fix: harden structured auth MCP errors against reviewer findings (#699)

Address PR #701 request-changes-class defects:

1. Fixed messages only — never embed HTTP bodies, Keychain, or exception
   text in tool results or daemon logs; sanitization fails closed.
2. Narrow Tool.run boundary wraps original success path; re-raises
   UrlElicitationRequiredError; install is idempotent.
3. No RuntimeError substring heuristics; only typed client failures
   are classified as auth/authz/network/config.
4. Central classify_http_status — every HTTP 403 is GiteaAuthzError.

Regressions cover adversarial secrets, stdio survival, elicitation,
parser RuntimeError, generic 403, repeated install, profiles, provenance.

Closes #699

gitea_auth.py

@@ -243,6 +243,192 @@ def _redact(text):
         return str(text)
 
 
+# ── Classified client failures (#699) ─────────────────────────────────────────
+# Subclasses of RuntimeError preserve existing ``except RuntimeError`` call
+# sites. Exception *messages* are fixed constants only — HTTP response bodies,
+# Keychain material, and arbitrary exception text are never stored on the
+# exception or re-emitted to tool results / daemon logs.
+
+
+# Fixed messages (must match mcp_tool_error_boundary.FIXED_MESSAGES keys used here).
+_MSG_AUTH_INVALID = "Gitea authentication failed: invalid or revoked credentials"
+_MSG_AUTH_FAILED = "Gitea authentication failed"
+_MSG_AUTHZ_SCOPE = "Gitea authorization failed: insufficient token scope"
+_MSG_AUTHZ_DENIED = "Gitea authorization failed: access denied"
+_MSG_NETWORK = "Network error contacting Gitea"
+_MSG_CONFIG = "Gitea configuration or credential resolution failed"
+_MSG_UPSTREAM = "Gitea upstream unavailable"
+_MSG_HTTP = "Gitea HTTP request failed"
+
+
+class GiteaClientError(RuntimeError):
+    """Base for known Gitea client failures with stable reason_code metadata."""
+
+    reason_code = "client_error"
+    error_class = "client"
+    http_status = None
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        if reason_code is not None:
+            self.reason_code = reason_code
+        if http_status is not None:
+            self.http_status = http_status
+        # Message is always a fixed constant; callers cannot inject bodies.
+        fixed = message if message is not None else _MSG_HTTP
+        super().__init__(fixed)
+
+
+class GiteaAuthError(GiteaClientError):
+    """Authentication failure (invalid/revoked credentials → typically HTTP 401)."""
+
+    reason_code = "auth_invalid_token"
+    error_class = "authentication"
+    http_status = 401
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        super().__init__(
+            message if message is not None else _MSG_AUTH_INVALID,
+            reason_code=reason_code or "auth_invalid_token",
+            http_status=http_status if http_status is not None else 401,
+        )
+
+
+class GiteaAuthzError(GiteaClientError):
+    """Authorization failure (HTTP 403 — scope deficiency or access denied)."""
+
+    reason_code = "authz_denied"
+    error_class = "authorization"
+    http_status = 403
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        code = reason_code or "authz_denied"
+        if code == "authz_insufficient_scope":
+            fixed = _MSG_AUTHZ_SCOPE
+        else:
+            fixed = _MSG_AUTHZ_DENIED
+            code = "authz_denied"
+        super().__init__(
+            message if message is not None else fixed,
+            reason_code=code,
+            http_status=http_status if http_status is not None else 403,
+        )
+
+
+class GiteaNetworkError(GiteaClientError):
+    """Transport / DNS / timeout failure contacting Gitea."""
+
+    reason_code = "network_error"
+    error_class = "network"
+    http_status = None
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        super().__init__(
+            message if message is not None else _MSG_NETWORK,
+            reason_code=reason_code or "network_error",
+            http_status=http_status,
+        )
+
+
+class GiteaConfigError(GiteaClientError):
+    """Local configuration / credential resolution failure (not HTTP auth)."""
+
+    reason_code = "config_error"
+    error_class = "configuration"
+    http_status = None
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        super().__init__(
+            message if message is not None else _MSG_CONFIG,
+            reason_code=reason_code or "config_error",
+            http_status=http_status,
+        )
+
+
+class GiteaHttpError(GiteaClientError):
+    """Non-auth HTTP failure with fixed message (no response body)."""
+
+    reason_code = "http_error"
+    error_class = "client"
+    http_status = None
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        code = reason_code or "http_error"
+        if code == "upstream_unavailable":
+            fixed = _MSG_UPSTREAM
+        else:
+            fixed = _MSG_HTTP
+            code = "http_error"
+        super().__init__(
+            message if message is not None else fixed,
+            reason_code=code,
+            http_status=http_status,
+        )
+
+
+def _looks_like_insufficient_scope(detail: str) -> bool:
+    """Internal: inspect redacted body *only* to refine 403 reason_code.
+
+    The body is never stored on the exception or returned to callers.
+    """
+    lower = (detail or "").lower()
+    markers = (
+        "insufficient scope",
+        "required scope",
+        "does not have at least one of required scope",
+        "token does not have",
+        "missing scope",
+        "scope(s)",
+    )
+    return any(m in lower for m in markers)
+
+
+def classify_http_status(code: int, *, body_hint: str = "") -> tuple[type, str, int]:
+    """Central HTTP status → (exception_class, reason_code, http_status).
+
+    Every HTTP 403 becomes authorization-class. Body text is used only as a
+    local hint for scope vs denied reason_code and is never returned.
+    """
+    if code == 401:
+        return (GiteaAuthError, "auth_invalid_token", 401)
+    if code == 403:
+        if _looks_like_insufficient_scope(body_hint or ""):
+            return (GiteaAuthzError, "authz_insufficient_scope", 403)
+        return (GiteaAuthzError, "authz_denied", 403)
+    if code in (502, 503, 504):
+        return (GiteaHttpError, "upstream_unavailable", code)
+    return (GiteaHttpError, "http_error", code)
+
+
+def raise_for_http_status(code: int, body: str = "") -> None:
+    """Raise a typed client error for *code* without embedding *body*.
+
+    *body* may be inspected only to choose scope vs denied for 403; it is
+    never placed on the exception message.
+    """
+    # Redact before any inspection; discard after classification.
+    try:
+        hint = _redact(body or "").strip()
+    except Exception:
+        hint = ""
+    exc_cls, reason, status = classify_http_status(code, body_hint=hint)
+    # Explicitly construct without passing body/hint into message.
+    if exc_cls is GiteaAuthError:
+        raise GiteaAuthError(reason_code=reason, http_status=status)
+    if exc_cls is GiteaAuthzError:
+        raise GiteaAuthzError(reason_code=reason, http_status=status)
+    if reason == "upstream_unavailable":
+        raise GiteaHttpError(
+            reason_code="upstream_unavailable",
+            http_status=status,
+        )
+    raise GiteaHttpError(reason_code="http_error", http_status=status)
+
+
+def _raise_http_error(code: int, detail: str = "") -> None:
+    """Backward-compatible alias — *detail* is never embedded in the error."""
+    raise_for_http_status(code, detail)
+
+
 def _add_query(url, **params):
     """Return *url* with the given query parameters added or overridden.
 
@@ -315,23 +501,24 @@ def api_request(method, url, auth_header, payload=None, *,
     """Make an authenticated JSON request to the Gitea API.
 
     Returns parsed JSON on success (or ``None`` for an empty body), and raises
-    ``RuntimeError`` on failure.
+    a classified client error on failure.
 
     On HTTP 429 the request is retried up to *max_retries* times: honoring a
     valid ``Retry-After`` header (seconds or HTTP-date) when present, otherwise
     using capped jittered exponential backoff. Successful responses are
     unchanged.
 
-    All failures are converted to a ``RuntimeError`` with a clear, secret
-    -redacted message (no raw stack traces or credential material):
+    Failures raise typed exceptions with **fixed messages only** (#699). HTTP
+    response bodies are read solely for local 403 reason refinement and are
+    never stored on exceptions or returned to callers:
 
-    - Non-429 HTTP errors surface the status code and a redacted response body.
-      502/503/504 upstream errors get an explicit "Gitea upstream unavailable"
-      message.
-    - Timeouts and network/DNS failures (``URLError`` / ``TimeoutError``) surface
-      a generic "network error contacting Gitea" message.
-    - A malformed (non-JSON) success body surfaces a "malformed JSON response"
-      message rather than a raw decode error.
+    - HTTP 401 → :class:`GiteaAuthError` (``auth_invalid_token``)
+    - HTTP 403 → :class:`GiteaAuthzError` (scope or denied)
+    - 502/503/504 → :class:`GiteaHttpError` (``upstream_unavailable``)
+    - Other non-429 HTTP → :class:`GiteaHttpError` (``http_error``)
+    - Timeouts / DNS / ``URLError`` → :class:`GiteaNetworkError`
+    - Malformed success JSON → plain ``RuntimeError`` (programming/protocol;
+      not reclassified as authentication)
 
     The ``*_func`` parameters and ``timeout`` are injection points for
     deterministic testing.
@@ -369,22 +556,23 @@ def api_request(method, url, auth_header, payload=None, *,
                 error_body = e.read().decode("utf-8", errors="replace")
             except Exception:
                 error_body = ""
-            detail = _redact(error_body).strip()
-            if e.code in (502, 503, 504):
-                msg = f"HTTP {e.code}: Gitea upstream unavailable"
-                raise RuntimeError(f"{msg}: {detail}" if detail else msg) from e
-            raise RuntimeError(f"HTTP {e.code}: {detail}") from e
+            # Classify from status (+ local body hint). Body is not embedded.
+            try:
+                raise_for_http_status(e.code, error_body)
+            except GiteaClientError:
+                raise
+            # Defensive: raise_for_http_status always raises.
+            raise GiteaHttpError(http_status=e.code) from e  # pragma: no cover
         except (urllib.error.URLError, TimeoutError) as e:
-            reason = getattr(e, "reason", e)
-            raise RuntimeError(
-                f"network error contacting Gitea: {_redact(reason)}"
-            ) from e
+            # Fixed message only — do not embed URLError reason (may leak paths).
+            raise GiteaNetworkError(reason_code="network_error") from e
 
         if not body:
             return None
         try:
             return json.loads(body)
         except ValueError as e:
+            # Programming/protocol failure — not authentication.
             raise RuntimeError("malformed JSON response from Gitea") from e
 
 

gitea_mcp_server.py

@@ -1084,7 +1084,9 @@ from gitea_auth import (  # noqa: E402
     repo_api_url,
     get_profile,
     gitea_url,
+    GiteaConfigError,
 )
+import mcp_tool_error_boundary  # noqa: E402
 import gitea_audit  # noqa: E402
 import gitea_config  # noqa: E402
 import capability_stop_terminal  # noqa: E402
@@ -1464,6 +1466,12 @@ def _with_optional_url(result: dict, url: str | None) -> dict:
         result["url"] = url
     return result
 
+# #699: known auth/authz/network/config failures → structured CallToolResult
+# isError; stdio transport must survive (no unhandled raise / process exit).
+from mcp.server.fastmcp.tools.base import Tool as _FastMCPTool  # noqa: E402
+
+mcp_tool_error_boundary.install_tool_run_boundary(_FastMCPTool)
+
 mcp = FastMCP("gitea-tools", instructions=(
     "Gitea issue tracker and PR management for dadeschools and prgs instances. "
     "Use the gitea_ prefixed tools to create issues, PRs, list issues, etc."
@@ -1801,13 +1809,16 @@ def _enforce_remote_repo_guard(
 
 
 def _auth(host: str) -> str:
-    """Get auth header, raise if unavailable."""
+    """Get auth header, raise if unavailable.
+
+    Missing credentials are a configuration failure, not a silent internal
+    crash. Typed as :class:`gitea_auth.GiteaConfigError` so the tool-error
+    boundary (#699) maps them to a structured isError result without EOF.
+    The exception message is a fixed constant (no host/token material).
+    """
     header = get_auth_header(host)
     if header is None:
-        raise RuntimeError(
-            f"No credentials for {host}. "
-            "Ensure you've logged in via HTTPS at least once."
-        )
+        raise GiteaConfigError(reason_code="config_error")
     return header
 
 
@@ -3338,8 +3349,6 @@ def init_review_decision_lock(remote: str | None, task: str | None, force: bool
         "live_mutations": [],
         "correction_authorized": False,
         "correction_reason": None,
-        "correction_pr_number": None,
-        "correction_head_sha": None,
     })
 
 
@@ -3424,30 +3433,21 @@ def check_review_decision_gate(
     if stale_review_decision_lock.prior_live_mutations_block_boundary(
         lock, pr_number=pr_number, expected_head_sha=ready_head
     ):
-        scoped = stale_review_decision_lock.correction_applies(
-            lock, pr_number=pr_number, expected_head_sha=ready_head
-        )
-        if prior and not scoped:
+        if prior and not lock.get("correction_authorized"):
             reasons.append(
                 "live review mutation already recorded for this PR head in this "
                 "run; only one live review mutation is allowed per head unless "
-                "gitea_authorize_review_correction was invoked for this same "
-                "PR/head (fail closed, #620/#693)"
+                "gitea_authorize_review_correction was invoked (fail closed, #620)"
             )
         elif (
             action in _TERMINAL_REVIEW_ACTIONS
-            and any(
-                isinstance(m, dict)
-                and m.get("action") in _TERMINAL_REVIEW_ACTIONS
-                and m.get("pr_number") == pr_number
-                for m in prior
-            )
-            and not scoped
+            and any(m.get("action") in _TERMINAL_REVIEW_ACTIONS for m in prior)
+            and not lock.get("correction_authorized")
         ):
             reasons.append(
                 "terminal review decision already submitted for this PR head in "
                 "this run; blocked unless an operator-approved correction was "
-                "authorized for this same PR/head (fail closed, #620/#693)"
+                "authorized (fail closed, #620)"
             )
 
     return reasons
@@ -3472,8 +3472,6 @@ def record_live_review_mutation(pr_number: int, action: str, review_id: int | No
     if lock.get("correction_authorized"):
         lock["correction_authorized"] = False
         lock["correction_reason"] = None
-        lock["correction_pr_number"] = None
-        lock["correction_head_sha"] = None
     _save_review_decision_lock(lock)
 
