fix: anti-stomp capability auth, inventory wiring, side-effect proof (#604)

Address REQUEST_CHANGES on PR #680:

Blocker A — role vs capability agreement
- authorization_compatible allows reviewer/merger when they hold the task's
  required permission (e.g. gitea.issue.comment on comment_issue/mark_issue/
  set_issue_labels/lock_issue) without broad role-bypass.
- Unauthorized escalation without the permission remains fail closed.
- Regression coverage for allowed and denied reviewer/merger cases.

Blocker B — MUTATION_TASKS matches runtime wiring
- Remove unenforced entries; document dedicated-gate exclusions
  (mark_final_review_decision, save/resume_review_draft, etc.).
- Wire non-closing gitea_edit_pr as edit_pr; acquire lease uses
  acquire_reviewer_pr_lease task through verify_preflight_purity.
- Inventory↔wiring consistency tests replace set-membership-only coverage.

Blocker C — entrypoint side-effect ordering
- Behavioral tests for merge_pr, submit_pr_review, and comment_issue prove
  the assessor block aborts before Gitea API mutation and local durable writes.

Validation: 43 focused anti-stomp + related suites green; full suite
2639 passed / 6 skipped.

Closes #604

anti_stomp_preflight.py

@@ -0,0 +1,807 @@
+"""Common anti-stomp preflight for every MCP mutation tool (#604).
+
+Even with leases, mutation tools need a **shared** preflight that prevents
+stale sessions, wrong worktrees, wrong repos, old prompts, terminal locks,
+foreign leases, contaminated approvals, and root-checkout mutations from
+slipping through.
+
+This module is the pure assessment core. Callers (MCP mutation entrypoints)
+gather live facts and pass them in — nothing here performs git, network, or
+durable-state I/O. Existing happy-path guards remain authoritative; this
+module composes them into one typed, fail-closed result.
+
+Required checks (issue #604):
+
+* repo/org verification
+* profile/role verification
+* root checkout clean and not used for mutation (when role requires branches/)
+* worktree under branches when required
+* active lease ownership (when lease is required for the mutation)
+* terminal lock status (when applicable)
+* expected head SHA (when pinned)
+* stale runtime status
+* workflow hash (when a workflow load is required)
+* source contamination status
+* no manual state/mtime/source-file bypass
+
+Failure returns a typed blocker and an exact next action. There is **no**
+agent-facing bypass flag.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+import author_mutation_worktree
+import master_parity_gate
+import remote_repo_guard
+import root_checkout_guard
+import stable_branch_push_guard
+
+# ── public constants ──────────────────────────────────────────────────────────
+
+# Typed blocker kinds returned in the structured result.
+BLOCKER_WRONG_REPO = "wrong_repo"
+BLOCKER_WRONG_ROLE = "wrong_role"
+BLOCKER_ROOT_CHECKOUT = "root_checkout_mutation"
+BLOCKER_WRONG_WORKTREE = "wrong_worktree"
+BLOCKER_FOREIGN_LEASE = "foreign_lease"
+BLOCKER_TERMINAL_LOCK = "terminal_lock"
+BLOCKER_HEAD_SHA = "head_sha_mismatch"
+BLOCKER_STALE_RUNTIME = "stale_runtime"
+BLOCKER_WORKFLOW_HASH = "workflow_hash"
+BLOCKER_SOURCE_CONTAMINATION = "source_contamination"
+BLOCKER_MANUAL_BYPASS = "manual_bypass"
+
+BLOCKER_KINDS = frozenset({
+    BLOCKER_WRONG_REPO,
+    BLOCKER_WRONG_ROLE,
+    BLOCKER_ROOT_CHECKOUT,
+    BLOCKER_WRONG_WORKTREE,
+    BLOCKER_FOREIGN_LEASE,
+    BLOCKER_TERMINAL_LOCK,
+    BLOCKER_HEAD_SHA,
+    BLOCKER_STALE_RUNTIME,
+    BLOCKER_WORKFLOW_HASH,
+    BLOCKER_SOURCE_CONTAMINATION,
+    BLOCKER_MANUAL_BYPASS,
+})
+
+# Mutation tasks that must invoke the shared anti-stomp preflight before
+# acting (issue #604 AC1). Every member must appear as a live task= kwarg
+# to verify_preflight_purity / _run_anti_stomp_preflight (or the review
+# anti_task map) in gitea_mcp_server.py. Inventory↔wiring tests fail if
+# a declared task is not wired.
+MUTATION_TASKS = frozenset({
+    "create_issue",
+    "comment_issue",
+    "close_issue",
+    "mark_issue",
+    "lock_issue",
+    "set_issue_labels",
+    "create_label",
+    "create_pr",
+    "close_pr",
+    "edit_pr",
+    "commit_files",
+    "gitea_commit_files",
+    "delete_branch",
+    "cleanup_merged_pr_branch",
+    "cleanup_stale_claims",
+    "reconcile_merged_cleanups",
+    "reconcile_already_landed_pr",
+    "reconcile_close_superseded_pr",
+    "post_heartbeat",
+    "acquire_reviewer_pr_lease",
+    "gitea_acquire_reviewer_pr_lease",
+    "adopt_merger_pr_lease",
+    "review_pr",
+    "submit_pr_review",
+    "approve_pr",
+    "request_changes_pr",
+    "merge_pr",
+})
+
+# Intentionally excluded from MUTATION_TASKS. Each has a dedicated
+# fail-closed gate that preserves decision-lock ownership, workflow-hash,
+# head-SHA, and repository consistency. Do not re-add without either
+# wiring shared preflight or updating this rationale (#604 Blocker B).
+DEDICATED_GATE_MUTATIONS: dict[str, str] = {
+    "mark_final_review_decision": (
+        "Local review-decision lock only. Enforced by session lock ownership, "
+        "workflow-hash, expected head SHA, PR work lease, eligibility, and "
+        "terminal-lock gates. No Gitea review POST; shared anti-stomp would "
+        "duplicate without side-effect-ordering value."
+    ),
+    "save_review_draft": (
+        "Local session-state draft save with live PR head/base consistency "
+        "checks. Not a Gitea review/merge mutation; dedicated head-SHA and "
+        "worktree resolution gates apply."
+    ),
+    "resume_review_draft": (
+        "Live-state resume with terminal lock, lease ownership, head/base SHA, "
+        "and parity checks. When submit=True, delegates to gitea_submit_pr_review "
+        "which runs shared anti-stomp before the Gitea review POST."
+    ),
+    "cleanup_stale_review_decision_lock": (
+        "Moot-lock cleanup with identity match, live PR merged/closed proof, "
+        "and reviewer capability gate (#594). Distinct from shared anti-stomp."
+    ),
+    "gitea_cleanup_stale_review_decision_lock": (
+        "Alias of cleanup_stale_review_decision_lock; dedicated #594 path."
+    ),
+    "heartbeat_reviewer_pr_lease": (
+        "Lease heartbeat posts via verify_preflight_purity(task='review_pr') "
+        "plus in-session lease ownership checks; not a separate mutation class."
+    ),
+    "release_reviewer_pr_lease": (
+        "Lease release uses workspace binding + ownership checks; posts only "
+        "when the session owns the active lease."
+    ),
+}
+
+# Roles that must mutate from a branches/ worktree (not the control checkout).
+_BRANCHES_REQUIRED_ROLES = frozenset({"author"})
+
+# Reviewer/merger mutations that require an owned lease + head pinning when
+# the caller supplies those facts.
+_LEASE_AWARE_TASKS = frozenset({
+    "review_pr",
+    "submit_pr_review",
+    "approve_pr",
+    "request_changes_pr",
+    "merge_pr",
+    "acquire_reviewer_pr_lease",
+    "gitea_acquire_reviewer_pr_lease",
+    "adopt_merger_pr_lease",
+})
+
+_NEXT_ACTIONS: dict[str, str] = {
+    BLOCKER_WRONG_REPO: (
+        "Pass explicit org= and repo= matching the local git remote "
+        "(e.g. org=Scaled-Tech-Consulting repo=Gitea-Tools) and retry."
+    ),
+    BLOCKER_WRONG_ROLE: (
+        "Call gitea_resolve_task_capability, switch to the required "
+        "namespace/profile, re-verify with gitea_whoami, then retry."
+    ),
+    BLOCKER_ROOT_CHECKOUT: (
+        "Leave the root control checkout on clean master; create or switch "
+        "to a session-owned worktree under branches/ and retry the mutation "
+        "with worktree_path set."
+    ),
+    BLOCKER_WRONG_WORKTREE: (
+        "Create or bind a session-owned worktree under branches/, set "
+        "worktree_path (or GITEA_ACTIVE_WORKTREE), and retry."
+    ),
+    BLOCKER_FOREIGN_LEASE: (
+        "Stop. Do not stomp a foreign lease. Wait for expiry, request "
+        "takeover through the sanctioned path, or hand off to the owner."
+    ),
+    BLOCKER_TERMINAL_LOCK: (
+        "Stop. A terminal review-decision lock is active for this head. "
+        "Do not re-approve/merge; follow the #332/#620 recovery path."
+    ),
+    BLOCKER_HEAD_SHA: (
+        "Re-fetch the live PR head with gitea_view_pr, re-pin "
+        "expected_head_sha to the current head, re-validate, then retry."
+    ),
+    BLOCKER_STALE_RUNTIME: (
+        "Restart the Gitea MCP server so it reloads master's capability "
+        "gates, re-run gitea_whoami + gitea_resolve_task_capability, then retry."
+    ),
+    BLOCKER_WORKFLOW_HASH: (
+        "Reload the canonical workflow via gitea_load_review_workflow, then "
+        "rerun the full review-merge workflow from inventory (no approve/merge replay)."
+    ),
+    BLOCKER_SOURCE_CONTAMINATION: (
+        "Stop. Session is source-contaminated. Hand off to a reconciler for "
+        "audit/clear; do not clear markers by deleting session-state files."
+    ),
+    BLOCKER_MANUAL_BYPASS: (
+        "Stop. Manual state/mtime/source-file bypass is forbidden. Use "
+        "sanctioned MCP tools only; never delete or rewrite session-state "
+        "or lock files by hand."
+    ),
+}
+
+
+def is_mutation_task(task: str | None) -> bool:
+    """True when *task* is in the #604 mutation set (normalized)."""
+    name = (task or "").strip().lower().removeprefix("gitea_")
+    if not name:
+        return False
+    if name in MUTATION_TASKS:
+        return True
+    # Accept gitea_ prefixed membership for aliases already in the set.
+    return f"gitea_{name}" in MUTATION_TASKS
+
+
+def roles_compatible(active_role: str | None, required_role: str | None) -> bool:
+    """Whether *active_role* may perform a task that maps to *required_role*.
+
+    Exact match always passes. Reconcilers may run author-class mutations
+    (comment/close/cleanup) that the capability map stamps as ``author`` —
+    matching the long-standing reconciler exemption for control-checkout
+    work. No other cross-role substitutions are allowed.
+
+    Capability-authorized multi-role tasks (e.g. reviewer holding
+    ``gitea.issue.comment`` for ``comment_issue``) are handled by
+    :func:`authorization_compatible`, not by expanding this role matrix.
+    """
+    active = (active_role or "").strip().lower()
+    required = (required_role or "").strip().lower()
+    if not active or not required:
+        return True
+    if active == required:
+        return True
+    if active == "reconciler" and required in {"author", "reconciler"}:
+        return True
+    return False
+
+
+def authorization_compatible(
+    active_role: str | None,
+    required_role: str | None,
+    *,
+    required_permission: str | None = None,
+    allowed_operations: Any = None,
+) -> bool:
+    """Whether the active session may run a task given role *and* capability.
+
+    Order:
+
+    1. :func:`roles_compatible` (exact role or narrow reconciler→author).
+    2. Capability possession: when *required_permission* is non-empty and
+       present in *allowed_operations*, allow even if the nominal task role
+       differs (e.g. reviewer/merger with ``gitea.issue.comment`` on
+       ``comment_issue`` / ``mark_issue`` / ``set_issue_labels`` /
+       ``lock_issue``).
+
+    Fail closed otherwise. This is **not** a broad reviewer→author or
+    merger→author role rewrite: without the specific permission the check
+    still denies. Missing *allowed_operations* when a permission is required
+    also fails closed (callers must supply the live profile op list).
+    """
+    if roles_compatible(active_role, required_role):
+        return True
+    perm = (required_permission or "").strip()
+    if not perm:
+        return False
+    if allowed_operations is None:
+        return False
+    try:
+        ops = {str(o).strip() for o in allowed_operations if o is not None}
+    except TypeError:
+        return False
+    return perm in ops
+
+
+def _blocker(
+    kind: str,
+    reasons: list[str],
+    *,
+    exact_next_action: str | None = None,
+    detail: dict | None = None,
+) -> dict[str, Any]:
+    if kind not in BLOCKER_KINDS:
+        raise ValueError(f"unknown anti-stomp blocker kind: {kind!r}")
+    return {
+        "kind": kind,
+        "reasons": list(reasons),
+        "exact_next_action": exact_next_action or _NEXT_ACTIONS[kind],
+        "detail": dict(detail or {}),
+    }
+
+
+def _allowed_result(checks: dict[str, Any]) -> dict[str, Any]:
+    return {
+        "allowed": True,
+        "block": False,
+        "blockers": [],
+        "reasons": [],
+        "exact_next_action": "proceed",
+        "blocker_kind": None,
+        "checks": checks,
+    }
+
+
+def _blocked_result(
+    blockers: list[dict[str, Any]],
+    checks: dict[str, Any],
+) -> dict[str, Any]:
+    primary = blockers[0]
+    all_reasons: list[str] = []
+    for b in blockers:
+        for r in b.get("reasons") or []:
+            if r not in all_reasons:
+                all_reasons.append(r)
+    return {
+        "allowed": False,
+        "block": True,
+        "blockers": blockers,
+        "reasons": all_reasons,
+        "exact_next_action": primary["exact_next_action"],
+        "blocker_kind": primary["kind"],
+        "checks": checks,
+    }
+
+
+def assess_anti_stomp_preflight(
+    *,
+    task: str | None = None,
+    # repo/org
+    remote: str | None = None,
+    resolved_org: str | None = None,
+    resolved_repo: str | None = None,
+    local_remote_url: str | None = None,
+    org_explicit: bool = False,
+    repo_explicit: bool = False,
+    check_repo: bool = True,
+    # profile/role + capability
+    profile_name: str | None = None,
+    profile_role: str | None = None,
+    required_role: str | None = None,
+    required_permission: str | None = None,
+    allowed_operations: Any = None,
+    check_role: bool = True,
+    # root checkout + worktree
+    workspace_path: str | None = None,
+    project_root: str | None = None,
+    current_branch: str | None = None,
+    root_head_sha: str | None = None,
+    root_porcelain: str | None = None,
+    remote_master_sha: str | None = None,
+    check_root_checkout: bool = True,
+    check_worktree: bool = True,
+    # stale runtime (master parity)
+    startup_head: str | None = None,
+    current_code_head: str | None = None,
+    check_stale_runtime: bool = True,
+    # lease ownership
+    lease_required: bool = False,
+    foreign_lease: bool | None = None,
+    lease_owner_session: str | None = None,
+    active_session_id: str | None = None,
+    lease_owner_identity: str | None = None,
+    active_identity: str | None = None,
+    lease_reasons: list[str] | None = None,
+    # terminal lock
+    terminal_lock_blocks: bool | None = None,
+    terminal_lock_reasons: list[str] | None = None,
+    # expected head SHA
+    require_head_sha: bool = False,
+    expected_head_sha: str | None = None,
+    live_head_sha: str | None = None,
+    # workflow hash
+    workflow_hash_valid: bool | None = None,
+    workflow_hash_reasons: list[str] | None = None,
+    # source contamination (stable-branch push / approval contamination)
+    source_contaminated: bool | None = None,
+    contamination_reasons: list[str] | None = None,
+    # manual bypass
+    manual_bypass_attempted: bool = False,
+    manual_bypass_reasons: list[str] | None = None,
+) -> dict[str, Any]:
+    """Fail-closed common anti-stomp assessment (pure).
+
+    Only checks for which facts are supplied (or which are required by the
+    mutation category) are evaluated. Unsupplied optional facts are recorded
+    as ``skipped`` so callers can see coverage without inventing defaults.
+
+    Returns a structured dict with ``allowed``/``block``, typed ``blockers``,
+    aggregated ``reasons``, ``exact_next_action``, and per-check ``checks``.
+    """
+    task_name = (task or "").strip()
+    role = (profile_role or "").strip().lower() or None
