fix(cleanup): harden readback scope and ownership fail-closed (#687)

Require branch-scoped post-delete not-found (not generic/repo/host 404),
emit consistent top-level cleanup fields, fail closed on ownership inventory
errors, never auto-reclaim expired control-plane leases, include active
comment-backed reviewer leases, apply the same gates to reconcile_merged_cleanups,
and match ownership with normalized host identity.

branch_cleanup_guard.py

@@ -7,6 +7,19 @@ from typing import Any
 
 PROTECTED_BRANCHES = frozenset({"master", "main", "dev"})
 
+# Evidence / preservation branches must never be removed by cleanup tools
+# (e.g. chore/issue-681-preserve-review-session-wip).
+_PRESERVATION_MARKERS = ("preserve", "preservation", "evidence")
+
+
+def is_preservation_or_evidence_branch(branch: str | None) -> bool:
+    """Return True when *branch* is a preservation/evidence ref that must stay."""
+    if not branch:
+        return False
+    name = str(branch).lower()
+    return any(marker in name for marker in _PRESERVATION_MARKERS)
+
+
 _RAW_BRANCH_DELETE_PATTERNS = (
     re.compile(r"\bgit(?:\s+-C\s+\S+)?\s+branch\s+-[dD]\b[^\n\r]*", re.I),
     re.compile(r"\bgit(?:\s+-C\s+\S+)?\s+push\b[^\n\r]*\s--delete\b[^\n\r]*", re.I),
@@ -72,6 +85,11 @@ def assess_merged_pr_branch_cleanup(
         reasons.append("PR head branch is missing")
     if head_branch in protected:
         reasons.append(f"branch '{head_branch}' is protected")
+    if is_preservation_or_evidence_branch(head_branch):
+        reasons.append(
+            f"branch '{head_branch}' is a preservation/evidence branch and "
+            "cannot be deleted through merged-PR cleanup"
+        )
     if head_branch in open_pr_heads:
         reasons.append("an open PR still references this head branch")
     if head_on_target is False:
@@ -96,3 +114,490 @@ def assess_merged_pr_branch_cleanup(
         "block_reasons": reasons,
         "recommended_action": "delete_remote_branch" if safe else "keep_remote_branch",
     }
+
+
+# ---------------------------------------------------------------------------
+# #687 remediation: post-delete readback + active ownership protection
+# ---------------------------------------------------------------------------
+
+READBACK_NOT_FOUND = "not_found"
+READBACK_EXISTS = "exists"
+READBACK_AUTHENTICATION = "authentication_error"
+READBACK_AUTHORIZATION = "authorization_error"
+READBACK_TRANSPORT = "transport_error"
+READBACK_UNEXPECTED = "unexpected_response"
+READBACK_AMBIGUOUS_404 = "ambiguous_not_found"
+
+# Scope of a 404: only branch-scoped absence may set verified_absent.
+NOT_FOUND_SCOPE_BRANCH = "branch"
+NOT_FOUND_SCOPE_REPOSITORY = "repository"
+NOT_FOUND_SCOPE_HOST = "host"
+NOT_FOUND_SCOPE_UNKNOWN = "unknown"
+
+ERROR_CLASS_AUTHENTICATION = "authentication"
+ERROR_CLASS_AUTHORIZATION = "authorization"
+ERROR_CLASS_TRANSPORT = "transport"
+ERROR_CLASS_UNEXPECTED = "unexpected"
+
+OWNERSHIP_CATEGORY_AUTHOR_SESSION = "author_session"
+OWNERSHIP_CATEGORY_AUTHOR_LEASE = "author_lease"
+OWNERSHIP_CATEGORY_REVIEWER_LEASE = "reviewer_lease"
+OWNERSHIP_CATEGORY_MERGER_LEASE = "merger_lease"
+OWNERSHIP_CATEGORY_CONTROLLER_LEASE = "controller_lease"
+OWNERSHIP_CATEGORY_RECONCILER_LEASE = "reconciler_lease"
+OWNERSHIP_CATEGORY_WORKTREE_BINDING = "worktree_binding"
+OWNERSHIP_CATEGORY_INVENTORY_ERROR = "ownership_inventory_error"
+
+_ROLE_TO_OWNERSHIP_CATEGORY = {
+    "author": OWNERSHIP_CATEGORY_AUTHOR_LEASE,
+    "reviewer": OWNERSHIP_CATEGORY_REVIEWER_LEASE,
+    "merger": OWNERSHIP_CATEGORY_MERGER_LEASE,
+    "controller": OWNERSHIP_CATEGORY_CONTROLLER_LEASE,
+    "reconciler": OWNERSHIP_CATEGORY_RECONCILER_LEASE,
+}
+
+_ACTIVE_OWNERSHIP_STATUSES = frozenset(
+    {"active", "live", "claimed", "in_progress", "working", "pushing", "pushed"}
+)
+_TERMINAL_OWNERSHIP_STATUSES = frozenset(
+    {"released", "abandoned", "done", "blocked", "terminal", "closed"}
+)
+_EXPIRED_STATUSES = frozenset({"expired"})
+_STALE_STATUSES = frozenset({"stale", "stale_dead_process", "stale_missing_worktree"})
+
+
+def _norm_str(value: Any) -> str:
+    return str(value or "").strip()
+
+
+def normalize_host(host: str | None) -> str:
+    """Normalize a host identity for ownership matching (no credentials)."""
+    text = _norm_str(host).lower()
+    for prefix in ("https://", "http://"):
+        if text.startswith(prefix):
+            text = text[len(prefix) :]
+    # Drop path/query if a full URL slipped through.
+    text = text.split("/", 1)[0]
+    text = text.split("?", 1)[0]
+    return text.rstrip(".")
+
+
+def ownership_category_for_role(role: str | None) -> str:
+    """Map a role kind to a non-secret ownership category label."""
+    key = _norm_str(role).lower()
+    return _ROLE_TO_OWNERSHIP_CATEGORY.get(key, f"{key or 'unknown'}_lease")
+
+
+def classify_branch_readback_http_status(
+    status_code: int | None,
+    *,
+    not_found_scope: str | None = None,
+) -> dict[str, Any]:
+    """Classify a GET-branch HTTP status into a secret-free readback result.
+
+    R1: A bare/generic/repository/wrong-host 404 never yields
+    ``verified_absent=True``. Only an authoritative *branch-scoped* not-found
+    (``not_found_scope='branch'``) may verify deletion.
+    """
+    if status_code == 404:
+        scope = _norm_str(not_found_scope).lower() or NOT_FOUND_SCOPE_UNKNOWN
+        if scope == NOT_FOUND_SCOPE_BRANCH:
+            return {
+                "status": READBACK_NOT_FOUND,
+                "error_class": None,
+                "verified_absent": True,
+                "branch_present": False,
+                "not_found_scope": NOT_FOUND_SCOPE_BRANCH,
+                "reasons": [],
+            }
+        # repository / host / unknown / generic 404 — not verified absence
+        reason = {
+            NOT_FOUND_SCOPE_REPOSITORY: (
+                "post-delete readback 404 is repository-scoped, not branch absence"
+            ),
+            NOT_FOUND_SCOPE_HOST: (
+                "post-delete readback 404 is host-scoped, not branch absence"
+            ),
+        }.get(
+            scope,
+            "post-delete readback 404 is ambiguous (not branch-scoped); "
+            "cannot verify absence",
+        )
+        return {
+            "status": READBACK_AMBIGUOUS_404,
+            "error_class": ERROR_CLASS_UNEXPECTED,
+            "verified_absent": False,
+            "branch_present": None,
+            "not_found_scope": scope,
+            "reasons": [reason],
+        }
+    if status_code in (401, 407):
+        return {
+            "status": READBACK_AUTHENTICATION,
+            "error_class": ERROR_CLASS_AUTHENTICATION,
+            "verified_absent": False,
+            "branch_present": None,
+            "reasons": ["post-delete branch readback authentication failed"],
+        }
+    if status_code == 403:
+        return {
+            "status": READBACK_AUTHORIZATION,
+            "error_class": ERROR_CLASS_AUTHORIZATION,
+            "verified_absent": False,
+            "branch_present": None,
+            "reasons": ["post-delete branch readback authorization failed"],
+        }
+    if status_code is not None and 200 <= int(status_code) < 300:
+        return {
+            "status": READBACK_EXISTS,
+            "error_class": None,
+            "verified_absent": False,
+            "branch_present": True,
+            "reasons": ["post-delete readback found branch still present"],
+        }
+    if status_code is not None and int(status_code) >= 500:
+        return {
+            "status": READBACK_TRANSPORT,
+            "error_class": ERROR_CLASS_TRANSPORT,
+            "verified_absent": False,
+            "branch_present": None,
+            "reasons": ["post-delete branch readback transport/upstream failure"],
+        }
+    return {
+        "status": READBACK_UNEXPECTED,
+        "error_class": ERROR_CLASS_UNEXPECTED,
+        "verified_absent": False,
+        "branch_present": None,
+        "reasons": ["post-delete branch readback returned an unexpected response"],
+        "http_status": status_code,
+    }
+
+
+def _extract_http_status(exc: BaseException) -> int | None:
+    """Extract an HTTP status code from an exception chain (secret-free)."""
+    seen: set[int] = set()
+    current: BaseException | None = exc
+    while current is not None and id(current) not in seen:
+        seen.add(id(current))
+        for attr in ("code", "status", "status_code"):
+            value = getattr(current, attr, None)
+            if isinstance(value, int) and 100 <= value <= 599:
+                return value
+        text = str(current) if current is not None else ""
+        match = re.match(r"HTTP\s+(\d{3})\b", text)
+        if match:
+            return int(match.group(1))
+        current = current.__cause__ or current.__context__
+    return None
+
+
+def classify_branch_readback_exception(
+    exc: BaseException,
+    *,
+    not_found_scope: str | None = None,
+) -> dict[str, Any]:
+    """Classify a GET-branch exception without leaking credentials or bodies.
+
+    R1: substring ``404`` / ``not found`` alone never becomes verified_absent.
+    Callers must pass ``not_found_scope='branch'`` only after authoritative
+    proof that the repository/host is still reachable and the 404 is branch-level.
+    """
+    status_code = _extract_http_status(exc)
+    if status_code is None:
+        lower = str(exc).lower() if exc is not None else ""
+        if any(
+            token in lower
+            for token in (
+                "timed out",
+                "timeout",
+                "connection",
+                "network",
+                "temporarily unavailable",
+                "name or service not known",
+                "nodename nor servname",
+            )
+        ):
+            return {
+                "status": READBACK_TRANSPORT,
+                "error_class": ERROR_CLASS_TRANSPORT,
+                "verified_absent": False,
+                "branch_present": None,
+                "reasons": [
+                    "post-delete branch readback transport/upstream failure"
+                ],
+            }
+        if "unauthorized" in lower:
+            status_code = 401
+        elif "forbidden" in lower:
+            status_code = 403
+        elif "404" in lower or "not found" in lower:
+            # Ambiguous: do NOT treat as branch absence without scope proof.
+            status_code = 404
+            if not_found_scope is None:
+                not_found_scope = NOT_FOUND_SCOPE_UNKNOWN
+
+    if status_code is not None:
+        return classify_branch_readback_http_status(
+            status_code, not_found_scope=not_found_scope
+        )
+
+    return {
+        "status": READBACK_UNEXPECTED,
+        "error_class": ERROR_CLASS_UNEXPECTED,
+        "verified_absent": False,
+        "branch_present": None,
+        "reasons": ["post-delete branch readback returned an unexpected response"],
+    }
+
+
+def assess_post_delete_readback(readback: dict[str, Any] | None) -> dict[str, Any]:
+    """Decide whether DELETE success may be reported after branch readback.
+
+    Success requires authoritative branch-scoped not-found
+    (``verified_absent=True``). DELETE HTTP success alone is never enough.
+    Generic/repository/host 404 cannot verify absence (R1).
+    """
+    payload = dict(readback or {})
+    status = _norm_str(payload.get("status")) or READBACK_UNEXPECTED
+    # Only explicit verified_absent flag counts — never infer from status alone
+    # when status is a bare not_found without branch scope proof.
+    verified = bool(payload.get("verified_absent")) is True
+    if verified and status == READBACK_NOT_FOUND:
+        return {
+            "ok": True,
+            "success": True,
+            "verified_absent": True,
+            "readback": {
+                "status": READBACK_NOT_FOUND,
+                "verified_absent": True,
+                "branch_present": False,
+                "error_class": None,
+                "not_found_scope": NOT_FOUND_SCOPE_BRANCH,
+            },
+            "reasons": [],
+        }
+
+    reasons = list(payload.get("reasons") or [])
+    if not reasons:
+        if status == READBACK_EXISTS:
+            reasons = ["post-delete readback found branch still present"]
+        elif status == READBACK_AUTHENTICATION:
+            reasons = ["post-delete branch readback authentication failed"]
+        elif status == READBACK_AUTHORIZATION:
+            reasons = ["post-delete branch readback authorization failed"]
+        elif status == READBACK_TRANSPORT:
+            reasons = ["post-delete branch readback transport/upstream failure"]
+        elif status == READBACK_AMBIGUOUS_404:
+            reasons = [
+                "post-delete readback 404 is not branch-scoped; "
+                "cannot verify absence"
+            ]
+        else:
+            reasons = ["post-delete branch readback could not verify deletion"]
+
+    return {
+        "ok": False,
+        "success": False,
+        "verified_absent": False,
+        "readback": {
+            "status": status,
+            "verified_absent": False,
+            "branch_present": payload.get("branch_present"),
+            "error_class": payload.get("error_class"),
+            "not_found_scope": payload.get("not_found_scope"),
+        },
+        "reasons": reasons,
+        "blocker_kind": "post_delete_readback_failed",
+    }
+
+
+def cleanup_result_envelope(
+    *,
+    success: bool,
+    performed: bool,
+    delete_acknowledged: bool,
+    verified_absent: bool,
+    **extra: Any,
+) -> dict[str, Any]:
+    """R2: consistent top-level cleanup result fields on every return path."""
+    out: dict[str, Any] = {
+        "success": bool(success),
+        "performed": bool(performed),
+        "delete_acknowledged": bool(delete_acknowledged),
+        "verified_absent": bool(verified_absent),
+    }
+    out.update(extra)
+    return out
+
+
+def _repo_matches(
+    record: dict[str, Any],
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    host: str | None = None,
+) -> bool:
+    """Match ownership record to target remote/org/repo and normalized host."""
+    if (
+        _norm_str(record.get("remote")).lower() != _norm_str(remote).lower()
+        or _norm_str(record.get("org")).lower() != _norm_str(org).lower()
+        or _norm_str(record.get("repo")).lower() != _norm_str(repo).lower()
+    ):
+        return False
+    expected_host = normalize_host(host)
+    record_host = normalize_host(record.get("host") or record.get("host_name"))
+    # When both sides declare a host, they must agree after normalization.
+    # A record host that disagrees with the expected host is out of scope.
+    # Legacy records without host still match when remote/org/repo agree.
+    if expected_host and record_host and expected_host != record_host:
+        return False
+    return True
+
+
+def _branch_matches(record: dict[str, Any], branch: str) -> bool:
+    return _norm_str(record.get("branch")) == _norm_str(branch)
+
+
+def assess_ownership_record_activity(record: dict[str, Any]) -> dict[str, Any]:
+    """Classify one ownership record as blocking or non-blocking.
+
+    Distinguishes active ownership from expired/released/terminal/stale records.
+    Expired/stale records block unless reclaim_allowed is *explicitly* True
+    (O2: never treat missing/unknown reclaim as auto-allowed).
+    """
+    status = _norm_str(record.get("status")).lower()
+    category = _norm_str(record.get("category")) or "unknown"
+    reclaim_allowed = record.get("reclaim_allowed")
+
+    if category == OWNERSHIP_CATEGORY_INVENTORY_ERROR:
+        return {
+            "blocks": True,
+            "status": status or "unknown",
+            "category": category,
+            "reason": "ownership inventory failed closed",
+        }
+
+    if status in _TERMINAL_OWNERSHIP_STATUSES:
+        return {
+            "blocks": False,
+            "status": status,
+            "category": category,
+            "reason": f"{category} ownership is terminal/released ({status})",
+        }
+    if status in _ACTIVE_OWNERSHIP_STATUSES:
+        return {
+            "blocks": True,
+            "status": status,
+            "category": category,
+            "reason": f"active {category} ownership still uses the target branch",
+        }
+    if status in _EXPIRED_STATUSES or status in _STALE_STATUSES:
+        # O2: only explicit reclaim_allowed=True skips the block.
+        if reclaim_allowed is True:
+            return {
+                "blocks": False,
+                "status": status,
+                "category": category,
+                "reason": (
+                    f"{category} ownership is {status} and reclaimable; "
+                    "does not block deletion"
+                ),
+            }
+        return {
+            "blocks": True,
+            "status": status,
+            "category": category,
+            "reason": (
+                f"{status} {category} ownership still protects the target "
+                "branch (reclaim not proven; fail closed)"
+            ),
+        }
+    # Unknown status → fail closed
+    return {
+        "blocks": True,
+        "status": status or "unknown",
+        "category": category,
+        "reason": (
+            f"unclassified {category} ownership status "
+            f"'{status or 'unknown'}'; fail closed"
+        ),
+    }
+
+
+def assess_active_branch_ownership(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    branch: str,
+    host: str | None = None,
+    records: list[dict[str, Any]] | None = None,
+) -> dict[str, Any]:
+    """Assess whether any active ownership still uses *branch* in *repo*.
+
+    Matching requires remote/org/repo/branch and, when provided, normalized
+    host identity. Other repositories, hosts, or branches never false-block.
+    """
+    target_branch = _norm_str(branch)
+    expected_host = normalize_host(host)
+    considered: list[dict[str, Any]] = []
+    blocking: list[dict[str, Any]] = []
+    ignored: list[dict[str, Any]] = []
+
+    for raw in records or []:
+        if not isinstance(raw, dict):
+            continue
+        if not _repo_matches(
+            raw, remote=remote, org=org, repo=repo, host=expected_host or None
+        ):
+            ignored.append(
+                {
+                    "category": _norm_str(raw.get("category")) or "unknown",
+                    "reason": "different repository or host scope",
+                }
+            )
+            continue
+        if not _branch_matches(raw, target_branch):
+            ignored.append(
+                {
+                    "category": _norm_str(raw.get("category")) or "unknown",
+                    "reason": "different branch",
+                }
+            )
+            continue
+        activity = assess_ownership_record_activity(raw)
+        entry = {
+            "category": activity["category"],
+            "status": activity["status"],
+            "blocks": activity["blocks"],
+            "reason": activity["reason"],
+        }
+        considered.append(entry)
+        if activity["blocks"]:
+            blocking.append(entry)
+
+    block = bool(blocking)
+    categories = sorted({b["category"] for b in blocking})
+    reasons = [
+        (
+            "active ownership protects branch "
+            f"'{target_branch}': " + "; ".join(b["reason"] for b in blocking)
+        )
+    ] if block else []
+    return {
+        "block": block,
+        "safe_to_delete": not block,
+        "remote": remote,
+        "org": org,
+        "repo": repo,
+        "host": expected_host or None,
+        "branch": target_branch,
+        "blocking_categories": categories,
+        "blocking": blocking,
+        "considered": considered,
+        "ignored_out_of_scope": ignored,
+        "reasons": reasons,
+        "blocker_kind": "active_branch_ownership" if block else None,
+        "recommended_action": "keep_remote_branch" if block else "delete_remote_branch",
+    }

docs/gitea-execution-profiles.md

@@ -238,11 +238,43 @@ narrow operation set:
 - `gitea.issue.comment`
 - `gitea.issue.close`
 - `gitea.pr.close`
+- `gitea.branch.delete` (merged-branch cleanup only — see below)
 
 Forbidden on reconciler profiles: `gitea.pr.approve`, `gitea.pr.merge`,
 `gitea.pr.review`, `gitea.pr.create`, `gitea.branch.push`, and
 `gitea.repo.commit`.
 
