fix(mcp): role-exclusive capability invariants and structured fail-closed submit (Closes #723)

Defect A - invariants:
- task_capability_map.ROLE_EXCLUSIVE_TASKS is now the single shared
  definition of role-exclusive tasks; the resolver's inline copy is gone
  (AC1/AC5 drift surface removed).
- tests: every role-exclusive task must exist in the capability map;
  formal-review tasks stay role-exclusive; canonical merger satisfies
  merge_pr; canonical reconciler satisfies branch-cleanup tasks
  (extends the #722 break-glass invariant suite).

Defect B - unactionable internal_error:
- AC3: gitea_resolve_task_capability records the capability purity
  baseline first but stamps _preflight_resolved_role/_task only for an
  ALLOWED resolve; a denied resolve clears any stale stamp
  (_clear_resolved_capability_stamp) so later mutation preflights key
  off the real profile role.
- AC4: _evaluate_pr_review_submission converts
  _verify_role_mutation_workspace failures (role binding, stale
  runtime) into result reasons with blocker_kind=workspace_role_binding
  instead of letting RuntimeError escape as a generic internal_error.
- AC5: _build_runtime_task_capabilities applies the resolver's
  role-exclusive filter when given the active role kind and labels each
  entry role_filtered/permission_only; matching_configured_profiles
  honors declared profile roles for role-exclusive tasks.

Validation: focused suites 22 passed (+48 subtests); adjacent resolver/
runtime/review suites 72 passed; full suite 2929 passed, 6 skipped,
221 subtests (single pre-existing Starlette warning, #682).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

gitea_mcp_server.py

@@ -517,6 +517,19 @@ def _clear_preflight_capability_state() -> None:
     _preflight_reviewer_violation_files = []
 
 
+def _clear_resolved_capability_stamp() -> None:
+    """#723 AC3: drop only the resolved role/task stamp (denied resolve).
+
+    ``record_preflight_check("capability")`` without a role intentionally
+    preserves a prior stamp, so a DENIED resolve must clear it explicitly —
+    otherwise the stale role poisons :func:`_effective_workspace_role` and a
+    later mutation preflight raises instead of failing closed with reasons.
+    """
+    global _preflight_resolved_role, _preflight_resolved_task
+    _preflight_resolved_role = None
+    _preflight_resolved_task = None
+
+
 def record_preflight_check(
     type_name: str,
     resolved_role: str | None = None,
@@ -3454,8 +3467,6 @@ def init_review_decision_lock(remote: str | None, task: str | None, force: bool
         "live_mutations": [],
         "correction_authorized": False,
         "correction_reason": None,
-        "correction_pr_number": None,
-        "correction_head_sha": None,
     })
 
 
@@ -3551,30 +3562,21 @@ def check_review_decision_gate(
     if stale_review_decision_lock.prior_live_mutations_block_boundary(
         lock, pr_number=pr_number, expected_head_sha=ready_head
     ):
-        scoped = stale_review_decision_lock.correction_applies(
-            lock, pr_number=pr_number, expected_head_sha=ready_head
-        )
-        if prior and not scoped:
+        if prior and not lock.get("correction_authorized"):
             reasons.append(
                 "live review mutation already recorded for this PR head in this "
                 "run; only one live review mutation is allowed per head unless "
-                "gitea_authorize_review_correction was invoked for this same "
-                "PR/head (fail closed, #620/#693)"
+                "gitea_authorize_review_correction was invoked (fail closed, #620)"
             )
         elif (
             action in _TERMINAL_REVIEW_ACTIONS
-            and any(
-                isinstance(m, dict)
-                and m.get("action") in _TERMINAL_REVIEW_ACTIONS
-                and m.get("pr_number") == pr_number
-                for m in prior
-            )
-            and not scoped
+            and any(m.get("action") in _TERMINAL_REVIEW_ACTIONS for m in prior)
+            and not lock.get("correction_authorized")
         ):
             reasons.append(
                 "terminal review decision already submitted for this PR head in "
                 "this run; blocked unless an operator-approved correction was "
-                "authorized for this same PR/head (fail closed, #620/#693)"
+                "authorized (fail closed, #620)"
             )
 
     return reasons
@@ -3603,8 +3605,6 @@ def record_live_review_mutation(pr_number: int, action: str, review_id: int | No
     if lock.get("correction_authorized"):
         lock["correction_authorized"] = False
         lock["correction_reason"] = None
-        lock["correction_pr_number"] = None
-        lock["correction_head_sha"] = None
     _save_review_decision_lock(lock)
 
 
@@ -3648,13 +3648,11 @@ def terminal_review_hard_stop_reasons(
         and last.get("pr_number") == pr_number
     ):
         return []
-    if operation in ("mark_ready", "review", "resume") and (
-        stale_review_decision_lock.correction_applies(
-            lock, pr_number=pr_number, expected_head_sha=expected_head_sha
-        )
+    if operation in ("mark_ready", "review", "resume") and lock.get(
+        "correction_authorized"
     ):
         return []
-    # #620 same-PR new head + #693 cross-PR isolation.
+    # #620: same PR, different reviewed head → fresh decision boundary.
     if stale_review_decision_lock.terminal_boundary_allows_fresh_decision(
         lock,
         pr_number=pr_number,
@@ -3676,20 +3674,16 @@ def terminal_review_hard_stop_reasons(
         else ""
     )
     recovery = (
-        "exact_next_action: if that PR is already merged/closed, use "
-        "gitea_cleanup_stale_review_decision_lock(apply=true) after live-state "
-        "proof (#594); if the same PR head moved, mark/submit with the new "
-        "expected_head_sha (#620); if the target is a different PR, "
-        "gitea_diagnose_review_decision_lock then mark_final on the target "
-        "(cross-PR isolation, #693); if same-head verdict was mistaken, "
-        "gitea_authorize_review_correction with matching target_pr_number "
-        "(not a generic unlock); never delete session-state files by hand; "
-        "if still blocked create/update a durable Gitea issue and stop"
+        "if that PR is already merged/closed, use "
+        "gitea_cleanup_stale_review_decision_lock (apply=true) after live-state "
+        "proof (#594); if the PR is still open but the head moved, mark/submit "
+        "with the new expected_head_sha (#620); never delete session-state "
+        "files by hand"
     )
     return [
         "terminal review mutation already consumed in this run "
         f"({last.get('action')} on PR #{last.get('pr_number')}{head_note}); "
-        f"{guidance} (fail closed, #332/#693); {recovery}"
+        f"{guidance} (fail closed, #332); {recovery}"
     ]
 
