fix(mcp): invalidate review session state on cross-profile activation (Closes #690)

A mid-run profile switch (reviewer -> author -> reviewer) left workflow-load
proof, reviewer lease binding, the review decision lock, live namespace
health, and preflight identity/capability stamps intact, so a formal verdict
could be recorded under contaminated session state.

- gitea_activate_profile now invalidates all review-critical session state
  on a cross-profile switch, in memory and in durable state keyed by either
  profile identity, and reports the invalidation + re-preflight requirement.
- Full reviewer preflight (whoami, load_review_workflow,
  resolve_task_capability(review_pr), head re-pin, lease re-acquire) is
  required before any formal verdict after a switch; switching back cannot
  resurrect the stale run.
- Namespace provenance: optional launcher-declared GITEA_MCP_NAMESPACE is
  reported by whoami/runtime context/capability resolution, and a declared
  namespace that disagrees with a task's required namespace fails closed.
- Docs: supported pattern is separate session/namespace per role, not
  in-process profile hopping mid-review.

docs/gitea-execution-profiles.md

@@ -589,6 +589,47 @@ When dynamic profile switching is enabled and a profile is activated via `gitea_
 2. Call `gitea_whoami` with the target remote to prove and verify the fresh Gitea authenticated identity.
 This guarantees the active profile operations align with the actual Gitea authenticated user credential.
 
+### 4. Review-State Invalidation on Profile Switch (#690)
+
+A cross-profile activation (e.g. reviewer → author → reviewer) is a session
+boundary for formal review state. On any switch where the activated profile
+differs from the previous one, `gitea_activate_profile` invalidates, in
+memory **and** in durable session state (for both the old and new profile
+identities):
+
+- preflight identity/capability stamps (`gitea_whoami` / `gitea_resolve_task_capability` proof),
+- review workflow-load proof (`gitea_load_review_workflow`),
+- the review decision lock (including `final_review_decision_ready` markers),
+- the reviewer PR session lease binding,
+- live namespace-health assessments.
+
+Before any formal verdict (`gitea_mark_final_review_decision` /
+`gitea_submit_pr_review`) the full reviewer preflight must be re-established
+under the new profile: `gitea_whoami`, `gitea_load_review_workflow`,
+`gitea_resolve_task_capability(review_pr)`, live head re-pin, and lease
+re-acquire/adopt. Switching back to the earlier profile does **not**
+resurrect the prior run — durable state keyed by either profile identity is
+cleared at switch time.
+
+The supported pattern remains **separate session/namespace per role**
+(dual-namespace, §2): file author-side follow-ups from an author session,
+not by hopping profiles inside a formal review run. Runtime profile
+switching is the operator-approved exception and always carries the
+re-preflight cost above.
+
+### 5. Namespace Provenance (#690)
+
+The server cannot derive its own client-managed MCP namespace name, so a
+launcher may declare it via the `GITEA_MCP_NAMESPACE` environment variable
+(e.g. `gitea-reviewer`). `gitea_whoami`, `gitea_get_runtime_context`, and
+`gitea_resolve_task_capability` report `namespace_provenance` — the
+configured client namespace, the active execution profile, and, for tasks
+with a required namespace (`review_pr` → `gitea-reviewer`, `merge_pr` →
+`gitea-merger`), a mismatch verdict. A declared namespace that disagrees
+with the requested task's required namespace **fails closed**. An
+undeclared namespace is reported as `unknown` and is never treated as
+proof either way.
+
 ## Gitea MCP Runtime Isolation and Worktree Safety
 
 To ensure high availability and prevent broken feature worktrees from disabling essential security/identity controls, the Gitea MCP server implements runtime isolation:

docs/mcp-namespace-eof-recovery.md

@@ -47,33 +47,18 @@ Do the steps in order. Stop as soon as a live **client-namespace** call succeeds
    - Only the Gitea namespace fails → single-namespace transport close. Continue.
    - Every server fails → restart the whole MCP client, not just one namespace.
 
-2. **Request the sanctioned reconnect surface (#678), then reconnect through
-   the client — not the shell.** From a still-reachable Gitea MCP namespace
-   (or after host auto-reconnect), call:
-
-   ```text
-   gitea_request_mcp_reconnect(
-       namespace="gitea-author",   # or gitea-reviewer / gitea-merger / …
-       reason="transport_eof",
-       client="codex",            # or claude_code / generic
-   )
-   ```
-
-   The tool is **report-only**: it never restarts a process. It returns
-   namespace, profile, pid/session, startup SHA, current master SHA, boundary
-   status, and a **typed blocker** with exact operator UI steps for Codex
-   (Reload Developer Tools / per-server reconnect) or Claude Code (`/mcp`).
-   Then perform the host reconnect those steps describe so the client spawns a
-   fresh subprocess and re-opens the pipe. That clears the closed-client state
-   that a bare `kill`/respawn from a terminal does **not**.
+2. **Reconnect the namespace through the client, not the shell.** Use the IDE /
+   client MCP-reconnect action for that server entry (in Claude Code:
+   `/mcp` → reconnect the affected `gitea-*` server). Reconnecting forces the
+   client to spawn a fresh subprocess and re-open the pipe. This clears the
+   closed-client state that a bare `kill`/respawn from a terminal does **not**.
 
 3. **Do not "fix" it by importing the server or poking the process.** Reaching
    for `python -c 'import gitea_mcp_server ...'`, raw JSON-RPC from a shell,
    killing PIDs to force a respawn, or touching MCP config mtimes does **not**
    restore the *client's* view of the namespace and violates the daemon-import
    guard (#558, `docs/mcp-daemon-import-guard.md`). The only sanctioned repair
-   is a **client reconnect / relaunch** (or the typed operator path returned by
-   `gitea_request_mcp_reconnect`).
+   is a **client reconnect / relaunch**.
 
 4. **Verify through the same path the workflow will use.** After reconnect, call
    the specific tool the blocked workflow needs — not just any tool — through

docs/mcp-namespace-health.md

@@ -86,3 +86,24 @@ When a namespace returns EOF, follow
 
 When blocked, repair the IDE namespace and re-record a healthy
 `client_namespace` assessment before retrying the mutation.
+
+## Namespace provenance (#690)
+
+A server process cannot derive the name of the client-managed namespace it is
+registered under, so the launcher may declare it with the
+`GITEA_MCP_NAMESPACE` environment variable (e.g. `GITEA_MCP_NAMESPACE=gitea-reviewer`).
+
+- `gitea_whoami`, `gitea_get_runtime_context`, and
+  `gitea_resolve_task_capability` report `namespace_provenance`: the declared
+  client namespace, the active execution profile, and — for tasks with a
+  required namespace (`review_pr`/`submit_review` → `gitea-reviewer`,
+  `merge_pr` → `gitea-merger`) — a `mismatch` verdict.
+- A declared namespace that disagrees with the requested task's required
+  namespace **fails closed** (`allowed_in_current_session=false` with a STOP
+  guidance entry).
+- An undeclared namespace is reported as `namespace_source="unknown"` and is
+  never treated as proof either way.
+- A profile switch via `gitea_activate_profile` clears all recorded live
+  namespace-health assessments; re-probe through the client before further
+  review/merge mutations.
+

docs/mcp-restart-path-inventory.md

@@ -45,11 +45,10 @@ and *fails closed*.
 | `legacy_auto_restart_helper` | removed | A helper (`_trigger_mcp_auto_restart`) that actively restarted the server from the read-only resolver path. | Removed in #685; kept absent by `assert_auto_restart_helper_absent()`. | #685, #657 |
 | `config_touch_reload` | removed | Touching (utime) the MCP client config to make the host reload the server. | Removed from the resolver in #685: stale detection is report-only, never mutating config, spawning threads, or calling `os._exit`. | #685, #657 |
 | `master_advance_auto_restart` | guarded_fail_closed | On-disk master advancing past the running code. | `master_parity_gate` captures startup parity and blocks mutations while stale, emitting restart guidance; the process never self-restarts. | #420, #591, #657 |
-| `stale_runtime_resolver_reconnect` | guarded_fail_closed | The capability resolver detecting a stale serving process. | Report-only (#685): returns `restart_required`/`stop_required` and an exact reconnect action; no restart, thread, config touch, or `os._exit`. | #685, #657, #678 |
-| `codex_client_reconnect_request` | guarded_fail_closed | `gitea_request_mcp_reconnect` report-only tool for Codex/LLM sessions. | Report-only (#678): returns namespace/profile/pid/startup SHA/master SHA/boundary status and a typed operator blocker with exact client UI steps; never restarts or kills. | #678, #630, #685, #657 |
+| `stale_runtime_resolver_reconnect` | guarded_fail_closed | The capability resolver detecting a stale serving process. | Report-only (#685): returns `restart_required`/`stop_required` and an exact reconnect action; no restart, thread, config touch, or `os._exit`. | #685, #657 |
 | `manual_daemon_kill` | forbidden | Shell kills of the daemon: `pkill -f mcp_server.py`, `killall`, broad `pkill -f python` sweeps, or `kill <pid>` of a daemon pid. | Forbidden (#630): `runtime_recovery_guard` classifies these as contamination and `gitea_record_daemon_process_kill_attempt` writes a durable marker that fails later mutations closed. Operator maintenance authorization is read only from the environment. | #630, #657 |
 | `conflict_marker_infra_stop` | guarded_fail_closed | The daemon entrypoint scans for unresolved merge-conflict markers at startup and stops (`sys.exit(1)`). | Fail-closed startup stop, not a restart: the process exits and waits for the operator to resolve conflicts and relaunch; never loops. | #657 |
-| `ide_client_reconnect` | host_residual | A manual `/mcp reconnect` (or equivalent host action) that recreates the MCP client connection. Agents obtain exact UI steps via `gitea_request_mcp_reconnect` (#678). | Outside this process's control; the sanctioned recovery the gates point operators toward. No in-process code initiates it. | #584, #656, #657, #678 |
+| `ide_client_reconnect` | host_residual | A manual `/mcp reconnect` (or equivalent host action) that recreates the MCP client connection. | Outside this process's control; the sanctioned recovery the gates point operators toward. No in-process code initiates it. | #584, #656, #657 |
 | `profile_switch_runtime` | sanctioned_narrow_recovery | Switching the active execution profile at runtime (dynamic-profile mode). | In-process and restart-free: `runtime_switching_supported` is true, so a switch rebinds capability without recreating the process. | #656, #657 |
 
