the required phrase (exact, whitespace-trimmed)."""
+    return _clean(confirmation) == confirmation_phrase(namespace, mode)
+
+
+# --- Scope validation -------------------------------------------------------
+
+
+def _validate_scope(namespace: str, mode: str) -> tuple[str, str] | None:
+    """Return ``(reason_code, detail)`` when the scope is refused."""
+    ns = _clean(namespace)
+    md = _clean(mode)
+
+    if md not in MODES:
+        return (
+            DENY_UNKNOWN_MODE,
+            f"Mode {md!r} is not one of {', '.join(MODES)}.",
+        )
+    if ns.lower() in _FLEET_TOKENS:
+        return (
+            DENY_FLEET_SCOPE,
+            (
+                "Fleet-wide restart is an explicit non-goal: it reproduces the "
+                "blast radius of `pkill -f mcp_server.py` (#630). Restart one "
+                "namespace at a time."
+            ),
+        )
+    if ns not in KNOWN_NAMESPACES:
+        return (
+            DENY_UNKNOWN_NAMESPACE,
+            f"Namespace {ns!r} is not a known MCP namespace.",
+        )
+    return None
+
+
+# --- Host hook --------------------------------------------------------------
+
+
+def restart_hook(env: dict[str, str] | None = None) -> dict[str, Any]:
+    """Report the configured host-managed restart hook.
+
+    The hook is a reference the *host* resolves (a supervisor label), not a
+    command this process runs. ``configured=False`` fails restart closed.
+    """
+    source = env if env is not None else os.environ
+    reference = _clean(source.get(RESTART_HOOK_ENV))
+    return {
+        "configured": bool(reference),
+        "reference": reference or None,
+        "source": RESTART_HOOK_ENV if reference else None,
+        "self_assertable": False,
+        "console_executes_process": False,
+    }
+
+
+# --- Preview ----------------------------------------------------------------
+
+
+def build_restart_preview(
+    namespace: str,
+    mode: str = MODE_RESTART,
+    *,
+    principal: console_authz.Principal | None = None,
+    env: dict[str, str] | None = None,
+) -> dict[str, Any]:
+    """Render the dry-run preview for a restart/reload request.
+
+    Read-only: no authorization is granted, no host is contacted, and the
+    result never contains a shell command.
+    """
+    ns = _clean(namespace)
+    md = _clean(mode)
+    action_id = ACTION_FOR_MODE.get(md, ACTION_RESTART_NAMESPACE)
+    action = console_authz.get_action(action_id)
+    decision = console_authz.authorize(action_id, principal)
+    scope_error = _validate_scope(ns, md)
+    hook = restart_hook(env)
+    operator = runtime_recovery_guard.operator_authorization(env)
+
+    return {
+        "action_id": action_id,
+        "namespace": ns,
+        "mode": md,
+        "scope_valid": scope_error is None,
+        "scope_reason_code": scope_error[0] if scope_error else None,
+        "scope_detail": scope_error[1] if scope_error else None,
+        "required_role": action.minimum_role if action else None,
+        "required_permission": action.mcp_permission if action else None,
+        "action_class": action.action_class if action else None,
+        "dual_control": action.dual_control if action else True,
+        "break_glass": action.break_glass if action else True,
+        "requires_confirmation": True,
+        "confirmation_phrase": confirmation_phrase(ns, md),
+        "mutation_ledger": [asdict(entry) for entry in _mutation_ledger(ns, md)],
+        "authorization": decision.to_dict(),
+        "operator_authorization": operator,
+        "restart_hook": hook,
+        "execution_enabled": False,
+        "raw_process_kill_exposed": False,
+        "known_namespaces": list(KNOWN_NAMESPACES),
+        "post_restart_verification_required": True,
+    }
+
+
+# --- Gate -------------------------------------------------------------------
+
+
+def assess_restart_request(
+    namespace: str,
+    mode: str = MODE_RESTART,
+    *,
+    principal: console_authz.Principal | None = None,
+    confirmation: str | None = None,
+    contamination_marker: dict[str, Any] | None = None,
+    env: dict[str, str] | None = None,
+) -> dict[str, Any]:
+    """Decide whether a restart request may proceed to the host hook.
+
+    Every gate must pass. The first failure wins and is reported with a stable
+    reason code; a pass never means "restarted", only "may be handed to the
+    configured host hook".
+    """
+    ns = _clean(namespace)
+    md = _clean(mode)
+    action_id = ACTION_FOR_MODE.get(md, ACTION_RESTART_NAMESPACE)
+    preview = build_restart_preview(ns, md, principal=principal, env=env)
+
+    def refuse(reason_code: str, detail: str) -> dict[str, Any]:
+        return {
+            "allowed": False,
+            "gates_passed": False,
+            "reason_code": reason_code,
+            "detail": detail,
+            "action_id": action_id,
+            "namespace": ns,
+            "mode": md,
+            "preview": preview,
+            "execution_enabled": False,
+        }
+
+    scope_error = _validate_scope(ns, md)
+    if scope_error is not None:
+        return refuse(*scope_error)
+
+    # Authority is checked as an authorization decision, not an execution
+    # grant. ``for_execution=True`` asks "may the console perform this write?",
+    # and the answer here is permanently no: step 2 of the ledger is a request
+    # to the host supervisor, so the console's Phase 2 execution gate is not
+    # the relevant gate. Every branch below keeps ``execution_enabled`` False
+    # and :func:`execute_restart` never touches a process.