 
@@ -4115,9 +4109,6 @@ def _evaluate_pr_review_submission(
     worktree_path: str | None = None,
 ) -> dict:
     """Shared gate chain for live submit and dry-run review tools."""
-    _verify_role_mutation_workspace(
-        remote, worktree_path=worktree_path, task="review_pr"
-    )
     action = (action or "").strip().lower()
     workflow_blockers = _review_workflow_load_gate_reasons() if live else []
     result = {
@@ -4135,6 +4126,20 @@ def _evaluate_pr_review_submission(
         "reasons": [],
     }
     reasons = result["reasons"]
+    # #723 AC4: workspace/role-binding failures fail closed with structured
+    # reasons — never escape as a generic internal_error (PR #721: a stamped
+    # 'merger' role raised RuntimeError here and the client saw an
+    # unactionable internal_error after mark_final had already succeeded).
+    try:
+        _verify_role_mutation_workspace(
+            remote, worktree_path=worktree_path, task="review_pr"
+        )
+    except RuntimeError as exc:
+        result["blocker_kind"] = "workspace_role_binding"
+        reasons.append(
+            "workspace/role binding failed (fail closed, #723): " f"{exc}"
+        )
+        return result
     if workflow_blockers:
         reasons.extend(workflow_blockers)
         reasons.extend(review_workflow_load.recovery_handoff_without_replay())
@@ -4354,33 +4359,10 @@ def gitea_mark_final_review_decision(
             "reasons": [
                 "review decision lock missing; resolve review_pr capability first"
             ],
-            "exact_next_action": (
-                "gitea_resolve_task_capability(task='review_pr') then retry "
-                "mark_final"
-            ),
-            "durable_issue_handoff": {
-                "required": True,
-                "instruction": (
-                    "If the lock cannot be seeded, create/update a durable "
-                    "Gitea issue and stop (#693 AC8)"
-                ),
-            },
         }
     session_reasons = _review_decision_session_reasons(lock)
     if session_reasons:
-        classification = stale_review_decision_lock.classify_review_decision_lock(
-            lock,
-            target_pr_number=pr_number,
-            target_head_sha=expected_head_sha,
-            session_blockers=session_reasons,
-        )
-        fail = stale_review_decision_lock.build_precise_mark_final_failure(
-            classification
-        )
-        return {
-            "marked_ready": False,
-            **fail,
-        }
+        return {"marked_ready": False, "reasons": session_reasons}
     if remote != lock.get("remote"):
         return {
             "marked_ready": False,
@@ -4388,7 +4370,6 @@ def gitea_mark_final_review_decision(
                 f"requested remote '{remote}' does not match locked remote "
                 f"'{lock.get('remote')}' (fail closed)"
             ],
-            "exact_next_action": "use the remote bound on the decision lock",
         }
     try:
         _, resolved_org, resolved_repo = _resolve(remote, None, org, repo)
@@ -4423,26 +4404,7 @@ def gitea_mark_final_review_decision(
         pr_number, "mark_ready", expected_head_sha=expected_head_sha
     )
     if hard_stop:
-        classification = stale_review_decision_lock.classify_review_decision_lock(
-            lock,
-            target_pr_number=pr_number,
-            target_head_sha=expected_head_sha,
-            active_profile_identity=_decision_lock_binding().get(
-                "profile_identity"
-            ),
-        )
-        fail = stale_review_decision_lock.build_precise_mark_final_failure(
-            classification
-        )
-        # Prefer classification next_action when more precise; keep hard_stop
-        # text as primary reasons for operators.
-        return {
-            "marked_ready": False,
-            "reasons": hard_stop + list(fail.get("reasons") or []),
-            "classification": fail.get("classification"),
-            "exact_next_action": fail.get("exact_next_action"),
-            "durable_issue_handoff": fail.get("durable_issue_handoff"),
-        }
+        return {"marked_ready": False, "reasons": hard_stop}
     if action not in _REVIEW_ACTIONS:
         return {
             "marked_ready": False,
@@ -4458,63 +4420,17 @@ def gitea_mark_final_review_decision(
                 "expected_head_sha required before marking final review "
                 "decision (fail closed, #399)"
             ],
-            "exact_next_action": "retry mark_final with expected_head_sha pin",
-        }
-    # Safe idempotency: already ready for same PR/action/head (#693 AC4).
-    ready_head = stale_review_decision_lock.normalize_head_sha(
-        lock.get("ready_expected_head_sha")
-    )
-    target_head = stale_review_decision_lock.normalize_head_sha(expected_head_sha)
-    if (
-        lock.get("final_review_decision_ready")
-        and lock.get("ready_pr_number") == pr_number
-        and lock.get("ready_action") == action
-        and ready_head
-        and target_head
-        and stale_review_decision_lock.heads_equal(ready_head, target_head)
-        and lock.get("ready_remote") == remote
-        and lock.get("ready_org") == org
-        and lock.get("ready_repo") == repo
-    ):
-        return {
-            "marked_ready": True,
-            "idempotent": True,
-            "pr_number": pr_number,
-            "action": action,
-            "expected_head_sha": expected_head_sha,
-            "remote": remote,
-            "org": org,
-            "repo": repo,
-            "final_review_decision_ready": True,
-            "head_scoped": True,
-            "reasons": [
-                "final review decision already marked ready for this PR/action/"
-                "head (idempotent, #693)"
-            ],
         }
     if stale_review_decision_lock.prior_live_mutations_block_boundary(
         lock, pr_number=pr_number, expected_head_sha=expected_head_sha
     ):
-        classification = stale_review_decision_lock.classify_review_decision_lock(
-            lock,
-            target_pr_number=pr_number,
-            target_head_sha=expected_head_sha,
-        )
-        fail = stale_review_decision_lock.build_precise_mark_final_failure(
-            classification
-        )
         return {
             "marked_ready": False,
             "reasons": [
                 "cannot mark final decision after a live review mutation was "
                 "already recorded for this PR head unless an operator-approved "
-                "correction was authorized for this same PR/head "
-                "(fail closed, #620/#693)"
-            ]
-            + list(fail.get("reasons") or []),
-            "classification": fail.get("classification"),
-            "exact_next_action": fail.get("exact_next_action"),
-            "durable_issue_handoff": fail.get("durable_issue_handoff"),
+                "correction was authorized (fail closed, #620)"
+            ],
         }
     elig = gitea_check_pr_eligibility(
         pr_number=pr_number,
@@ -4598,19 +4514,8 @@ def gitea_authorize_review_correction(
     prior_review_state: str,
     reason: str,
     operator_authorized: bool = False,
-    target_pr_number: int | None = None,
-    expected_head_sha: str | None = None,
-    remote: str = "dadeschools",
-    org: str | None = None,
-    repo: str | None = None,
-    post_audit_comment: bool = True,
 ) -> dict:
-    """Authorize one operator-approved correction after a mistaken live review.
-
-    #693: correction is scoped to the named prior review's **PR and head**.
-    It cannot unlock a different PR (no generic decision-lock bypass).
-    Successful authorization posts a thread-visible audit on the target PR.
-    """
+    """Authorize one operator-approved correction after a mistaken live review."""
     reason = (reason or "").strip()
     prior_review_state = (prior_review_state or "").strip().lower()
     lock = _load_review_decision_lock()
@@ -4636,20 +4541,7 @@ def gitea_authorize_review_correction(
     last_mutation = prior[-1]
     last_review_id = last_mutation.get("review_id")
     last_review_state = last_mutation.get("action")
-    last_pr = last_mutation.get("pr_number")
-    last_head = stale_review_decision_lock.mutation_head_sha(last_mutation, lock)
     reasons = []
-    if target_pr_number is None:
-        reasons.append(
-            "target_pr_number is required so correction cannot become a "
-            "generic unlock (fail closed, #693)"
-        )
-    elif last_pr is not None and int(target_pr_number) != int(last_pr):
-        reasons.append(
-            f"target_pr_number #{target_pr_number} does not match last "
-            f"recorded mutation PR #{last_pr}; correction cannot unlock a "
-            f"different PR (fail closed, #693)"
-        )
     if last_review_id is not None and last_review_id != prior_review_id:
         reasons.append(
             f"prior review ID '{prior_review_id}' does not match last "
@@ -4660,202 +4552,14 @@ def gitea_authorize_review_correction(
             f"prior review state '{prior_review_state}' does not match last "
             f"recorded review state '{last_review_state}' (fail closed)"
         )
-    want_head = stale_review_decision_lock.normalize_head_sha(expected_head_sha)
-    if want_head and last_head and not stale_review_decision_lock.heads_equal(
-        want_head, last_head
-    ):
-        reasons.append(
-            f"expected_head_sha does not match last mutation head "
-            f"{last_head[:12]}… (fail closed, #693)"
-        )
     if not reason:
         reasons.append("correction reason is required")
-    try:
-        actor = None
-        h, o, r = _resolve(remote, None, org, repo)
-        try:
-            actor = _authenticated_username(h)
-        except Exception:
-            actor = None
-    except Exception as exc:  # noqa: BLE001
-        return {
-            "authorized": False,
-            "reasons": [f"could not resolve remote for audit: {_redact(str(exc))}"],
-        }
-    profile = get_profile()
-    profile_name = (profile.get("profile_name") or "").strip() or None
-    audit = stale_review_decision_lock.build_correction_audit_record(
-        prior_review_id=prior_review_id,
-        prior_review_state=prior_review_state,
-        target_pr_number=target_pr_number if target_pr_number is not None else last_pr,
-        target_head_sha=want_head or last_head,
-        reason=reason,
-        actor_username=actor,
-        profile_name=profile_name,
-        authorized=False,
-    )
     if reasons:
-        return {
-            "authorized": False,
-            "reasons": reasons,
-            "audit": audit,
-            "exact_next_action": (
-                "use same-PR correction only, or for a different PR use "
-                "gitea_diagnose_review_decision_lock / cross-PR isolation "
-                "(#693) or moot cleanup (#594)"
-            ),
-        }
-    scope_pr = int(target_pr_number) if target_pr_number is not None else int(last_pr)
-    scope_head = want_head or last_head
+        return {"authorized": False, "reasons": reasons}
     lock["correction_authorized"] = True
     lock["correction_reason"] = reason
-    lock["correction_pr_number"] = scope_pr
-    lock["correction_head_sha"] = scope_head
     _save_review_decision_lock(lock)
-    audit = stale_review_decision_lock.build_correction_audit_record(
-        prior_review_id=prior_review_id,
-        prior_review_state=prior_review_state,
-        target_pr_number=scope_pr,
-        target_head_sha=scope_head,
-        reason=reason,
-        actor_username=actor,
-        profile_name=profile_name,
-        authorized=True,
-    )
-    report = {
-        "authorized": True,
-        "correction_reason": reason,
-        "correction_pr_number": scope_pr,
-        "correction_head_sha": scope_head,
-        "audit": audit,
-        "audit_comment_id": None,
-        "reasons": [],
-        "scope": "same_pr_head_only",
-    }
-    if post_audit_comment and scope_pr is not None:
-        comment_block = _profile_operation_gate("gitea.pr.comment")
-        if comment_block:
-            report["audit_comment_skipped"] = comment_block
-        else:
-            try:
-                auth = _auth(h)
-                body = stale_review_decision_lock.format_correction_audit_comment(
-                    audit
-                )
-                with _audited(
-                    "comment_pr",
-                    host=h,
-                    remote=remote,
-                    org=o,
-                    repo=r,
-                    pr_number=scope_pr,
-                    request_metadata={"source": "authorize_review_correction"},
-                ):
-                    posted = api_request(
-                        "POST",
-                        f"{repo_api_url(h, o, r)}/issues/{scope_pr}/comments",
-                        auth,
-                        {"body": body},
-                    )
-                report["audit_comment_id"] = (posted or {}).get("id")
-            except Exception as exc:  # noqa: BLE001
-                report["audit_comment_error"] = _redact(str(exc))
-    return report
-
-
-@mcp.tool()
-def gitea_diagnose_review_decision_lock(
-    target_pr_number: int,
-    expected_head_sha: str | None = None,
-    remote: str = "dadeschools",
-    host: str | None = None,
-    org: str | None = None,
-    repo: str | None = None,
-) -> dict:
-    """Read-only: classify durable review-decision lock state for a target PR (#693).
-
-    Returns a deterministic classification, owner/evidence, exact next_action,
-    and whether mark_final / cleanup / scoped correction are appropriate.
-    Never mutates the lock and never authorizes correction.
-    """
-    read_block = _profile_operation_gate("gitea.read")
-    if read_block:
-        return {
-            "success": False,
-            "reasons": read_block,
-            "permission_report": _permission_block_report("gitea.read"),
-        }
-    h, o, r = _resolve(remote, host, org, repo)
-    auth = _auth(h)
-    binding = _decision_lock_binding()
-    lock = _load_review_decision_lock()
-    session_blockers = _review_decision_session_reasons(lock) if lock else []
-    last = stale_review_decision_lock.last_terminal_mutation(lock)
-    pr_live = None
-    pr_lookup_error = None
-    last_pr = last.get("pr_number") if last else None
-    if last_pr is not None:
-        try:
-            pr_live = api_request(
-                "GET", f"{repo_api_url(h, o, r)}/pulls/{last_pr}", auth
-            ) or {}
-            if not pr_live:
-                pr_lookup_error = "empty PR payload"
-        except Exception as exc:  # noqa: BLE001
-            pr_lookup_error = _redact(str(exc))
-    classification = stale_review_decision_lock.classify_review_decision_lock(
-        lock,
-        target_pr_number=target_pr_number,
-        target_head_sha=expected_head_sha,
-        pr_live=pr_live,
-        pr_lookup_error=pr_lookup_error,
-        active_profile_identity=binding.get("profile_identity"),
-        session_blockers=session_blockers,
-    )
-    recovery = stale_review_decision_lock.assess_open_pr_decision_lock_recovery(
-        lock,
-        target_pr_number=target_pr_number,
-        target_head_sha=expected_head_sha,
-        last_terminal_pr_live=pr_live,
-        pr_lookup_error=pr_lookup_error,
-        active_profile_identity=binding.get("profile_identity"),
-        session_blockers=session_blockers,
-    )
-    try:
-        actor = _authenticated_username(h)
-    except Exception:
-        actor = None
-    return {
-        "success": True,
-        "remote": remote,
-        "org": o,
-        "repo": r,
-        "authenticated_username": actor,
-        "active_profile_identity": binding.get("profile_identity"),
-        "classification": classification.get("classification"),
-        "mark_final_allowed": classification.get("mark_final_allowed"),
-        "cleanup_allowed": classification.get("cleanup_allowed"),
-        "correction_eligible": classification.get("correction_eligible"),
-        "recovery_allowed": recovery.get("recovery_allowed"),
-        "recovery_mode": recovery.get("recovery_mode"),
-        "exact_next_action": classification.get("next_action"),
-        "owner_profile_identity": classification.get("owner_profile_identity"),
-        "last_terminal_pr": classification.get("last_terminal_pr"),
-        "last_terminal_action": classification.get("last_terminal_action"),
-        "locked_head_sha": classification.get("locked_head_sha"),
-        "target_pr_number": target_pr_number,
-        "target_head_sha": stale_review_decision_lock.normalize_head_sha(
-            expected_head_sha
-        ),
-        "lock_summary": classification.get("lock_summary"),
-        "evidence": classification.get("evidence"),
-        "reasons": list(classification.get("reasons") or []),
-        "manual_file_delete_forbidden": True,
-        "correction_as_generic_unlock_forbidden": True,
-        "durable_issue_handoff": stale_review_decision_lock.build_precise_mark_final_failure(
-            classification
-        ).get("durable_issue_handoff"),
-    }
+    return {"authorized": True, "correction_reason": reason, "reasons": []}
 
 
 
@@ -12211,8 +11915,16 @@ _RUNTIME_CAPABILITY_TASKS = (
 def _matching_configured_profiles(
     config: dict | None,
     required_permission: str,
+    required_role_kind: str | None = None,
 ) -> list[str]:
-    """Profile names that allow *required_permission* (redacted metadata only)."""
+    """Profile names that allow *required_permission* (redacted metadata only).
+
+    #723 AC5: when *required_role_kind* is supplied (role-exclusive tasks),
+    a profile with a declared role must also match it — mirroring the
+    resolver's matching rule so the two lists cannot drift. Profiles without
+    a declared role still match on permission alone, exactly like the
+    resolver.
+    """
     if not config or "profiles" not in config:
         return []
     matches: list[str] = []
@@ -12236,7 +11948,13 @@ def _matching_configured_profiles(
         ok, _ = gitea_config.check_operation(
             required_permission, p_allowed_n, p_forbidden_n
         )
-        if ok:
+        p_role = (p_data.get("role") or "").strip()
+        role_ok = (
+            required_role_kind is None
+            or not p_role
+            or p_role == required_role_kind
+        )
+        if ok and role_ok:
             matches.append(p_name)
     return sorted(matches)
 