 ## Guards enforced in CI

docs/mcp-tool-inventory.md

@@ -137,7 +137,6 @@ that gates each call, not which tools exist.
 - `gitea_release_merger_pr_lease`
 - `gitea_release_reviewer_pr_lease`
 - `gitea_release_workflow_lease`
-- `gitea_request_mcp_reconnect`
 - `gitea_request_mcp_restart`
 - `gitea_resolve_task_capability`
 - `gitea_resume_review_draft`

gitea_mcp_server.py

@@ -839,6 +839,75 @@ def _invalidate_preflight_identity_state() -> None:
     _clear_preflight_capability_state()
 
 
+# #690: session-boundary invalidation record for the most recent cross-profile
+# activation. Surfaced in runtime diagnostics so a formal review run can prove
+# its state was reset by a profile switch and must be fully re-established.
+_PROFILE_SWITCH_INVALIDATION: dict | None = None
+
+
+def _invalidate_review_state_on_profile_switch(
+    before_profile: str,
+    after_profile: str,
+) -> dict:
+    """Invalidate review-critical session state on a profile switch (#690).
+
+    Workflow-load proof, reviewer lease binding, the review decision lock,
+    live namespace health, and preflight identity/capability stamps recorded
+    under the prior profile are contaminated for the new role. Durable state
+    keyed by *either* profile identity is cleared so a reviewer → author →
+    reviewer hop cannot resurrect a stale review run: the full reviewer
+    preflight (gitea_whoami, gitea_load_review_workflow,
+    gitea_resolve_task_capability(review_pr), live head re-pin, lease
+    re-acquire/adopt) must be re-established before any formal verdict.
+    """
+    global _PROFILE_SWITCH_INVALIDATION
+    invalidated: list[str] = []
+
+    _invalidate_preflight_identity_state()
+    invalidated.append("preflight_identity_capability")
+
+    review_workflow_load.clear_review_workflow_load()
+    invalidated.append("review_workflow_load")
+
+    _save_review_decision_lock(None)
+    invalidated.append("review_decision_lock")
+
+    reviewer_pr_lease.clear_session_lease()
+    invalidated.append("reviewer_session_lease")
+
+    if _LIVE_NAMESPACE_HEALTH:
+        _LIVE_NAMESPACE_HEALTH.clear()
+        invalidated.append("live_namespace_health")
+
+    # Durable records keyed by either profile identity must not survive the
+    # switch, or activating author → reviewer → author could revive a stale
+    # review run without re-preflight.
+    for identity in {before_profile, after_profile}:
+        if not identity:
+            continue
+        try:
+            mcp_session_state.clear_state(
+                kind=mcp_session_state.KIND_DECISION_LOCK,
+                profile_identity=identity,
+            )
+            mcp_session_state.clear_state(
+                kind=mcp_session_state.KIND_WORKFLOW_LOAD,
+                profile_identity=identity,
+            )
+        except Exception:
+            pass  # best-effort durable cleanup; in-memory state already reset
+    invalidated.append("durable_profile_state")
+
+    _PROFILE_SWITCH_INVALIDATION = {
+        "from_profile": before_profile,
+        "to_profile": after_profile,
+        "invalidated": invalidated,
+        "invalidated_at": datetime.now(timezone.utc).isoformat(),
+        "re_preflight_required": True,
+    }
+    return dict(_PROFILE_SWITCH_INVALIDATION)
+
+
 def record_preflight_check(
     type_name: str,
     resolved_role: str | None = None,
@@ -2092,7 +2161,6 @@ import root_checkout_guard  # noqa: E402
 import workflow_scope_guard  # noqa: E402  # #683 production scope / force-on guards
 import stable_branch_push_guard  # noqa: E402
 import runtime_recovery_guard  # noqa: E402  # #630 manual daemon-kill contamination
-import mcp_client_reconnect  # noqa: E402  # #678 sanctioned Codex reconnect request
 import remote_repo_guard  # noqa: E402
 import anti_stomp_preflight  # noqa: E402
 import issue_claim_heartbeat  # noqa: E402
@@ -14025,16 +14093,11 @@ def _classify_operation_gate_reasons(reasons: list[str]) -> dict:
 
 
 def _stale_runtime_reconnect_action() -> str:
-    """Sanctioned recovery for a stale daemon — reconnect only (#685/#897/#678)."""
+    """Sanctioned recovery for a stale daemon — reconnect only (#685/#897)."""
     return (
-        "blocker_kind=runtime_reconnect_required: call "
-        "gitea_request_mcp_reconnect(namespace=<active gitea-* namespace>, "
-        "reason='stale-runtime', client='codex') for a typed operator "
-        "reconnect blocker with exact UI steps, then reconnect the IDE/client "
-        "MCP session so the server reloads at the current master head. Do not "
-        "call gitea_activate_profile, pkill, touch configs, or switch MCP role "
-        "sessions — profile switching does not clear a stale daemon. After "
-        "reconnect restart from gitea_whoami → gitea_resolve_task_capability."
+        "Reconnect the IDE/client MCP session so the server reloads at the "
+        "current master head. Do not call gitea_activate_profile or switch "
+        "MCP role sessions — profile switching does not clear a stale daemon."
     )
 
 
@@ -17216,6 +17279,11 @@ def gitea_whoami(
         "session_context_audit": session_ctx.mutation_context_audit_fields(),
         "identity_match": not id_match.get("block"),
         "identity_match_reasons": id_match.get("reasons") or [],
+        # #690 AC4: report launcher-declared client namespace alongside the
+        # active execution profile so drift is visible in diagnostics.
+        "namespace_provenance": mcp_namespace_health.namespace_provenance(
+            active_profile=profile["profile_name"]
+        ),
     }
     if id_match.get("block"):
         _invalidate_preflight_identity_state()
@@ -18114,6 +18182,11 @@ def gitea_get_runtime_context(
         "shell_health": native_mcp_preference.shell_health_status(),
         "workflow_load_proof": review_workflow_load.workflow_load_status(
             PROJECT_ROOT),
+        # #690: namespace provenance + profile-switch invalidation evidence.
+        "namespace_provenance": mcp_namespace_health.namespace_provenance(
+            active_profile=profile["profile_name"]
+        ),
+        "profile_switch_invalidation": _PROFILE_SWITCH_INVALIDATION,
     }
 
     # #702: read-only visibility into the inherited GITEA_ACTIVE_WORKTREE
@@ -18617,6 +18690,17 @@ def gitea_activate_profile(
         source="gitea_activate_profile",
     )
 
+    # 4.7 #690: a profile switch is a session-boundary event for review state.
+    # Any workflow-load proof, reviewer lease, decision lock, namespace
+    # health, or preflight stamp recorded under the prior profile is
+    # contaminated for the new role and must be re-established under the new
+    # profile before any formal review verdict.
+    switch_invalidation = None
+    if before_profile != after_profile:
+        switch_invalidation = _invalidate_review_state_on_profile_switch(
+            before_profile, after_profile
+        )
+
     # 5. Audit the switch if auditing is on
     _audit(
         "activate_profile",
@@ -18627,11 +18711,12 @@ def gitea_activate_profile(
             "before": before_profile,
             "after": after_profile,
             "session_context": session_ctx.mutation_context_audit_fields(),
+            "review_state_invalidated": bool(switch_invalidation),
         },
         username=after_identity,
     )
 