+    decision = console_authz.authorize(action_id, principal)
+    if not decision.allowed:
+        return refuse(DENY_UNAUTHORIZED, decision.detail)
+
+    if not _clean(confirmation):
+        return refuse(
+            DENY_CONFIRMATION_MISSING,
+            (
+                "Type the confirmation phrase "
+                f"{preview['confirmation_phrase']!r} to proceed."
+            ),
+        )
+    if not confirmation_matches(ns, md, confirmation):
+        return refuse(
+            DENY_CONFIRMATION_MISMATCH,
+            (
+                "Confirmation does not name this namespace and mode; expected "
+                f"{preview['confirmation_phrase']!r}."
+            ),
+        )
+
+    operator = preview["operator_authorization"]
+    if not operator["authorized"]:
+        return refuse(
+            DENY_OPERATOR_AUTHORIZATION,
+            (
+                "Host daemon maintenance requires out-of-band operator "
+                "authorization via "
+                f"{runtime_recovery_guard.OPERATOR_AUTHORIZATION_ENV}."
+            ),
+        )
+
+    # #630's task-scoped gate deliberately lets a contaminated worker keep
+    # commenting and handing off. Restart is stricter and unconditional: a
+    # runtime already contaminated by a manual kill must be reconciled before
+    # it is restarted again, or the restart just launders the contamination.
+    if contamination_marker and not contamination_marker.get(
+        "cleared_by_reconciler"
+    ):
+        return refuse(
+            DENY_CONTAMINATED_RUNTIME,
+            (
+                "A live contamination marker is present; clear it through the "
+                "reconciler path before restarting."
+            ),
+        )
+
+    hook = preview["restart_hook"]
+    if not hook["configured"]:
+        return refuse(
+            DENY_HOOK_NOT_CONFIGURED,
+            (
+                "No host-managed restart hook is configured "
+                f"({RESTART_HOOK_ENV}). The console will not fall back to a "
+                "process kill."
+            ),
+        )
+
+    return {
+        "allowed": True,
+        "gates_passed": True,
+        "reason_code": ALLOW_HOST_ACTION_REQUIRED,
+        "detail": (
+            "Every gate passed. The restart must be performed by the "
+            "configured host supervisor; the console does not signal the "
+            "process."
+        ),
+        "action_id": action_id,
+        "namespace": ns,
+        "mode": md,
+        "preview": preview,
+        "execution_enabled": False,
+        "console_executes": False,
+        "console_active_phase": console_authz.ACTIVE_PHASE,
+    }
+
+
+# --- Execution --------------------------------------------------------------
+
+
+def execute_restart(
+    namespace: str,
+    mode: str = MODE_RESTART,
+    *,
+    principal: console_authz.Principal | None = None,
+    confirmation: str | None = None,
+    contamination_marker: dict[str, Any] | None = None,
+    env: dict[str, str] | None = None,
+    request_id: str | None = None,
+    session_id: str | None = None,
+) -> dict[str, Any]:
+    """Run every gate, audit the outcome, and hand off to the host.
+
+    This function never spawns a process, never sends a signal, and never
+    builds a command line. ``success`` is False in both directions: a refused
+    request is refused, and an authorized request still requires the host
+    supervisor to act.
+    """
+    assessment = assess_restart_request(
+        namespace,
+        mode,
+        principal=principal,
+        confirmation=confirmation,
+        contamination_marker=contamination_marker,
+        env=env,
+    )
+    action_id = assessment["action_id"]
+    allowed = assessment["allowed"]
+
+    audit = console_audit.record_event(
+        action_id=action_id,
+        result=(
+            console_audit.RESULT_ALLOWED if allowed
+            else console_audit.RESULT_DENIED
+        ),
+        principal=principal,
+        target={"namespace": assessment["namespace"], "mode": assessment["mode"]},
+        reason_code=assessment["reason_code"],
+        detail=assessment["detail"],
+        request_id=request_id,
+        session_id=session_id,
+        metadata={
+            "gates_passed": assessment["gates_passed"],
+            "process_kill_executed": False,
+            "post_restart_verification_required": True,
+        },
+    )
+
+    return {
+        "success": False,
+        "outcome": (
+            ALLOW_HOST_ACTION_REQUIRED if allowed else assessment["reason_code"]
+        ),
+        "allowed": allowed,
+        "detail": assessment["detail"],
+        "namespace": assessment["namespace"],
+        "mode": assessment["mode"],
+        "action_id": action_id,
+        "process_kill_executed": False,
+        "host_hook": assessment["preview"]["restart_hook"],
+        "next_action": (
+            "Have the host supervisor perform the restart, then call "
+            "verify_post_restart_health with live client-namespace evidence "
+            "before claiming a clean session."