@@ -12245,8 +11963,16 @@ def _build_runtime_task_capabilities(
     allowed: list[str],
     forbidden: list[str],
     config: dict | None,
+    active_role_kind: str | None = None,
 ) -> dict:
-    """Per-task capability summary for role-aware runtime context (#139)."""
+    """Per-task capability summary for role-aware runtime context (#139).
+
+    #723 AC5: applies the same role-exclusive filter as
+    ``gitea_resolve_task_capability`` when *active_role_kind* is supplied, so
+    runtime context can never report a role-exclusive task as allowed while
+    the resolver fail-closes it in the same session (incident #722). Without
+    an *active_role_kind* the view is permission-only and each entry says so.
+    """
     task_entries = []
     flags: dict[str, bool] = {}
     flag_keys = {
@@ -12259,18 +11985,35 @@ def _build_runtime_task_capabilities(
         "close_issue": "can_close_issues",
         "reconcile_already_landed_pr": "can_reconcile_already_landed_prs",
     }
+    role_filter_applied = active_role_kind is not None
     for task in _RUNTIME_CAPABILITY_TASKS:
         permission = task_capability_map.required_permission(task)
-        allowed_here, _ = gitea_config.check_operation(
+        required_role_kind = task_capability_map.required_role(task)
+        role_exclusive = task in task_capability_map.ROLE_EXCLUSIVE_TASKS
+        permission_allowed, _ = gitea_config.check_operation(
             permission, allowed, forbidden
         )
+        role_ok = (
+            not role_exclusive
+            or not role_filter_applied
+            or active_role_kind == required_role_kind
+        )
+        allowed_here = permission_allowed and role_ok
         entry = {
             "task": task,
             "required_permission": permission,
-            "required_role_kind": task_capability_map.required_role(task),
+            "required_role_kind": required_role_kind,
+            "role_exclusive": role_exclusive,
+            "capability_view": (
+                "role_filtered" if role_filter_applied else "permission_only"
+            ),
             "allowed_in_current_session": allowed_here,
             "matching_configured_profiles": _matching_configured_profiles(
-                config, permission
+                config,
+                permission,
+                required_role_kind=(
+                    required_role_kind if role_exclusive else None
+                ),
             ),
         }
         task_entries.append(entry)
@@ -12723,7 +12466,10 @@ def gitea_get_runtime_context(
         )
 
     session_capabilities = _build_runtime_task_capabilities(
-        allowed, forbidden, config
+        allowed,
+        forbidden,
+        config,
+        active_role_kind=_profile_role_kind(profile),
     )
 
     preflight = assess_preflight_status(worktree_path)
@@ -14141,26 +13887,9 @@ def gitea_resolve_task_capability(
 
     required_permission = task_capability_map.required_permission(task)
     required_role = task_capability_map.required_role(task)
-    role_exclusive_tasks = {
-        "review_pr",
-        "approve_pr",
-        "request_changes_pr",
-        "blind_pr_queue_review",
-        "pr_queue_cleanup",
-        "pr-queue-cleanup",
-        "merge_pr",
-        "create_branch",
-        "push_branch",
-        "create_pr",
-        "commit_files",
-        "gitea_commit_files",
-        "address_pr_change_requests",
-        "delete_branch",
-        "cleanup_merged_pr_branch",
-        "reconciliation_cleanup",
-        "work_issue",
-        "work-issue",
-    }
+    # #723 AC5: single shared definition; the runtime-context capability
+    # report applies the same set so the two views cannot drift.
+    role_exclusive_tasks = task_capability_map.ROLE_EXCLUSIVE_TASKS
 
     infra_assessment = role_session_router.assess_infra_stop(PROJECT_ROOT)
     if required_role == "reviewer":
@@ -14241,7 +13970,12 @@ def gitea_resolve_task_capability(
                         "exact_safe_next_action": next_safe_action,
                     }
 
-    record_preflight_check("capability", required_role, resolved_task=task)
+    # #723 AC3: record the capability purity baseline now, but DEFER the
+    # resolved-role/task stamp until after the allow/deny decision below. A
+    # denied resolve previously stamped ``_preflight_resolved_role`` anyway
+    # (PR #721: a denied review_pr resolve stamped 'merger', and the later
+    # submit escaped as a generic internal_error instead of failing closed).
+    record_preflight_check("capability")
 
     # Try automatic dispatch switching
     _ensure_matching_profile(required_permission, required_role, remote, host)
@@ -14276,6 +14010,14 @@ def gitea_resolve_task_capability(
         permission_allowed_in_current_session and role_matches_current_session
     )
 
+    # #723 AC3: stamp the resolved role/task only for an ALLOWED resolve; a
+    # denied resolve clears any stale stamp so later mutation preflights key
+    # off the real profile role and fail closed with structured reasons.
+    if allowed_in_current_session:
+        record_preflight_check("capability", required_role, resolved_task=task)
+    else:
+        _clear_resolved_capability_stamp()
+
     switching = gitea_config.is_runtime_switching_enabled()
     available_in_session = allowed_in_current_session
     configured = False

stale_review_decision_lock.py

@@ -1,4 +1,4 @@
-"""Stale / moot #332 review-decision lock detection and cleanup policy (#594/#620/#693).
+"""Stale / moot #332 review-decision lock detection and cleanup policy (#594/#620).
 
 #332 correctly hard-stops a reviewer session after a terminal live review
 mutation. After #559 those locks are durable on disk, so they can outlive the
@@ -12,11 +12,6 @@ on head B of the **same open PR**. Same-head duplicates remain fail-closed.
 Open-PR lock *cleanup* remains forbidden unless the PR is truly merged/closed
 (#594); new-head re-review is allowed without deleting the durable lock.
 
-#693 scopes the terminal boundary by **PR number**: a terminal on open PR A
-must not block a fresh formal decision on open PR B on the same durable
-profile lock (cross-PR isolation). Correction authorization is scoped to the
-named prior review's PR/head and cannot unlock a different PR.
-
 This module is pure policy (no Gitea I/O). The MCP tool
 ``gitea_cleanup_stale_review_decision_lock`` fetches live PR state, calls these
 helpers, and only then clears durable state when cleanup is allowed.
@@ -85,45 +80,17 @@ def last_terminal_mutation(lock: dict | None) -> dict | None:
     return terminals[-1] if terminals else None
 
 
-def correction_applies(
-    lock: dict | None,
-    *,
-    pr_number: int | None = None,
-    expected_head_sha: str | None = None,
-) -> bool:
-    """True when operator correction is active and scoped to the target (#693).
-
-    Global ``correction_authorized`` alone is not enough: correction must name
-    the same PR (and head when recorded) as the decision being re-opened.
-    Missing scope fields on legacy locks fail closed (do not apply).
-    """
-    if not lock or not lock.get("correction_authorized"):
-        return False
-    corr_pr = lock.get("correction_pr_number")
-    if corr_pr is None:
-        # Legacy unscoped correction — refuse as generic unlock (#693).
-        return False
-    if pr_number is not None and int(corr_pr) != int(pr_number):
-        return False
-    corr_head = normalize_head_sha(lock.get("correction_head_sha"))
-    target = normalize_head_sha(expected_head_sha)
-    if corr_head and target and not heads_equal(corr_head, target):
-        return False
-    return True
-
-
 def prior_live_mutations_block_boundary(
     lock: dict | None,
     *,
     pr_number: int,
     expected_head_sha: str | None,
 ) -> bool:
-    """True when prior live mutations block a new decision for PR+head (#620/#693).
+    """True when prior live mutations block a new decision for PR+head (#620).
 
     Historical terminals on a **different head of the same PR** do not block.
-    Terminals on a **different PR** do not block (#693 cross-PR isolation).
-    Same PR + same head (or same PR without a comparable head SHA) blocks
-    unless a scoped correction applies.
+    Any prior mutation on another PR, the same head, or without a comparable
+    head SHA fails closed (blocks).
 
     Head resolution uses ``mutation_head_sha(m, lock)`` so pre-#620 ledgers
     that only stored ``ready_expected_head_sha`` still compare correctly
@@ -131,9 +98,7 @@ def prior_live_mutations_block_boundary(
     """
     if not lock:
         return False
-    if correction_applies(
-        lock, pr_number=pr_number, expected_head_sha=expected_head_sha
-    ):
+    if lock.get("correction_authorized"):
         return False
     prior = list(lock.get("live_mutations") or [])
     if not prior:
@@ -143,14 +108,10 @@ def prior_live_mutations_block_boundary(
         if not isinstance(m, dict):
             return True
         m_pr = m.get("pr_number")
-        if m_pr is None:
-            return True  # fail closed — unscoped mutation
-        if int(m_pr) != int(pr_number):
-            # #693: foreign-PR history on the shared durable lock does not block.
-            continue
         m_head = mutation_head_sha(m, lock)
         if (
-            target
+            m_pr == pr_number
+            and target
             and m_head
             and not heads_equal(m_head, target)
         ):
@@ -167,34 +128,23 @@ def terminal_boundary_allows_fresh_decision(
     expected_head_sha: str | None,
     operation: str,
 ) -> bool:
-    """Whether #332 hard-stop should yield for a new PR+head boundary (#620/#693).
+    """Whether #332 hard-stop should yield for a new PR+head boundary (#620).
 
-    For ``mark_ready`` / ``review`` / ``resume``:
-
-    * **same PR, different head** — allowed (#620)
-    * **different PR than last terminal** — allowed (#693 cross-PR isolation)
-    * **same PR, same head** — not allowed (unless scoped correction)
-
-    Merge is never reopened by head change or cross-PR isolation (approved
-    head merge path is separate).
+    Only for ``mark_ready`` / ``review`` / ``resume`` on the **same PR** when
+    the requested head differs from the last terminal's head. Merge is never
+    reopened by head change (approved head merge path is separate).
     """
     if operation not in ("mark_ready", "review", "resume"):
         return False
     if not lock:
         return False
-    if correction_applies(
-        lock, pr_number=pr_number, expected_head_sha=expected_head_sha
-    ):
+    if lock.get("correction_authorized"):
         return True
     last = last_terminal_mutation(lock)
     if last is None:
         return True
-    last_pr = last.get("pr_number")
-    if last_pr is None:
+    if last.get("pr_number") != pr_number:
         return False
-    if int(last_pr) != int(pr_number):
-        # #693: last terminal belongs to another PR — do not hard-stop this PR.
-        return True
     locked_head = mutation_head_sha(last, lock)
     target = normalize_head_sha(expected_head_sha)
     if not locked_head or not target:
@@ -490,400 +440,6 @@ def format_cleanup_audit_comment(audit: dict[str, Any]) -> str:
     return "\n".join(lines)
 