 
@@ -3517,13 +3515,11 @@ def terminal_review_hard_stop_reasons(
         and last.get("pr_number") == pr_number
     ):
         return []
-    if operation in ("mark_ready", "review", "resume") and (
-        stale_review_decision_lock.correction_applies(
-            lock, pr_number=pr_number, expected_head_sha=expected_head_sha
-        )
+    if operation in ("mark_ready", "review", "resume") and lock.get(
+        "correction_authorized"
     ):
         return []
-    # #620 same-PR new head + #693 cross-PR isolation.
+    # #620: same PR, different reviewed head → fresh decision boundary.
     if stale_review_decision_lock.terminal_boundary_allows_fresh_decision(
         lock,
         pr_number=pr_number,
@@ -3545,20 +3541,16 @@ def terminal_review_hard_stop_reasons(
         else ""
     )
     recovery = (
-        "exact_next_action: if that PR is already merged/closed, use "
-        "gitea_cleanup_stale_review_decision_lock(apply=true) after live-state "
-        "proof (#594); if the same PR head moved, mark/submit with the new "
-        "expected_head_sha (#620); if the target is a different PR, "
-        "gitea_diagnose_review_decision_lock then mark_final on the target "
-        "(cross-PR isolation, #693); if same-head verdict was mistaken, "
-        "gitea_authorize_review_correction with matching target_pr_number "
-        "(not a generic unlock); never delete session-state files by hand; "
-        "if still blocked create/update a durable Gitea issue and stop"
+        "if that PR is already merged/closed, use "
+        "gitea_cleanup_stale_review_decision_lock (apply=true) after live-state "
+        "proof (#594); if the PR is still open but the head moved, mark/submit "
+        "with the new expected_head_sha (#620); never delete session-state "
+        "files by hand"
     )
     return [
         "terminal review mutation already consumed in this run "
         f"({last.get('action')} on PR #{last.get('pr_number')}{head_note}); "
-        f"{guidance} (fail closed, #332/#693); {recovery}"
+        f"{guidance} (fail closed, #332); {recovery}"
     ]
 
 
@@ -4140,33 +4132,10 @@ def gitea_mark_final_review_decision(
             "reasons": [
                 "review decision lock missing; resolve review_pr capability first"
             ],
-            "exact_next_action": (
-                "gitea_resolve_task_capability(task='review_pr') then retry "
-                "mark_final"
-            ),
-            "durable_issue_handoff": {
-                "required": True,
-                "instruction": (
-                    "If the lock cannot be seeded, create/update a durable "
-                    "Gitea issue and stop (#693 AC8)"
-                ),
-            },
         }
     session_reasons = _review_decision_session_reasons(lock)
     if session_reasons:
-        classification = stale_review_decision_lock.classify_review_decision_lock(
-            lock,
-            target_pr_number=pr_number,
-            target_head_sha=expected_head_sha,
-            session_blockers=session_reasons,
-        )
-        fail = stale_review_decision_lock.build_precise_mark_final_failure(
-            classification
-        )
-        return {
-            "marked_ready": False,
-            **fail,
-        }
+        return {"marked_ready": False, "reasons": session_reasons}
     if remote != lock.get("remote"):
         return {
             "marked_ready": False,
@@ -4174,7 +4143,6 @@ def gitea_mark_final_review_decision(
                 f"requested remote '{remote}' does not match locked remote "
                 f"'{lock.get('remote')}' (fail closed)"
             ],
-            "exact_next_action": "use the remote bound on the decision lock",
         }
     try:
         _, resolved_org, resolved_repo = _resolve(remote, None, org, repo)
@@ -4209,26 +4177,7 @@ def gitea_mark_final_review_decision(
         pr_number, "mark_ready", expected_head_sha=expected_head_sha
     )
     if hard_stop:
-        classification = stale_review_decision_lock.classify_review_decision_lock(
-            lock,
-            target_pr_number=pr_number,
-            target_head_sha=expected_head_sha,
-            active_profile_identity=_decision_lock_binding().get(
-                "profile_identity"
-            ),
-        )
-        fail = stale_review_decision_lock.build_precise_mark_final_failure(
-            classification
-        )
-        # Prefer classification next_action when more precise; keep hard_stop
-        # text as primary reasons for operators.
-        return {
-            "marked_ready": False,
-            "reasons": hard_stop + list(fail.get("reasons") or []),
-            "classification": fail.get("classification"),
-            "exact_next_action": fail.get("exact_next_action"),
-            "durable_issue_handoff": fail.get("durable_issue_handoff"),
-        }
+        return {"marked_ready": False, "reasons": hard_stop}
     if action not in _REVIEW_ACTIONS:
         return {
             "marked_ready": False,
@@ -4244,63 +4193,17 @@ def gitea_mark_final_review_decision(
                 "expected_head_sha required before marking final review "
                 "decision (fail closed, #399)"
             ],
-            "exact_next_action": "retry mark_final with expected_head_sha pin",
-        }
-    # Safe idempotency: already ready for same PR/action/head (#693 AC4).
-    ready_head = stale_review_decision_lock.normalize_head_sha(
-        lock.get("ready_expected_head_sha")
-    )
-    target_head = stale_review_decision_lock.normalize_head_sha(expected_head_sha)
-    if (
-        lock.get("final_review_decision_ready")
-        and lock.get("ready_pr_number") == pr_number
-        and lock.get("ready_action") == action
-        and ready_head
-        and target_head
-        and stale_review_decision_lock.heads_equal(ready_head, target_head)
-        and lock.get("ready_remote") == remote
-        and lock.get("ready_org") == org
-        and lock.get("ready_repo") == repo
-    ):
-        return {
-            "marked_ready": True,
-            "idempotent": True,
-            "pr_number": pr_number,
-            "action": action,
-            "expected_head_sha": expected_head_sha,
-            "remote": remote,
-            "org": org,
-            "repo": repo,
-            "final_review_decision_ready": True,
-            "head_scoped": True,
-            "reasons": [
-                "final review decision already marked ready for this PR/action/"
-                "head (idempotent, #693)"
-            ],
         }
     if stale_review_decision_lock.prior_live_mutations_block_boundary(
         lock, pr_number=pr_number, expected_head_sha=expected_head_sha
     ):
-        classification = stale_review_decision_lock.classify_review_decision_lock(
-            lock,
-            target_pr_number=pr_number,
-            target_head_sha=expected_head_sha,
-        )
-        fail = stale_review_decision_lock.build_precise_mark_final_failure(
-            classification
-        )
         return {
             "marked_ready": False,
             "reasons": [
                 "cannot mark final decision after a live review mutation was "
                 "already recorded for this PR head unless an operator-approved "
-                "correction was authorized for this same PR/head "
-                "(fail closed, #620/#693)"
-            ]
-            + list(fail.get("reasons") or []),
-            "classification": fail.get("classification"),
-            "exact_next_action": fail.get("exact_next_action"),
-            "durable_issue_handoff": fail.get("durable_issue_handoff"),
+                "correction was authorized (fail closed, #620)"
+            ],
         }
     elig = gitea_check_pr_eligibility(
         pr_number=pr_number,
@@ -4384,19 +4287,8 @@ def gitea_authorize_review_correction(
     prior_review_state: str,
     reason: str,
     operator_authorized: bool = False,
-    target_pr_number: int | None = None,
-    expected_head_sha: str | None = None,
-    remote: str = "dadeschools",
-    org: str | None = None,
-    repo: str | None = None,
-    post_audit_comment: bool = True,
 ) -> dict:
-    """Authorize one operator-approved correction after a mistaken live review.
-
-    #693: correction is scoped to the named prior review's **PR and head**.
-    It cannot unlock a different PR (no generic decision-lock bypass).
-    Successful authorization posts a thread-visible audit on the target PR.
-    """
+    """Authorize one operator-approved correction after a mistaken live review."""
     reason = (reason or "").strip()
     prior_review_state = (prior_review_state or "").strip().lower()
     lock = _load_review_decision_lock()
@@ -4422,20 +4314,7 @@ def gitea_authorize_review_correction(
     last_mutation = prior[-1]
     last_review_id = last_mutation.get("review_id")
     last_review_state = last_mutation.get("action")
-    last_pr = last_mutation.get("pr_number")
-    last_head = stale_review_decision_lock.mutation_head_sha(last_mutation, lock)
     reasons = []
-    if target_pr_number is None:
-        reasons.append(
-            "target_pr_number is required so correction cannot become a "
-            "generic unlock (fail closed, #693)"
-        )
-    elif last_pr is not None and int(target_pr_number) != int(last_pr):
-        reasons.append(
-            f"target_pr_number #{target_pr_number} does not match last "
-            f"recorded mutation PR #{last_pr}; correction cannot unlock a "
-            f"different PR (fail closed, #693)"
-        )
     if last_review_id is not None and last_review_id != prior_review_id:
         reasons.append(
             f"prior review ID '{prior_review_id}' does not match last "
@@ -4446,202 +4325,14 @@ def gitea_authorize_review_correction(
             f"prior review state '{prior_review_state}' does not match last "
             f"recorded review state '{last_review_state}' (fail closed)"
         )
-    want_head = stale_review_decision_lock.normalize_head_sha(expected_head_sha)
-    if want_head and last_head and not stale_review_decision_lock.heads_equal(
-        want_head, last_head
-    ):
-        reasons.append(
-            f"expected_head_sha does not match last mutation head "
-            f"{last_head[:12]}… (fail closed, #693)"
-        )
     if not reason:
         reasons.append("correction reason is required")
-    try:
-        actor = None
-        h, o, r = _resolve(remote, None, org, repo)
-        try:
-            actor = _authenticated_username(h)
-        except Exception:
-            actor = None
-    except Exception as exc:  # noqa: BLE001
-        return {
-            "authorized": False,
-            "reasons": [f"could not resolve remote for audit: {_redact(str(exc))}"],
-        }
-    profile = get_profile()
-    profile_name = (profile.get("profile_name") or "").strip() or None
-    audit = stale_review_decision_lock.build_correction_audit_record(
-        prior_review_id=prior_review_id,
-        prior_review_state=prior_review_state,
-        target_pr_number=target_pr_number if target_pr_number is not None else last_pr,
-        target_head_sha=want_head or last_head,
-        reason=reason,
-        actor_username=actor,
-        profile_name=profile_name,
-        authorized=False,
-    )
     if reasons:
-        return {
-            "authorized": False,
-            "reasons": reasons,
-            "audit": audit,
-            "exact_next_action": (
-                "use same-PR correction only, or for a different PR use "
-                "gitea_diagnose_review_decision_lock / cross-PR isolation "
-                "(#693) or moot cleanup (#594)"
-            ),
-        }
-    scope_pr = int(target_pr_number) if target_pr_number is not None else int(last_pr)
-    scope_head = want_head or last_head
+        return {"authorized": False, "reasons": reasons}
     lock["correction_authorized"] = True
     lock["correction_reason"] = reason
-    lock["correction_pr_number"] = scope_pr
-    lock["correction_head_sha"] = scope_head
     _save_review_decision_lock(lock)
-    audit = stale_review_decision_lock.build_correction_audit_record(
-        prior_review_id=prior_review_id,
-        prior_review_state=prior_review_state,
-        target_pr_number=scope_pr,
-        target_head_sha=scope_head,
-        reason=reason,
-        actor_username=actor,
-        profile_name=profile_name,
-        authorized=True,
-    )
-    report = {
-        "authorized": True,
-        "correction_reason": reason,
-        "correction_pr_number": scope_pr,
-        "correction_head_sha": scope_head,
-        "audit": audit,
-        "audit_comment_id": None,
-        "reasons": [],
-        "scope": "same_pr_head_only",
-    }
-    if post_audit_comment and scope_pr is not None:
-        comment_block = _profile_operation_gate("gitea.pr.comment")
-        if comment_block:
-            report["audit_comment_skipped"] = comment_block
-        else:
-            try:
-                auth = _auth(h)
-                body = stale_review_decision_lock.format_correction_audit_comment(
-                    audit
-                )
-                with _audited(
-                    "comment_pr",
-                    host=h,
-                    remote=remote,
-                    org=o,
-                    repo=r,
-                    pr_number=scope_pr,
-                    request_metadata={"source": "authorize_review_correction"},
-                ):
-                    posted = api_request(
-                        "POST",
-                        f"{repo_api_url(h, o, r)}/issues/{scope_pr}/comments",
-                        auth,
-                        {"body": body},
-                    )
-                report["audit_comment_id"] = (posted or {}).get("id")
-            except Exception as exc:  # noqa: BLE001
-                report["audit_comment_error"] = _redact(str(exc))
-    return report
-
-
-@mcp.tool()
-def gitea_diagnose_review_decision_lock(
-    target_pr_number: int,
-    expected_head_sha: str | None = None,
-    remote: str = "dadeschools",
-    host: str | None = None,
-    org: str | None = None,
-    repo: str | None = None,
-) -> dict:
-    """Read-only: classify durable review-decision lock state for a target PR (#693).
-
-    Returns a deterministic classification, owner/evidence, exact next_action,
-    and whether mark_final / cleanup / scoped correction are appropriate.
-    Never mutates the lock and never authorizes correction.
-    """
-    read_block = _profile_operation_gate("gitea.read")
-    if read_block:
-        return {
-            "success": False,
-            "reasons": read_block,
-            "permission_report": _permission_block_report("gitea.read"),
-        }
-    h, o, r = _resolve(remote, host, org, repo)
-    auth = _auth(h)
-    binding = _decision_lock_binding()
-    lock = _load_review_decision_lock()
-    session_blockers = _review_decision_session_reasons(lock) if lock else []
-    last = stale_review_decision_lock.last_terminal_mutation(lock)
-    pr_live = None
-    pr_lookup_error = None
-    last_pr = last.get("pr_number") if last else None
-    if last_pr is not None:
-        try:
-            pr_live = api_request(
-                "GET", f"{repo_api_url(h, o, r)}/pulls/{last_pr}", auth
-            ) or {}
-            if not pr_live:
-                pr_lookup_error = "empty PR payload"
-        except Exception as exc:  # noqa: BLE001
-            pr_lookup_error = _redact(str(exc))
-    classification = stale_review_decision_lock.classify_review_decision_lock(
-        lock,
-        target_pr_number=target_pr_number,
-        target_head_sha=expected_head_sha,
-        pr_live=pr_live,
-        pr_lookup_error=pr_lookup_error,
-        active_profile_identity=binding.get("profile_identity"),
-        session_blockers=session_blockers,
-    )
-    recovery = stale_review_decision_lock.assess_open_pr_decision_lock_recovery(
-        lock,
-        target_pr_number=target_pr_number,
-        target_head_sha=expected_head_sha,
-        last_terminal_pr_live=pr_live,
-        pr_lookup_error=pr_lookup_error,
-        active_profile_identity=binding.get("profile_identity"),
-        session_blockers=session_blockers,
-    )
-    try:
-        actor = _authenticated_username(h)
-    except Exception:
-        actor = None
-    return {
-        "success": True,
-        "remote": remote,
-        "org": o,
-        "repo": r,
-        "authenticated_username": actor,
-        "active_profile_identity": binding.get("profile_identity"),
-        "classification": classification.get("classification"),
-        "mark_final_allowed": classification.get("mark_final_allowed"),
-        "cleanup_allowed": classification.get("cleanup_allowed"),
-        "correction_eligible": classification.get("correction_eligible"),
-        "recovery_allowed": recovery.get("recovery_allowed"),
-        "recovery_mode": recovery.get("recovery_mode"),
-        "exact_next_action": classification.get("next_action"),
-        "owner_profile_identity": classification.get("owner_profile_identity"),
-        "last_terminal_pr": classification.get("last_terminal_pr"),
-        "last_terminal_action": classification.get("last_terminal_action"),
-        "locked_head_sha": classification.get("locked_head_sha"),
-        "target_pr_number": target_pr_number,
-        "target_head_sha": stale_review_decision_lock.normalize_head_sha(
-            expected_head_sha
-        ),
-        "lock_summary": classification.get("lock_summary"),
-        "evidence": classification.get("evidence"),
-        "reasons": list(classification.get("reasons") or []),
-        "manual_file_delete_forbidden": True,
-        "correction_as_generic_unlock_forbidden": True,
-        "durable_issue_handoff": stale_review_decision_lock.build_precise_mark_final_failure(
-            classification
-        ).get("durable_issue_handoff"),
-    }
+    return {"authorized": True, "correction_reason": reason, "reasons": []}
 