+    req_role = (required_role or "").strip().lower() or None
+    req_perm = (required_permission or "").strip() or None
+    checks: dict[str, Any] = {
+        "task": task_name or None,
+        "profile_name": profile_name,
+        "profile_role": role,
+        "required_role": req_role,
+        "required_permission": req_perm,
+    }
+    blockers: list[dict[str, Any]] = []
+
+    # ── manual bypass (always first; never skippable when attempted) ─────────
+    if manual_bypass_attempted:
+        reasons = list(manual_bypass_reasons or [
+            "manual state/mtime/source-file bypass attempt detected (fail closed)"
+        ])
+        blockers.append(_blocker(BLOCKER_MANUAL_BYPASS, reasons))
+        checks["manual_bypass"] = {"block": True, "reasons": reasons}
+    else:
+        checks["manual_bypass"] = {"block": False, "skipped": False}
+
+    # ── repo/org ─────────────────────────────────────────────────────────────
+    if check_repo and resolved_org is not None and resolved_repo is not None:
+        repo_assessment = remote_repo_guard.assess_remote_repo_match(
+            remote=remote or "",
+            resolved_org=resolved_org,
+            resolved_repo=resolved_repo,
+            local_remote_url=local_remote_url,
+            org_explicit=org_explicit,
+            repo_explicit=repo_explicit,
+        )
+        checks["repo"] = {
+            "block": bool(repo_assessment.get("block")),
+            "reasons": list(repo_assessment.get("reasons") or []),
+            "resolved_org": resolved_org,
+            "resolved_repo": resolved_repo,
+        }
+        if repo_assessment.get("block"):
+            blockers.append(
+                _blocker(
+                    BLOCKER_WRONG_REPO,
+                    list(repo_assessment.get("reasons") or ["repo/org mismatch"]),
+                    detail={
+                        "resolved_org": resolved_org,
+                        "resolved_repo": resolved_repo,
+                        "local_remote_url": local_remote_url,
+                    },
+                )
+            )
+    else:
+        checks["repo"] = {"block": False, "skipped": True}
+
+    # ── profile/role + capability ────────────────────────────────────────────
+    # Role match OR possession of the task's required permission (Blocker A).
+    # Reviewer/merger may run issue-comment-class tasks when they hold
+    # gitea.issue.comment; unauthorized escalation without the permission
+    # still fails closed.
+    if check_role and req_role and role:
+        authorized = authorization_compatible(
+            role,
+            req_role,
+            required_permission=req_perm,
+            allowed_operations=allowed_operations,
+        )
+        if not authorized:
+            perm_clause = (
+                f", required_permission='{req_perm}'" if req_perm else ""
+            )
+            reasons = [
+                f"active profile role '{role}' is not authorized for task "
+                f"'{task_name or '(unknown)'}' (required_role='{req_role}'"
+                f"{perm_clause}; profile={profile_name or '(unknown)'})"
+            ]
+            checks["role"] = {
+                "block": True,
+                "reasons": reasons,
+                "required_permission": req_perm,
+                "capability_authorized": False,
+            }
+            blockers.append(
+                _blocker(
+                    BLOCKER_WRONG_ROLE,
+                    reasons,
+                    detail={
+                        "profile_name": profile_name,
+                        "profile_role": role,
+                        "required_role": req_role,
+                        "required_permission": req_perm,
+                    },
+                )
+            )
+        else:
+            checks["role"] = {
+                "block": False,
+                "reasons": [],
+                "required_permission": req_perm,
+                "capability_authorized": bool(
+                    req_perm
+                    and allowed_operations is not None
+                    and req_perm in {
+                        str(o).strip() for o in (allowed_operations or [])
+                        if o is not None
+                    }
+                    and not roles_compatible(role, req_role)
+                ),
+            }
+    else:
+        checks["role"] = {"block": False, "skipped": True}
+
+    # ── stale runtime (master parity) ────────────────────────────────────────
+    if check_stale_runtime and (
+        startup_head is not None or current_code_head is not None
+    ):
+        parity = master_parity_gate.assess_master_parity(
+            {"startup_head": startup_head},
+            current_code_head,
+        )
+        stale_reasons = master_parity_gate.parity_block_reasons(parity)
+        checks["stale_runtime"] = {
+            "block": bool(stale_reasons),
+            "reasons": list(stale_reasons),
+            "startup_head": startup_head,
+            "current_code_head": current_code_head,
+            "stale": bool(parity.get("stale")),
+        }
+        if stale_reasons:
+            blockers.append(
+                _blocker(
+                    BLOCKER_STALE_RUNTIME,
+                    list(stale_reasons),
+                    detail={
+                        "startup_head": startup_head,
+                        "current_code_head": current_code_head,
+                    },
+                )
+            )
+    else:
+        checks["stale_runtime"] = {"block": False, "skipped": True}
+
+    # ── root checkout ────────────────────────────────────────────────────────
+    if (
+        check_root_checkout
+        and workspace_path is not None
+        and project_root is not None
+        and root_porcelain is not None
+    ):
+        root_assessment = root_checkout_guard.assess_root_checkout_guard(
+            workspace_path=workspace_path,
+            canonical_repo_root=project_root,
+            current_branch=current_branch,
+            head_sha=root_head_sha,
+            porcelain_status=root_porcelain,
+            remote_master_sha=remote_master_sha,
+            resolved_role=req_role or role,
+            actual_role=role,
+        )
+        checks["root_checkout"] = {
+            "block": bool(root_assessment.get("block")),
+            "reasons": list(root_assessment.get("reasons") or []),
+        }
+        if root_assessment.get("block"):
+            blockers.append(
+                _blocker(
+                    BLOCKER_ROOT_CHECKOUT,
+                    list(root_assessment.get("reasons") or [
+                        "control checkout is not clean master"
+                    ]),
+                    detail={
+                        "workspace_path": workspace_path,
+                        "project_root": project_root,
+                        "current_branch": current_branch,
+                    },
+                )
+            )
+    else:
+        checks["root_checkout"] = {"block": False, "skipped": True}
+
+    # ── worktree under branches (author) ─────────────────────────────────────
+    worktree_role = role or req_role
+    if (
+        check_worktree
+        and workspace_path is not None
+        and project_root is not None
+        and worktree_role in _BRANCHES_REQUIRED_ROLES
+    ):
+        wt = author_mutation_worktree.assess_author_mutation_worktree(
+            workspace_path=workspace_path,
+            project_root=project_root,
+            current_branch=current_branch,
+        )
+        checks["worktree"] = {
+            "block": bool(wt.get("block")),
+            "reasons": list(wt.get("reasons") or []),
+            "under_branches": wt.get("under_branches"),
+        }
+        if wt.get("block"):
+            blockers.append(
+                _blocker(
+                    BLOCKER_WRONG_WORKTREE,
+                    list(wt.get("reasons") or [
+                        "mutation worktree is not under branches/"
+                    ]),
+                    detail={
+                        "workspace_path": workspace_path,
+                        "project_root": project_root,
+                    },
+                )
+            )
+    else:
+        checks["worktree"] = {
+            "block": False,
+            "skipped": worktree_role not in _BRANCHES_REQUIRED_ROLES
+            or workspace_path is None,
+        }
+
+    # ── foreign lease ────────────────────────────────────────────────────────
+    lease_needed = lease_required or (
+        task_name.removeprefix("gitea_") in {
+            t.removeprefix("gitea_") for t in _LEASE_AWARE_TASKS
+        }
+        and foreign_lease is not None
+    )
+    if lease_needed or foreign_lease is True:
+        is_foreign = bool(foreign_lease)
+        if foreign_lease is None and lease_required:
+            # Ownership must be proven when lease_required; missing ownership
+            # facts fail closed.
+            owner_ok = (
+                (not lease_owner_session and not active_session_id)
+                or (
+                    lease_owner_session
+                    and active_session_id
+                    and lease_owner_session == active_session_id
+                )
+            )
+            identity_ok = (
+                (not lease_owner_identity and not active_identity)
+                or (
+                    lease_owner_identity
+                    and active_identity
+                    and lease_owner_identity == active_identity
+                )
+            )
+            if not owner_ok or not identity_ok:
+                is_foreign = True
+        reasons = list(lease_reasons or [])
+        if is_foreign and not reasons:
+            reasons = [
+                "active lease is owned by a foreign session or identity "
+                "(anti-stomp fail closed)"
+            ]
+        checks["lease"] = {
+            "block": is_foreign,
+            "reasons": reasons if is_foreign else [],
+            "lease_owner_session": lease_owner_session,
+            "active_session_id": active_session_id,
+        }
+        if is_foreign:
+            blockers.append(
+                _blocker(BLOCKER_FOREIGN_LEASE, reasons)
+            )
+    else:
+        checks["lease"] = {"block": False, "skipped": True}
+
+    # ── terminal lock ────────────────────────────────────────────────────────
+    if terminal_lock_blocks is not None:
+        reasons = list(terminal_lock_reasons or [])
+        if terminal_lock_blocks and not reasons:
+            reasons = [
+                "terminal review-decision lock is active for this head "
+                "(anti-stomp fail closed)"
+            ]
+        checks["terminal_lock"] = {
+            "block": bool(terminal_lock_blocks),
+            "reasons": reasons if terminal_lock_blocks else [],
+        }
+        if terminal_lock_blocks:
+            blockers.append(_blocker(BLOCKER_TERMINAL_LOCK, reasons))
+    else:
+        checks["terminal_lock"] = {"block": False, "skipped": True}
+
+    # ── expected head SHA ────────────────────────────────────────────────────
+    if require_head_sha or (
+        expected_head_sha is not None and live_head_sha is not None
+    ):
+        exp = (expected_head_sha or "").strip().lower()
+        live = (live_head_sha or "").strip().lower()
+        mismatch = False
+        reasons: list[str] = []
+        if require_head_sha and not exp:
+            mismatch = True
+            reasons.append(
+                "expected_head_sha is required before this mutation "
+                "(anti-stomp fail closed)"
+            )
+        elif exp and live and exp != live:
+            mismatch = True
+            reasons.append(
+                f"expected_head_sha '{exp}' does not match live PR head "
+                f"'{live}' (anti-stomp fail closed; stale prompt data)"
+            )
+        elif require_head_sha and exp and not live:
+            mismatch = True
+            reasons.append(
+                "live PR head SHA could not be determined to corroborate "
+                "expected_head_sha (anti-stomp fail closed)"
+            )
+        checks["head_sha"] = {
+            "block": mismatch,
+            "reasons": reasons,
+            "expected_head_sha": expected_head_sha,
+            "live_head_sha": live_head_sha,
+        }
+        if mismatch:
+            blockers.append(_blocker(BLOCKER_HEAD_SHA, reasons))
+    else:
+        checks["head_sha"] = {"block": False, "skipped": True}
+
+    # ── workflow hash ────────────────────────────────────────────────────────
+    if workflow_hash_valid is not None:
+        reasons = list(workflow_hash_reasons or [])
+        if not workflow_hash_valid and not reasons:
+            reasons = [
+                "workflow load proof missing or hash stale "
+                "(anti-stomp fail closed)"
+            ]
+        checks["workflow_hash"] = {
+            "block": not bool(workflow_hash_valid),
+            "reasons": reasons if not workflow_hash_valid else [],
+        }
+        if not workflow_hash_valid:
+            blockers.append(_blocker(BLOCKER_WORKFLOW_HASH, reasons))
+    else:
+        checks["workflow_hash"] = {"block": False, "skipped": True}
+
+    # ── source contamination ─────────────────────────────────────────────────
+    if source_contaminated is not None:
+        reasons = list(contamination_reasons or [])
+        if source_contaminated and not reasons:
+            reasons = [
+                "session is source-contaminated (stable-branch push or "
+                "contaminated approval path); anti-stomp fail closed"
+            ]
+        checks["source_contamination"] = {
+            "block": bool(source_contaminated),
+            "reasons": reasons if source_contaminated else [],
+        }
+        if source_contaminated:
+            blockers.append(
+                _blocker(BLOCKER_SOURCE_CONTAMINATION, reasons)
+            )
+    else:
+        checks["source_contamination"] = {"block": False, "skipped": True}
+
+    if blockers:
+        return _blocked_result(blockers, checks)
+    return _allowed_result(checks)
+
+
+def format_anti_stomp_error(assessment: dict[str, Any]) -> str:
+    """Single RuntimeError message for MCP mutation gates."""
+    kind = assessment.get("blocker_kind") or "unknown"
+    reasons = "; ".join(
+        assessment.get("reasons")
+        or ["anti-stomp preflight blocked the mutation"]
+    )
+    next_action = assessment.get("exact_next_action") or "stop and diagnose"
+    return (
+        f"Anti-stomp preflight (#604) blocked mutation "
+        f"[{kind}]: {reasons}. "
+        f"exact_next_action: {next_action}"
+    )
+
+
+def block_response(
+    assessment: dict[str, Any],
+    **extra_fields: Any,
+) -> dict[str, Any]:
+    """Structured tool-return payload for a blocked mutation."""
+    payload = {
+        "success": False,
+        "performed": False,
+        "blocked": True,
+        "anti_stomp": True,
+        "blocker_kind": assessment.get("blocker_kind"),
+        "blockers": list(assessment.get("blockers") or []),
+        "reasons": list(assessment.get("reasons") or []),
+        "exact_next_action": assessment.get("exact_next_action"),
+        "checks": assessment.get("checks") or {},
+    }
+    payload.update(extra_fields)
+    return payload
+
+
+def contamination_from_stable_marker(
+    marker: dict | None,
+    *,
+    task: str | None,
+    actual_role: str | None,
+) -> tuple[bool, list[str]]:
+    """Derive source-contamination facts from a #671 durable marker."""
+    if not marker:
+        return False, []
+    gate = stable_branch_push_guard.assess_contamination_gate(
+        marker,
+        task=task,
+        actual_role=actual_role,
+    )
+    if gate.get("block"):
+        return True, list(gate.get("reasons") or [])
+    return False, []