 
-# --- #693 classification / recovery / correction audit -----------------------
-
-# Deterministic classification labels for diagnostics and recovery routing.
-CLASS_NO_LOCK = "no_lock"
-CLASS_READY_FOR_TARGET = "ready_for_target"
-CLASS_IN_PROGRESS_SAME_HEAD = "in_progress_same_head"
-CLASS_TERMINAL_ACTIVE_SAME_HEAD = "terminal_active_same_head"
-CLASS_STALE_SUPERSEDED_HEAD = "stale_superseded_head"
-CLASS_FOREIGN_PR_TERMINAL = "foreign_pr_terminal"
-CLASS_MOOT_MERGED_CLOSED = "moot_merged_closed"
-CLASS_CORRECTION_ACTIVE = "correction_active"
-CLASS_SESSION_OR_PROFILE_MISMATCH = "session_or_profile_mismatch"
-CLASS_AMBIGUOUS = "ambiguous"
-
-
-def classify_review_decision_lock(
-    lock: dict | None,
-    *,
-    target_pr_number: int | None = None,
-    target_head_sha: str | None = None,
-    pr_live: dict | None = None,
-    pr_lookup_error: str | None = None,
-    active_profile_identity: str | None = None,
-    session_blockers: list[str] | None = None,
-) -> dict[str, Any]:
-    """Deterministic review-decision-lock classification (#693).
-
-    Returns classification, exact next_action, owner/evidence fields, and
-    whether mark_final / cleanup / correction are appropriate.
-    """
-    summary = lock_summary(lock)
-    target_head = normalize_head_sha(target_head_sha)
-    result: dict[str, Any] = {
-        "classification": CLASS_NO_LOCK,
-        "has_lock": lock is not None,
-        "lock_summary": summary,
-        "target_pr_number": target_pr_number,
-        "target_head_sha": target_head,
-        "last_terminal_pr": None,
-        "last_terminal_action": None,
-        "locked_head_sha": None,
-        "owner_profile_identity": (summary or {}).get("profile_identity"),
-        "session_profile": (summary or {}).get("session_profile"),
-        "updated_at": (summary or {}).get("updated_at"),
-        "correction_authorized": bool((lock or {}).get("correction_authorized")),
-        "correction_pr_number": (lock or {}).get("correction_pr_number"),
-        "correction_head_sha": normalize_head_sha(
-            (lock or {}).get("correction_head_sha")
-        ),
-        "mark_final_allowed": True,
-        "cleanup_allowed": False,
-        "correction_eligible": False,
-        "next_action": "gitea_resolve_task_capability(task='review_pr') then mark_final",
-        "reasons": [],
-        "evidence": {},
-    }
-
-    if lock is None:
-        result["reasons"].append("no review decision lock present")
-        return result
-
-    session_blockers = list(session_blockers or [])
-    if session_blockers:
-        result["classification"] = CLASS_SESSION_OR_PROFILE_MISMATCH
-        result["mark_final_allowed"] = False
-        result["next_action"] = (
-            "reconnect matching prgs-reviewer session or wait for lock TTL; "
-            "do not use gitea_authorize_review_correction as unlock; "
-            "do not delete session-state files"
-        )
-        result["reasons"].extend(session_blockers)
-        return result
-
-    stored = (
-        (lock.get("profile_identity") or lock.get("session_profile_lock") or "")
-        .strip()
-    )
-    active = (active_profile_identity or "").strip()
-    if active and stored and active != stored:
-        result["classification"] = CLASS_SESSION_OR_PROFILE_MISMATCH
-        result["mark_final_allowed"] = False
-        result["next_action"] = (
-            f"switch to profile '{stored}' or wait for moot cleanup; "
-            "do not use correction authorization as a generic unlock"
-        )
-        result["reasons"].append(
-            f"lock profile '{stored}' does not match active '{active}'"
-        )
-        return result
-
-    last = last_terminal_mutation(lock)
-    if last is None:
-        ready_pr = lock.get("ready_pr_number")
-        ready_head = normalize_head_sha(lock.get("ready_expected_head_sha"))
-        if (
-            target_pr_number is not None
-            and ready_pr == target_pr_number
-            and ready_head
-            and target_head
-            and heads_equal(ready_head, target_head)
-            and lock.get("final_review_decision_ready")
-        ):
-            result["classification"] = CLASS_IN_PROGRESS_SAME_HEAD
-            result["mark_final_allowed"] = True  # idempotent re-mark
-            result["next_action"] = (
-                "gitea_submit_pr_review with final_review_decision_ready=true "
-                "for the ready PR/head"
-            )
-            result["reasons"].append(
-                "final decision already marked ready for this PR/head (idempotent)"
-            )
-            return result
-        result["classification"] = CLASS_READY_FOR_TARGET
-        result["next_action"] = "gitea_mark_final_review_decision then submit"
-        result["reasons"].append("no terminal live mutations; mark_final allowed")
-        return result
-
-    last_pr = last.get("pr_number")
-    last_action = last.get("action")
-    locked_head = mutation_head_sha(last, lock)
-    result["last_terminal_pr"] = last_pr
-    result["last_terminal_action"] = last_action
-    result["locked_head_sha"] = locked_head
-    result["evidence"] = {
-        "last_review_id": last.get("review_id"),
-        "live_mutations_count": len(lock.get("live_mutations") or []),
-    }
-
-    if correction_applies(
-        lock, pr_number=target_pr_number, expected_head_sha=target_head
-    ):
-        result["classification"] = CLASS_CORRECTION_ACTIVE
-        result["mark_final_allowed"] = True
-        result["next_action"] = (
-            "gitea_mark_final_review_decision for the correction-scoped PR/head, "
-            "then submit once"
-        )
-        result["reasons"].append(
-            f"scoped correction active for PR #{lock.get('correction_pr_number')}"
-        )
-        return result
-
-    # Live state of last terminal PR when provided.
-    live = None
-    if pr_lookup_error:
-        result["classification"] = CLASS_AMBIGUOUS
-        result["mark_final_allowed"] = False
-        result["next_action"] = (
-            "retry diagnosis after live PR state is available; "
-            "fail closed under ambiguous evidence"
-        )
-        result["reasons"].append(f"live PR lookup failed: {pr_lookup_error}")
-        return result
-    if pr_live is not None:
-        live = classify_pr_live_state(pr_live)
-        result["evidence"]["last_terminal_pr_state"] = live.get("pr_state")
-        result["evidence"]["last_terminal_pr_merged"] = live.get("pr_merged")
-        if live.get("pr_merged_or_closed"):
-            result["classification"] = CLASS_MOOT_MERGED_CLOSED
-            result["cleanup_allowed"] = True
-            result["mark_final_allowed"] = target_pr_number is not None and (
-                int(last_pr) != int(target_pr_number)
-                if last_pr is not None and target_pr_number is not None
-                else True
-            )
-            result["next_action"] = (
-                "gitea_cleanup_stale_review_decision_lock(apply=true, "
-                f"expected_terminal_pr={last_pr}) then mark_final on the target PR"
-            )
-            result["reasons"].append(
-                f"terminal on PR #{last_pr} is moot (merged/closed); cleanup allowed"
-            )
-            return result
-
-    if target_pr_number is None:
-        result["classification"] = CLASS_AMBIGUOUS
-        result["mark_final_allowed"] = False
-        result["next_action"] = "re-run diagnosis with target_pr_number"
-        result["reasons"].append("target_pr_number required for open-PR classification")
-        return result
-
-    if last_pr is not None and int(last_pr) != int(target_pr_number):
-        # Cross-PR isolation: foreign terminal is history, not a block.
-        result["classification"] = CLASS_FOREIGN_PR_TERMINAL
-        result["mark_final_allowed"] = True
-        result["correction_eligible"] = False  # must not use correction to "unlock"
-        result["next_action"] = (
-            f"gitea_mark_final_review_decision(pr_number={target_pr_number}, ...) "
-            f"— foreign terminal on PR #{last_pr} does not block (#693); "
-            "do not call gitea_authorize_review_correction for cross-PR unlock"
-        )
-        result["reasons"].append(
-            f"last terminal is {last_action} on foreign open/closed PR #{last_pr}; "
-            f"target PR #{target_pr_number} is isolated (#693)"
-        )
-        return result
-
-    # Same PR as target.
-    if (
-        locked_head
-        and target_head
-        and not heads_equal(locked_head, target_head)
-    ):
-        result["classification"] = CLASS_STALE_SUPERSEDED_HEAD
-        result["mark_final_allowed"] = True
-        result["next_action"] = (
-            f"gitea_mark_final_review_decision with expected_head_sha="
-            f"{target_head} (#620 same-PR new head)"
-        )
-        result["reasons"].append(
-            f"terminal {last_action} on head {locked_head[:12]}…; target head "
-            f"{target_head[:12]}… — fresh formal review allowed without cleanup"
-        )
-        return result
-
-    # Same PR + same head (or missing head comparison) — active terminal.
-    result["classification"] = CLASS_TERMINAL_ACTIVE_SAME_HEAD
-    result["mark_final_allowed"] = False
-    result["correction_eligible"] = True
-    result["next_action"] = (
-        "if the prior verdict was mistaken: gitea_authorize_review_correction "
-        f"with prior_review_id={last.get('review_id')}, "
-        f"prior_review_state={last_action}, target_pr_number={target_pr_number}, "
-        "operator_authorized=true, then re-mark once; "
-        "if the prior verdict is correct: stop and hand off (do not duplicate)"
-    )
-    result["reasons"].append(
-        f"terminal {last_action} already recorded for PR #{target_pr_number} "
-        f"at this head; same-head duplicate blocked (#332/#620)"
-    )
-    return result
-
-
-def build_precise_mark_final_failure(
-    classification: dict[str, Any],
-) -> dict[str, Any]:
-    """One precise recovery instruction + durable issue handoff payload (#693 AC4/8)."""
-    cls = classification.get("classification")
-    next_action = classification.get("next_action") or (
-        "stop and create a durable Gitea issue with lock evidence"
-    )
-    reasons = list(classification.get("reasons") or [])
-    reasons.append(f"exact_next_action: {next_action}")
-    handoff = {
-        "required": cls
-        in (
-            CLASS_AMBIGUOUS,
-            CLASS_SESSION_OR_PROFILE_MISMATCH,
-            CLASS_TERMINAL_ACTIVE_SAME_HEAD,
-        )
-        and not classification.get("mark_final_allowed"),
-        "title_hint": (
-            "Review-decision-lock recovery failed during formal review"
-        ),
-        "classification": cls,
-        "exact_next_action": next_action,
-        "owner_profile_identity": classification.get("owner_profile_identity"),
-        "last_terminal_pr": classification.get("last_terminal_pr"),
-        "last_terminal_action": classification.get("last_terminal_action"),
-        "locked_head_sha": classification.get("locked_head_sha"),
-        "target_pr_number": classification.get("target_pr_number"),
-        "target_head_sha": classification.get("target_head_sha"),
-        "evidence": classification.get("evidence") or {},
-        "instruction": (
-            "If recovery cannot complete with the exact_next_action above, "
-            "create or update a durable Gitea issue with this payload and stop; "
-            "do not delete session-state files; do not misuse correction as unlock."
-        ),
-    }
-    return {
-        "reasons": reasons,
-        "classification": cls,
-        "exact_next_action": next_action,
-        "durable_issue_handoff": handoff,
-    }
-
-
-def build_correction_audit_record(
-    *,
-    prior_review_id: int | None,
-    prior_review_state: str | None,
-    target_pr_number: int | None,
-    target_head_sha: str | None,
-    reason: str | None,
-    actor_username: str | None,
-    profile_name: str | None,
-    authorized: bool,
-) -> dict[str, Any]:
-    """Structured durable audit for review-correction authorization (#693)."""
-    return {
-        "event": "review_correction_authorization",
-        "issue_ref": "#693",
-        "authorized": bool(authorized),
-        "timestamp": datetime.now(timezone.utc).isoformat(),
-        "actor_username": actor_username,
-        "profile_name": profile_name,
-        "prior_review_id": prior_review_id,
-        "prior_review_state": prior_review_state,
-        "target_pr_number": target_pr_number,
-        "target_head_sha": normalize_head_sha(target_head_sha),
-        "reason": reason,
-        "scope": "same_pr_head_only",
-    }
-
-
-def format_correction_audit_comment(audit: dict[str, Any]) -> str:
-    """Markdown body for a thread-visible correction authorization audit."""
-    status = "AUTHORIZED" if audit.get("authorized") else "DENIED"
-    lines = [
-        "## Review correction authorization audit (#693)",
-        "",
-        f"Status: **{status}**",
-        "",
-        f"- actor: `{audit.get('actor_username')}`",
-        f"- profile: `{audit.get('profile_name')}`",
-        f"- timestamp: `{audit.get('timestamp')}`",
-        f"- prior_review_id: `{audit.get('prior_review_id')}`",
-        f"- prior_review_state: `{audit.get('prior_review_state')}`",
-        f"- target_pr: `#{audit.get('target_pr_number')}`",
-        f"- target_head_sha: `{audit.get('target_head_sha')}`",
-        f"- reason: {audit.get('reason')}",
-        f"- scope: `{audit.get('scope')}` (cannot unlock a different PR)",
-        "",
-        "This is **not** a generic decision-lock unlock. Cross-PR recovery "
-        "uses isolation (#693) or moot cleanup (#594), never correction.",
-    ]
-    return "\n".join(lines)
-
-
-def assess_open_pr_decision_lock_recovery(
-    lock: dict | None,
-    *,
-    target_pr_number: int,
-    target_head_sha: str | None,
-    last_terminal_pr_live: dict | None = None,
-    pr_lookup_error: str | None = None,
-    active_profile_identity: str | None = None,
-    session_blockers: list[str] | None = None,
-    controller_recovery_authorized: bool = False,
-) -> dict[str, Any]:
-    """Assess guarded recovery for decision locks affecting an open target PR (#693).
-
-    Recovery here means *workflow recovery routing*, not necessarily lock wipe.
-    Foreign-PR terminals are recoverable by isolation (mark_final allowed).
-    Moot terminals use #594 cleanup. Same-head active terminals refuse wipe.
-    """
-    classification = classify_review_decision_lock(
-        lock,
-        target_pr_number=target_pr_number,
-        target_head_sha=target_head_sha,
-        pr_live=last_terminal_pr_live,
-        pr_lookup_error=pr_lookup_error,
-        active_profile_identity=active_profile_identity,
-        session_blockers=session_blockers,
-    )
-    cls = classification["classification"]
-    recovery_allowed = False
-    recovery_mode = None
-    if cls == CLASS_FOREIGN_PR_TERMINAL:
-        recovery_allowed = True
-        recovery_mode = "cross_pr_isolation"
-    elif cls == CLASS_STALE_SUPERSEDED_HEAD:
-        recovery_allowed = True
-        recovery_mode = "same_pr_new_head"
-    elif cls == CLASS_MOOT_MERGED_CLOSED:
-        recovery_allowed = True
-        recovery_mode = "moot_cleanup"
-    elif cls == CLASS_READY_FOR_TARGET:
-        recovery_allowed = True
-        recovery_mode = "none_required"
-    elif cls == CLASS_CORRECTION_ACTIVE:
-        recovery_allowed = True
-        recovery_mode = "scoped_correction"
-    elif cls == CLASS_TERMINAL_ACTIVE_SAME_HEAD:
-        recovery_allowed = False
-        recovery_mode = "correction_only_if_mistake"
-    else:
-        recovery_allowed = False
-        recovery_mode = "fail_closed"
-
-    if recovery_mode == "moot_cleanup" and not controller_recovery_authorized:
-        # Cleanup still needs apply + capability; assess reports path.
-        pass
-
-    return {
-        **classification,
-        "recovery_allowed": recovery_allowed,
-        "recovery_mode": recovery_mode,
-        "controller_recovery_authorized": bool(controller_recovery_authorized),
-        "manual_file_delete_forbidden": True,
-        "correction_as_generic_unlock_forbidden": True,
-    }
-
-
 # ---------------------------------------------------------------------------
 # #709 cross-profile cleanup, overwrite protection, recovery provenance
 # ---------------------------------------------------------------------------