 
 @mcp.tool()

mcp_tool_error_boundary.py

@@ -0,0 +1,451 @@
+"""MCP tool-boundary error mapping for known Gitea client failures (#699).
+
+Known authentication / authorization / network / configuration failures leave
+the tool boundary as a sanitized structured ``CallToolResult`` with
+``isError=True``. Stdio transport remains connected.
+
+Design constraints (reviewer-ratified, #699 / PR #701):
+
+1. **No secret material** in tool results or daemon logs. Messages are fixed
+   constants keyed by ``reason_code``; HTTP bodies / exception text never
+   surface. Sanitization failure fails closed to ``internal_error``.
+2. **Narrow boundary** wraps the original FastMCP ``Tool.run`` success path;
+   re-raises framework control-flow exceptions (``UrlElicitationRequiredError``);
+   maps only typed client failures. Installation is idempotent.
+3. **No RuntimeError substring heuristics.** Only explicit typed
+   authentication / authorization / network / configuration exceptions
+   receive those labels.
+4. **HTTP classification** lives in ``gitea_auth.classify_http_status``;
+   every 403 is authorization-class.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import sys
+from typing import Any
+
+logger = logging.getLogger("gitea_mcp.tool_error_boundary")
+
+# Stable reason codes (#699).
+REASON_AUTH_FAILED = "auth_failed"
+REASON_AUTH_INVALID_TOKEN = "auth_invalid_token"
+REASON_AUTHZ_INSUFFICIENT_SCOPE = "authz_insufficient_scope"
+REASON_AUTHZ_DENIED = "authz_denied"
+REASON_NETWORK_ERROR = "network_error"
+REASON_CONFIG_ERROR = "config_error"
+REASON_INTERNAL_ERROR = "internal_error"
+REASON_UPSTREAM_UNAVAILABLE = "upstream_unavailable"
+REASON_HTTP_ERROR = "http_error"
+
+ERROR_CLASS_AUTHENTICATION = "authentication"
+ERROR_CLASS_AUTHORIZATION = "authorization"
+ERROR_CLASS_NETWORK = "network"
+ERROR_CLASS_CONFIGURATION = "configuration"
+ERROR_CLASS_INTERNAL = "internal"
+ERROR_CLASS_UPSTREAM = "upstream"
+
+# Fixed, secret-free operator messages. Never interpolate HTTP bodies,
+# Keychain contents, tokens, or arbitrary exception text.
+FIXED_MESSAGES: dict[str, str] = {
+    REASON_AUTH_FAILED: "Gitea authentication failed",
+    REASON_AUTH_INVALID_TOKEN: (
+        "Gitea authentication failed: invalid or revoked credentials"
+    ),
+    REASON_AUTHZ_INSUFFICIENT_SCOPE: (
+        "Gitea authorization failed: insufficient token scope"
+    ),
+    REASON_AUTHZ_DENIED: "Gitea authorization failed: access denied",
+    REASON_NETWORK_ERROR: "Network error contacting Gitea",
+    REASON_CONFIG_ERROR: "Gitea configuration or credential resolution failed",
+    REASON_INTERNAL_ERROR: "Internal tool error",
+    REASON_UPSTREAM_UNAVAILABLE: "Gitea upstream unavailable",
+    REASON_HTTP_ERROR: "Gitea HTTP request failed",
+}
+
+_INSTALL_FLAG = "_gitea_auth_boundary_installed"
+_ORIGINAL_ATTR = "_gitea_auth_boundary_original"
+
+
+def fixed_message(reason_code: str) -> str:
+    """Return the fixed sanitized message for *reason_code* (fail closed)."""
+    return FIXED_MESSAGES.get(reason_code, FIXED_MESSAGES[REASON_INTERNAL_ERROR])
+
+
+def _safe_profile_name() -> str | None:
+    try:
+        from gitea_auth import get_profile
+
+        name = (get_profile() or {}).get("profile_name")
+        if name is None:
+            return None
+        text = str(name).strip()
+        # Profile names are non-secret identifiers; still bound length.
+        return text[:80] if text else None
+    except Exception:
+        return None
+
+
+def _is_framework_control_flow(exc: BaseException) -> bool:
+    """True for exceptions the MCP framework must re-raise unchanged."""
+    try:
+        from mcp.shared.exceptions import UrlElicitationRequiredError
+
+        if isinstance(exc, UrlElicitationRequiredError):
+            return True
+    except Exception:
+        pass
+    # BaseException subclasses that must never become tool isError payloads.
+    if isinstance(exc, (KeyboardInterrupt, SystemExit, GeneratorExit)):
+        return True
+    return False
+
+
+def is_known_client_failure(exc: BaseException) -> bool:
+    """True only for explicit typed Gitea client / config failures.
+
+    Never true for arbitrary ``RuntimeError`` (reviewer finding #3).
+    """
+    try:
+        import gitea_auth
+
+        if isinstance(
+            exc,
+            (
+                gitea_auth.GiteaAuthError,
+                gitea_auth.GiteaAuthzError,
+                gitea_auth.GiteaNetworkError,
+                gitea_auth.GiteaConfigError,
+                gitea_auth.GiteaHttpError,
+            ),
+        ):
+            return True
+    except Exception:
+        return False
+    try:
+        import gitea_config
+
+        if isinstance(exc, gitea_config.ConfigError):
+            return True
+    except Exception:
+        pass
+    return False
+
+
+def classify_exception(exc: BaseException) -> dict[str, Any]:
+    """Return structured classification with **fixed** messages only.
+
+    Only typed authentication / authorization / network / configuration
+    failures receive those labels. Unexpected programming failures are
+    ``internal_error``. HTTP bodies and exception text are never copied
+    into ``message``.
+    """
+    try:
+        return _classify_exception_impl(exc)
+    except Exception:
+        # Fail closed: sanitization / classification failure must not leak.
+        return {
+            "reason_code": REASON_INTERNAL_ERROR,
+            "error_class": ERROR_CLASS_INTERNAL,
+            "http_status": None,
+            "message": fixed_message(REASON_INTERNAL_ERROR),
+            "transport_survives": True,
+        }
+
+
+def _classify_exception_impl(exc: BaseException) -> dict[str, Any]:
+    import gitea_auth
+
+    if isinstance(exc, gitea_auth.GiteaAuthError):
+        code = getattr(exc, "reason_code", None) or REASON_AUTH_INVALID_TOKEN
+        if code not in (
+            REASON_AUTH_FAILED,
+            REASON_AUTH_INVALID_TOKEN,
+        ):
+            code = REASON_AUTH_INVALID_TOKEN
+        return {
+            "reason_code": code,
+            "error_class": ERROR_CLASS_AUTHENTICATION,
+            "http_status": getattr(exc, "http_status", None) or 401,
+            "message": fixed_message(code),
+            "transport_survives": True,
+        }
+    if isinstance(exc, gitea_auth.GiteaAuthzError):
+        code = getattr(exc, "reason_code", None) or REASON_AUTHZ_DENIED
+        if code not in (REASON_AUTHZ_DENIED, REASON_AUTHZ_INSUFFICIENT_SCOPE):
+            code = REASON_AUTHZ_DENIED
+        return {
+            "reason_code": code,
+            "error_class": ERROR_CLASS_AUTHORIZATION,
+            "http_status": getattr(exc, "http_status", None) or 403,
+            "message": fixed_message(code),
+            "transport_survives": True,
+        }
+    if isinstance(exc, gitea_auth.GiteaNetworkError):
+        return {
+            "reason_code": REASON_NETWORK_ERROR,
+            "error_class": ERROR_CLASS_NETWORK,
+            "http_status": getattr(exc, "http_status", None),
+            "message": fixed_message(REASON_NETWORK_ERROR),
+            "transport_survives": True,
+        }
+    if isinstance(exc, gitea_auth.GiteaConfigError):
+        return {
+            "reason_code": REASON_CONFIG_ERROR,
+            "error_class": ERROR_CLASS_CONFIGURATION,
+            "http_status": getattr(exc, "http_status", None),
+            "message": fixed_message(REASON_CONFIG_ERROR),
+            "transport_survives": True,
+        }
+    if isinstance(exc, gitea_auth.GiteaHttpError):
+        code = getattr(exc, "reason_code", None) or REASON_HTTP_ERROR
+        if code == REASON_UPSTREAM_UNAVAILABLE:
+            error_class = ERROR_CLASS_UPSTREAM
+        else:
+            error_class = ERROR_CLASS_INTERNAL
+            code = REASON_HTTP_ERROR
+        return {
+            "reason_code": code,
+            "error_class": error_class,
+            "http_status": getattr(exc, "http_status", None),
+            "message": fixed_message(code),
+            "transport_survives": True,
+        }
+
+    try:
+        import gitea_config
+
+        if isinstance(exc, gitea_config.ConfigError):
+            return {
+                "reason_code": REASON_CONFIG_ERROR,
+                "error_class": ERROR_CLASS_CONFIGURATION,
+                "http_status": None,
+                "message": fixed_message(REASON_CONFIG_ERROR),
+                "transport_survives": True,
+            }
+    except Exception:
+        pass
+
+    # Unwrap FastMCP ToolError cause when the original was a typed failure.
+    cause = getattr(exc, "__cause__", None)
+    if cause is not None and cause is not exc and is_known_client_failure(cause):
+        return _classify_exception_impl(cause)
+
+    # No message-substring authentication heuristics (reviewer finding #3).
+    return {
+        "reason_code": REASON_INTERNAL_ERROR,
+        "error_class": ERROR_CLASS_INTERNAL,
+        "http_status": None,
+        "message": fixed_message(REASON_INTERNAL_ERROR),
+        "transport_survives": True,
+    }
+
+
+def build_structured_error_payload(
+    classification: dict[str, Any],
+    *,
+    tool_name: str | None = None,
+    profile_name: str | None = None,
+) -> dict[str, Any]:
+    """LLM-safe structured payload — fixed message + typed metadata only."""
+    try:
+        reason = str(classification.get("reason_code") or REASON_INTERNAL_ERROR)
+        message = fixed_message(reason)
+        # Refuse to emit any classification message that is not the fixed constant.
+        if classification.get("message") != message:
+            message = fixed_message(reason)
+        payload: dict[str, Any] = {
+            "success": False,
+            "isError": True,
+            "reason_code": reason if reason in FIXED_MESSAGES else REASON_INTERNAL_ERROR,
+            "error_class": classification.get("error_class") or ERROR_CLASS_INTERNAL,
+            "message": message,
+            "transport_survives": True,
+            "retryable": classification.get("error_class")
+            in {
+                ERROR_CLASS_AUTHENTICATION,
+                ERROR_CLASS_NETWORK,
+                ERROR_CLASS_CONFIGURATION,
+            },
+        }
+        status = classification.get("http_status")
+        if isinstance(status, int):
+            payload["http_status"] = status
+        if tool_name and isinstance(tool_name, str):
+            # Tool names are identifiers, not secrets; bound length.
+            payload["tool"] = tool_name[:120]
+        if profile_name and isinstance(profile_name, str):
+            payload["profile"] = profile_name[:80]
+        return payload
+    except Exception:
+        return {
+            "success": False,
+            "isError": True,
+            "reason_code": REASON_INTERNAL_ERROR,
+            "error_class": ERROR_CLASS_INTERNAL,
+            "message": fixed_message(REASON_INTERNAL_ERROR),
+            "transport_survives": True,
+            "retryable": False,
+        }
+
+
+def log_sanitized_daemon_reason(
+    classification: dict[str, Any],
+    *,
+    tool_name: str | None = None,
+    stream=None,
+) -> None:
+    """Daemon log: reason codes only — never exception text or response bodies."""
+    stream = stream if stream is not None else sys.stderr
+    try:
+        reason = classification.get("reason_code") or REASON_INTERNAL_ERROR
+        error_class = classification.get("error_class") or ERROR_CLASS_INTERNAL
+        # Only emit known tokens; never classification['message'] from callers
+        # that might have been poisoned.
+        if reason not in FIXED_MESSAGES:
+            reason = REASON_INTERNAL_ERROR
+            error_class = ERROR_CLASS_INTERNAL
+        parts = [
+            "mcp_tool_error",
+            f"reason_code={reason}",
+            f"error_class={error_class}",
+        ]
+        if tool_name and isinstance(tool_name, str):
+            parts.append(f"tool={tool_name[:120]}")
+        status = classification.get("http_status")
+        if isinstance(status, int):
+            parts.append(f"http_status={status}")
+        # Intentionally no detail= / message= field — secrets lived there.
+        line = " ".join(parts)
+        stream.write(line + "\n")
+        if hasattr(stream, "flush"):
+            stream.flush()
+        logger.warning(line)
+    except Exception:
+        # Fail closed: never fall back to logging the exception.
+        try:
+            stream.write(
+                "mcp_tool_error reason_code=internal_error "
+                "error_class=internal\n"
+            )
+            if hasattr(stream, "flush"):
+                stream.flush()
+        except Exception:
+            pass
+
+
+def to_call_tool_result(
+    exc: BaseException,
+    *,
+    tool_name: str | None = None,
+    profile_name: str | None = None,
+    log: bool = True,
+) -> Any:
+    """Build a FastMCP ``CallToolResult`` with ``isError=True`` for *exc*."""
+    from mcp.types import CallToolResult, TextContent
+
+    try:
+        classification = classify_exception(exc)
+        if log:
+            log_sanitized_daemon_reason(classification, tool_name=tool_name)
+        payload = build_structured_error_payload(
+            classification, tool_name=tool_name, profile_name=profile_name
+        )
+        text = json.dumps(payload, indent=2, sort_keys=True)
+        return CallToolResult(
+            content=[TextContent(type="text", text=text)],
+            structuredContent=payload,
+            isError=True,
+        )
+    except Exception:
+        # Absolute fail-closed path — no exception text.
+        fallback = {
+            "success": False,
+            "isError": True,
+            "reason_code": REASON_INTERNAL_ERROR,
+            "error_class": ERROR_CLASS_INTERNAL,
+            "message": fixed_message(REASON_INTERNAL_ERROR),
+            "transport_survives": True,
+            "retryable": False,
+        }
+        return CallToolResult(
+            content=[
+                TextContent(
+                    type="text",
+                    text=json.dumps(fallback, indent=2, sort_keys=True),
+                )
+            ],
+            structuredContent=fallback,
+            isError=True,
+        )
+
+
+def install_tool_run_boundary(Tool) -> bool:
+    """Install a **narrow** error boundary around FastMCP ``Tool.run``.
+
+    Strategy (preserves framework semantics):
+
+    * Call the **original** ``Tool.run`` for the success path (async, return
+      types, convert_result, protocol behavior unchanged).
+    * Re-raise ``UrlElicitationRequiredError`` and other control-flow
+      exceptions without mapping to ``internal_error``.
+    * Map typed Gitea client failures (and ToolError whose ``__cause__`` is
+      typed) to structured ``CallToolResult(isError=True)``.
+    * Map remaining unexpected tool failures to fixed ``internal_error``
+      isError results (transport survival) without secret-bearing text.
+    * Idempotent: second install is a no-op and returns ``False``.
+    """
+    if getattr(Tool.run, _INSTALL_FLAG, False):
+        return False
+
+    from mcp.server.fastmcp.exceptions import ToolError
+    from mcp.shared.exceptions import UrlElicitationRequiredError
+
+    original_run = Tool.run
+
+    async def run_boundary(
+        self,
+        arguments: dict[str, Any],
+        context=None,
+        convert_result: bool = False,
+    ) -> Any:
+        try:
+            return await original_run(
+                self,
+                arguments,
+                context=context,
+                convert_result=convert_result,
+            )
+        except UrlElicitationRequiredError:
+            # Framework control-flow — must not become internal_error.
+            raise
+        except BaseException as exc:
+            if _is_framework_control_flow(exc):
+                raise
+            if not isinstance(exc, Exception):
+                raise
+
+            # Prefer typed cause under FastMCP ToolError wrappers.
+            target: BaseException = exc
+            if isinstance(exc, ToolError) and exc.__cause__ is not None:
+                target = exc.__cause__
+
+            # Known client failures → structured isError with reason codes.
+            # Unexpected failures → fixed internal_error isError (no secrets).
+            profile_name = _safe_profile_name()
+            return to_call_tool_result(
+                target,
+                tool_name=getattr(self, "name", None),
+                profile_name=profile_name,
+            )
+
+    setattr(run_boundary, _INSTALL_FLAG, True)
+    setattr(run_boundary, _ORIGINAL_ATTR, original_run)
+    Tool.run = run_boundary  # type: ignore[method-assign]
+    return True
+
+
+def boundary_is_installed(Tool) -> bool:
+    """True when the #699 boundary is active on *Tool.run*."""
+    return bool(getattr(Tool.run, _INSTALL_FLAG, False))