gitea_mcp_server.py

@@ -619,284 +619,330 @@ def _enforce_branches_only_author_mutation(worktree_path: str | None = None) ->
         )
 
 
+def _anti_stomp_in_test_mode() -> bool:
+    """Whether the #604 anti-stomp gate is skipped under pytest.
+
+    Mirrors remote-repo / stable-contamination test bypasses so the existing
+    suite (bare remotes, mocked APIs) stays green. Set
+    ``GITEA_TEST_FORCE_ANTI_STOMP=1`` to exercise the live gate under tests.
+    """
+    if not _preflight_in_test_mode():
+        return False
+    return not bool(os.environ.get("GITEA_TEST_FORCE_ANTI_STOMP"))
+
+
+def _run_anti_stomp_preflight(
+    task: str | None,
+    *,
+    remote: str | None = None,
+    worktree_path: str | None = None,
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    expected_head_sha: str | None = None,
+    live_head_sha: str | None = None,
+    require_head_sha: bool = False,
+    lease_required: bool = False,
+    foreign_lease: bool | None = None,
+    lease_reasons: list[str] | None = None,
+    terminal_lock_blocks: bool | None = None,
+    terminal_lock_reasons: list[str] | None = None,
+    workflow_hash_valid: bool | None = None,
+    workflow_hash_reasons: list[str] | None = None,
+    raise_on_block: bool = True,
+) -> dict | None:
+    """Shared #604 anti-stomp preflight for MCP mutation entrypoints.
+
+    Gathers live workspace/parity/role/repo facts and invokes the pure
+    :func:`anti_stomp_preflight.assess_anti_stomp_preflight` assessor. On
+    block, raises ``RuntimeError`` (default) or returns a structured
+    :func:`anti_stomp_preflight.block_response` when *raise_on_block* is
+    False. Returns ``None`` when the mutation may proceed.
+    """
+    if _anti_stomp_in_test_mode():
+        return None
+
+    # Only enforce when the caller names a known mutation task. Read-only
+    # paths and legacy verify_preflight_purity calls without a task stay
+    # on the pre-#604 gate chain (whoami/capability/root/worktree).
+    if not task or not anti_stomp_preflight.is_mutation_task(task):
+        return None
+
+    profile = get_profile()
+    profile_name = profile.get("profile_name")
+    profile_role = _actual_profile_role()
+    allowed_operations = list(profile.get("allowed_operations") or [])
+    req_role = None
+    req_perm = None
+    if task:
+        try:
+            req_role = task_capability_map.required_role(task)
+        except KeyError:
+            req_role = _preflight_resolved_role
+        try:
+            req_perm = task_capability_map.required_permission(task)
+        except KeyError:
+            req_perm = None
+
+    ctx = _resolve_namespace_mutation_context(worktree_path)
+    workspace = ctx["workspace_path"]
+    canonical_root = ctx["canonical_repo_root"]
+    git_state = issue_lock_worktree.read_worktree_git_state(canonical_root)
+    remote_master_sha = root_checkout_guard.resolve_remote_master_sha(canonical_root)
+
+    # Repo/org facts (best-effort; explicit org/repo when provided).
+    resolved_org = org
+    resolved_repo = repo
+    local_remote_url = None
+    org_explicit = org is not None
+    repo_explicit = repo is not None
+    if remote:
+        try:
+            local_remote_url = _local_git_remote_url(remote)
+        except Exception:
+            local_remote_url = None
+        if resolved_org is None or resolved_repo is None:
+            try:
+                rem = _effective_remote(remote)
+                if rem in REMOTES:
+                    if resolved_org is None:
+                        resolved_org = REMOTES[rem]["org"]
+                    if resolved_repo is None:
+                        resolved_repo = REMOTES[rem]["repo"]
+            except Exception:
+                pass
+
+    parity = _current_master_parity()
+    startup_head = parity.get("startup_head")
+    current_code_head = parity.get("current_head")
+
+    # Source contamination from durable #671 marker (role-aware).
+    source_contaminated = None
+    contamination_reasons = None
+    try:
+        marker = _load_stable_contamination_marker(remote)
+        contaminated, cont_reasons = anti_stomp_preflight.contamination_from_stable_marker(
+            marker,
+            task=task,
+            actual_role=profile_role,
+        )
+        if marker is not None:
+            source_contaminated = contaminated
+            contamination_reasons = cont_reasons
+    except Exception:
+        # Fail soft on marker I/O: existing #671 enforcer still runs separately.
+        source_contaminated = None
+
+    # Workflow-hash facts when the task is review/merge oriented.
+    if workflow_hash_valid is None and task in {
+        "review_pr",
+        "submit_pr_review",
+        "approve_pr",
+        "request_changes_pr",
+        "merge_pr",
+    }:
+        try:
+            wf_reasons = _review_workflow_load_gate_reasons()
+            workflow_hash_valid = not bool(wf_reasons)
+            workflow_hash_reasons = list(wf_reasons) if wf_reasons else None
+        except Exception:
+            pass
+
+    # Mirror remote_repo_guard's pytest bypass: under the unit suite bare
+    # remote=prgs still defaults to Timesheet, and re-checking here would
+    # break happy-path reconciler/author tests that already rely on the
+    # #530 gate being opt-in via GITEA_FORCE_REMOTE_REPO_CHECK.
+    check_repo = True
+    if "pytest" in sys.modules and not os.environ.get(
+        "GITEA_FORCE_REMOTE_REPO_CHECK"
+    ):
+        check_repo = False
+
+    assessment = anti_stomp_preflight.assess_anti_stomp_preflight(
+        task=task,
+        remote=remote,
+        resolved_org=resolved_org,
+        resolved_repo=resolved_repo,
+        local_remote_url=local_remote_url,
+        org_explicit=org_explicit,
+        repo_explicit=repo_explicit,
+        check_repo=check_repo,
+        profile_name=profile_name,
+        profile_role=profile_role,
+        required_role=req_role or _preflight_resolved_role,
+        required_permission=req_perm,
+        allowed_operations=allowed_operations,
+        workspace_path=workspace,
+        project_root=canonical_root,
+        current_branch=git_state.get("current_branch"),
+        root_head_sha=git_state.get("head_sha"),
+        root_porcelain=git_state.get("porcelain_status") or "",
+        remote_master_sha=remote_master_sha,
+        startup_head=startup_head,
+        current_code_head=current_code_head,
+        lease_required=lease_required,
+        foreign_lease=foreign_lease,
+        lease_reasons=lease_reasons,
+        terminal_lock_blocks=terminal_lock_blocks,
+        terminal_lock_reasons=terminal_lock_reasons,
+        require_head_sha=require_head_sha,
+        expected_head_sha=expected_head_sha,
+        live_head_sha=live_head_sha,
+        workflow_hash_valid=workflow_hash_valid,
+        workflow_hash_reasons=workflow_hash_reasons,
+        source_contaminated=source_contaminated,
+        contamination_reasons=contamination_reasons,
+        manual_bypass_attempted=False,
+    )
+    if not assessment.get("block"):
+        return None
+    if raise_on_block:
+        raise RuntimeError(anti_stomp_preflight.format_anti_stomp_error(assessment))
+    return anti_stomp_preflight.block_response(assessment)
+
+
 def verify_preflight_purity(
     remote: str | None = None,
     worktree_path: str | None = None,
     task: str | None = None,
     *,
-    target_issue_number: int | None = None,
-    require_author_lock: bool = False,
+    expected_head_sha: str | None = None,
+    live_head_sha: str | None = None,
+    require_head_sha: bool = False,
+    lease_required: bool = False,
+    foreign_lease: bool | None = None,
+    lease_reasons: list[str] | None = None,
+    terminal_lock_blocks: bool | None = None,
+    terminal_lock_reasons: list[str] | None = None,
+    workflow_hash_valid: bool | None = None,
+    workflow_hash_reasons: list[str] | None = None,
+    org: str | None = None,
+    repo: str | None = None,
 ):
-    """Verify identity/capability order, then production workspace guards.
+    """Verify that identity and capability were verified prior to session edits.
 
-    #683: pytest/unittest must not skip production root/branches/scope
-    enforcement when force-on signals request production behavior. The
-    early return below only skips *preflight-order* purity checks under
-    pure unit-test isolation — never when production guards are active.
+    Also runs the shared #604 anti-stomp preflight for mutation tasks (typed
+    blocker + exact next action). Extended lease/head/terminal facts may be
+    supplied by review/merge callers.
     """
     global _preflight_reviewer_violation_files
 
     in_test = _preflight_in_test_mode()
-    production_active = workflow_scope_guard.production_guards_active(
-        in_test_mode=in_test
-    )
-    # Pure unit-test isolation: skip purity-order unless legacy dirty/porcelain
-    # force flags request the dirtiness path. #683 FORCE_PRODUCTION_GUARDS alone
-    # runs production root/branches/scope without requiring whoami/capability.
-    skip_purity_order = in_test and not workflow_scope_guard.purity_order_forced()
-
-    if not skip_purity_order:
-        if not _preflight_whoami_called:
-            raise RuntimeError(
-                "Pre-flight order violation: Identity (gitea_whoami) has not been verified (fail closed)"
-            )
-        if not _preflight_capability_called:
-            raise RuntimeError(
-                "Pre-flight order violation: Task capability (gitea_resolve_task_capability) has not been resolved (fail closed)"
-            )
-        if (
-            task is not None
-            and _preflight_resolved_task is not None
-            and task != _preflight_resolved_task
-        ):
-            raise RuntimeError(
-                "Pre-flight task mismatch: "
-                f"resolved '{_preflight_resolved_task}' but mutation requires "
-                f"'{task}' (fail closed)"
-            )
-
-        # #671: block review/merge/close/completion mutations while the session is
-        # contaminated by a direct stable-branch push attempt (reconciler-exempt).
-        _enforce_stable_branch_contamination_gate(task, remote)
-
-        ctx = _resolve_namespace_mutation_context(worktree_path)
-        workspace = ctx["workspace_path"]
-        canonical_root = ctx["canonical_repo_root"]
-        process_root = ctx["process_project_root"]
-        real_workspace = os.path.realpath(workspace)
-        role = ctx.get("workspace_role_kind") or _effective_workspace_role()
-
-        if real_workspace != process_root:
-            if not _preflight_in_test_mode():
-                membership = author_mutation_worktree.assess_workspace_repo_membership(
-                    workspace_path=workspace,
-                    canonical_repo_root=canonical_root,
-                )
-                if membership["block"]:
-                    raise RuntimeError(
-                        author_mutation_worktree.format_workspace_repo_membership_error(
-                            membership
-                        )
-                    )
-
-            dirty_files = sorted(
-                _parse_porcelain_entries(_get_workspace_porcelain(workspace))
-            )
-            if dirty_files:
-                raise RuntimeError(
-                    nwb.format_namespace_workspace_binding_error(
-                        role_kind=role,
-                        workspace_path=workspace,
-                        binding_source=ctx.get("workspace_binding_source")
-                        or "unknown binding source",
-                        dirty_files=dirty_files,
-                        ignored_bindings=ctx.get("ignored_bindings"),
-                    )
-                )
-        else:
-            if _preflight_whoami_violation:
-                raise RuntimeError(
-                    "Pre-flight order violation: Workspace file edits occurred before "
-                    f"gitea_whoami verification (fail closed). Offending files: "
-                    f"{_format_preflight_files(_preflight_whoami_violation_files)}"
-                )
-            if _preflight_capability_violation:
-                raise RuntimeError(
-                    "Pre-flight order violation: Workspace file edits occurred before "
-                    f"gitea_resolve_task_capability verification (fail closed). Offending files: "
-                    f"{_format_preflight_files(_preflight_capability_violation_files)}"
-                )
-
-            if role in {"reviewer", "merger"}:
-                current = _get_workspace_porcelain()
-                baseline = _preflight_capability_baseline_porcelain or ""
-                reviewer_delta = _new_tracked_changes_since(baseline, current)
-                _preflight_reviewer_violation_files = reviewer_delta
-                if reviewer_delta:
-                    raise RuntimeError(
-                        f"{role.title()} role violation: profile is forbidden from modifying "
-                        "tracked workspace files (fail closed). Offending files: "
-                        f"{_format_preflight_files(reviewer_delta)}"
-                    )
-
-        # Historical path: root + branches after purity-order when dirty paths live.
-        _enforce_root_checkout_guard(worktree_path)
-        _enforce_branches_only_author_mutation(worktree_path)
-        _enforce_issue_scope_guard(
-            worktree_path,
-            task=task,
-            target_issue_number=target_issue_number,
-            require_author_lock=require_author_lock,
-        )
-        _clear_preflight_capability_state()
+    if in_test and not (
+        os.environ.get("GITEA_TEST_FORCE_DIRTY")
+        or os.environ.get("GITEA_TEST_PORCELAIN") is not None
+        or os.environ.get("GITEA_TEST_FORCE_ANTI_STOMP")
+    ):
         return
 