task_capability_map.py

@@ -127,23 +127,6 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.review",
         "role": "reviewer",
     },
-    # #693: read-only classification of durable decision locks (incl. open PRs).
-    "diagnose_review_decision_lock": {
-        "permission": "gitea.read",
-        "role": "reviewer",
-    },
-    "gitea_diagnose_review_decision_lock": {
-        "permission": "gitea.read",
-        "role": "reviewer",
-    },
-    "authorize_review_correction": {
-        "permission": "gitea.pr.review",
-        "role": "reviewer",
-    },
-    "gitea_authorize_review_correction": {
-        "permission": "gitea.pr.review",
-        "role": "reviewer",
-    },
     # #709: truthful absence-of-proof recovery (server-side auth + record + consume).
     # Dedicated mutation capability — gitea.read is insufficient (review 434 F1).
     "issue_irrecoverable_provenance_authorization": {
@@ -347,6 +330,32 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
     },
 }
 
+# #723 AC1/AC5: tasks where permission alone is NOT enough — the profile's
+# role kind must also match. Shared by ``gitea_resolve_task_capability`` and
+# the runtime-context capability report so the two can never disagree about
+# which tasks are role-exclusive (incident #722: runtime context said
+# review_pr was allowed while the resolver fail-closed the same session).
+ROLE_EXCLUSIVE_TASKS: frozenset[str] = frozenset({
+    "review_pr",
+    "approve_pr",
+    "request_changes_pr",
+    "blind_pr_queue_review",
+    "pr_queue_cleanup",
+    "pr-queue-cleanup",
+    "merge_pr",
+    "create_branch",
+    "push_branch",
+    "create_pr",
+    "commit_files",
+    "gitea_commit_files",
+    "address_pr_change_requests",
+    "delete_branch",
+    "cleanup_merged_pr_branch",
+    "reconciliation_cleanup",
+    "work_issue",
+    "work-issue",
+})
+
 # Issue-mutating MCP tools and their resolver task keys.
 ISSUE_MUTATION_TOOL_TASKS: dict[str, str] = {
     "gitea_create_issue": "create_issue",

tests/test_head_scoped_review_decision_lock.py

@@ -24,10 +24,6 @@ HEAD_C = "c" * 40
 
 
 def _lock(mutations=None, correction=False, ready_pr=None, ready_head=None, ready_action=None):
-    mutations = list(mutations or [])
-    corr_pr = None
-    if correction and mutations:
-        corr_pr = mutations[-1].get("pr_number")
     return {
         "task": "review_pr",
         "remote": "prgs",
@@ -44,11 +40,9 @@ def _lock(mutations=None, correction=False, ready_pr=None, ready_head=None, read
         "ready_remote": "prgs" if ready_pr else None,
         "ready_org": "Scaled-Tech-Consulting" if ready_pr else None,
         "ready_repo": "Gitea-Tools" if ready_pr else None,
-        "live_mutations": mutations,
+        "live_mutations": list(mutations or []),
         "correction_authorized": correction,
-        "correction_reason": "test" if correction else None,
-        "correction_pr_number": corr_pr,
-        "correction_head_sha": None,
+        "correction_reason": None,
     }
 
 
@@ -180,13 +174,12 @@ class TestHardStopHeadScope(unittest.TestCase):
         self.assertTrue(reasons)
         self.assertIn("#332", reasons[0])
 
-    def test_rc_head_a_allows_other_pr_via_cross_pr_isolation(self):
-        """#693: foreign-PR terminal must not hard-stop mark_ready on another PR."""
+    def test_rc_head_a_blocks_other_pr(self):
         _seed([RC_619_HEAD_A], ready_pr=619, ready_head=HEAD_A)
         reasons = mcp_server.terminal_review_hard_stop_reasons(
             700, "mark_ready", expected_head_sha=HEAD_B
         )
-        self.assertEqual(reasons, [])
+        self.assertTrue(reasons)
 
     def test_legacy_619_ledger_allows_new_head(self):
         """PR #619-style durable lock without mutation head_sha."""