stale_review_decision_lock.py

@@ -1,4 +1,4 @@
-"""Stale / moot #332 review-decision lock detection and cleanup policy (#594/#620/#693).
+"""Stale / moot #332 review-decision lock detection and cleanup policy (#594/#620).
 
 #332 correctly hard-stops a reviewer session after a terminal live review
 mutation. After #559 those locks are durable on disk, so they can outlive the
@@ -12,11 +12,6 @@ on head B of the **same open PR**. Same-head duplicates remain fail-closed.
 Open-PR lock *cleanup* remains forbidden unless the PR is truly merged/closed
 (#594); new-head re-review is allowed without deleting the durable lock.
 
-#693 scopes the terminal boundary by **PR number**: a terminal on open PR A
-must not block a fresh formal decision on open PR B on the same durable
-profile lock (cross-PR isolation). Correction authorization is scoped to the
-named prior review's PR/head and cannot unlock a different PR.
-
 This module is pure policy (no Gitea I/O). The MCP tool
 ``gitea_cleanup_stale_review_decision_lock`` fetches live PR state, calls these
 helpers, and only then clears durable state when cleanup is allowed.
@@ -85,45 +80,17 @@ def last_terminal_mutation(lock: dict | None) -> dict | None:
     return terminals[-1] if terminals else None
 
 
-def correction_applies(
-    lock: dict | None,
-    *,
-    pr_number: int | None = None,
-    expected_head_sha: str | None = None,
-) -> bool:
-    """True when operator correction is active and scoped to the target (#693).
-
-    Global ``correction_authorized`` alone is not enough: correction must name
-    the same PR (and head when recorded) as the decision being re-opened.
-    Missing scope fields on legacy locks fail closed (do not apply).
-    """
-    if not lock or not lock.get("correction_authorized"):
-        return False
-    corr_pr = lock.get("correction_pr_number")
-    if corr_pr is None:
-        # Legacy unscoped correction — refuse as generic unlock (#693).
-        return False
-    if pr_number is not None and int(corr_pr) != int(pr_number):
-        return False
-    corr_head = normalize_head_sha(lock.get("correction_head_sha"))
-    target = normalize_head_sha(expected_head_sha)
-    if corr_head and target and not heads_equal(corr_head, target):
-        return False
-    return True
-
-
 def prior_live_mutations_block_boundary(
     lock: dict | None,
     *,
     pr_number: int,
     expected_head_sha: str | None,
 ) -> bool:
-    """True when prior live mutations block a new decision for PR+head (#620/#693).
+    """True when prior live mutations block a new decision for PR+head (#620).
 
     Historical terminals on a **different head of the same PR** do not block.
-    Terminals on a **different PR** do not block (#693 cross-PR isolation).
-    Same PR + same head (or same PR without a comparable head SHA) blocks
-    unless a scoped correction applies.
+    Any prior mutation on another PR, the same head, or without a comparable
+    head SHA fails closed (blocks).
 
     Head resolution uses ``mutation_head_sha(m, lock)`` so pre-#620 ledgers
     that only stored ``ready_expected_head_sha`` still compare correctly
@@ -131,9 +98,7 @@ def prior_live_mutations_block_boundary(
     """
     if not lock:
         return False
-    if correction_applies(
-        lock, pr_number=pr_number, expected_head_sha=expected_head_sha
-    ):
+    if lock.get("correction_authorized"):
         return False
     prior = list(lock.get("live_mutations") or [])
     if not prior:
@@ -143,14 +108,10 @@ def prior_live_mutations_block_boundary(
         if not isinstance(m, dict):
             return True
         m_pr = m.get("pr_number")
-        if m_pr is None:
-            return True  # fail closed — unscoped mutation
-        if int(m_pr) != int(pr_number):
-            # #693: foreign-PR history on the shared durable lock does not block.
-            continue
         m_head = mutation_head_sha(m, lock)
         if (
-            target
+            m_pr == pr_number
+            and target
             and m_head
             and not heads_equal(m_head, target)
         ):
@@ -167,34 +128,23 @@ def terminal_boundary_allows_fresh_decision(
     expected_head_sha: str | None,
     operation: str,
 ) -> bool:
-    """Whether #332 hard-stop should yield for a new PR+head boundary (#620/#693).
+    """Whether #332 hard-stop should yield for a new PR+head boundary (#620).
 