+### Merged-branch cleanup ownership (`gitea.branch.delete`)
+
+The reconciler is the repository-supported owner of merged-PR source-branch
+cleanup: `task_capability_map` maps `cleanup_merged_pr_branch` (and
+`reconciliation_cleanup`) to role `reconciler` with permission
+`gitea.branch.delete`. Post-merge branch lifecycle is reconciliation work —
+it happens after the author, reviewer, and merger roles have completed, and
+it must not be reachable from those roles.
+
+Least-privilege constraints:
+
+- `gitea.branch.delete` is granted **only** to reconciler profiles. Author,
+  reviewer, and merger profiles must never hold it; `gitea_delete_branch`
+  and `gitea_cleanup_merged_pr_branch` fail closed on any profile without
+  the permission.
+- Even with the permission, reconciler deletion is only supported through the
+  guarded `gitea_cleanup_merged_pr_branch` path (#514 / #687): the PR must be
+  merged, the head an ancestor of the target, the branch not protected
+  (`master`/`main`/`dev`), the branch not a preservation/evidence ref (e.g.
+  `chore/issue-681-preserve-review-session-wip`), no open PR may still use the
+  head, and an explicit `CLEANUP MERGED PR <n> BRANCH <branch>` confirmation is
+  required. Raw `gitea_delete_branch` is **denied** to reconciler even when
+  `gitea.branch.delete` is present.
+- Raw `git branch -d` / `git push --delete` cleanup remains blocked by
+  `branch_cleanup_guard` and the final-report validator regardless of
+  profile permissions.
+- `gitea.branch.delete` has no short alias in `GITEA_OPERATION_ALIASES`;
+  write it fully qualified in `allowed_operations`. Migration must emit
+  canonical names such as `gitea.pr.close` (never bare `pr.close` /
+  `issue.close`, which the production normalizer rejects or drops).
+
 Launch a static `gitea-reconciler` MCP namespace with
 `GITEA_MCP_PROFILE=prgs-reconciler`. Profile shape is validated by
 `reconciler_profile.assess_reconciler_profile` (#304). Use the
@@ -251,6 +283,159 @@ Launch a static `gitea-reconciler` MCP namespace with
 fresh target-branch fetch, recorded target SHA, and ancestor proof. PRs whose
 heads are not already landed cannot be closed through this path.
 
+### Operational runbook: grant reconciler `gitea.branch.delete` (#687)
+
+Merging a code PR that updates `migrate_profiles.py` / `reconciler_profile.py`
+**does not** change the live operator profile on disk. Apply the profile
+change deliberately, then reconnect the client-managed namespace.
+
+1. **Approved migration / profile-update command** (from the repo root, using
+   the project venv if present):
+
+   ```bash
+   # Dry-run first (default): validates v2 output, writes nothing
+   python3 migrate_profiles.py -i ~/.config/gitea-tools/profiles.json
+
+   # Apply: creates backup then writes migrated v2 config
+   python3 migrate_profiles.py -i ~/.config/gitea-tools/profiles.json -w
+   # Optional explicit paths:
+   # python3 migrate_profiles.py -i ~/.config/gitea-tools/profiles.json \
+   #   -o ~/.config/gitea-tools/profiles.json \
+   #   --backup ~/.config/gitea-tools/profiles.json.bak -w
+   ```
+
+   If the live file is already v2, edit the reconciler identity’s
+   `allowed_operations` / `forbidden_operations` under
+   `environments.<env>.services.gitea.identities.reconciler` (or the
+   `prgs-reconciler` alias target) so allowed includes the canonical set
+   below — then re-validate with a load of the config (see step 3).
+
+2. **Inspect the generated (or edited) profile** — confirm the reconciler
+   identity, for example:
+
+   ```bash
+   python3 - <<'PY'
+   import json
+   from pathlib import Path
+   cfg = json.loads(Path.home().joinpath(".config/gitea-tools/profiles.json").read_text())
+   # v2 environments shape:
+   ident = cfg["environments"]["prgs"]["services"]["gitea"]["identities"]["reconciler"]
+   print("role:", ident.get("role"))
+   print("allowed:", ident.get("allowed_operations"))
+   print("forbidden:", ident.get("forbidden_operations"))
+   PY
+   ```
+
+3. **Validate canonical operation names and least privilege**
+
+   Expected canonical **allowed** (defaults after migration):
+
+   - `gitea.read`
+   - `gitea.pr.close` (required)
+   - `gitea.pr.comment`
+   - `gitea.issue.comment`
+   - `gitea.issue.close`
+   - `gitea.branch.delete` (recommended; cleanup only)
+
+   Expected **forbidden** includes at least: `gitea.pr.approve`,
+   `gitea.pr.merge`, `gitea.pr.review`, `gitea.pr.create`,
+   `gitea.branch.push`, `gitea.repo.commit`.
+
+   No shorthand (`pr.close`, `issue.close`, `pr.comment`) may remain.
+   Validate with the production loader:
+
+   ```bash
+   python3 - <<'PY'
+   import gitea_config, reconciler_profile
+   from pathlib import Path
+   path = str(Path.home() / ".config/gitea-tools/profiles.json")
+   gitea_config.load_config(path)  # fails closed on invalid config
+   # Or assess the reconciler lists directly after extracting them:
+   # print(reconciler_profile.assess_reconciler_profile(allowed, forbidden))
+   PY
+   ```
+
+4. **Merging PR #688 (or any code PR) does not update the live profile.**
+   Code changes only the migration helper, schema, docs, and tests. The
+   operator must still run `migrate_profiles.py -w` or an equivalent
+   authorized edit of `~/.config/gitea-tools/profiles.json`.
+
+5. **Supported apply method:** `python3 migrate_profiles.py … -w` (backup
+   created automatically) **or** operator-authorized edit of the live
+   profiles file after backup. Unsupported: silent mtime tricks, manual
+   process kill to “reload”, or undocumented env overrides.
+
+6. **Backup and validation:** `-w` copies the input to
+   `<input_path>.bak` (or `--backup PATH`) before writing. Re-run
+   `load_config` / `assess_reconciler_profile` after write. Keep the
+   `.bak` until live whoami/capability checks pass.
+
+7. **Client-managed namespace reconnect/reload:** reconnect or reload the
+   IDE MCP client so `gitea-reconciler` restarts from current `master` and
+   the updated `GITEA_MCP_PROFILE=prgs-reconciler` config. Do not hand-launch
+   `mcp_server.py` / `gitea_mcp_server.py` with ad hoc `GITEA_*` env
+   (see #686 / #630).
+
+8. **Live reverification** (through the client-managed `gitea-reconciler`
+   namespace only):
+
+   - `gitea_whoami` → identity + profile `prgs-reconciler`
+   - `gitea_assess_master_parity` → `stale=false`, `restart_required=false`
+   - `gitea_resolve_task_capability(task="cleanup_merged_pr_branch")` →
+     `allowed_in_current_session=true` only when permission and role match
+   - `gitea_resolve_task_capability(task="delete_branch")` →
+     **not** allowed for reconciler (role denial must be enforced)
+
+9. **Guarded cleanup usage** (example for a merged PR whose source branch
+   remains on the remote):
+
+   ```text
+   gitea_cleanup_merged_pr_branch(
+     pr_number=<N>,
+     branch=<exact PR head branch>,
+     confirmation="CLEANUP MERGED PR <N> BRANCH <exact PR head branch>",
+     remote="prgs",
+     org="Scaled-Tech-Consulting",
+     repo="Gitea-Tools",
+     worktree_path="<path under branches/>",
+   )
+   ```
+
+   The tool refuses unmerged PRs, protected branches, preservation/evidence
+   branches, open-PR heads, mismatched branch names, and wrong confirmation.
+
+10. **Prohibitions**
+
+    - No raw `git push --delete`, `git branch -d` / `-D`, or delete refspecs
+    - No arbitrary `gitea_delete_branch` from reconciler
+    - No unsupported profile switching mid-run without full re-preflight
+    - No ad hoc hand-edits of live profiles **unless** operator-authorized,
+      backed up, and revalidated as above
+
+Canonical migrated reconciler example:
+
+```json
+{
+  "role": "reconciler",
+  "allowed_operations": [
+    "gitea.read",
+    "gitea.pr.close",
+    "gitea.pr.comment",
+    "gitea.issue.comment",
+    "gitea.issue.close",
+    "gitea.branch.delete"
+  ],
+  "forbidden_operations": [
+    "gitea.pr.approve",
+    "gitea.pr.merge",
+    "gitea.pr.review",
+    "gitea.pr.create",
+    "gitea.branch.push",
+    "gitea.repo.commit"
+  ]
+}
+```
+
 ## Identity and fail-closed rules
 
 Before **any** mutating action, a workflow must know both:

mcp_session_state.py

@@ -31,6 +31,11 @@ DEFAULT_TTL_HOURS = 4.0
 KIND_WORKFLOW_LOAD = "review_workflow_load"
 KIND_DECISION_LOCK = "review_decision_lock"
 KIND_REVIEW_DRAFT = "review_draft"
+# Durable marker set when a worker session attempts a direct stable-branch push
+# or a root-checkout local commit (#671). Keyed per profile identity like the
+# other session proofs; a contaminated session fails closed on gated mutations
+# until a reconciler audits and clears it.
+KIND_STABLE_BRANCH_CONTAMINATION = "stable_branch_contamination"
 
 
 

migrate_profiles.py

@@ -20,12 +20,114 @@ if PROJECT_ROOT not in sys.path:
 import gitea_config
 
 
-AUTHOR_DEFAULT_ALLOWED = ["read", "branch", "commit", "push", "open_pr", "comment"]
-AUTHOR_DEFAULT_FORBIDDEN = ["approve", "request_changes", "merge"]
-REVIEWER_DEFAULT_ALLOWED = [
-    "read", "review", "comment", "approve", "request_changes", "merge"
+# Defaults emit *canonical* operation names only. Shorthand that is not in
+# gitea_config.GITEA_OPERATION_ALIASES (e.g. ``pr.close``, ``issue.close``)
+# is silently dropped by the production loader and must never appear here.
+AUTHOR_DEFAULT_ALLOWED = [
+    "gitea.read",
+    "gitea.branch.create",
+    "gitea.repo.commit",
+    "gitea.branch.push",
+    "gitea.pr.create",
+    "gitea.pr.comment",
 ]
-REVIEWER_DEFAULT_FORBIDDEN = ["branch", "commit", "push", "open_pr"]
+AUTHOR_DEFAULT_FORBIDDEN = [
+    "gitea.pr.approve",
+    "gitea.pr.request_changes",
+    "gitea.pr.merge",
+]
+REVIEWER_DEFAULT_ALLOWED = [
+    "gitea.read",
+    "gitea.pr.review",
+    "gitea.pr.comment",
+    "gitea.pr.approve",
+    "gitea.pr.request_changes",
+    "gitea.pr.merge",
+]
+REVIEWER_DEFAULT_FORBIDDEN = [
+    "gitea.branch.create",
+    "gitea.repo.commit",
+    "gitea.branch.push",
+    "gitea.pr.create",
+]
+# Required reconciler ops (read + pr.close) plus recommended comment/close and
+# branch.delete for guarded merged-PR cleanup. All names must normalize via
+# gitea_config.normalize_operation without being dropped.
+RECONCILER_DEFAULT_ALLOWED = [
+    "gitea.read",
+    "gitea.pr.close",
+    "gitea.pr.comment",
+    "gitea.issue.comment",
+    "gitea.issue.close",
+    "gitea.branch.delete",
+]
+RECONCILER_DEFAULT_FORBIDDEN = [
+    "gitea.pr.approve",
+    "gitea.pr.merge",
+    "gitea.pr.review",
+    "gitea.pr.create",
+    "gitea.branch.push",
+    "gitea.repo.commit",
+]
+
+# Migration-only expansions for common shorthands that are *not* in
+# GITEA_OPERATION_ALIASES. Emitted output is always the canonical form so a
+# second canonicalize pass is a no-op (idempotent).
+_MIGRATION_ONLY_ALIASES = {
+    "pr.close": "gitea.pr.close",
+    "pr.comment": "gitea.pr.comment",
+    "issue.close": "gitea.issue.close",
+    "branch.delete": "gitea.branch.delete",
+}
+
+# Reconciler required ops that must survive migration (from reconciler_profile).
+RECONCILER_REQUIRED_CANONICAL = ("gitea.read", "gitea.pr.close")
+
+
+def canonicalize_operation(op: str) -> str:
+    """Return a canonical operation name accepted by the production loader.
+
+    Fail closed on unknown/ambiguous spellings so required permissions cannot
+    be silently dropped by ``check_operation`` later.
+    """
+    if not isinstance(op, str) or not op.strip():
+        raise ValueError("operation must be a non-empty string (fail closed)")
+    op = op.strip()
+    try:
+        return gitea_config.normalize_operation(op)
+    except gitea_config.ConfigError:
+        pass
+    if op in _MIGRATION_ONLY_ALIASES:
+        return _MIGRATION_ONLY_ALIASES[op]
+    raise ValueError(
+        f"operation {op!r} cannot be canonicalized for migration "
+        "(unknown/ambiguous; fail closed — production loader would drop it)"
+    )
+
+
+def canonicalize_operations(ops, *, context: str = "operations") -> list[str]:
+    """Canonicalize a list of operations; preserve order, drop duplicates."""
+    if not isinstance(ops, list):
+        raise ValueError(f"{context} must be a list (fail closed)")
+    out: list[str] = []
+    seen: set[str] = set()
+    for entry in ops:
+        canon = canonicalize_operation(entry)
+        if canon not in seen:
+            seen.add(canon)
+            out.append(canon)
+    return out
+
+
+def _assert_reconciler_required_survive(allowed: list[str], profile_name: str) -> None:
+    """Fail visibly when migration would leave a reconciler without required ops."""
+    missing = [op for op in RECONCILER_REQUIRED_CANONICAL if op not in set(allowed)]
+    if missing:
+        raise ValueError(
+            f"Profile '{profile_name}' (reconciler) is missing required "
+            f"operation(s) after migration: {missing}. Refusing to emit a "
+            "profile that would silently fail pr.close / read (fail closed)."
+        )
 
 
 def infer_role(name, execution_profile):
@@ -90,9 +192,11 @@ def migrate_v1_to_v2(v1_data):
             ident_name = "reviewer"
         elif role == "author":
             ident_name = "author"
+        elif role == "reconciler":
+            ident_name = "reconciler"
         else:
             role = prof.get("role")
-            if role not in (None, "author", "reviewer"):
+            if role not in (None, "author", "reviewer", "reconciler"):
                 raise ValueError(
                     f"Profile '{name}' has unsupported role {role!r}"
                 )
@@ -124,20 +228,35 @@ def migrate_v1_to_v2(v1_data):
                 raise ValueError(
                     f"Profile '{name}' operation fields must be lists"
                 )
-            identity_data["allowed_operations"] = list(allowed)
-            identity_data["forbidden_operations"] = list(forbidden)
+            try:
+                identity_data["allowed_operations"] = canonicalize_operations(
+                    allowed, context=f"profile '{name}' allowed_operations"
+                )
+                identity_data["forbidden_operations"] = canonicalize_operations(
+                    forbidden, context=f"profile '{name}' forbidden_operations"
+                )
+            except ValueError as exc:
+                raise ValueError(f"Profile '{name}': {exc}") from exc
         elif role == "author":
             identity_data["allowed_operations"] = list(AUTHOR_DEFAULT_ALLOWED)
             identity_data["forbidden_operations"] = list(AUTHOR_DEFAULT_FORBIDDEN)
         elif role == "reviewer":
             identity_data["allowed_operations"] = list(REVIEWER_DEFAULT_ALLOWED)
             identity_data["forbidden_operations"] = list(REVIEWER_DEFAULT_FORBIDDEN)
+        elif role == "reconciler":
+            identity_data["allowed_operations"] = list(RECONCILER_DEFAULT_ALLOWED)
+            identity_data["forbidden_operations"] = list(RECONCILER_DEFAULT_FORBIDDEN)
         else:
             raise ValueError(
                 f"Profile '{name}' has no explicit operation lists and no "
                 "unambiguous author/reviewer role marker (fail closed)"
             )
 
+        if role == "reconciler":
+            _assert_reconciler_required_survive(
+                identity_data["allowed_operations"], name
+            )
+
         # Nest inside environments/services structure
         env = environments.setdefault(env_name, {})
         services = env.setdefault("services", {})

reconciler_profile.py

@@ -18,6 +18,11 @@ RECONCILER_RECOMMENDED_OPERATIONS = (
     "gitea.pr.comment",
     "gitea.issue.comment",
     "gitea.issue.close",
+    # Merged-branch cleanup is reconciler-owned (task_capability_map maps
+    # cleanup_merged_pr_branch -> reconciler). The permission is only
+    # exercisable through the guarded gitea_cleanup_merged_pr_branch path
+    # (#514): merged proof, protected-branch refusal, explicit confirmation.
+    "gitea.branch.delete",
 )
 