tests/test_issue_693_review_decision_lock_recovery.py

@@ -1,427 +0,0 @@
-"""Review-decision-lock recovery / cross-PR isolation (#693).
-
-Reproduces the PR #688 → PR #692 formal-review sequence:
-
-  * durable lock holds REQUEST_CHANGES on open PR #688 @ head A (review_id 425)
-  * reviewer leases PR #692 @ head B (6d86db…)
-  * mark_final for #692 must succeed without correction unlock
-  * cleanup of open #688 terminal remains forbidden (#594)
-  * authorize_review_correction for #688 cannot unlock #692
-  * eventual #692 APPROVE is unique and head-bound (review_id 426)
-  * mark_final is idempotent for same PR/action/head
-  * diagnosis returns one exact next_action + durable handoff payload
-"""
-
-from __future__ import annotations
-
-import os
-import unittest
-from unittest.mock import patch
-
-import mcp_server
-import review_workflow_load
-import stale_review_decision_lock as srdl
-
-# PR #688 / #692 incident fixtures (sanitized reconstruction from issue #693)
-HEAD_688 = "c7a444eb4b41cf916fdbd20a4999ffd78af496d0"
-HEAD_692 = "6d86db793bbdfaed16bd54d93171f1dd66f234ca"
-PR_A = 688
-PR_B = 692
-REVIEW_ID_A = 425
-REVIEW_ID_B = 426
-
-RC_688 = {
-    "pr_number": PR_A,
-    "action": "request_changes",
-    "review_id": REVIEW_ID_A,
-    "review_state": "request_changes",
-    "head_sha": HEAD_688,
-}
-APPROVE_692 = {
-    "pr_number": PR_B,
-    "action": "approve",
-    "review_id": REVIEW_ID_B,
-    "review_state": "approve",
-    "head_sha": HEAD_692,
-}
-
-
-def _lock(mutations=None, **kwargs):
-    from datetime import datetime, timezone
-
-    now = datetime.now(timezone.utc).isoformat()
-    base = {
-        "task": "review_pr",
-        "remote": "prgs",
-        "org": "Scaled-Tech-Consulting",
-        "repo": "Gitea-Tools",
-        "session_pid": os.getpid(),
-        "session_profile": "prgs-reviewer",
-        "session_profile_lock": "prgs-reviewer",
-        "profile_identity": "prgs-reviewer",
-        "final_review_decision_ready": False,
-        "ready_pr_number": None,
-        "ready_action": None,
-        "ready_expected_head_sha": None,
-        "ready_remote": None,
-        "ready_org": None,
-        "ready_repo": None,
-        "live_mutations": list(mutations or []),
-        "correction_authorized": False,
-        "correction_reason": None,
-        "correction_pr_number": None,
-        "correction_head_sha": None,
-        "updated_at": now,
-        "recorded_at": now,
-        "writer_pid": os.getpid(),
-    }
-    base.update(kwargs)
-    # Ensure TTL fields stay fresh unless the caller is testing expiry.
-    if "recorded_at" not in kwargs:
-        base["recorded_at"] = now
-    if "updated_at" not in kwargs:
-        base["updated_at"] = now
-    return base
-
-
-REVIEWER_ENV = {
-    "GITEA_PROFILE_NAME": "prgs-reviewer",
-    "GITEA_ALLOWED_OPERATIONS": (
-        "gitea.read,gitea.pr.review,gitea.pr.approve,"
-        "gitea.pr.request_changes,gitea.pr.comment"
-    ),
-    "GITEA_SESSION_PROFILE_LOCK": "prgs-reviewer",
-}
-
-REVIEWER_PROFILE = {
-    "profile_name": "prgs-reviewer",
-    "allowed_operations": [
-        "gitea.read",
-        "gitea.pr.review",
-        "gitea.pr.approve",
-        "gitea.pr.request_changes",
-        "gitea.pr.comment",
-    ],
-    "forbidden_operations": ["gitea.pr.merge"],
-}
-
-
-def _seed(mutations=None, **kwargs):
-    review_workflow_load.record_review_workflow_load(mcp_server.PROJECT_ROOT)
-    mcp_server._save_review_decision_lock(_lock(mutations, **kwargs))
-    mcp_server.gitea_load_review_workflow()
-
-
-def _no_lease():
-    return {"block": False, "reasons": [], "mutation_allowed": True}
-
-
-def _open_pr(number, head):
-    return {
-        "number": number,
-        "state": "open",
-        "merged": False,
-        "merged_at": None,
-        "head": {"sha": head},
-    }
-
-
-class TestCrossPrIsolationPure(unittest.TestCase):
-    def test_foreign_terminal_does_not_block_mark_boundary(self):
-        lock = _lock([RC_688])
-        self.assertFalse(
-            srdl.prior_live_mutations_block_boundary(
-                lock, pr_number=PR_B, expected_head_sha=HEAD_692
-            )
-        )
-        self.assertTrue(
-            srdl.prior_live_mutations_block_boundary(
-                lock, pr_number=PR_A, expected_head_sha=HEAD_688
-            )
-        )
-
-    def test_terminal_boundary_allows_fresh_decision_on_other_pr(self):
-        lock = _lock([RC_688])
-        self.assertTrue(
-            srdl.terminal_boundary_allows_fresh_decision(
-                lock,
-                pr_number=PR_B,
-                expected_head_sha=HEAD_692,
-                operation="mark_ready",
-            )
-        )
-        self.assertFalse(
-            srdl.terminal_boundary_allows_fresh_decision(
-                lock,
-                pr_number=PR_A,
-                expected_head_sha=HEAD_688,
-                operation="mark_ready",
-            )
-        )
-
-    def test_unscoped_correction_does_not_apply(self):
-        lock = _lock([RC_688], correction_authorized=True, correction_reason="x")
-        # Missing correction_pr_number → fail closed (#693)
-        self.assertFalse(
-            srdl.correction_applies(lock, pr_number=PR_A, expected_head_sha=HEAD_688)
-        )
-
-    def test_scoped_correction_only_for_named_pr(self):
-        lock = _lock(
-            [RC_688],
-            correction_authorized=True,
-            correction_reason="mistake",
-            correction_pr_number=PR_A,
-            correction_head_sha=HEAD_688,
-        )
-        self.assertTrue(
-            srdl.correction_applies(lock, pr_number=PR_A, expected_head_sha=HEAD_688)
-        )
-        self.assertFalse(
-            srdl.correction_applies(lock, pr_number=PR_B, expected_head_sha=HEAD_692)
-        )
-
-
-class TestClassification(unittest.TestCase):
-    def test_foreign_pr_terminal_classification(self):
-        lock = _lock([RC_688])
-        c = srdl.classify_review_decision_lock(
-            lock,
-            target_pr_number=PR_B,
-            target_head_sha=HEAD_692,
-            pr_live=_open_pr(PR_A, HEAD_688),
-            active_profile_identity="prgs-reviewer",
-        )
-        self.assertEqual(c["classification"], srdl.CLASS_FOREIGN_PR_TERMINAL)
-        self.assertTrue(c["mark_final_allowed"])
-        self.assertFalse(c["correction_eligible"])
-        self.assertIn("do not call gitea_authorize_review_correction", c["next_action"])
-
-    def test_same_head_terminal_classification(self):
-        lock = _lock([RC_688])
-        c = srdl.classify_review_decision_lock(
-            lock,
-            target_pr_number=PR_A,
-            target_head_sha=HEAD_688,
-            pr_live=_open_pr(PR_A, HEAD_688),
-        )
-        self.assertEqual(c["classification"], srdl.CLASS_TERMINAL_ACTIVE_SAME_HEAD)
-        self.assertFalse(c["mark_final_allowed"])
-        self.assertTrue(c["correction_eligible"])
-
-    def test_precise_failure_includes_durable_handoff(self):
-        lock = _lock([RC_688])
-        c = srdl.classify_review_decision_lock(
-            lock, target_pr_number=PR_A, target_head_sha=HEAD_688
-        )
-        fail = srdl.build_precise_mark_final_failure(c)
-        self.assertIn("exact_next_action", fail)
-        self.assertIn("durable_issue_handoff", fail)
-        self.assertTrue(fail["durable_issue_handoff"]["required"])
-
-
-class TestPr692Sequence(unittest.TestCase):
-    def setUp(self):
-        self._env = patch.dict(os.environ, REVIEWER_ENV, clear=False)
-        self._env.start()
-        self._prof = patch.object(
-            mcp_server, "get_profile", return_value=REVIEWER_PROFILE
-        )
-        self._prof.start()
-
-    def tearDown(self):
-        self._prof.stop()
-        self._env.stop()
-        mcp_server._save_review_decision_lock(None)
-        review_workflow_load.clear_review_workflow_load()
-
-    def test_mark_final_692_succeeds_with_open_688_terminal(self):
-        _seed([RC_688], writer_pid=25883, session_pid=60615)
-        with patch("mcp_server._list_pr_lease_comments", return_value=[]), patch(
-            "mcp_server._pr_work_lease_reviewer_block", return_value=_no_lease()
-        ), patch.object(
-            mcp_server,
-            "gitea_check_pr_eligibility",
-            return_value={"head_sha": HEAD_692, "eligible": True},
-        ):
-            result = mcp_server.gitea_mark_final_review_decision(
-                pr_number=PR_B,
-                action="approve",
-                expected_head_sha=HEAD_692,
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-            )
-        self.assertTrue(result["marked_ready"], result.get("reasons"))
-        lock = mcp_server._load_review_decision_lock()
-        self.assertEqual(lock["ready_pr_number"], PR_B)
-        self.assertEqual(
-            srdl.normalize_head_sha(lock["ready_expected_head_sha"]), HEAD_692
-        )
-        # Foreign terminal history preserved (non-destructive isolation).
-        self.assertEqual(lock["live_mutations"][0]["pr_number"], PR_A)
-
-    def test_mark_final_idempotent_same_binding(self):
-        _seed(
-            [RC_688],
-            final_review_decision_ready=True,
-            ready_pr_number=PR_B,
-            ready_action="approve",
-            ready_expected_head_sha=HEAD_692,
-            ready_remote="prgs",
-            ready_org="Scaled-Tech-Consulting",
-            ready_repo="Gitea-Tools",
-        )
-        with patch("mcp_server._list_pr_lease_comments", return_value=[]), patch(
-            "mcp_server._pr_work_lease_reviewer_block", return_value=_no_lease()
-        ), patch.object(
-            mcp_server,
-            "gitea_check_pr_eligibility",
-            return_value={"head_sha": HEAD_692, "eligible": True},
-        ):
-            result = mcp_server.gitea_mark_final_review_decision(
-                pr_number=PR_B,
-                action="approve",
-                expected_head_sha=HEAD_692,
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-            )
-        self.assertTrue(result["marked_ready"])
-        self.assertTrue(result.get("idempotent"))
-
-    def test_cleanup_still_forbidden_while_688_open(self):
-        _seed([RC_688])
-        assessment = srdl.assess_stale_review_decision_lock(
-            mcp_server._load_review_decision_lock(),
-            pr_live=_open_pr(PR_A, HEAD_688),
-            active_profile_identity="prgs-reviewer",
-        )
-        self.assertFalse(assessment["cleanup_allowed"])
-        self.assertFalse(assessment["is_moot"])
-
-    def test_correction_cannot_unlock_different_pr(self):
-        _seed([RC_688])
-        r = mcp_server.gitea_authorize_review_correction(
-            prior_review_id=REVIEW_ID_A,
-            prior_review_state="request_changes",
-            reason="try unlock 692",
-            operator_authorized=True,
-            target_pr_number=PR_B,
-            remote="prgs",
-            org="Scaled-Tech-Consulting",
-            repo="Gitea-Tools",
-            post_audit_comment=False,
-        )
-        self.assertFalse(r["authorized"])
-        self.assertTrue(any("different PR" in x for x in r["reasons"]))
-
-    def test_scoped_correction_for_same_pr_posts_audit(self):
-        _seed([RC_688])
-        with patch(
-            "mcp_server._authenticated_username", return_value="sysadmin"
-        ), patch(
-            "mcp_server.get_auth_header", return_value="Basic dGVzdDp0ZXN0"
-        ), patch(
-            "mcp_server._auth", return_value="Basic dGVzdDp0ZXN0"
-        ), patch("mcp_server.api_request", return_value={"id": 99901}):
-            r = mcp_server.gitea_authorize_review_correction(
-                prior_review_id=REVIEW_ID_A,
-                prior_review_state="request_changes",
-                reason="mistaken RC wording",
-                operator_authorized=True,
-                target_pr_number=PR_A,
-                expected_head_sha=HEAD_688,
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-                post_audit_comment=True,
-            )
-        self.assertTrue(r["authorized"], r.get("reasons"))
-        self.assertEqual(r.get("correction_pr_number"), PR_A)
-        self.assertEqual(
-            r.get("audit_comment_id"),
-            99901,
-            r.get("audit_comment_skipped") or r.get("audit_comment_error") or r,
-        )
-
-    def test_diagnose_foreign_terminal_next_action(self):
-        _seed([RC_688])
-        with patch(
-            "mcp_server._authenticated_username", return_value="sysadmin"
-        ), patch(
-            "mcp_server.get_auth_header", return_value="Basic dGVzdDp0ZXN0"
-        ), patch(
-            "mcp_server._auth", return_value="Basic dGVzdDp0ZXN0"
-        ), patch("mcp_server.api_request", return_value=_open_pr(PR_A, HEAD_688)):
-            d = mcp_server.gitea_diagnose_review_decision_lock(
-                target_pr_number=PR_B,
-                expected_head_sha=HEAD_692,
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-            )
-        self.assertTrue(d["success"], d.get("reasons"))
-        self.assertEqual(d["classification"], srdl.CLASS_FOREIGN_PR_TERMINAL)
-        self.assertTrue(d["mark_final_allowed"])
-        self.assertIn("mark_final", d["exact_next_action"])
-        self.assertTrue(d["correction_as_generic_unlock_forbidden"])
-
-    def test_approval_ledger_unique_and_bound_after_sequence(self):
-        """After mark_final + record mutation, ledger binds unique approve to 692 head."""
-        _seed([RC_688])
-        with patch("mcp_server._list_pr_lease_comments", return_value=[]), patch(
-            "mcp_server._pr_work_lease_reviewer_block", return_value=_no_lease()
-        ), patch.object(
-            mcp_server,
-            "gitea_check_pr_eligibility",
-            return_value={"head_sha": HEAD_692, "eligible": True},
-        ):
-            marked = mcp_server.gitea_mark_final_review_decision(
-                pr_number=PR_B,
-                action="approve",
-                expected_head_sha=HEAD_692,
-                remote="prgs",
-                org="Scaled-Tech-Consulting",
-                repo="Gitea-Tools",
-            )
-        self.assertTrue(marked["marked_ready"])
-        mcp_server.record_live_review_mutation(PR_B, "approve", REVIEW_ID_B)
-        lock = mcp_server._load_review_decision_lock()
-        terminals = [
-            m
-            for m in lock["live_mutations"]
-            if m.get("action") in srdl.TERMINAL_REVIEW_ACTIONS
-            and m.get("pr_number") == PR_B
-        ]
-        self.assertEqual(len(terminals), 1)
-        self.assertEqual(terminals[0]["review_id"], REVIEW_ID_B)
-        self.assertEqual(
-            srdl.normalize_head_sha(terminals[0].get("head_sha")), HEAD_692
-        )
-        # Same-head duplicate still blocked.
-        self.assertTrue(
-            srdl.prior_live_mutations_block_boundary(
-                lock, pr_number=PR_B, expected_head_sha=HEAD_692
-            )
-        )
-
-
-class TestSessionRestartWriterPid(unittest.TestCase):
-    def tearDown(self):
-        mcp_server._save_review_decision_lock(None)
-        review_workflow_load.clear_review_workflow_load()
-
-    def test_writer_pid_change_does_not_inherit_foreign_block(self):
-        # session_pid 60615 origin, writer later 25883 — still foreign isolation.
-        _seed([RC_688], session_pid=60615, writer_pid=25883)
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(
-                PR_B, "mark_ready", expected_head_sha=HEAD_692
-            ),
-            [],
-        )
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_issue_723_role_stamp_and_submission.py