-    For ``mark_ready`` / ``review`` / ``resume``:
-
-    * **same PR, different head** — allowed (#620)
-    * **different PR than last terminal** — allowed (#693 cross-PR isolation)
-    * **same PR, same head** — not allowed (unless scoped correction)
-
-    Merge is never reopened by head change or cross-PR isolation (approved
-    head merge path is separate).
+    Only for ``mark_ready`` / ``review`` / ``resume`` on the **same PR** when
+    the requested head differs from the last terminal's head. Merge is never
+    reopened by head change (approved head merge path is separate).
     """
     if operation not in ("mark_ready", "review", "resume"):
         return False
     if not lock:
         return False
-    if correction_applies(
-        lock, pr_number=pr_number, expected_head_sha=expected_head_sha
-    ):
+    if lock.get("correction_authorized"):
         return True
     last = last_terminal_mutation(lock)
     if last is None:
         return True
-    last_pr = last.get("pr_number")
-    if last_pr is None:
+    if last.get("pr_number") != pr_number:
         return False
-    if int(last_pr) != int(pr_number):
-        # #693: last terminal belongs to another PR — do not hard-stop this PR.
-        return True
     locked_head = mutation_head_sha(last, lock)
     target = normalize_head_sha(expected_head_sha)
     if not locked_head or not target:
@@ -488,397 +438,3 @@ def format_cleanup_audit_comment(audit: dict[str, Any]) -> str:
         "This path only clears a lock when the referenced PR is merged/closed.",
     ]
     return "\n".join(lines)
-
-
-# --- #693 classification / recovery / correction audit -----------------------
-
-# Deterministic classification labels for diagnostics and recovery routing.
-CLASS_NO_LOCK = "no_lock"
-CLASS_READY_FOR_TARGET = "ready_for_target"
-CLASS_IN_PROGRESS_SAME_HEAD = "in_progress_same_head"
-CLASS_TERMINAL_ACTIVE_SAME_HEAD = "terminal_active_same_head"
-CLASS_STALE_SUPERSEDED_HEAD = "stale_superseded_head"
-CLASS_FOREIGN_PR_TERMINAL = "foreign_pr_terminal"
-CLASS_MOOT_MERGED_CLOSED = "moot_merged_closed"
-CLASS_CORRECTION_ACTIVE = "correction_active"
-CLASS_SESSION_OR_PROFILE_MISMATCH = "session_or_profile_mismatch"
-CLASS_AMBIGUOUS = "ambiguous"
-
-
-def classify_review_decision_lock(
-    lock: dict | None,
-    *,
-    target_pr_number: int | None = None,
-    target_head_sha: str | None = None,
-    pr_live: dict | None = None,
-    pr_lookup_error: str | None = None,
-    active_profile_identity: str | None = None,
-    session_blockers: list[str] | None = None,
-) -> dict[str, Any]:
-    """Deterministic review-decision-lock classification (#693).
-
-    Returns classification, exact next_action, owner/evidence fields, and
-    whether mark_final / cleanup / correction are appropriate.
-    """
-    summary = lock_summary(lock)
-    target_head = normalize_head_sha(target_head_sha)
-    result: dict[str, Any] = {
-        "classification": CLASS_NO_LOCK,
-        "has_lock": lock is not None,
-        "lock_summary": summary,
-        "target_pr_number": target_pr_number,
-        "target_head_sha": target_head,
-        "last_terminal_pr": None,
-        "last_terminal_action": None,
-        "locked_head_sha": None,
-        "owner_profile_identity": (summary or {}).get("profile_identity"),
-        "session_profile": (summary or {}).get("session_profile"),
-        "updated_at": (summary or {}).get("updated_at"),
-        "correction_authorized": bool((lock or {}).get("correction_authorized")),
-        "correction_pr_number": (lock or {}).get("correction_pr_number"),
-        "correction_head_sha": normalize_head_sha(
-            (lock or {}).get("correction_head_sha")
-        ),
-        "mark_final_allowed": True,
-        "cleanup_allowed": False,
-        "correction_eligible": False,
-        "next_action": "gitea_resolve_task_capability(task='review_pr') then mark_final",
-        "reasons": [],
-        "evidence": {},
-    }
-
-    if lock is None:
-        result["reasons"].append("no review decision lock present")
-        return result
-
-    session_blockers = list(session_blockers or [])
-    if session_blockers:
-        result["classification"] = CLASS_SESSION_OR_PROFILE_MISMATCH
-        result["mark_final_allowed"] = False
-        result["next_action"] = (
-            "reconnect matching prgs-reviewer session or wait for lock TTL; "
-            "do not use gitea_authorize_review_correction as unlock; "
-            "do not delete session-state files"
-        )
-        result["reasons"].extend(session_blockers)
-        return result
-
-    stored = (
-        (lock.get("profile_identity") or lock.get("session_profile_lock") or "")
-        .strip()
-    )
-    active = (active_profile_identity or "").strip()
-    if active and stored and active != stored:
-        result["classification"] = CLASS_SESSION_OR_PROFILE_MISMATCH
-        result["mark_final_allowed"] = False
-        result["next_action"] = (
-            f"switch to profile '{stored}' or wait for moot cleanup; "
-            "do not use correction authorization as a generic unlock"
-        )
-        result["reasons"].append(
-            f"lock profile '{stored}' does not match active '{active}'"
-        )
-        return result
-
-    last = last_terminal_mutation(lock)
-    if last is None:
-        ready_pr = lock.get("ready_pr_number")
-        ready_head = normalize_head_sha(lock.get("ready_expected_head_sha"))
-        if (
-            target_pr_number is not None
-            and ready_pr == target_pr_number
-            and ready_head
-            and target_head
-            and heads_equal(ready_head, target_head)
-            and lock.get("final_review_decision_ready")
-        ):
-            result["classification"] = CLASS_IN_PROGRESS_SAME_HEAD
-            result["mark_final_allowed"] = True  # idempotent re-mark
-            result["next_action"] = (
-                "gitea_submit_pr_review with final_review_decision_ready=true "
-                "for the ready PR/head"
-            )
-            result["reasons"].append(
-                "final decision already marked ready for this PR/head (idempotent)"
-            )
-            return result
-        result["classification"] = CLASS_READY_FOR_TARGET
-        result["next_action"] = "gitea_mark_final_review_decision then submit"
-        result["reasons"].append("no terminal live mutations; mark_final allowed")
-        return result
-
-    last_pr = last.get("pr_number")
-    last_action = last.get("action")
-    locked_head = mutation_head_sha(last, lock)
-    result["last_terminal_pr"] = last_pr
-    result["last_terminal_action"] = last_action
-    result["locked_head_sha"] = locked_head
-    result["evidence"] = {
-        "last_review_id": last.get("review_id"),
-        "live_mutations_count": len(lock.get("live_mutations") or []),
-    }
-
-    if correction_applies(
-        lock, pr_number=target_pr_number, expected_head_sha=target_head
-    ):
-        result["classification"] = CLASS_CORRECTION_ACTIVE
-        result["mark_final_allowed"] = True
-        result["next_action"] = (
-            "gitea_mark_final_review_decision for the correction-scoped PR/head, "
-            "then submit once"
-        )
-        result["reasons"].append(
-            f"scoped correction active for PR #{lock.get('correction_pr_number')}"
-        )
-        return result
-
-    # Live state of last terminal PR when provided.
-    live = None
-    if pr_lookup_error:
-        result["classification"] = CLASS_AMBIGUOUS
-        result["mark_final_allowed"] = False
-        result["next_action"] = (
-            "retry diagnosis after live PR state is available; "
-            "fail closed under ambiguous evidence"
-        )
-        result["reasons"].append(f"live PR lookup failed: {pr_lookup_error}")
-        return result
-    if pr_live is not None:
-        live = classify_pr_live_state(pr_live)
-        result["evidence"]["last_terminal_pr_state"] = live.get("pr_state")
-        result["evidence"]["last_terminal_pr_merged"] = live.get("pr_merged")
-        if live.get("pr_merged_or_closed"):
-            result["classification"] = CLASS_MOOT_MERGED_CLOSED
-            result["cleanup_allowed"] = True
-            result["mark_final_allowed"] = target_pr_number is not None and (
-                int(last_pr) != int(target_pr_number)
-                if last_pr is not None and target_pr_number is not None
-                else True
-            )
-            result["next_action"] = (
-                "gitea_cleanup_stale_review_decision_lock(apply=true, "
-                f"expected_terminal_pr={last_pr}) then mark_final on the target PR"
-            )
-            result["reasons"].append(
-                f"terminal on PR #{last_pr} is moot (merged/closed); cleanup allowed"
-            )
-            return result
-
-    if target_pr_number is None:
-        result["classification"] = CLASS_AMBIGUOUS
-        result["mark_final_allowed"] = False
-        result["next_action"] = "re-run diagnosis with target_pr_number"
-        result["reasons"].append("target_pr_number required for open-PR classification")
-        return result
-
-    if last_pr is not None and int(last_pr) != int(target_pr_number):
-        # Cross-PR isolation: foreign terminal is history, not a block.
-        result["classification"] = CLASS_FOREIGN_PR_TERMINAL
-        result["mark_final_allowed"] = True
-        result["correction_eligible"] = False  # must not use correction to "unlock"
-        result["next_action"] = (
-            f"gitea_mark_final_review_decision(pr_number={target_pr_number}, ...) "
-            f"— foreign terminal on PR #{last_pr} does not block (#693); "
-            "do not call gitea_authorize_review_correction for cross-PR unlock"
-        )
-        result["reasons"].append(
-            f"last terminal is {last_action} on foreign open/closed PR #{last_pr}; "
-            f"target PR #{target_pr_number} is isolated (#693)"
-        )
-        return result
-
-    # Same PR as target.
-    if (
-        locked_head
-        and target_head
-        and not heads_equal(locked_head, target_head)
-    ):
-        result["classification"] = CLASS_STALE_SUPERSEDED_HEAD
-        result["mark_final_allowed"] = True
-        result["next_action"] = (
-            f"gitea_mark_final_review_decision with expected_head_sha="
-            f"{target_head} (#620 same-PR new head)"
-        )
-        result["reasons"].append(
-            f"terminal {last_action} on head {locked_head[:12]}…; target head "
-            f"{target_head[:12]}… — fresh formal review allowed without cleanup"
-        )
-        return result
-
-    # Same PR + same head (or missing head comparison) — active terminal.
-    result["classification"] = CLASS_TERMINAL_ACTIVE_SAME_HEAD
-    result["mark_final_allowed"] = False
-    result["correction_eligible"] = True
-    result["next_action"] = (
-        "if the prior verdict was mistaken: gitea_authorize_review_correction "
-        f"with prior_review_id={last.get('review_id')}, "
-        f"prior_review_state={last_action}, target_pr_number={target_pr_number}, "
-        "operator_authorized=true, then re-mark once; "
-        "if the prior verdict is correct: stop and hand off (do not duplicate)"
-    )
-    result["reasons"].append(
-        f"terminal {last_action} already recorded for PR #{target_pr_number} "
-        f"at this head; same-head duplicate blocked (#332/#620)"
-    )
-    return result
-
-
-def build_precise_mark_final_failure(
-    classification: dict[str, Any],
-) -> dict[str, Any]:
-    """One precise recovery instruction + durable issue handoff payload (#693 AC4/8)."""
-    cls = classification.get("classification")
-    next_action = classification.get("next_action") or (
-        "stop and create a durable Gitea issue with lock evidence"
-    )
-    reasons = list(classification.get("reasons") or [])
-    reasons.append(f"exact_next_action: {next_action}")
-    handoff = {
-        "required": cls
-        in (
-            CLASS_AMBIGUOUS,
-            CLASS_SESSION_OR_PROFILE_MISMATCH,
-            CLASS_TERMINAL_ACTIVE_SAME_HEAD,
-        )
-        and not classification.get("mark_final_allowed"),
-        "title_hint": (
-            "Review-decision-lock recovery failed during formal review"
-        ),
-        "classification": cls,
-        "exact_next_action": next_action,
-        "owner_profile_identity": classification.get("owner_profile_identity"),
-        "last_terminal_pr": classification.get("last_terminal_pr"),
-        "last_terminal_action": classification.get("last_terminal_action"),
-        "locked_head_sha": classification.get("locked_head_sha"),
-        "target_pr_number": classification.get("target_pr_number"),
-        "target_head_sha": classification.get("target_head_sha"),
-        "evidence": classification.get("evidence") or {},
-        "instruction": (
-            "If recovery cannot complete with the exact_next_action above, "
-            "create or update a durable Gitea issue with this payload and stop; "
-            "do not delete session-state files; do not misuse correction as unlock."
-        ),
-    }
-    return {
-        "reasons": reasons,
-        "classification": cls,
-        "exact_next_action": next_action,
-        "durable_issue_handoff": handoff,
-    }
-
-
-def build_correction_audit_record(
-    *,
-    prior_review_id: int | None,
-    prior_review_state: str | None,
-    target_pr_number: int | None,
-    target_head_sha: str | None,
-    reason: str | None,
-    actor_username: str | None,
-    profile_name: str | None,
-    authorized: bool,
-) -> dict[str, Any]:
-    """Structured durable audit for review-correction authorization (#693)."""
-    return {
-        "event": "review_correction_authorization",
-        "issue_ref": "#693",
-        "authorized": bool(authorized),
-        "timestamp": datetime.now(timezone.utc).isoformat(),
-        "actor_username": actor_username,
-        "profile_name": profile_name,
-        "prior_review_id": prior_review_id,
-        "prior_review_state": prior_review_state,
-        "target_pr_number": target_pr_number,
-        "target_head_sha": normalize_head_sha(target_head_sha),
-        "reason": reason,
-        "scope": "same_pr_head_only",
-    }
-
-
-def format_correction_audit_comment(audit: dict[str, Any]) -> str:
-    """Markdown body for a thread-visible correction authorization audit."""
-    status = "AUTHORIZED" if audit.get("authorized") else "DENIED"
-    lines = [
-        "## Review correction authorization audit (#693)",
-        "",
-        f"Status: **{status}**",
-        "",
-        f"- actor: `{audit.get('actor_username')}`",
-        f"- profile: `{audit.get('profile_name')}`",
-        f"- timestamp: `{audit.get('timestamp')}`",
-        f"- prior_review_id: `{audit.get('prior_review_id')}`",
-        f"- prior_review_state: `{audit.get('prior_review_state')}`",
-        f"- target_pr: `#{audit.get('target_pr_number')}`",
-        f"- target_head_sha: `{audit.get('target_head_sha')}`",
-        f"- reason: {audit.get('reason')}",
-        f"- scope: `{audit.get('scope')}` (cannot unlock a different PR)",
-        "",
-        "This is **not** a generic decision-lock unlock. Cross-PR recovery "
-        "uses isolation (#693) or moot cleanup (#594), never correction.",
-    ]
-    return "\n".join(lines)
-
-
-def assess_open_pr_decision_lock_recovery(
-    lock: dict | None,
-    *,
-    target_pr_number: int,
-    target_head_sha: str | None,
-    last_terminal_pr_live: dict | None = None,
-    pr_lookup_error: str | None = None,
-    active_profile_identity: str | None = None,
-    session_blockers: list[str] | None = None,
-    controller_recovery_authorized: bool = False,
-) -> dict[str, Any]:
-    """Assess guarded recovery for decision locks affecting an open target PR (#693).
-
-    Recovery here means *workflow recovery routing*, not necessarily lock wipe.
-    Foreign-PR terminals are recoverable by isolation (mark_final allowed).
-    Moot terminals use #594 cleanup. Same-head active terminals refuse wipe.
-    """
-    classification = classify_review_decision_lock(
-        lock,
-        target_pr_number=target_pr_number,
-        target_head_sha=target_head_sha,
-        pr_live=last_terminal_pr_live,
-        pr_lookup_error=pr_lookup_error,
-        active_profile_identity=active_profile_identity,
-        session_blockers=session_blockers,
-    )
-    cls = classification["classification"]
-    recovery_allowed = False
-    recovery_mode = None
-    if cls == CLASS_FOREIGN_PR_TERMINAL:
-        recovery_allowed = True
-        recovery_mode = "cross_pr_isolation"
-    elif cls == CLASS_STALE_SUPERSEDED_HEAD:
-        recovery_allowed = True
-        recovery_mode = "same_pr_new_head"
-    elif cls == CLASS_MOOT_MERGED_CLOSED:
-        recovery_allowed = True
-        recovery_mode = "moot_cleanup"
-    elif cls == CLASS_READY_FOR_TARGET:
-        recovery_allowed = True
-        recovery_mode = "none_required"
-    elif cls == CLASS_CORRECTION_ACTIVE:
-        recovery_allowed = True
-        recovery_mode = "scoped_correction"
-    elif cls == CLASS_TERMINAL_ACTIVE_SAME_HEAD:
-        recovery_allowed = False
-        recovery_mode = "correction_only_if_mistake"
-    else:
-        recovery_allowed = False
-        recovery_mode = "fail_closed"
-
-    if recovery_mode == "moot_cleanup" and not controller_recovery_authorized:
-        # Cleanup still needs apply + capability; assess reports path.
-        pass
-
-    return {
-        **classification,
-        "recovery_allowed": recovery_allowed,
-        "recovery_mode": recovery_mode,
-        "controller_recovery_authorized": bool(controller_recovery_authorized),
-        "manual_file_delete_forbidden": True,
-        "correction_as_generic_unlock_forbidden": True,
-    }

task_capability_map.py

@@ -117,23 +117,6 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.review",
         "role": "reviewer",
     },
-    # #693: read-only classification of durable decision locks (incl. open PRs).
-    "diagnose_review_decision_lock": {
-        "permission": "gitea.read",
-        "role": "reviewer",
-    },
-    "gitea_diagnose_review_decision_lock": {
-        "permission": "gitea.read",
-        "role": "reviewer",
-    },
-    "authorize_review_correction": {
-        "permission": "gitea.pr.review",
-        "role": "reviewer",
-    },
-    "gitea_authorize_review_correction": {
-        "permission": "gitea.pr.review",
-        "role": "reviewer",
-    },
     "delete_branch": {
         "permission": "gitea.branch.delete",
         "role": "author",

tests/test_api_reliability.py

@@ -79,41 +79,46 @@ class TestApiRequestFailures(unittest.TestCase):
     @patch("gitea_auth.urllib.request.urlopen")
     def test_timeout_converted_to_runtimeerror(self, mock_open):
         mock_open.side_effect = TimeoutError("timed out")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaNetworkError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("network error contacting Gitea", str(ctx.exception))
+        # Fixed message only (#699) — still a RuntimeError subclass.
+        self.assertIsInstance(ctx.exception, RuntimeError)
+        self.assertEqual(str(ctx.exception), "Network error contacting Gitea")
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_dns_network_failure_converted(self, mock_open):
         mock_open.side_effect = urllib.error.URLError("Name or service not known")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaNetworkError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("network error contacting Gitea", str(ctx.exception))
+        self.assertEqual(str(ctx.exception), "Network error contacting Gitea")
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_502_upstream_message(self, mock_open):
         mock_open.side_effect = http_error(502, "bad gateway")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
         msg = str(ctx.exception)
-        self.assertIn("HTTP 502", msg)
-        self.assertIn("upstream unavailable", msg)
+        self.assertEqual(msg, "Gitea upstream unavailable")
+        self.assertEqual(ctx.exception.reason_code, "upstream_unavailable")
+        self.assertEqual(ctx.exception.http_status, 502)
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_503_upstream_message(self, mock_open):
         mock_open.side_effect = http_error(503, "")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("HTTP 503", str(ctx.exception))
-        self.assertIn("upstream unavailable", str(ctx.exception))
+        self.assertEqual(str(ctx.exception), "Gitea upstream unavailable")
+        self.assertEqual(ctx.exception.http_status, 503)
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_malformed_error_payload_does_not_crash(self, mock_open):
-        # Non-JSON garbage error body must still yield a clean RuntimeError.
+        # Non-JSON garbage error body must still yield a clean typed error
+        # with a fixed message (no body echo — #699).
         mock_open.side_effect = http_error(500, "<html>garbage</html>")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("HTTP 500", str(ctx.exception))
+        self.assertEqual(str(ctx.exception), "Gitea HTTP request failed")
+        self.assertNotIn("<html>", str(ctx.exception))
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_malformed_success_json_raises_clean_error(self, mock_open):
@@ -126,16 +131,17 @@ class TestApiRequestFailures(unittest.TestCase):
     def test_no_secret_leak_in_error_body(self, mock_open):
         mock_open.side_effect = http_error(
             400, "failed: token supersecret123 rejected")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
         msg = str(ctx.exception)
         self.assertNotIn("supersecret123", msg)
-        self.assertIn(gitea_audit.REDACTED, msg)
+        # Fixed message — body never appears (stronger than redaction).
+        self.assertEqual(msg, "Gitea HTTP request failed")
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_auth_header_never_in_error(self, mock_open):
         mock_open.side_effect = http_error(400, "bad request")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
         self.assertNotIn(FAKE_AUTH, str(ctx.exception))
 

tests/test_head_scoped_review_decision_lock.py

@@ -24,10 +24,6 @@ HEAD_C = "c" * 40
 
 
 def _lock(mutations=None, correction=False, ready_pr=None, ready_head=None, ready_action=None):
-    mutations = list(mutations or [])
-    corr_pr = None
-    if correction and mutations:
-        corr_pr = mutations[-1].get("pr_number")
     return {
         "task": "review_pr",
         "remote": "prgs",
@@ -44,11 +40,9 @@ def _lock(mutations=None, correction=False, ready_pr=None, ready_head=None, read
         "ready_remote": "prgs" if ready_pr else None,
         "ready_org": "Scaled-Tech-Consulting" if ready_pr else None,
         "ready_repo": "Gitea-Tools" if ready_pr else None,
-        "live_mutations": mutations,
+        "live_mutations": list(mutations or []),
         "correction_authorized": correction,
-        "correction_reason": "test" if correction else None,
-        "correction_pr_number": corr_pr,
-        "correction_head_sha": None,
+        "correction_reason": None,
     }
 
 
@@ -180,13 +174,12 @@ class TestHardStopHeadScope(unittest.TestCase):
         self.assertTrue(reasons)
         self.assertIn("#332", reasons[0])
 
-    def test_rc_head_a_allows_other_pr_via_cross_pr_isolation(self):
-        """#693: foreign-PR terminal must not hard-stop mark_ready on another PR."""
+    def test_rc_head_a_blocks_other_pr(self):
         _seed([RC_619_HEAD_A], ready_pr=619, ready_head=HEAD_A)
         reasons = mcp_server.terminal_review_hard_stop_reasons(
             700, "mark_ready", expected_head_sha=HEAD_B
         )
-        self.assertEqual(reasons, [])
+        self.assertTrue(reasons)
 
     def test_legacy_619_ledger_allows_new_head(self):
         """PR #619-style durable lock without mutation head_sha."""