 RECONCILER_FORBIDDEN_OPERATIONS = (

reviewer_worktree.py

@@ -27,6 +27,20 @@ _READONLY_REVIEWER_GIT = re.compile(
 _GIT_INVOCATION = re.compile(r"\bgit\b", re.IGNORECASE)
 
 
+# #673: Canonical pattern for identifying review worktrees under branches/.
+REVIEW_WORKTREE_RE = re.compile(
+    r"branches/(?:review-pr\d+[\w/-]*|merge-simulation-pr\d+|review-[\w-]+)",
+    re.IGNORECASE,
+)
+
+
+def is_review_worktree_path(path: str) -> bool:
+    """True when the path belongs to a reviewer or simulation worktree."""
+    normalized = (path or "").replace("\\", "/")
+    return bool(REVIEW_WORKTREE_RE.search(normalized))
+
+
+
 def parse_dirty_tracked_files(porcelain: str) -> list[str]:
     """Return tracked paths with local modifications from ``git status --porcelain``.
 

reviewer_worktree_ownership.py

@@ -5,10 +5,9 @@ from __future__ import annotations
 import re
 from typing import Any
 
-_SESSION_OWNED_RE = re.compile(
-    r"branches/(?:review-pr\d+[\w/-]*|review-[\w-]+)",
-    re.IGNORECASE,
-)
+from reviewer_worktree import REVIEW_WORKTREE_RE
+
+_SESSION_OWNED_RE = REVIEW_WORKTREE_RE
 _WORKTREE_PATH_RE = re.compile(
     r"(?:review worktree path|worktree path|session-owned worktree)\s*:\s*(\S+)",
     re.IGNORECASE,

skills/llm-project-workflow/SKILL.md

@@ -32,6 +32,15 @@ workflow file.
   mutation.
 - A nearby capability does not count.
 - Do not self-review or self-merge.
+- **Never push a stable branch directly.** Worker sessions (author/reviewer/merger)
+  must never run `git push <remote> master` — or `main`/`dev`/other stable refs,
+  including refspecs (`HEAD:master`), `--force`, `--delete`, or `--dry-run` no-op
+  probes — and must never commit on the root/control checkout outside an issue
+  feature branch. Stable-branch updates land ONLY through sanctioned Gitea merge
+  tooling (`gitea_merge_pr`) or an explicitly authorized reconciler path. A
+  detected attempt marks the session workflow-contaminated (#671) and fails
+  closed on review/merge/close/completion until a reconciler audits and clears
+  it. `git fetch` / `git pull --ff-only` and feature-branch pushes stay allowed.
 - Do not mix modes in one run.
 - **BLOCKED + DIAGNOSE default rule (required):** If any required workflow step, skill, tool, capability, preflight, instruction, profile, worktree binding, or terminal/MCP operation cannot be performed or loaded (including the canonical ones listed in this skill and its loaded workflow), immediately enter `BLOCKED + DIAGNOSE`. Stop before any git or Gitea mutation. Diagnose using the standard template in [`templates/blocked-diagnose-report.md`](templates/blocked-diagnose-report.md). Attempt *only* safe non-mutating recovery. Report using the template. Do not continue, use fallbacks, or treat the missing requirement as harmless.
 - If the required workflow cannot be loaded, stop and produce a recovery handoff
@@ -48,6 +57,11 @@ workflow file.
 - wrong profile or role for the requested operation
 - dirty or misbound worktree (root checkout or non-branches/ path)
 - root checkout mutation risk
+- stable-branch push contamination (#671): a direct `git push <remote> master`
+  (or `main`/`dev`) equivalent, or a root/control-checkout commit not on an issue
+  feature branch, marks the session workflow-contaminated; review/merge/close/
+  completion mutations then fail closed until a reconciler audits and clears it
+  (`gitea_audit_stable_branch_contamination action=clear`, reconciler-only)
 - mutation guard failure (e.g. branches-only guard)
 - missing required MCP tool/schema or operation
 - stale or inconsistent runtime state (e.g. lease vs actual, dirty state disagreement)
@@ -118,6 +132,42 @@ The main project checkout is a stable control checkout on `master`, `main`, or
 If `cwd` is not inside `branches/`, stop before any file edit, test write,
 commit, merge, rebase, or cleanup. The main checkout is orchestration-only.
 
+## Stable Branch Push Protection (#671)
+
+Worker sessions must **never** publish a stable branch directly. This is the
+prevention hardening for the #670 incident (a bare direct-to-master commit
+`2fa97c26` and a PR #654 merger `git push prgs master` attempt).
+
+**Forbidden for author/reviewer/merger sessions:**
+
+- `git push <remote> master` (and `main`, `dev`, `develop`, `development`),
+  including refspecs (`HEAD:master`, `+refs/heads/x:refs/heads/master`),
+  `--force`, `--delete` / `:master`, and `--dry-run`/`-n` no-op probes (a
+  dry-run still proves intent and contaminates the session).
+- Local commits on the root/control checkout that are not carried by an issue
+  feature branch under `branches/`.
+
+**Allowed (never blocked):**
+
+- `git fetch` and `git pull --ff-only` of master into the control checkout when
+  authorized for sync.
+- Feature-branch pushes to non-stable refs (`git push <remote> fix/issue-N-...`).
+- Sanctioned merges via `gitea_merge_pr` / the Gitea API merge endpoint — the
+  **only** way stable branches advance.
+
+**What happens on a detected attempt:** the session is marked
+workflow-contaminated (durable `stable_branch_contamination` marker, redacted
+command summary + session id + remote + ref). While contaminated, all
+review / merge / close / issue-completion mutations fail closed. `comment_issue`
+and `lock_issue` remain allowed so the contaminated worker can post the durable
+audit comment and hand off. Contamination **cannot be self-cleared** — only a
+reconciler audit (`gitea_audit_stable_branch_contamination action=clear`) may
+clear it.
+
+Tooling: call `gitea_record_stable_branch_push_attempt` to classify/record a
+proposed push before running it; `gitea_audit_stable_branch_contamination` to
+inspect or (reconciler-only) clear the marker.
+
 ## Shell Spawn Hard-Stop Rule
 
 `exit_code: -1` with empty stdout/stderr means the shell failed to spawn — not a

stable_branch_push_guard.py

@@ -0,0 +1,478 @@
+"""Fail-closed guard against direct pushes to stable branches (#671).
+
+MCP workflow sessions must never publish to a stable branch (``master``,
+``main``, ``dev``, ...) directly. Stable-branch updates land only through
+sanctioned Gitea merge tooling or an explicitly authorized reconciler path.
+
+Incident origin (#670): a bare direct-to-master commit ``2fa97c26`` landed on
+``prgs/master`` without PR/review provenance, and a PR #654 merger run
+attempted ``git push prgs master`` (audited as a no-op, but the *intent* is the
+hazard). Partial protections already existed (``author_proofs.PROTECTED_BRANCHES``,
+``root_checkout_guard``, branch-push proofs) but did not detect shell push
+equivalents, mark the session contaminated after such an attempt, or fail
+closed on subsequent review/merge/close/completion mutations.
+
+This module is the detection + contamination-policy core. Like
+``author_proofs`` and ``root_checkout_guard`` it is **pure**: callers gather
+the raw facts (the proposed command line, git state, the durable contamination
+marker) and pass them in, so the same logic serves prompts, MCP gates, and
+tests. Nothing here performs git or network calls or reads durable state; the
+server wires these helpers to ``mcp_session_state`` and ``verify_preflight_purity``.
+
+Design rules honoured (from the #671 acceptance criteria):
+
+* Detect ``git push <remote> master`` shell equivalents, including refspecs
+  (``HEAD:master``, ``+refs/heads/x:refs/heads/master``), ``--force``,
+  ``--dry-run``/no-op intent, and delete refspecs (``:master``).
+* Never false-block a feature-branch push (``git push prgs fix/issue-671-...``).
+* Never treat ``git fetch`` / ``git pull --ff-only`` as a push.
+* Never treat sanctioned ``gitea_merge_pr`` / Gitea API merge as a push.
+* Fail closed on ambiguous targets that *may* resolve to a stable branch, but
+  surface ambiguity as its own signal rather than silently blocking feature work.
+* Contamination must not be clearable by the same worker session — only a
+  reconciler (audit) role may clear or bypass the gate.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any, Iterable
+
+from author_proofs import PROTECTED_BRANCHES
+
+# Single source of truth for the stable branch set: the same protected set the
+# author branch-identity proofs already enforce (#177), so the two guards can
+# never drift apart.
+STABLE_BRANCHES = PROTECTED_BRANCHES
+
+# Mutations that must fail closed once the session is contaminated by a direct
+# stable-branch push attempt (#671 AC4: review, merge, close, completion).
+# ``comment_issue`` / ``lock_issue`` / ``create_issue`` are deliberately NOT
+# gated so a contaminated worker can still post the durable audit comment and
+# hand off. Only a reconciler (audit) role bypasses this set.
+CONTAMINATION_GATED_TASKS = frozenset({
+    "create_pr",
+    "commit_files",
+    "gitea_commit_files",
+    "close_pr",
+    "close_issue",
+    "review_pr",
+    "approve_pr",
+    "request_changes_pr",
+    "submit_pr_review",
+    "merge_pr",
+    "delete_branch",
+    "complete_issue",
+})
+
+CONTAMINATION_KIND = "stable_branch_push"
+
+REMEDIATION = (
+    "Direct stable-branch publication is forbidden for worker sessions. Stop, "
+    "leave the stable branch untouched, and route the change through sanctioned "
+    "Gitea merge tooling (gitea_merge_pr) or an explicitly authorized reconciler "
+    "audit. This session is workflow-contaminated until a reconciler audits it."
+)
+
+# ── command tokenising ────────────────────────────────────────────────────────
+
+# Split a compound command line into individual simple commands on shell
+# separators so ``a && git push prgs master`` is analysed segment by segment.
+_SEGMENT_SPLIT_RE = re.compile(r"(?:\|\||&&|\||;|\n)")
+
+_GIT_PUSH_RE = re.compile(r"\bgit\b[\w\s\-]*?\bpush\b", re.IGNORECASE)
+_GIT_FETCH_RE = re.compile(r"\bgit\b[\w\s\-]*?\b(?:fetch|pull)\b", re.IGNORECASE)
+
+# Flags that take a value argument in ``git push`` (so the following token is
+# consumed as the flag's value, not a refspec).
+_VALUE_FLAGS = frozenset({
+    "--repo",
+    "-o",
+    "--push-option",
+    "--receive-pack",
+    "--exec",
+})
+
+_FORCE_FLAGS = frozenset({"-f", "--force"})
+_DRY_RUN_FLAGS = frozenset({"-n", "--dry-run"})
+_DELETE_FLAGS = frozenset({"-d", "--delete"})
+
+
+def _clean(value: str | None) -> str:
+    return (value or "").strip()
+
+
+def _strip_ref_prefix(ref: str) -> str:
+    ref = ref.strip()
+    for prefix in ("refs/heads/", "heads/"):
+        if ref.startswith(prefix):
+            return ref[len(prefix):]
+    return ref
+
+
+def is_stable_ref(ref: str | None) -> bool:
+    """True when ``ref`` names a configured stable branch."""
+    name = _strip_ref_prefix(_clean(ref))
+    return bool(name) and name in STABLE_BRANCHES
+
+
+# ── redaction ─────────────────────────────────────────────────────────────────
+
+_URL_USERINFO_RE = re.compile(r"(https?://)[^/\s:@]+(?::[^/\s@]+)?@", re.IGNORECASE)
+_SECRET_ASSIGN_RE = re.compile(
+    r"\b((?:GITEA_)?(?:TOKEN|PASSWORD|PASS|PAT|SECRET|API_KEY|AUTH))\s*=\s*\S+",
+    re.IGNORECASE,
+)
+_BEARER_RE = re.compile(r"\b(Bearer|token)\s+[A-Za-z0-9._\-]{8,}", re.IGNORECASE)
+
+
+def redact_command(command: str | None) -> str:
+    """Strip credentials/URLs from a command line before logging it (#671).
+
+    Redacts URL userinfo (``https://user:tok@host`` → ``https://***@host``),
+    ``TOKEN=...`` style assignments, and bearer/token headers. Leaves the
+    structural parts (``git push <remote> master``) intact for audit value.
+    """
+    text = _clean(command)
+    if not text:
+        return ""
+    text = _URL_USERINFO_RE.sub(r"\1***@", text)
+    text = _SECRET_ASSIGN_RE.sub(lambda m: f"{m.group(1)}=***", text)
+    text = _BEARER_RE.sub(lambda m: f"{m.group(1)} ***", text)
+    return text
+
+
+# ── push classification ───────────────────────────────────────────────────────
+
+def _analyse_push_segment(segment: str) -> dict[str, Any]:
+    """Classify one ``git push ...`` command segment."""
+    tokens = segment.split()
+    # Drop everything up to and including the ``push`` verb.
+    try:
+        push_idx = next(
+            i for i, tok in enumerate(tokens)
+            if tok.lower() == "push"
+        )
+    except StopIteration:
+        push_idx = -1
+    args = tokens[push_idx + 1:] if push_idx >= 0 else []
+
+    is_force = False
+    is_dry_run = False
+    is_delete = False
+    positionals: list[str] = []
+
+    skip_next = False
+    for tok in args:
+        if skip_next:
+            skip_next = False
+            continue
+        if tok in _FORCE_FLAGS or tok.startswith("--force-with-lease") or tok.startswith("--force-if-includes"):
+            is_force = True
+            continue
+        if tok in _DRY_RUN_FLAGS:
+            is_dry_run = True
+            continue
+        if tok in _DELETE_FLAGS:
+            is_delete = True
+            continue
+        if tok in _VALUE_FLAGS:
+            skip_next = True
+            continue
+        if tok.startswith("--") and "=" in tok:
+            # e.g. --repo=... : self-contained, not a refspec.
+            continue
+        if tok.startswith("-"):
+            # Unknown/combined short flag; ignore for ref detection.
+            continue
+        positionals.append(tok)
+
+    # First positional after push is the remote (when any positional exists);
+    # the rest are refspecs / branch names.
+    remote = positionals[0] if positionals else None
+    refspecs = positionals[1:]
+
+    stable_refs: list[str] = []
+    force_to_stable = False
+    delete_stable = False
+    for spec in refspecs:
+        force_spec = spec.startswith("+")
+        body = spec[1:] if force_spec else spec
+        if ":" in body:
+            src, _, dst = body.partition(":")
+            dest = dst
+            if src == "" and dst:
+                # ``:master`` — delete refspec.
+                is_delete = True
+        else:
+            dest = body
+        if is_stable_ref(dest):
+            stable_refs.append(_strip_ref_prefix(dest))
+            if force_spec or is_force:
+                force_to_stable = True
+            if is_delete:
+                delete_stable = True
+
+    targets_stable = bool(stable_refs)
+    # Ambiguous: ``git push <remote>`` (or bare ``git push``) with no refspec —
+    # resolves to the current branch's upstream, which we cannot see from the
+    # command alone. Flag it, but do not assert stable (would false-block
+    # feature-branch pushes).
+    ambiguous = not refspecs
+
+    return {
+        "is_git_push": True,
+        "remote": remote,
+        "refspecs": refspecs,
+        "targets_stable": targets_stable,
+        "stable_refs": stable_refs,
+        "is_force": is_force or force_to_stable,
+        "is_dry_run": is_dry_run,
+        "is_delete": is_delete or delete_stable,
+        "ambiguous_target": ambiguous,
+    }
+
+
+def classify_push_command(command: str | None) -> dict[str, Any]:
+    """Classify a shell command line for direct stable-branch push intent (#671).
+
+    Returns a dict describing whether the command is a ``git push`` targeting a
+    stable branch. Fetch/pull are never pushes. A sanctioned Gitea merge (which
+    is not a ``git push`` at all) classifies as non-push. Dry-run and no-op
+    pushes still count as *intent* and are reported as contamination
+    (``proves_intent``) so a ``--dry-run`` cannot be used to probe the gate.
+    """
+    text = _clean(command)
+    result: dict[str, Any] = {
+        "command": text,
+        "redacted_command": redact_command(text),
+        "is_git_push": False,
+        "is_fetch_or_pull": False,
+        "targets_stable": False,
+        "stable_refs": [],
+        "is_force": False,
+        "is_dry_run": False,
+        "is_delete": False,
+        "ambiguous_target": False,
+        "contamination": False,
+        "proves_intent": False,
+        "reasons": [],
+    }
+    if not text:
+        return result
+
+    stable_refs: list[str] = []
+    saw_push = False
+    for segment in _SEGMENT_SPLIT_RE.split(text):
+        seg = segment.strip()
+        if not seg:
+            continue
+        if _GIT_FETCH_RE.search(seg) and not _GIT_PUSH_RE.search(seg):
+            result["is_fetch_or_pull"] = True
+            continue
+        if not _GIT_PUSH_RE.search(seg):
+            continue
+        saw_push = True
+        analysis = _analyse_push_segment(seg)
+        result["is_git_push"] = True
+        result["is_force"] = result["is_force"] or analysis["is_force"]
+        result["is_dry_run"] = result["is_dry_run"] or analysis["is_dry_run"]
+        result["is_delete"] = result["is_delete"] or analysis["is_delete"]
+        result["ambiguous_target"] = result["ambiguous_target"] or analysis["ambiguous_target"]
+        stable_refs.extend(analysis["stable_refs"])
+
+    result["stable_refs"] = sorted(set(stable_refs))
+    result["targets_stable"] = bool(stable_refs)
+
+    reasons: list[str] = []
+    if result["targets_stable"]:
+        refs = ", ".join(result["stable_refs"])
+        verb = "delete" if result["is_delete"] else ("force-push" if result["is_force"] else "push")
+        qualifier = " (dry-run/no-op still proves intent)" if result["is_dry_run"] else ""
+        reasons.append(
+            f"direct stable-branch {verb} detected targeting: {refs}{qualifier}; "
+            "worker sessions must never publish stable branches directly"
+        )
+        result["contamination"] = True
+        result["proves_intent"] = True
+    elif saw_push and result["ambiguous_target"]:
+        # Bare ``git push`` with no refspec: ambiguous. Report, but do not
+        # contaminate on the command alone — the root-checkout / branch-state
+        # detector resolves whether the current branch is stable.
+        reasons.append(
+            "ambiguous 'git push' with no refspec: resolve the current branch "
+            "before pushing; if it is a stable branch this is forbidden"
+        )
+
+    result["reasons"] = reasons
+    return result
+
+
+def detect_stable_push(commands: str | Iterable[str] | None) -> dict[str, Any]:
+    """Classify one command or an iterable of commands; contamination if any hit."""
+    if commands is None:
+        return classify_push_command(None)
+    if isinstance(commands, str):
+        return classify_push_command(commands)
+    worst: dict[str, Any] | None = None
+    for cmd in commands:
+        res = classify_push_command(cmd)
+        if res["contamination"]:
+            return res
+        if worst is None or (res["is_git_push"] and not worst["is_git_push"]):
+            worst = res
+    return worst or classify_push_command(None)
+
+
+# ── root/control checkout local-commit detection ──────────────────────────────
+
+def assess_root_checkout_local_commit(
+    *,
+    current_branch: str | None,
+    head_sha: str | None,
+    remote_master_sha: str | None,
+    is_under_branches: bool,
+    ahead_count: int | None = None,
+) -> dict[str, Any]:
+    """Detect a local commit on the root/control checkout not on a feature branch.
+
+    #671 AC2. An isolated ``branches/...`` worktree is exempt (that is where
+    feature work belongs). On the control checkout, a commit is illegitimate
+    when the checkout sits on a stable branch (or detached) and its HEAD has
+    advanced past the tracking ``prgs/master`` — i.e. a commit was made that is
+    not carried by an issue feature branch/PR.
+
+    Positive evidence only: missing state reports ``unknown`` rather than
+    asserting contamination, but an unreadable *branch* on the control checkout
+    (detached HEAD) with an advanced HEAD is still flagged.
+    """
+    branch = _clean(current_branch)
+    head = _clean(head_sha).lower()
+    master = _clean(remote_master_sha).lower()
+
+    if is_under_branches:
+        return {
+            "contamination": False,
+            "unknown": False,
+            "reasons": [],
+            "detail": "isolated branches/ worktree — feature commits are expected here",
+        }
+
+    reasons: list[str] = []
+    unknown = False
+
+    on_stable = (not branch) or (branch in STABLE_BRANCHES)
+    if not on_stable:
+        # Control checkout is on some non-stable branch: out of scope for this
+        # detector (root_checkout_guard #475 handles that contamination class).
+        return {
+            "contamination": False,
+            "unknown": False,
+            "reasons": [],
+            "detail": f"control checkout on non-stable branch '{branch}' — not this detector's class",
+        }
+
+    advanced = False
+    if ahead_count is not None and ahead_count > 0:
+        advanced = True
+    if head and master and head != master:
+        advanced = True
+    if (not head or not master) and ahead_count is None:
+        unknown = True
+
+    if advanced:
+        where = f"branch '{branch}'" if branch else "detached HEAD"
+        reasons.append(
+            f"control checkout ({where}) has local commits not on an issue "
+            "feature branch (HEAD advanced past prgs/master); worker sessions "
+            "must commit only on issue branches under branches/"
+        )
+
+    return {
+        "contamination": bool(reasons),
+        "unknown": unknown and not reasons,
+        "reasons": reasons,
+        "current_branch": branch or None,
+        "head_sha": head or None,
+        "remote_master_sha": master or None,
+    }
+
+
+# ── contamination record + gate ───────────────────────────────────────────────
+
+def build_contamination_record(
+    *,
+    reason_class: str,
+    command_redacted: str | None = None,
+    session_id: str | None = None,
+    remote: str | None = None,
+    ref: str | None = None,
+    role: str | None = None,
+    detail: str | None = None,
+) -> dict[str, Any]:
+    """Build the durable contamination marker payload (redacted, audit-safe).
+
+    ``reason_class`` is one of ``stable_branch_push`` / ``root_checkout_commit``.
+    The command is stored already-redacted; callers pass the raw line through
+    :func:`redact_command` (or this builder redacts a raw ``command`` for them).
+    """
+    return {
+        "kind": CONTAMINATION_KIND,
+        "reason_class": _clean(reason_class) or "stable_branch_push",
+        "command_summary": redact_command(command_redacted),
+        "session_id": _clean(session_id) or None,
+        "remote": _clean(remote) or None,
+        "ref": _clean(ref) or None,
+        "role": _clean(role) or None,
+        "detail": _clean(detail) or None,
+        "cleared_by_reconciler": False,
+    }
+
+
+def assess_contamination_gate(
+    marker: dict[str, Any] | None,
+    *,
+    task: str | None,
+    actual_role: str | None,
+) -> dict[str, Any]:
+    """Fail closed on gated mutations while a contamination marker is live (#671 AC4).
+
+    * No marker → allowed.
+    * Reconciler (audit) role → allowed (the sanctioned path to inspect/clear).
+    * Marker present + ``task`` in :data:`CONTAMINATION_GATED_TASKS` → blocked.
+    * Marker present + non-gated task (e.g. ``comment_issue``) → allowed, so the
+      worker can still post the durable audit/handoff comment.
+    """
+    if not marker or marker.get("cleared_by_reconciler"):
+        return {"block": False, "reasons": [], "task": task}
+
+    role = _clean(actual_role).lower()
+    if role == "reconciler":
+        return {
+            "block": False,
+            "reasons": [],
+            "task": task,
+            "detail": "reconciler audit path is exempt from the contamination gate",
+        }
+
+    task_name = _clean(task)
+    if task_name and task_name in CONTAMINATION_GATED_TASKS:
+        summary = marker.get("command_summary") or marker.get("detail") or "(no summary)"
+        reason_class = marker.get("reason_class") or "stable_branch_push"
+        return {
+            "block": True,
+            "reasons": [
+                f"session is workflow-contaminated ({reason_class}): {summary}. "
+                f"'{task_name}' is blocked until a reconciler audits and clears "
+                "the contamination. " + REMEDIATION
+            ],
+            "task": task_name,
+        }
+
+    return {"block": False, "reasons": [], "task": task_name or None}
+
+
+def format_contamination_gate_error(gate: dict[str, Any]) -> str:
+    """Single RuntimeError message for MCP mutation gates."""
+    reasons = "; ".join(gate.get("reasons") or ["session workflow-contaminated"])
+    return f"Stable-branch contamination gate (#671): {reasons}"