+            if allowed
+            else assessment["detail"]
+        ),
+        "assessment": assessment,
+        "audit": audit,
+    }
+
+
+# --- Contamination classification -------------------------------------------
+
+
+def classify_restart_command(
+    command: str | None,
+    *,
+    mcp_pids: list[Any] | tuple[Any, ...] | None = None,
+    session_id: str | None = None,
+    remote: str | None = None,
+    role: str | None = None,
+) -> dict[str, Any]:
+    """Classify an operator-proposed recovery command (#630 AC2).
+
+    A manual ``pkill``/``kill`` of the MCP daemon is contamination, not a
+    restart. When contaminating, a durable marker is returned so downstream
+    gated mutations and clean claims fail closed.
+    """
+    classification = runtime_recovery_guard.classify_recovery_command(
+        command, mcp_pids=mcp_pids
+    )
+    contaminating = bool(classification.get("contamination"))
+
+    marker = None
+    if contaminating:
+        marker = runtime_recovery_guard.build_contamination_record(
+            reason_class=(
+                classification.get("reason_class")
+                or runtime_recovery_guard.REASON_MANUAL_DAEMON_KILL
+            ),
+            command_redacted=classification.get("redacted_command"),
+            session_id=session_id,
+            remote=remote,
+            role=role,
+            detail=(
+                "Manual daemon kill is forbidden; use the sanctioned "
+                f"{ACTION_RESTART_NAMESPACE} gated action instead."
+            ),
+        )
+
+    return {
+        "contamination": contaminating,
+        "sanctioned": not contaminating and not classification.get("process_kill"),
+        "clean_claim_allowed": not contaminating,
+        "reason_class": classification.get("reason_class"),
+        "redacted_command": classification.get("redacted_command"),
+        "classification": classification,
+        "contamination_marker": marker,
+        "sanctioned_alternative": ACTION_RESTART_NAMESPACE,
+    }
+
+
+# --- Post-restart health verification ---------------------------------------
+
+
+def verify_post_restart_health(
+    namespace: str,
+    *,
+    probe_result: dict[str, Any] | None = None,
+    probe_source: str | None = None,
+    registered_tools: list[str] | tuple[str, ...] | None = None,
+    required_tool: str | None = None,
+    profile: str | None = None,
+) -> dict[str, Any]:
+    """Require live proof a namespace is callable before any clean claim (AC3).
+
+    Static registration is not proof and neither is an offline subprocess
+    probe: only ``probe_source=client_namespace`` evidence can clear a
+    post-restart session for mutations.
+    """
+    ns = _clean(namespace)
+    health = mcp_namespace_health.classify_namespace_probe(
+        ns,
+        required_tool=required_tool,
+        registered_tools=registered_tools,
+        probe_result=probe_result,
+        profile=profile,
+        probe_source=probe_source,
+    )
+    healthy = bool(health.get("healthy"))
+    proven = bool(health.get("ide_namespace_proven"))
+
+    if healthy and proven:
+        status = HEALTH_CLEAN
+    elif healthy:
+        status = HEALTH_UNPROVEN
+    else:
+        status = HEALTH_UNHEALTHY
+
+    reasons = list(health.get("reasons") or [])
+    if status == HEALTH_UNPROVEN:
+        reasons.append(
+            "Namespace reported healthy without live client-namespace "
+            "evidence; a post-restart clean claim requires "
+            f"probe_source={mcp_namespace_health.PROBE_SOURCE_CLIENT!r}."
+        )
+
+    return {
+        "namespace": ns,
+        "status": status,
+        "healthy": healthy,
+        "ide_namespace_proven": proven,
+        "clean_claim_allowed": status == HEALTH_CLEAN,
+        "mutations_allowed": status == HEALTH_CLEAN,
+        "reasons": reasons,
+        "health": health,
+    }
+
+
+# --- Policy surface ---------------------------------------------------------
+
+
+def restart_policy() -> dict[str, Any]:
+    """Machine-readable description of the sanctioned restart contract."""
+    return {
+        "policy_version": 1,
+        "modes": list(MODES),
+        "actions": [ACTION_RESTART_NAMESPACE, ACTION_RELOAD_NAMESPACE],
+        "known_namespaces": list(KNOWN_NAMESPACES),
+        "fleet_scope_permitted": False,
+        "console_executes_process_kill": False,
+        "raw_kill_exposed": False,
+        "requires_confirmation": True,
+        "confirmation_binds_namespace": True,
+        "operator_authorization_env": (
+            runtime_recovery_guard.OPERATOR_AUTHORIZATION_ENV
+        ),
+        "restart_hook_env": RESTART_HOOK_ENV,
+        "manual_kill_classified_as": runtime_recovery_guard.CONTAMINATION_KIND,
+        "post_restart_clean_claim_requires": (
+            mcp_namespace_health.PROBE_SOURCE_CLIENT
+        ),
+        "audit_required": True,
+        "silent_auto_restart_permitted": False,
+    }