-    # #683: under pytest unit isolation, FORCE_PRODUCTION_GUARDS still runs
-    # production root + branches + issue scope (no silent no-op of guards).
-    if production_active:
-        _enforce_root_checkout_guard(worktree_path)
-        _enforce_branches_only_author_mutation(worktree_path)
-        _enforce_issue_scope_guard(
-            worktree_path,
-            task=task,
-            target_issue_number=target_issue_number,
-            require_author_lock=require_author_lock,
+    if not _preflight_whoami_called:
+        raise RuntimeError(
+            "Pre-flight order violation: Identity (gitea_whoami) has not been verified (fail closed)"
+        )
+    if not _preflight_capability_called:
+        raise RuntimeError(
+            "Pre-flight order violation: Task capability (gitea_resolve_task_capability) has not been resolved (fail closed)"
+        )
+    if (
+        task is not None
+        and _preflight_resolved_task is not None
+        and task != _preflight_resolved_task
+    ):
+        raise RuntimeError(
+            "Pre-flight task mismatch: "
+            f"resolved '{_preflight_resolved_task}' but mutation requires "
+            f"'{task}' (fail closed)"
         )
 
+    # #671: block review/merge/close/completion mutations while the session is
+    # contaminated by a direct stable-branch push attempt (reconciler-exempt).
+    _enforce_stable_branch_contamination_gate(task, remote)
 
-def _session_issue_lock_snapshot(
-    workspace_path: str | None = None,
-) -> dict:
-    """Return session lock fields relevant to #683 scope enforcement.
-
-    Branch-vs-lock comparison uses the live workspace branch only when the
-    lock's worktree matches the mutation workspace. That prevents a foreign
-    or leftover session lock from poisoning unrelated test worktrees while
-    still fail-closing when the bound worktree drifts to another issue.
-    """
-    lock = issue_lock_store.read_session_issue_lock() or {}
-    raw = lock.get("issue_number")
-    locked: int | None
-    try:
-        locked = int(raw) if raw is not None else None
-    except (TypeError, ValueError):
-        locked = None
-    lock_wt = (lock.get("worktree_path") or "").strip()
-    workspace = (workspace_path or "").strip()
-    worktrees_match = False
-    if lock_wt and workspace:
-        try:
-            worktrees_match = os.path.realpath(lock_wt) == os.path.realpath(workspace)
-        except OSError:
-            worktrees_match = False
-    return {
-        "locked_issue_number": locked,
-        "lock_branch_name": (lock.get("branch_name") or "").strip() or None,
-        "lock_worktree_path": lock_wt or None,
-        "worktrees_match": worktrees_match,
-    }
-
-
-def _session_locked_issue_number() -> int | None:
-    """Return the active session issue lock number when present (#683)."""
-    return _session_issue_lock_snapshot().get("locked_issue_number")
-
-
-def _enforce_issue_scope_guard(
-    worktree_path: str | None = None,
-    *,
-    task: str | None = None,
-    target_issue_number: int | None = None,
-    require_author_lock: bool = False,
-) -> None:
-    """#683: fail closed on missing/out-of-scope issue ownership for mutations."""
     ctx = _resolve_namespace_mutation_context(worktree_path)
     workspace = ctx["workspace_path"]
-    git_state = issue_lock_worktree.read_worktree_git_state(workspace)
-    # Honour actual profile role as well as poisoned task role (#540 / #683):
-    # comment_issue preflight stamps required_role_kind=author, which must not
-    # strip a genuine reconciler of control-checkout exemptions.
+    canonical_root = ctx["canonical_repo_root"]
+    process_root = ctx["process_project_root"]
+    real_workspace = os.path.realpath(workspace)
     role = ctx.get("workspace_role_kind") or _effective_workspace_role()
-    actual = _actual_profile_role()
-    if actual in nwb.NON_AUTHOR_ROLES:
-        role = actual
-    snap = _session_issue_lock_snapshot(workspace)
-    # Scope uses the lock's recorded branch for issue-number matching.
-    # Live workspace branch can inherit the parent control checkout's branch
-    # name when a temp branches/ dir is not its own worktree tip — that must
-    # not invent a false out-of-scope failure. Live branch drift is enforced
-    # by issue_lock_store.verify_lock_for_mutation elsewhere.
-    branch_for_scope = snap.get("lock_branch_name")
-    if (
-        snap.get("worktrees_match")
-        and workflow_scope_guard.production_guards_forced()
-    ):
-        live_branch = git_state.get("current_branch")
-        live_issue = workflow_scope_guard.extract_issue_number_from_branch(
-            live_branch
-        )
-        locked = snap.get("locked_issue_number")
-        if (
-            live_issue is not None
-            and locked is not None
-            and live_issue != locked
-        ):
-            branch_for_scope = live_branch
-    # Author implementation / source-adjacent mutations need ownership when forced.
-    authorish = role == "author" or (
-        task
-        in {
-            "create_issue",
-            "comment_issue",
-            "lock_issue",
-            "create_pr",
-            "commit_files",
-            "gitea_commit_files",
-            "mark_issue",
-        }
-    )
-    require_lock = bool(require_author_lock) or (
-        authorish
-        and workflow_scope_guard.production_guards_forced()
-        and role == "author"
-    )
-    assessment = workflow_scope_guard.assess_production_mutation_guards(
-        workspace_path=workspace,
-        canonical_repo_root=ctx["canonical_repo_root"],
-        porcelain_status=git_state.get("porcelain_status") or "",
-        current_branch=branch_for_scope,
-        locked_issue_number=snap.get("locked_issue_number"),
-        target_issue_number=target_issue_number,
-        role_kind=role,
-        require_author_lock=require_lock,
-        in_test_mode=_preflight_in_test_mode(),
-    )
-    workflow_scope_guard.raise_if_blocked(assessment)
 
+    if real_workspace != process_root:
+        if not _preflight_in_test_mode():
+            membership = author_mutation_worktree.assess_workspace_repo_membership(
+                workspace_path=workspace,
+                canonical_repo_root=canonical_root,
+            )
+            if membership["block"]:
+                raise RuntimeError(
+                    author_mutation_worktree.format_workspace_repo_membership_error(
+                        membership
+                    )
+                )
 
-def _production_guard_block_from_exc(exc: BaseException, **extra) -> dict | None:
-    """Map production-guard exceptions to typed tool block responses (#683)."""
-    if isinstance(exc, workflow_scope_guard.ProductionGuardError):
-        return workflow_scope_guard.block_response(exc, **extra)
-    text = str(exc)
-    if "Workflow scope guard (#683)" in text or "Root checkout guard (#475)" in text:
-        kind = workflow_scope_guard.BLOCKER_PRODUCTION_GUARD
-        if "root_diagnostic_edit" in text or "tracked source or test edits" in text:
-            kind = workflow_scope_guard.BLOCKER_ROOT_DIAGNOSTIC_EDIT
-        elif "Branches-only mutation guard" in text or "stable control checkout" in text:
-            kind = workflow_scope_guard.BLOCKER_MISSING_WORKTREE
-        elif "out-of-scope" in text or "locked to issue" in text:
-            kind = workflow_scope_guard.BLOCKER_OUT_OF_SCOPE_ISSUE
-        elif "no owning issue" in text:
-            kind = workflow_scope_guard.BLOCKER_MISSING_ISSUE_SCOPE
-        return workflow_scope_guard.block_response(
-            blocker_kind=kind,
-            reasons=[text],
-            **extra,
-        )
-    if "Branches-only mutation guard" in text:
-        return workflow_scope_guard.block_response(
-            blocker_kind=workflow_scope_guard.BLOCKER_MISSING_WORKTREE,
-            reasons=[text],
-            **extra,
-        )
-    if "Root checkout guard" in text:
-        return workflow_scope_guard.block_response(
-            blocker_kind=workflow_scope_guard.BLOCKER_ROOT_DIAGNOSTIC_EDIT,
-            reasons=[text],
-            **extra,
-        )
-    return None
+        dirty_files = sorted(_parse_porcelain_entries(_get_workspace_porcelain(workspace)))
+        if dirty_files:
+            raise RuntimeError(
+                nwb.format_namespace_workspace_binding_error(
+                    role_kind=role,
+                    workspace_path=workspace,
+                    binding_source=ctx.get("workspace_binding_source")
+                    or "unknown binding source",
+                    dirty_files=dirty_files,
+                    ignored_bindings=ctx.get("ignored_bindings"),
+                )
+            )
+    else:
+        if _preflight_whoami_violation:
+            raise RuntimeError(
+                "Pre-flight order violation: Workspace file edits occurred before "
+                f"gitea_whoami verification (fail closed). Offending files: "
+                f"{_format_preflight_files(_preflight_whoami_violation_files)}"
+            )
+        if _preflight_capability_violation:
+            raise RuntimeError(
+                "Pre-flight order violation: Workspace file edits occurred before "
+                f"gitea_resolve_task_capability verification (fail closed). Offending files: "
+                f"{_format_preflight_files(_preflight_capability_violation_files)}"
+            )
+
+        if role in {"reviewer", "merger"}:
+            current = _get_workspace_porcelain()
+            baseline = _preflight_capability_baseline_porcelain or ""
+            reviewer_delta = _new_tracked_changes_since(baseline, current)
+            _preflight_reviewer_violation_files = reviewer_delta
+            if reviewer_delta:
+                raise RuntimeError(
+                    f"{role.title()} role violation: profile is forbidden from modifying "
+                    "tracked workspace files (fail closed). Offending files: "
+                    f"{_format_preflight_files(reviewer_delta)}"
+                )
+
+    _enforce_root_checkout_guard(worktree_path)
+    _enforce_branches_only_author_mutation(worktree_path)
+
+    # #604: common anti-stomp preflight (typed blocker + exact next action).
+    # Runs after the legacy enforcers so existing happy paths stay green and
+    # the shared module remains the single fail-closed composition point for
+    # repo/role/worktree/lease/terminal-lock/head/stale/workflow/contamination.
+    _run_anti_stomp_preflight(
+        task,
+        remote=remote,
+        worktree_path=worktree_path,
+        org=org,
+        repo=repo,
+        expected_head_sha=expected_head_sha,
+        live_head_sha=live_head_sha,
+        require_head_sha=require_head_sha,
+        lease_required=lease_required,
+        foreign_lease=foreign_lease,
+        lease_reasons=lease_reasons,
+        terminal_lock_blocks=terminal_lock_blocks,
+        terminal_lock_reasons=terminal_lock_reasons,
+        workflow_hash_valid=workflow_hash_valid,
+        workflow_hash_reasons=workflow_hash_reasons,
+        raise_on_block=True,
+    )
+
+    _clear_preflight_capability_state()
 
 
 def _verify_role_mutation_workspace(
@@ -906,12 +952,7 @@ def _verify_role_mutation_workspace(
     worktree: str | None = None,
     task: str | None = None,
 ) -> str:
-    """Bind reviewer/merger mutations to the active namespace workspace (#510).
-
-    #683: must NOT early-return solely because pytest/unittest is loaded.
-    Production workspace binding always runs; test isolation uses explicit
-    env fixtures / force-on flags, never a production short-circuit here.
-    """
+    """Bind reviewer/merger mutations to the active namespace workspace (#510)."""
 