tests/conftest.py

@@ -26,7 +26,16 @@ def _reset_mutation_authority(monkeypatch):
     Pin ``default_state_dir`` / ``DEFAULT_STATE_DIR`` to a per-test temp dir
     so durable load/save never touches host state even after env clears.
     """
-    monkeypatch.delenv("GITEA_SESSION_PROFILE_LOCK", raising=False)
+    for env_key in [
+        "GITEA_SESSION_PROFILE_LOCK",
+        "GITEA_ACTIVE_WORKTREE",
+        "GITEA_AUTHOR_WORKTREE",
+        "GITEA_REVIEWER_WORKTREE",
+        "GITEA_MERGER_WORKTREE",
+        "GITEA_RECONCILER_WORKTREE",
+    ]:
+        monkeypatch.delenv(env_key, raising=False)
+
     # Isolate durable session-state files so tests never share host cache (#559).
     import tempfile
 

tests/test_audit_reconciliation_mode.py

@@ -27,7 +27,13 @@ from task_capability_map import required_permission, required_role
 
 DELETE_PROFILE = {
     "profile_name": "prgs-author-delete",
-    "allowed_operations": ["gitea.read", "gitea.branch.delete"],
+    "role": "author",
+    "allowed_operations": [
+        "gitea.read",
+        "gitea.pr.create",
+        "gitea.branch.push",
+        "gitea.branch.delete",
+    ],
     "forbidden_operations": [],
     "audit_label": "prgs-author-delete",
 }

tests/test_create_issue_workspace_guard.py

@@ -57,9 +57,23 @@ class TestCreateIssueWorkspaceGuard(unittest.TestCase):
         # Without worktree_path/env hints, workspace resolves to PROJECT_ROOT. When that
         # path is the stable control checkout (not under branches/), mutation must fail.
         with patch.object(srv, "PROJECT_ROOT", CONTROL_CHECKOUT_ROOT):
-            with self.assertRaises(RuntimeError) as ctx:
-                srv.gitea_create_issue(title="Test issue", body="body text")
-        self.assertIn("stable control checkout", str(ctx.exception))
+            try:
+                res = srv.gitea_create_issue(title="Test issue", body="body text")
+            except RuntimeError as exc:
+                self.assertIn("stable control checkout", str(exc))
+            else:
+                # #683: production guards return typed blockers at entrypoints
+                self.assertFalse(res.get("success"))
+                self.assertFalse(res.get("performed"))
+                blob = " ".join(res.get("reasons") or []) + " " + str(
+                    res.get("blocker_kind") or ""
+                )
+                self.assertTrue(
+                    "stable control checkout" in blob
+                    or "missing_issue_worktree" in blob
+                    or "control checkout" in blob.lower()
+                )
+                self.assertTrue(res.get("exact_next_action"))
 
     @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)
     @patch("gitea_mcp_server._profile_permission_block", return_value=None)
@@ -105,11 +119,17 @@ class TestCreateIssueWorkspaceGuard(unittest.TestCase):
         )
         
         with patch.object(srv, "PROJECT_ROOT", CONTROL_CHECKOUT_ROOT):
-            with self.assertRaises(RuntimeError) as ctx:
-                srv.gitea_create_issue(
+            try:
+                res = srv.gitea_create_issue(
                     title="Test issue", body="body", worktree_path=missing_path
                 )
-        self.assertIn("does not exist (fail closed)", str(ctx.exception))
+            except RuntimeError as exc:
+                self.assertIn("does not exist", str(exc))
+            else:
+                self.assertFalse(res.get("success"))
+                blob = " ".join(res.get("reasons") or [])
+                self.assertIn("does not exist", blob)
+                self.assertTrue(res.get("exact_next_action") or res.get("reasons"))
 
     @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)
     @patch("gitea_mcp_server._profile_permission_block", return_value=None)
@@ -142,11 +162,20 @@ class TestCreateIssueWorkspaceGuard(unittest.TestCase):
 
         with patch.object(srv, "PROJECT_ROOT", CONTROL_CHECKOUT_ROOT):
             with patch("gitea_mcp_server._get_workspace_porcelain", return_value=""):
-                with self.assertRaises(RuntimeError) as ctx:
-                    srv.gitea_create_issue(
-                        title="Test issue", body="body", worktree_path=wrong_repo_path
+                try:
+                    res = srv.gitea_create_issue(
+                        title="Test issue",
+                        body="body",
+                        worktree_path=wrong_repo_path,
                     )
-        self.assertIn("does not belong to the target repository", str(ctx.exception))
+                except RuntimeError as exc:
+                    self.assertIn(
+                        "does not belong to the target repository", str(exc)
+                    )
+                else:
+                    self.assertFalse(res.get("success"))
+                    blob = " ".join(res.get("reasons") or [])
+                    self.assertIn("does not belong to the target repository", blob)
 
     @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)
     @patch("gitea_mcp_server._profile_permission_block", return_value=None)

tests/test_issue_540_comment_role_poison.py

@@ -267,10 +267,19 @@ class TestReconcilerCommentThroughCanonicalPath(unittest.TestCase):
             with patch.dict(os.environ, {}, clear=False):
                 os.environ.pop("GITEA_AUTHOR_WORKTREE", None)
                 os.environ.pop("GITEA_ACTIVE_WORKTREE", None)
-                with self.assertRaises(RuntimeError):
-                    srv.gitea_create_issue_comment(
+                try:
+                    res = srv.gitea_create_issue_comment(
                         515, "author note", remote="prgs"
                     )
+                except RuntimeError:
+                    pass  # legacy raise path
+                else:
+                    # #683: typed blocker at mutation entrypoint
+                    self.assertFalse(res.get("success"))
+                    self.assertFalse(res.get("performed"))
+                    self.assertTrue(
+                        res.get("blocker_kind") or res.get("reasons")
+                    )
         mock_api.assert_not_called()
 
 