tests/test_issue_693_review_decision_lock_recovery.py

@@ -1,427 +0,0 @@
-"""Review-decision-lock recovery / cross-PR isolation (#693).
-
-Reproduces the PR #688 → PR #692 formal-review sequence:
-
-  * durable lock holds REQUEST_CHANGES on open PR #688 @ head A (review_id 425)
-  * reviewer leases PR #692 @ head B (6d86db…)
-  * mark_final for #692 must succeed without correction unlock
-  * cleanup of open #688 terminal remains forbidden (#594)
-  * authorize_review_correction for #688 cannot unlock #692
-  * eventual #692 APPROVE is unique and head-bound (review_id 426)
-  * mark_final is idempotent for same PR/action/head
-  * diagnosis returns one exact next_action + durable handoff payload
-"""
-
-from __future__ import annotations
-
-import os
-import unittest
-from unittest.mock import patch
-
-import mcp_server
-import review_workflow_load
-import stale_review_decision_lock as srdl
-
-# PR #688 / #692 incident fixtures (sanitized reconstruction from issue #693)
-HEAD_688 = "c7a444eb4b41cf916fdbd20a4999ffd78af496d0"
-HEAD_692 = "6d86db793bbdfaed16bd54d93171f1dd66f234ca"
-PR_A = 688
-PR_B = 692
-REVIEW_ID_A = 425
-REVIEW_ID_B = 426
-
-RC_688 = {
-    "pr_number": PR_A,
-    "action": "request_changes",
-    "review_id": REVIEW_ID_A,
-    "review_state": "request_changes",
-    "head_sha": HEAD_688,
-}
-APPROVE_692 = {
-    "pr_number": PR_B,
-    "action": "approve",
-    "review_id": REVIEW_ID_B,
-    "review_state": "approve",
-    "head_sha": HEAD_692,
-}
-
-
-def _lock(mutations=None, **kwargs):
-    from datetime import datetime, timezone
-
-    now = datetime.now(timezone.utc).isoformat()
-    base = {
-        "task": "review_pr",
-        "remote": "prgs",
-        "org": "Scaled-Tech-Consulting",
-        "repo": "Gitea-Tools",
-        "session_pid": os.getpid(),
-        "session_profile": "prgs-reviewer",
-        "session_profile_lock": "prgs-reviewer",
-        "profile_identity": "prgs-reviewer",
-        "final_review_decision_ready": False,
-        "ready_pr_number": None,
-        "ready_action": None,
-        "ready_expected_head_sha": None,
-        "ready_remote": None,
-        "ready_org": None,
-        "ready_repo": None,
-        "live_mutations": list(mutations or []),
-        "correction_authorized": False,
-        "correction_reason": None,
-        "correction_pr_number": None,
-        "correction_head_sha": None,
-        "updated_at": now,
-        "recorded_at": now,
-        "writer_pid": os.getpid(),
-    }
-    base.update(kwargs)
-    # Ensure TTL fields stay fresh unless the caller is testing expiry.
-    if "recorded_at" not in kwargs:
-        base["recorded_at"] = now
-    if "updated_at" not in kwargs:
-        base["updated_at"] = now
-    return base
-
-
-REVIEWER_ENV = {
-    "GITEA_PROFILE_NAME": "prgs-reviewer",
-    "GITEA_ALLOWED_OPERATIONS": (
-        "gitea.read,gitea.pr.review,gitea.pr.approve,"
-        "gitea.pr.request_changes,gitea.pr.comment"
-    ),
-    "GITEA_SESSION_PROFILE_LOCK": "prgs-reviewer",
-}
-
-REVIEWER_PROFILE = {
-    "profile_name": "prgs-reviewer",
-    "allowed_operations": [
-        "gitea.read",
-        "gitea.pr.review",
-        "gitea.pr.approve",
-        "gitea.pr.request_changes",
-        "gitea.pr.comment",
-    ],
-    "forbidden_operations": ["gitea.pr.merge"],
-}
-
-
-def _seed(mutations=None, **kwargs):
-    review_workflow_load.record_review_workflow_load(mcp_server.PROJECT_ROOT)
-    mcp_server._save_review_decision_lock(_lock(mutations, **kwargs))
-    mcp_server.gitea_load_review_workflow()
-
-
-def _no_lease():
-    return {"block": False, "reasons": [], "mutation_allowed": True}
-
-
-def _open_pr(number, head):
-    return {
-        "number": number,
-        "state": "open",
-        "merged": False,
-        "merged_at": None,
-        "head": {"sha": head},
-    }
-
-
-class TestCrossPrIsolationPure(unittest.TestCase):
-    def test_foreign_terminal_does_not_block_mark_boundary(self):
-        lock = _lock([RC_688])
-        self.assertFalse(
-            srdl.prior_live_mutations_block_boundary(
-                lock, pr_number=PR_B, expected_head_sha=HEAD_692
-            )
-        )
-        self.assertTrue(
-            srdl.prior_live_mutations_block_boundary(
-                lock, pr_number=PR_A, expected_head_sha=HEAD_688
-            )
-        )
-
-    def test_terminal_boundary_allows_fresh_decision_on_other_pr(self):
-        lock = _lock([RC_688])
-        self.assertTrue(
-            srdl.terminal_boundary_allows_fresh_decision(
-                lock,
-                pr_number=PR_B,
-                expected_head_sha=HEAD_692,
-                operation="mark_ready",
-            )
-        )
-        self.assertFalse(
-            srdl.terminal_boundary_allows_fresh_decision(
-                lock,
-                pr_number=PR_A,
-                expected_head_sha=HEAD_688,
-                operation="mark_ready",
-            )
-        )
-
-    def test_unscoped_correction_does_not_apply(self):
-        lock = _lock([RC_688], correction_authorized=True, correction_reason="x")
-        # Missing correction_pr_number → fail closed (#693)
-        self.assertFalse(
-            srdl.correction_applies(lock, pr_number=PR_A, expected_head_sha=HEAD_688)
-        )
-
-    def test_scoped_correction_only_for_named_pr(self):
-        lock = _lock(
-            [RC_688],
-            correction_authorized=True,
-            correction_reason="mistake",
-            correction_pr_number=PR_A,
-            correction_head_sha=HEAD_688,
-        )
-        self.assertTrue(
-            srdl.correction_applies(lock, pr_number=PR_A, expected_head_sha=HEAD_688)
-        )
-        self.assertFalse(
-            srdl.correction_applies(lock, pr_number=PR_B, expected_head_sha=HEAD_692)
-        )
-
-
-class TestClassification(unittest.TestCase):
-    def test_foreign_pr_terminal_classification(self):
-        lock = _lock([RC_688])
-        c = srdl.classify_review_decision_lock(
-            lock,
-            target_pr_number=PR_B,
-            target_head_sha=HEAD_692,
-            pr_live=_open_pr(PR_A, HEAD_688),
-            active_profile_identity="prgs-reviewer",
-        )
-        self.assertEqual(c["classification"], srdl.CLASS_FOREIGN_PR_TERMINAL)
-        self.assertTrue(c["mark_final_allowed"])
-        self.assertFalse(c["correction_eligible"])
-        self.assertIn("do not call gitea_authorize_review_correction", c["next_action"])
-
-    def test_same_head_terminal_classification(self):
-        lock = _lock([RC_688])
-        c = srdl.classify_review_decision_lock(
-            lock,
-            target_pr_number=PR_A,
-            target_head_sha=HEAD_688,
-            pr_live=_open_pr(PR_A, HEAD_688),
-        )
-        self.assertEqual(c["classification"], srdl.CLASS_TERMINAL_ACTIVE_SAME_HEAD)
-        self.assertFalse(c["mark_final_allowed"])
-        self.assertTrue(c["correction_eligible"])
-
-    def test_precise_failure_includes_durable_handoff(self):
-        lock = _lock([RC_688])
-        c = srdl.classify_review_decision_lock(
-            lock, target_pr_number=PR_A, target_head_sha=HEAD_688
-        )
-        fail = srdl.build_precise_mark_final_failure(c)
-        self.assertIn("exact_next_action", fail)
-        self.assertIn("durable_issue_handoff", fail)
-        self.assertTrue(fail["durable_issue_handoff"]["required"])
-
-
-class TestPr692Sequence(unittest.TestCase):
-    def setUp(self):
-        self._env = patch.dict(os.environ, REVIEWER_ENV, clear=False)
-        self._env.start()
-        self._prof = patch.object(
-            mcp_server, "get_profile", return_value=REVIEWER_PROFILE
-        )
-        self._prof.start()
-
-    def tearDown(self):
-        self._prof.stop()
-        self._env.stop()
-        mcp_server._save_review_decision_lock(None)
-        review_workflow_load.clear_review_workflow_load()
-
-    def test_mark_final_692_succeeds_with_open_688_terminal(self):
-        _seed([RC_688], writer_pid=25883, session_pid=60615)
-        with patch("mcp_server._list_pr_lease_comments", return_value=[]), patch(
-            "mcp_server._pr_work_lease_reviewer_block", return_value=_no_lease()
-        ), patch.object(
-            mcp_server,
-            "gitea_check_pr_eligibility",
-            return_value={"head_sha": HEAD_692, "eligible": True},
-        ):
-            result = mcp_server.gitea_mark_final_review_decision(
-                pr_number=PR_B,
-                action="approve",
-                expected_head_sha=HEAD_692,
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-            )
-        self.assertTrue(result["marked_ready"], result.get("reasons"))
-        lock = mcp_server._load_review_decision_lock()
-        self.assertEqual(lock["ready_pr_number"], PR_B)
-        self.assertEqual(
-            srdl.normalize_head_sha(lock["ready_expected_head_sha"]), HEAD_692
-        )
-        # Foreign terminal history preserved (non-destructive isolation).
-        self.assertEqual(lock["live_mutations"][0]["pr_number"], PR_A)
-
-    def test_mark_final_idempotent_same_binding(self):
-        _seed(
-            [RC_688],
-            final_review_decision_ready=True,
-            ready_pr_number=PR_B,
-            ready_action="approve",
-            ready_expected_head_sha=HEAD_692,
-            ready_remote="prgs",
-            ready_org="Scaled-Tech-Consulting",
-            ready_repo="Gitea-Tools",
-        )
-        with patch("mcp_server._list_pr_lease_comments", return_value=[]), patch(
-            "mcp_server._pr_work_lease_reviewer_block", return_value=_no_lease()
-        ), patch.object(
-            mcp_server,
-            "gitea_check_pr_eligibility",
-            return_value={"head_sha": HEAD_692, "eligible": True},
-        ):
-            result = mcp_server.gitea_mark_final_review_decision(
-                pr_number=PR_B,
-                action="approve",
-                expected_head_sha=HEAD_692,
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-            )
-        self.assertTrue(result["marked_ready"])
-        self.assertTrue(result.get("idempotent"))
-
-    def test_cleanup_still_forbidden_while_688_open(self):
-        _seed([RC_688])
-        assessment = srdl.assess_stale_review_decision_lock(
-            mcp_server._load_review_decision_lock(),
-            pr_live=_open_pr(PR_A, HEAD_688),
-            active_profile_identity="prgs-reviewer",
-        )
-        self.assertFalse(assessment["cleanup_allowed"])
-        self.assertFalse(assessment["is_moot"])
-
-    def test_correction_cannot_unlock_different_pr(self):
-        _seed([RC_688])
-        r = mcp_server.gitea_authorize_review_correction(
-            prior_review_id=REVIEW_ID_A,
-            prior_review_state="request_changes",
-            reason="try unlock 692",
-            operator_authorized=True,
-            target_pr_number=PR_B,
-            remote="prgs",
-            org="Scaled-Tech-Consulting",
-            repo="Gitea-Tools",
-            post_audit_comment=False,
-        )
-        self.assertFalse(r["authorized"])
-        self.assertTrue(any("different PR" in x for x in r["reasons"]))
-
-    def test_scoped_correction_for_same_pr_posts_audit(self):
-        _seed([RC_688])
-        with patch(
-            "mcp_server._authenticated_username", return_value="sysadmin"
-        ), patch(
-            "mcp_server.get_auth_header", return_value="Basic dGVzdDp0ZXN0"
-        ), patch(
-            "mcp_server._auth", return_value="Basic dGVzdDp0ZXN0"
-        ), patch("mcp_server.api_request", return_value={"id": 99901}):
-            r = mcp_server.gitea_authorize_review_correction(
-                prior_review_id=REVIEW_ID_A,
-                prior_review_state="request_changes",
-                reason="mistaken RC wording",
-                operator_authorized=True,
-                target_pr_number=PR_A,
-                expected_head_sha=HEAD_688,
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-                post_audit_comment=True,
-            )
-        self.assertTrue(r["authorized"], r.get("reasons"))
-        self.assertEqual(r.get("correction_pr_number"), PR_A)
-        self.assertEqual(
-            r.get("audit_comment_id"),
-            99901,
-            r.get("audit_comment_skipped") or r.get("audit_comment_error") or r,
-        )
-
-    def test_diagnose_foreign_terminal_next_action(self):
-        _seed([RC_688])
-        with patch(
-            "mcp_server._authenticated_username", return_value="sysadmin"
-        ), patch(
-            "mcp_server.get_auth_header", return_value="Basic dGVzdDp0ZXN0"
-        ), patch(
-            "mcp_server._auth", return_value="Basic dGVzdDp0ZXN0"
-        ), patch("mcp_server.api_request", return_value=_open_pr(PR_A, HEAD_688)):
-            d = mcp_server.gitea_diagnose_review_decision_lock(
-                target_pr_number=PR_B,
-                expected_head_sha=HEAD_692,
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-            )
-        self.assertTrue(d["success"], d.get("reasons"))
-        self.assertEqual(d["classification"], srdl.CLASS_FOREIGN_PR_TERMINAL)
-        self.assertTrue(d["mark_final_allowed"])
-        self.assertIn("mark_final", d["exact_next_action"])
-        self.assertTrue(d["correction_as_generic_unlock_forbidden"])
-
-    def test_approval_ledger_unique_and_bound_after_sequence(self):
-        """After mark_final + record mutation, ledger binds unique approve to 692 head."""
-        _seed([RC_688])
-        with patch("mcp_server._list_pr_lease_comments", return_value=[]), patch(
-            "mcp_server._pr_work_lease_reviewer_block", return_value=_no_lease()
-        ), patch.object(
-            mcp_server,
-            "gitea_check_pr_eligibility",
-            return_value={"head_sha": HEAD_692, "eligible": True},
-        ):
-            marked = mcp_server.gitea_mark_final_review_decision(
-                pr_number=PR_B,
-                action="approve",
-                expected_head_sha=HEAD_692,
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-            )
-        self.assertTrue(marked["marked_ready"])
-        mcp_server.record_live_review_mutation(PR_B, "approve", REVIEW_ID_B)
-        lock = mcp_server._load_review_decision_lock()
-        terminals = [
-            m
-            for m in lock["live_mutations"]
-            if m.get("action") in srdl.TERMINAL_REVIEW_ACTIONS
-            and m.get("pr_number") == PR_B
-        ]
-        self.assertEqual(len(terminals), 1)
-        self.assertEqual(terminals[0]["review_id"], REVIEW_ID_B)
-        self.assertEqual(
-            srdl.normalize_head_sha(terminals[0].get("head_sha")), HEAD_692
-        )
-        # Same-head duplicate still blocked.
-        self.assertTrue(
-            srdl.prior_live_mutations_block_boundary(
-                lock, pr_number=PR_B, expected_head_sha=HEAD_692
-            )
-        )
-
-
-class TestSessionRestartWriterPid(unittest.TestCase):
-    def tearDown(self):
-        mcp_server._save_review_decision_lock(None)
-        review_workflow_load.clear_review_workflow_load()
-
-    def test_writer_pid_change_does_not_inherit_foreign_block(self):
-        # session_pid 60615 origin, writer later 25883 — still foreign isolation.
-        _seed([RC_688], session_pid=60615, writer_pid=25883)
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(
-                PR_B, "mark_ready", expected_head_sha=HEAD_692
-            ),
-            [],
-        )
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_mcp_server.py