     # Check running runtimes to prevent stale mutations
     try:
@@ -1112,9 +1153,9 @@ import merge_approval_gate  # noqa: E402
 import already_landed_reconcile  # noqa: E402
 import author_mutation_worktree  # noqa: E402
 import root_checkout_guard  # noqa: E402
-import workflow_scope_guard  # noqa: E402  # #683 production scope / force-on guards
 import stable_branch_push_guard  # noqa: E402
 import remote_repo_guard  # noqa: E402
+import anti_stomp_preflight  # noqa: E402
 import issue_claim_heartbeat  # noqa: E402
 import issue_work_duplicate_gate  # noqa: E402
 import issue_workflow_labels  # noqa: E402
@@ -2081,15 +2122,7 @@ def gitea_create_issue(
     )
     if blocked:
         return blocked
-    try:
-        verify_preflight_purity(
-            remote, worktree_path=worktree_path, task="create_issue"
-        )
-    except Exception as exc:
-        typed = _production_guard_block_from_exc(exc, number=None)
-        if typed is not None:
-            return typed
-        raise
+    verify_preflight_purity(remote, worktree_path=worktree_path, task="create_issue")
     content_gate = issue_content_gate.pre_create_issue_content_gate(
         title,
         body,
@@ -4026,6 +4059,30 @@ def _evaluate_pr_review_submission(
         result["pr_work_lease"] = lease_block
         return result
 
+    if live:
+        # #604: common anti-stomp with live head + lease proof (typed blocker).
+        anti_task = {
+            "approve": "approve_pr",
+            "request_changes": "request_changes_pr",
+            "comment": "submit_pr_review",
+        }.get(action, "submit_pr_review")
+        try:
+            _run_anti_stomp_preflight(
+                anti_task,
+                remote=remote,
+                worktree_path=worktree_path,
+                org=org,
+                repo=repo,
+                expected_head_sha=pinned_sha,
+                live_head_sha=actual_sha,
+                require_head_sha=True,
+                foreign_lease=False,
+                terminal_lock_blocks=False,
+            )
+        except RuntimeError as exc:
+            reasons.append(str(exc))
+            return result
+
     if (body or "").strip():
         gate = _canonical_comment_gate(body, context="pr_review")
         if gate["blocked"]:
@@ -4980,7 +5037,12 @@ def gitea_edit_pr(
         raise ValueError("At least one field to edit (title, body, state, base) must be provided.")
 
     closing = payload.get("state") == "closed"
-    verify_preflight_purity(remote, task="close_pr" if closing else None)
+    # Closing uses close_pr; non-closing title/body/base edits use edit_pr so
+    # the shared #604 anti-stomp inventory stays consistent with wiring.
+    if closing:
+        verify_preflight_purity(remote, task="close_pr")
+    else:
+        verify_preflight_purity(remote, task="edit_pr")
 
     # PR closure is a first-class capability, distinct from retitling or
     # rebasing edits (#216). Gate BEFORE auth/API setup so a blocked close
@@ -5462,6 +5524,25 @@ def gitea_merge_pr(
         reasons.extend(lease_block.get("reasons") or [])
         result["pr_work_lease"] = lease_block
         return result
+
+    # #604: common anti-stomp with live head + lease proof (typed blocker).
+    try:
+        _run_anti_stomp_preflight(
+            "merge_pr",
+            remote=remote,
+            worktree_path=worktree_path,
+            org=org,
+            repo=repo,
+            expected_head_sha=expected_head_sha,
+            live_head_sha=actual_sha,
+            require_head_sha=True,
+            foreign_lease=False,
+            terminal_lock_blocks=False,
+        )
+    except RuntimeError as exc:
+        reasons.append(str(exc))
+        return result
+
     if expected_head_sha and actual_sha and expected_head_sha != actual_sha:
         reasons.append(
             "expected head SHA does not match current PR head (fail closed)"
@@ -7581,7 +7662,11 @@ def gitea_acquire_reviewer_pr_lease(
             "permission_report": _permission_block_report("gitea.pr.comment"),
         }
 
-    _verify_role_mutation_workspace(remote, worktree=worktree, task="review_pr")
+    # task=acquire_reviewer_pr_lease so verify_preflight_purity runs shared #604
+    # anti-stomp for the declared lease-acquire mutation inventory entry.
+    _verify_role_mutation_workspace(
+        remote, worktree=worktree, task="acquire_reviewer_pr_lease"
+    )
     h, o, r = _resolve(remote, host, org, repo)
     auth = _auth(h)
     profile = get_profile()
@@ -7722,6 +7807,7 @@ def gitea_adopt_merger_pr_lease(
             "permission_report": _permission_block_report("gitea.pr.merge"),
         }
 
+    # task=adopt_merger_pr_lease so verify_preflight_purity runs shared #604 anti-stomp.
     _verify_role_mutation_workspace(
         remote, worktree=worktree, task="adopt_merger_pr_lease"
     )
@@ -8360,26 +8446,9 @@ def gitea_create_issue_comment(
         with the reveal opt-in); on a permission block or empty body,
         'success'/'performed' False and 'reasons' with no API call made
         (permission blocks also carry a structured 'permission_report',
-        #142). On production-guard blocks (#683): 'blocker_kind' and
-        'exact_next_action' with no API side effect.
+        #142).
     """
-    try:
-        # Do not pass target_issue_number: comments on other issues remain
-        # allowed while an author holds a different implementation lock.
-        # Scope ownership for source edits is enforced via branch/worktree
-        # binding + root diagnostic checks (#683).
-        verify_preflight_purity(
-            remote,
-            worktree_path=worktree_path,
-            task="comment_issue",
-        )
-    except Exception as exc:
-        typed = _production_guard_block_from_exc(
-            exc, issue_number=issue_number
-        )
-        if typed is not None:
-            return typed
-        raise
+    verify_preflight_purity(remote, worktree_path=worktree_path, task="comment_issue")
     gate_reasons = _profile_operation_gate("gitea.issue.comment")
     reasons = list(gate_reasons)
     if not (body or "").strip():

task_capability_map.py

@@ -60,6 +60,15 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.close",
         "role": "author",
     },
+    # Non-closing PR metadata edits (title/body/base). Closing uses close_pr.
+    "edit_pr": {
+        "permission": "gitea.pr.create",
+        "role": "author",
+    },
+    "gitea_edit_pr": {
+        "permission": "gitea.pr.create",
+        "role": "author",
+    },
     "address_pr_change_requests": {
         "permission": "gitea.branch.push",
         "role": "author",
@@ -68,10 +77,22 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.review",
         "role": "reviewer",
     },
+    "submit_pr_review": {
+        "permission": "gitea.pr.review",
+        "role": "reviewer",
+    },
     "merge_pr": {
         "permission": "gitea.pr.merge",
         "role": "merger",
     },
+    "acquire_reviewer_pr_lease": {
+        "permission": "gitea.pr.comment",
+        "role": "reviewer",
+    },
+    "gitea_acquire_reviewer_pr_lease": {
+        "permission": "gitea.pr.comment",
+        "role": "reviewer",
+    },
     "adopt_merger_pr_lease": {
         "permission": "gitea.pr.comment",
         "role": "reviewer",

tests/test_create_issue_workspace_guard.py

@@ -57,23 +57,9 @@ class TestCreateIssueWorkspaceGuard(unittest.TestCase):
         # Without worktree_path/env hints, workspace resolves to PROJECT_ROOT. When that
         # path is the stable control checkout (not under branches/), mutation must fail.
         with patch.object(srv, "PROJECT_ROOT", CONTROL_CHECKOUT_ROOT):
-            try:
-                res = srv.gitea_create_issue(title="Test issue", body="body text")
-            except RuntimeError as exc:
-                self.assertIn("stable control checkout", str(exc))
-            else:
-                # #683: production guards return typed blockers at entrypoints
-                self.assertFalse(res.get("success"))
-                self.assertFalse(res.get("performed"))
-                blob = " ".join(res.get("reasons") or []) + " " + str(
-                    res.get("blocker_kind") or ""
-                )
-                self.assertTrue(
-                    "stable control checkout" in blob
-                    or "missing_issue_worktree" in blob
-                    or "control checkout" in blob.lower()
-                )
-                self.assertTrue(res.get("exact_next_action"))
+            with self.assertRaises(RuntimeError) as ctx:
+                srv.gitea_create_issue(title="Test issue", body="body text")
+        self.assertIn("stable control checkout", str(ctx.exception))
 
     @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)
     @patch("gitea_mcp_server._profile_permission_block", return_value=None)
@@ -119,17 +105,11 @@ class TestCreateIssueWorkspaceGuard(unittest.TestCase):
         )
         
         with patch.object(srv, "PROJECT_ROOT", CONTROL_CHECKOUT_ROOT):
-            try:
-                res = srv.gitea_create_issue(
+            with self.assertRaises(RuntimeError) as ctx:
+                srv.gitea_create_issue(
                     title="Test issue", body="body", worktree_path=missing_path
                 )
-            except RuntimeError as exc:
-                self.assertIn("does not exist", str(exc))
-            else:
-                self.assertFalse(res.get("success"))
-                blob = " ".join(res.get("reasons") or [])
-                self.assertIn("does not exist", blob)
-                self.assertTrue(res.get("exact_next_action") or res.get("reasons"))
+        self.assertIn("does not exist (fail closed)", str(ctx.exception))
 
     @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)
     @patch("gitea_mcp_server._profile_permission_block", return_value=None)
@@ -162,20 +142,11 @@ class TestCreateIssueWorkspaceGuard(unittest.TestCase):
 
         with patch.object(srv, "PROJECT_ROOT", CONTROL_CHECKOUT_ROOT):
             with patch("gitea_mcp_server._get_workspace_porcelain", return_value=""):
-                try:
-                    res = srv.gitea_create_issue(
-                        title="Test issue",
-                        body="body",
-                        worktree_path=wrong_repo_path,
+                with self.assertRaises(RuntimeError) as ctx:
+                    srv.gitea_create_issue(
+                        title="Test issue", body="body", worktree_path=wrong_repo_path
                     )
-                except RuntimeError as exc:
-                    self.assertIn(
-                        "does not belong to the target repository", str(exc)
-                    )
-                else:
-                    self.assertFalse(res.get("success"))
-                    blob = " ".join(res.get("reasons") or [])
-                    self.assertIn("does not belong to the target repository", blob)
+        self.assertIn("does not belong to the target repository", str(ctx.exception))
 
     @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)
     @patch("gitea_mcp_server._profile_permission_block", return_value=None)

tests/test_issue_540_comment_role_poison.py

@@ -267,19 +267,10 @@ class TestReconcilerCommentThroughCanonicalPath(unittest.TestCase):
             with patch.dict(os.environ, {}, clear=False):
                 os.environ.pop("GITEA_AUTHOR_WORKTREE", None)
                 os.environ.pop("GITEA_ACTIVE_WORKTREE", None)
-                try:
-                    res = srv.gitea_create_issue_comment(
+                with self.assertRaises(RuntimeError):
+                    srv.gitea_create_issue_comment(
                         515, "author note", remote="prgs"
                     )
-                except RuntimeError:
-                    pass  # legacy raise path
-                else:
-                    # #683: typed blocker at mutation entrypoint
-                    self.assertFalse(res.get("success"))
-                    self.assertFalse(res.get("performed"))
-                    self.assertTrue(
-                        res.get("blocker_kind") or res.get("reasons")
-                    )
         mock_api.assert_not_called()
 
 