tests/test_issue_683_workflow_scope_guards.py

@@ -0,0 +1,472 @@
+"""#683: block unattributed root WIP; pytest cannot disable production guards.
+
+Regression coverage required by issue #683:
+
+1. Session locked to issue A blocks unrelated target issue B until B is selected.
+2. Diagnostic source edit on the root checkout is blocked.
+3. Same legitimate edit succeeds after issue ownership + isolated worktree bind.
+4. Running under pytest does not deactivate production guards when force-on.
+5. Dirty tracked Python files remain visible to porcelain consumers.
+6. Monkeypatching one helper cannot silently turn the full guard path into a no-op.
+7. Real mutation entrypoint proves production guards run before side effects.
+8. Same-issue edits in a valid isolated worktree remain unaffected.
+9. Blocker includes stable reason + exact recovery action.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+import textwrap
+import unittest
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+import gitea_mcp_server as mcp_server  # noqa: E402
+import issue_lock_worktree  # noqa: E402
+import workflow_scope_guard as wsg  # noqa: E402
+
+CONTROL_ROOT = str(Path(__file__).resolve().parent.parent)
+if "branches" in Path(__file__).resolve().parts:
+    # Running from a worktree under branches/ — parent of branches is control.
+    parts = Path(__file__).resolve().parts
+    idx = parts.index("branches")
+    CONTROL_ROOT = str(Path(*parts[:idx])) if idx > 0 else CONTROL_ROOT
+
+
+class TestProductionGuardsForceOn(unittest.TestCase):
+    def tearDown(self):
+        for key in (
+            wsg.FORCE_PRODUCTION_GUARDS_ENV,
+            "GITEA_TEST_FORCE_DIRTY",
+            "GITEA_TEST_PORCELAIN",
+            "GITEA_AUTHOR_WORKTREE",
+            "GITEA_ACTIVE_WORKTREE",
+        ):
+            os.environ.pop(key, None)
+        wsg.clear_workflow_failure_ledger()
+
+    def test_force_on_under_pytest_keeps_production_active(self):
+        self.assertTrue(wsg.production_guards_active(in_test_mode=False))
+        self.assertFalse(wsg.production_guards_active(in_test_mode=True))
+        os.environ[wsg.FORCE_PRODUCTION_GUARDS_ENV] = "1"
+        self.assertTrue(wsg.production_guards_active(in_test_mode=True))
+        self.assertTrue(wsg.production_guards_forced())
+
+    def test_no_early_return_in_verify_role_mutation_workspace_source(self):
+        src = Path(mcp_server.__file__).read_text(encoding="utf-8")
+        # Rejected 300a4ca pattern must not exist.
+        self.assertNotIn(
+            "if _preflight_in_test_mode():\n        return _resolve_preflight_workspace_path",
+            src,
+        )
+        # Docstring contract for #683.
+        self.assertIn("#683", src)
+        self.assertIn("must NOT early-return solely because pytest", src)
+
+
+class TestPorcelainIntegrity(unittest.TestCase):
+    def test_read_worktree_git_state_surfaces_dirty_py(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            # Use a real git repo so porcelain is truthful.
+            import subprocess
+
+            subprocess.run(["git", "init"], cwd=tmp, check=True, capture_output=True)
+            subprocess.run(
+                ["git", "config", "user.email", "[email protected]"],
+                cwd=tmp,
+                check=True,
+                capture_output=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.name", "t"],
+                cwd=tmp,
+                check=True,
+                capture_output=True,
+            )
+            py_path = Path(tmp) / "sample_mod.py"
+            py_path.write_text("x = 1\n", encoding="utf-8")
+            subprocess.run(["git", "add", "sample_mod.py"], cwd=tmp, check=True)
+            subprocess.run(
+                ["git", "commit", "-m", "init"],
+                cwd=tmp,
+                check=True,
+                capture_output=True,
+            )
+            py_path.write_text("x = 2\n", encoding="utf-8")
+            state = issue_lock_worktree.read_worktree_git_state(tmp)
+            porcelain = state.get("porcelain_status") or ""
+            self.assertIn("sample_mod.py", porcelain)
+            self.assertTrue(any(line.strip().endswith(".py") for line in porcelain.splitlines()))
+
+    def test_production_reader_source_rejects_pytest_py_filter(self):
+        src = Path(issue_lock_worktree.__file__).read_text(encoding="utf-8")
+        findings = wsg.assert_no_pytest_porcelain_filter(src)
+        self.assertEqual(findings, [])
+        # Negative: the rejected 300a4ca pattern is detected.
+        rejected = textwrap.dedent(
+            """
+            porcelain = status_res.stdout or ""
+            import sys
+            if "pytest" in sys.modules or "unittest" in sys.modules:
+                porcelain = "\\n".join(
+                    line for line in porcelain.splitlines()
+                    if not line.strip().endswith(".py")
+                )
+            """
+        )
+        self.assertTrue(wsg.assert_no_pytest_porcelain_filter(rejected))
+
+
+class TestIssueScopeOwnership(unittest.TestCase):
+    def test_out_of_scope_issue_blocked_until_selected(self):
+        result = wsg.assess_issue_scope_ownership(
+            locked_issue_number=100,
+            target_issue_number=200,
+            branch_name="fix/issue-100-example",
+            role_kind="author",
+        )
+        self.assertTrue(result["block"])
+        self.assertEqual(result["blocker_kind"], wsg.BLOCKER_OUT_OF_SCOPE_ISSUE)
+        self.assertIn("exact_next_action", result)
+        self.assertIn("owning issue", result["exact_next_action"].lower())
+        self.assertTrue(result["reasons"])
+
+    def test_same_issue_scope_allowed(self):
+        result = wsg.assess_issue_scope_ownership(
+            locked_issue_number=100,
+            target_issue_number=100,
+            branch_name="fix/issue-100-example",
+            role_kind="author",
+        )
+        self.assertFalse(result["block"])
+        self.assertEqual(result["exact_next_action"], "proceed")
+
+    def test_missing_lock_when_required(self):
+        result = wsg.assess_issue_scope_ownership(
+            locked_issue_number=None,
+            target_issue_number=None,
+            role_kind="author",
+            require_lock_for_author=True,
+        )
+        self.assertTrue(result["block"])
+        self.assertEqual(result["blocker_kind"], wsg.BLOCKER_MISSING_ISSUE_SCOPE)
+
+    def test_branch_issue_mismatch(self):
+        result = wsg.assess_issue_scope_ownership(
+            locked_issue_number=50,
+            branch_name="fix/issue-99-other",
+            role_kind="author",
+        )
+        self.assertTrue(result["block"])
+        self.assertEqual(result["blocker_kind"], wsg.BLOCKER_OUT_OF_SCOPE_ISSUE)
+
+
+class TestRootDiagnosticEdit(unittest.TestCase):
+    def test_dirty_root_source_blocked(self):
+        result = wsg.assess_root_source_mutation(
+            workspace_path=CONTROL_ROOT,
+            canonical_repo_root=CONTROL_ROOT,
+            porcelain_status=" M gitea_mcp_server.py\n M tests/test_x.py\n",
+            role_kind="author",
+        )
+        self.assertTrue(result["block"])
+        self.assertEqual(result["blocker_kind"], wsg.BLOCKER_ROOT_DIAGNOSTIC_EDIT)
+        self.assertIn("gitea_mcp_server.py", result["dirty_source_files"])
+        self.assertIn("exact_next_action", result)
+        self.assertIn("branches/", result["exact_next_action"])
+
+    def test_isolated_worktree_same_issue_unaffected(self):
+        wt = f"{CONTROL_ROOT}/branches/issue-100-example"
+        result = wsg.assess_root_source_mutation(
+            workspace_path=wt,
+            canonical_repo_root=CONTROL_ROOT,
+            porcelain_status=" M helper.py\n",
+            current_branch="fix/issue-100-example",
+            locked_issue_number=100,
+            role_kind="author",
+        )
+        self.assertFalse(result["block"])
+        self.assertTrue(result["under_branches"])
+
+    def test_legitimate_after_ownership_and_worktree(self):
+        wt = f"{CONTROL_ROOT}/branches/issue-683-workflow-guard-hardening"
+        composed = wsg.assess_production_mutation_guards(
+            workspace_path=wt,
+            canonical_repo_root=CONTROL_ROOT,
+            porcelain_status=" M workflow_scope_guard.py\n",
+            current_branch="fix/issue-683-workflow-guard-hardening",
+            locked_issue_number=683,
+            target_issue_number=683,
+            role_kind="author",
+            require_author_lock=True,
+            in_test_mode=True,
+        )
+        # Force-on required for production path under pytest.
+        os.environ[wsg.FORCE_PRODUCTION_GUARDS_ENV] = "1"
+        try:
+            composed = wsg.assess_production_mutation_guards(
+                workspace_path=wt,
+                canonical_repo_root=CONTROL_ROOT,
+                porcelain_status=" M workflow_scope_guard.py\n",
+                current_branch="fix/issue-683-workflow-guard-hardening",
+                locked_issue_number=683,
+                target_issue_number=683,
+                role_kind="author",
+                require_author_lock=True,
+                in_test_mode=True,
+            )
+            self.assertFalse(composed["block"])
+            self.assertFalse(composed.get("skipped"))
+        finally:
+            os.environ.pop(wsg.FORCE_PRODUCTION_GUARDS_ENV, None)
+
+
+class TestTypedBlockerResponse(unittest.TestCase):
+    def test_block_response_has_stable_kind_and_next_action(self):
+        assessment = wsg.assess_issue_scope_ownership(
+            locked_issue_number=1,
+            target_issue_number=2,
+            role_kind="author",
+        )
+        resp = wsg.block_response(assessment)
+        self.assertFalse(resp["success"])
+        self.assertFalse(resp["performed"])
+        self.assertEqual(resp["blocker_kind"], wsg.BLOCKER_OUT_OF_SCOPE_ISSUE)
+        self.assertIsInstance(resp["exact_next_action"], str)
+        self.assertTrue(resp["exact_next_action"])
+        self.assertTrue(resp["reasons"])
+
+    def test_production_guard_error_roundtrip(self):
+        err = wsg.ProductionGuardError(
+            "blocked",
+            blocker_kind=wsg.BLOCKER_ROOT_DIAGNOSTIC_EDIT,
+            reasons=["dirty root"],
+        )
+        resp = wsg.block_response(err, issue_number=683)
+        self.assertEqual(resp["blocker_kind"], wsg.BLOCKER_ROOT_DIAGNOSTIC_EDIT)
+        self.assertEqual(resp["issue_number"], 683)
+        self.assertIn("exact_next_action", resp)
+
+
+class TestDurableFailureRecording(unittest.TestCase):
+    def setUp(self):
+        wsg.clear_workflow_failure_ledger()
+
+    def tearDown(self):
+        wsg.clear_workflow_failure_ledger()
+
+    def test_record_before_source_mutation(self):
+        pending = wsg.assess_durable_failure_recorded(
+            require_record=True, pending_source_mutation=True
+        )
+        self.assertTrue(pending["block"])
+        self.assertEqual(pending["blocker_kind"], wsg.BLOCKER_UNRECORDED_FAILURE)
+
+        wsg.record_workflow_failure(
+            kind="transport_eof",
+            detail="EOF during review session (#584 cluster)",
+            issue_number=683,
+            task="comment_issue",
+        )
+        after = wsg.assess_durable_failure_recorded(
+            require_record=True, pending_source_mutation=True
+        )
+        self.assertFalse(after["block"])
+        self.assertEqual(len(wsg.workflow_failure_ledger()), 1)
+
+
+class TestMonkeypatchCannotNoopFullPath(unittest.TestCase):
+    def tearDown(self):
+        os.environ.pop(wsg.FORCE_PRODUCTION_GUARDS_ENV, None)
+
+    def test_patching_branches_only_still_blocks_dirty_root_scope(self):
+        """Monkeypatching branches-only must not silence root diagnostic block."""
+        os.environ[wsg.FORCE_PRODUCTION_GUARDS_ENV] = "1"
+        with patch.object(
+            mcp_server, "_enforce_branches_only_author_mutation", lambda *a, **k: None
+        ):
+            with patch.object(
+                mcp_server, "_enforce_root_checkout_guard", lambda *a, **k: None
+            ):
+                # Even if both legacy helpers are patched, issue-scope composition
+                # still sees dirty root source via assess_production_mutation_guards.
+                assessment = wsg.assess_production_mutation_guards(
+                    workspace_path=CONTROL_ROOT,
+                    canonical_repo_root=CONTROL_ROOT,
+                    porcelain_status=" M gitea_mcp_server.py\n",
+                    role_kind="author",
+                    in_test_mode=True,
+                )
+                self.assertTrue(assessment["block"])
+                self.assertEqual(
+                    assessment["blocker_kind"], wsg.BLOCKER_ROOT_DIAGNOSTIC_EDIT
+                )
+
+
+class TestRealEntrypointProductionGuard(unittest.TestCase):
+    """Real mutation entrypoint: production guard before side effects (#683)."""
+
+    def setUp(self):
+        os.environ[wsg.FORCE_PRODUCTION_GUARDS_ENV] = "1"
+        for key in ("GITEA_AUTHOR_WORKTREE", "GITEA_ACTIVE_WORKTREE"):
+            os.environ.pop(key, None)
+        self._orig_whoami = mcp_server._preflight_whoami_called
+        self._orig_cap = mcp_server._preflight_capability_called
+        mcp_server._preflight_whoami_called = False
+        mcp_server._preflight_capability_called = False
+        mcp_server._preflight_resolved_role = None
+        mcp_server._preflight_resolved_task = None
+
+    def tearDown(self):
+        os.environ.pop(wsg.FORCE_PRODUCTION_GUARDS_ENV, None)
+        for key in ("GITEA_AUTHOR_WORKTREE", "GITEA_ACTIVE_WORKTREE"):
+            os.environ.pop(key, None)
+        mcp_server._preflight_whoami_called = self._orig_whoami
+        mcp_server._preflight_capability_called = self._orig_cap
+        mcp_server._preflight_resolved_role = None
+        mcp_server._preflight_resolved_task = None
+
+    def test_comment_issue_blocks_dirty_root_before_api(self):
+        api_mock = MagicMock()
+        with patch.object(mcp_server, "api_request", api_mock), patch.object(
+            mcp_server,
+            "_actual_profile_role",
+            return_value="author",
+        ), patch.object(
+            mcp_server,
+            "_effective_workspace_role",
+            return_value="author",
+        ), patch.object(
+            mcp_server,
+            "get_profile",
+            return_value={
+                "profile_name": "prgs-author",
+                "allowed_operations": [
+                    "gitea.issue.comment",
+                    "gitea.read",
+                    "gitea.pr.create",
+                    "gitea.branch.push",
+                ],
+                "forbidden_operations": [],
+            },
+        ), patch.object(
+            issue_lock_worktree,
+            "read_worktree_git_state",
+            side_effect=lambda path, **kw: {
+                "current_branch": "master",
+                "porcelain_status": (
+                    " M gitea_mcp_server.py\n"
+                    if os.path.realpath(path) == os.path.realpath(CONTROL_ROOT)
+                    or path == CONTROL_ROOT
+                    else ""
+                ),
+                "head_sha": "a" * 40,
+                "base_equivalent": True,
+            },
+        ), patch.object(
+            mcp_server,
+            "_resolve_namespace_mutation_context",
+            return_value={
+                "workspace_path": CONTROL_ROOT,
+                "canonical_repo_root": CONTROL_ROOT,
+                "process_project_root": CONTROL_ROOT,
+                "workspace_role_kind": "author",
+                "workspace_binding_source": "process root",
+                "ignored_bindings": [],
+            },
+        ), patch.object(
+            mcp_server,
+            "_resolve_author_mutation_context",
+            return_value={
+                "workspace_path": CONTROL_ROOT,
+                "canonical_repo_root": CONTROL_ROOT,
+                "process_project_root": CONTROL_ROOT,
+                "roots_aligned": True,
+            },
+        ), patch.object(
+            mcp_server,
+            "_session_locked_issue_number",
+            return_value=None,
+        ):
+            result = mcp_server.gitea_create_issue_comment(
+                issue_number=683,
+                body="diagnostic note",
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+                worktree_path=CONTROL_ROOT,
+            )
+
+        api_mock.assert_not_called()
+        self.assertFalse(result.get("success"))
+        self.assertFalse(result.get("performed"))
+        self.assertIn(result.get("blocker_kind"), wsg.BLOCKER_KINDS)
+        self.assertTrue(result.get("exact_next_action"))
+        self.assertTrue(result.get("reasons"))
+
+    def test_comment_issue_succeeds_structure_after_worktree_bind(self):
+        """Same-issue isolated worktree is not blocked by root diagnostic path."""
+        wt = f"{CONTROL_ROOT}/branches/issue-683-workflow-guard-hardening"
+        os.environ["GITEA_AUTHOR_WORKTREE"] = wt
+        assessment = wsg.assess_production_mutation_guards(
+            workspace_path=wt,
+            canonical_repo_root=CONTROL_ROOT,
+            porcelain_status=" M workflow_scope_guard.py\n",
+            current_branch="fix/issue-683-workflow-guard-hardening",
+            locked_issue_number=683,
+            target_issue_number=683,
+            role_kind="author",
+            require_author_lock=True,
+            in_test_mode=True,
+        )
+        self.assertFalse(assessment["block"], assessment)
+
+
+class TestVerifyPreflightForceOn(unittest.TestCase):
+    def tearDown(self):
+        os.environ.pop(wsg.FORCE_PRODUCTION_GUARDS_ENV, None)
+        for key in ("GITEA_AUTHOR_WORKTREE", "GITEA_ACTIVE_WORKTREE"):
+            os.environ.pop(key, None)
+
+    def test_force_on_runs_production_guards_under_pytest(self):
+        os.environ[wsg.FORCE_PRODUCTION_GUARDS_ENV] = "1"
+        called = {"root": 0, "branches": 0, "scope": 0}
+
+        def _root(*a, **k):
+            called["root"] += 1
+
+        def _branches(*a, **k):
+            called["branches"] += 1
+
+        def _scope(*a, **k):
+            called["scope"] += 1
+
+        with patch.object(mcp_server, "_enforce_root_checkout_guard", _root), patch.object(
+            mcp_server, "_enforce_branches_only_author_mutation", _branches
+        ), patch.object(mcp_server, "_enforce_issue_scope_guard", _scope):
+            # No whoami/capability — purity-order skipped; production still runs.
+            mcp_server.verify_preflight_purity(task="comment_issue")
+
+        self.assertEqual(called["root"], 1)
+        self.assertEqual(called["branches"], 1)
+        self.assertEqual(called["scope"], 1)
+
+    def test_without_force_on_pytest_skips_production_only_for_unit_isolation(self):
+        called = {"root": 0}
+
+        def _root(*a, **k):
+            called["root"] += 1
+
+        with patch.object(mcp_server, "_enforce_root_checkout_guard", _root), patch.object(
+            mcp_server, "_enforce_branches_only_author_mutation", lambda *a, **k: None
+        ), patch.object(mcp_server, "_enforce_issue_scope_guard", lambda *a, **k: None):
+            mcp_server.verify_preflight_purity(task="comment_issue")
+        self.assertEqual(called["root"], 0)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_issue_comment_workspace_guard.py

@@ -108,13 +108,24 @@ class TestIssueCommentWorkspaceGuard(unittest.TestCase):
                 "gitea_mcp_server.issue_lock_worktree.read_worktree_git_state",
                 side_effect=self._git_state(valid_worktree),
             ):
-                with self.assertRaises(RuntimeError) as ctx:
-                    srv.gitea_create_issue_comment(
+                try:
+                    res = srv.gitea_create_issue_comment(
                         issue_number=557,
                         body="evidence comment",
                         remote="prgs",
                     )
-        self.assertIn("stable control checkout", str(ctx.exception))
+                except RuntimeError as exc:
+                    self.assertIn("stable control checkout", str(exc))
+                else:
+                    # #683 typed blocker at mutation entrypoint
+                    self.assertFalse(res.get("success"))
+                    self.assertFalse(res.get("performed"))
+                    blob = " ".join(res.get("reasons") or [])
+                    self.assertTrue(
+                        "stable control checkout" in blob
+                        or res.get("blocker_kind")
+                    )
+                    self.assertTrue(res.get("exact_next_action") or res.get("reasons"))
         mock_api.assert_not_called()
 
     @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)
@@ -184,14 +195,24 @@ class TestIssueCommentWorkspaceGuard(unittest.TestCase):
                         side_effect=self._subprocess(valid_worktree, outside_worktree),
                     ):
                         with patch.dict(os.environ, self.AUTHOR_ENV, clear=True):
-                            with self.assertRaises(RuntimeError) as ctx:
-                                srv.gitea_create_issue_comment(
+                            try:
+                                res = srv.gitea_create_issue_comment(
                                     issue_number=557,
                                     body="evidence comment",
                                     remote="prgs",
                                     worktree_path=outside_worktree,
                                 )
-        self.assertIn("does not belong to the target repository", str(ctx.exception))
+                            except RuntimeError as exc:
+                                self.assertIn(
+                                    "does not belong to the target repository",
+                                    str(exc),
+                                )
+                            else:
+                                self.assertFalse(res.get("success"))
+                                blob = " ".join(res.get("reasons") or [])
+                                self.assertIn(
+                                    "does not belong to the target repository", blob
+                                )
         mock_api.assert_not_called()
 
     @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)

tests/test_mcp_server.py

@@ -1425,10 +1425,16 @@ class TestReviewPR(unittest.TestCase):
 class TestDeleteBranch(unittest.TestCase):
 
     DELETE_PROFILE = {
-        "profile_name": "test-deleter",
-        "allowed_operations": ["gitea.read", "gitea.branch.delete"],
+        "profile_name": "test-author-deleter",
+        "role": "author",
+        "allowed_operations": [
+            "gitea.read",
+            "gitea.pr.create",
+            "gitea.branch.push",
+            "gitea.branch.delete",
+        ],
         "forbidden_operations": [],
-        "audit_label": "test-deleter",
+        "audit_label": "test-author-deleter",
     }
 
     @patch("mcp_server.get_profile", return_value=DELETE_PROFILE)

tests/test_migrate_profiles.py

@@ -92,14 +92,19 @@ class TestMigrateProfiles(unittest.TestCase):
         author = prgs_gitea["identities"]["author"]
         self.assertEqual(author["username"], "jcwalker3")
         self.assertEqual(author["auth"]["id"], "redacted-author-ref")
-        self.assertEqual(author["allowed_operations"], ["read", "comment"])
-        self.assertEqual(author["forbidden_operations"], ["approve", "merge"])
+        self.assertEqual(
+            author["allowed_operations"], ["gitea.read", "gitea.pr.comment"]
+        )
+        self.assertEqual(
+            author["forbidden_operations"],
+            ["gitea.pr.approve", "gitea.pr.merge"],
+        )
 
         reviewer = prgs_gitea["identities"]["reviewer"]
         self.assertEqual(reviewer["role"], "reviewer")
         self.assertEqual(reviewer["username"], "sysadmin")
         self.assertEqual(reviewer["auth"]["id"], "redacted-reviewer-ref")
-        self.assertIn("merge", reviewer["allowed_operations"])
+        self.assertIn("gitea.pr.merge", reviewer["allowed_operations"])
 
     def test_alias_generation(self):
         """Test that aliases are correctly generated to support old profile names."""
@@ -188,7 +193,7 @@ class TestMigrateProfiles(unittest.TestCase):
         self.assertNotIn("token", stdout_output.lower())
 
     def test_explicit_operations_are_preserved(self):
-        """Explicit v1 permissions must not be replaced by role defaults."""
+        """Explicit v1 permissions are canonicalized, not replaced by role defaults."""
         v1_data = json.loads(json.dumps(self.v1_content))
         v1_data["profiles"]["prgs-reviewer"]["allowed_operations"] = ["read"]
         v1_data["profiles"]["prgs-reviewer"]["forbidden_operations"] = ["merge"]
@@ -198,8 +203,8 @@ class TestMigrateProfiles(unittest.TestCase):
             v2_data["environments"]["prgs"]["services"]["gitea"]
             ["identities"]["reviewer"]
         )
-        self.assertEqual(reviewer["allowed_operations"], ["read"])
-        self.assertEqual(reviewer["forbidden_operations"], ["merge"])
+        self.assertEqual(reviewer["allowed_operations"], ["gitea.read"])
+        self.assertEqual(reviewer["forbidden_operations"], ["gitea.pr.merge"])
 
     def test_inferred_role_defaults_only_when_unambiguous(self):
         """Role defaults are allowed only for clear author/reviewer profiles."""
@@ -306,6 +311,171 @@ class TestMigrateProfiles(unittest.TestCase):
                 migrate_profiles.main()
             self.assertEqual(cm.exception.code, 1)
 