@@ -0,0 +1,337 @@
+"""#723 AC3/AC4/AC5: denied resolves must not poison the session role stamp,
+review-submission workspace failures must fail closed with structured
+reasons, and runtime-context capabilities must apply the resolver's
+role-exclusive filter.
+
+Reproduces the PR #721 sequence: a reviewer session resolved a task whose
+capability-map role had drifted to ``merger``; the denied resolve stamped
+``_preflight_resolved_role = "merger"`` anyway, ``mark_final`` succeeded, and
+``gitea_submit_pr_review`` raised RuntimeError out of the tool as a generic
+``internal_error``.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+ROOT = str(Path(__file__).resolve().parent.parent)
+if ROOT not in sys.path:
+    sys.path.insert(0, ROOT)
+
+import gitea_mcp_server as mcp_server
+import task_capability_map
+
+
+REVIEWER_PROFILE = {
+    "profile_name": "prgs-reviewer",
+    "role": "reviewer",
+    "allowed_operations": [
+        "gitea.read",
+        "gitea.pr.review",
+        "gitea.pr.approve",
+        "gitea.pr.request_changes",
+        "gitea.pr.comment",
+        "gitea.issue.comment",
+    ],
+    "forbidden_operations": [
+        "gitea.branch.create",
+        "gitea.branch.push",
+        "gitea.repo.commit",
+        "gitea.pr.create",
+        "gitea.pr.merge",
+    ],
+}
+
+CONFIG = {
+    "profiles": {
+        "prgs-reviewer": {
+            "role": "reviewer",
+            "allowed_operations": REVIEWER_PROFILE["allowed_operations"],
+            "forbidden_operations": REVIEWER_PROFILE["forbidden_operations"],
+        },
+        "prgs-merger": {
+            "role": "merger",
+            "allowed_operations": [
+                "gitea.read",
+                "gitea.pr.merge",
+                "gitea.pr.comment",
+                "gitea.issue.comment",
+            ],
+            "forbidden_operations": [
+                "gitea.pr.approve",
+                "gitea.pr.review",
+                "gitea.pr.request_changes",
+            ],
+        },
+    }
+}
+
+
+def _reset_preflight():
+    mcp_server._clear_preflight_capability_state()
+    mcp_server._preflight_whoami_called = False
+    mcp_server._preflight_whoami_violation = False
+
+
+class _ResolveHarness(unittest.TestCase):
+    """Shared patched-resolver harness."""
+
+    def setUp(self):
+        _reset_preflight()
+
+    def tearDown(self):
+        _reset_preflight()
+
+    def _resolve(self, task, profile=REVIEWER_PROFILE, required_role=None):
+        """Run gitea_resolve_task_capability with a fixed profile/config."""
+        patches = [
+            patch.object(mcp_server, "get_profile", return_value=profile),
+            patch.object(
+                mcp_server.gitea_config, "load_config", return_value=CONFIG
+            ),
+            patch.object(
+                mcp_server, "_authenticated_username", return_value="tester"
+            ),
+            patch.object(
+                mcp_server, "_ensure_matching_profile", return_value=None
+            ),
+            patch.object(
+                mcp_server, "init_review_decision_lock", return_value=None
+            ),
+        ]
+        if required_role is not None:
+            patches.append(
+                patch.object(
+                    mcp_server.task_capability_map,
+                    "required_role",
+                    side_effect=lambda t: (
+                        required_role
+                        if t == task
+                        else task_capability_map.TASK_CAPABILITY_MAP[t]["role"]
+                    ),
+                )
+            )
+        for p in patches:
+            p.__enter__()
+        try:
+            return mcp_server.gitea_resolve_task_capability(
+                task=task, remote="prgs"
+            )
+        finally:
+            for p in reversed(patches):
+                p.__exit__(None, None, None)
+
+
+class TestAC3DeniedResolveDoesNotStampRole(_ResolveHarness):
+    def test_allowed_resolve_stamps_role(self):
+        result = self._resolve("review_pr")
+        self.assertTrue(result["allowed_in_current_session"], result)
+        self.assertEqual(mcp_server._preflight_resolved_role, "reviewer")
+        self.assertEqual(mcp_server._preflight_resolved_task, "review_pr")
+
+    def test_denied_resolve_does_not_stamp_required_role(self):
+        """The PR #721 poison: review_pr requiring merger under a reviewer."""
+        result = self._resolve("review_pr", required_role="merger")
+        self.assertFalse(result["allowed_in_current_session"], result)
+        self.assertIsNone(
+            mcp_server._preflight_resolved_role,
+            "denied resolve must not stamp the required role (#723 AC3)",
+        )
+        self.assertIsNone(mcp_server._preflight_resolved_task)
+
+    def test_denied_resolve_clears_prior_stale_stamp(self):
+        allowed = self._resolve("review_pr")
+        self.assertTrue(allowed["allowed_in_current_session"])
+        self.assertEqual(mcp_server._preflight_resolved_role, "reviewer")
+
+        denied = self._resolve("merge_pr")  # reviewer profile cannot merge
+        self.assertFalse(denied["allowed_in_current_session"], denied)
+        self.assertIsNone(
+            mcp_server._preflight_resolved_role,
+            "a denied resolve must clear the previous stamp, not keep it",
+        )
+
+    def test_denied_resolve_keeps_effective_role_on_actual_profile(self):
+        with patch.object(
+            mcp_server, "get_profile", return_value=REVIEWER_PROFILE
+        ):
+            self._resolve("review_pr", required_role="merger")
+            self.assertEqual(
+                mcp_server._effective_workspace_role(), "reviewer"
+            )
+
+
+class TestAC4SubmissionFailsClosedStructured(unittest.TestCase):
+    def setUp(self):
+        _reset_preflight()
+
+    def tearDown(self):
+        _reset_preflight()
+
+    def test_workspace_binding_failure_returns_reasons_not_raise(self):
+        boom = RuntimeError(
+            "namespace workspace binding blocked: role 'merger' cannot "
+            "mutate from reviewer session workspace"
+        )
+        with patch.object(
+            mcp_server,
+            "_verify_role_mutation_workspace",
+            side_effect=boom,
+        ), patch.object(
+            mcp_server, "get_profile", return_value=REVIEWER_PROFILE
+        ):
+            result = mcp_server._evaluate_pr_review_submission(
+                pr_number=721,
+                action="approve",
+                expected_head_sha="80f59b334e6671b08006725292c08a8e8b6c823f",
+                remote="prgs",
+                live=True,
+                final_review_decision_ready=True,
+            )
+        self.assertFalse(result["performed"])
+        self.assertEqual(result["blocker_kind"], "workspace_role_binding")
+        self.assertTrue(
+            any("workspace/role binding failed" in r for r in result["reasons"]),
+            result["reasons"],
+        )
+        self.assertTrue(
+            any("cannot mutate from reviewer session" in r for r in result["reasons"]),
+            "the underlying binding error text must be preserved",
+        )
+
+    def test_stale_runtime_failure_also_structured(self):
+        boom = RuntimeError(
+            "stale-runtime: The active Gitea MCP server process is stale"
+        )
+        with patch.object(
+            mcp_server,
+            "_verify_role_mutation_workspace",
+            side_effect=boom,
+        ), patch.object(
+            mcp_server, "get_profile", return_value=REVIEWER_PROFILE
+        ):
+            result = mcp_server._evaluate_pr_review_submission(
+                pr_number=721,
+                action="approve",
+                remote="prgs",
+                live=True,
+            )
+        self.assertFalse(result["performed"])
+        self.assertEqual(result["blocker_kind"], "workspace_role_binding")
+        self.assertTrue(
+            any("stale-runtime" in r for r in result["reasons"]),
+            result["reasons"],
+        )
+
+    def test_dry_run_also_fails_closed_structured(self):
+        boom = RuntimeError("binding blocked")
+        with patch.object(
+            mcp_server,
+            "_verify_role_mutation_workspace",
+            side_effect=boom,
+        ), patch.object(
+            mcp_server, "get_profile", return_value=REVIEWER_PROFILE
+        ):
+            result = mcp_server._evaluate_pr_review_submission(
+                pr_number=721,
+                action="approve",
+                remote="prgs",
+                live=False,
+            )
+        self.assertFalse(result["would_perform"])
+        self.assertEqual(result["blocker_kind"], "workspace_role_binding")
+
+
+class TestAC5RuntimeContextRoleFilter(unittest.TestCase):
+    def test_role_filtered_view_matches_resolver_denial(self):
+        """Reviewer session: merge_pr stays denied under the role filter even
+        when the permission is (pathologically) present."""
+        allowed_ops = [
+            "gitea.read",
+            "gitea.pr.review",
+            "gitea.pr.approve",
+            "gitea.pr.request_changes",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+            "gitea.pr.merge",
+        ]
+        caps = mcp_server._build_runtime_task_capabilities(
+            allowed_ops, [], CONFIG, active_role_kind="reviewer"
+        )
+        merge_entry = next(
+            t for t in caps["task_capabilities"] if t["task"] == "merge_pr"
+        )
+        self.assertTrue(merge_entry["role_exclusive"])
+        self.assertEqual(merge_entry["capability_view"], "role_filtered")
+        self.assertFalse(
+            merge_entry["allowed_in_current_session"],
+            "role-exclusive merge_pr must stay denied for a reviewer role "
+            "even when the permission is present (#723 AC5)",
+        )
+        self.assertFalse(caps["can_merge_prs"])
+
+    def test_role_filter_restricts_matching_profiles(self):
+        caps = mcp_server._build_runtime_task_capabilities(
+            ["gitea.read"], [], CONFIG, active_role_kind="author"
+        )
+        review_entry = next(
+            t for t in caps["task_capabilities"] if t["task"] == "review_pr"
+        )
+        self.assertEqual(
+            review_entry["matching_configured_profiles"],
+            ["prgs-reviewer"],
+            "role-exclusive review_pr must not list the merger profile",
+        )
+        merge_entry = next(
+            t for t in caps["task_capabilities"] if t["task"] == "merge_pr"
+        )
+        self.assertEqual(
+            merge_entry["matching_configured_profiles"], ["prgs-merger"]
+        )
+
+    def test_permission_only_view_is_labeled(self):
+        caps = mcp_server._build_runtime_task_capabilities(
+            ["gitea.pr.merge", "gitea.read"], [], CONFIG
+        )
+        merge_entry = next(
+            t for t in caps["task_capabilities"] if t["task"] == "merge_pr"
+        )
+        self.assertEqual(merge_entry["capability_view"], "permission_only")
+        # Legacy permission-only semantics preserved when no role supplied.
+        self.assertTrue(merge_entry["allowed_in_current_session"])
+
+    def test_incident_722_shape_runtime_context_agrees_with_resolver(self):
+        """Post-970e68b shape: review_pr requires merger; a reviewer session
+        must see review_pr denied in runtime context, matching the resolver."""
+        with patch.object(
+            mcp_server.task_capability_map,
+            "required_role",
+            side_effect=lambda t: (
+                "merger"
+                if t == "review_pr"
+                else task_capability_map.TASK_CAPABILITY_MAP[t]["role"]
+            ),
+        ):
+            caps = mcp_server._build_runtime_task_capabilities(
+                REVIEWER_PROFILE["allowed_operations"],
+                REVIEWER_PROFILE["forbidden_operations"],
+                CONFIG,
+                active_role_kind="reviewer",
+            )
+        review_entry = next(
+            t for t in caps["task_capabilities"] if t["task"] == "review_pr"
+        )
+        self.assertFalse(
+            review_entry["allowed_in_current_session"],
+            "runtime context must not report review_pr allowed when the "
+            "resolver would fail-close it (incident #722)",
+        )
+        self.assertFalse(caps["can_review_prs"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_mcp_server.py

@@ -2567,18 +2567,15 @@ class TestSubmitPrReview(unittest.TestCase):
         lock = _load_review_decision_lock() or {}
         lock["live_mutations"] = [{"pr_number": 8, "action": "approve", "review_id": 42, "review_state": "approve"}]
         _save_review_decision_lock(lock)
-        with patch("mcp_server.api_request", return_value={"id": 9001}):
-            r = gitea_authorize_review_correction(
-                prior_review_id=42,
-                prior_review_state="approve",
-                reason="typo",
-                operator_authorized=True,
-                target_pr_number=8,
-            )
+        r = gitea_authorize_review_correction(
+            prior_review_id=42,
+            prior_review_state="approve",
+            reason="typo",
+            operator_authorized=True,
+        )
         self.assertTrue(r["authorized"])
         lock = _load_review_decision_lock()
         self.assertTrue(lock["correction_authorized"])
-        self.assertEqual(lock["correction_pr_number"], 8)
 
     def test_authorize_review_correction_mismatch(self):
         from mcp_server import _load_review_decision_lock, _save_review_decision_lock
@@ -2592,7 +2589,6 @@ class TestSubmitPrReview(unittest.TestCase):
             prior_review_state="approve",
             reason="typo",
             operator_authorized=True,
-            target_pr_number=8,
         )
         self.assertFalse(r["authorized"])
         self.assertTrue(any("prior review ID" in x for x in r["reasons"]))
@@ -2603,22 +2599,10 @@ class TestSubmitPrReview(unittest.TestCase):
             prior_review_state="request_changes",
             reason="typo",
             operator_authorized=True,
-            target_pr_number=8,
         )
         self.assertFalse(r["authorized"])
         self.assertTrue(any("prior review state" in x for x in r["reasons"]))
 
-        # Cross-PR unlock refused (#693)
-        r = gitea_authorize_review_correction(
-            prior_review_id=42,
-            prior_review_state="approve",
-            reason="unlock other pr",
-            operator_authorized=True,
-            target_pr_number=692,
-        )
-        self.assertFalse(r["authorized"])
-        self.assertTrue(any("different PR" in x for x in r["reasons"]))
-
     def test_authorize_review_correction_requires_operator_auth(self):
         from mcp_server import _load_review_decision_lock, _save_review_decision_lock
         lock = _load_review_decision_lock() or {}
@@ -2631,7 +2615,6 @@ class TestSubmitPrReview(unittest.TestCase):
             prior_review_state="approve",
             reason="typo",
             operator_authorized=False,
-            target_pr_number=8,
         )
         self.assertFalse(r["authorized"])
         self.assertTrue(any("operator authorization" in x for x in r["reasons"]))
@@ -2689,7 +2672,6 @@ class TestSubmitPrReview(unittest.TestCase):
                     prior_review_state="approve",
                     reason="operator approved correcting mistaken approve",
                     operator_authorized=True,
-                    target_pr_number=8,
                 )
                 _mark_request_changes_ready(remote="prgs")
                 second = gitea_submit_pr_review(

tests/test_stale_review_decision_lock_cleanup.py

@@ -188,32 +188,20 @@ class TestActiveHardStopPreserved(unittest.TestCase):
         mcp_server._save_review_decision_lock(None)
         mcp_server.review_workflow_load.clear_review_workflow_load()
 
-    def test_open_approve_blocks_same_pr_not_other_pr_mark_ready(self):
-        _seed([APPROVED_OPEN])  # approve on PR #700
-        # Same PR still hard-stopped for mark_ready.
-        reasons_same = mcp_server.terminal_review_hard_stop_reasons(
-            700, "mark_ready"
-        )
-        self.assertTrue(reasons_same)
-        self.assertIn("#332", reasons_same[0])
-        # #693: other PR may mark_ready without cleanup.
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(592, "mark_ready"),
-            [],
-        )
+    def test_open_approve_still_blocks_other_pr_mark_ready(self):
+        _seed([APPROVED_OPEN])
+        reasons = mcp_server.terminal_review_hard_stop_reasons(592, "mark_ready")
+        self.assertTrue(reasons)
+        self.assertIn("#332", reasons[0])
+        self.assertIn("gitea_cleanup_stale_review_decision_lock", reasons[0])
 
-    def test_request_changes_still_blocks_same_pr(self):
-        _seed([RC_OPEN])  # request_changes on PR #701
+    def test_request_changes_still_blocks_everything(self):
+        _seed([RC_OPEN])
         for op in ("merge", "mark_ready", "review"):
             self.assertTrue(
-                mcp_server.terminal_review_hard_stop_reasons(701, op),
+                mcp_server.terminal_review_hard_stop_reasons(592, op),
                 msg=op,
             )
-        # Foreign PR review path is open (#693).
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(592, "mark_ready"),
-            [],
-        )
 
 
 # --------------------------------------------------------------------------- #

tests/test_task_capability_role_invariants.py

@@ -19,7 +19,12 @@ import unittest
 
 import gitea_config
 from role_session_router import MERGER_TASKS, REVIEWER_TASKS
-from task_capability_map import required_permission, required_role
+from task_capability_map import (
+    ROLE_EXCLUSIVE_TASKS,
+    TASK_CAPABILITY_MAP,
+    required_permission,
+    required_role,
+)
 
 # Canonical role-profile permission shape. Mirrors the configured
 # author/reviewer/merger/reconciler profiles (profiles.json v2 role split):
@@ -201,5 +206,44 @@ class TestMergerBoundary(unittest.TestCase):
                 )
 
 
+class TestRoleExclusiveSetIntegrity(unittest.TestCase):
+    """#723 AC1/AC5: the shared role-exclusive set stays coherent."""
+
+    def test_every_role_exclusive_task_exists_in_capability_map(self):
+        for task in sorted(ROLE_EXCLUSIVE_TASKS):
+            with self.subTest(task=task):
+                self.assertIn(
+                    task,
+                    TASK_CAPABILITY_MAP,
+                    f"role-exclusive task {task!r} missing from the "
+                    f"capability map — required_role() would raise and the "
+                    f"resolver would 500 instead of failing closed",
+                )
+
+    def test_formal_review_tasks_are_role_exclusive(self):
+        for task in FORMAL_REVIEW_TASKS:
+            with self.subTest(task=task):
+                self.assertIn(task, ROLE_EXCLUSIVE_TASKS)
+
+    def test_merge_pr_is_role_exclusive_and_merger_satisfiable(self):
+        """AC1 merger equivalent: merging must stay possible for a canonical
+        merger profile (permission AND role together)."""
+        self.assertIn("merge_pr", ROLE_EXCLUSIVE_TASKS)
+        self.assertTrue(
+            _profile_satisfies("merger", "merge_pr"),
+            "no canonical merger profile satisfies merge_pr — merging would "
+            "be impossible for every configured profile",
+        )
+
+    def test_reconciler_cleanup_tasks_stay_reconciler_satisfiable(self):
+        for task in ("cleanup_merged_pr_branch", "reconciliation_cleanup"):
+            with self.subTest(task=task):
+                self.assertIn(task, ROLE_EXCLUSIVE_TASKS)
+                self.assertTrue(
+                    _profile_satisfies("reconciler", task),
+                    f"no canonical reconciler profile satisfies {task!r}",
+                )
+
+
 if __name__ == "__main__":
     unittest.main()

tests/test_terminal_review_hard_stop.py

@@ -1,10 +1,10 @@
-"""Tests for the session hard-stop after a terminal review mutation (#332/#693).
+"""Tests for the session hard-stop after a terminal review mutation (#332).
 
 Extends the single-terminal-decision machinery (#211): after a live
-REQUEST_CHANGES on a PR head the same-head path must stop; after an APPROVE
-only the merge sequence for that same PR may continue; #693 allows a
-*different* PR to be mark_ready/review in the same durable lock (cross-PR
-isolation); duplicate REQUEST_CHANGES at an unchanged head is suppressed.
+REQUEST_CHANGES the run must stop; after an APPROVE only the merge sequence
+for that same PR may continue; a different PR can never be reviewed or
+merged in the same run; duplicate REQUEST_CHANGES at an unchanged head is
+suppressed.
 """
 import os
 import unittest
@@ -15,10 +15,7 @@ import mcp_server
 HEAD_SHA = "a" * 40
 
 
-def _lock(mutations=None, correction=False, correction_pr=None):
-    mutations = list(mutations or [])
-    if correction and correction_pr is None and mutations:
-        correction_pr = mutations[-1].get("pr_number")
+def _lock(mutations=None, correction=False):
     return {
         "task": "review_pr",
         "remote": "prgs",
@@ -32,11 +29,9 @@ def _lock(mutations=None, correction=False, correction_pr=None):
         "ready_remote": None,
         "ready_org": None,
         "ready_repo": None,
-        "live_mutations": mutations,
+        "live_mutations": list(mutations or []),
         "correction_authorized": correction,
-        "correction_reason": "test" if correction else None,
-        "correction_pr_number": correction_pr if correction else None,
-        "correction_head_sha": None,
+        "correction_reason": None,
     }
 
 
@@ -69,35 +64,25 @@ class TestTerminalHardStopReasons(unittest.TestCase):
         self.assertEqual(
             mcp_server.terminal_review_hard_stop_reasons(5, "merge"), [])
 
-    def test_request_changes_blocks_same_pr_allows_other_pr_review(self):
+    def test_request_changes_blocks_everything(self):
         _seed([RC_A])
-        # Same PR: still hard-stopped for mark_ready/review/merge.
         for op in ("merge", "mark_ready", "review"):
-            reasons = mcp_server.terminal_review_hard_stop_reasons(5, op)
-            self.assertTrue(reasons, f"{op}/5")
-            self.assertIn("request_changes on PR #5", reasons[0])
-            self.assertIn("#332", reasons[0])
-        # #693: different PR may mark_ready / review (not merge via hard-stop alone).
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(6, "mark_ready"), [])
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(6, "review"), [])
-        # Merge of an unapproved other PR remains blocked by hard-stop path
-        # (last terminal is not approve of PR 6).
-        self.assertTrue(
-            mcp_server.terminal_review_hard_stop_reasons(6, "merge"))
+            for pr in (5, 6):
+                reasons = mcp_server.terminal_review_hard_stop_reasons(pr, op)
+                self.assertTrue(reasons, f"{op}/{pr}")
+                self.assertIn("request_changes on PR #5", reasons[0])
+                self.assertIn("#332", reasons[0])
 
-    def test_approve_allows_same_pr_merge_and_other_pr_review(self):
+    def test_approve_allows_same_pr_merge_only(self):
         _seed([APPROVED_A])
         self.assertEqual(
             mcp_server.terminal_review_hard_stop_reasons(5, "merge"), [])
         self.assertTrue(
             mcp_server.terminal_review_hard_stop_reasons(6, "merge"))
-        # #693 cross-PR isolation: other PR formal review path is open.
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(6, "mark_ready"), [])
-        self.assertEqual(
-            mcp_server.terminal_review_hard_stop_reasons(6, "review"), [])
+        self.assertTrue(
+            mcp_server.terminal_review_hard_stop_reasons(6, "mark_ready"))
+        self.assertTrue(
+            mcp_server.terminal_review_hard_stop_reasons(6, "review"))
 
     def test_correction_reopens_review_path_only(self):
         _seed([RC_A], correction=True)
@@ -105,11 +90,9 @@ class TestTerminalHardStopReasons(unittest.TestCase):
             mcp_server.terminal_review_hard_stop_reasons(5, "mark_ready"), [])
         self.assertEqual(
             mcp_server.terminal_review_hard_stop_reasons(5, "review"), [])
-        # scoped correction never opens a cross-PR merge
+        # correction never opens a cross-PR merge
         self.assertTrue(
             mcp_server.terminal_review_hard_stop_reasons(6, "merge"))
-        # unscoped/cross-PR correction must not lift PR 6 via correction alone
-        # (PR 6 is allowed by isolation, not by correction scope)
 
 
 class TestMergeHardStopWiring(unittest.TestCase):
@@ -143,29 +126,14 @@ class TestMarkFinalHardStopWiring(unittest.TestCase):
         mcp_server._save_review_decision_lock(None)
         mcp_server.review_workflow_load.clear_review_workflow_load()
 
-    def test_mark_ready_same_pr_blocked_after_terminal_mutation(self):
+    def test_mark_ready_blocked_after_terminal_mutation(self):
         _seed([RC_A])
         result = mcp_server.gitea_mark_final_review_decision(
-            pr_number=5, action="approve", remote="prgs",
-            expected_head_sha=HEAD_SHA)
+            pr_number=6, action="approve", remote="prgs")
         self.assertFalse(result["marked_ready"])
         self.assertTrue(
             any("#332" in r for r in result["reasons"]), result["reasons"])
 
-    def test_mark_ready_other_pr_allowed_after_foreign_terminal(self):
-        """#693: foreign open-PR terminal must not block mark_final on PR B."""
-        _seed([RC_A])
-        no_lease = {"block": False, "reasons": [], "mutation_allowed": True}
-        with patch("mcp_server._list_pr_lease_comments", return_value=[]), \
-                patch("mcp_server._pr_work_lease_reviewer_block",
-                      return_value=no_lease), \
-                patch.object(mcp_server, "gitea_check_pr_eligibility",
-                             return_value={"head_sha": HEAD_SHA, "eligible": True}):
-            result = mcp_server.gitea_mark_final_review_decision(
-                pr_number=6, action="approve", remote="prgs",
-                expected_head_sha=HEAD_SHA)
-        self.assertTrue(result["marked_ready"], result.get("reasons"))
-
 
 def _feedback(blocking, stale=False, success=True):
     return {