tests/test_issue_683_workflow_scope_guards.py

@@ -1,472 +0,0 @@
-"""#683: block unattributed root WIP; pytest cannot disable production guards.
-
-Regression coverage required by issue #683:
-
-1. Session locked to issue A blocks unrelated target issue B until B is selected.
-2. Diagnostic source edit on the root checkout is blocked.
-3. Same legitimate edit succeeds after issue ownership + isolated worktree bind.
-4. Running under pytest does not deactivate production guards when force-on.
-5. Dirty tracked Python files remain visible to porcelain consumers.
-6. Monkeypatching one helper cannot silently turn the full guard path into a no-op.
-7. Real mutation entrypoint proves production guards run before side effects.
-8. Same-issue edits in a valid isolated worktree remain unaffected.
-9. Blocker includes stable reason + exact recovery action.
-"""
-
-from __future__ import annotations
-
-import os
-import sys
-import tempfile
-import textwrap
-import unittest
-from pathlib import Path
-from unittest.mock import MagicMock, patch
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-import gitea_mcp_server as mcp_server  # noqa: E402
-import issue_lock_worktree  # noqa: E402
-import workflow_scope_guard as wsg  # noqa: E402
-
-CONTROL_ROOT = str(Path(__file__).resolve().parent.parent)
-if "branches" in Path(__file__).resolve().parts:
-    # Running from a worktree under branches/ — parent of branches is control.
-    parts = Path(__file__).resolve().parts
-    idx = parts.index("branches")
-    CONTROL_ROOT = str(Path(*parts[:idx])) if idx > 0 else CONTROL_ROOT
-
-
-class TestProductionGuardsForceOn(unittest.TestCase):
-    def tearDown(self):
-        for key in (
-            wsg.FORCE_PRODUCTION_GUARDS_ENV,
-            "GITEA_TEST_FORCE_DIRTY",
-            "GITEA_TEST_PORCELAIN",
-            "GITEA_AUTHOR_WORKTREE",
-            "GITEA_ACTIVE_WORKTREE",
-        ):
-            os.environ.pop(key, None)
-        wsg.clear_workflow_failure_ledger()
-
-    def test_force_on_under_pytest_keeps_production_active(self):
-        self.assertTrue(wsg.production_guards_active(in_test_mode=False))
-        self.assertFalse(wsg.production_guards_active(in_test_mode=True))
-        os.environ[wsg.FORCE_PRODUCTION_GUARDS_ENV] = "1"
-        self.assertTrue(wsg.production_guards_active(in_test_mode=True))
-        self.assertTrue(wsg.production_guards_forced())
-
-    def test_no_early_return_in_verify_role_mutation_workspace_source(self):
-        src = Path(mcp_server.__file__).read_text(encoding="utf-8")
-        # Rejected 300a4ca pattern must not exist.
-        self.assertNotIn(
-            "if _preflight_in_test_mode():\n        return _resolve_preflight_workspace_path",
-            src,
-        )
-        # Docstring contract for #683.
-        self.assertIn("#683", src)
-        self.assertIn("must NOT early-return solely because pytest", src)
-
-
-class TestPorcelainIntegrity(unittest.TestCase):
-    def test_read_worktree_git_state_surfaces_dirty_py(self):
-        with tempfile.TemporaryDirectory() as tmp:
-            # Use a real git repo so porcelain is truthful.
-            import subprocess
-
-            subprocess.run(["git", "init"], cwd=tmp, check=True, capture_output=True)
-            subprocess.run(
-                ["git", "config", "user.email", "[email protected]"],
-                cwd=tmp,
-                check=True,
-                capture_output=True,
-            )
-            subprocess.run(
-                ["git", "config", "user.name", "t"],
-                cwd=tmp,
-                check=True,
-                capture_output=True,
-            )
-            py_path = Path(tmp) / "sample_mod.py"
-            py_path.write_text("x = 1\n", encoding="utf-8")
-            subprocess.run(["git", "add", "sample_mod.py"], cwd=tmp, check=True)
-            subprocess.run(
-                ["git", "commit", "-m", "init"],
-                cwd=tmp,
-                check=True,
-                capture_output=True,
-            )
-            py_path.write_text("x = 2\n", encoding="utf-8")
-            state = issue_lock_worktree.read_worktree_git_state(tmp)
-            porcelain = state.get("porcelain_status") or ""
-            self.assertIn("sample_mod.py", porcelain)
-            self.assertTrue(any(line.strip().endswith(".py") for line in porcelain.splitlines()))
-
-    def test_production_reader_source_rejects_pytest_py_filter(self):
-        src = Path(issue_lock_worktree.__file__).read_text(encoding="utf-8")
-        findings = wsg.assert_no_pytest_porcelain_filter(src)
-        self.assertEqual(findings, [])
-        # Negative: the rejected 300a4ca pattern is detected.
-        rejected = textwrap.dedent(
-            """
-            porcelain = status_res.stdout or ""
-            import sys
-            if "pytest" in sys.modules or "unittest" in sys.modules:
-                porcelain = "\\n".join(
-                    line for line in porcelain.splitlines()
-                    if not line.strip().endswith(".py")
-                )
-            """
-        )
-        self.assertTrue(wsg.assert_no_pytest_porcelain_filter(rejected))
-
-
-class TestIssueScopeOwnership(unittest.TestCase):
-    def test_out_of_scope_issue_blocked_until_selected(self):
-        result = wsg.assess_issue_scope_ownership(
-            locked_issue_number=100,
-            target_issue_number=200,
-            branch_name="fix/issue-100-example",
-            role_kind="author",
-        )
-        self.assertTrue(result["block"])
-        self.assertEqual(result["blocker_kind"], wsg.BLOCKER_OUT_OF_SCOPE_ISSUE)
-        self.assertIn("exact_next_action", result)
-        self.assertIn("owning issue", result["exact_next_action"].lower())
-        self.assertTrue(result["reasons"])
-
-    def test_same_issue_scope_allowed(self):
-        result = wsg.assess_issue_scope_ownership(
-            locked_issue_number=100,
-            target_issue_number=100,
-            branch_name="fix/issue-100-example",
-            role_kind="author",
-        )
-        self.assertFalse(result["block"])
-        self.assertEqual(result["exact_next_action"], "proceed")
-
-    def test_missing_lock_when_required(self):
-        result = wsg.assess_issue_scope_ownership(
-            locked_issue_number=None,
-            target_issue_number=None,
-            role_kind="author",
-            require_lock_for_author=True,
-        )
-        self.assertTrue(result["block"])
-        self.assertEqual(result["blocker_kind"], wsg.BLOCKER_MISSING_ISSUE_SCOPE)
-
-    def test_branch_issue_mismatch(self):
-        result = wsg.assess_issue_scope_ownership(
-            locked_issue_number=50,
-            branch_name="fix/issue-99-other",
-            role_kind="author",
-        )
-        self.assertTrue(result["block"])
-        self.assertEqual(result["blocker_kind"], wsg.BLOCKER_OUT_OF_SCOPE_ISSUE)
-
-
-class TestRootDiagnosticEdit(unittest.TestCase):
-    def test_dirty_root_source_blocked(self):
-        result = wsg.assess_root_source_mutation(
-            workspace_path=CONTROL_ROOT,
-            canonical_repo_root=CONTROL_ROOT,
-            porcelain_status=" M gitea_mcp_server.py\n M tests/test_x.py\n",
-            role_kind="author",
-        )
-        self.assertTrue(result["block"])
-        self.assertEqual(result["blocker_kind"], wsg.BLOCKER_ROOT_DIAGNOSTIC_EDIT)
-        self.assertIn("gitea_mcp_server.py", result["dirty_source_files"])
-        self.assertIn("exact_next_action", result)
-        self.assertIn("branches/", result["exact_next_action"])
-
-    def test_isolated_worktree_same_issue_unaffected(self):
-        wt = f"{CONTROL_ROOT}/branches/issue-100-example"
-        result = wsg.assess_root_source_mutation(
-            workspace_path=wt,
-            canonical_repo_root=CONTROL_ROOT,
-            porcelain_status=" M helper.py\n",
-            current_branch="fix/issue-100-example",
-            locked_issue_number=100,
-            role_kind="author",
-        )
-        self.assertFalse(result["block"])
-        self.assertTrue(result["under_branches"])
-
-    def test_legitimate_after_ownership_and_worktree(self):
-        wt = f"{CONTROL_ROOT}/branches/issue-683-workflow-guard-hardening"
-        composed = wsg.assess_production_mutation_guards(
-            workspace_path=wt,
-            canonical_repo_root=CONTROL_ROOT,
-            porcelain_status=" M workflow_scope_guard.py\n",
-            current_branch="fix/issue-683-workflow-guard-hardening",
-            locked_issue_number=683,
-            target_issue_number=683,
-            role_kind="author",
-            require_author_lock=True,
-            in_test_mode=True,
-        )
-        # Force-on required for production path under pytest.
-        os.environ[wsg.FORCE_PRODUCTION_GUARDS_ENV] = "1"
-        try:
-            composed = wsg.assess_production_mutation_guards(
-                workspace_path=wt,
-                canonical_repo_root=CONTROL_ROOT,
-                porcelain_status=" M workflow_scope_guard.py\n",
-                current_branch="fix/issue-683-workflow-guard-hardening",
-                locked_issue_number=683,
-                target_issue_number=683,
-                role_kind="author",
-                require_author_lock=True,
-                in_test_mode=True,
-            )
-            self.assertFalse(composed["block"])
-            self.assertFalse(composed.get("skipped"))
-        finally:
-            os.environ.pop(wsg.FORCE_PRODUCTION_GUARDS_ENV, None)
-
-
-class TestTypedBlockerResponse(unittest.TestCase):
-    def test_block_response_has_stable_kind_and_next_action(self):
-        assessment = wsg.assess_issue_scope_ownership(
-            locked_issue_number=1,
-            target_issue_number=2,
-            role_kind="author",
-        )
-        resp = wsg.block_response(assessment)
-        self.assertFalse(resp["success"])
-        self.assertFalse(resp["performed"])
-        self.assertEqual(resp["blocker_kind"], wsg.BLOCKER_OUT_OF_SCOPE_ISSUE)
-        self.assertIsInstance(resp["exact_next_action"], str)
-        self.assertTrue(resp["exact_next_action"])
-        self.assertTrue(resp["reasons"])
-
-    def test_production_guard_error_roundtrip(self):
-        err = wsg.ProductionGuardError(
-            "blocked",
-            blocker_kind=wsg.BLOCKER_ROOT_DIAGNOSTIC_EDIT,
-            reasons=["dirty root"],
-        )
-        resp = wsg.block_response(err, issue_number=683)
-        self.assertEqual(resp["blocker_kind"], wsg.BLOCKER_ROOT_DIAGNOSTIC_EDIT)
-        self.assertEqual(resp["issue_number"], 683)
-        self.assertIn("exact_next_action", resp)
-
-
-class TestDurableFailureRecording(unittest.TestCase):
-    def setUp(self):
-        wsg.clear_workflow_failure_ledger()
-
-    def tearDown(self):
-        wsg.clear_workflow_failure_ledger()
-
-    def test_record_before_source_mutation(self):
-        pending = wsg.assess_durable_failure_recorded(
-            require_record=True, pending_source_mutation=True
-        )
-        self.assertTrue(pending["block"])
-        self.assertEqual(pending["blocker_kind"], wsg.BLOCKER_UNRECORDED_FAILURE)
-
-        wsg.record_workflow_failure(
-            kind="transport_eof",
-            detail="EOF during review session (#584 cluster)",
-            issue_number=683,
-            task="comment_issue",
-        )
-        after = wsg.assess_durable_failure_recorded(
-            require_record=True, pending_source_mutation=True
-        )
-        self.assertFalse(after["block"])
-        self.assertEqual(len(wsg.workflow_failure_ledger()), 1)
-
-
-class TestMonkeypatchCannotNoopFullPath(unittest.TestCase):
-    def tearDown(self):
-        os.environ.pop(wsg.FORCE_PRODUCTION_GUARDS_ENV, None)
-
-    def test_patching_branches_only_still_blocks_dirty_root_scope(self):
-        """Monkeypatching branches-only must not silence root diagnostic block."""
-        os.environ[wsg.FORCE_PRODUCTION_GUARDS_ENV] = "1"
-        with patch.object(
-            mcp_server, "_enforce_branches_only_author_mutation", lambda *a, **k: None
-        ):
-            with patch.object(
-                mcp_server, "_enforce_root_checkout_guard", lambda *a, **k: None
-            ):
-                # Even if both legacy helpers are patched, issue-scope composition
-                # still sees dirty root source via assess_production_mutation_guards.
-                assessment = wsg.assess_production_mutation_guards(
-                    workspace_path=CONTROL_ROOT,
-                    canonical_repo_root=CONTROL_ROOT,
-                    porcelain_status=" M gitea_mcp_server.py\n",
-                    role_kind="author",
-                    in_test_mode=True,
-                )
-                self.assertTrue(assessment["block"])
-                self.assertEqual(
-                    assessment["blocker_kind"], wsg.BLOCKER_ROOT_DIAGNOSTIC_EDIT
-                )
-
-
-class TestRealEntrypointProductionGuard(unittest.TestCase):
-    """Real mutation entrypoint: production guard before side effects (#683)."""
-
-    def setUp(self):
-        os.environ[wsg.FORCE_PRODUCTION_GUARDS_ENV] = "1"
-        for key in ("GITEA_AUTHOR_WORKTREE", "GITEA_ACTIVE_WORKTREE"):
-            os.environ.pop(key, None)
-        self._orig_whoami = mcp_server._preflight_whoami_called
-        self._orig_cap = mcp_server._preflight_capability_called
-        mcp_server._preflight_whoami_called = False
-        mcp_server._preflight_capability_called = False
-        mcp_server._preflight_resolved_role = None
-        mcp_server._preflight_resolved_task = None
-
-    def tearDown(self):
-        os.environ.pop(wsg.FORCE_PRODUCTION_GUARDS_ENV, None)
-        for key in ("GITEA_AUTHOR_WORKTREE", "GITEA_ACTIVE_WORKTREE"):
-            os.environ.pop(key, None)
-        mcp_server._preflight_whoami_called = self._orig_whoami
-        mcp_server._preflight_capability_called = self._orig_cap
-        mcp_server._preflight_resolved_role = None
-        mcp_server._preflight_resolved_task = None
-
-    def test_comment_issue_blocks_dirty_root_before_api(self):
-        api_mock = MagicMock()
-        with patch.object(mcp_server, "api_request", api_mock), patch.object(
-            mcp_server,
-            "_actual_profile_role",
-            return_value="author",
-        ), patch.object(
-            mcp_server,
-            "_effective_workspace_role",
-            return_value="author",
-        ), patch.object(
-            mcp_server,
-            "get_profile",
-            return_value={
-                "profile_name": "prgs-author",
-                "allowed_operations": [
-                    "gitea.issue.comment",
-                    "gitea.read",
-                    "gitea.pr.create",
-                    "gitea.branch.push",
-                ],
-                "forbidden_operations": [],
-            },
-        ), patch.object(
-            issue_lock_worktree,
-            "read_worktree_git_state",
-            side_effect=lambda path, **kw: {
-                "current_branch": "master",
-                "porcelain_status": (
-                    " M gitea_mcp_server.py\n"
-                    if os.path.realpath(path) == os.path.realpath(CONTROL_ROOT)
-                    or path == CONTROL_ROOT
-                    else ""
-                ),
-                "head_sha": "a" * 40,
-                "base_equivalent": True,
-            },
-        ), patch.object(
-            mcp_server,
-            "_resolve_namespace_mutation_context",
-            return_value={
-                "workspace_path": CONTROL_ROOT,
-                "canonical_repo_root": CONTROL_ROOT,
-                "process_project_root": CONTROL_ROOT,
-                "workspace_role_kind": "author",
-                "workspace_binding_source": "process root",
-                "ignored_bindings": [],
-            },
-        ), patch.object(
-            mcp_server,
-            "_resolve_author_mutation_context",
-            return_value={
-                "workspace_path": CONTROL_ROOT,
-                "canonical_repo_root": CONTROL_ROOT,
-                "process_project_root": CONTROL_ROOT,
-                "roots_aligned": True,
-            },
-        ), patch.object(
-            mcp_server,
-            "_session_locked_issue_number",
-            return_value=None,
-        ):
-            result = mcp_server.gitea_create_issue_comment(
-                issue_number=683,
-                body="diagnostic note",
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-                worktree_path=CONTROL_ROOT,
-            )
-
-        api_mock.assert_not_called()
-        self.assertFalse(result.get("success"))
-        self.assertFalse(result.get("performed"))
-        self.assertIn(result.get("blocker_kind"), wsg.BLOCKER_KINDS)
-        self.assertTrue(result.get("exact_next_action"))
-        self.assertTrue(result.get("reasons"))
-
-    def test_comment_issue_succeeds_structure_after_worktree_bind(self):
-        """Same-issue isolated worktree is not blocked by root diagnostic path."""
-        wt = f"{CONTROL_ROOT}/branches/issue-683-workflow-guard-hardening"
-        os.environ["GITEA_AUTHOR_WORKTREE"] = wt
-        assessment = wsg.assess_production_mutation_guards(
-            workspace_path=wt,
-            canonical_repo_root=CONTROL_ROOT,
-            porcelain_status=" M workflow_scope_guard.py\n",
-            current_branch="fix/issue-683-workflow-guard-hardening",
-            locked_issue_number=683,
-            target_issue_number=683,
-            role_kind="author",
-            require_author_lock=True,
-            in_test_mode=True,
-        )
-        self.assertFalse(assessment["block"], assessment)
-
-
-class TestVerifyPreflightForceOn(unittest.TestCase):
-    def tearDown(self):
-        os.environ.pop(wsg.FORCE_PRODUCTION_GUARDS_ENV, None)
-        for key in ("GITEA_AUTHOR_WORKTREE", "GITEA_ACTIVE_WORKTREE"):
-            os.environ.pop(key, None)
-
-    def test_force_on_runs_production_guards_under_pytest(self):
-        os.environ[wsg.FORCE_PRODUCTION_GUARDS_ENV] = "1"
-        called = {"root": 0, "branches": 0, "scope": 0}
-
-        def _root(*a, **k):
-            called["root"] += 1
-
-        def _branches(*a, **k):
-            called["branches"] += 1
-
-        def _scope(*a, **k):
-            called["scope"] += 1
-
-        with patch.object(mcp_server, "_enforce_root_checkout_guard", _root), patch.object(
-            mcp_server, "_enforce_branches_only_author_mutation", _branches
-        ), patch.object(mcp_server, "_enforce_issue_scope_guard", _scope):
-            # No whoami/capability — purity-order skipped; production still runs.
-            mcp_server.verify_preflight_purity(task="comment_issue")
-
-        self.assertEqual(called["root"], 1)
-        self.assertEqual(called["branches"], 1)
-        self.assertEqual(called["scope"], 1)
-
-    def test_without_force_on_pytest_skips_production_only_for_unit_isolation(self):
-        called = {"root": 0}
-
-        def _root(*a, **k):
-            called["root"] += 1
-
-        with patch.object(mcp_server, "_enforce_root_checkout_guard", _root), patch.object(
-            mcp_server, "_enforce_branches_only_author_mutation", lambda *a, **k: None
-        ), patch.object(mcp_server, "_enforce_issue_scope_guard", lambda *a, **k: None):
-            mcp_server.verify_preflight_purity(task="comment_issue")
-        self.assertEqual(called["root"], 0)
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_issue_comment_workspace_guard.py