+    def test_reconciler_profile_migration(self):
+        """Legacy reconciler shorthands migrate to valid canonical operations."""
+        import gitea_config
+        import reconciler_profile
+
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                    "allowed_operations": [
+                        "read",
+                        "pr.close",
+                        "pr.comment",
+                        "issue.comment",
+                        "issue.close",
+                        "gitea.branch.delete",
+                    ],
+                    "forbidden_operations": [
+                        "merge",
+                        "approve",
+                        "review",
+                        "pr.create",
+                        "branch.push",
+                        "commit",
+                    ],
+                }
+            }
+        }
+        v2_data = migrate_profiles.migrate_v1_to_v2(v1_data)
+        reconciler = (
+            v2_data["environments"]["prgs"]["services"]["gitea"]
+            ["identities"]["reconciler"]
+        )
+        self.assertEqual(reconciler["role"], "reconciler")
+        allowed = reconciler["allowed_operations"]
+        forbidden = reconciler["forbidden_operations"]
+        # No invalid shorthand remains
+        for bad in ("pr.close", "pr.comment", "issue.close", "read", "merge"):
+            self.assertNotIn(bad, allowed)
+            self.assertNotIn(bad, forbidden)
+        for required in (
+            "gitea.read",
+            "gitea.pr.close",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+            "gitea.issue.close",
+            "gitea.branch.delete",
+        ):
+            self.assertIn(required, allowed)
+            # Production loader accepts every allowed op
+            self.assertEqual(
+                gitea_config.normalize_operation(required), required
+            )
+        self.assertEqual(v2_data["aliases"]["prgs-reconciler"], "prgs.gitea.reconciler")
+        assessment = reconciler_profile.assess_reconciler_profile(allowed, forbidden)
+        self.assertTrue(assessment["valid"])
+        self.assertTrue(migrate_profiles.validate_v2_data(v2_data))
+
+    def test_reconciler_profile_defaults(self):
+        """Reconciler defaults are fully canonical and loader-valid."""
+        import gitea_config
+        import reconciler_profile
+
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                }
+            }
+        }
+        v2_data = migrate_profiles.migrate_v1_to_v2(v1_data)
+        reconciler = (
+            v2_data["environments"]["prgs"]["services"]["gitea"]
+            ["identities"]["reconciler"]
+        )
+        self.assertEqual(reconciler["role"], "reconciler")
+        self.assertEqual(
+            reconciler["allowed_operations"],
+            migrate_profiles.RECONCILER_DEFAULT_ALLOWED,
+        )
+        self.assertEqual(
+            reconciler["forbidden_operations"],
+            migrate_profiles.RECONCILER_DEFAULT_FORBIDDEN,
+        )
+        for op in reconciler["allowed_operations"]:
+            self.assertEqual(gitea_config.normalize_operation(op), op)
+            self.assertTrue(op.startswith("gitea."))
+        assessment = reconciler_profile.assess_reconciler_profile(
+            reconciler["allowed_operations"],
+            reconciler["forbidden_operations"],
+        )
+        self.assertTrue(assessment["valid"])
+        self.assertNotIn(
+            "gitea.branch.delete", assessment["missing_recommended_operations"]
+        )
+
+    def test_reconciler_migration_idempotent_canonicalize(self):
+        """Second canonicalize of already-canonical ops is a no-op."""
+        first = migrate_profiles.canonicalize_operations(
+            list(migrate_profiles.RECONCILER_DEFAULT_ALLOWED)
+        )
+        second = migrate_profiles.canonicalize_operations(first)
+        self.assertEqual(first, second)
+        self.assertEqual(first, list(migrate_profiles.RECONCILER_DEFAULT_ALLOWED))
+
+    def test_reconciler_missing_required_fails_visibly(self):
+        """Missing gitea.pr.close after migration fails closed (not silent drop)."""
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                    "allowed_operations": ["read", "gitea.branch.delete"],
+                    "forbidden_operations": ["merge"],
+                }
+            },
+        }
+        with self.assertRaisesRegex(ValueError, "missing required"):
+            migrate_profiles.migrate_v1_to_v2(v1_data)
+
+    def test_unknown_operation_fails_visibly(self):
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-author": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "jcwalker3",
+                    "auth": {"type": "keychain", "id": "hidden-author-ref"},
+                    "execution_profile": "prgs-author",
+                    "allowed_operations": ["read", "not.a.real.op"],
+                    "forbidden_operations": ["merge"],
+                }
+            },
+        }
+        with self.assertRaisesRegex(ValueError, "cannot be canonicalized"):
+            migrate_profiles.migrate_v1_to_v2(v1_data)
+
+    def test_role_inference_author_reviewer_merger_reconciler(self):
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-author", "prgs-author"), "author"
+        )
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-reviewer", "prgs-reviewer"),
+            "reviewer",
+        )
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-reconciler", "prgs-reconciler"),
+            "reconciler",
+        )
+        self.assertIsNone(
+            migrate_profiles.infer_role("prgs-merger", "prgs-merger")
+        )
+
 
 if __name__ == "__main__":
     unittest.main()
+

tests/test_preflight_read_survival.py

@@ -76,13 +76,17 @@ class TestPreflightReadSurvival(unittest.TestCase):
         self.assertIn("task mismatch", str(ctx.exception))
 
     def test_capability_consumed_after_mutation_gate(self):
+        # Use reconciler/close_pr so this purity-order test does not require a
+        # branches/ worktree (author create_issue would hit #274/#683 guards).
+        # Test isolation stays explicit; production author guards remain live
+        # under force-on (see tests/test_issue_683_workflow_scope_guards.py).
         mcp_server.record_preflight_check("whoami")
         mcp_server.record_preflight_check(
-            "capability", resolved_role="author", resolved_task="create_issue"
+            "capability", resolved_role="reconciler", resolved_task="close_pr"
         )
-        mcp_server.verify_preflight_purity(task="create_issue")
+        mcp_server.verify_preflight_purity(task="close_pr")
         with self.assertRaises(RuntimeError) as ctx:
-            mcp_server.verify_preflight_purity(task="create_issue")
+            mcp_server.verify_preflight_purity(task="close_pr")
         self.assertIn("has not been resolved", str(ctx.exception))
 
     def test_whoami_recovery_after_violation_clears_capability(self):

tests/test_reconciler_close_workspace_guard.py

@@ -86,9 +86,21 @@ class TestReconcilerCloseWorkspaceGuard(unittest.TestCase):
     ):
         srv._preflight_resolved_role = "author"
         with patch.object(srv, "PROJECT_ROOT", CONTROL_CHECKOUT_ROOT):
-            with self.assertRaises(RuntimeError) as ctx:
-                srv.gitea_create_issue(title="Test", body="body")
-        self.assertIn("stable control checkout", str(ctx.exception))
+            try:
+                res = srv.gitea_create_issue(title="Test", body="body")
+            except RuntimeError as exc:
+                self.assertIn("stable control checkout", str(exc))
+            else:
+                # #683 typed blocker at mutation entrypoint
+                self.assertFalse(res.get("success"))
+                blob = " ".join(res.get("reasons") or []) + str(
+                    res.get("blocker_kind") or ""
+                )
+                self.assertTrue(
+                    "stable control checkout" in blob
+                    or "missing_issue_worktree" in blob
+                    or "control checkout" in blob.lower()
+                )
 
 
 if __name__ == "__main__":

tests/test_reconciler_profile.py

@@ -82,6 +82,42 @@ class TestReconcilerProfileModel(unittest.TestCase):
             "reconciler",
         )
 
+    def test_branch_delete_is_recommended_for_reconciler(self):
+        self.assertIn(
+            "gitea.branch.delete",
+            reconciler_profile.RECONCILER_RECOMMENDED_OPERATIONS,
+        )
+        self.assertNotIn(
+            "gitea.branch.delete",
+            reconciler_profile.RECONCILER_REQUIRED_OPERATIONS,
+        )
+
+    def test_reconciler_with_branch_delete_stays_valid(self):
+        allowed = PRGS_RECONCILER_ALLOWED + ["gitea.branch.delete"]
+        result = reconciler_profile.assess_reconciler_profile(
+            allowed,
+            PRGS_RECONCILER_FORBIDDEN,
+        )
+        self.assertTrue(result["is_reconciler_profile"])
+        self.assertTrue(result["valid"])
+        self.assertNotIn(
+            "gitea.branch.delete", result["missing_recommended_operations"]
+        )
+        self.assertEqual(
+            mcp_server._role_kind(allowed, PRGS_RECONCILER_FORBIDDEN),
+            "reconciler",
+        )
+
+    def test_reconciler_without_branch_delete_reports_missing_recommended(self):
+        result = reconciler_profile.assess_reconciler_profile(
+            PRGS_RECONCILER_ALLOWED,
+            PRGS_RECONCILER_FORBIDDEN,
+        )
+        self.assertTrue(result["valid"])
+        self.assertIn(
+            "gitea.branch.delete", result["missing_recommended_operations"]
+        )
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_root_checkout_guard.py

@@ -141,13 +141,21 @@ class TestVerifyPreflightRootGuardIntegration(unittest.TestCase):
         self.assertIn("Root checkout guard (#475)", str(ctx.exception))
         self.assertIn(rcg.REMEDIATION, str(ctx.exception))
 
+    @patch("os.path.isdir", return_value=True)
+    @patch("os.path.exists", return_value=True)
+    @patch("subprocess.run")
     @patch("gitea_mcp_server._get_workspace_porcelain", return_value="")
     @patch("gitea_mcp_server.root_checkout_guard.resolve_remote_master_sha", return_value=MASTER_SHA)
     @patch("gitea_mcp_server.issue_lock_worktree.read_worktree_git_state")
     @patch("gitea_mcp_server._resolve_author_mutation_context")
     def test_reviewer_from_branches_worktree_allowed(
-        self, mock_ctx, mock_git, _remote_sha, _porcelain,
+        self, mock_ctx, mock_git, _remote_sha, _porcelain, mock_run, _exists, _isdir,
     ):
+        import unittest.mock
+        mock_run.return_value = unittest.mock.MagicMock(
+            returncode=0,
+            stdout=f"{CONTROL_ROOT}/.git\n",
+        )
         srv._preflight_capability_baseline_porcelain = ""
         mock_ctx.return_value = {
             "workspace_path": BRANCHES_WORKTREE,
@@ -161,6 +169,5 @@ class TestVerifyPreflightRootGuardIntegration(unittest.TestCase):
         }
         srv.verify_preflight_purity("prgs", worktree_path=BRANCHES_WORKTREE)
 
-
 if __name__ == "__main__":
     unittest.main()

tests/test_stable_branch_contamination_server.py

@@ -0,0 +1,188 @@
+"""Server wiring for stable-branch push contamination (#671).
+
+Exercises the MCP tools and the pre-flight enforcement gate against the durable
+contamination marker (isolated per-test state dir from conftest).
+"""
+
+from __future__ import annotations
+
+import os
+from unittest.mock import patch
+
+import gitea_mcp_server as srv
+
+
+def _clear_marker(remote="prgs"):
+    srv._clear_stable_contamination_marker(remote=remote)
+
+
+def teardown_function():
+    _clear_marker()
+
+
+# ── record tool marks a real direct push ─────────────────────────────────────
+
+def test_record_tool_marks_direct_master_push():
+    _clear_marker()
+    res = srv.gitea_record_stable_branch_push_attempt(
+        command="git push prgs master", remote="prgs"
+    )
+    assert res["contaminated"] is True
+    assert res["marked"] is True
+    assert res["marker"] is not None
+    assert res["marker"]["reason_class"] == "stable_branch_push"
+    # loaded back through the durable store
+    loaded = srv._load_stable_contamination_marker("prgs")
+    assert loaded is not None
+    assert loaded["ref"] == "master"
+
+
+def test_record_tool_dry_run_still_marks():
+    _clear_marker()
+    res = srv.gitea_record_stable_branch_push_attempt(
+        command="git push --dry-run prgs master", remote="prgs"
+    )
+    assert res["contaminated"] is True
+    assert res["marked"] is True
+
+
+def test_record_tool_feature_branch_does_not_mark():
+    _clear_marker()
+    res = srv.gitea_record_stable_branch_push_attempt(
+        command="git push prgs fix/issue-671-block-stable-branch-push",
+        remote="prgs",
+    )
+    assert res["contaminated"] is False
+    assert res["marked"] is False
+    assert srv._load_stable_contamination_marker("prgs") is None
+
+
+def test_record_tool_fetch_only_does_not_mark():
+    _clear_marker()
+    res = srv.gitea_record_stable_branch_push_attempt(
+        command="git fetch prgs", remote="prgs"
+    )
+    assert res["contaminated"] is False
+    assert res["marked"] is False
+
+
+def test_record_tool_mark_false_is_readonly():
+    _clear_marker()
+    res = srv.gitea_record_stable_branch_push_attempt(
+        command="git push prgs master", remote="prgs", mark=False
+    )
+    assert res["contaminated"] is True
+    assert res["marked"] is False
+    assert srv._load_stable_contamination_marker("prgs") is None
+
+
+def test_record_tool_redacts_secret_in_marker():
+    _clear_marker()
+    res = srv.gitea_record_stable_branch_push_attempt(
+        command="git push https://u:supersecret@host/o/r.git master",
+        remote="prgs",
+    )
+    assert res["marked"] is True
+    assert "supersecret" not in res["marker"]["command_summary"]
+
+
+def test_record_tool_root_checkout_local_commit_marks():
+    _clear_marker()
+    res = srv.gitea_record_stable_branch_push_attempt(
+        command=None,
+        remote="prgs",
+        current_branch="master",
+        head_sha="a" * 40,
+        remote_master_sha="b" * 40,
+        is_under_branches=False,
+    )
+    assert res["contaminated"] is True
+    assert res["marked"] is True
+    assert res["marker"]["reason_class"] == "root_checkout_commit"
+
+
+# ── audit tool: inspect + reconciler-only clear ──────────────────────────────
+
+def test_audit_inspect_reports_marker():
+    _clear_marker()
+    srv.gitea_record_stable_branch_push_attempt(
+        command="git push prgs master", remote="prgs"
+    )
+    out = srv.gitea_audit_stable_branch_contamination(action="inspect", remote="prgs")
+    assert out["contaminated"] is True
+    assert out["read_only"] is True
+
+
+def test_audit_clear_refused_for_non_reconciler():
+    _clear_marker()
+    srv.gitea_record_stable_branch_push_attempt(
+        command="git push prgs master", remote="prgs"
+    )
+    with patch.object(srv, "_actual_profile_role", return_value="author"):
+        out = srv.gitea_audit_stable_branch_contamination(action="clear", remote="prgs")
+    assert out["success"] is False
+    assert out["reasons"]
+    # marker survives a refused clear
+    assert srv._load_stable_contamination_marker("prgs") is not None
+
+
+def test_audit_clear_allowed_for_reconciler():
+    _clear_marker()
+    srv.gitea_record_stable_branch_push_attempt(
+        command="git push prgs master", remote="prgs"
+    )
+    identity = srv._stable_contamination_profile_identity()
+    with patch.object(srv, "_actual_profile_role", return_value="reconciler"):
+        out = srv.gitea_audit_stable_branch_contamination(
+            action="clear", remote="prgs", profile_identity=identity
+        )
+    assert out["success"] is True
+    assert srv._load_stable_contamination_marker("prgs") is None
+
+
+# ── pre-flight enforcement gate ──────────────────────────────────────────────
+
+def _force_gate_env():
+    return patch.dict(os.environ, {"GITEA_TEST_FORCE_STABLE_CONTAMINATION": "1"})
+
+
+def test_gate_blocks_gated_mutation_when_contaminated():
+    _clear_marker()
+    srv.gitea_record_stable_branch_push_attempt(
+        command="git push prgs master", remote="prgs"
+    )
+    with _force_gate_env(), patch.object(srv, "_actual_profile_role", return_value="author"):
+        for task in ("merge_pr", "review_pr", "close_issue", "create_pr"):
+            try:
+                srv._enforce_stable_branch_contamination_gate(task, "prgs")
+                raised = False
+            except RuntimeError as exc:
+                raised = True
+                assert "#671" in str(exc)
+            assert raised, task
+
+
+def test_gate_allows_comment_for_handoff_when_contaminated():
+    _clear_marker()
+    srv.gitea_record_stable_branch_push_attempt(
+        command="git push prgs master", remote="prgs"
+    )
+    with _force_gate_env(), patch.object(srv, "_actual_profile_role", return_value="author"):
+        # must not raise — worker can still post the durable audit comment
+        srv._enforce_stable_branch_contamination_gate("comment_issue", "prgs")
+        srv._enforce_stable_branch_contamination_gate("lock_issue", "prgs")
+
+
+def test_gate_exempts_reconciler_when_contaminated():
+    _clear_marker()
+    srv.gitea_record_stable_branch_push_attempt(
+        command="git push prgs master", remote="prgs"
+    )
+    with _force_gate_env(), patch.object(srv, "_actual_profile_role", return_value="reconciler"):
+        srv._enforce_stable_branch_contamination_gate("merge_pr", "prgs")
+
+
+def test_gate_noop_when_not_contaminated():
+    _clear_marker()
+    with _force_gate_env(), patch.object(srv, "_actual_profile_role", return_value="author"):
+        srv._enforce_stable_branch_contamination_gate("merge_pr", "prgs")