-    return {
+    result = {
         "success": True,
         "message": f"Successfully activated profile '{profile_name}' (fresh identity verification complete).",
         "before_profile": before_profile,
@@ -18641,6 +18726,18 @@ def gitea_activate_profile(
         "session_context_audit": session_ctx.mutation_context_audit_fields(),
         "auto_profile_substitution": False,
     }
+    if switch_invalidation is not None:
+        result["review_state_invalidation"] = switch_invalidation
+        result["re_preflight_required"] = True
+        result["exact_next_action"] = (
+            "Profile switch invalidated workflow-load proof, reviewer lease, "
+            "decision lock, and preflight stamps (#690). Before any formal "
+            "review verdict, re-run the full reviewer preflight: "
+            "gitea_whoami, gitea_load_review_workflow, "
+            "gitea_resolve_task_capability(review_pr), live head re-pin, and "
+            "lease re-acquire/adopt."
+        )
+    return result
 
 
 @mcp.tool()
@@ -20885,12 +20982,22 @@ def gitea_resolve_task_capability(
             f"{required_role} task '{task}' even if nearby permissions are "
             "present (fail closed)."
         )
+    # #690 AC4: when the launcher declares a client namespace, a task with a
+    # required namespace must fail closed on mismatch (e.g. review_pr served
+    # from an author namespace).
+    ns_provenance = mcp_namespace_health.namespace_provenance(
+        task=task_key, active_profile=profile.get("profile_name")
+    )
+    ns_mismatch_reason = None
+    if ns_provenance.get("mismatch"):
+        ns_mismatch_reason = "; ".join(ns_provenance.get("reasons") or [])
     cross_host_block = bool(remote_assess.get("block"))
     identity_block = bool(id_assess.get("block"))
     drift_block = bool(ctx_assess.get("block"))
     allowed_in_current_session = (
         permission_allowed_in_current_session
         and role_matches_current_session
+        and not ns_provenance.get("mismatch")
         and not cross_host_block
         and not identity_block
         and not drift_block
@@ -20941,6 +21048,8 @@ def gitea_resolve_task_capability(
             )
         if role_mismatch_reason:
             deny_parts.append(role_mismatch_reason)
+        if ns_mismatch_reason:
+            deny_parts.append(ns_mismatch_reason)
         if deny_parts:
             reason_msg = "; ".join(deny_parts)
         elif configured and switching:
@@ -21004,15 +21113,10 @@ def gitea_resolve_task_capability(
     # serving process/profile inventory is stale — even if permission is OK.
     if runtime_stale_blocker:
         next_safe_action = (
-            "blocker_kind=runtime_reconnect_required: call "
-            "gitea_request_mcp_reconnect(namespace=<active gitea-* namespace>, "
-            "reason='stale-runtime', client='codex') for a typed operator "
-            "blocker with exact UI steps, then reconnect/reload the IDE-managed "
-            "Gitea MCP server for this profile so it reloads current master. "
-            "Do not edit mcp_config.json by hand, pkill, or touch configs; the "
-            "resolver does not touch config, spawn recovery threads, or "
-            "terminate the process. After reconnect restart from gitea_whoami → "
-            "gitea_resolve_task_capability."
+            "blocker_kind=runtime_reconnect_required: reconnect/restart the "
+            "IDE-managed Gitea MCP server for this profile so it reloads current "
+            "master. Do not edit mcp_config.json by hand; the resolver does not "
+            "touch config, spawn recovery threads, or terminate the process."
         )
 
     # Task/role alignment guards (#167): the requested task, not the
@@ -21023,6 +21127,8 @@ def gitea_resolve_task_capability(
     task_role_guidance = []
     if role_mismatch_reason:
         task_role_guidance.append(f"STOP: {role_mismatch_reason}")
+    if ns_mismatch_reason:
+        task_role_guidance.append(f"STOP: {ns_mismatch_reason}")
     if required_role == "reviewer":
         if allowed_in_current_session:
             task_role_guidance.append(
@@ -21089,6 +21195,7 @@ def gitea_resolve_task_capability(
         "session_context_audit": session_ctx.mutation_context_audit_fields(),
         "profile_remote_compatible": not cross_host_block,
         "identity_match": not identity_block,
+        "namespace_provenance": ns_provenance,
         "auto_profile_substitution": False,
     }
     # #685: report typed reconnect blocker without mutating config or exiting.
@@ -22570,129 +22677,6 @@ def gitea_workflow_dashboard(
     return payload
 
 
-@mcp.tool()
-def gitea_request_mcp_reconnect(
-    namespace: str | None = None,
-    reason: str | None = None,
-    client: str = "codex",
-    remote: str = "dadeschools",
-    host: str | None = None,
-    session_id: str | None = None,
-) -> dict:
-    """Request a sanctioned host/IDE MCP reconnect for a named namespace (#678).
-
-    Codex and other agent hosts can detect stale or closed Gitea MCP runtimes
-    (``stop_required`` / ``restart_required`` from capability resolution, transport
-    EOF, missing namespace attachment). The **host owns the transport** — this
-    process cannot reopen the client's stdio pipe. This tool is the callable
-    surface agents use to:
-
-    1. Report reconnect status fields (namespace, profile, pid/session,
-       startup SHA, current master SHA, boundary status).
-    2. Return a **typed blocker** with exact operator UI steps for Codex (or
-       another client) when reconnect is required.
-
-    This tool **never** restarts, kills, reloads, or reconfigures an MCP
-    process. Forbidden recovery paths (pkill, touch/mtime hacks, config/.env
-    edits, session-state edits, raw API) are never recommended.
-
-    After the operator reconnects, workflows must restart from preflight:
-    ``gitea_whoami`` → ``gitea_resolve_task_capability`` → task.
-
-    Args:
-        namespace: MCP namespace to reconnect (e.g. ``gitea-author``). Defaults
-            to the active profile's inferred namespace.
-        reason: Why reconnect is requested: ``stale-runtime``, ``transport_eof``,
-            ``missing_namespace``, ``not_required``, or free-form (normalized).
-        client: Operator UI surface — ``codex`` (default), ``claude_code``, or
-            ``generic``.
-        remote: Known instance — ``dadeschools`` or ``prgs`` (parity context).
-        host: Optional host override for parity context.
-        session_id: Optional session id to echo in the report.
-
-    Returns:
-        dict with reconnect report fields, ``reconnect_performed=False``,
-        ``typed_blocker`` when reconnect is required, and
-        ``forbidden_recovery_paths``.
-    """
-    # Read-only: gitea.read is sufficient. Never a mutation.
-    read_block = _profile_operation_gate("gitea.read")
-    if read_block:
-        return {
-            "success": False,
-            "read_only": True,
-            "reconnect_performed": False,
-            "mutation_performed": False,
-            "reasons": read_block,
-            "permission_report": _permission_block_report("gitea.read"),
-            "forbidden_recovery_paths": list(
-                mcp_client_reconnect.FORBIDDEN_RECOVERY_PATHS
-            ),
-        }
-
-    profile = get_profile()
-    profile_name = (profile.get("profile_name") or "").strip() or None
-    inferred_ns = role_namespace_gate.infer_mcp_namespace(profile_name)
-    ns = (namespace or "").strip() or inferred_ns or "gitea-tools"
-
-    parity = _current_master_parity()
-    startup_sha = (
-        parity.get("daemon_start_head")
-        or parity.get("startup_head")
-        or _process_boot_head_sha
-    )
-    current_sha = parity.get("local_head") or parity.get("current_head")
-    if not current_sha:
-        try:
-            current_sha = master_parity_gate.read_git_head(PROJECT_ROOT)
-        except Exception:  # noqa: BLE001
-            current_sha = None
-
-    boundary = mcp_client_reconnect.classify_boundary_status(
-        startup_sha=startup_sha if isinstance(startup_sha, str) else None,
-        current_master_sha=current_sha if isinstance(current_sha, str) else None,
-        live_stale=bool(parity.get("live_stale")) if parity.get("live_known") else None,
-        in_parity=parity.get("in_parity") if parity.get("determinable") else None,
-    )
-
-    # Infer reason from parity when caller left it unspecified.
-    effective_reason = reason
-    if not (effective_reason or "").strip():
-        if parity.get("restart_required") or parity.get("live_stale"):
-            effective_reason = mcp_client_reconnect.REASON_STALE_RUNTIME
-        elif boundary == mcp_client_reconnect.BOUNDARY_CLEAN:
-            effective_reason = mcp_client_reconnect.REASON_NOT_REQUIRED
-        else:
-            effective_reason = mcp_client_reconnect.REASON_UNSPECIFIED
-
-    payload = mcp_client_reconnect.build_reconnect_request(
-        namespace=ns,
-        profile=profile_name,
-        pid=os.getpid(),
-        session_id=session_id
-        or f"{(profile_name or 'session')}-{os.getpid()}",
-        startup_sha=startup_sha if isinstance(startup_sha, str) else None,
-        current_master_sha=current_sha if isinstance(current_sha, str) else None,
-        boundary_status=boundary,
-        reason=effective_reason,
-        client=client,
-        live_stale=bool(parity.get("live_stale")) if parity.get("live_known") else None,
-        in_parity=parity.get("in_parity") if parity.get("determinable") else None,
-        restart_required=bool(parity.get("restart_required")),
-        stop_required=bool(parity.get("restart_required")),
-        extra={
-            "remote": remote if remote in REMOTES else remote,
-            "host": host,
-            "session_context_audit": session_ctx.mutation_context_audit_fields(),
-            "parity_summary": master_parity_gate.format_parity(parity),
-            "live_stale": parity.get("live_stale"),
-            "live_known": parity.get("live_known"),
-            "in_parity": parity.get("in_parity"),
-        },
-    )
-    return payload
-
-
 @mcp.tool()
 def gitea_request_mcp_restart(
     remote: str = "dadeschools",

mcp_client_reconnect.py

@@ -1,328 +0,0 @@
-"""Sanctioned MCP client reconnect request surface for Codex/LLM sessions (#678).
-
-Codex and other agent hosts can detect stale or closed Gitea MCP runtimes, but
-the host owns the transport. This module never restarts, kills, or reloads a
-daemon. It builds:
-
-1. A **callable reconnect request** result agents can invoke via
-   ``gitea_request_mcp_reconnect`` (report-only, side-effect free).
-2. A **typed blocker** with exact operator UI steps when recovery must be
-   performed by the host/operator.
-
-Forbidden recovery paths (must never be recommended):
-
-* ``pkill`` / ``kill`` / ``killall`` of MCP daemons
-* ``touch`` / mtime config reload hacks
-* ``.env`` or MCP config edits as recovery
-* session-state file edits
-* raw Gitea API / direct server-import fallbacks
-
-After the operator reconnects, workflows restart from identity / runtime /
-capability preflight (``gitea_whoami`` → ``gitea_resolve_task_capability`` →
-task).
-"""
-
-from __future__ import annotations
-
-from typing import Any, Mapping
-
-# --- Reason vocabulary -------------------------------------------------------
-
-REASON_STALE_RUNTIME = "stale-runtime"
-REASON_TRANSPORT_EOF = "transport_eof"
-REASON_MISSING_NAMESPACE = "missing_namespace"
-REASON_NOT_REQUIRED = "not_required"
-REASON_UNSPECIFIED = "unspecified"
-
-VALID_REASONS = frozenset(
-    {
-        REASON_STALE_RUNTIME,
-        REASON_TRANSPORT_EOF,
-        REASON_MISSING_NAMESPACE,
-        REASON_NOT_REQUIRED,
-        REASON_UNSPECIFIED,
-    }
-)
-
-# Boundary statuses reported to callers (match review_workflow_boundary style).
-BOUNDARY_CLEAN = "clean"
-BOUNDARY_MISMATCH = "mismatch"
-BOUNDARY_STALE = "stale"
-BOUNDARY_UNKNOWN = "unknown"
-
-# Typed blocker kinds
-BLOCKER_OPERATOR_RECONNECT = "operator_mcp_reconnect_required"
-BLOCKER_NONE = "none"
-
-FORBIDDEN_RECOVERY_PATHS: tuple[str, ...] = (
-    "pkill / kill / killall of mcp_server.py, gitea_mcp_server, or broad python sweeps",
-    "touch / mtime-based MCP config reload hacks",
-    ".env edits as recovery",
-    "MCP config file edits as recovery",
-    "session-state file edits as recovery",
-    "raw Gitea API or direct MCP server-import fallbacks",
-)
-
-# Client-specific operator UI steps. Keep Codex first (issue title surface).
-OPERATOR_UI_STEPS: dict[str, tuple[str, ...]] = {
-    "codex": (
-        "In Codex, open the MCP / Developer tools panel for this workspace.",
-        "Locate the named Gitea MCP server entry (namespace) that needs reconnect "
-        "(e.g. gitea-author, gitea-reviewer, gitea-merger, gitea-tools, "
-        "gitea-controller, gitea-reconciler).",
-        "Click 'Reload Developer Tools' or the server reconnect/reload control "
-        "for that entry so the client spawns a fresh MCP subprocess.",
-        "If per-server reconnect is unavailable, fully restart the Codex client "
-        "(quit and relaunch) so all MCP namespaces reattach.",
-        "After reconnect, rerun the blocked workflow from preflight: "
-        "gitea_whoami → gitea_resolve_task_capability → the original task. "
-        "Do not resume mid-mutation.",
-    ),
-    "claude_code": (
-        "Run `/mcp` (or open the MCP servers UI) in Claude Code.",
-        "Reconnect the affected gitea-* server entry so the client reopens stdio.",
-        "If reconnect fails, relaunch the Claude Code session entirely.",
-        "After reconnect, restart the workflow from gitea_whoami → "
-        "gitea_resolve_task_capability → task.",
-    ),
-    "generic": (
-        "Use the host/IDE MCP reconnect or reload control for the named namespace.",
-        "If no per-namespace control exists, restart the MCP client/editor.",
-        "After reconnect, restart the workflow from identity/capability preflight.",
-    ),
-}
-
-DEFAULT_CLIENT = "codex"
-
-
-def normalize_reason(reason: str | None) -> str:
-    """Map free-form reason strings onto the closed vocabulary."""
-    raw = (reason or "").strip().lower()
-    if not raw:
-        return REASON_UNSPECIFIED
-    if raw in VALID_REASONS:
-        return raw
-    text = raw.replace(" ", "_").replace("-", "_")
-    aliases = {
-        "stale_runtime": REASON_STALE_RUNTIME,
-        "staleruntime": REASON_STALE_RUNTIME,
-        "runtime_stale": REASON_STALE_RUNTIME,
-        "stale": REASON_STALE_RUNTIME,
-        "transport_eof": REASON_TRANSPORT_EOF,
-        "transport_closed": REASON_TRANSPORT_EOF,
-        "eof": REASON_TRANSPORT_EOF,
-        "client_is_closing": REASON_TRANSPORT_EOF,
-        "missing_namespace": REASON_MISSING_NAMESPACE,
-        "namespace_missing": REASON_MISSING_NAMESPACE,
-        "not_required": REASON_NOT_REQUIRED,
-        "healthy": REASON_NOT_REQUIRED,
-        "ok": REASON_NOT_REQUIRED,
-        "unspecified": REASON_UNSPECIFIED,
-    }
-    if text in aliases:
-        return aliases[text]
-    hyphenated = text.replace("_", "-")
-    if hyphenated in VALID_REASONS:
-        return hyphenated
-    return REASON_UNSPECIFIED
-
-
-def normalize_client(client: str | None) -> str:
-    """Return a known client key for operator UI steps."""
-    text = (client or "").strip().lower().replace(" ", "_").replace("-", "_")
-    if text in ("codex", "openai_codex", "openai"):
-        return "codex"
-    if text in ("claude", "claude_code", "claude_desktop", "anthropic"):
-        return "claude_code"
-    if text in OPERATOR_UI_STEPS:
-        return text
-    return DEFAULT_CLIENT
-
-
-def classify_boundary_status(
-    *,
-    startup_sha: str | None,
-    current_master_sha: str | None,
-    live_stale: bool | None = None,
-    in_parity: bool | None = None,
-) -> str:
-    """Derive boundary_status from parity evidence."""
-    if live_stale is True or in_parity is False:
-        return BOUNDARY_STALE
-    start = (startup_sha or "").strip().lower()
-    current = (current_master_sha or "").strip().lower()
-    if start and current and start != current:
-        return BOUNDARY_MISMATCH
-    if start and current and start == current:
-        return BOUNDARY_CLEAN
-    if in_parity is True:
-        return BOUNDARY_CLEAN
-    return BOUNDARY_UNKNOWN
-
-
-def operator_ui_steps(client: str | None, *, namespace: str | None = None) -> list[str]:
-    """Exact operator UI steps for the named client."""
-    key = normalize_client(client)
-    steps = list(OPERATOR_UI_STEPS.get(key) or OPERATOR_UI_STEPS[DEFAULT_CLIENT])
-    ns = (namespace or "").strip()
-    if ns:
-        steps = [
-            s.replace("named Gitea MCP server entry (namespace)", f"namespace '{ns}'")
-            .replace("affected gitea-* server entry", f"server entry '{ns}'")
-            .replace("named namespace", f"namespace '{ns}'")
-            for s in steps
-        ]
-    return steps
-
-
-def build_reconnect_request(
-    *,
-    namespace: str,
-    profile: str | None = None,
-    pid: int | str | None = None,
-    session_id: str | None = None,
-    startup_sha: str | None = None,
-    current_master_sha: str | None = None,
-    boundary_status: str | None = None,
-    reason: str | None = None,
-    client: str | None = DEFAULT_CLIENT,
-    live_stale: bool | None = None,
-    in_parity: bool | None = None,
-    restart_required: bool | None = None,
-    stop_required: bool | None = None,
-    extra: Mapping[str, Any] | None = None,
-) -> dict[str, Any]:
-    """Build the structured reconnect-request / typed-blocker payload (#678).
-
-    Never mutates process, config, or session state. Always side-effect free.
-    """
-    ns = (namespace or "").strip() or "unknown"
-    normalized_reason = normalize_reason(reason)
-    boundary = (boundary_status or "").strip() or classify_boundary_status(
-        startup_sha=startup_sha,
-        current_master_sha=current_master_sha,
-        live_stale=live_stale,
-        in_parity=in_parity,
-    )
-
-    reconnect_needed = True
-    if normalized_reason == REASON_NOT_REQUIRED and boundary == BOUNDARY_CLEAN:
-        reconnect_needed = False
-    if restart_required is False and stop_required is False and boundary == BOUNDARY_CLEAN:
-        # Explicit healthy probe
-        if normalized_reason in (REASON_NOT_REQUIRED, REASON_UNSPECIFIED):
-            reconnect_needed = False
-            normalized_reason = REASON_NOT_REQUIRED
-
-    if restart_required is True or stop_required is True:
-        reconnect_needed = True
-        if normalized_reason in (REASON_NOT_REQUIRED, REASON_UNSPECIFIED):
-            normalized_reason = REASON_STALE_RUNTIME
-
-    client_key = normalize_client(client)
-    steps = operator_ui_steps(client_key, namespace=ns)
-
-    result: dict[str, Any] = {
-        "success": True,
-        "read_only": True,
-        "reconnect_performed": False,
-        "mutation_performed": False,
-        "reconnect_needed": reconnect_needed,
-        "namespace": ns,
-        "profile": (profile or "").strip() or None,
-        "pid": pid,
-        "session_id": (session_id or "").strip() or None,
-        "startup_sha": (startup_sha or "").strip() or None,
-        "current_master_sha": (current_master_sha or "").strip() or None,
-        "boundary_status": boundary,
-        "reason": normalized_reason,
-        "client": client_key,
-        "forbidden_recovery_paths": list(FORBIDDEN_RECOVERY_PATHS),
-        "post_reconnect_preflight": [
-            "gitea_whoami",
-            "gitea_resolve_task_capability",
-            "original_task",
-        ],
-        "exact_safe_next_action": None,
-        "blocker_kind": BLOCKER_NONE,
-        "operator_ui_steps": steps,
-        "typed_blocker": None,
-    }
-
-    if reconnect_needed:
-        result["blocker_kind"] = BLOCKER_OPERATOR_RECONNECT
-        result["stop_required"] = True
-        result["restart_required"] = True
-        result["exact_safe_next_action"] = (
-            f"blocker_kind={BLOCKER_OPERATOR_RECONNECT}: operator must reconnect "
-            f"MCP namespace '{ns}' via the host UI (client={client_key}). "
-            "Do not pkill, touch configs, edit session state, or use raw API. "
-            "After reconnect, restart from gitea_whoami → "
-            "gitea_resolve_task_capability → task."
-        )
-        result["typed_blocker"] = {
-            "blocker_kind": BLOCKER_OPERATOR_RECONNECT,
-            "namespaces": [ns],
-            "why_reconnect_required": normalized_reason,
-            "operator_ui_steps": steps,
-            "client": client_key,
-            "forbidden_recovery_paths": list(FORBIDDEN_RECOVERY_PATHS),
-            "instruction_after_reconnect": (
-                "Rerun the blocked workflow from preflight "
-                "(gitea_whoami → gitea_resolve_task_capability → task). "
-                "Do not continue mid-mutation from pre-reconnect state."
-            ),
-        }
-    else:
-        result["stop_required"] = False
-        result["restart_required"] = False
-        result["exact_safe_next_action"] = (
-            f"Reconnect not required for namespace '{ns}' "
-            f"(boundary_status={boundary}). Proceed with the original task."
-        )
-
-    if extra:
-        for key, value in extra.items():
-            if key not in result:
-                result[key] = value
-
-    return result
-
-
-def reasons_never_suggest_forbidden(text: str) -> bool:
-    """Return True when *text* does not recommend a forbidden recovery path.
-
-    Mentions that *ban* a path (e.g. ``Do not pkill`` / ``never edit session
-    state``) are allowed. Positive recommendations such as ``use pkill`` or
-    ``run killall`` fail.
-    """
-    import re
-
-    lowered = (text or "").lower()
-    # Strip common ban prefixes so "do not pkill" does not trip positive checks.
-    scrubbed = re.sub(
-        r"\b(?:do not|don't|never|must not|forbid(?:den)?|ban(?:ned)?)\b"
-        r"[^.!;\n]{0,80}",
-        " ",
-        lowered,
-    )
-    # Positive imperative / advisory forms that would tell an agent to do harm.
-    positive_suggestions = (
-        "use pkill",
-        "run pkill",
-        "try pkill",
-        "pkill -f",
-        "use killall",
-        "run killall",
-        "killall mcp",
-        "use kill ",
-        "run kill ",
-        "touch the mcp",
-        "touch mcp config",
-        "utime(",
-        "edit the mcp config to recover",
-        "edit .env to recover",
-        "import gitea_mcp_server",
-        "python -c 'import gitea_mcp",
-    )
-    return not any(frag in scrubbed for frag in positive_suggestions)

mcp_namespace_health.py

@@ -16,6 +16,7 @@ Probe sources
 
 from __future__ import annotations
 
+import os
 from typing import Any
 
 
@@ -57,8 +58,56 @@ SAFE_ENV_KEYS = (
     "GITEA_SERVICE",
     "GITEA_EXECUTION_ROLE",
     "GITEA_MCP_CONFIG",
+    "GITEA_MCP_NAMESPACE",
 )
 
+# Optional launcher-provided env declaring the client-managed MCP namespace
+# this process is registered under (e.g. ``gitea-reviewer``). The server
+# cannot derive its own IDE namespace name, so the launcher declares it; when
+# declared, reviewers/mergers can fail closed on a namespace/task mismatch
+# (#690 AC4). Absence means "unknown" — reported, never guessed.
+NAMESPACE_ENV = "GITEA_MCP_NAMESPACE"
+
+
+def configured_client_namespace(env: dict[str, str] | None = None) -> str | None:
+    """Return the launcher-declared client namespace, or None when unknown."""
+    source = os.environ if env is None else env
+    value = (source.get(NAMESPACE_ENV) or "").strip()
+    return value or None
+
+
+def namespace_provenance(
+    task: str | None = None,
+    *,
+    active_profile: str | None = None,
+    env: dict[str, str] | None = None,
+) -> dict[str, Any]:
+    """Report configured client namespace vs active execution profile (#690).
+
+    When *task* carries a required namespace (``TASK_REQUIRED_NAMESPACES``)
+    and the launcher declared a different one, ``mismatch`` is True and the
+    caller must fail closed for that task. An undeclared namespace is
+    reported as unknown — never treated as proof either way.
+    """
+    configured = configured_client_namespace(env)
+    required = TASK_REQUIRED_NAMESPACES.get(task or "")
+    mismatch = bool(configured and required and configured != required)
+    reasons: list[str] = []
+    if mismatch:
+        reasons.append(
+            f"configured client namespace '{configured}' does not match "
+            f"required namespace '{required}' for task '{task}' (fail closed)"
+        )
+    return {
+        "configured_namespace": configured,
+        "namespace_source": NAMESPACE_ENV if configured else "unknown",
+        "active_profile": active_profile,
+        "requested_task": task,
+        "required_namespace": required,
+        "mismatch": mismatch,
+        "reasons": reasons,
+    }
+
 
 def _as_list(value: Any) -> list[str] | None:
     if value is None:

mcp_restart_paths.py

@@ -225,33 +225,8 @@ _RESTART_PATHS: tuple[RestartPath, ...] = (
             "exact_safe_next_action pointing at IDE/client reconnect; performs "
             "no restart, thread spawn, config touch, or os._exit."
         ),
-        locations=(
-            "gitea_mcp_server.py (gitea_resolve_task_capability)",
-            "gitea_mcp_server.py (gitea_request_mcp_reconnect)",
-            "mcp_client_reconnect.py",
-        ),
-        references=("#685", "#657", "#678"),
-    ),
-    RestartPath(
-        path_id="codex_client_reconnect_request",
-        title="Sanctioned Codex/LLM reconnect request tool",
-        mechanism=(
-            "gitea_request_mcp_reconnect: agents invoke a report-only tool that "
-            "returns namespace/profile/pid/startup SHA/master SHA/boundary "
-            "status plus a typed operator blocker with exact client UI steps."
-        ),
-        classification=CLASS_GUARDED_FAIL_CLOSED,
-        guard=(
-            "Report-only (#678): never restarts, kills, reloads, or edits "
-            "config; recovery is always host/operator reconnect. Forbidden "
-            "paths (pkill, touch, .env/config/session-state hacks) are listed "
-            "and never recommended."
-        ),
-        locations=(
-            "mcp_client_reconnect.py",
-            "gitea_mcp_server.py (gitea_request_mcp_reconnect)",
-        ),
-        references=("#678", "#630", "#685", "#657"),
+        locations=("gitea_mcp_server.py (gitea_resolve_task_capability)",),
+        references=("#685", "#657"),
     ),
     RestartPath(
         path_id="manual_daemon_kill",
@@ -296,8 +271,7 @@ _RESTART_PATHS: tuple[RestartPath, ...] = (
         title="Host/IDE MCP reconnect",
         mechanism=(
             "A manual `/mcp reconnect` (or equivalent host action) that the "
-            "IDE performs to recreate the MCP client connection. Agents obtain "
-            "exact UI steps via gitea_request_mcp_reconnect (#678)."
+            "IDE performs to recreate the MCP client connection."
         ),
         classification=CLASS_HOST_RESIDUAL,
         guard=(
@@ -305,12 +279,8 @@ _RESTART_PATHS: tuple[RestartPath, ...] = (
             "gates point operators toward; documented as residual host "
             "behavior. No in-process code initiates it."
         ),
-        locations=(
-            "host/IDE",
-            "mcp_client_reconnect.py",
-            "gitea_mcp_server.py (gitea_request_mcp_reconnect)",
-        ),
-        references=("#584", "#656", "#657", "#678"),
+        locations=("host/IDE",),
+        references=("#584", "#656", "#657"),
         residual_host=True,
     ),
     RestartPath(

tests/conftest.py

@@ -41,6 +41,7 @@ def _reset_mutation_authority(monkeypatch):
         "GITEA_REVIEWER_WORKTREE",
         "GITEA_MERGER_WORKTREE",
         "GITEA_RECONCILER_WORKTREE",
+        "GITEA_MCP_NAMESPACE",
     ]:
         monkeypatch.delenv(env_key, raising=False)
 
@@ -115,6 +116,7 @@ def _reset_mutation_authority(monkeypatch):
         monkeypatch.setattr(mcp_server, "_ACTOR_IDENTITY_CACHE", {})
     monkeypatch.setattr(mcp_server, "_REVIEW_DECISION_LOCK", None)
     monkeypatch.setattr(mcp_server, "_LIVE_NAMESPACE_HEALTH", {})
+    monkeypatch.setattr(mcp_server, "_PROFILE_SWITCH_INVALIDATION", None)
     monkeypatch.setattr(mcp_server, "_preflight_whoami_called", False)
     monkeypatch.setattr(mcp_server, "_preflight_capability_called", False)
     monkeypatch.setattr(mcp_server, "_preflight_resolved_role", None)

tests/test_issue_678_mcp_client_reconnect.py

@@ -1,323 +0,0 @@
-"""Tests for sanctioned Codex MCP reconnect request surface (#678)."""
-
-from __future__ import annotations
-
-import os
-import unittest
-from unittest import mock
-
-import mcp_client_reconnect as mcr
-
-
-class NormalizeReasonTests(unittest.TestCase):
-    def test_stale_runtime_aliases(self):
-        self.assertEqual(mcr.normalize_reason("stale-runtime"), mcr.REASON_STALE_RUNTIME)
-        self.assertEqual(mcr.normalize_reason("stale_runtime"), mcr.REASON_STALE_RUNTIME)
-        self.assertEqual(mcr.normalize_reason("STALE"), mcr.REASON_STALE_RUNTIME)
-
-    def test_transport_eof_aliases(self):
-        self.assertEqual(mcr.normalize_reason("transport_eof"), mcr.REASON_TRANSPORT_EOF)
-        self.assertEqual(mcr.normalize_reason("EOF"), mcr.REASON_TRANSPORT_EOF)
-        self.assertEqual(
-            mcr.normalize_reason("client_is_closing"), mcr.REASON_TRANSPORT_EOF
-        )
-
-    def test_missing_namespace(self):
-        self.assertEqual(
-            mcr.normalize_reason("missing_namespace"), mcr.REASON_MISSING_NAMESPACE
-        )
-
-    def test_empty_is_unspecified(self):
-        self.assertEqual(mcr.normalize_reason(None), mcr.REASON_UNSPECIFIED)
-        self.assertEqual(mcr.normalize_reason(""), mcr.REASON_UNSPECIFIED)
-
-
-class BoundaryClassificationTests(unittest.TestCase):
-    def test_clean_when_shas_match(self):
-        self.assertEqual(
-            mcr.classify_boundary_status(
-                startup_sha="abc", current_master_sha="abc"
-            ),
-            mcr.BOUNDARY_CLEAN,
-        )
-
-    def test_mismatch_when_shas_differ(self):
-        self.assertEqual(
-            mcr.classify_boundary_status(
-                startup_sha="aaa", current_master_sha="bbb"
-            ),
-            mcr.BOUNDARY_MISMATCH,
-        )
-
-    def test_stale_when_live_stale(self):
-        self.assertEqual(
-            mcr.classify_boundary_status(
-                startup_sha="aaa",
-                current_master_sha="aaa",
-                live_stale=True,
-            ),
-            mcr.BOUNDARY_STALE,
-        )
-
-
-class BuildReconnectRequestTests(unittest.TestCase):
-    def test_stale_runtime_returns_typed_blocker_with_codex_steps(self):
-        result = mcr.build_reconnect_request(
-            namespace="gitea-author",
-            profile="prgs-author",
-            pid=1234,
-            session_id="sess-1",
-            startup_sha="aaa111",
-            current_master_sha="bbb222",
-            reason="stale-runtime",
-            client="codex",
-            restart_required=True,
-            stop_required=True,
-        )
-        self.assertTrue(result["success"])
-        self.assertTrue(result["read_only"])
-        self.assertFalse(result["reconnect_performed"])
-        self.assertFalse(result["mutation_performed"])
-        self.assertTrue(result["reconnect_needed"])
-        self.assertEqual(result["namespace"], "gitea-author")
-        self.assertEqual(result["profile"], "prgs-author")
-        self.assertEqual(result["pid"], 1234)
-        self.assertEqual(result["session_id"], "sess-1")
-        self.assertEqual(result["startup_sha"], "aaa111")
-        self.assertEqual(result["current_master_sha"], "bbb222")
-        self.assertEqual(result["boundary_status"], mcr.BOUNDARY_MISMATCH)
-        self.assertEqual(result["blocker_kind"], mcr.BLOCKER_OPERATOR_RECONNECT)
-        self.assertIsNotNone(result["typed_blocker"])
-        blocker = result["typed_blocker"]
-        self.assertEqual(blocker["namespaces"], ["gitea-author"])
-        self.assertEqual(blocker["why_reconnect_required"], mcr.REASON_STALE_RUNTIME)
-        self.assertTrue(any("Codex" in s or "Reload" in s for s in blocker["operator_ui_steps"]))
-        self.assertIn("pkill", " ".join(result["forbidden_recovery_paths"]).lower())
-        self.assertTrue(
-            mcr.reasons_never_suggest_forbidden(result["exact_safe_next_action"] or "")
-        )
-        # Must not recommend forbidden recovery.
-        for step in blocker["operator_ui_steps"]:
-            self.assertTrue(mcr.reasons_never_suggest_forbidden(step), step)
-
-    def test_transport_eof_typed_blocker(self):
-        result = mcr.build_reconnect_request(
-            namespace="gitea-reviewer",
-            reason="transport_eof",
-            client="claude_code",
-        )
-        self.assertTrue(result["reconnect_needed"])
-        self.assertEqual(result["reason"], mcr.REASON_TRANSPORT_EOF)
-        self.assertEqual(result["client"], "claude_code")
-        steps = " ".join(result["operator_ui_steps"]).lower()
-        self.assertIn("/mcp", steps)
-
-    def test_missing_namespace_typed_blocker(self):
-        result = mcr.build_reconnect_request(
-            namespace="gitea-merger",
-            reason="missing_namespace",
-            client="codex",
-        )
-        self.assertTrue(result["reconnect_needed"])
-        self.assertEqual(result["reason"], mcr.REASON_MISSING_NAMESPACE)
-        self.assertEqual(
-            result["typed_blocker"]["blocker_kind"], mcr.BLOCKER_OPERATOR_RECONNECT
-        )
-
-    def test_healthy_not_required(self):
-        result = mcr.build_reconnect_request(
-            namespace="gitea-tools",
-            startup_sha="deadbeef",
-            current_master_sha="deadbeef",
-            reason="not_required",
-            client="codex",
-            in_parity=True,
-            restart_required=False,
-            stop_required=False,
-        )
-        self.assertFalse(result["reconnect_needed"])
-        self.assertEqual(result["blocker_kind"], mcr.BLOCKER_NONE)
-        self.assertIsNone(result["typed_blocker"])
-        self.assertFalse(result["stop_required"])
-        self.assertFalse(result["restart_required"])
-        self.assertIn("not required", (result["exact_safe_next_action"] or "").lower())
-
-    def test_successful_reconnect_report_fields_present(self):
-        """AC2: reconnect result reports required fields (even when needed)."""
-        result = mcr.build_reconnect_request(
-            namespace="gitea-controller",
-            profile="prgs-controller",
-            pid=99,
-            session_id="sid",
-            startup_sha="s" * 40,
-            current_master_sha="c" * 40,
-            reason="stale-runtime",
-        )
-        for key in (
-            "namespace",
-            "profile",
-            "pid",
-            "session_id",
-            "startup_sha",
-            "current_master_sha",
-            "boundary_status",
-        ):
-            self.assertIn(key, result)
-            self.assertIsNotNone(result[key], key)
-
-
-class ToolSurfaceTests(unittest.TestCase):
-    """Exercise gitea_request_mcp_reconnect with a stubbed server context."""
-
-    def test_tool_is_registered_and_side_effect_free(self):
-        import gitea_mcp_server as srv
-
-        self.assertTrue(hasattr(srv, "gitea_request_mcp_reconnect"))
-        with mock.patch.object(srv, "_profile_operation_gate", return_value=None):
-            with mock.patch.object(
-                srv,
-                "get_profile",
-                return_value={
-                    "profile_name": "prgs-author",
-                    "role_kind": "author",
-                    "role": "author",
-                },
-            ):
-                with mock.patch.object(
-                    srv,
-                    "_current_master_parity",
-                    return_value={
-                        "startup_head": "a" * 40,
-                        "current_head": "a" * 40,
-                        "daemon_start_head": "a" * 40,
-                        "local_head": "a" * 40,
-                        "in_parity": True,
-                        "stale": False,
-                        "restart_required": False,
-                        "determinable": True,
-                        "live_stale": False,
-                        "live_known": True,
-                        "reasons": [],
-                    },
-                ):
-                    with mock.patch.object(
-                        srv.master_parity_gate,
-                        "format_parity",
-                        return_value="in parity",
-                    ):
-                        with mock.patch.object(
-                            srv.role_namespace_gate,
-                            "infer_mcp_namespace",
-                            return_value="gitea-author",
-                        ):
-                            with mock.patch.object(
-                                srv.session_ctx,
-                                "mutation_context_audit_fields",
-                                return_value={"session_profile": "prgs-author"},
-                            ):
-                                result = srv.gitea_request_mcp_reconnect(
-                                    namespace="gitea-author",
-                                    reason="not_required",
-                                    client="codex",
-                                    remote="prgs",
-                                )
-        self.assertTrue(result.get("success"))
-        self.assertFalse(result.get("reconnect_performed"))
-        self.assertFalse(result.get("mutation_performed"))
-        self.assertEqual(result.get("namespace"), "gitea-author")
-        self.assertEqual(result.get("profile"), "prgs-author")
-        self.assertEqual(result.get("pid"), os.getpid())
-        self.assertIn("startup_sha", result)
-        self.assertIn("current_master_sha", result)
-        self.assertIn("boundary_status", result)
-        self.assertTrue(
-            mcr.reasons_never_suggest_forbidden(
-                result.get("exact_safe_next_action") or ""
-            )
-        )
-
-    def test_tool_stale_returns_typed_blocker(self):
-        import gitea_mcp_server as srv
-
-        with mock.patch.object(srv, "_profile_operation_gate", return_value=None):
-            with mock.patch.object(
-                srv,
-                "get_profile",
-                return_value={
-                    "profile_name": "prgs-reconciler",
-                    "role_kind": "reconciler",
-                    "role": "reconciler",
-                },
-            ):
-                with mock.patch.object(
-                    srv,
-                    "_current_master_parity",
-                    return_value={
-                        "startup_head": "a" * 40,
-                        "current_head": "b" * 40,
-                        "daemon_start_head": "a" * 40,
-                        "local_head": "b" * 40,
-                        "in_parity": False,
-                        "stale": True,
-                        "restart_required": True,
-                        "determinable": True,
-                        "live_stale": True,
-                        "live_known": True,
-                        "reasons": ["stale"],
-                    },
-                ):
-                    with mock.patch.object(
-                        srv.master_parity_gate,
-                        "format_parity",
-                        return_value="stale",
-                    ):
-                        with mock.patch.object(
-                            srv.role_namespace_gate,
-                            "infer_mcp_namespace",
-                            return_value="gitea-reconciler",
-                        ):
-                            with mock.patch.object(
-                                srv.session_ctx,
-                                "mutation_context_audit_fields",
-                                return_value={},
-                            ):
-                                result = srv.gitea_request_mcp_reconnect(
-                                    reason="stale-runtime",
-                                    client="codex",
-                                )
-        self.assertTrue(result["reconnect_needed"])
-        self.assertEqual(
-            result["blocker_kind"], mcr.BLOCKER_OPERATOR_RECONNECT
-        )
-        self.assertIsNotNone(result["typed_blocker"])
-        self.assertIn("gitea-reconciler", result["typed_blocker"]["namespaces"])
-        self.assertTrue(result["stop_required"])
-        self.assertTrue(result["restart_required"])
-        self.assertTrue(
-            mcr.reasons_never_suggest_forbidden(
-                result.get("exact_safe_next_action") or ""
-            )
-        )
-
-
-class InventoryRegistrationTests(unittest.TestCase):
-    def test_reconnect_path_in_restart_inventory(self):
-        import mcp_restart_paths as mrp
-
-        ids = {p.path_id for p in mrp.iter_restart_paths()}
-        self.assertIn("codex_client_reconnect_request", ids)
-        self.assertIn("ide_client_reconnect", ids)
-
-    def test_tool_name_in_documented_inventory(self):
-        import mcp_tool_inventory as inv
-
-        doc_path = os.path.join(
-            os.path.dirname(os.path.dirname(__file__)), inv.INVENTORY_DOC_PATH
-        )
-        with open(doc_path, encoding="utf-8") as handle:
-            documented = inv.parse_documented_inventory(handle.read())
-        self.assertIn("gitea_request_mcp_reconnect", documented)
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_issue_690_profile_switch_review_guard.py

@@ -0,0 +1,274 @@
+"""Regression coverage for #690: cross-role profile activation invalidation.
+
+A mid-run profile switch (e.g. reviewer → author → reviewer) must invalidate
+workflow-load proof, reviewer lease binding, review decision lock, live
+namespace health, and preflight identity/capability stamps, and must require
+a full reviewer preflight before any formal verdict. Namespace provenance
+must be reported and fail closed on task/namespace mismatch.
+"""
+import json
+import os
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent))
+
+import gitea_config
+import mcp_namespace_health
+import mcp_server
+import mcp_session_state
+import review_workflow_load
+import reviewer_pr_lease
+
+from tests.test_runtime_clarity import CONFIG_SWITCHING_ENABLED
+
+
+class TestProfileSwitchReviewGuard(unittest.TestCase):
+    def setUp(self):
+        self._remotes_patch = patch.dict(mcp_server.REMOTES, {
+            "dadeschools": {"host": "gitea.example.com", "org": "Example-Org", "repo": "Example-Repo"},
+            "prgs": {"host": "gitea.example.com", "org": "Example-Org", "repo": "Example-Repo"},
+        })
+        self._remotes_patch.start()
+        mcp_server._IDENTITY_CACHE.clear()
+        gitea_config._active_profile_override = None
+        self._dir = tempfile.TemporaryDirectory()
+        self.config_path = os.path.join(self._dir.name, "profiles.json")
+        with open(self.config_path, "w", encoding="utf-8") as fh:
+            fh.write(json.dumps(CONFIG_SWITCHING_ENABLED))
+
+    def tearDown(self):
+        self._remotes_patch.stop()
+        mcp_server._IDENTITY_CACHE.clear()
+        gitea_config._active_profile_override = None
+        self._dir.cleanup()
+
+    def _env(self, profile="reviewer-profile"):
+        return {
+            "GITEA_MCP_CONFIG": self.config_path,
+            "GITEA_MCP_PROFILE": profile,
+            "GITEA_TOKEN_AUTHOR": "author-pass",
+            "GITEA_TOKEN_REVIEWER": "reviewer-pass",
+            "GITEA_TOKEN_MERGER": "merger-pass",
+        }
+
+    def _seed_contaminated_review_state(self):
+        """Simulate an in-flight reviewer run under reviewer-profile."""
+        mcp_server._preflight_whoami_called = True
+        mcp_server._preflight_capability_called = True
+        mcp_server._preflight_resolved_role = "reviewer"
+        mcp_server._preflight_resolved_task = "review_pr"
+        review_workflow_load._REVIEW_WORKFLOW_LOAD = {"loaded": True}
+        mcp_server._REVIEW_DECISION_LOCK = {
+            "session_profile": "reviewer-profile",
+            "final_review_decision_ready": True,
+            "ready_pr_number": 688,
+        }
+        reviewer_pr_lease.record_session_lease(
+            {"session_id": "lease-session-1", "pr_number": 688}
+        )
+        mcp_server._LIVE_NAMESPACE_HEALTH["gitea-reviewer"] = {
+            "namespace": "gitea-reviewer",
+            "healthy": True,
+            "ide_namespace_proven": True,
+        }
+        # Durable records keyed by the reviewer identity must also be cleared.
+        mcp_session_state.save_state(
+            kind=mcp_session_state.KIND_WORKFLOW_LOAD,
+            payload={"loaded": True},
+            profile_identity="reviewer-profile",
+        )
+        mcp_session_state.save_state(
+            kind=mcp_session_state.KIND_DECISION_LOCK,
+            payload={"final_review_decision_ready": True, "ready_pr_number": 688},
+            profile_identity="reviewer-profile",
+        )
+
+    def _activate(self, target, logins):
+        with patch.object(
+            mcp_server, "get_auth_header", side_effect=[f"token p" for _ in logins]
+        ), patch.object(
+            mcp_server, "api_request", side_effect=[{"login": l} for l in logins]
+        ), patch.object(
+            mcp_server,
+            "_workspace_repository_slug",
+            return_value="Example-Org/Example-Repo",
+        ), patch.object(
+            mcp_server, "_canonical_repository_slug", return_value=(None, [])
+        ):
+            return mcp_server.gitea_activate_profile(profile_name=target)
+
+    # -----------------------------------------------------------------
+    # AC1/AC2/AC3: switch invalidates review state; re-preflight required
+    # -----------------------------------------------------------------
+    def test_switch_invalidates_review_state_and_blocks_verdict(self):
+        with patch.dict(os.environ, self._env("reviewer-profile"), clear=True):
+            self._seed_contaminated_review_state()
+            res = self._activate("author-profile", ["reviewer-user", "author-user"])
+
+            self.assertTrue(res["success"])
+            self.assertTrue(res["re_preflight_required"])
+            inv = res["review_state_invalidation"]
+            self.assertEqual(inv["from_profile"], "reviewer-profile")
+            self.assertEqual(inv["to_profile"], "author-profile")
+            for item in (
+                "preflight_identity_capability",
+                "review_workflow_load",
+                "review_decision_lock",
+                "reviewer_session_lease",
+                "live_namespace_health",
+            ):
+                self.assertIn(item, inv["invalidated"])
+
+            # In-memory state cleared.
+            self.assertFalse(mcp_server._preflight_whoami_called)
+            self.assertFalse(mcp_server._preflight_capability_called)
+            self.assertIsNone(mcp_server._preflight_resolved_task)
+            self.assertIsNone(review_workflow_load._REVIEW_WORKFLOW_LOAD)
+            self.assertIsNone(mcp_server._REVIEW_DECISION_LOCK)
+            self.assertIsNone(reviewer_pr_lease.get_session_lease())
+            self.assertEqual(mcp_server._LIVE_NAMESPACE_HEALTH, {})
+            self.assertIsNotNone(mcp_server._PROFILE_SWITCH_INVALIDATION)
+
+            # Durable records keyed by the reviewer identity are gone.
+            self.assertIsNone(
+                mcp_session_state.load_state(
+                    kind=mcp_session_state.KIND_WORKFLOW_LOAD,
+                    profile_identity="reviewer-profile",
+                )
+            )
+            self.assertIsNone(
+                mcp_session_state.load_state(
+                    kind=mcp_session_state.KIND_DECISION_LOCK,
+                    profile_identity="reviewer-profile",
+                )
+            )
+
+            # A formal verdict without re-preflight fails closed.
+            reasons = mcp_server.check_review_decision_gate(
+                688, "APPROVE", final_review_decision_ready=True
+            )
+            self.assertTrue(reasons)
+
+    def test_switch_back_cannot_resurrect_stale_review_run(self):
+        with patch.dict(os.environ, self._env("reviewer-profile"), clear=True):
+            self._seed_contaminated_review_state()
+            self._activate("author-profile", ["reviewer-user", "author-user"])
+            res = self._activate("reviewer-profile", ["author-user", "reviewer-user"])
+
+            self.assertTrue(res["success"])
+            # The pre-switch review run must not reappear.
+            self.assertIsNone(mcp_server._REVIEW_DECISION_LOCK)
+            self.assertIsNone(review_workflow_load._REVIEW_WORKFLOW_LOAD)
+            self.assertIsNone(reviewer_pr_lease.get_session_lease())
+            status = review_workflow_load.workflow_load_status()
+            self.assertFalse(status["workflow_load_valid"])
+            reasons = mcp_server.check_review_decision_gate(
+                688, "APPROVE", final_review_decision_ready=True
+            )
+            self.assertTrue(reasons)
+
+    def test_same_profile_reactivation_keeps_state(self):
+        with patch.dict(os.environ, self._env("reviewer-profile"), clear=True):
+            self._seed_contaminated_review_state()
+            res = self._activate("reviewer-profile", ["reviewer-user", "reviewer-user"])
+            self.assertTrue(res["success"], res)
+            self.assertNotIn("review_state_invalidation", res)
+            self.assertIsNotNone(mcp_server._REVIEW_DECISION_LOCK)
+            self.assertTrue(mcp_server._preflight_whoami_called)
+
+    def test_clean_repreflight_after_switch_allows_gate(self):
+        with patch.dict(os.environ, self._env("reviewer-profile"), clear=True):
+            self._seed_contaminated_review_state()
+            self._activate("author-profile", ["reviewer-user", "author-user"])
+            self._activate("reviewer-profile", ["author-user", "reviewer-user"])
+
+            # Re-establish the full reviewer preflight under the new profile.
+            mcp_server.record_preflight_check("whoami")
+            mcp_server.record_preflight_check(
+                "capability", resolved_role="reviewer", resolved_task="review_pr"
+            )
+            mcp_server.init_review_decision_lock("dadeschools", "review_pr")
+            lock = mcp_server._load_review_decision_lock()
+            self.assertIsNotNone(lock)
+            lock.update(
+                {
+                    "final_review_decision_ready": True,
+                    "ready_pr_number": 688,
+                    "ready_action": "APPROVE",
+                    "ready_remote": "dadeschools",
+                    "ready_org": "Example-Org",
+                    "ready_repo": "Example-Repo",
+                }
+            )
+            mcp_server._save_review_decision_lock(lock)
+
+            with patch.object(
+                mcp_server, "_review_workflow_load_gate_reasons", return_value=[]
+            ):
+                reasons = mcp_server.check_review_decision_gate(
+                    688,
+                    "APPROVE",
+                    final_review_decision_ready=True,
+                    remote="dadeschools",
+                )
+            self.assertEqual(reasons, [])
+
+    # -----------------------------------------------------------------
+    # AC4: namespace provenance reporting + fail-closed mismatch
+    # -----------------------------------------------------------------
+    def test_namespace_provenance_mismatch_detection(self):
+        prov = mcp_namespace_health.namespace_provenance(
+            task="review_pr",
+            active_profile="reviewer-profile",
+            env={"GITEA_MCP_NAMESPACE": "gitea-author"},
+        )
+        self.assertTrue(prov["mismatch"])
+        self.assertEqual(prov["required_namespace"], "gitea-reviewer")
+
+        prov_ok = mcp_namespace_health.namespace_provenance(
+            task="review_pr",
+            active_profile="reviewer-profile",
+            env={"GITEA_MCP_NAMESPACE": "gitea-reviewer"},
+        )
+        self.assertFalse(prov_ok["mismatch"])
+
+        prov_unknown = mcp_namespace_health.namespace_provenance(
+            task="review_pr", active_profile="reviewer-profile", env={}
+        )
+        self.assertIsNone(prov_unknown["configured_namespace"])
+        self.assertFalse(prov_unknown["mismatch"])
+        self.assertEqual(prov_unknown["namespace_source"], "unknown")
+
+    @patch("mcp_server.api_request", return_value={"login": "reviewer-user"})
+    @patch("mcp_server.get_auth_header", return_value="token reviewer-pass")
+    def test_whoami_reports_namespace_provenance(self, _auth, _api):
+        env = self._env("reviewer-profile")
+        env["GITEA_MCP_NAMESPACE"] = "gitea-reviewer"
+        with patch.dict(os.environ, env, clear=True):
+            res = mcp_server.gitea_whoami(remote="dadeschools")
+        prov = res["namespace_provenance"]
+        self.assertEqual(prov["configured_namespace"], "gitea-reviewer")
+        self.assertEqual(prov["active_profile"], "reviewer-profile")
+        self.assertFalse(prov["mismatch"])
+
+    @patch("mcp_server.api_request", return_value={"login": "reviewer-user"})
+    @patch("mcp_server.get_auth_header", return_value="token reviewer-pass")
+    def test_resolve_fails_closed_on_namespace_mismatch(self, _auth, _api):
+        env = self._env("reviewer-profile")
+        env["GITEA_MCP_NAMESPACE"] = "gitea-author"
+        with patch.dict(os.environ, env, clear=True):
+            res = mcp_server.gitea_resolve_task_capability(
+                task="review_pr", kwargs="{}", remote="dadeschools"
+            )
+        self.assertFalse(res["allowed_in_current_session"])
+        self.assertTrue(res["namespace_provenance"]["mismatch"])
+        self.assertTrue(
+            any("namespace" in g for g in res["task_role_guidance"])
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()