@@ -108,24 +108,13 @@ class TestIssueCommentWorkspaceGuard(unittest.TestCase):
                 "gitea_mcp_server.issue_lock_worktree.read_worktree_git_state",
                 side_effect=self._git_state(valid_worktree),
             ):
-                try:
-                    res = srv.gitea_create_issue_comment(
+                with self.assertRaises(RuntimeError) as ctx:
+                    srv.gitea_create_issue_comment(
                         issue_number=557,
                         body="evidence comment",
                         remote="prgs",
                     )
-                except RuntimeError as exc:
-                    self.assertIn("stable control checkout", str(exc))
-                else:
-                    # #683 typed blocker at mutation entrypoint
-                    self.assertFalse(res.get("success"))
-                    self.assertFalse(res.get("performed"))
-                    blob = " ".join(res.get("reasons") or [])
-                    self.assertTrue(
-                        "stable control checkout" in blob
-                        or res.get("blocker_kind")
-                    )
-                    self.assertTrue(res.get("exact_next_action") or res.get("reasons"))
+        self.assertIn("stable control checkout", str(ctx.exception))
         mock_api.assert_not_called()
 
     @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)
@@ -195,24 +184,14 @@ class TestIssueCommentWorkspaceGuard(unittest.TestCase):
                         side_effect=self._subprocess(valid_worktree, outside_worktree),
                     ):
                         with patch.dict(os.environ, self.AUTHOR_ENV, clear=True):
-                            try:
-                                res = srv.gitea_create_issue_comment(
+                            with self.assertRaises(RuntimeError) as ctx:
+                                srv.gitea_create_issue_comment(
                                     issue_number=557,
                                     body="evidence comment",
                                     remote="prgs",
                                     worktree_path=outside_worktree,
                                 )
-                            except RuntimeError as exc:
-                                self.assertIn(
-                                    "does not belong to the target repository",
-                                    str(exc),
-                                )
-                            else:
-                                self.assertFalse(res.get("success"))
-                                blob = " ".join(res.get("reasons") or [])
-                                self.assertIn(
-                                    "does not belong to the target repository", blob
-                                )
+        self.assertIn("does not belong to the target repository", str(ctx.exception))
         mock_api.assert_not_called()
 
     @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)

tests/test_preflight_read_survival.py

@@ -76,17 +76,13 @@ class TestPreflightReadSurvival(unittest.TestCase):
         self.assertIn("task mismatch", str(ctx.exception))
 
     def test_capability_consumed_after_mutation_gate(self):
-        # Use reconciler/close_pr so this purity-order test does not require a
-        # branches/ worktree (author create_issue would hit #274/#683 guards).
-        # Test isolation stays explicit; production author guards remain live
-        # under force-on (see tests/test_issue_683_workflow_scope_guards.py).
         mcp_server.record_preflight_check("whoami")
         mcp_server.record_preflight_check(
-            "capability", resolved_role="reconciler", resolved_task="close_pr"
+            "capability", resolved_role="author", resolved_task="create_issue"
         )
-        mcp_server.verify_preflight_purity(task="close_pr")
+        mcp_server.verify_preflight_purity(task="create_issue")
         with self.assertRaises(RuntimeError) as ctx:
-            mcp_server.verify_preflight_purity(task="close_pr")
+            mcp_server.verify_preflight_purity(task="create_issue")
         self.assertIn("has not been resolved", str(ctx.exception))
 
     def test_whoami_recovery_after_violation_clears_capability(self):

tests/test_reconciler_close_workspace_guard.py

@@ -86,21 +86,9 @@ class TestReconcilerCloseWorkspaceGuard(unittest.TestCase):
     ):
         srv._preflight_resolved_role = "author"
         with patch.object(srv, "PROJECT_ROOT", CONTROL_CHECKOUT_ROOT):
-            try:
-                res = srv.gitea_create_issue(title="Test", body="body")
-            except RuntimeError as exc:
-                self.assertIn("stable control checkout", str(exc))
-            else:
-                # #683 typed blocker at mutation entrypoint
-                self.assertFalse(res.get("success"))
-                blob = " ".join(res.get("reasons") or []) + str(
-                    res.get("blocker_kind") or ""
-                )
-                self.assertTrue(
-                    "stable control checkout" in blob
-                    or "missing_issue_worktree" in blob
-                    or "control checkout" in blob.lower()
-                )
+            with self.assertRaises(RuntimeError) as ctx:
+                srv.gitea_create_issue(title="Test", body="body")
+        self.assertIn("stable control checkout", str(ctx.exception))
 
 
 if __name__ == "__main__":

workflow_scope_guard.py

@@ -1,626 +0,0 @@
-"""Workflow scope ownership and production-guard hardening (#683).
-
-Implements fail-closed enforcement so sessions cannot:
-
-* mutate source/tests on the root/control checkout (including temporary
-  diagnostic edits) without binding an issue-backed ``branches/`` worktree;
-* continue out-of-scope source work while locked to a different issue;
-* disable, skip, or conceal production root/branches/porcelain guards solely
-  because pytest/unittest is loaded.
-
-This module is pure assessment + small durable ledger helpers. Callers gather
-live facts (lock, branch, porcelain, worktree path) and pass them in. Existing
-root_checkout_guard / author_mutation_worktree assessors remain authoritative;
-this module composes typed blockers with exact recovery actions.
-
-Do **not** reintroduce the rejected #681 / ``300a4ca`` patterns:
-
-* early-return from workspace verification under ``_preflight_in_test_mode()``
-* porcelain filtering that strips ``*.py`` lines under pytest
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import threading
-from typing import Any
-
-import author_mutation_worktree
-from reviewer_worktree import parse_dirty_tracked_files
-
-# ── force-on / test isolation ────────────────────────────────────────────────
-
-# When set, production root/branches/scope guards MUST run even under pytest.
-# Unit tests that only need preflight-order isolation leave this unset and
-# use GITEA_TEST_PORCELAIN / fixtures; real-entrypoint proof sets this to "1".
-FORCE_PRODUCTION_GUARDS_ENV = "GITEA_TEST_FORCE_PRODUCTION_GUARDS"
-
-# Existing force signals also mean "exercise production dirtiness paths".
-_FORCE_DIRTY_ENV = "GITEA_TEST_FORCE_DIRTY"
-_FORCE_PORCELAIN_ENV = "GITEA_TEST_PORCELAIN"
-
-# ── typed blocker kinds ──────────────────────────────────────────────────────
-
-BLOCKER_ROOT_DIAGNOSTIC_EDIT = "root_diagnostic_edit"
-BLOCKER_MISSING_ISSUE_SCOPE = "missing_issue_scope"
-BLOCKER_OUT_OF_SCOPE_ISSUE = "out_of_scope_issue"
-BLOCKER_MISSING_WORKTREE = "missing_issue_worktree"
-BLOCKER_UNRECORDED_FAILURE = "unrecorded_workflow_failure"
-BLOCKER_PRODUCTION_GUARD = "production_guard_violation"
-
-BLOCKER_KINDS = frozenset(
-    {
-        BLOCKER_ROOT_DIAGNOSTIC_EDIT,
-        BLOCKER_MISSING_ISSUE_SCOPE,
-        BLOCKER_OUT_OF_SCOPE_ISSUE,
-        BLOCKER_MISSING_WORKTREE,
-        BLOCKER_UNRECORDED_FAILURE,
-        BLOCKER_PRODUCTION_GUARD,
-    }
-)
-
-_NEXT_ACTIONS: dict[str, str] = {
-    BLOCKER_ROOT_DIAGNOSTIC_EDIT: (
-        "Stop editing the control/root checkout. Preserve or discard root WIP "
-        "durably, restore root to clean master, lock or create the owning issue, "
-        "bind branches/issue-<N>-*, set GITEA_AUTHOR_WORKTREE to that worktree, "
-        "then re-run the mutation."
-    ),
-    BLOCKER_MISSING_ISSUE_SCOPE: (
-        "Select or create the owning Gitea issue, claim/lock it "
-        "(gitea_mark_issue + gitea_lock_issue), bind branches/issue-<N>-* "
-        "from clean master, then re-run the mutation from that worktree."
-    ),
-    BLOCKER_OUT_OF_SCOPE_ISSUE: (
-        "Stop. The active issue lock does not own this work. Release or finish "
-        "the current issue lease, then select/create and lock the correct "
-        "owning issue, bind its branches/issue-<N>-* worktree, and re-run."
-    ),
-    BLOCKER_MISSING_WORKTREE: (
-        "Bind an issue-backed worktree under branches/ (scripts/worktree-start "
-        "or git worktree add branches/issue-<N>-*), set GITEA_AUTHOR_WORKTREE / "
-        "worktree_path to that path, keep the control checkout clean on master, "
-        "then re-run the mutation."
-    ),
-    BLOCKER_UNRECORDED_FAILURE: (
-        "Record the workflow/tool failure durably first (issue comment or "
-        "workflow_scope_guard.record_workflow_failure), then continue only "
-        "inside the owning issue-backed worktree."
-    ),
-    BLOCKER_PRODUCTION_GUARD: (
-        "Resolve the production guard violation: clean or isolate the control "
-        "checkout, bind the owning issue worktree under branches/, and re-run "
-        "with production guards active."
-    ),
-}
-
-_ISSUE_IN_BRANCH_RE = re.compile(r"issue-(\d+)", re.IGNORECASE)
-
-# In-process durable failure ledger (also written via optional sink callback).
-_ledger_lock = threading.Lock()
-_failure_ledger: list[dict[str, Any]] = []
-
-
-class ProductionGuardError(RuntimeError):
-    """Fail-closed production guard with typed blocker metadata (#683)."""
-
-    def __init__(
-        self,
-        message: str,
-        *,
-        blocker_kind: str,
-        exact_next_action: str | None = None,
-        reasons: list[str] | None = None,
-        details: dict[str, Any] | None = None,
-    ) -> None:
-        super().__init__(message)
-        kind = (blocker_kind or "").strip()
-        if kind not in BLOCKER_KINDS:
-            kind = BLOCKER_PRODUCTION_GUARD
-        self.blocker_kind = kind
-        self.exact_next_action = (
-            (exact_next_action or "").strip() or _NEXT_ACTIONS[kind]
-        )
-        self.reasons = list(reasons or [message])
-        self.details = dict(details or {})
-
-
-def production_guards_forced() -> bool:
-    """True when the explicit #683 force-on flag requests production guards."""
-    return (os.environ.get(FORCE_PRODUCTION_GUARDS_ENV) or "").strip().lower() in {
-        "1",
-        "true",
-        "yes",
-        "on",
-    }
-
-
-def purity_order_forced() -> bool:
-    """True when tests force preflight-order dirtiness paths (legacy flags)."""
-    if os.environ.get(_FORCE_DIRTY_ENV):
-        return True
-    # GITEA_TEST_PORCELAIN present (even empty) means dirtiness paths are live.
-    if os.environ.get(_FORCE_PORCELAIN_ENV) is not None:
-        return True
-    return False
-
-
-def production_guards_active(*, in_test_mode: bool) -> bool:
-    """Whether production root/branches/scope guards must execute.
-
-    Production (non-test) always active. Under pytest, active when either the
-    explicit #683 force-on flag or legacy dirty/porcelain force signals are
-    set — never skip production enforcement solely because tests are running
-    when force-on is requested.
-    """
-    if production_guards_forced() or purity_order_forced():
-        return True
-    return not bool(in_test_mode)
-
-
-def extract_issue_number_from_branch(branch_name: str | None) -> int | None:
-    """Return the first issue-N number embedded in a branch name, if any."""
-    text = (branch_name or "").strip()
-    if not text:
-        return None
-    match = _ISSUE_IN_BRANCH_RE.search(text)
-    if not match:
-        return None
-    try:
-        return int(match.group(1))
-    except ValueError:
-        return None
-
-
-def is_source_or_test_path(path: str) -> bool:
-    """True for tracked source/test paths that must not land as root WIP."""
-    p = (path or "").replace("\\", "/").lstrip("./")
-    if not p:
-        return False
-    if p.startswith("tests/") or "/tests/" in f"/{p}":
-        return True
-    if p.endswith((".py", ".pyi", ".toml", ".cfg", ".ini", ".sh")):
-        return True
-    if p in {"requirements.txt", "pyproject.toml", "setup.py", "setup.cfg"}:
-        return True
-    return False
-
-
-def dirty_source_files(porcelain_status: str) -> list[str]:
-    """Tracked dirty paths that count as source/test contamination."""
-    dirty = parse_dirty_tracked_files(porcelain_status or "")
-    return [p for p in dirty if is_source_or_test_path(p)]
-
-
-def assess_issue_scope_ownership(
-    *,
-    locked_issue_number: int | None,
-    target_issue_number: int | None = None,
-    branch_name: str | None = None,
-    role_kind: str | None = None,
-    require_lock_for_author: bool = False,
-) -> dict[str, Any]:
-    """Fail closed when the session issue lock does not own the attempted work.
-
-    * Author sessions that require a lock fail when none is held.
-    * When a lock exists, the target issue (tool argument) and/or the issue
-      number embedded in the branch must match the locked issue.
-    * Reviewer/merger/reconciler roles are not issue-scope owners of author
-      implementation work and skip the author lock requirement.
-    """
-    role = (role_kind or "").strip().lower()
-    locked = locked_issue_number
-    if isinstance(locked, str) and locked.isdigit():
-        locked = int(locked)
-    if locked is not None:
-        try:
-            locked = int(locked)
-        except (TypeError, ValueError):
-            locked = None
-
-    target = target_issue_number
-    if target is not None:
-        try:
-            target = int(target)
-        except (TypeError, ValueError):
-            target = None
-
-    branch_issue = extract_issue_number_from_branch(branch_name)
-    reasons: list[str] = []
-    blocker_kind: str | None = None
-
-    # Non-author roles do not take author issue locks for implementation.
-    if role in {"reviewer", "merger", "reconciler"}:
-        return _scope_ok(locked, target, branch_issue)
-
-    if require_lock_for_author and locked is None:
-        reasons.append(
-            "no owning issue lock is bound for this author session; "
-            "source/test mutation requires selecting or creating an owning issue first"
-        )
-        blocker_kind = BLOCKER_MISSING_ISSUE_SCOPE
-
-    if locked is not None and target is not None and locked != target:
-        reasons.append(
-            f"session is locked to issue #{locked} but mutation targets issue "
-            f"#{target}; out-of-scope until the owning issue is selected"
-        )
-        blocker_kind = BLOCKER_OUT_OF_SCOPE_ISSUE
-
-    if locked is not None and branch_issue is not None and locked != branch_issue:
-        reasons.append(
-            f"session is locked to issue #{locked} but workspace branch is for "
-            f"issue #{branch_issue}; bind the matching issue-backed worktree"
-        )
-        blocker_kind = BLOCKER_OUT_OF_SCOPE_ISSUE
-
-    if reasons:
-        kind = blocker_kind or BLOCKER_MISSING_ISSUE_SCOPE
-        return {
-            "proven": False,
-            "block": True,
-            "blocker_kind": kind,
-            "exact_next_action": _NEXT_ACTIONS[kind],
-            "reasons": reasons,
-            "locked_issue_number": locked,
-            "target_issue_number": target,
-            "branch_issue_number": branch_issue,
-        }
-    return _scope_ok(locked, target, branch_issue)
-
-
-def assess_root_source_mutation(
-    *,
-    workspace_path: str,
-    canonical_repo_root: str,
-    porcelain_status: str,
-    current_branch: str | None = None,
-    locked_issue_number: int | None = None,
-    role_kind: str | None = None,
-) -> dict[str, Any]:
-    """Fail closed for diagnostic/source edits on the control/root checkout.
-
-    Allowed only when the active workspace is under ``branches/``. Dirty
-    tracked source/test files on the control checkout always block, including
-    temporary/diagnostic/test-only intent.
-    """
-    role = (role_kind or "").strip().lower()
-    if role == "reconciler":
-        return {
-            "proven": True,
-            "block": False,
-            "blocker_kind": None,
-            "exact_next_action": "proceed",
-            "reasons": [],
-            "dirty_source_files": [],
-        }
-
-    root = os.path.realpath(canonical_repo_root or "")
-    workspace = os.path.realpath(workspace_path or root or ".")
-    under_branches = author_mutation_worktree.is_path_under_branches(workspace, root)
-    dirty_src = dirty_source_files(porcelain_status)
-    reasons: list[str] = []
-    blocker_kind: str | None = None
-
-    if not under_branches and workspace == root and dirty_src:
-        # Root workspace with source dirtiness is unattributed root WIP.
-        # (Clean-root author binding is enforced by branches-only #274.)
-        reasons.append(
-            "control/root checkout has tracked source or test edits "
-            f"(dirty files: {', '.join(dirty_src)}); diagnostic or temporary "
-            "edits on the root checkout are forbidden"
-        )
-        blocker_kind = BLOCKER_ROOT_DIAGNOSTIC_EDIT
-
-    if (
-        not under_branches
-        and workspace == root
-        and not dirty_src
-        and role == "author"
-    ):
-        # Explicit missing-worktree signal for force-on author entrypoints.
-        reasons.append(
-            "author source/test mutation from the stable control checkout is "
-            "forbidden; bind an issue-backed worktree under branches/ first"
-        )
-        blocker_kind = BLOCKER_MISSING_WORKTREE
-
-    if reasons:
-        kind = blocker_kind or BLOCKER_ROOT_DIAGNOSTIC_EDIT
-        return {
-            "proven": False,
-            "block": True,
-            "blocker_kind": kind,
-            "exact_next_action": _NEXT_ACTIONS[kind],
-            "reasons": reasons,
-            "dirty_source_files": dirty_src,
-            "workspace_path": workspace,
-            "canonical_repo_root": root,
-            "under_branches": under_branches,
-            "locked_issue_number": locked_issue_number,
-        }
-    return {
-        "proven": True,
-        "block": False,
-        "blocker_kind": None,
-        "exact_next_action": "proceed",
-        "reasons": [],
-        "dirty_source_files": dirty_src,
-        "workspace_path": workspace,
-        "canonical_repo_root": root,
-        "under_branches": under_branches,
-        "locked_issue_number": locked_issue_number,
-    }
-
-
-def assess_production_mutation_guards(
-    *,
-    workspace_path: str,
-    canonical_repo_root: str,
-    porcelain_status: str,
-    current_branch: str | None = None,
-    locked_issue_number: int | None = None,
-    target_issue_number: int | None = None,
-    role_kind: str | None = None,
-    require_author_lock: bool = False,
-    in_test_mode: bool = False,
-) -> dict[str, Any]:
-    """Compose root + scope production guards when they must be active (#683)."""
-    if not production_guards_active(in_test_mode=in_test_mode):
-        return {
-            "proven": True,
-            "block": False,
-            "blocker_kind": None,
-            "exact_next_action": "proceed",
-            "reasons": [],
-            "skipped": True,
-            "skip_reason": "production guards not active (test isolation without force-on)",
-        }
-
-    root_assess = assess_root_source_mutation(
-        workspace_path=workspace_path,
-        canonical_repo_root=canonical_repo_root,
-        porcelain_status=porcelain_status,
-        current_branch=current_branch,
-        locked_issue_number=locked_issue_number,
-        role_kind=role_kind,
-    )
-    if root_assess["block"]:
-        return {**root_assess, "skipped": False}
-
-    scope_assess = assess_issue_scope_ownership(
-        locked_issue_number=locked_issue_number,
-        target_issue_number=target_issue_number,
-        branch_name=current_branch,
-        role_kind=role_kind,
-        require_lock_for_author=require_author_lock,
-    )
-    if scope_assess["block"]:
-        return {**scope_assess, "skipped": False}
-
-    return {
-        "proven": True,
-        "block": False,
-        "blocker_kind": None,
-        "exact_next_action": "proceed",
-        "reasons": [],
-        "skipped": False,
-        "root": root_assess,
-        "scope": scope_assess,
-    }
-
-
-def raise_if_blocked(assessment: dict[str, Any]) -> None:
-    """Raise :class:`ProductionGuardError` when *assessment* blocks."""
-    if not assessment or not assessment.get("block"):
-        return
-    kind = assessment.get("blocker_kind") or BLOCKER_PRODUCTION_GUARD
-    reasons = list(assessment.get("reasons") or ["production guard violation"])
-    message = (
-        f"Workflow scope guard (#683) [{kind}]: {'; '.join(reasons)}. "
-        f"exact_next_action: {assessment.get('exact_next_action') or _NEXT_ACTIONS.get(kind, '')}"
-    )
-    raise ProductionGuardError(
-        message,
-        blocker_kind=kind,
-        exact_next_action=assessment.get("exact_next_action"),
-        reasons=reasons,
-        details={
-            k: v
-            for k, v in assessment.items()
-            if k
-            not in {
-                "proven",
-                "block",
-                "blocker_kind",
-                "exact_next_action",
-                "reasons",
-            }
-        },
-    )
-
-
-def block_response(
-    assessment: dict[str, Any] | ProductionGuardError | None = None,
-    *,
-    blocker_kind: str | None = None,
-    reasons: list[str] | None = None,
-    exact_next_action: str | None = None,
-    **extra: Any,
-) -> dict[str, Any]:
-    """Structured fail-closed tool response with typed blocker fields."""
-    if isinstance(assessment, ProductionGuardError):
-        kind = assessment.blocker_kind
-        reason_list = list(assessment.reasons)
-        next_action = assessment.exact_next_action
-        extra = {**assessment.details, **extra}
-    elif isinstance(assessment, dict) and assessment.get("block"):
-        kind = assessment.get("blocker_kind") or BLOCKER_PRODUCTION_GUARD
-        reason_list = list(assessment.get("reasons") or [])
-        next_action = assessment.get("exact_next_action") or _NEXT_ACTIONS.get(
-            kind, _NEXT_ACTIONS[BLOCKER_PRODUCTION_GUARD]
-        )
-    else:
-        kind = (blocker_kind or BLOCKER_PRODUCTION_GUARD).strip()
-        if kind not in BLOCKER_KINDS:
-            kind = BLOCKER_PRODUCTION_GUARD
-        reason_list = list(reasons or ["production guard violation"])
-        next_action = exact_next_action or _NEXT_ACTIONS[kind]
-
-    if kind not in BLOCKER_KINDS:
-        kind = BLOCKER_PRODUCTION_GUARD
-    if not reason_list:
-        reason_list = ["production guard violation"]
-    next_action = (next_action or "").strip() or _NEXT_ACTIONS[kind]
-
-    out: dict[str, Any] = {
-        "success": False,
-        "performed": False,
-        "blocker_kind": kind,
-        "exact_next_action": next_action,
-        "reasons": reason_list,
-    }
-    for key, value in extra.items():
-        if key not in out and value is not None:
-            out[key] = value
-    return out
-
-
-def format_production_guard_error(assessment: dict[str, Any]) -> str:
-    """Single RuntimeError string carrying kind + exact next action."""
-    kind = assessment.get("blocker_kind") or BLOCKER_PRODUCTION_GUARD
-    reasons = "; ".join(assessment.get("reasons") or ["production guard violation"])
-    next_action = assessment.get("exact_next_action") or _NEXT_ACTIONS.get(
-        kind, _NEXT_ACTIONS[BLOCKER_PRODUCTION_GUARD]
-    )
-    return (
-        f"Workflow scope guard (#683) [{kind}]: {reasons}. "
-        f"exact_next_action: {next_action}"
-    )
-
-
-# ── durable failure recording ────────────────────────────────────────────────
-
-
-def record_workflow_failure(
-    *,
-    kind: str,
-    detail: str,
-    issue_number: int | None = None,
-    task: str | None = None,
-    sink: Any | None = None,
-) -> dict[str, Any]:
-    """Record a workflow/tool failure before source edits continue (#683 AC8).
-
-    *sink* may be a callable ``sink(record)`` (e.g. tests) or omitted for the
-    in-process ledger only. Returns the durable record.
-    """
-    record = {
-        "kind": (kind or "workflow_failure").strip() or "workflow_failure",
-        "detail": (detail or "").strip(),
-        "issue_number": issue_number,
-        "task": task,
-        "pid": os.getpid(),
-    }
-    with _ledger_lock:
-        _failure_ledger.append(dict(record))
-    if callable(sink):
-        sink(record)
-    return record
-
-
-def clear_workflow_failure_ledger() -> None:
-    """Test helper: reset the in-process failure ledger."""
-    with _ledger_lock:
-        _failure_ledger.clear()
-
-
-def workflow_failure_ledger() -> list[dict[str, Any]]:
-    """Copy of durable in-process failure records."""
-    with _ledger_lock:
-        return [dict(r) for r in _failure_ledger]
-
-
-def assess_durable_failure_recorded(
-    *,
-    require_record: bool,
-    pending_source_mutation: bool,
-) -> dict[str, Any]:
-    """Block source mutation when a workflow failure was not recorded first."""
-    if not require_record or not pending_source_mutation:
-        return {
-            "proven": True,
-            "block": False,
-            "blocker_kind": None,
-            "exact_next_action": "proceed",
-            "reasons": [],
-        }
-    with _ledger_lock:
-        has_record = bool(_failure_ledger)
-    if has_record:
-        return {
-            "proven": True,
-            "block": False,
-            "blocker_kind": None,
-            "exact_next_action": "proceed",
-            "reasons": [],
-        }
-    return {
-        "proven": False,
-        "block": True,
-        "blocker_kind": BLOCKER_UNRECORDED_FAILURE,
-        "exact_next_action": _NEXT_ACTIONS[BLOCKER_UNRECORDED_FAILURE],
-        "reasons": [
-            "workflow/tool failure triggered a need for source changes but no "
-            "durable failure record exists yet"
-        ],
-    }
-
-
-def porcelain_preserves_python_paths(porcelain_status: str) -> bool:
-    """Regression helper: dirty ``*.py`` lines must remain visible (#683)."""
-    text = porcelain_status or ""
-    for line in text.splitlines():
-        stripped = line.strip()
-        if stripped.endswith(".py") or ".py " in stripped or stripped.endswith(".py"):
-            # Any py path present proves no silent strip of all *.py lines.
-            if " M " in f" {stripped}" or stripped[:1] in "MADRCTU" or len(line) >= 4:
-                return True
-    # Empty porcelain is fine; integrity means we did not strip when present.
-    return ".py" not in text
-
-
-def assert_no_pytest_porcelain_filter(source_text: str) -> list[str]:
-    """Static check: production reader must not strip ``*.py`` under pytest."""
-    findings: list[str] = []
-    lowered = source_text or ""
-    if "endswith(\".py\")" in lowered or "endswith('.py')" in lowered:
-        if "pytest" in lowered and "porcelain" in lowered.lower():
-            findings.append(
-                "production porcelain reader must not filter *.py under pytest "
-                "(rejected 300a4ca pattern)"
-            )
-    if "if \"pytest\" in sys.modules" in lowered and "porcelain" in lowered.lower():
-        if ".py" in lowered and ("join" in lowered or "endswith" in lowered):
-            findings.append(
-                "test-mode porcelain filtering of source files is forbidden (#683)"
-            )
-    return findings
-
-
-def _scope_ok(
-    locked: int | None,
-    target: int | None,
-    branch_issue: int | None,
-) -> dict[str, Any]:
-    return {
-        "proven": True,
-        "block": False,
-        "blocker_kind": None,
-        "exact_next_action": "proceed",
-        "reasons": [],
-        "locked_issue_number": locked,
-        "target_issue_number": target,
-        "branch_issue_number": branch_issue,
-    }