tests/test_stable_branch_push_guard.py

@@ -0,0 +1,341 @@
+"""Tests for the direct stable-branch push guard (#671).
+
+Covers the acceptance criteria:
+1. detect shell ``git push <remote> master`` equivalents
+2. detect root/control-checkout local commits not on an issue branch
+3. contamination record shape
+4. fail-closed gate on review/merge/close/completion (reconciler-exempt)
+5. AC5 case matrix: no-op dry-run push, real direct push, sanctioned Gitea
+   merge, fetch-only, root-checkout local commit; plus feature-branch push
+   still allowed and sanctioned merge still allowed
+6. redaction of credentials in logged command summaries
+"""
+
+import stable_branch_push_guard as guard
+
+
+# ── AC1: detect direct stable-branch push equivalents ────────────────────────
+
+def test_plain_git_push_remote_master_is_contamination():
+    res = guard.classify_push_command("git push prgs master")
+    assert res["is_git_push"] is True
+    assert res["targets_stable"] is True
+    assert res["stable_refs"] == ["master"]
+    assert res["contamination"] is True
+    assert res["reasons"]
+
+
+def test_push_main_and_dev_detected():
+    for ref in ("main", "dev", "develop", "development"):
+        res = guard.classify_push_command(f"git push origin {ref}")
+        assert res["contamination"] is True, ref
+        assert res["stable_refs"] == [ref]
+
+
+def test_head_colon_master_refspec_detected():
+    res = guard.classify_push_command("git push prgs HEAD:master")
+    assert res["targets_stable"] is True
+    assert res["stable_refs"] == ["master"]
+    assert res["contamination"] is True
+
+
+def test_full_refspec_force_plus_detected():
+    res = guard.classify_push_command(
+        "git push prgs +refs/heads/tmp:refs/heads/master"
+    )
+    assert res["contamination"] is True
+    assert res["is_force"] is True
+    assert res["stable_refs"] == ["master"]
+
+
+def test_force_flag_to_master_detected():
+    res = guard.classify_push_command("git push --force prgs master")
+    assert res["contamination"] is True
+    assert res["is_force"] is True
+
+
+def test_delete_refspec_master_detected():
+    res = guard.classify_push_command("git push prgs :master")
+    assert res["contamination"] is True
+    assert res["is_delete"] is True
+
+
+def test_delete_flag_master_detected():
+    res = guard.classify_push_command("git push --delete prgs master")
+    assert res["contamination"] is True
+    assert res["is_delete"] is True
+
+
+def test_push_detected_inside_compound_command():
+    res = guard.classify_push_command("cd repo && git push prgs master && echo ok")
+    assert res["contamination"] is True
+    assert res["stable_refs"] == ["master"]
+
+
+# ── AC5: no-op / dry-run push still proves intent ────────────────────────────
+
+def test_dry_run_push_to_master_proves_intent():
+    res = guard.classify_push_command("git push --dry-run prgs master")
+    assert res["is_dry_run"] is True
+    assert res["contamination"] is True
+    assert res["proves_intent"] is True
+    assert "intent" in " ".join(res["reasons"]).lower()
+
+
+def test_short_dry_run_flag_n_detected():
+    res = guard.classify_push_command("git push -n prgs master")
+    assert res["is_dry_run"] is True
+    assert res["contamination"] is True
+
+
+# ── AC5 negative: feature-branch push still allowed ──────────────────────────
+
+def test_feature_branch_push_not_flagged():
+    res = guard.classify_push_command(
+        "git push prgs fix/issue-671-block-stable-branch-push"
+    )
+    assert res["is_git_push"] is True
+    assert res["targets_stable"] is False
+    assert res["contamination"] is False
+    assert res["reasons"] == []
+
+
+def test_feature_branch_head_refspec_not_flagged():
+    res = guard.classify_push_command(
+        "git push prgs HEAD:fix/issue-671-block-stable-branch-push"
+    )
+    assert res["contamination"] is False
+    assert res["targets_stable"] is False
+
+
+def test_branch_named_like_master_substring_not_flagged():
+    # 'master-notes' is not the stable 'master'.
+    res = guard.classify_push_command("git push prgs master-notes")
+    assert res["contamination"] is False
+    assert res["targets_stable"] is False
+
+
+# ── AC5 negative: fetch-only operations ──────────────────────────────────────
+
+def test_git_fetch_not_a_push():
+    res = guard.classify_push_command("git fetch prgs")
+    assert res["is_git_push"] is False
+    assert res["is_fetch_or_pull"] is True
+    assert res["contamination"] is False
+
+
+def test_git_pull_ff_only_master_not_a_push():
+    res = guard.classify_push_command("git pull --ff-only prgs master")
+    assert res["is_git_push"] is False
+    assert res["is_fetch_or_pull"] is True
+    assert res["contamination"] is False
+
+
+# ── AC5 negative: sanctioned Gitea merge is not a push ───────────────────────
+
+def test_gitea_merge_pr_tool_is_not_a_push():
+    res = guard.classify_push_command("gitea_merge_pr(pr_number=671, remote='prgs')")
+    assert res["is_git_push"] is False
+    assert res["contamination"] is False
+
+
+def test_gitea_api_merge_is_not_a_push():
+    res = guard.classify_push_command(
+        "curl -X POST https://gitea.example/api/v1/repos/o/r/pulls/671/merge"
+    )
+    assert res["is_git_push"] is False
+    assert res["contamination"] is False
+
+
+# ── ambiguous bare push: reported, not auto-contaminating ────────────────────
+
+def test_bare_push_is_ambiguous_not_contaminating():
+    res = guard.classify_push_command("git push prgs")
+    assert res["is_git_push"] is True
+    assert res["ambiguous_target"] is True
+    assert res["contamination"] is False
+    assert res["reasons"]  # surfaced as a warning
+
+
+# ── AC2: root/control-checkout local commit detection ────────────────────────
+
+def test_root_checkout_commit_ahead_of_master_flagged():
+    res = guard.assess_root_checkout_local_commit(
+        current_branch="master",
+        head_sha="a" * 40,
+        remote_master_sha="b" * 40,
+        is_under_branches=False,
+    )
+    assert res["contamination"] is True
+    assert res["reasons"]
+
+
+def test_root_checkout_clean_at_master_not_flagged():
+    sha = "c" * 40
+    res = guard.assess_root_checkout_local_commit(
+        current_branch="master",
+        head_sha=sha,
+        remote_master_sha=sha,
+        is_under_branches=False,
+    )
+    assert res["contamination"] is False
+    assert res["unknown"] is False
+
+
+def test_branches_worktree_commit_is_exempt():
+    res = guard.assess_root_checkout_local_commit(
+        current_branch="fix/issue-671-block-stable-branch-push",
+        head_sha="a" * 40,
+        remote_master_sha="b" * 40,
+        is_under_branches=True,
+    )
+    assert res["contamination"] is False
+
+
+def test_root_checkout_ahead_count_flagged():
+    res = guard.assess_root_checkout_local_commit(
+        current_branch="master",
+        head_sha="",
+        remote_master_sha="",
+        is_under_branches=False,
+        ahead_count=2,
+    )
+    assert res["contamination"] is True
+
+
+def test_root_checkout_unknown_when_state_missing():
+    res = guard.assess_root_checkout_local_commit(
+        current_branch="master",
+        head_sha="",
+        remote_master_sha="",
+        is_under_branches=False,
+    )
+    assert res["contamination"] is False
+    assert res["unknown"] is True
+
+
+def test_root_checkout_non_stable_branch_out_of_scope():
+    res = guard.assess_root_checkout_local_commit(
+        current_branch="feature/x",
+        head_sha="a" * 40,
+        remote_master_sha="b" * 40,
+        is_under_branches=False,
+    )
+    assert res["contamination"] is False
+
+
+# ── AC3: contamination record shape ──────────────────────────────────────────
+
+def test_build_contamination_record_shape_and_redaction():
+    rec = guard.build_contamination_record(
+        reason_class="stable_branch_push",
+        command_redacted="git push https://user:[email protected]/o/r.git master",
+        session_id="prgs-author-123",
+        remote="prgs",
+        ref="master",
+        role="author",
+    )
+    assert rec["kind"] == guard.CONTAMINATION_KIND
+    assert rec["reason_class"] == "stable_branch_push"
+    assert rec["remote"] == "prgs"
+    assert rec["ref"] == "master"
+    assert rec["cleared_by_reconciler"] is False
+    # secret must never survive into the durable record
+    assert "tok@" not in rec["command_summary"]
+    assert "***@" in rec["command_summary"]
+
+
+# ── AC4: fail-closed gate on gated mutations ─────────────────────────────────
+
+def _marker():
+    return guard.build_contamination_record(
+        reason_class="stable_branch_push",
+        command_redacted="git push prgs master",
+        remote="prgs",
+        ref="master",
+        role="author",
+    )
+
+
+def test_gate_blocks_gated_mutations_for_author():
+    marker = _marker()
+    for task in ("create_pr", "merge_pr", "close_issue", "review_pr",
+                 "submit_pr_review", "commit_files", "close_pr"):
+        gate = guard.assess_contamination_gate(marker, task=task, actual_role="author")
+        assert gate["block"] is True, task
+        assert gate["reasons"]
+
+
+def test_gate_allows_comment_and_lock_for_handoff():
+    marker = _marker()
+    for task in ("comment_issue", "lock_issue", "create_issue", "mark_issue"):
+        gate = guard.assess_contamination_gate(marker, task=task, actual_role="author")
+        assert gate["block"] is False, task
+
+
+def test_gate_exempts_reconciler_audit_path():
+    marker = _marker()
+    gate = guard.assess_contamination_gate(marker, task="close_pr", actual_role="reconciler")
+    assert gate["block"] is False
+
+
+def test_gate_no_marker_allows_everything():
+    gate = guard.assess_contamination_gate(None, task="merge_pr", actual_role="merger")
+    assert gate["block"] is False
+
+
+def test_gate_cleared_marker_allows_everything():
+    marker = _marker()
+    marker["cleared_by_reconciler"] = True
+    gate = guard.assess_contamination_gate(marker, task="merge_pr", actual_role="merger")
+    assert gate["block"] is False
+
+
+def test_same_worker_cannot_self_clear_by_role():
+    # A merger/reviewer/author role is still gated — only reconciler is exempt.
+    marker = _marker()
+    for role in ("author", "reviewer", "merger"):
+        gate = guard.assess_contamination_gate(marker, task="merge_pr", actual_role=role)
+        assert gate["block"] is True, role
+
+
+def test_format_gate_error_mentions_issue():
+    marker = _marker()
+    gate = guard.assess_contamination_gate(marker, task="merge_pr", actual_role="merger")
+    msg = guard.format_contamination_gate_error(gate)
+    assert "#671" in msg
+    assert "contaminat" in msg.lower()
+
+
+# ── redaction unit coverage ──────────────────────────────────────────────────
+
+def test_redact_url_userinfo():
+    out = guard.redact_command("git push https://bob:secretpat@host/o/r.git master")
+    assert "secretpat" not in out
+    assert "***@" in out
+    assert "master" in out  # structure preserved for audit
+
+
+def test_redact_token_assignment():
+    out = guard.redact_command("GITEA_TOKEN=abcdef123456 git push prgs master")
+    assert "abcdef123456" not in out
+    assert "GITEA_TOKEN=***" in out
+
+
+def test_redact_empty():
+    assert guard.redact_command(None) == ""
+    assert guard.redact_command("") == ""
+
+
+# ── detect_stable_push over iterables ────────────────────────────────────────
+
+def test_detect_stable_push_iterable_finds_first_contamination():
+    cmds = ["git status", "git push prgs master", "echo done"]
+    res = guard.detect_stable_push(cmds)
+    assert res["contamination"] is True
+
+
+def test_detect_stable_push_iterable_all_safe():
+    cmds = ["git status", "git push prgs feature/x", "git fetch prgs"]
+    res = guard.detect_stable_push(cmds)
+    assert res["contamination"] is False

tests/test_workspace_guard_alignment.py

@@ -100,7 +100,23 @@ class TestRuntimeContextGuardAlignment(unittest.TestCase):
         srv._preflight_in_test_mode = self._orig_in_test
         self._env_patch.stop()
 
-    def test_runtime_context_and_guard_share_resolved_workspace(self):
+    @mock.patch("subprocess.run")
+    @mock.patch("os.path.isdir", return_value=True)
+    @mock.patch("os.path.exists", return_value=True)
+    def test_runtime_context_and_guard_share_resolved_workspace(
+        self, _exists, _isdir, mock_run
+    ):
+        def run_side_effect(cmd, *args, **kwargs):
+            res = MagicMock(returncode=0)
+            if "--git-common-dir" in cmd:
+                res.stdout = f"{CONTROL_ROOT}/.git\n"
+            elif "--show-toplevel" in cmd:
+                cwd = cmd[cmd.index("-C") + 1] if "-C" in cmd else ""
+                res.stdout = f"{cwd}\n"
+            else:
+                res.stdout = f"{CONTROL_ROOT}\n"
+            return res
+        mock_run.side_effect = run_side_effect
         with mock.patch.object(srv, "PROJECT_ROOT", MCP_PROCESS_ROOT):
             ctx = srv._resolve_author_mutation_context(BRANCHES_WORKTREE)
             status = srv.assess_preflight_status(worktree_path=BRANCHES_WORKTREE)

webui/worktree_scanner.py

@@ -14,11 +14,7 @@ from merged_cleanup_reconcile import (
     read_issue_lock,
     read_local_worktree_state,
 )
-
-_REVIEW_WORKTREE_RE = re.compile(
-    r"branches/(?:review-pr\d+|merge-simulation-pr\d+|review-[\w-]+)",
-    re.IGNORECASE,
-)
+from reviewer_worktree import REVIEW_WORKTREE_RE
 
 CLASSIFICATIONS = frozenset({
     "active-pr",
@@ -147,7 +143,7 @@ def classify_entry(
     if not record:
         return "orphan", "Directory exists but is not a registered git worktree"
 
-    if record.get("detached") and _REVIEW_WORKTREE_RE.search(rel_path):
+    if record.get("detached") and REVIEW_WORKTREE_RE.search(rel_path):
         return "detached-review", "Detached HEAD in reviewer/simulation worktree"
 
     if state.get("exists") and state.get("clean"):