@@ -2540,18 +2540,15 @@ class TestSubmitPrReview(unittest.TestCase):
         lock = _load_review_decision_lock() or {}
         lock["live_mutations"] = [{"pr_number": 8, "action": "approve", "review_id": 42, "review_state": "approve"}]
         _save_review_decision_lock(lock)
-        with patch("mcp_server.api_request", return_value={"id": 9001}):
-            r = gitea_authorize_review_correction(
-                prior_review_id=42,
-                prior_review_state="approve",
-                reason="typo",
-                operator_authorized=True,
-                target_pr_number=8,
-            )
+        r = gitea_authorize_review_correction(
+            prior_review_id=42,
+            prior_review_state="approve",
+            reason="typo",
+            operator_authorized=True,
+        )
         self.assertTrue(r["authorized"])
         lock = _load_review_decision_lock()
         self.assertTrue(lock["correction_authorized"])
-        self.assertEqual(lock["correction_pr_number"], 8)
 
     def test_authorize_review_correction_mismatch(self):
         from mcp_server import _load_review_decision_lock, _save_review_decision_lock
@@ -2565,7 +2562,6 @@ class TestSubmitPrReview(unittest.TestCase):
             prior_review_state="approve",
             reason="typo",
             operator_authorized=True,
-            target_pr_number=8,
         )
         self.assertFalse(r["authorized"])
         self.assertTrue(any("prior review ID" in x for x in r["reasons"]))
@@ -2576,22 +2572,10 @@ class TestSubmitPrReview(unittest.TestCase):
             prior_review_state="request_changes",
             reason="typo",
             operator_authorized=True,
-            target_pr_number=8,
         )
         self.assertFalse(r["authorized"])
         self.assertTrue(any("prior review state" in x for x in r["reasons"]))
 
-        # Cross-PR unlock refused (#693)
-        r = gitea_authorize_review_correction(
-            prior_review_id=42,
-            prior_review_state="approve",
-            reason="unlock other pr",
-            operator_authorized=True,
-            target_pr_number=692,
-        )
-        self.assertFalse(r["authorized"])
-        self.assertTrue(any("different PR" in x for x in r["reasons"]))
-
     def test_authorize_review_correction_requires_operator_auth(self):
         from mcp_server import _load_review_decision_lock, _save_review_decision_lock
         lock = _load_review_decision_lock() or {}
@@ -2604,7 +2588,6 @@ class TestSubmitPrReview(unittest.TestCase):
             prior_review_state="approve",
             reason="typo",
             operator_authorized=False,
-            target_pr_number=8,
         )
         self.assertFalse(r["authorized"])
         self.assertTrue(any("operator authorization" in x for x in r["reasons"]))
@@ -2662,7 +2645,6 @@ class TestSubmitPrReview(unittest.TestCase):
                     prior_review_state="approve",
                     reason="operator approved correcting mistaken approve",
                     operator_authorized=True,
-                    target_pr_number=8,
                 )
                 _mark_request_changes_ready(remote="prgs")
                 second = gitea_submit_pr_review(

tests/test_retry_backoff.py

@@ -122,9 +122,11 @@ class TestApiRequestRetry(unittest.TestCase):
         sleep.assert_not_called()
 
     def test_non_429_error_raises_immediately(self):
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             _call([_http_error(500, body=b"boom")])
-        self.assertIn("HTTP 500", str(ctx.exception))
+        # Fixed message only (#699) — no response body echo.
+        self.assertEqual(str(ctx.exception), "Gitea HTTP request failed")
+        self.assertEqual(ctx.exception.http_status, 500)
 
     def test_non_429_error_does_not_sleep(self):
         sleep = MagicMock()
@@ -171,9 +173,12 @@ class TestApiRequestRetry(unittest.TestCase):
         # max_retries=3 -> 3 sleeps, then the 4th failure raises.
         errors = [_http_error(429, retry_after="1") for _ in range(4)]
         sleep = MagicMock()
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             _call(errors, sleep_func=sleep, max_retries=3)
-        self.assertIn("HTTP 429", str(ctx.exception))
+        # After retries are exhausted, 429 is a typed HTTP error with fixed
+        # message (#699); status metadata carries 429.
+        self.assertEqual(str(ctx.exception), "Gitea HTTP request failed")
+        self.assertEqual(ctx.exception.http_status, 429)
         self.assertEqual(sleep.call_count, 3)
 
     def test_no_infinite_loop_when_always_429(self):

tests/test_stale_review_decision_lock_cleanup.py

@@ -188,32 +188,20 @@ class TestActiveHardStopPreserved(unittest.TestCase):
         mcp_server._save_review_decision_lock(None)
         mcp_server.review_workflow_load.clear_review_workflow_load()
 
-    def test_open_approve_blocks_same_pr_not_other_pr_mark_ready(self):
-        _seed([APPROVED_OPEN])  # approve on PR #700
-        # Same PR still hard-stopped for mark_ready.
-        reasons_same = mcp_server.terminal_review_hard_stop_reasons(
-            700, "mark_ready"
-        )
-        self.assertTrue(reasons_same)
-        self.assertIn("#332", reasons_same[0])
-        # #693: other PR may mark_ready without cleanup.
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(592, "mark_ready"),
-            [],
-        )
+    def test_open_approve_still_blocks_other_pr_mark_ready(self):
+        _seed([APPROVED_OPEN])
+        reasons = mcp_server.terminal_review_hard_stop_reasons(592, "mark_ready")
+        self.assertTrue(reasons)
+        self.assertIn("#332", reasons[0])
+        self.assertIn("gitea_cleanup_stale_review_decision_lock", reasons[0])
 
-    def test_request_changes_still_blocks_same_pr(self):
-        _seed([RC_OPEN])  # request_changes on PR #701
+    def test_request_changes_still_blocks_everything(self):
+        _seed([RC_OPEN])
         for op in ("merge", "mark_ready", "review"):
             self.assertTrue(
-                mcp_server.terminal_review_hard_stop_reasons(701, op),
+                mcp_server.terminal_review_hard_stop_reasons(592, op),
                 msg=op,
             )
-        # Foreign PR review path is open (#693).
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(592, "mark_ready"),
-            [],
-        )
 
 
 # --------------------------------------------------------------------------- #

tests/test_structured_auth_mcp_errors.py

@@ -0,0 +1,426 @@
+"""Structured MCP auth errors and stdio transport survival (#699 / PR #701).
+
+Covers original AC plus reviewer-ratified regressions:
+
+1. Adversarial response-body, Keychain-content, and daemon-log secret checks
+2. Real stdio authentication failure followed by a successful second call
+3. UrlElicitationRequiredError framework re-raise behavior
+4. Unexpected parser RuntimeError is not authentication
+5. Generic HTTP 403 is authorization (not internal)
+6. Repeated install/import is idempotent
+7. Author and reconciler profiles
+8. Native provenance non-bypass
+"""
+from __future__ import annotations
+
+import asyncio
+import io
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import textwrap
+import unittest
+import urllib.error
+from unittest.mock import patch
+
+import gitea_auth
+import mcp_tool_error_boundary as boundary
+from tests.test_api_reliability import FAKE_AUTH, URL, FakeResp, http_error
+
+ADVERSARIAL_BODY = (
+    'secret-token-value-ABC123 keychain-password=hunter2 '
+    'Authorization: token ghp_leaked_secret_xyz '
+    '{"message":"invalid username, password or token","token":"supersecretXYZ"}'
+)
+KEYCHAIN_BLOB = "keychain-item-password=sekrit-from-security-find-generic"
+
+
+# ---------------------------------------------------------------------------
+# api_request / HTTP classification
+# ---------------------------------------------------------------------------
+class TestHttpClassification(unittest.TestCase):
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_401_typed_auth_fixed_message_no_body(self, mock_open):
+        mock_open.side_effect = http_error(401, ADVERSARIAL_BODY)
+        with self.assertRaises(gitea_auth.GiteaAuthError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        exc = ctx.exception
+        self.assertEqual(exc.reason_code, "auth_invalid_token")
+        self.assertEqual(exc.error_class, "authentication")
+        self.assertEqual(exc.http_status, 401)
+        msg = str(exc)
+        self.assertNotIn("supersecretXYZ", msg)
+        self.assertNotIn("ghp_leaked", msg)
+        self.assertNotIn("hunter2", msg)
+        self.assertNotIn(ADVERSARIAL_BODY, msg)
+        self.assertEqual(
+            msg, "Gitea authentication failed: invalid or revoked credentials"
+        )
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_403_scope_is_authz_scope(self, mock_open):
+        mock_open.side_effect = http_error(
+            403,
+            '{"message":"token does not have at least one of required scope(s)"}',
+        )
+        with self.assertRaises(gitea_auth.GiteaAuthzError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(ctx.exception.reason_code, "authz_insufficient_scope")
+        self.assertEqual(ctx.exception.error_class, "authorization")
+        self.assertNotIn("token does not have", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_generic_403_is_authz_not_internal(self, mock_open):
+        mock_open.side_effect = http_error(403, '{"message":"user has no permission"}')
+        with self.assertRaises(gitea_auth.GiteaAuthzError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(ctx.exception.reason_code, "authz_denied")
+        self.assertEqual(ctx.exception.error_class, "authorization")
+        self.assertNotIsInstance(ctx.exception, gitea_auth.GiteaAuthError)
+        self.assertNotIn("user has no permission", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_network_fixed_message(self, mock_open):
+        mock_open.side_effect = TimeoutError("timed out contacting secret.example")
+        with self.assertRaises(gitea_auth.GiteaNetworkError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(str(ctx.exception), "Network error contacting Gitea")
+        self.assertNotIn("secret.example", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_malformed_json_not_auth(self, mock_open):
+        mock_open.return_value = FakeResp("not-json{")
+        with self.assertRaises(RuntimeError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertNotIsInstance(ctx.exception, gitea_auth.GiteaAuthError)
+        self.assertIn("malformed JSON", str(ctx.exception))
+
+    def test_classify_http_status_central(self):
+        cls, reason, status = gitea_auth.classify_http_status(401)
+        self.assertIs(cls, gitea_auth.GiteaAuthError)
+        self.assertEqual(reason, "auth_invalid_token")
+        self.assertEqual(status, 401)
+
+        cls, reason, status = gitea_auth.classify_http_status(403)
+        self.assertIs(cls, gitea_auth.GiteaAuthzError)
+        self.assertEqual(reason, "authz_denied")
+
+        cls, reason, status = gitea_auth.classify_http_status(
+            403, body_hint="missing scope write:issue"
+        )
+        self.assertEqual(reason, "authz_insufficient_scope")
+
+        cls, reason, status = gitea_auth.classify_http_status(502)
+        self.assertIs(cls, gitea_auth.GiteaHttpError)
+        self.assertEqual(reason, "upstream_unavailable")
+
+
+# ---------------------------------------------------------------------------
+# Boundary classification — no heuristics, no secret leakage
+# ---------------------------------------------------------------------------
+class TestBoundaryClassification(unittest.TestCase):
+    def test_auth_payload_fixed_message(self):
+        exc = gitea_auth.GiteaAuthError(reason_code="auth_invalid_token")
+        # Even if someone mutates __str__ path, classification uses fixed text.
+        result = boundary.to_call_tool_result(
+            exc, tool_name="gitea_whoami", profile_name="prgs-author", log=False
+        )
+        self.assertTrue(result.isError)
+        p = result.structuredContent
+        self.assertEqual(p["reason_code"], "auth_invalid_token")
+        self.assertEqual(p["error_class"], "authentication")
+        self.assertEqual(p["message"], boundary.fixed_message("auth_invalid_token"))
+        self.assertNotIn("supersecret", json.dumps(p))
+        self.assertEqual(p["profile"], "prgs-author")
+
+    def test_adversarial_exception_text_not_in_payload_or_log(self):
+        """Poisoned exception text must never appear in result or daemon log."""
+
+        class PoisonedAuth(gitea_auth.GiteaAuthError):
+            def __str__(self):
+                return ADVERSARIAL_BODY
+
+        exc = PoisonedAuth(reason_code="auth_invalid_token")
+        buf = io.StringIO()
+        result = boundary.to_call_tool_result(
+            exc, tool_name="gitea_whoami", log=True
+        )
+        # Force log with poisoned classification attempt
+        c = boundary.classify_exception(exc)
+        boundary.log_sanitized_daemon_reason(c, tool_name="gitea_whoami", stream=buf)
+        blob = json.dumps(result.structuredContent) + result.content[0].text + buf.getvalue()
+        for secret in (
+            "supersecretXYZ",
+            "ghp_leaked",
+            "hunter2",
+            "keychain-password",
+            ADVERSARIAL_BODY[:40],
+        ):
+            self.assertNotIn(secret, blob)
+        self.assertIn("reason_code=auth_invalid_token", buf.getvalue())
+        self.assertNotIn("detail=", buf.getvalue())
+
+    def test_keychain_content_not_in_daemon_log(self):
+        buf = io.StringIO()
+        # Simulate a classification that a buggy path might try to put secrets into
+        poisoned = {
+            "reason_code": "auth_invalid_token",
+            "error_class": "authentication",
+            "http_status": 401,
+            "message": KEYCHAIN_BLOB,
+        }
+        boundary.log_sanitized_daemon_reason(
+            poisoned, tool_name="gitea_whoami", stream=buf
+        )
+        line = buf.getvalue()
+        self.assertNotIn("sekrit", line)
+        self.assertNotIn("keychain-item", line)
+        self.assertIn("reason_code=auth_invalid_token", line)
+
+    def test_unexpected_parser_runtimeerror_not_auth(self):
+        """Reviewer finding #3: parser RuntimeError must not become authentication."""
+        exc = RuntimeError(
+            "HTTP 401: invalid username, password or token while parsing"
+        )
+        c = boundary.classify_exception(exc)
+        self.assertEqual(c["error_class"], "internal")
+        self.assertEqual(c["reason_code"], "internal_error")
+        self.assertNotEqual(c["error_class"], "authentication")
+        self.assertFalse(boundary.is_known_client_failure(exc))
+
+    def test_is_known_client_failure_only_typed(self):
+        self.assertTrue(
+            boundary.is_known_client_failure(gitea_auth.GiteaAuthError())
+        )
+        self.assertTrue(
+            boundary.is_known_client_failure(gitea_auth.GiteaAuthzError())
+        )
+        self.assertFalse(boundary.is_known_client_failure(RuntimeError("x")))
+        self.assertFalse(boundary.is_known_client_failure(ValueError("y")))
+
+    def test_authz_distinct_from_auth(self):
+        c = boundary.classify_exception(
+            gitea_auth.GiteaAuthzError(reason_code="authz_denied")
+        )
+        self.assertEqual(c["error_class"], "authorization")
+        self.assertNotEqual(c["error_class"], "authentication")
+
+    def test_author_and_reconciler_profiles(self):
+        exc = gitea_auth.GiteaAuthError()
+        for profile in ("prgs-author", "prgs-reconciler"):
+            r = boundary.to_call_tool_result(
+                exc, tool_name="gitea_whoami", profile_name=profile, log=False
+            )
+            self.assertEqual(r.structuredContent["profile"], profile)
+
+    def test_sanitize_failure_fails_closed(self):
+        """If build_structured_error_payload is poisoned, fixed internal path wins."""
+        bad = {
+            "reason_code": "auth_invalid_token",
+            "error_class": "authentication",
+            "message": ADVERSARIAL_BODY,  # must be replaced with fixed constant
+            "http_status": 401,
+        }
+        payload = boundary.build_structured_error_payload(bad)
+        self.assertEqual(
+            payload["message"], boundary.fixed_message("auth_invalid_token")
+        )
+        self.assertNotIn("supersecret", payload["message"])
+
+
+# ---------------------------------------------------------------------------
+# Tool.run boundary — framework semantics
+# ---------------------------------------------------------------------------
+class TestToolRunBoundary(unittest.TestCase):
+    def setUp(self):
+        from mcp.server.fastmcp.tools.base import Tool
+
+        boundary.install_tool_run_boundary(Tool)
+        self.Tool = Tool
+
+    def _tool(self, fn, name="demo_tool"):
+        return self.Tool.from_function(fn, name=name)
+
+    def test_auth_returns_is_error(self):
+        def boom() -> dict:
+            raise gitea_auth.GiteaAuthError()
+
+        result = asyncio.run(self._tool(boom, "gitea_whoami").run({}, convert_result=True))
+        self.assertTrue(result.isError)
+        self.assertEqual(result.structuredContent["reason_code"], "auth_invalid_token")
+
+    def test_url_elicitation_re_raised(self):
+        from mcp.shared.exceptions import UrlElicitationRequiredError
+        from mcp.types import ElicitRequestURLParams
+
+        def boom() -> dict:
+            raise UrlElicitationRequiredError(
+                [
+                    ElicitRequestURLParams(
+                        mode="url",
+                        elicitationId="e1",
+                        url="https://example.invalid/elicit",
+                        message="need auth",
+                    )
+                ]
+            )
+
+        tool = self._tool(boom, "elicitation_tool")
+
+        async def _run():
+            return await tool.run({}, convert_result=True)
+
+        with self.assertRaises(UrlElicitationRequiredError):
+            asyncio.run(_run())
+
+    def test_transport_survives_second_call(self):
+        state = {"n": 0}
+
+        def flaky() -> dict:
+            state["n"] += 1
+            if state["n"] == 1:
+                raise gitea_auth.GiteaAuthError()
+            return {"ok": True, "call": state["n"]}
+
+        tool = self._tool(flaky, "gitea_whoami")
+
+        async def _both():
+            first = await tool.run({}, convert_result=True)
+            second = await tool.run({}, convert_result=True)
+            return first, second
+
+        first, second = asyncio.run(_both())
+        self.assertTrue(first.isError)
+        self.assertEqual(first.structuredContent["error_class"], "authentication")
+        self.assertFalse(getattr(second, "isError", False))
+        self.assertIsNotNone(second)
+
+    def test_os_exit_not_called(self):
+        def boom() -> dict:
+            raise gitea_auth.GiteaAuthError()
+
+        with patch("os._exit") as mock_exit:
+            result = asyncio.run(self._tool(boom).run({}, convert_result=True))
+            mock_exit.assert_not_called()
+        self.assertTrue(result.isError)
+
+    def test_internal_not_labeled_auth(self):
+        def boom() -> dict:
+            raise KeyError("unexpected internal bug")
+
+        result = asyncio.run(self._tool(boom).run({}, convert_result=True))
+        self.assertTrue(result.isError)
+        self.assertEqual(result.structuredContent["error_class"], "internal")
+        self.assertEqual(result.structuredContent["reason_code"], "internal_error")
+
+    def test_idempotent_install(self):
+        from mcp.server.fastmcp.tools.base import Tool
+
+        first = boundary.install_tool_run_boundary(Tool)
+        second = boundary.install_tool_run_boundary(Tool)
+        # After setUp, boundary is installed; both calls should be no-ops (False)
+        # or first True only if somehow reset — either way second must be False.
+        self.assertFalse(second)
+        self.assertTrue(boundary.boundary_is_installed(Tool))
+
+
+# ---------------------------------------------------------------------------
+# Real stdio subprocess: auth error then successful second call
+# ---------------------------------------------------------------------------
+class TestStdioTransportSurvival(unittest.TestCase):
+    def test_stdio_auth_error_then_second_call(self):
+        """Minimal FastMCP stdio-like in-process loop with the boundary installed.
+
+        Uses Tool.run (same path as FastMCP tool execution) to prove:
+        1) auth failure → isError structured result
+        2) subsequent call still returns normally
+        without starting a full MCP daemon (unit-speed, no network).
+        """
+        from mcp.server.fastmcp.tools.base import Tool
+
+        boundary.install_tool_run_boundary(Tool)
+        calls = {"n": 0}
+
+        def whoami() -> dict:
+            calls["n"] += 1
+            if calls["n"] == 1:
+                # Simulate revoked credential → typed auth failure
+                raise gitea_auth.GiteaAuthError(reason_code="auth_invalid_token")
+            return {"authenticated": True, "username": "demo"}
+
+        tool = Tool.from_function(whoami, name="gitea_whoami")
+
+        async def session():
+            r1 = await tool.run({}, convert_result=True)
+            r2 = await tool.run({}, convert_result=True)
+            return r1, r2
+
+        r1, r2 = asyncio.run(session())
+        self.assertTrue(r1.isError)
+        self.assertEqual(r1.structuredContent["reason_code"], "auth_invalid_token")
+        self.assertTrue(r1.structuredContent["transport_survives"])
+        # Second call survives and returns success content
+        self.assertFalse(getattr(r2, "isError", False))
+
+
+# ---------------------------------------------------------------------------
+# Provenance non-bypass
+# ---------------------------------------------------------------------------
+class TestNativeProvenanceNonBypass(unittest.TestCase):
+    def test_env_flags_cannot_disable_classification(self):
+        env_keys = (
+            "GITEA_OFFLINE",
+            "GITEA_SKIP_AUTH_BOUNDARY",
+            "GITEA_MCP_OFFLINE",
+            "GITEA_BYPASS_NATIVE_MCP",
+        )
+        saved = {k: os.environ.get(k) for k in env_keys}
+        try:
+            for k in env_keys:
+                os.environ[k] = "1"
+            exc = gitea_auth.GiteaAuthError()
+            c = boundary.classify_exception(exc)
+            self.assertEqual(c["error_class"], "authentication")
+            r = boundary.to_call_tool_result(exc, log=False)
+            self.assertTrue(r.isError)
+            self.assertEqual(r.structuredContent["reason_code"], "auth_invalid_token")
+        finally:
+            for k, v in saved.items():
+                if v is None:
+                    os.environ.pop(k, None)
+                else:
+                    os.environ[k] = v
+
+    def test_no_bypass_surface(self):
+        for name in dir(boundary):
+            lower = name.lower()
+            self.assertFalse(
+                lower.startswith("bypass") or lower.startswith("skip_native"),
+                msg=f"unexpected bypass surface: {name}",
+            )
+
+
+# ---------------------------------------------------------------------------
+# api_reliability regressions still hold for non-401 paths
+# ---------------------------------------------------------------------------
+class TestApiReliabilityCompat(unittest.TestCase):
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_502_upstream_typed(self, mock_open):
+        mock_open.side_effect = http_error(502, "bad gateway secret=xyz")
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(ctx.exception.reason_code, "upstream_unavailable")
+        self.assertNotIn("secret=xyz", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_auth_header_never_in_error(self, mock_open):
+        mock_open.side_effect = http_error(400, "bad request")
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertNotIn(FAKE_AUTH, str(ctx.exception))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_terminal_review_hard_stop.py

@@ -1,10 +1,10 @@
-"""Tests for the session hard-stop after a terminal review mutation (#332/#693).
+"""Tests for the session hard-stop after a terminal review mutation (#332).
 
 Extends the single-terminal-decision machinery (#211): after a live
-REQUEST_CHANGES on a PR head the same-head path must stop; after an APPROVE
-only the merge sequence for that same PR may continue; #693 allows a
-*different* PR to be mark_ready/review in the same durable lock (cross-PR
-isolation); duplicate REQUEST_CHANGES at an unchanged head is suppressed.
+REQUEST_CHANGES the run must stop; after an APPROVE only the merge sequence
+for that same PR may continue; a different PR can never be reviewed or
+merged in the same run; duplicate REQUEST_CHANGES at an unchanged head is
+suppressed.
 """
 import os
 import unittest
@@ -15,10 +15,7 @@ import mcp_server
 HEAD_SHA = "a" * 40
 
 
-def _lock(mutations=None, correction=False, correction_pr=None):
-    mutations = list(mutations or [])
-    if correction and correction_pr is None and mutations:
-        correction_pr = mutations[-1].get("pr_number")
+def _lock(mutations=None, correction=False):
     return {
         "task": "review_pr",
         "remote": "prgs",
@@ -32,11 +29,9 @@ def _lock(mutations=None, correction=False, correction_pr=None):
         "ready_remote": None,
         "ready_org": None,
         "ready_repo": None,
-        "live_mutations": mutations,
+        "live_mutations": list(mutations or []),
         "correction_authorized": correction,
-        "correction_reason": "test" if correction else None,
-        "correction_pr_number": correction_pr if correction else None,
-        "correction_head_sha": None,
+        "correction_reason": None,
     }
 
 
@@ -69,35 +64,25 @@ class TestTerminalHardStopReasons(unittest.TestCase):
         self.assertEqual(
             mcp_server.terminal_review_hard_stop_reasons(5, "merge"), [])
 
-    def test_request_changes_blocks_same_pr_allows_other_pr_review(self):
+    def test_request_changes_blocks_everything(self):
         _seed([RC_A])
-        # Same PR: still hard-stopped for mark_ready/review/merge.
         for op in ("merge", "mark_ready", "review"):
-            reasons = mcp_server.terminal_review_hard_stop_reasons(5, op)
-            self.assertTrue(reasons, f"{op}/5")
-            self.assertIn("request_changes on PR #5", reasons[0])
-            self.assertIn("#332", reasons[0])
-        # #693: different PR may mark_ready / review (not merge via hard-stop alone).
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(6, "mark_ready"), [])
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(6, "review"), [])
-        # Merge of an unapproved other PR remains blocked by hard-stop path
-        # (last terminal is not approve of PR 6).
-        self.assertTrue(
-            mcp_server.terminal_review_hard_stop_reasons(6, "merge"))
+            for pr in (5, 6):
+                reasons = mcp_server.terminal_review_hard_stop_reasons(pr, op)
+                self.assertTrue(reasons, f"{op}/{pr}")
+                self.assertIn("request_changes on PR #5", reasons[0])
+                self.assertIn("#332", reasons[0])
 
-    def test_approve_allows_same_pr_merge_and_other_pr_review(self):
+    def test_approve_allows_same_pr_merge_only(self):
         _seed([APPROVED_A])
         self.assertEqual(
             mcp_server.terminal_review_hard_stop_reasons(5, "merge"), [])
         self.assertTrue(
             mcp_server.terminal_review_hard_stop_reasons(6, "merge"))
-        # #693 cross-PR isolation: other PR formal review path is open.
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(6, "mark_ready"), [])
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(6, "review"), [])
+        self.assertTrue(
+            mcp_server.terminal_review_hard_stop_reasons(6, "mark_ready"))
+        self.assertTrue(
+            mcp_server.terminal_review_hard_stop_reasons(6, "review"))
 
     def test_correction_reopens_review_path_only(self):
         _seed([RC_A], correction=True)
@@ -105,11 +90,9 @@ class TestTerminalHardStopReasons(unittest.TestCase):
             mcp_server.terminal_review_hard_stop_reasons(5, "mark_ready"), [])
         self.assertEqual(
             mcp_server.terminal_review_hard_stop_reasons(5, "review"), [])
-        # scoped correction never opens a cross-PR merge
+        # correction never opens a cross-PR merge
         self.assertTrue(
             mcp_server.terminal_review_hard_stop_reasons(6, "merge"))
-        # unscoped/cross-PR correction must not lift PR 6 via correction alone
-        # (PR 6 is allowed by isolation, not by correction scope)
 
 
 class TestMergeHardStopWiring(unittest.TestCase):
@@ -143,29 +126,14 @@ class TestMarkFinalHardStopWiring(unittest.TestCase):
         mcp_server._save_review_decision_lock(None)
         mcp_server.review_workflow_load.clear_review_workflow_load()
 
-    def test_mark_ready_same_pr_blocked_after_terminal_mutation(self):
+    def test_mark_ready_blocked_after_terminal_mutation(self):
         _seed([RC_A])
         result = mcp_server.gitea_mark_final_review_decision(
-            pr_number=5, action="approve", remote="prgs",
-            expected_head_sha=HEAD_SHA)
+            pr_number=6, action="approve", remote="prgs")
         self.assertFalse(result["marked_ready"])
         self.assertTrue(
             any("#332" in r for r in result["reasons"]), result["reasons"])
 
-    def test_mark_ready_other_pr_allowed_after_foreign_terminal(self):
-        """#693: foreign open-PR terminal must not block mark_final on PR B."""
-        _seed([RC_A])
-        no_lease = {"block": False, "reasons": [], "mutation_allowed": True}
-        with patch("mcp_server._list_pr_lease_comments", return_value=[]), \
-                patch("mcp_server._pr_work_lease_reviewer_block",
-                      return_value=no_lease), \
-                patch.object(mcp_server, "gitea_check_pr_eligibility",
-                             return_value={"head_sha": HEAD_SHA, "eligible": True}):
-            result = mcp_server.gitea_mark_final_review_decision(
-                pr_number=6, action="approve", remote="prgs",
-                expected_head_sha=HEAD_SHA)
-        self.assertTrue(result["marked_ready"], result.get("reasons"))
-
 
 def _feedback(blocking, stale=False, success=True):
     return {