workflow_scope_guard.py

@@ -0,0 +1,626 @@
+"""Workflow scope ownership and production-guard hardening (#683).
+
+Implements fail-closed enforcement so sessions cannot:
+
+* mutate source/tests on the root/control checkout (including temporary
+  diagnostic edits) without binding an issue-backed ``branches/`` worktree;
+* continue out-of-scope source work while locked to a different issue;
+* disable, skip, or conceal production root/branches/porcelain guards solely
+  because pytest/unittest is loaded.
+
+This module is pure assessment + small durable ledger helpers. Callers gather
+live facts (lock, branch, porcelain, worktree path) and pass them in. Existing
+root_checkout_guard / author_mutation_worktree assessors remain authoritative;
+this module composes typed blockers with exact recovery actions.
+
+Do **not** reintroduce the rejected #681 / ``300a4ca`` patterns:
+
+* early-return from workspace verification under ``_preflight_in_test_mode()``
+* porcelain filtering that strips ``*.py`` lines under pytest
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import threading
+from typing import Any
+
+import author_mutation_worktree
+from reviewer_worktree import parse_dirty_tracked_files
+
+# ── force-on / test isolation ────────────────────────────────────────────────
+
+# When set, production root/branches/scope guards MUST run even under pytest.
+# Unit tests that only need preflight-order isolation leave this unset and
+# use GITEA_TEST_PORCELAIN / fixtures; real-entrypoint proof sets this to "1".
+FORCE_PRODUCTION_GUARDS_ENV = "GITEA_TEST_FORCE_PRODUCTION_GUARDS"
+
+# Existing force signals also mean "exercise production dirtiness paths".
+_FORCE_DIRTY_ENV = "GITEA_TEST_FORCE_DIRTY"
+_FORCE_PORCELAIN_ENV = "GITEA_TEST_PORCELAIN"
+
+# ── typed blocker kinds ──────────────────────────────────────────────────────
+
+BLOCKER_ROOT_DIAGNOSTIC_EDIT = "root_diagnostic_edit"
+BLOCKER_MISSING_ISSUE_SCOPE = "missing_issue_scope"
+BLOCKER_OUT_OF_SCOPE_ISSUE = "out_of_scope_issue"
+BLOCKER_MISSING_WORKTREE = "missing_issue_worktree"
+BLOCKER_UNRECORDED_FAILURE = "unrecorded_workflow_failure"
+BLOCKER_PRODUCTION_GUARD = "production_guard_violation"
+
+BLOCKER_KINDS = frozenset(
+    {
+        BLOCKER_ROOT_DIAGNOSTIC_EDIT,
+        BLOCKER_MISSING_ISSUE_SCOPE,
+        BLOCKER_OUT_OF_SCOPE_ISSUE,
+        BLOCKER_MISSING_WORKTREE,
+        BLOCKER_UNRECORDED_FAILURE,
+        BLOCKER_PRODUCTION_GUARD,
+    }
+)
+
+_NEXT_ACTIONS: dict[str, str] = {
+    BLOCKER_ROOT_DIAGNOSTIC_EDIT: (
+        "Stop editing the control/root checkout. Preserve or discard root WIP "
+        "durably, restore root to clean master, lock or create the owning issue, "
+        "bind branches/issue-<N>-*, set GITEA_AUTHOR_WORKTREE to that worktree, "
+        "then re-run the mutation."
+    ),
+    BLOCKER_MISSING_ISSUE_SCOPE: (
+        "Select or create the owning Gitea issue, claim/lock it "
+        "(gitea_mark_issue + gitea_lock_issue), bind branches/issue-<N>-* "
+        "from clean master, then re-run the mutation from that worktree."
+    ),
+    BLOCKER_OUT_OF_SCOPE_ISSUE: (
+        "Stop. The active issue lock does not own this work. Release or finish "
+        "the current issue lease, then select/create and lock the correct "
+        "owning issue, bind its branches/issue-<N>-* worktree, and re-run."
+    ),
+    BLOCKER_MISSING_WORKTREE: (
+        "Bind an issue-backed worktree under branches/ (scripts/worktree-start "
+        "or git worktree add branches/issue-<N>-*), set GITEA_AUTHOR_WORKTREE / "
+        "worktree_path to that path, keep the control checkout clean on master, "
+        "then re-run the mutation."
+    ),
+    BLOCKER_UNRECORDED_FAILURE: (
+        "Record the workflow/tool failure durably first (issue comment or "
+        "workflow_scope_guard.record_workflow_failure), then continue only "
+        "inside the owning issue-backed worktree."
+    ),
+    BLOCKER_PRODUCTION_GUARD: (
+        "Resolve the production guard violation: clean or isolate the control "
+        "checkout, bind the owning issue worktree under branches/, and re-run "
+        "with production guards active."
+    ),
+}
+
+_ISSUE_IN_BRANCH_RE = re.compile(r"issue-(\d+)", re.IGNORECASE)
+
+# In-process durable failure ledger (also written via optional sink callback).
+_ledger_lock = threading.Lock()
+_failure_ledger: list[dict[str, Any]] = []
+
+
+class ProductionGuardError(RuntimeError):
+    """Fail-closed production guard with typed blocker metadata (#683)."""
+
+    def __init__(
+        self,
+        message: str,
+        *,
+        blocker_kind: str,
+        exact_next_action: str | None = None,
+        reasons: list[str] | None = None,
+        details: dict[str, Any] | None = None,
+    ) -> None:
+        super().__init__(message)
+        kind = (blocker_kind or "").strip()
+        if kind not in BLOCKER_KINDS:
+            kind = BLOCKER_PRODUCTION_GUARD
+        self.blocker_kind = kind
+        self.exact_next_action = (
+            (exact_next_action or "").strip() or _NEXT_ACTIONS[kind]
+        )
+        self.reasons = list(reasons or [message])
+        self.details = dict(details or {})
+
+
+def production_guards_forced() -> bool:
+    """True when the explicit #683 force-on flag requests production guards."""
+    return (os.environ.get(FORCE_PRODUCTION_GUARDS_ENV) or "").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+        "on",
+    }
+
+
+def purity_order_forced() -> bool:
+    """True when tests force preflight-order dirtiness paths (legacy flags)."""
+    if os.environ.get(_FORCE_DIRTY_ENV):
+        return True
+    # GITEA_TEST_PORCELAIN present (even empty) means dirtiness paths are live.
+    if os.environ.get(_FORCE_PORCELAIN_ENV) is not None:
+        return True
+    return False
+
+
+def production_guards_active(*, in_test_mode: bool) -> bool:
+    """Whether production root/branches/scope guards must execute.
+
+    Production (non-test) always active. Under pytest, active when either the
+    explicit #683 force-on flag or legacy dirty/porcelain force signals are
+    set — never skip production enforcement solely because tests are running
+    when force-on is requested.
+    """
+    if production_guards_forced() or purity_order_forced():
+        return True
+    return not bool(in_test_mode)
+
+
+def extract_issue_number_from_branch(branch_name: str | None) -> int | None:
+    """Return the first issue-N number embedded in a branch name, if any."""
+    text = (branch_name or "").strip()
+    if not text:
+        return None
+    match = _ISSUE_IN_BRANCH_RE.search(text)
+    if not match:
+        return None
+    try:
+        return int(match.group(1))
+    except ValueError:
+        return None
+
+
+def is_source_or_test_path(path: str) -> bool:
+    """True for tracked source/test paths that must not land as root WIP."""
+    p = (path or "").replace("\\", "/").lstrip("./")
+    if not p:
+        return False
+    if p.startswith("tests/") or "/tests/" in f"/{p}":
+        return True
+    if p.endswith((".py", ".pyi", ".toml", ".cfg", ".ini", ".sh")):
+        return True
+    if p in {"requirements.txt", "pyproject.toml", "setup.py", "setup.cfg"}:
+        return True
+    return False
+
+
+def dirty_source_files(porcelain_status: str) -> list[str]:
+    """Tracked dirty paths that count as source/test contamination."""
+    dirty = parse_dirty_tracked_files(porcelain_status or "")
+    return [p for p in dirty if is_source_or_test_path(p)]
+
+
+def assess_issue_scope_ownership(
+    *,
+    locked_issue_number: int | None,
+    target_issue_number: int | None = None,
+    branch_name: str | None = None,
+    role_kind: str | None = None,
+    require_lock_for_author: bool = False,
+) -> dict[str, Any]:
+    """Fail closed when the session issue lock does not own the attempted work.
+
+    * Author sessions that require a lock fail when none is held.
+    * When a lock exists, the target issue (tool argument) and/or the issue
+      number embedded in the branch must match the locked issue.
+    * Reviewer/merger/reconciler roles are not issue-scope owners of author
+      implementation work and skip the author lock requirement.
+    """
+    role = (role_kind or "").strip().lower()
+    locked = locked_issue_number
+    if isinstance(locked, str) and locked.isdigit():
+        locked = int(locked)
+    if locked is not None:
+        try:
+            locked = int(locked)
+        except (TypeError, ValueError):
+            locked = None
+
+    target = target_issue_number
+    if target is not None:
+        try:
+            target = int(target)
+        except (TypeError, ValueError):
+            target = None
+
+    branch_issue = extract_issue_number_from_branch(branch_name)
+    reasons: list[str] = []
+    blocker_kind: str | None = None
+
+    # Non-author roles do not take author issue locks for implementation.
+    if role in {"reviewer", "merger", "reconciler"}:
+        return _scope_ok(locked, target, branch_issue)
+
+    if require_lock_for_author and locked is None:
+        reasons.append(
+            "no owning issue lock is bound for this author session; "
+            "source/test mutation requires selecting or creating an owning issue first"
+        )
+        blocker_kind = BLOCKER_MISSING_ISSUE_SCOPE
+
+    if locked is not None and target is not None and locked != target:
+        reasons.append(
+            f"session is locked to issue #{locked} but mutation targets issue "
+            f"#{target}; out-of-scope until the owning issue is selected"
+        )
+        blocker_kind = BLOCKER_OUT_OF_SCOPE_ISSUE
+
+    if locked is not None and branch_issue is not None and locked != branch_issue:
+        reasons.append(
+            f"session is locked to issue #{locked} but workspace branch is for "
+            f"issue #{branch_issue}; bind the matching issue-backed worktree"
+        )
+        blocker_kind = BLOCKER_OUT_OF_SCOPE_ISSUE
+
+    if reasons:
+        kind = blocker_kind or BLOCKER_MISSING_ISSUE_SCOPE
+        return {
+            "proven": False,
+            "block": True,
+            "blocker_kind": kind,
+            "exact_next_action": _NEXT_ACTIONS[kind],
+            "reasons": reasons,
+            "locked_issue_number": locked,
+            "target_issue_number": target,
+            "branch_issue_number": branch_issue,
+        }
+    return _scope_ok(locked, target, branch_issue)
+
+
+def assess_root_source_mutation(
+    *,
+    workspace_path: str,
+    canonical_repo_root: str,
+    porcelain_status: str,
+    current_branch: str | None = None,
+    locked_issue_number: int | None = None,
+    role_kind: str | None = None,
+) -> dict[str, Any]:
+    """Fail closed for diagnostic/source edits on the control/root checkout.
+
+    Allowed only when the active workspace is under ``branches/``. Dirty
+    tracked source/test files on the control checkout always block, including
+    temporary/diagnostic/test-only intent.
+    """
+    role = (role_kind or "").strip().lower()
+    if role == "reconciler":
+        return {
+            "proven": True,
+            "block": False,
+            "blocker_kind": None,
+            "exact_next_action": "proceed",
+            "reasons": [],
+            "dirty_source_files": [],
+        }
+
+    root = os.path.realpath(canonical_repo_root or "")
+    workspace = os.path.realpath(workspace_path or root or ".")
+    under_branches = author_mutation_worktree.is_path_under_branches(workspace, root)
+    dirty_src = dirty_source_files(porcelain_status)
+    reasons: list[str] = []
+    blocker_kind: str | None = None
+
+    if not under_branches and workspace == root and dirty_src:
+        # Root workspace with source dirtiness is unattributed root WIP.
+        # (Clean-root author binding is enforced by branches-only #274.)
+        reasons.append(
+            "control/root checkout has tracked source or test edits "
+            f"(dirty files: {', '.join(dirty_src)}); diagnostic or temporary "
+            "edits on the root checkout are forbidden"
+        )
+        blocker_kind = BLOCKER_ROOT_DIAGNOSTIC_EDIT
+
+    if (
+        not under_branches
+        and workspace == root
+        and not dirty_src
+        and role == "author"
+    ):
+        # Explicit missing-worktree signal for force-on author entrypoints.
+        reasons.append(
+            "author source/test mutation from the stable control checkout is "
+            "forbidden; bind an issue-backed worktree under branches/ first"
+        )
+        blocker_kind = BLOCKER_MISSING_WORKTREE
+
+    if reasons:
+        kind = blocker_kind or BLOCKER_ROOT_DIAGNOSTIC_EDIT
+        return {
+            "proven": False,
+            "block": True,
+            "blocker_kind": kind,
+            "exact_next_action": _NEXT_ACTIONS[kind],
+            "reasons": reasons,
+            "dirty_source_files": dirty_src,
+            "workspace_path": workspace,
+            "canonical_repo_root": root,
+            "under_branches": under_branches,
+            "locked_issue_number": locked_issue_number,
+        }
+    return {
+        "proven": True,
+        "block": False,
+        "blocker_kind": None,
+        "exact_next_action": "proceed",
+        "reasons": [],
+        "dirty_source_files": dirty_src,
+        "workspace_path": workspace,
+        "canonical_repo_root": root,
+        "under_branches": under_branches,
+        "locked_issue_number": locked_issue_number,
+    }
+
+
+def assess_production_mutation_guards(
+    *,
+    workspace_path: str,
+    canonical_repo_root: str,
+    porcelain_status: str,
+    current_branch: str | None = None,
+    locked_issue_number: int | None = None,
+    target_issue_number: int | None = None,
+    role_kind: str | None = None,
+    require_author_lock: bool = False,
+    in_test_mode: bool = False,
+) -> dict[str, Any]:
+    """Compose root + scope production guards when they must be active (#683)."""
+    if not production_guards_active(in_test_mode=in_test_mode):
+        return {
+            "proven": True,
+            "block": False,
+            "blocker_kind": None,
+            "exact_next_action": "proceed",
+            "reasons": [],
+            "skipped": True,
+            "skip_reason": "production guards not active (test isolation without force-on)",
+        }
+
+    root_assess = assess_root_source_mutation(
+        workspace_path=workspace_path,
+        canonical_repo_root=canonical_repo_root,
+        porcelain_status=porcelain_status,
+        current_branch=current_branch,
+        locked_issue_number=locked_issue_number,
+        role_kind=role_kind,
+    )
+    if root_assess["block"]:
+        return {**root_assess, "skipped": False}
+
+    scope_assess = assess_issue_scope_ownership(
+        locked_issue_number=locked_issue_number,
+        target_issue_number=target_issue_number,
+        branch_name=current_branch,
+        role_kind=role_kind,
+        require_lock_for_author=require_author_lock,
+    )
+    if scope_assess["block"]:
+        return {**scope_assess, "skipped": False}
+
+    return {
+        "proven": True,
+        "block": False,
+        "blocker_kind": None,
+        "exact_next_action": "proceed",
+        "reasons": [],
+        "skipped": False,
+        "root": root_assess,
+        "scope": scope_assess,
+    }
+
+
+def raise_if_blocked(assessment: dict[str, Any]) -> None:
+    """Raise :class:`ProductionGuardError` when *assessment* blocks."""
+    if not assessment or not assessment.get("block"):
+        return
+    kind = assessment.get("blocker_kind") or BLOCKER_PRODUCTION_GUARD
+    reasons = list(assessment.get("reasons") or ["production guard violation"])
+    message = (
+        f"Workflow scope guard (#683) [{kind}]: {'; '.join(reasons)}. "
+        f"exact_next_action: {assessment.get('exact_next_action') or _NEXT_ACTIONS.get(kind, '')}"
+    )
+    raise ProductionGuardError(
+        message,
+        blocker_kind=kind,
+        exact_next_action=assessment.get("exact_next_action"),
+        reasons=reasons,
+        details={
+            k: v
+            for k, v in assessment.items()
+            if k
+            not in {
+                "proven",
+                "block",
+                "blocker_kind",
+                "exact_next_action",
+                "reasons",
+            }
+        },
+    )
+
+
+def block_response(
+    assessment: dict[str, Any] | ProductionGuardError | None = None,
+    *,
+    blocker_kind: str | None = None,
+    reasons: list[str] | None = None,
+    exact_next_action: str | None = None,
+    **extra: Any,
+) -> dict[str, Any]:
+    """Structured fail-closed tool response with typed blocker fields."""
+    if isinstance(assessment, ProductionGuardError):
+        kind = assessment.blocker_kind
+        reason_list = list(assessment.reasons)
+        next_action = assessment.exact_next_action
+        extra = {**assessment.details, **extra}
+    elif isinstance(assessment, dict) and assessment.get("block"):
+        kind = assessment.get("blocker_kind") or BLOCKER_PRODUCTION_GUARD
+        reason_list = list(assessment.get("reasons") or [])
+        next_action = assessment.get("exact_next_action") or _NEXT_ACTIONS.get(
+            kind, _NEXT_ACTIONS[BLOCKER_PRODUCTION_GUARD]
+        )
+    else:
+        kind = (blocker_kind or BLOCKER_PRODUCTION_GUARD).strip()
+        if kind not in BLOCKER_KINDS:
+            kind = BLOCKER_PRODUCTION_GUARD
+        reason_list = list(reasons or ["production guard violation"])
+        next_action = exact_next_action or _NEXT_ACTIONS[kind]
+
+    if kind not in BLOCKER_KINDS:
+        kind = BLOCKER_PRODUCTION_GUARD
+    if not reason_list:
+        reason_list = ["production guard violation"]
+    next_action = (next_action or "").strip() or _NEXT_ACTIONS[kind]
+
+    out: dict[str, Any] = {
+        "success": False,
+        "performed": False,
+        "blocker_kind": kind,
+        "exact_next_action": next_action,
+        "reasons": reason_list,
+    }
+    for key, value in extra.items():
+        if key not in out and value is not None:
+            out[key] = value
+    return out
+
+
+def format_production_guard_error(assessment: dict[str, Any]) -> str:
+    """Single RuntimeError string carrying kind + exact next action."""
+    kind = assessment.get("blocker_kind") or BLOCKER_PRODUCTION_GUARD
+    reasons = "; ".join(assessment.get("reasons") or ["production guard violation"])
+    next_action = assessment.get("exact_next_action") or _NEXT_ACTIONS.get(
+        kind, _NEXT_ACTIONS[BLOCKER_PRODUCTION_GUARD]
+    )
+    return (
+        f"Workflow scope guard (#683) [{kind}]: {reasons}. "
+        f"exact_next_action: {next_action}"
+    )
+
+
+# ── durable failure recording ────────────────────────────────────────────────
+
+
+def record_workflow_failure(
+    *,
+    kind: str,
+    detail: str,
+    issue_number: int | None = None,
+    task: str | None = None,
+    sink: Any | None = None,
+) -> dict[str, Any]:
+    """Record a workflow/tool failure before source edits continue (#683 AC8).
+
+    *sink* may be a callable ``sink(record)`` (e.g. tests) or omitted for the
+    in-process ledger only. Returns the durable record.
+    """
+    record = {
+        "kind": (kind or "workflow_failure").strip() or "workflow_failure",
+        "detail": (detail or "").strip(),
+        "issue_number": issue_number,
+        "task": task,
+        "pid": os.getpid(),
+    }
+    with _ledger_lock:
+        _failure_ledger.append(dict(record))
+    if callable(sink):
+        sink(record)
+    return record
+
+
+def clear_workflow_failure_ledger() -> None:
+    """Test helper: reset the in-process failure ledger."""
+    with _ledger_lock:
+        _failure_ledger.clear()
+
+
+def workflow_failure_ledger() -> list[dict[str, Any]]:
+    """Copy of durable in-process failure records."""
+    with _ledger_lock:
+        return [dict(r) for r in _failure_ledger]
+
+
+def assess_durable_failure_recorded(
+    *,
+    require_record: bool,
+    pending_source_mutation: bool,
+) -> dict[str, Any]:
+    """Block source mutation when a workflow failure was not recorded first."""
+    if not require_record or not pending_source_mutation:
+        return {
+            "proven": True,
+            "block": False,
+            "blocker_kind": None,
+            "exact_next_action": "proceed",
+            "reasons": [],
+        }
+    with _ledger_lock:
+        has_record = bool(_failure_ledger)
+    if has_record:
+        return {
+            "proven": True,
+            "block": False,
+            "blocker_kind": None,
+            "exact_next_action": "proceed",
+            "reasons": [],
+        }
+    return {
+        "proven": False,
+        "block": True,
+        "blocker_kind": BLOCKER_UNRECORDED_FAILURE,
+        "exact_next_action": _NEXT_ACTIONS[BLOCKER_UNRECORDED_FAILURE],
+        "reasons": [
+            "workflow/tool failure triggered a need for source changes but no "
+            "durable failure record exists yet"
+        ],
+    }
+
+
+def porcelain_preserves_python_paths(porcelain_status: str) -> bool:
+    """Regression helper: dirty ``*.py`` lines must remain visible (#683)."""
+    text = porcelain_status or ""
+    for line in text.splitlines():
+        stripped = line.strip()
+        if stripped.endswith(".py") or ".py " in stripped or stripped.endswith(".py"):
+            # Any py path present proves no silent strip of all *.py lines.
+            if " M " in f" {stripped}" or stripped[:1] in "MADRCTU" or len(line) >= 4:
+                return True
+    # Empty porcelain is fine; integrity means we did not strip when present.
+    return ".py" not in text
+
+
+def assert_no_pytest_porcelain_filter(source_text: str) -> list[str]:
+    """Static check: production reader must not strip ``*.py`` under pytest."""
+    findings: list[str] = []
+    lowered = source_text or ""
+    if "endswith(\".py\")" in lowered or "endswith('.py')" in lowered:
+        if "pytest" in lowered and "porcelain" in lowered.lower():
+            findings.append(
+                "production porcelain reader must not filter *.py under pytest "
+                "(rejected 300a4ca pattern)"
+            )
+    if "if \"pytest\" in sys.modules" in lowered and "porcelain" in lowered.lower():
+        if ".py" in lowered and ("join" in lowered or "endswith" in lowered):
+            findings.append(
+                "test-mode porcelain filtering of source files is forbidden (#683)"
+            )
+    return findings
+
+
+def _scope_ok(
+    locked: int | None,
+    target: int | None,
+    branch_issue: int | None,
+) -> dict[str, Any]:
+    return {
+        "proven": True,
+        "block": False,
+        "blocker_kind": None,
+        "exact_next_action": "proceed",
+        "reasons": [],
+        "locked_issue_number": locked,
+        "target_issue_number": target,
+        "branch_issue_number": branch_issue,
+    }

worktree_cleanup_audit.py

@@ -35,7 +35,7 @@ from datetime import datetime, timezone
 from typing import Any
 
 from merged_cleanup_reconcile import branch_worktree_folder, read_local_worktree_state
-from reviewer_worktree import parse_dirty_tracked_files
+from reviewer_worktree import parse_dirty_tracked_files, REVIEW_WORKTREE_RE
 
 PROTECTED_BRANCHES = frozenset({"master", "main", "dev"})
 DEFAULT_TTL_HOURS = float(os.environ.get("GITEA_WORKTREE_TTL_HOURS", "24") or 24)
@@ -508,10 +508,8 @@ DISPOSITIONS = frozenset({
     "unsafe_unknown",
 })
 
-REVIEW_WORKTREE_RE = re.compile(
-    r"branches/(?:review-pr\d+|merge-simulation-pr\d+|review-[\w-]+)",
-    re.IGNORECASE,
-)
+
+
 
 
 def normalize_path(path: str) -> str: