fix(profiles): canonical reconciler ops and guard raw branch delete (#687)

Address REQUEST_CHANGES on PR #688:

- migrate_profiles: emit fully canonical reconciler/author/reviewer defaults;
  canonicalize explicit ops; fail if reconciler loses required pr.close/read
- gitea_delete_branch: deny reconciler (and non-author roles); refuse
  preservation/protected branches before any API call
- gitea_cleanup_merged_pr_branch: require reconciler role only; block
  preservation/evidence branches via branch_cleanup_guard
- docs: end-to-end operator runbook for profile migrate/apply/reconnect/cleanup
- tests: migration canonicalization, idempotency, raw-delete denial, guarded
  cleanup success and unmerged/preserve rejections

Closes #687.

branch_cleanup_guard.py

@@ -7,6 +7,19 @@ from typing import Any
 
 PROTECTED_BRANCHES = frozenset({"master", "main", "dev"})
 
+# Evidence / preservation branches must never be removed by cleanup tools
+# (e.g. chore/issue-681-preserve-review-session-wip).
+_PRESERVATION_MARKERS = ("preserve", "preservation", "evidence")
+
+
+def is_preservation_or_evidence_branch(branch: str | None) -> bool:
+    """Return True when *branch* is a preservation/evidence ref that must stay."""
+    if not branch:
+        return False
+    name = str(branch).lower()
+    return any(marker in name for marker in _PRESERVATION_MARKERS)
+
+
 _RAW_BRANCH_DELETE_PATTERNS = (
     re.compile(r"\bgit(?:\s+-C\s+\S+)?\s+branch\s+-[dD]\b[^\n\r]*", re.I),
     re.compile(r"\bgit(?:\s+-C\s+\S+)?\s+push\b[^\n\r]*\s--delete\b[^\n\r]*", re.I),
@@ -72,6 +85,11 @@ def assess_merged_pr_branch_cleanup(
         reasons.append("PR head branch is missing")
     if head_branch in protected:
         reasons.append(f"branch '{head_branch}' is protected")
+    if is_preservation_or_evidence_branch(head_branch):
+        reasons.append(
+            f"branch '{head_branch}' is a preservation/evidence branch and "
+            "cannot be deleted through merged-PR cleanup"
+        )
     if head_branch in open_pr_heads:
         reasons.append("an open PR still references this head branch")
     if head_on_target is False:

docs/gitea-execution-profiles.md

@@ -238,11 +238,43 @@ narrow operation set:
 - `gitea.issue.comment`
 - `gitea.issue.close`
 - `gitea.pr.close`
+- `gitea.branch.delete` (merged-branch cleanup only — see below)
 
 Forbidden on reconciler profiles: `gitea.pr.approve`, `gitea.pr.merge`,
 `gitea.pr.review`, `gitea.pr.create`, `gitea.branch.push`, and
 `gitea.repo.commit`.
 
+### Merged-branch cleanup ownership (`gitea.branch.delete`)
+
+The reconciler is the repository-supported owner of merged-PR source-branch
+cleanup: `task_capability_map` maps `cleanup_merged_pr_branch` (and
+`reconciliation_cleanup`) to role `reconciler` with permission
+`gitea.branch.delete`. Post-merge branch lifecycle is reconciliation work —
+it happens after the author, reviewer, and merger roles have completed, and
+it must not be reachable from those roles.
+
+Least-privilege constraints:
+
+- `gitea.branch.delete` is granted **only** to reconciler profiles. Author,
+  reviewer, and merger profiles must never hold it; `gitea_delete_branch`
+  and `gitea_cleanup_merged_pr_branch` fail closed on any profile without
+  the permission.
+- Even with the permission, reconciler deletion is only supported through the
+  guarded `gitea_cleanup_merged_pr_branch` path (#514 / #687): the PR must be
+  merged, the head an ancestor of the target, the branch not protected
+  (`master`/`main`/`dev`), the branch not a preservation/evidence ref (e.g.
+  `chore/issue-681-preserve-review-session-wip`), no open PR may still use the
+  head, and an explicit `CLEANUP MERGED PR <n> BRANCH <branch>` confirmation is
+  required. Raw `gitea_delete_branch` is **denied** to reconciler even when
+  `gitea.branch.delete` is present.
+- Raw `git branch -d` / `git push --delete` cleanup remains blocked by
+  `branch_cleanup_guard` and the final-report validator regardless of
+  profile permissions.
+- `gitea.branch.delete` has no short alias in `GITEA_OPERATION_ALIASES`;
+  write it fully qualified in `allowed_operations`. Migration must emit
+  canonical names such as `gitea.pr.close` (never bare `pr.close` /
+  `issue.close`, which the production normalizer rejects or drops).
+
 Launch a static `gitea-reconciler` MCP namespace with
 `GITEA_MCP_PROFILE=prgs-reconciler`. Profile shape is validated by
 `reconciler_profile.assess_reconciler_profile` (#304). Use the
@@ -251,6 +283,159 @@ Launch a static `gitea-reconciler` MCP namespace with
 fresh target-branch fetch, recorded target SHA, and ancestor proof. PRs whose
 heads are not already landed cannot be closed through this path.
 
+### Operational runbook: grant reconciler `gitea.branch.delete` (#687)
+
+Merging a code PR that updates `migrate_profiles.py` / `reconciler_profile.py`
+**does not** change the live operator profile on disk. Apply the profile
+change deliberately, then reconnect the client-managed namespace.
+
+1. **Approved migration / profile-update command** (from the repo root, using
+   the project venv if present):
+
+   ```bash
+   # Dry-run first (default): validates v2 output, writes nothing
+   python3 migrate_profiles.py -i ~/.config/gitea-tools/profiles.json
+
+   # Apply: creates backup then writes migrated v2 config
+   python3 migrate_profiles.py -i ~/.config/gitea-tools/profiles.json -w
+   # Optional explicit paths:
+   # python3 migrate_profiles.py -i ~/.config/gitea-tools/profiles.json \
+   #   -o ~/.config/gitea-tools/profiles.json \
+   #   --backup ~/.config/gitea-tools/profiles.json.bak -w
+   ```
+
+   If the live file is already v2, edit the reconciler identity’s
+   `allowed_operations` / `forbidden_operations` under
+   `environments.<env>.services.gitea.identities.reconciler` (or the
+   `prgs-reconciler` alias target) so allowed includes the canonical set
+   below — then re-validate with a load of the config (see step 3).
+
+2. **Inspect the generated (or edited) profile** — confirm the reconciler
+   identity, for example:
+
+   ```bash
+   python3 - <<'PY'
+   import json
+   from pathlib import Path
+   cfg = json.loads(Path.home().joinpath(".config/gitea-tools/profiles.json").read_text())
+   # v2 environments shape:
+   ident = cfg["environments"]["prgs"]["services"]["gitea"]["identities"]["reconciler"]
+   print("role:", ident.get("role"))
+   print("allowed:", ident.get("allowed_operations"))
+   print("forbidden:", ident.get("forbidden_operations"))
+   PY
+   ```
+
+3. **Validate canonical operation names and least privilege**
+
+   Expected canonical **allowed** (defaults after migration):
+
+   - `gitea.read`
+   - `gitea.pr.close` (required)
+   - `gitea.pr.comment`
+   - `gitea.issue.comment`
+   - `gitea.issue.close`
+   - `gitea.branch.delete` (recommended; cleanup only)
+
+   Expected **forbidden** includes at least: `gitea.pr.approve`,
+   `gitea.pr.merge`, `gitea.pr.review`, `gitea.pr.create`,
+   `gitea.branch.push`, `gitea.repo.commit`.
+
+   No shorthand (`pr.close`, `issue.close`, `pr.comment`) may remain.
+   Validate with the production loader:
+
+   ```bash
+   python3 - <<'PY'
+   import gitea_config, reconciler_profile
+   from pathlib import Path
+   path = str(Path.home() / ".config/gitea-tools/profiles.json")
+   gitea_config.load_config(path)  # fails closed on invalid config
+   # Or assess the reconciler lists directly after extracting them:
+   # print(reconciler_profile.assess_reconciler_profile(allowed, forbidden))
+   PY
+   ```
+
+4. **Merging PR #688 (or any code PR) does not update the live profile.**
+   Code changes only the migration helper, schema, docs, and tests. The
+   operator must still run `migrate_profiles.py -w` or an equivalent
+   authorized edit of `~/.config/gitea-tools/profiles.json`.
+
+5. **Supported apply method:** `python3 migrate_profiles.py … -w` (backup
+   created automatically) **or** operator-authorized edit of the live
+   profiles file after backup. Unsupported: silent mtime tricks, manual
+   process kill to “reload”, or undocumented env overrides.
+
+6. **Backup and validation:** `-w` copies the input to
+   `<input_path>.bak` (or `--backup PATH`) before writing. Re-run
+   `load_config` / `assess_reconciler_profile` after write. Keep the
+   `.bak` until live whoami/capability checks pass.
+
+7. **Client-managed namespace reconnect/reload:** reconnect or reload the
+   IDE MCP client so `gitea-reconciler` restarts from current `master` and
+   the updated `GITEA_MCP_PROFILE=prgs-reconciler` config. Do not hand-launch
+   `mcp_server.py` / `gitea_mcp_server.py` with ad hoc `GITEA_*` env
+   (see #686 / #630).
+
+8. **Live reverification** (through the client-managed `gitea-reconciler`
+   namespace only):
+
+   - `gitea_whoami` → identity + profile `prgs-reconciler`
+   - `gitea_assess_master_parity` → `stale=false`, `restart_required=false`
+   - `gitea_resolve_task_capability(task="cleanup_merged_pr_branch")` →
+     `allowed_in_current_session=true` only when permission and role match
+   - `gitea_resolve_task_capability(task="delete_branch")` →
+     **not** allowed for reconciler (role denial must be enforced)
+
+9. **Guarded cleanup usage** (example for a merged PR whose source branch
+   remains on the remote):
+
+   ```text
+   gitea_cleanup_merged_pr_branch(
+     pr_number=<N>,
+     branch=<exact PR head branch>,
+     confirmation="CLEANUP MERGED PR <N> BRANCH <exact PR head branch>",
+     remote="prgs",
+     org="Scaled-Tech-Consulting",
+     repo="Gitea-Tools",
+     worktree_path="<path under branches/>",
+   )
+   ```
+
+   The tool refuses unmerged PRs, protected branches, preservation/evidence
+   branches, open-PR heads, mismatched branch names, and wrong confirmation.
+
+10. **Prohibitions**
+
+    - No raw `git push --delete`, `git branch -d` / `-D`, or delete refspecs
+    - No arbitrary `gitea_delete_branch` from reconciler
+    - No unsupported profile switching mid-run without full re-preflight
+    - No ad hoc hand-edits of live profiles **unless** operator-authorized,
+      backed up, and revalidated as above
+
+Canonical migrated reconciler example:
+
+```json
+{
+  "role": "reconciler",
+  "allowed_operations": [
+    "gitea.read",
+    "gitea.pr.close",
+    "gitea.pr.comment",
+    "gitea.issue.comment",
+    "gitea.issue.close",
+    "gitea.branch.delete"
+  ],
+  "forbidden_operations": [
+    "gitea.pr.approve",
+    "gitea.pr.merge",
+    "gitea.pr.review",
+    "gitea.pr.create",
+    "gitea.branch.push",
+    "gitea.repo.commit"
+  ]
+}
+```
+
 ## Identity and fail-closed rules
 
 Before **any** mutating action, a workflow must know both:

gitea_mcp_server.py

@@ -195,12 +195,6 @@ RECONCILER_WORKTREE_ENV = "GITEA_RECONCILER_WORKTREE"
 
 import namespace_workspace_binding as nwb  # noqa: E402
 import mcp_namespace_health  # noqa: E402
-import stale_binding_recovery  # noqa: E402
-
-# Worktree env bindings inherited from the parent environment at daemon boot
-# (#702). A value that still equals its boot snapshot was never established by
-# a sanctioned tool in this daemon's lifetime.
-_BOOT_ENV_WORKTREE_BINDINGS = stale_binding_recovery.snapshot_boot_bindings()
 
 
 def _preflight_in_test_mode() -> bool:
@@ -266,124 +260,8 @@ def _actual_profile_role() -> str:
     )
 
 
-def _assess_stale_active_binding(auto_recover: bool = False) -> dict:
-    """Classify the GITEA_ACTIVE_WORKTREE binding; recover when provably stale (#702).
-
-    Runs during ``gitea_resolve_task_capability`` / runtime context. Clearing
-    is the sanctioned in-daemon mechanism and happens only for the two
-    provably-stale classes (missing path, superseded by a sanctioned session
-    lease); an uncorroborated boot-inherited binding is surfaced with the
-    managed-reconnect next action, never cleared silently.
-    """
-    active_value = (os.environ.get(ACTIVE_WORKTREE_ENV) or "").strip() or None
-    try:
-        role = _actual_profile_role()
-    except Exception:
-        role = "author"
-    role_env_key = nwb.ROLE_WORKTREE_ENVS.get(role, AUTHOR_WORKTREE_ENV)
-    boot_value = (
-        (_BOOT_ENV_WORKTREE_BINDINGS.get("active_worktree") or "").strip() or None
-    )
-    classification = stale_binding_recovery.classify_active_worktree_binding(
-        active_value=active_value,
-        role_env_value=(os.environ.get(role_env_key) or "").strip() or None,
-        session_lease_worktree=_reviewer_session_worktree(),
-        boot_inherited=bool(active_value and boot_value == active_value),
-        path_exists=os.path.isdir(active_value) if active_value else None,
-        role_kind=role,
-    )
-    plan = stale_binding_recovery.plan_recovery(classification)
-    applied: dict = {"performed": False}
-    recovery_enabled = (
-        not _preflight_in_test_mode()
-        or os.environ.get("GITEA_FORCE_STALE_BINDING_RECOVERY") == "1"
-    )
-    audit_persisted: bool | None = None
-    if auto_recover and plan.get("clear_allowed") and recovery_enabled:
-        # #702 F6: the durable audit record must exist BEFORE the environment
-        # is cleared. If audit persistence fails the recovery does not run —
-        # an env clear without durable proof is an unauditable mutation.
-        pending_value = (os.environ.get(ACTIVE_WORKTREE_ENV) or "").strip() or None
-        audit_error: str | None = None
-        try:
-            import mcp_session_state as mss
-
-            mss.save_state(
-                kind=mss.KIND_STALE_BINDING_RECOVERY,
-                payload={
-                    "cleared_env": ACTIVE_WORKTREE_ENV,
-                    "cleared_value": pending_value,
-                    "classification": plan.get("classification"),
-                    "reasons": list(plan.get("reasons") or []),
-                    "recovery_status": "pending",
-                },
-            )
-            audit_persisted = True
-        except Exception as exc:
-            audit_persisted = False
-            audit_error = f"{type(exc).__name__}: {exc}"
-        if audit_persisted:
-            applied = stale_binding_recovery.apply_recovery(plan)
-            if applied.get("performed"):
-                try:
-                    import mcp_session_state as mss
-
-                    mss.save_state(
-                        kind=mss.KIND_STALE_BINDING_RECOVERY,
-                        payload={
-                            "cleared_env": applied.get("cleared_env"),
-                            "cleared_value": applied.get("cleared_value"),
-                            "classification": applied.get("classification"),
-                            "reasons": applied.get("reasons"),
-                            "recovery_status": "performed",
-                        },
-                    )
-                except Exception:
-                    # The pre-clear "pending" record is already durable; the
-                    # status refresh is best-effort and never rolls back.
-                    pass
-        else:
-            applied = {
-                "performed": False,
-                "action": stale_binding_recovery.RECOVERY_ACTION_NONE,
-                "audit_write_failed": True,
-                "reasons": [
-                    "audit persistence failed; stale binding NOT cleared "
-                    "(fail closed, #702 F6)"
-                ]
-                + ([audit_error] if audit_error else []),
-            }
-    report = {
-        "classification": classification.get("classification"),
-        "active_worktree": classification.get("active_worktree"),
-        "boot_inherited": classification.get("boot_inherited", False),
-        "clear_eligible": bool(classification.get("clear_eligible")),
-        "recovery_action": plan.get("action"),
-        "recovery_performed": bool(applied.get("performed")),
-        "reasons": classification.get("reasons") or [],
-    }
-    if audit_persisted is not None:
-        report["audit_persisted"] = audit_persisted
-    if applied.get("audit_write_failed"):
-        report["audit_write_failed"] = True
-        report["reasons"] = list(report["reasons"]) + list(
-            applied.get("reasons") or []
-        )
-    if applied.get("performed"):
-        report["cleared_value"] = applied.get("cleared_value")
-    if plan.get("exact_next_action"):
-        report["exact_next_action"] = plan.get("exact_next_action")
-    return report
-
-
 def _resolve_preflight_workspace_path(worktree_path: str | None = None) -> str:
-    """Resolve the namespace-scoped workspace root inspected by pre-flight guards.
-
-    #702 F2: preflight resolves with the same existence verification as the
-    canonical mutation context (verify_paths). A dead env binding must demote
-    here exactly as it does in :func:`_resolve_namespace_mutation_context`,
-    or preflight would inspect a path the mutation guard never uses.
-    """
+    """Resolve the namespace-scoped workspace root inspected by pre-flight guards."""
     role = _effective_workspace_role()
     workspace, _source = nwb.resolve_namespace_workspace(
         role_kind=role,
@@ -393,7 +271,6 @@ def _resolve_preflight_workspace_path(worktree_path: str | None = None) -> str:
             _reviewer_session_worktree() if role in {"reviewer", "merger"} else None
         ),
         profile_name=get_profile().get("profile_name"),
-        verify_paths=True,
     )
     return workspace
 
@@ -440,15 +317,6 @@ def _get_git_root(path: str) -> str | None:
     return (res.stdout or "").strip() or None
 
 
-# #702 F2: synthetic tracked-dirty porcelain returned when the preflight
-# workspace cannot be inspected (missing path, git failure). Shaped as a
-# modified tracked entry so every consumer treats "workspace unavailable"
-# as dirty — an uninspectable workspace must never read as clean.
-PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN = (
-    " M __gitea_preflight_workspace_unavailable__\n"
-)
-
-
 def _get_workspace_porcelain(worktree_path: str | None = None) -> str:
     """Return tracked-workspace porcelain for pre-flight attribution."""
     if os.environ.get("GITEA_TEST_FORCE_DIRTY"):
@@ -457,8 +325,6 @@ def _get_workspace_porcelain(worktree_path: str | None = None) -> str:
     if override is not None:
         return override
     workspace = _resolve_preflight_workspace_path(worktree_path)
-    if not os.path.isdir(workspace):
-        return PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN
     try:
         res = subprocess.run(
             ["git", "status", "--porcelain"],
@@ -466,11 +332,9 @@ def _get_workspace_porcelain(worktree_path: str | None = None) -> str:
             text=True,
             cwd=workspace,
         )
+        return res.stdout or ""
     except Exception:
-        return PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN
-    if res.returncode != 0:
-        return PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN
-    return res.stdout or ""
+        return ""
 
 
 def _parse_porcelain_entries(porcelain: str) -> dict[str, str]:
@@ -6061,6 +5925,65 @@ def gitea_delete_branch(
             "permission_report": _permission_block_report("gitea.branch.delete"),
         }
 
+    # Possessing gitea.branch.delete alone is not enough for arbitrary deletion.
+    # task_capability_map maps delete_branch → author; reconciler must use the
+    # guarded cleanup_merged_pr_branch path only (#687 / #514).
+    profile = get_profile()
+    active_role = _profile_role_kind(profile)
+    required_role = task_capability_map.required_role("delete_branch")
+    if active_role == "reconciler":
+        return {
+            "success": False,
+            "performed": False,
+            "required_permission": "gitea.branch.delete",
+            "required_role_kind": required_role,
+            "active_role_kind": active_role,
+            "reasons": [
+                "reconciler profile cannot use raw gitea_delete_branch; "
+                "use gitea_cleanup_merged_pr_branch for a fully merged PR "
+                "source branch only (fail closed)"
+            ],
+            "exact_next_action": (
+                "Call gitea_cleanup_merged_pr_branch with pr_number, the "
+                "exact PR head branch, and confirmation "
+                "'CLEANUP MERGED PR <n> BRANCH <branch>' after capability "
+                "resolve for cleanup_merged_pr_branch."
+            ),
+            "permission_report": _permission_block_report("gitea.branch.delete"),
+        }
+    if active_role != required_role:
+        return {
+            "success": False,
+            "performed": False,
+            "required_permission": "gitea.branch.delete",
+            "required_role_kind": required_role,
+            "active_role_kind": active_role,
+            "reasons": [
+                f"Active profile role '{active_role}' cannot perform "
+                f"{required_role} task 'delete_branch' even when "
+                "gitea.branch.delete is present (fail closed)"
+            ],
+            "permission_report": _permission_block_report("gitea.branch.delete"),
+        }
+
+    if branch_cleanup_guard.is_preservation_or_evidence_branch(branch):
+        return {
+            "success": False,
+            "performed": False,
+            "required_permission": "gitea.branch.delete",
+            "reasons": [
+                f"branch '{branch}' is a preservation/evidence branch and "
+                "cannot be deleted (fail closed)"
+            ],
+        }
+    if branch in branch_cleanup_guard.PROTECTED_BRANCHES:
+        return {
+            "success": False,
+            "performed": False,
+            "required_permission": "gitea.branch.delete",
+            "reasons": [f"branch '{branch}' is protected (fail closed)"],
+        }
+
     audit_allowed, audit_reasons = (
         audit_reconciliation_mode.check_audit_mutation_allowed("delete_branch")
     )
@@ -6112,18 +6035,20 @@ def gitea_cleanup_merged_pr_branch(
         }
 
     profile = get_profile()
-    active_role = _role_kind(
-        profile.get("allowed_operations", []),
-        profile.get("forbidden_operations", []),
-    )
-    if active_role == "reviewer":
+    active_role = _profile_role_kind(profile)
+    # cleanup_merged_pr_branch is reconciler-owned (task_capability_map).
+    # Author/reviewer/merger must not reach this path even if they somehow
+    # hold gitea.branch.delete.
+    if active_role != "reconciler":
         return {
             "success": False,
             "performed": False,
             "required_permission": "gitea.branch.delete",
+            "required_role_kind": "reconciler",
+            "active_role_kind": active_role,
             "reasons": [
-                "reviewer profile is not authorized for merged branch cleanup "
-                "(fail closed)"
+                f"profile role '{active_role}' is not authorized for merged "
+                "branch cleanup; required role is reconciler (fail closed)"
             ],
             "permission_report": _permission_block_report("gitea.branch.delete"),
         }
@@ -8100,12 +8025,11 @@ def gitea_diagnose_reviewer_pr_lease_handoff(
     org: str | None = None,
     repo: str | None = None,
 ) -> dict:
-    """Read-only: diagnose open-PR reviewer lease handoff and emit next action (#599, #691).
+    """Read-only: diagnose open-PR reviewer lease handoff and emit next action (#599).
 
-    Classifies no-lease / own / foreign / superseded-head / expired / orphan /
-    instructed-lease-missing-with-replacement and worktree binding mismatch.
-    Returns a canonical ``next_action`` (including guarded obsolete-lease cleanup)
-    without mutating Gitea state. Never steals foreign leases.
+    Classifies no-lease / own / foreign / instructed-lease-missing-with-replacement
+    and worktree binding mismatch. Returns a canonical ``next_action`` without
+    mutating Gitea state. Never steals foreign leases.
     """
     read_block = _profile_operation_gate("gitea.read")
     if read_block:
@@ -8116,7 +8040,7 @@ def gitea_diagnose_reviewer_pr_lease_handoff(
         }
     comments = _fetch_pr_comments(
         pr_number, remote=remote, host=host, org=org, repo=repo)
-    h, o, r = _resolve(remote, host, org, repo)
+    h, _o, _r = _resolve(remote, host, org, repo)
     try:
         username = _authenticated_username(h)
     except Exception:
@@ -8130,74 +8054,6 @@ def gitea_diagnose_reviewer_pr_lease_handoff(
     # Prefer in-session lease id when present; otherwise diagnose as a fresh
     # caller without inventing ownership of an on-thread lease.
     session_id = (session_lease.get("session_id") or "").strip() or None
-
-    # Live PR head + formal reviews for #691 superseded/completed classification.
-    current_head_sha = None
-    formal_reviews: list[dict] = []
-    try:
-        auth = _auth(h)
-        pr_live = api_request(
-            "GET", f"{repo_api_url(h, o, r)}/pulls/{pr_number}", auth
-        ) or {}
-        head = pr_live.get("head") or {}
-        current_head_sha = head.get("sha") or pr_live.get("head_commit_sha")
-        try:
-            reviews = api_request(
-                "GET",
-                f"{repo_api_url(h, o, r)}/pulls/{pr_number}/reviews",
-                auth,
-            ) or []
-            for rev in reviews if isinstance(reviews, list) else []:
-                formal_reviews.append({
-                    "verdict": rev.get("state") or rev.get("verdict"),
-                    "reviewed_head_sha": rev.get("commit_id") or rev.get(
-                        "reviewed_head_sha"
-                    ),
-                    "dismissed": bool(rev.get("dismissed")),
-                    "reviewer": ((rev.get("user") or {}).get("login")),
-                    "submitted_at": rev.get("submitted_at"),
-                })
-        except Exception:
-            formal_reviews = []
-    except Exception:
-        current_head_sha = None
-
-    lease_wt = None
-    active = reviewer_pr_lease.find_newest_nonterminal_lease(
-        comments, pr_number=pr_number, include_expired=True
-    )
-    if active:
-        lease_wt = (active.get("worktree") or "").strip() or None
-    worktree_exists = None
-    worktree_clean = None
-    if lease_wt:
-        worktree_exists = os.path.isdir(lease_wt)
-        if worktree_exists:
-            try:
-                import subprocess
-
-                st = subprocess.run(
-                    ["git", "-C", lease_wt, "status", "--porcelain"],
-                    capture_output=True,
-                    text=True,
-                    timeout=30,
-                    check=False,
-                )
-                if st.returncode == 0:
-                    worktree_clean = not bool((st.stdout or "").strip())
-            except Exception:
-                worktree_clean = None
-
-    # #702: derive owner-process evidence from the durable session-lease
-    # shadow left behind by a crashed daemon. Only a provably dead recorded
-    # owner pid yields False; PID liveness alone never proves ownership.
-    orphan_evidence = reviewer_pr_lease.assess_crashed_session_lease_orphan(
-        reviewer_pr_lease.load_session_lease_shadow(
-            session_id=(active or {}).get("session_id")
-        ),
-        lease=active,
-    )
-
     diagnosis = reviewer_pr_lease.diagnose_reviewer_pr_lease_handoff(
         comments,
         pr_number=pr_number,
@@ -8207,13 +8063,7 @@ def gitea_diagnose_reviewer_pr_lease_handoff(
         env_bound_worktree=env_wt,
         instructed_session_id=instructed_session_id,
         instructed_comment_id=instructed_comment_id,
-        current_head_sha=current_head_sha,
-        formal_reviews=formal_reviews,
-        worktree_exists=worktree_exists,
-        worktree_clean=worktree_clean,
-        owner_process_alive=orphan_evidence.get("owner_process_alive"),
     )
-    diagnosis["crashed_session_lease_evidence"] = orphan_evidence
     diagnosis["success"] = True
     diagnosis["remote"] = remote
     diagnosis["authenticated_user"] = username
@@ -8340,221 +8190,6 @@ def gitea_cleanup_post_merge_moot_lease(
     return report
 
 
-@mcp.tool()
-def gitea_cleanup_obsolete_reviewer_comment_lease(
-    pr_number: int,
-    confirmation: str = "",
-    apply: bool = False,
-    controller_recovery_authorized: bool = False,
-    expected_lease_comment_id: int | None = None,
-    expected_session_id: str | None = None,
-    expected_leased_head: str | None = None,
-    owner_process_alive: bool | None = None,
-    current_head_review_in_progress: bool = False,
-    remote: str = "dadeschools",
-    host: str | None = None,
-    org: str | None = None,
-    repo: str | None = None,
-) -> dict:
-    """Guarded cleanup for obsolete comment-backed reviewer leases on open PRs (#691).
-
-    Neutralises an expired and/or superseded-head foreign lease by posting a
-    terminal ``phase: released`` lease marker (append-only audit). Never deletes
-    comments, never repoints the lease to the new head, never transfers
-    validation/decision/workflow state, never uses PID equality as ownership,
-    and never steals a genuinely active foreign lease on the current head.
-
-    Read-first when ``apply`` is false. Apply requires:
-
-    - ``controller_recovery_authorized=True`` (explicit operator/controller
-      recovery capability — not implied by profile alone)
-    - ``confirmation`` exactly ``CLEANUP OBSOLETE REVIEWER LEASE <pr_number>``
-    - full eligibility evidence from
-      ``reviewer_pr_lease.assess_obsolete_reviewer_comment_lease_cleanup``
-
-    Comment-backed leases need no control-plane DB ``lease_id``.
-    """
-    read_block = _profile_operation_gate("gitea.read")
-    if read_block:
-        return {
-            "success": False,
-            "cleanup_performed": False,
-            "no_steal_or_adoption": True,
-            "reasons": read_block,
-            "permission_report": _permission_block_report("gitea.read"),
-        }
-
-    h, o, r = _resolve(remote, host, org, repo)
-    auth = _auth(h)
-    expected_repo = f"{o}/{r}"
-    comments = _fetch_pr_comments(
-        pr_number, remote=remote, host=host, org=org, repo=repo
-    )
-    pr_live = api_request(
-        "GET", f"{repo_api_url(h, o, r)}/pulls/{pr_number}", auth
-    ) or {}
-    head = pr_live.get("head") or {}
-    current_head_sha = head.get("sha") or pr_live.get("head_commit_sha")
-
-    formal_reviews: list[dict] = []
-    try:
-        reviews = api_request(
-            "GET",
-            f"{repo_api_url(h, o, r)}/pulls/{pr_number}/reviews",
-            auth,
-        ) or []
-        for rev in reviews if isinstance(reviews, list) else []:
-            formal_reviews.append({
-                "verdict": rev.get("state") or rev.get("verdict"),
-                "reviewed_head_sha": rev.get("commit_id")
-                or rev.get("reviewed_head_sha"),
-                "dismissed": bool(rev.get("dismissed")),
-                "reviewer": ((rev.get("user") or {}).get("login")),
-                "submitted_at": rev.get("submitted_at"),
-            })
-    except Exception:
-        formal_reviews = []
-
-    lease = reviewer_pr_lease.find_newest_nonterminal_lease(
-        comments, pr_number=pr_number, include_expired=True
-    )
-    lease_wt = ((lease or {}).get("worktree") or "").strip() or None
-    worktree_exists = None
-    worktree_clean = None
-    worktree_has_unpreserved_work = None
-    if lease_wt:
-        worktree_exists = os.path.isdir(lease_wt)
-        if worktree_exists:
-            try:
-                import subprocess
-
-                st = subprocess.run(
-                    ["git", "-C", lease_wt, "status", "--porcelain"],
-                    capture_output=True,
-                    text=True,
-                    timeout=30,
-                    check=False,
-                )
-                if st.returncode == 0:
-                    dirty = bool((st.stdout or "").strip())
-                    worktree_clean = not dirty
-                    worktree_has_unpreserved_work = dirty
-            except Exception:
-                worktree_clean = None
-
-    session = reviewer_pr_lease.get_session_lease() or {}
-    # #702: when the caller supplies no owner evidence, consult the durable
-    # session-lease shadow; an explicitly passed value always wins.
-    if owner_process_alive is None:
-        owner_process_alive = reviewer_pr_lease.assess_crashed_session_lease_orphan(
-            reviewer_pr_lease.load_session_lease_shadow(
-                session_id=(lease or {}).get("session_id")
-            ),
-            lease=lease,
-        ).get("owner_process_alive")
-    assessment = reviewer_pr_lease.assess_obsolete_reviewer_comment_lease_cleanup(
-        comments,
-        pr_number=pr_number,
-        current_head_sha=current_head_sha,
-        formal_reviews=formal_reviews,
-        repo=expected_repo,
-        expected_repo=expected_repo,
-        requesting_session_id=(session.get("session_id") or "").strip() or None,
-        controller_recovery_authorized=controller_recovery_authorized,
-        worktree_exists=worktree_exists,
-        worktree_clean=worktree_clean,
-        worktree_has_unpreserved_work=worktree_has_unpreserved_work,
-        owner_process_alive=owner_process_alive,
-        owner_pid_observed=None,
-        requesting_pid=os.getpid(),
-        current_head_review_in_progress=current_head_review_in_progress,
-        expected_lease_comment_id=expected_lease_comment_id,
-        expected_session_id=expected_session_id,
-        expected_leased_head=expected_leased_head,
-        confirmation=confirmation,
-        apply=apply,
-    )
-
-    report = {
-        "success": True,
-        "pr_number": pr_number,
-        "pr_state": pr_live.get("state"),
-        "cleanup_allowed": assessment.get("cleanup_allowed"),
-        "cleanup_performed": False,
-        "classification": assessment.get("classification"),
-        "blocker_kind": assessment.get("blocker_kind"),
-        "exact_next_action": assessment.get("exact_next_action"),
-        "mutation_eligibility": assessment.get("mutation_eligibility"),
-        "leased_head": assessment.get("leased_head"),
-        "current_head": assessment.get("current_head"),
-        "expires_at": assessment.get("expires_at"),
-        "terminal_review": assessment.get("terminal_review"),
-        "worktree_state": assessment.get("worktree_state"),
-        "owner_session_evidence": assessment.get("owner_session_evidence"),
-        "cleanup_tool": assessment.get("cleanup_tool"),
-        "required_confirmation": assessment.get("required_confirmation"),
-        "active_lease": assessment.get("active_lease"),
-        "no_steal_or_adoption": True,
-        "no_repoint": True,
-        "no_validation_transfer": True,
-        "mode": "apply" if apply else "read_only",
-        "reasons": assessment.get("reasons") or [],
-        "forbidden": assessment.get("forbidden") or [],
-    }
-
-    if not apply:
-        return report
-    if not assessment.get("cleanup_allowed"):
-        report["success"] = False
-        report["cleanup_skipped_reason"] = (
-            assessment.get("fail_closed_reasons")
-            or assessment.get("reasons")
-            or ["cleanup not allowed"]
-        )
-        return report
-
-    comment_block = _profile_operation_gate("gitea.pr.comment")
-    if comment_block:
-        report["success"] = False
-        report["reasons"] = comment_block
-        report["permission_report"] = _permission_block_report("gitea.pr.comment")
-        return report
-
-    verify_preflight_purity(remote)
-    # Terminal lease marker (preserves history; does not delete comment 10749-style
-    # entries — newest released marker neutralises the ledger).
-    release_body = assessment.get("release_body") or ""
-    audit_body = assessment.get("audit_comment_body") or ""
-    comment_url = f"{repo_api_url(h, o, r)}/issues/{pr_number}/comments"
-    with _audited(
-        "comment_pr",
-        host=h,
-        remote=remote,
-        org=o,
-        repo=r,
-        pr_number=pr_number,
-        request_metadata={
-            "source": "cleanup_obsolete_reviewer_comment_lease",
-            "classification": assessment.get("classification"),
-        },
-    ):
-        posted_release = api_request(
-            "POST", comment_url, auth, {"body": release_body}
-        )
-        posted_audit = None
-        if audit_body.strip():
-            posted_audit = api_request(
-                "POST", comment_url, auth, {"body": audit_body}
-            )
-
-    # Never seed session lease from cleaned foreign lease.
-    report["cleanup_performed"] = True
-    report["released_comment_id"] = (posted_release or {}).get("id")
-    report["audit_comment_id"] = (posted_audit or {}).get("id")
-    report["session_lease_seeded"] = False
-    return report
-
-
 @mcp.tool()
 def gitea_release_reviewer_pr_lease(
     pr_number: int,
@@ -10301,17 +9936,6 @@ def gitea_get_runtime_context(
             PROJECT_ROOT),
     }
 
-    # #702: read-only visibility into the inherited GITEA_ACTIVE_WORKTREE
-    # binding; recovery itself runs during capability resolution.
-    try:
-        stale_binding = _assess_stale_active_binding(auto_recover=False)
-        if stale_binding.get("classification") != (
-            stale_binding_recovery.CLASSIFICATION_UNBOUND
-        ):
-            result["stale_binding_recovery"] = stale_binding
-    except Exception:
-        pass
-
     parity = _current_master_parity()
     result["master_parity"] = {
         "in_parity": parity["in_parity"],
@@ -11706,6 +11330,8 @@ def gitea_resolve_task_capability(
         "gitea_commit_files",
         "address_pr_change_requests",
         "delete_branch",
+        "cleanup_merged_pr_branch",
+        "reconciliation_cleanup",
         "work_issue",
         "work-issue",
     }
@@ -11745,18 +11371,6 @@ def gitea_resolve_task_capability(
                 "exact_safe_next_action": next_safe_action,
             }
 
-    # #702 F1: validate (and, when provably stale, recover) the inherited
-    # GITEA_ACTIVE_WORKTREE binding BEFORE the terminal launcher probe. The
-    # probe uses that binding as its cwd; a worktree removed mid-session
-    # would otherwise wedge every mutation-task resolution on 'missing cwd'
-    # before the sanctioned recovery could ever run. Recovery stays
-    # fail-closed: only the provably-stale classes clear, with the durable
-    # audit record persisted first (F6).
-    try:
-        stale_binding = _assess_stale_active_binding(auto_recover=True)
-    except Exception:
-        stale_binding = None
-
     # ── Terminal Launcher Preflight Check (#556) ──
     if task in native_mcp_preference.GITEA_MUTATION_TASKS:
         in_test = _preflight_in_test_mode()
@@ -11780,7 +11394,7 @@ def gitea_resolve_task_capability(
                         "Do not attempt git/pytest finalization or unsafe fallbacks. "
                         "Run gitea_diagnose_terminal, emit blocked-diagnose-report, and stop."
                     )
-                    blocked_result = {
+                    return {
                         "requested_task": task,
                         "required_operation_permission": required_permission,
                         "required_role_kind": required_role,
@@ -11800,11 +11414,6 @@ def gitea_resolve_task_capability(
                         "different_mcp_namespace_required": False,
                         "exact_safe_next_action": next_safe_action,
                     }
-                    if stale_binding is not None and stale_binding.get(
-                        "classification"
-                    ) != stale_binding_recovery.CLASSIFICATION_UNBOUND:
-                        blocked_result["stale_binding_recovery"] = stale_binding
-                    return blocked_result
 
     record_preflight_check("capability", required_role, resolved_task=task)
 
@@ -11994,10 +11603,6 @@ def gitea_resolve_task_capability(
         "different_mcp_namespace_required": different_namespace_required,
         "exact_safe_next_action": next_safe_action,
     }
-    if stale_binding is not None and stale_binding.get("classification") != (
-        stale_binding_recovery.CLASSIFICATION_UNBOUND
-    ):
-        result["stale_binding_recovery"] = stale_binding
     if reason_msg:
         result["reason"] = reason_msg
     if task in ("review_pr", "merge_pr"):
@@ -12873,11 +12478,4 @@ if __name__ == "__main__":
     # processes (e.g. review_pr.py) can detect and refuse profile
     # side-channel overrides (#199).
     _export_session_profile_lock()
-    # #702: an auto-reconnected daemon inherits GITEA_ACTIVE_WORKTREE from its
-    # parent environment. Validate it at boot and clear it only when provably
-    # stale (missing path); anything less certain is surfaced, not cleared.
-    try:
-        _assess_stale_active_binding(auto_recover=True)
-    except Exception:
-        pass
     mcp.run(transport="stdio")

mcp_native_cleanup_proof.py

@@ -13,7 +13,6 @@ from typing import Any
 
 AUTHORIZED_CLEANUP_TOOLS = frozenset({
     "gitea_cleanup_post_merge_moot_lease",
-    "gitea_cleanup_obsolete_reviewer_comment_lease",
     "gitea_reconcile_merged_cleanups",
     "gitea_delete_branch",
     "gitea_cleanup_merged_pr_branch",

mcp_session_state.py

@@ -36,25 +36,6 @@ KIND_REVIEW_DRAFT = "review_draft"
 # other session proofs; a contaminated session fails closed on gated mutations
 # until a reconciler audits and clears it.
 KIND_STABLE_BRANCH_CONTAMINATION = "stable_branch_contamination"
-# Durable shadow of the in-memory reviewer session lease (#702). Written on
-# every sanctioned record/heartbeat and removed on sanctioned clear, so a
-# daemon that dies without teardown leaves provable orphan evidence (owner
-# pid + session id) for the guarded lease-cleanup path. Never a substitute
-# for the in-session lease: mutation gates ignore it.
-KIND_REVIEWER_SESSION_LEASE = "reviewer_session_lease"
-# Durable audit record written whenever the daemon's sanctioned stale-binding
-# recovery clears an inherited GITEA_ACTIVE_WORKTREE binding (#702).
-KIND_STALE_BINDING_RECOVERY = "stale_binding_recovery"
-
-# Kinds that carry recovery-critical crash-orphan evidence (#702). They are
-# exempt from TTL expiry: a crashed daemon can never refresh its own record,
-# so a wall-clock TTL would silently destroy the only owner-exit proof the
-# guarded cleanup path accepts. These records live until a sanctioned clear
-# terminally reconciles them (durable lifecycle), never until a timer fires.
-RECOVERY_CRITICAL_KINDS = frozenset({
-    KIND_REVIEWER_SESSION_LEASE,
-    KIND_STALE_BINDING_RECOVERY,
-})
 
 
 
@@ -105,7 +86,6 @@ def state_key(
     org: str | None = None,
     repo: str | None = None,
     profile_identity: str | None = None,
-    instance_id: str | None = None,
 ) -> str:
     """Build durable filename key.
 
@@ -113,20 +93,17 @@ def state_key(
     so the primary key is kind + profile identity. Remote/org/repo are stored
     inside the payload and validated on load (#559), which lets a later daemon
     process recover state without already knowing the remote argument.
-
-    *instance_id* extends the key for kinds where one-per-profile collides —
-    concurrent same-profile sessions each own their reviewer-lease shadow
-    (#702 F5), keyed by their lease session id so a later heartbeat can never
-    overwrite or misattribute another session's crash evidence.
     """
     # Keep remote/org/repo parameters for API stability / future kinds; they are
     # intentionally not part of the filename for session-scoped proofs.
     _ = (remote, org, repo)
-    parts = [kind, profile_identity or "unknown-profile"]
-    instance = (instance_id or "").strip()
-    if instance:
-        parts.append(instance)
-    return "-".join(_sanitize_segment(part) for part in parts)
+    return "-".join(
+        _sanitize_segment(part)
+        for part in (
+            kind,
+            profile_identity or "unknown-profile",
+        )
+    )
 
 
 def state_file_path(
@@ -137,7 +114,6 @@ def state_file_path(
     repo: str | None = None,
     profile_identity: str | None = None,
     state_dir: str | None = None,
-    instance_id: str | None = None,
 ) -> str:
     root = (state_dir or default_state_dir()).strip()
     name = state_key(
@@ -146,7 +122,6 @@ def state_file_path(
         org=org,
         repo=repo,
         profile_identity=profile_identity,
-        instance_id=instance_id,
     )
     return os.path.join(root, f"{name}.json")
 
@@ -267,12 +242,10 @@ def identity_match_reasons(
         reasons.append("session state missing recorded_at timestamp (fail closed)")
     else:
         age = _now_utc() - recorded_at
-        record_kind = (str(record.get("kind") or "")).strip()
         if age > timedelta(hours=ttl_hours()):
-            if record_kind not in RECOVERY_CRITICAL_KINDS:
-                reasons.append(
-                    f"session state expired after {ttl_hours():g}h (fail closed)"
-                )
+            reasons.append(
+                f"session state expired after {ttl_hours():g}h (fail closed)"
+            )
         if age < timedelta(0):
             reasons.append("session state recorded_at is in the future (fail closed)")
     return reasons
@@ -286,7 +259,6 @@ def load_state(
     repo: str | None = None,
     profile_identity: str | None = None,
     state_dir: str | None = None,
-    instance_id: str | None = None,
 ) -> dict[str, Any] | None:
     """Load durable state payload when identity checks pass."""
     profile = current_profile_identity(profile_identity=profile_identity)
@@ -297,7 +269,6 @@ def load_state(
         repo=repo,
         profile_identity=profile,
         state_dir=state_dir,
-        instance_id=instance_id,
     )
     lock_path = f"{path}.lock"
     with _exclusive_file_lock(lock_path):
@@ -343,7 +314,6 @@ def save_state(
     repo: str | None = None,
     profile_identity: str | None = None,
     state_dir: str | None = None,
-    instance_id: str | None = None,
 ) -> dict[str, Any] | None:
     """Persist or clear durable state for the given session identity key."""
     profile = current_profile_identity(
@@ -365,7 +335,6 @@ def save_state(
         repo=key_repo,
         profile_identity=profile,
         state_dir=root,
-        instance_id=instance_id,
     )
     lock_path = f"{path}.lock"
     with _exclusive_file_lock(lock_path):
@@ -387,8 +356,6 @@ def save_state(
             body["session_profile_lock"] = profile
         body["recorded_at"] = body.get("recorded_at") or now
         body["updated_at"] = now
-        if (instance_id or "").strip():
-            body["instance_id"] = instance_id.strip()
         if key_remote is not None:
             body["remote"] = key_remote
         if key_org is not None:
@@ -420,7 +387,6 @@ def clear_state(
     repo: str | None = None,
     profile_identity: str | None = None,
     state_dir: str | None = None,
-    instance_id: str | None = None,
 ) -> None:
     save_state(
         kind=kind,
@@ -430,56 +396,4 @@ def clear_state(
         repo=repo,
         profile_identity=profile_identity,
         state_dir=state_dir,
-        instance_id=instance_id,
     )
-
-
-def list_states(
-    *,
-    kind: str,
-    profile_identity: str | None = None,
-    state_dir: str | None = None,
-) -> list[dict[str, Any]]:
-    """Enumerate durable records of *kind* across all instance keys.
-
-    Crash recovery cannot know which session id left a shadow behind, so it
-    must be able to enumerate every record of a kind (#702 F5). Identity
-    checks (profile / TTL policy) apply per record exactly as in
-    :func:`load_state`; records that fail closed are omitted.
-    """
-    root = (state_dir or default_state_dir()).strip()
-    if not root or not os.path.isdir(root):
-        return []
-    profile = current_profile_identity(profile_identity=profile_identity)
-    results: list[dict[str, Any]] = []
-    try:
-        names = sorted(os.listdir(root))
-    except OSError:
-        return []
-    for name in names:
-        if not name.endswith(".json") or name.startswith("."):
-            continue
-        envelope = _read_json(os.path.join(root, name))
-        if not envelope or envelope.get("kind") != kind:
-            continue
-        payload = envelope.get("payload")
-        if not isinstance(payload, dict):
-            continue
-        merged = dict(payload)
-        for key in (
-            "kind",
-            "remote",
-            "org",
-            "repo",
-            "profile_identity",
-            "session_profile_lock",
-            "recorded_at",
-            "updated_at",
-            "writer_pid",
-        ):
-            if key in envelope and key not in merged:
-                merged[key] = envelope[key]
-        if identity_match_reasons(merged, profile_identity=profile):
-            continue
-        results.append(merged)
-    return results

migrate_profiles.py

@@ -20,12 +20,114 @@ if PROJECT_ROOT not in sys.path:
 import gitea_config
 
 
-AUTHOR_DEFAULT_ALLOWED = ["read", "branch", "commit", "push", "open_pr", "comment"]
-AUTHOR_DEFAULT_FORBIDDEN = ["approve", "request_changes", "merge"]
-REVIEWER_DEFAULT_ALLOWED = [
-    "read", "review", "comment", "approve", "request_changes", "merge"
+# Defaults emit *canonical* operation names only. Shorthand that is not in
+# gitea_config.GITEA_OPERATION_ALIASES (e.g. ``pr.close``, ``issue.close``)
+# is silently dropped by the production loader and must never appear here.
+AUTHOR_DEFAULT_ALLOWED = [
+    "gitea.read",
+    "gitea.branch.create",
+    "gitea.repo.commit",
+    "gitea.branch.push",
+    "gitea.pr.create",
+    "gitea.pr.comment",
 ]
-REVIEWER_DEFAULT_FORBIDDEN = ["branch", "commit", "push", "open_pr"]
+AUTHOR_DEFAULT_FORBIDDEN = [
+    "gitea.pr.approve",
+    "gitea.pr.request_changes",
+    "gitea.pr.merge",
+]
+REVIEWER_DEFAULT_ALLOWED = [
+    "gitea.read",
+    "gitea.pr.review",
+    "gitea.pr.comment",
+    "gitea.pr.approve",
+    "gitea.pr.request_changes",
+    "gitea.pr.merge",
+]
+REVIEWER_DEFAULT_FORBIDDEN = [
+    "gitea.branch.create",
+    "gitea.repo.commit",
+    "gitea.branch.push",
+    "gitea.pr.create",
+]
+# Required reconciler ops (read + pr.close) plus recommended comment/close and
+# branch.delete for guarded merged-PR cleanup. All names must normalize via
+# gitea_config.normalize_operation without being dropped.
+RECONCILER_DEFAULT_ALLOWED = [
+    "gitea.read",
+    "gitea.pr.close",
+    "gitea.pr.comment",
+    "gitea.issue.comment",
+    "gitea.issue.close",
+    "gitea.branch.delete",
+]
+RECONCILER_DEFAULT_FORBIDDEN = [
+    "gitea.pr.approve",
+    "gitea.pr.merge",
+    "gitea.pr.review",
+    "gitea.pr.create",
+    "gitea.branch.push",
+    "gitea.repo.commit",
+]
+
+# Migration-only expansions for common shorthands that are *not* in
+# GITEA_OPERATION_ALIASES. Emitted output is always the canonical form so a
+# second canonicalize pass is a no-op (idempotent).
+_MIGRATION_ONLY_ALIASES = {
+    "pr.close": "gitea.pr.close",
+    "pr.comment": "gitea.pr.comment",
+    "issue.close": "gitea.issue.close",
+    "branch.delete": "gitea.branch.delete",
+}
+
+# Reconciler required ops that must survive migration (from reconciler_profile).
+RECONCILER_REQUIRED_CANONICAL = ("gitea.read", "gitea.pr.close")
+
+
+def canonicalize_operation(op: str) -> str:
+    """Return a canonical operation name accepted by the production loader.
+
+    Fail closed on unknown/ambiguous spellings so required permissions cannot
+    be silently dropped by ``check_operation`` later.
+    """
+    if not isinstance(op, str) or not op.strip():
+        raise ValueError("operation must be a non-empty string (fail closed)")
+    op = op.strip()
+    try:
+        return gitea_config.normalize_operation(op)
+    except gitea_config.ConfigError:
+        pass
+    if op in _MIGRATION_ONLY_ALIASES:
+        return _MIGRATION_ONLY_ALIASES[op]
+    raise ValueError(
+        f"operation {op!r} cannot be canonicalized for migration "
+        "(unknown/ambiguous; fail closed — production loader would drop it)"
+    )
+
+
+def canonicalize_operations(ops, *, context: str = "operations") -> list[str]:
+    """Canonicalize a list of operations; preserve order, drop duplicates."""
+    if not isinstance(ops, list):
+        raise ValueError(f"{context} must be a list (fail closed)")
+    out: list[str] = []
+    seen: set[str] = set()
+    for entry in ops:
+        canon = canonicalize_operation(entry)
+        if canon not in seen:
+            seen.add(canon)
+            out.append(canon)
+    return out
+
+
+def _assert_reconciler_required_survive(allowed: list[str], profile_name: str) -> None:
+    """Fail visibly when migration would leave a reconciler without required ops."""
+    missing = [op for op in RECONCILER_REQUIRED_CANONICAL if op not in set(allowed)]
+    if missing:
+        raise ValueError(
+            f"Profile '{profile_name}' (reconciler) is missing required "
+            f"operation(s) after migration: {missing}. Refusing to emit a "
+            "profile that would silently fail pr.close / read (fail closed)."
+        )
 
 
 def infer_role(name, execution_profile):
@@ -90,9 +192,11 @@ def migrate_v1_to_v2(v1_data):
             ident_name = "reviewer"
         elif role == "author":
             ident_name = "author"
+        elif role == "reconciler":
+            ident_name = "reconciler"
         else:
             role = prof.get("role")
-            if role not in (None, "author", "reviewer"):
+            if role not in (None, "author", "reviewer", "reconciler"):
                 raise ValueError(
                     f"Profile '{name}' has unsupported role {role!r}"
                 )
@@ -124,20 +228,35 @@ def migrate_v1_to_v2(v1_data):
                 raise ValueError(
                     f"Profile '{name}' operation fields must be lists"
                 )
-            identity_data["allowed_operations"] = list(allowed)
-            identity_data["forbidden_operations"] = list(forbidden)
+            try:
+                identity_data["allowed_operations"] = canonicalize_operations(
+                    allowed, context=f"profile '{name}' allowed_operations"
+                )
+                identity_data["forbidden_operations"] = canonicalize_operations(
+                    forbidden, context=f"profile '{name}' forbidden_operations"
+                )
+            except ValueError as exc:
+                raise ValueError(f"Profile '{name}': {exc}") from exc
         elif role == "author":
             identity_data["allowed_operations"] = list(AUTHOR_DEFAULT_ALLOWED)
             identity_data["forbidden_operations"] = list(AUTHOR_DEFAULT_FORBIDDEN)
         elif role == "reviewer":
             identity_data["allowed_operations"] = list(REVIEWER_DEFAULT_ALLOWED)
             identity_data["forbidden_operations"] = list(REVIEWER_DEFAULT_FORBIDDEN)
+        elif role == "reconciler":
+            identity_data["allowed_operations"] = list(RECONCILER_DEFAULT_ALLOWED)
+            identity_data["forbidden_operations"] = list(RECONCILER_DEFAULT_FORBIDDEN)
         else:
             raise ValueError(
                 f"Profile '{name}' has no explicit operation lists and no "
                 "unambiguous author/reviewer role marker (fail closed)"
             )
 
+        if role == "reconciler":
+            _assert_reconciler_required_survive(
+                identity_data["allowed_operations"], name
+            )
+
         # Nest inside environments/services structure
         env = environments.setdefault(env_name, {})
         services = env.setdefault("services", {})

namespace_workspace_binding.py

@@ -56,46 +56,23 @@ def resolve_namespace_workspace(
     env: dict[str, str] | os._Environ | None = None,
     session_lease_worktree: str | None = None,
     profile_name: str | None = None,
-    demotions: list[str] | None = None,
-    verify_paths: bool = False,
 ) -> tuple[str, str]:
-    """Return ``(resolved_path, binding_source)`` for *role_kind*.
-
-    With *verify_paths*, env-sourced candidates whose path no longer exists
-    are demoted (#702): a binding to a deleted worktree can never name a
-    valid task workspace, so resolution falls through to the next candidate.
-    Explicit arguments are never demoted — a caller-declared path must fail
-    loudly downstream rather than silently rebind. Demotion notes are
-    appended to *demotions* when provided. Runtime-context and mutation
-    guards resolve through :func:`resolve_namespace_mutation_context`, which
-    always verifies.
-    """
+    """Return ``(resolved_path, binding_source)`` for *role_kind*."""
     env_map = env if env is not None else os.environ
     role = normalize_role_kind(role_kind, profile_name=profile_name)
     role_env_key = ROLE_WORKTREE_ENVS[role]
 
-    for candidate, source, env_sourced in (
-        (worktree_path, "worktree_path argument", False),
-        (worktree, "worktree argument", False),
-        (_env_value(env_map, ACTIVE_WORKTREE_ENV),
-         f"{ACTIVE_WORKTREE_ENV} environment variable", True),
-        (_env_value(env_map, role_env_key),
-         f"{role_env_key} environment variable", True),
+    for candidate, source in (
+        (worktree_path, "worktree_path argument"),
+        (worktree, "worktree argument"),
+        (_env_value(env_map, ACTIVE_WORKTREE_ENV), f"{ACTIVE_WORKTREE_ENV} environment variable"),
+        (_env_value(env_map, role_env_key), f"{role_env_key} environment variable"),
         (session_lease_worktree if role in {"reviewer", "merger"} else None,
-         "reviewer PR lease worktree", False),
+         "reviewer PR lease worktree"),
     ):
         text = (candidate or "").strip()
-        if not text:
-            continue
-        real = os.path.realpath(os.path.abspath(text))
-        if verify_paths and env_sourced and not os.path.isdir(real):
-            if demotions is not None:
-                demotions.append(
-                    f"{source} '{real}' demoted: path no longer exists "
-                    "(stale binding, #702)"
-                )
-            continue
-        return real, source
+        if text:
+            return os.path.realpath(os.path.abspath(text)), source
 
     return os.path.realpath(process_project_root), "MCP server process root (default)"
 
@@ -111,7 +88,6 @@ def resolve_namespace_mutation_context(
     profile_name: str | None = None,
 ) -> dict:
     """Shared workspace resolution for runtime_context and mutation guards."""
-    demotions: list[str] = []
     workspace, binding_source = resolve_namespace_workspace(
         role_kind=role_kind,
         worktree_path=worktree_path,
@@ -120,8 +96,6 @@ def resolve_namespace_mutation_context(
         env=env,
         session_lease_worktree=session_lease_worktree,
         profile_name=profile_name,
-        demotions=demotions,
-        verify_paths=True,
     )
     process_root = os.path.realpath(process_project_root)
     role = normalize_role_kind(role_kind, profile_name=profile_name)
@@ -137,7 +111,7 @@ def resolve_namespace_mutation_context(
         "workspace_path": workspace,
         "workspace_binding_source": binding_source,
         "workspace_role_kind": role,
-        "ignored_bindings": demotions + (pollution.get("ignored_bindings") or []),
+        "ignored_bindings": pollution.get("ignored_bindings") or [],
         "process_project_root": process_root,
         "canonical_repo_root": canonical_root,
         "roots_aligned": canonical_root == process_root,

reconciler_profile.py

@@ -18,6 +18,11 @@ RECONCILER_RECOMMENDED_OPERATIONS = (
     "gitea.pr.comment",
     "gitea.issue.comment",
     "gitea.issue.close",
+    # Merged-branch cleanup is reconciler-owned (task_capability_map maps
+    # cleanup_merged_pr_branch -> reconciler). The permission is only
+    # exercisable through the guarded gitea_cleanup_merged_pr_branch path
+    # (#514): merged proof, protected-branch refusal, explicit confirmation.
+    "gitea.branch.delete",
 )
 
 RECONCILER_FORBIDDEN_OPERATIONS = (

stale_binding_recovery.py

@@ -1,257 +0,0 @@
-"""Sanctioned recovery for stale env-bound task workspace bindings (#702).
-
-When the MCP daemon dies from an unhandled exception it never runs teardown,
-and the auto-reconnected daemon inherits ``GITEA_ACTIVE_WORKTREE`` from its
-parent environment. That inherited value can permanently bind the fresh
-session to a prior task's worktree (the PR #701 / ``review-pr-654`` incident).
-
-This module classifies the active env binding against live session evidence
-and produces a fail-closed recovery plan. Only two situations permit the
-daemon to clear the binding on its own:
-
-- the bound path no longer exists on disk (``provably_stale_missing_path``)
-- the binding was inherited at daemon boot and a *sanctioned* in-session
-  reviewer/merger lease later bound a different worktree
-  (``superseded_by_session_lease``)
-
-Everything else is surfaced (``unverified_inherited``) and left for the
-managed reconnect path — never cleared silently, never rebound to a guessed
-worktree.
-"""
-
-from __future__ import annotations
-
-import os
-from typing import Any
-
-ACTIVE_WORKTREE_ENV = "GITEA_ACTIVE_WORKTREE"
-
-CLASSIFICATION_UNBOUND = "unbound"
-CLASSIFICATION_CORROBORATED = "corroborated"
-CLASSIFICATION_UNVERIFIED_INHERITED = "unverified_inherited"
-CLASSIFICATION_PROVABLY_STALE_MISSING_PATH = "provably_stale_missing_path"
-CLASSIFICATION_SUPERSEDED_BY_SESSION_LEASE = "superseded_by_session_lease"
-
-CLASSIFICATIONS = frozenset({
-    CLASSIFICATION_UNBOUND,
-    CLASSIFICATION_CORROBORATED,
-    CLASSIFICATION_UNVERIFIED_INHERITED,
-    CLASSIFICATION_PROVABLY_STALE_MISSING_PATH,
-    CLASSIFICATION_SUPERSEDED_BY_SESSION_LEASE,
-})
-
-# Roles whose task workspace is owned by a lease lifecycle, so an inherited
-# generic binding without a corroborating lease is suspect.
-LEASE_BOUND_ROLES = frozenset({"reviewer", "merger"})
-
-RECOVERY_ACTION_NONE = "none"
-RECOVERY_ACTION_CLEAR_ENV = "clear_env"
-
-
-def _norm(path: str | None) -> str:
-    text = (path or "").strip()
-    if not text:
-        return ""
-    return os.path.realpath(os.path.abspath(text))
-
-
-def snapshot_boot_bindings(
-    env: dict[str, str] | os._Environ | None = None,
-) -> dict[str, Any]:
-    """Capture worktree env bindings present when the daemon booted.
-
-    A value present in this snapshot was inherited from the parent
-    environment, not established by any sanctioned tool in this daemon's
-    lifetime.
-    """
-    env_map = env if env is not None else os.environ
-    return {
-        "active_worktree": (env_map.get(ACTIVE_WORKTREE_ENV) or "").strip() or None,
-    }
-
-
-def classify_active_worktree_binding(
-    *,
-    active_value: str | None,
-    role_env_value: str | None = None,
-    session_lease_worktree: str | None = None,
-    boot_inherited: bool,
-    path_exists: bool | None,
-    role_kind: str | None = None,
-) -> dict[str, Any]:
-    """Classify the GITEA_ACTIVE_WORKTREE binding against live evidence.
-
-    Fail closed: unknown evidence never yields a clear-eligible class.
-    """
-    reasons: list[str] = []
-    active = _norm(active_value)
-    if not active:
-        return {
-            "classification": CLASSIFICATION_UNBOUND,
-            "clear_eligible": False,
-            "active_worktree": None,
-            "reasons": ["no GITEA_ACTIVE_WORKTREE binding present"],
-        }
-
-    role = (role_kind or "").strip().lower()
-    role_env = _norm(role_env_value)
-    lease_wt = _norm(session_lease_worktree)
-
-    result: dict[str, Any] = {
-        "active_worktree": active,
-        "boot_inherited": bool(boot_inherited),
-        "role_kind": role or None,
-        "session_lease_worktree": lease_wt or None,
-        "role_env_worktree": role_env or None,
-    }
-
-    if path_exists is False:
-        reasons.append(
-            f"bound worktree '{active}' no longer exists on disk; the binding "
-            "cannot name a valid task workspace"
-        )
-        result.update({
-            "classification": CLASSIFICATION_PROVABLY_STALE_MISSING_PATH,
-            "clear_eligible": True,
-            "reasons": reasons,
-        })
-        return result
-
-    if lease_wt and lease_wt == active:
-        reasons.append("binding matches the sanctioned in-session lease worktree")
-        result.update({
-            "classification": CLASSIFICATION_CORROBORATED,
-            "clear_eligible": False,
-            "reasons": reasons,
-        })
-        return result
-
-    if lease_wt and lease_wt != active and boot_inherited:
-        reasons.append(
-            "boot-inherited binding disagrees with the sanctioned in-session "
-            f"lease worktree '{lease_wt}'; the lease is live authority"
-        )
-        result.update({
-            "classification": CLASSIFICATION_SUPERSEDED_BY_SESSION_LEASE,
-            "clear_eligible": True,
-            "reasons": reasons,
-        })
-        return result
-
-    if lease_wt and lease_wt != active and not boot_inherited:
-        # Set after boot by tooling; disagreement is surfaced, never auto-cleared.
-        reasons.append(
-            "post-boot binding disagrees with the in-session lease worktree; "
-            "surfacing only (fail closed, no automatic clear)"
-        )
-        result.update({
-            "classification": CLASSIFICATION_UNVERIFIED_INHERITED,
-            "clear_eligible": False,
-            "reasons": reasons,
-        })
-        return result
-
-    if role_env and role_env == active:
-        reasons.append("binding matches the role-specific worktree env binding")
-        result.update({
-            "classification": CLASSIFICATION_CORROBORATED,
-            "clear_eligible": False,
-            "reasons": reasons,
-        })
-        return result
-
-    if boot_inherited and role in LEASE_BOUND_ROLES and not lease_wt:
-        reasons.append(
-            "binding was inherited at daemon boot, no sanctioned in-session "
-            f"lease corroborates it, and the {role} role binds workspaces "
-            "through the lease lifecycle; treat as unverified until a fresh "
-            "lease or managed reconnect re-establishes the workspace"
-        )
-        result.update({
-            "classification": CLASSIFICATION_UNVERIFIED_INHERITED,
-            "clear_eligible": False,
-            "reasons": reasons,
-        })
-        return result
-
-    reasons.append("no contradicting evidence; binding treated as corroborated")
-    result.update({
-        "classification": CLASSIFICATION_CORROBORATED,
-        "clear_eligible": False,
-        "reasons": reasons,
-    })
-    return result
-
-
-def plan_recovery(classification_result: dict[str, Any]) -> dict[str, Any]:
-    """Turn a classification into an explicit, fail-closed recovery plan."""
-    classification = classification_result.get("classification")
-    clear_eligible = bool(classification_result.get("clear_eligible"))
-    reasons = list(classification_result.get("reasons") or [])
-
-    if classification not in CLASSIFICATIONS:
-        return {
-            "action": RECOVERY_ACTION_NONE,
-            "clear_allowed": False,
-            "classification": classification,
-            "reasons": reasons + ["unknown classification (fail closed)"],
-        }
-
-    if clear_eligible and classification in {
-        CLASSIFICATION_PROVABLY_STALE_MISSING_PATH,
-        CLASSIFICATION_SUPERSEDED_BY_SESSION_LEASE,
-    }:
-        return {
-            "action": RECOVERY_ACTION_CLEAR_ENV,
-            "clear_allowed": True,
-            "classification": classification,
-            "active_worktree": classification_result.get("active_worktree"),
-            "reasons": reasons,
-        }
-
-    exact_next_action = None
-    if classification == CLASSIFICATION_UNVERIFIED_INHERITED:
-        exact_next_action = (
-            "managed recovery required: reconnect the MCP namespace through "
-            "the managed client configuration (or start a fresh session) so "
-            "the daemon boots without the inherited GITEA_ACTIVE_WORKTREE, or "
-            "corroborate the binding by acquiring a lease for that worktree; "
-            "do not clear or rewrite the environment manually"
-        )
-    return {
-        "action": RECOVERY_ACTION_NONE,
-        "clear_allowed": False,
-        "classification": classification,
-        "active_worktree": classification_result.get("active_worktree"),
-        "reasons": reasons,
-        **({"exact_next_action": exact_next_action} if exact_next_action else {}),
-    }
-
-
-def apply_recovery(
-    plan: dict[str, Any],
-    env: dict[str, str] | os._Environ | None = None,
-) -> dict[str, Any]:
-    """Apply a clear-eligible plan by removing the stale env binding.
-
-    This is the sanctioned in-daemon mechanism (#702 AC2); callers must
-    persist the returned record for audit. Refuses anything but an explicit
-    ``clear_env`` plan.
-    """
-    env_map = env if env is not None else os.environ
-    if not plan.get("clear_allowed") or plan.get("action") != RECOVERY_ACTION_CLEAR_ENV:
-        return {
-            "performed": False,
-            "action": RECOVERY_ACTION_NONE,
-            "reasons": ["recovery plan does not authorize clearing (fail closed)"],
-        }
-    cleared_value = (env_map.get(ACTIVE_WORKTREE_ENV) or "").strip() or None
-    env_map.pop(ACTIVE_WORKTREE_ENV, None)
-    return {
-        "performed": True,
-        "action": RECOVERY_ACTION_CLEAR_ENV,
-        "cleared_env": ACTIVE_WORKTREE_ENV,
-        "cleared_value": cleared_value,
-        "classification": plan.get("classification"),
-        "reasons": list(plan.get("reasons") or []),
-    }

task_capability_map.py

@@ -76,16 +76,6 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.comment",
         "role": "reviewer",
     },
-    # #691: guarded non-owner cleanup of obsolete comment-backed reviewer leases.
-    # Apply path posts lease release + audit comments (gitea.pr.comment).
-    "cleanup_obsolete_reviewer_comment_lease": {
-        "permission": "gitea.pr.comment",
-        "role": "reviewer",
-    },
-    "gitea_cleanup_obsolete_reviewer_comment_lease": {
-        "permission": "gitea.pr.comment",
-        "role": "reviewer",
-    },
     "blind_pr_queue_review": {
         "permission": "gitea.pr.review",
         "role": "reviewer",

tests/test_audit_reconciliation_mode.py

@@ -27,7 +27,13 @@ from task_capability_map import required_permission, required_role
 
 DELETE_PROFILE = {
     "profile_name": "prgs-author-delete",
-    "allowed_operations": ["gitea.read", "gitea.branch.delete"],
+    "role": "author",
+    "allowed_operations": [
+        "gitea.read",
+        "gitea.pr.create",
+        "gitea.branch.push",
+        "gitea.branch.delete",
+    ],
     "forbidden_operations": [],
     "audit_label": "prgs-author-delete",
 }

tests/test_branch_cleanup_guard.py

@@ -8,10 +8,33 @@ import branch_cleanup_guard as guard  # noqa: E402
 import mcp_server  # noqa: E402
 import task_capability_map  # noqa: E402
 from final_report_validator import assess_final_report_validator  # noqa: E402
-from mcp_server import gitea_cleanup_merged_pr_branch  # noqa: E402
+from mcp_server import gitea_cleanup_merged_pr_branch, gitea_delete_branch  # noqa: E402
 
 FAKE_AUTH = "token fake"
 
+# Reconciler-shaped profile that holds branch.delete (recommended) plus
+# required pr.close/read so _role_kind classifies as reconciler.
+RECONCILER_WITH_DELETE = {
+    "profile_name": "prgs-reconciler",
+    "role": "reconciler",
+    "allowed_operations": [
+        "gitea.read",
+        "gitea.pr.close",
+        "gitea.pr.comment",
+        "gitea.issue.comment",
+        "gitea.issue.close",
+        "gitea.branch.delete",
+    ],
+    "forbidden_operations": [
+        "gitea.pr.approve",
+        "gitea.pr.merge",
+        "gitea.pr.review",
+        "gitea.pr.create",
+        "gitea.branch.push",
+        "gitea.repo.commit",
+    ],
+}
+
 
 class TestRawBranchDeleteGuard(unittest.TestCase):
     def test_detects_local_and_remote_raw_git_delete_commands(self):
@@ -93,14 +116,48 @@ class TestMergedPrBranchCleanupTool(unittest.TestCase):
         self.assertEqual(res["required_permission"], "gitea.branch.delete")
         self.mock_api.assert_not_called()
 
+    def test_author_and_merger_without_delete_authority_fail_closed(self):
+        role_profiles = {
+            "author": [
+                "gitea.read",
+                "gitea.branch.create",
+                "gitea.branch.push",
+                "gitea.repo.commit",
+                "gitea.pr.create",
+            ],
+            "merger": ["gitea.read", "gitea.pr.merge"],
+        }
+        for name, allowed in role_profiles.items():
+            with self.subTest(role=name):
+                profile_patch = patch(
+                    "mcp_server.get_profile",
+                    return_value={
+                        "profile_name": name,
+                        "allowed_operations": allowed,
+                        "forbidden_operations": [],
+                    },
+                )
+                profile_patch.start()
+                try:
+                    res = gitea_cleanup_merged_pr_branch(
+                        pr_number=487,
+                        confirmation="CLEANUP MERGED PR 487 BRANCH feat/branch",
+                        branch="feat/branch",
+                        remote="prgs",
+                        worktree_path="/tmp/repo/branches/cleanup",
+                    )
+                finally:
+                    profile_patch.stop()
+                self.assertFalse(res["performed"])
+                self.assertEqual(
+                    res["required_permission"], "gitea.branch.delete"
+                )
+                self.mock_api.assert_not_called()
+
     def test_root_checkout_cleanup_fails_closed(self):
         patch(
             "mcp_server.get_profile",
-            return_value={
-                "profile_name": "branch-cleanup",
-                "allowed_operations": ["gitea.read", "gitea.branch.delete"],
-                "forbidden_operations": [],
-            },
+            return_value=dict(RECONCILER_WITH_DELETE),
         ).start()
         res = gitea_cleanup_merged_pr_branch(
             pr_number=487,
@@ -117,11 +174,7 @@ class TestMergedPrBranchCleanupTool(unittest.TestCase):
         branch = "feat/issue-485-lease-comments-non-list-guard"
         patch(
             "mcp_server.get_profile",
-            return_value={
-                "profile_name": "branch-cleanup",
-                "allowed_operations": ["gitea.read", "gitea.branch.delete"],
-                "forbidden_operations": [],
-            },
+            return_value=dict(RECONCILER_WITH_DELETE),
         ).start()
         self.mock_api.side_effect = [
             {
@@ -152,11 +205,7 @@ class TestMergedPrBranchCleanupTool(unittest.TestCase):
         branch = "feat/issue-485-lease-comments-non-list-guard"
         patch(
             "mcp_server.get_profile",
-            return_value={
-                "profile_name": "branch-cleanup",
-                "allowed_operations": ["gitea.read", "gitea.branch.delete"],
-                "forbidden_operations": [],
-            },
+            return_value=dict(RECONCILER_WITH_DELETE),
         ).start()
         self.mock_api.side_effect = [
             {
@@ -182,6 +231,168 @@ class TestMergedPrBranchCleanupTool(unittest.TestCase):
         ]
         self.assertFalse(delete_calls)
 
+    def test_reconciler_with_branch_delete_cannot_raw_delete(self):
+        """#687: reconciler + gitea.branch.delete still cannot call raw delete."""
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+        res = gitea_delete_branch(
+            branch="fix/issue-683-workflow-guard-hardening",
+            remote="prgs",
+        )
+        self.assertFalse(res.get("success", True))
+        self.assertFalse(res.get("performed", True))
+        reasons = " ".join(res.get("reasons") or [])
+        self.assertIn("raw gitea_delete_branch", reasons)
+        self.assertIn("cleanup_merged_pr_branch", reasons)
+        self.mock_api.assert_not_called()
+
+    def test_reconciler_raw_delete_denies_preservation_branch(self):
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+        res = gitea_delete_branch(
+            branch="chore/issue-681-preserve-review-session-wip",
+            remote="prgs",
+        )
+        self.assertFalse(res.get("performed", True))
+        self.mock_api.assert_not_called()
+
+    def test_author_with_branch_delete_role_ok_but_preserve_blocked(self):
+        """Author role may use raw delete path when permitted; preserve fails closed."""
+        patch(
+            "mcp_server.get_profile",
+            return_value={
+                "profile_name": "prgs-author",
+                "role": "author",
+                "allowed_operations": [
+                    "gitea.read",
+                    "gitea.pr.create",
+                    "gitea.branch.push",
+                    "gitea.branch.delete",
+                ],
+                "forbidden_operations": ["gitea.pr.approve", "gitea.pr.merge"],
+            },
+        ).start()
+        res = gitea_delete_branch(
+            branch="chore/issue-681-preserve-review-session-wip",
+            remote="prgs",
+        )
+        self.assertFalse(res.get("performed", True))
+        self.assertIn("preservation", " ".join(res.get("reasons") or []))
+        self.mock_api.assert_not_called()
+
+    def test_unmerged_branch_cleanup_rejected(self):
+        branch = "feat/unmerged-work"
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+        self.mock_api.side_effect = [
+            {
+                "number": 999,
+                "merged": False,
+                "merged_at": None,
+                "head": {"ref": branch, "sha": "b" * 40},
+                "base": {"ref": "master"},
+            },
+            {},
+        ]
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=999,
+            confirmation=f"CLEANUP MERGED PR 999 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res["performed"])
+        self.assertTrue(
+            any("not merged" in r for r in (res.get("reasons") or []))
+        )
+        delete_calls = [
+            call for call in self.mock_api.call_args_list if call.args[0] == "DELETE"
+        ]
+        self.assertFalse(delete_calls)
+
+    def test_preservation_branch_cleanup_rejected(self):
+        branch = "chore/issue-681-preserve-review-session-wip"
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+        self.mock_api.side_effect = [
+            {
+                "number": 681,
+                "merged": True,
+                "merged_at": "2026-07-08T01:00:00Z",
+                "head": {"ref": branch, "sha": "c" * 40},
+                "base": {"ref": "master"},
+            },
+            {},
+        ]
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=681,
+            confirmation=f"CLEANUP MERGED PR 681 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res["performed"])
+        self.assertTrue(
+            any("preservation" in r for r in (res.get("reasons") or []))
+        )
+        delete_calls = [
+            call for call in self.mock_api.call_args_list if call.args[0] == "DELETE"
+        ]
+        self.assertFalse(delete_calls)
+
+    def test_non_reconciler_with_delete_denied_cleanup(self):
+        patch(
+            "mcp_server.get_profile",
+            return_value={
+                "profile_name": "prgs-author",
+                "role": "author",
+                "allowed_operations": [
+                    "gitea.read",
+                    "gitea.pr.create",
+                    "gitea.branch.push",
+                    "gitea.branch.delete",
+                ],
+                "forbidden_operations": [],
+            },
+        ).start()
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation="CLEANUP MERGED PR 487 BRANCH feat/branch",
+            branch="feat/branch",
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res["performed"])
+        self.assertEqual(res.get("required_role_kind"), "reconciler")
+        self.mock_api.assert_not_called()
+
+    def test_assess_guard_rejects_preservation_branch(self):
+        assessment = guard.assess_merged_pr_branch_cleanup(
+            pr_number=681,
+            head_branch="chore/issue-681-preserve-review-session-wip",
+            merged=True,
+            remote_branch_exists=True,
+            open_pr_heads=set(),
+            head_on_target=True,
+            delete_capability_allowed=True,
+            confirmation=(
+                "CLEANUP MERGED PR 681 BRANCH "
+                "chore/issue-681-preserve-review-session-wip"
+            ),
+        )
+        self.assertFalse(assessment["safe_to_delete"])
+        self.assertTrue(
+            any("preservation" in r for r in assessment["block_reasons"])
+        )
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_issue_691_obsolete_reviewer_lease_cleanup.py

@@ -1,616 +0,0 @@
-"""Guarded cleanup for obsolete comment-backed reviewer leases (#691).
-
-Reproduces PR #688 lease comment 10749 class of defect: completed
-REQUEST_CHANGES on head A, author pushes head B, foreign lease remains
-pinned to A (and after expiry still has no non-owner cleanup path that
-diagnosis can prescribe beyond indefinite wait).
-"""
-
-from __future__ import annotations
-
-import sys
-import unittest
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from unittest.mock import patch
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-import merger_lease_adoption as mla  # noqa: E402
-import reviewer_pr_lease as leases  # noqa: E402
-
-# PR #688 / comment 10749 reproduction fixtures
-HEAD_A = "c7a444eb4b41cf916fdbd20a4999ffd78af496d0"
-HEAD_B = "4a6357800364718a27a36ebc73578d4b929ff4aa"
-SESSION_FOREIGN = "25883-7d4c6e6ebd53"
-COMMENT_10749 = 10749
-REPO = "Scaled-Tech-Consulting/Gitea-Tools"
-PR = 688
-ISSUE = 687
-EXPIRES_10749 = "2026-07-13T04:23:00Z"
-
-
-def _utc(dt: datetime) -> datetime:
-    return dt if dt.tzinfo else dt.replace(tzinfo=timezone.utc)
-
-
-def _lease_comment(
-    *,
-    pr_number: int = PR,
-    session_id: str = SESSION_FOREIGN,
-    phase: str = "claimed",
-    candidate_head: str = HEAD_A,
-    comment_id: int = COMMENT_10749,
-    last_activity: datetime | None = None,
-    expires_at: datetime | None = None,
-    worktree: str = "branches/review-pr688-feat-issue-687-reconciler-branch-delete",
-    repo: str = REPO,
-) -> dict:
-    now = last_activity or datetime.now(timezone.utc)
-    body = leases.format_lease_body(
-        repo=repo,
-        pr_number=pr_number,
-        issue_number=ISSUE,
-        reviewer_identity="sysadmin",
-        profile="prgs-reviewer",
-        session_id=session_id,
-        worktree=worktree,
-        phase=phase,
-        candidate_head=candidate_head,
-        target_branch="master",
-        target_branch_sha="b" * 40,
-        last_activity=now,
-        expires_at=expires_at,
-    )
-    return {
-        "id": comment_id,
-        "body": body,
-        "user": {"login": "sysadmin"},
-        "author": "sysadmin",
-        "created_at": now.isoformat(),
-        "updated_at": now.isoformat(),
-    }
-
-
-def _reviews_for_head(head: str, verdict: str = "REQUEST_CHANGES") -> list[dict]:
-    return [
-        {
-            "verdict": verdict,
-            "reviewed_head_sha": head,
-            "dismissed": False,
-            "reviewer": "sysadmin",
-        }
-    ]
-
-
-def _assess(
-    comments,
-    *,
-    current_head=HEAD_B,
-    formal_reviews=None,
-    controller=True,
-    worktree_exists=True,
-    worktree_clean=True,
-    owner_process_alive=False,
-    requesting_session="fresh-controller",
-    apply=False,
-    confirmation=None,
-    **kwargs,
-):
-    return leases.assess_obsolete_reviewer_comment_lease_cleanup(
-        comments,
-        pr_number=PR,
-        current_head_sha=current_head,
-        formal_reviews=formal_reviews if formal_reviews is not None else _reviews_for_head(HEAD_A),
-        repo=REPO,
-        expected_repo=REPO,
-        requesting_session_id=requesting_session,
-        controller_recovery_authorized=controller,
-        worktree_exists=worktree_exists,
-        worktree_clean=worktree_clean,
-        worktree_has_unpreserved_work=not worktree_clean if worktree_exists else False,
-        owner_process_alive=owner_process_alive,
-        owner_pid_observed=kwargs.get("owner_pid_observed"),
-        requesting_pid=kwargs.get("requesting_pid", 99999),
-        current_head_review_in_progress=kwargs.get(
-            "current_head_review_in_progress", False
-        ),
-        expected_lease_comment_id=kwargs.get("expected_lease_comment_id"),
-        expected_session_id=kwargs.get("expected_session_id"),
-        expected_leased_head=kwargs.get("expected_leased_head"),
-        confirmation=confirmation
-        if confirmation is not None
-        else (leases.cleanup_confirmation_for_pr(PR) if apply else ""),
-        apply=apply,
-        now=kwargs.get("now"),
-    )
-
-
-class TestIssue691SupersededHeadCleanup(unittest.TestCase):
-    def setUp(self):
-        leases.clear_session_lease()
-
-    def test_1_request_changes_then_push_expired_cleanup_succeeds(self):
-        """Completed REQUEST_CHANGES on A, push B, lease A expires → cleanup OK."""
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(
-            last_activity=expires - timedelta(hours=2),
-            expires_at=expires,
-        )
-        result = _assess(
-            [claim],
-            formal_reviews=_reviews_for_head(HEAD_A, "REQUEST_CHANGES"),
-            now=now,
-            apply=True,
-        )
-        self.assertTrue(result["cleanup_allowed"], result["reasons"])
-        self.assertEqual(result["classification"], "foreign_expired_superseded_head")
-        self.assertEqual(
-            result["exact_next_action"], leases.NEXT_ACTION_CLEANUP_OBSOLETE_LEASE
-        )
-        self.assertIn("phase: released", result["release_body"])
-        self.assertIn("obsolete-superseded-or-expired-lease", result["release_body"])
-        self.assertIsNotNone(result["audit_comment_body"])
-        self.assertEqual(result["cleanup_tool"], leases.CLEANUP_OBSOLETE_LEASE_TOOL)
-
-    def test_2_approve_then_push_cleanup_policy(self):
-        """Completed APPROVE on A, push B → cleanup eligible (completed superseded)."""
-        now = datetime(2026, 7, 13, 1, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)  # not yet expired
-        claim = _lease_comment(
-            last_activity=now - timedelta(minutes=10),
-            expires_at=expires,
-        )
-        result = _assess(
-            [claim],
-            formal_reviews=_reviews_for_head(HEAD_A, "APPROVED"),
-            now=now,
-        )
-        self.assertTrue(result["cleanup_allowed"], result["reasons"])
-        self.assertEqual(result["classification"], "foreign_completed_superseded_head")
-
-    def test_3_active_current_head_cleanup_denied(self):
-        now = datetime.now(timezone.utc)
-        claim = _lease_comment(
-            candidate_head=HEAD_B,
-            last_activity=now - timedelta(minutes=5),
-            expires_at=now + timedelta(hours=2),
-        )
-        result = _assess(
-            [claim],
-            current_head=HEAD_B,
-            formal_reviews=_reviews_for_head(HEAD_B, "REQUEST_CHANGES"),
-            now=now,
-        )
-        self.assertFalse(result["cleanup_allowed"])
-        self.assertEqual(result["classification"], "foreign_active_current_head")
-
-    def test_4_foreign_owner_recent_progress_denied(self):
-        now = datetime.now(timezone.utc)
-        claim = _lease_comment(
-            candidate_head=HEAD_B,
-            last_activity=now - timedelta(minutes=2),
-            expires_at=now + timedelta(hours=2),
-        )
-        result = _assess(
-            [claim],
-            current_head=HEAD_B,
-            formal_reviews=[],
-            owner_process_alive=True,
-            now=now,
-        )
-        self.assertFalse(result["cleanup_allowed"])
-        self.assertTrue(
-            any("recent authenticated progress" in r for r in result["reasons"])
-            or any("current PR head" in r for r in result["reasons"])
-        )
-
-    def test_5_owner_absent_worktree_dirty_denied(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(
-            candidate_head=HEAD_B,
-            last_activity=expires - timedelta(hours=1),
-            expires_at=expires,
-        )
-        result = _assess(
-            [claim],
-            current_head=HEAD_B,
-            formal_reviews=[],
-            worktree_clean=False,
-            owner_process_alive=False,
-            now=now,
-        )
-        self.assertFalse(result["cleanup_allowed"])
-        self.assertTrue(any("dirty" in r for r in result["reasons"]))
-
-    def test_6_owner_absent_worktree_clean_orphan_ok(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(
-            candidate_head=HEAD_B,
-            last_activity=expires - timedelta(hours=1),
-            expires_at=expires,
-        )
-        result = _assess(
-            [claim],
-            current_head=HEAD_B,
-            formal_reviews=[],
-            worktree_clean=True,
-            owner_process_alive=False,
-            now=now,
-        )
-        self.assertTrue(result["cleanup_allowed"], result["reasons"])
-        self.assertEqual(result["classification"], "orphaned_owner_missing")
-
-    def test_7_pid_reuse_not_ownership(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        result = _assess(
-            [claim],
-            now=now,
-            owner_pid_observed=4242,
-            requesting_pid=4242,
-        )
-        self.assertTrue(
-            any("PID equality" in r or "NOT ownership" in r for r in result["reasons"])
-            or result["owner_session_evidence"]["pid_is_not_ownership_proof"]
-        )
-        # Still eligible via superseded+terminal+expired despite matching PID.
-        self.assertTrue(result["cleanup_allowed"], result["reasons"])
-
-    def test_8_comment_backed_no_db_lease_id(self):
-        """Cleanup uses comment ledger only — no control-plane lease_id required."""
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        # Explicitly no lease_id field anywhere.
-        self.assertNotIn("lease_id", claim)
-        result = _assess([claim], now=now)
-        self.assertTrue(result["cleanup_allowed"], result["reasons"])
-        self.assertEqual(result["active_lease"]["comment_id"], COMMENT_10749)
-        self.assertIsNone(result["active_lease"].get("lease_id"))
-
-    def test_9_cleanup_posts_durable_audit_bodies(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        result = _assess([claim], now=now, apply=True)
-        self.assertTrue(result["cleanup_allowed"])
-        self.assertIn("#691", result["audit_comment_body"])
-        self.assertIn(str(COMMENT_10749), result["audit_comment_body"])
-        self.assertIn(HEAD_A, result["audit_comment_body"])
-        self.assertIn(HEAD_B, result["audit_comment_body"])
-
-    def test_10_fresh_acquire_after_cleanup_marker(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(
-            expires_at=expires,
-            last_activity=expires - timedelta(hours=1),
-            comment_id=COMMENT_10749,
-        )
-        assessed = _assess([claim], now=now, apply=True)
-        self.assertTrue(assessed["cleanup_allowed"])
-        release = {
-            "id": 99999,
-            "body": assessed["release_body"],
-            "user": {"login": "sysadmin"},
-        }
-        # Newest terminal marker ends active lease.
-        active = leases.find_active_reviewer_lease(
-            [claim, release], pr_number=PR, now=now
-        )
-        self.assertIsNone(active)
-        acq = leases.assess_acquire_lease(
-            [claim, release],
-            pr_number=PR,
-            reviewer_identity="sysadmin",
-            profile="prgs-reviewer",
-            session_id="fresh-reviewer-1",
-            repo=REPO,
-            issue_number=ISSUE,
-            worktree="branches/review-pr-688-fresh",
-            candidate_head=HEAD_B,
-            target_branch="master",
-            target_branch_sha="b" * 40,
-            now=now,
-        )
-        self.assertTrue(acq["acquire_allowed"], acq["reasons"])
-
-    def test_11_no_validation_state_transfer(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        result = _assess([claim], now=now, apply=True)
-        self.assertTrue(result["cleanup_allowed"])
-        # Release body keeps old candidate_head (no repoint).
-        self.assertIn(f"candidate_head: {HEAD_A}", result["release_body"])
-        self.assertNotIn(HEAD_B, result["release_body"].split("candidate_head:")[1].split("\n")[0])
-        self.assertIn("did not transfer validation", result["audit_comment_body"])
-        self.assertIn("did not repoint", result["audit_comment_body"])
-        # Session lease must remain unset by assessment (tool never seeds).
-        self.assertIsNone(leases.get_session_lease())
-
-    def test_12_repeated_cleanup_idempotent(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        first = _assess([claim], now=now, apply=True)
-        self.assertTrue(first["cleanup_allowed"])
-        release = {"id": 100001, "body": first["release_body"], "user": {"login": "x"}}
-        second = _assess([claim, release], now=now, apply=True)
-        self.assertFalse(second["cleanup_allowed"])
-        self.assertEqual(second["classification"], "no_lease")
-
-    def test_13_malformed_expiry_fails_closed(self):
-        claim = _lease_comment()
-        # Corrupt expires_at in the body.
-        claim["body"] = claim["body"].replace(
-            claim["body"].split("expires_at:")[1].split("\n")[0].strip(),
-            "not-a-timestamp",
-        )
-        result = _assess([claim], formal_reviews=_reviews_for_head(HEAD_A))
-        self.assertFalse(result["cleanup_allowed"])
-        self.assertFalse(result["expires_parseable"])
-        self.assertTrue(any("expires_at" in r for r in result["reasons"]))
-
-    def test_14_wrong_identity_evidence_fails_closed(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        bad_repo = _assess(
-            [claim],
-            now=now,
-            # force repo mismatch via expected_repo
-        )
-        # Patch via direct call with wrong expected_repo
-        bad = leases.assess_obsolete_reviewer_comment_lease_cleanup(
-            [claim],
-            pr_number=PR,
-            current_head_sha=HEAD_B,
-            formal_reviews=_reviews_for_head(HEAD_A),
-            expected_repo="Other-Org/Other-Repo",
-            requesting_session_id="fresh",
-            controller_recovery_authorized=True,
-            worktree_exists=True,
-            worktree_clean=True,
-            owner_process_alive=False,
-            now=now,
-        )
-        self.assertFalse(bad["cleanup_allowed"])
-        self.assertTrue(any("repository identity" in r for r in bad["reasons"]))
-
-        bad_pr = leases.assess_obsolete_reviewer_comment_lease_cleanup(
-            [claim],
-            pr_number=999,
-            current_head_sha=HEAD_B,
-            formal_reviews=_reviews_for_head(HEAD_A),
-            expected_repo=REPO,
-            requesting_session_id="fresh",
-            controller_recovery_authorized=True,
-            worktree_exists=True,
-            worktree_clean=True,
-            owner_process_alive=False,
-            expected_lease_comment_id=COMMENT_10749,
-            now=now,
-        )
-        self.assertFalse(bad_pr["cleanup_allowed"])
-
-        bad_head = _assess(
-            [claim],
-            now=now,
-            expected_leased_head="0" * 40,
-        )
-        self.assertFalse(bad_head["cleanup_allowed"])
-
-        bad_session = _assess(
-            [claim],
-            now=now,
-            expected_session_id="wrong-session",
-        )
-        self.assertFalse(bad_session["cleanup_allowed"])
-
-    def test_15_current_head_active_cannot_be_displaced(self):
-        now = datetime.now(timezone.utc)
-        claim = _lease_comment(
-            candidate_head=HEAD_B,
-            last_activity=now - timedelta(minutes=1),
-            expires_at=now + timedelta(hours=2),
-        )
-        result = _assess(
-            [claim],
-            current_head=HEAD_B,
-            formal_reviews=_reviews_for_head(HEAD_B),
-            now=now,
-            current_head_review_in_progress=True,
-        )
-        self.assertFalse(result["cleanup_allowed"])
-        # Acquire also blocked by foreign active lease.
-        acq = leases.assess_acquire_lease(
-            [claim],
-            pr_number=PR,
-            reviewer_identity="other",
-            profile="prgs-reviewer",
-            session_id="thief",
-            repo=REPO,
-            issue_number=ISSUE,
-            worktree="branches/steal",
-            candidate_head=HEAD_B,
-            target_branch="master",
-            target_branch_sha="b" * 40,
-            now=now,
-        )
-        self.assertFalse(acq["acquire_allowed"])
-
-    def test_regression_pr688_comment_10749_after_expiry(self):
-        """Exact 10749 reproduction after recorded expires_at 2026-07-13T04:23:00Z."""
-        now = datetime(2026, 7, 13, 4, 30, 0, tzinfo=timezone.utc)
-        expires = datetime.fromisoformat(EXPIRES_10749.replace("Z", "+00:00"))
-        claim = _lease_comment(
-            session_id=SESSION_FOREIGN,
-            candidate_head=HEAD_A,
-            comment_id=COMMENT_10749,
-            last_activity=expires - timedelta(hours=2),
-            expires_at=expires,
-        )
-        # Diagnosis must not prescribe indefinite wait-only for this case.
-        diag = leases.diagnose_reviewer_pr_lease_handoff(
-            [claim],
-            pr_number=PR,
-            current_session_id="fresh-reviewer",
-            current_reviewer_identity="sysadmin",
-            current_head_sha=HEAD_B,
-            formal_reviews=_reviews_for_head(HEAD_A, "REQUEST_CHANGES"),
-            worktree_exists=True,
-            worktree_clean=True,
-            owner_process_alive=False,
-            instructed_session_id=SESSION_FOREIGN,
-            instructed_comment_id=COMMENT_10749,
-            now=now,
-        )
-        self.assertEqual(diag["classification"], "foreign_expired_superseded_head")
-        self.assertEqual(
-            diag["next_action"], leases.NEXT_ACTION_CLEANUP_OBSOLETE_LEASE
-        )
-        self.assertEqual(diag["cleanup_tool"], leases.CLEANUP_OBSOLETE_LEASE_TOOL)
-        self.assertIn("CLEANUP OBSOLETE REVIEWER LEASE 688", diag["required_confirmation"])
-        self.assertEqual(diag["mutation_eligibility"], "cleanup_only")
-        self.assertFalse(diag["mutation_allowed"])
-
-        # Assessment still returns the lease as active/stale class of block for acquire
-        # when unexpired path... here it's expired so find_active is None; acquire free
-        # only after cleanup if somehow still active. With expired, find_active is None:
-        active = leases.find_active_reviewer_lease([claim], pr_number=PR, now=now)
-        self.assertIsNone(active)
-
-        # But superseded unexpired still blocks acquire and diagnosis points to cleanup:
-        unexpired_now = datetime(2026, 7, 13, 1, 0, 0, tzinfo=timezone.utc)
-        claim2 = _lease_comment(
-            session_id=SESSION_FOREIGN,
-            candidate_head=HEAD_A,
-            comment_id=COMMENT_10749,
-            last_activity=unexpired_now - timedelta(minutes=45),
-            expires_at=expires,
-        )
-        active2 = leases.find_active_reviewer_lease(
-            [claim2], pr_number=PR, now=unexpired_now
-        )
-        self.assertIsNotNone(active2)
-        self.assertEqual(active2["freshness"], "stale_warning")
-        diag2 = leases.diagnose_reviewer_pr_lease_handoff(
-            [claim2],
-            pr_number=PR,
-            current_session_id="fresh-reviewer",
-            current_reviewer_identity="sysadmin",
-            current_head_sha=HEAD_B,
-            formal_reviews=_reviews_for_head(HEAD_A, "REQUEST_CHANGES"),
-            worktree_exists=True,
-            worktree_clean=True,
-            now=unexpired_now,
-        )
-        self.assertEqual(diag2["classification"], "foreign_completed_superseded_head")
-        self.assertEqual(
-            diag2["next_action"], leases.NEXT_ACTION_CLEANUP_OBSOLETE_LEASE
-        )
-        acq = leases.assess_acquire_lease(
-            [claim2],
-            pr_number=PR,
-            reviewer_identity="sysadmin",
-            profile="prgs-reviewer",
-            session_id="fresh-reviewer",
-            repo=REPO,
-            issue_number=ISSUE,
-            worktree="branches/review-pr-688-new",
-            candidate_head=HEAD_B,
-            target_branch="master",
-            target_branch_sha="b" * 40,
-            now=unexpired_now,
-        )
-        self.assertFalse(acq["acquire_allowed"])
-
-    def test_missing_controller_auth_denied(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        result = _assess([claim], controller=False, now=now)
-        self.assertFalse(result["cleanup_allowed"])
-
-    def test_wrong_confirmation_denied_on_apply(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        result = _assess(
-            [claim], now=now, apply=True, confirmation="MERGE PR 688"
-        )
-        self.assertFalse(result["cleanup_allowed"])
-        self.assertTrue(any("confirmation" in r for r in result["reasons"]))
-
-    def test_owner_session_must_use_owner_release(self):
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        result = _assess(
-            [claim],
-            now=now,
-            requesting_session=SESSION_FOREIGN,
-        )
-        self.assertFalse(result["cleanup_allowed"])
-        self.assertTrue(any("owns the lease" in r for r in result["reasons"]))
-
-    def test_superseded_without_terminal_review_denied(self):
-        # Pre-expiry the missing terminal review is ambiguous (fail closed);
-        # post-expiry with unknown owner evidence it is a crash-orphan (#702)
-        # that still fails closed until owner-process exit is proven.
-        now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
-        expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
-        claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        result = _assess(
-            [claim], formal_reviews=[], now=now, owner_process_alive=None
-        )
-        self.assertFalse(result["cleanup_allowed"])
-        self.assertEqual(
-            result["classification"], "orphaned_expired_superseded_head"
-        )
-
-        fresh_expires = now + timedelta(minutes=60)
-        fresh = _lease_comment(
-            expires_at=fresh_expires, last_activity=now - timedelta(minutes=5)
-        )
-        pre_expiry = _assess([fresh], formal_reviews=[], now=now)
-        self.assertFalse(pre_expiry["cleanup_allowed"])
-        self.assertEqual(
-            pre_expiry["classification"], "ambiguous_conflicting_evidence"
-        )
-
-
-class TestIssue691DiagnoseClassifications(unittest.TestCase):
-    def setUp(self):
-        leases.clear_session_lease()
-
-    def test_foreign_active_current_head_still_wait(self):
-        now = datetime.now(timezone.utc)
-        claim = _lease_comment(
-            candidate_head=HEAD_B,
-            last_activity=now - timedelta(minutes=5),
-            expires_at=now + timedelta(hours=1),
-        )
-        claim["id"] = 1
-        result = leases.diagnose_reviewer_pr_lease_handoff(
-            [claim],
-            pr_number=PR,
-            current_session_id="other",
-            current_reviewer_identity="sysadmin",
-            current_head_sha=HEAD_B,
-            formal_reviews=[],
-            now=now,
-        )
-        self.assertEqual(result["classification"], "foreign_active_current_head")
-        self.assertEqual(result["next_action"], leases.NEXT_ACTION_WAIT)
-        self.assertFalse(result["mutation_allowed"])
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_issue_702_review_findings_f1_f6.py

@@ -1,693 +0,0 @@
-"""Regression tests for the PR #703 REQUEST_CHANGES findings F1–F6 (#702).
-
-Formal review at head 889931d independently reproduced six defects:
-
-F1 — stale-binding recovery ran only AFTER the terminal launcher probe in
-     ``gitea_resolve_task_capability``; a worktree removed mid-session wedged
-     every mutation-task resolution on 'missing cwd' before recovery.
-F2 — ``_resolve_preflight_workspace_path`` skipped the existence checks the
-     canonical mutation context applies; a dead binding could produce empty
-     porcelain and read as a clean workspace.
-F3 — ``orphaned_expired_superseded_head`` cleanup accepted unknown
-     ``worktree_exists``/``worktree_clean`` evidence.
-F4 — the 4-hour session-state TTL silently discarded recovery-critical
-     crash-orphan shadow evidence.
-F5 — the single same-profile shadow slot let concurrent sessions overwrite
-     each other's crash evidence.
-F6 — the environment was cleared BEFORE the audit record was persisted, and
-     audit-write failure was swallowed.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import sys
-import tempfile
-import unittest
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from unittest.mock import patch
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-import mcp_session_state as mss  # noqa: E402
-import namespace_workspace_binding as nwb  # noqa: E402
-import reviewer_pr_lease as leases  # noqa: E402
-import stale_binding_recovery as sbr  # noqa: E402
-import mcp_server  # noqa: E402
-
-REPO = "Scaled-Tech-Consulting/Gitea-Tools"
-OLD_HEAD = "b" * 40
-NEW_HEAD = "6" * 40
-
-CONFIG = {
-    "version": 2,
-    "contexts": {
-        "ctx": {
-            "enabled": True,
-            "gitea": {"enabled": True, "base_url": "https://gitea.example.com"},
-        }
-    },
-    "profiles": {
-        "prgs-author": {
-            "enabled": True,
-            "context": "ctx",
-            "role": "author",
-            "username": "jcwalker3",
-            "auth": {"type": "env", "name": "GITEA_TOKEN_AUTHOR"},
-            "allowed_operations": [
-                "gitea.read", "gitea.issue.create", "gitea.issue.comment",
-                "gitea.pr.create", "gitea.branch.push",
-            ],
-            "forbidden_operations": [
-                "gitea.pr.approve", "gitea.pr.merge", "gitea.pr.review",
-            ],
-            "execution_profile": "prgs-author",
-        },
-    },
-    "rules": {"allow_runtime_switching": False},
-}
-
-
-def _now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-class _CapabilityHarness(unittest.TestCase):
-    """Shared config/env plumbing for resolve-capability integration tests."""
-
-    def setUp(self):
-        self._remotes = patch.dict(mcp_server.REMOTES, {
-            "prgs": {
-                "host": "gitea.example.com",
-                "org": "Scaled-Tech-Consulting",
-                "repo": "Gitea-Tools",
-            },
-        })
-        self._remotes.start()
-        mcp_server._IDENTITY_CACHE.clear()
-        self._dir = tempfile.TemporaryDirectory()
-        self.config_path = os.path.join(self._dir.name, "profiles.json")
-        with open(self.config_path, "w", encoding="utf-8") as fh:
-            fh.write(json.dumps(CONFIG))
-
-    def tearDown(self):
-        self._remotes.stop()
-        mcp_server._IDENTITY_CACHE.clear()
-        self._dir.cleanup()
-
-    def _env(self, **extra):
-        env = {
-            "GITEA_MCP_CONFIG": self.config_path,
-            "GITEA_MCP_PROFILE": "prgs-author",
-            "GITEA_TOKEN_AUTHOR": "author-pass",
-        }
-        env.update(extra)
-        return env
-
-    def _deleted_worktree(self) -> str:
-        path = tempfile.mkdtemp(prefix="gitea-removed-worktree-")
-        shutil.rmtree(path)
-        return path
-
-
-class TestF1RecoveryBeforeTerminalProbe(_CapabilityHarness):
-    """F1: recovery must run before the terminal cwd probe can wedge."""
-
-    @patch("mcp_server.api_request", return_value={"login": "jcwalker3"})
-    @patch("mcp_server.get_auth_header", return_value="token author-pass")
-    def test_removed_worktree_recovers_before_probe(self, _auth, _api):
-        missing = self._deleted_worktree()
-        env = self._env(
-            GITEA_ACTIVE_WORKTREE=missing,
-            GITEA_FORCE_TERMINAL_PROBE="1",
-            GITEA_FORCE_STALE_BINDING_RECOVERY="1",
-        )
-        with patch.dict(os.environ, env):
-            res = mcp_server.gitea_resolve_task_capability(
-                task="create_pr", remote="prgs"
-            )
-            # The provably-stale binding was cleared before the probe ran.
-            self.assertNotIn("GITEA_ACTIVE_WORKTREE", os.environ)
-        self.assertFalse(res.get("terminal_launcher_unhealthy"))
-        report = res.get("stale_binding_recovery") or {}
-        self.assertEqual(
-            report.get("classification"),
-            sbr.CLASSIFICATION_PROVABLY_STALE_MISSING_PATH,
-        )
-        self.assertTrue(report.get("recovery_performed"))
-        self.assertTrue(res.get("allowed_in_current_session"))
-
-    @patch("mcp_server.api_request", return_value={"login": "jcwalker3"})
-    @patch("mcp_server.get_auth_header", return_value="token author-pass")
-    def test_probe_block_still_carries_recovery_report(self, _auth, _api):
-        # Recovery disabled (test mode without the force flag) preserves the
-        # fail-closed probe block, but the block must now carry the
-        # classification evidence instead of hiding it.
-        missing = self._deleted_worktree()
-        env = self._env(
-            GITEA_ACTIVE_WORKTREE=missing,
-            GITEA_FORCE_TERMINAL_PROBE="1",
-        )
-        with patch.dict(os.environ, env):
-            res = mcp_server.gitea_resolve_task_capability(
-                task="create_pr", remote="prgs"
-            )
-            self.assertIn("GITEA_ACTIVE_WORKTREE", os.environ)
-        self.assertTrue(res.get("terminal_launcher_unhealthy"))
-        report = res.get("stale_binding_recovery") or {}
-        self.assertEqual(
-            report.get("classification"),
-            sbr.CLASSIFICATION_PROVABLY_STALE_MISSING_PATH,
-        )
-        self.assertFalse(report.get("recovery_performed"))
-
-    @patch("mcp_server.api_request", return_value={"login": "jcwalker3"})
-    @patch("mcp_server.get_auth_header", return_value="token author-pass")
-    def test_unverified_binding_is_never_cleared_by_reordering(self, _auth, _api):
-        # F1 must not weaken authorization: an existing, uncorroborated
-        # binding survives resolution untouched even with recovery forced.
-        existing = tempfile.mkdtemp(prefix="gitea-existing-worktree-")
-        self.addCleanup(shutil.rmtree, existing, ignore_errors=True)
-        env = self._env(
-            GITEA_ACTIVE_WORKTREE=existing,
-            GITEA_FORCE_TERMINAL_PROBE="1",
-            GITEA_FORCE_STALE_BINDING_RECOVERY="1",
-        )
-        with patch.dict(os.environ, env):
-            res = mcp_server.gitea_resolve_task_capability(
-                task="create_pr", remote="prgs"
-            )
-            self.assertEqual(os.environ.get("GITEA_ACTIVE_WORKTREE"), existing)
-        report = res.get("stale_binding_recovery") or {}
-        self.assertFalse(report.get("recovery_performed"))
-
-
-class TestF2PreflightPathVerification(_CapabilityHarness):
-    """F2: preflight and mutation contexts verify resolved paths alike."""
-
-    def test_preflight_and_mutation_context_agree_on_dead_binding(self):
-        missing = self._deleted_worktree()
-        env = self._env(GITEA_ACTIVE_WORKTREE=missing)
-        with patch.dict(os.environ, env):
-            preflight = mcp_server._resolve_preflight_workspace_path(None)
-            mutation = mcp_server._resolve_namespace_mutation_context(None)
-        self.assertEqual(preflight, mutation["workspace_path"])
-        self.assertNotEqual(preflight, os.path.realpath(missing))
-
-    def test_missing_explicit_worktree_never_reads_clean(self):
-        missing = self._deleted_worktree()
-        with patch.dict(os.environ, self._env()):
-            porcelain = mcp_server._get_workspace_porcelain(worktree_path=missing)
-        self.assertEqual(
-            porcelain, mcp_server.PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN
-        )
-        # The sentinel parses as a tracked dirty entry — never clean.
-        self.assertTrue(mcp_server._parse_porcelain_entries(porcelain))
-
-    def test_workspace_deleted_during_evaluation_never_reads_clean(self):
-        # TOCTOU: resolution succeeded, then the path vanished before git ran.
-        missing = self._deleted_worktree()
-        with patch.dict(os.environ, self._env()):
-            with patch.object(
-                mcp_server,
-                "_resolve_preflight_workspace_path",
-                return_value=missing,
-            ):
-                porcelain = mcp_server._get_workspace_porcelain()
-        self.assertEqual(
-            porcelain, mcp_server.PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN
-        )
-
-    def test_git_failure_never_reads_clean(self):
-        class _Failed:
-            returncode = 128
-            stdout = ""
-            stderr = "fatal: not a git repository"
-
-        with patch.dict(os.environ, self._env()):
-            with patch.object(
-                mcp_server.subprocess, "run", return_value=_Failed()
-            ):
-                porcelain = mcp_server._get_workspace_porcelain()
-        self.assertEqual(
-            porcelain, mcp_server.PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN
-        )
-
-    def test_symlinked_binding_to_deleted_target_is_demoted(self):
-        target = tempfile.mkdtemp(prefix="gitea-symlink-target-")
-        holder = tempfile.mkdtemp(prefix="gitea-symlink-holder-")
-        self.addCleanup(shutil.rmtree, holder, ignore_errors=True)
-        link = os.path.join(holder, "worktree-link")
-        os.symlink(target, link)
-        shutil.rmtree(target)
-        demotions: list[str] = []
-        _path, source = nwb.resolve_namespace_workspace(
-            role_kind="reviewer",
-            process_project_root=os.getcwd(),
-            env={"GITEA_ACTIVE_WORKTREE": link},
-            demotions=demotions,
-            verify_paths=True,
-        )
-        self.assertEqual(source, "MCP server process root (default)")
-        self.assertEqual(len(demotions), 1)
-
-    def test_dead_binding_falls_through_to_live_role_binding(self):
-        # Path changes during evaluation: the dead candidate demotes at
-        # verification time and never resurrects over the live fallback.
-        alive = tempfile.mkdtemp(prefix="gitea-alive-worktree-")
-        self.addCleanup(shutil.rmtree, alive, ignore_errors=True)
-        missing = self._deleted_worktree()
-        path, source = nwb.resolve_namespace_workspace(
-            role_kind="reviewer",
-            process_project_root=os.getcwd(),
-            env={
-                "GITEA_ACTIVE_WORKTREE": missing,
-                "GITEA_REVIEWER_WORKTREE": alive,
-            },
-            verify_paths=True,
-        )
-        self.assertEqual(path, os.path.realpath(alive))
-        self.assertEqual(
-            source, "GITEA_REVIEWER_WORKTREE environment variable"
-        )
-
-
-class TestF3AffirmativeWorktreeEvidence(unittest.TestCase):
-    """F3: unknown worktree evidence must fail closed for crash orphans."""
-
-    def _comments(self) -> list[dict]:
-        stale = _now() - timedelta(hours=3)
-        body = leases.format_lease_body(
-            repo=REPO,
-            pr_number=701,
-            issue_number=699,
-            reviewer_identity="sysadmin",
-            profile="prgs-reviewer",
-            session_id="65664-4f248d213d60",
-            worktree="branches/review-pr-654",
-            phase="validation-start",
-            candidate_head=OLD_HEAD,
-            target_branch="master",
-            target_branch_sha="2" * 40,
-            last_activity=stale,
-            expires_at=stale + timedelta(minutes=120),
-        )
-        return [{
-            "id": 11131,
-            "body": body,
-            "user": {"login": "sysadmin"},
-            "author": "sysadmin",
-            "created_at": stale.isoformat(),
-            "updated_at": stale.isoformat(),
-        }]
-
-    def _assess(self, **kwargs):
-        defaults = dict(
-            pr_number=701,
-            current_head_sha=NEW_HEAD,
-            formal_reviews=[],
-            repo=REPO,
-            expected_repo=REPO,
-            requesting_session_id="fresh-controller",
-            controller_recovery_authorized=True,
-            owner_process_alive=False,
-        )
-        defaults.update(kwargs)
-        return leases.assess_obsolete_reviewer_comment_lease_cleanup(
-            self._comments(), **defaults
-        )
-
-    def test_unknown_worktree_evidence_fails_closed(self):
-        result = self._assess(worktree_exists=None, worktree_clean=None)
-        self.assertEqual(
-            result["classification"], "orphaned_expired_superseded_head"
-        )
-        self.assertFalse(result["cleanup_allowed"])
-        self.assertIn(
-            "affirmative safe evidence",
-            " ".join(result["fail_closed_reasons"]),
-        )
-
-    def test_unknown_cleanliness_with_existing_worktree_fails_closed(self):
-        result = self._assess(worktree_exists=True, worktree_clean=None)
-        self.assertFalse(result["cleanup_allowed"])
-
-    def test_affirmative_clean_worktree_is_eligible(self):
-        result = self._assess(worktree_exists=True, worktree_clean=True)
-        self.assertEqual(
-            result["classification"], "orphaned_expired_superseded_head"
-        )
-        self.assertTrue(result["cleanup_allowed"])
-
-    def test_affirmative_absent_worktree_is_eligible(self):
-        result = self._assess(worktree_exists=False, worktree_clean=None)
-        self.assertTrue(result["cleanup_allowed"])
-
-    def test_matrix_matches_diagnosis_gate(self):
-        # The cleanup matrix and the diagnosis path must agree: unknown
-        # evidence yields acquire-only, affirmative evidence yields cleanup.
-        diagnosis_unknown = leases.diagnose_reviewer_pr_lease_handoff(
-            self._comments(),
-            pr_number=701,
-            current_session_id=None,
-            current_reviewer_identity="fresh-reviewer",
-            current_head_sha=NEW_HEAD,
-            formal_reviews=[],
-            owner_process_alive=False,
-            worktree_exists=None,
-            worktree_clean=None,
-        )
-        assess_unknown = self._assess(worktree_exists=None, worktree_clean=None)
-        self.assertNotEqual(
-            diagnosis_unknown["next_action"],
-            "cleanup_obsolete_reviewer_comment_lease",
-        )
-        self.assertFalse(assess_unknown["cleanup_allowed"])
-
-
-class TestF4CrashShadowDurability(unittest.TestCase):
-    """F4: crash-orphan evidence survives the former 4h TTL boundary."""
-
-    SID = "82984-abcabcabcabc"
-
-    def setUp(self):
-        self._dir = tempfile.TemporaryDirectory()
-        self._env = patch.dict(
-            os.environ, {"GITEA_MCP_SESSION_STATE_DIR": self._dir.name}
-        )
-        self._env.start()
-        leases._SESSION_LEASE = None
-
-    def tearDown(self):
-        self._env.stop()
-        self._dir.cleanup()
-        leases._SESSION_LEASE = None
-
-    def _age_record(self, kind: str, hours: float, instance_id: str | None = None):
-        path = mss.state_file_path(kind=kind, instance_id=instance_id)
-        with open(path, encoding="utf-8") as fh:
-            envelope = json.load(fh)
-        stamp = (
-            (_now() - timedelta(hours=hours)).isoformat().replace("+00:00", "Z")
-        )
-        envelope["recorded_at"] = stamp
-        envelope["updated_at"] = stamp
-        envelope["payload"]["recorded_at"] = stamp
-        envelope["payload"]["updated_at"] = stamp
-        with open(path, "w", encoding="utf-8") as fh:
-            json.dump(envelope, fh)
-
-    def _save_shadow(self) -> None:
-        mss.save_state(
-            kind=mss.KIND_REVIEWER_SESSION_LEASE,
-            instance_id=self.SID,
-            payload={"session_id": self.SID, "owner_pid": os.getpid()},
-        )
-
-    def _load_shadow(self):
-        return mss.load_state(
-            kind=mss.KIND_REVIEWER_SESSION_LEASE, instance_id=self.SID
-        )
-
-    def test_shadow_loads_before_former_ttl_boundary(self):
-        self._save_shadow()
-        self._age_record(
-            mss.KIND_REVIEWER_SESSION_LEASE, hours=3.9, instance_id=self.SID
-        )
-        self.assertIsNotNone(self._load_shadow())
-
-    def test_shadow_loads_at_former_ttl_boundary(self):
-        self._save_shadow()
-        self._age_record(
-            mss.KIND_REVIEWER_SESSION_LEASE, hours=4.0, instance_id=self.SID
-        )
-        self.assertIsNotNone(self._load_shadow())
-
-    def test_shadow_loads_long_after_former_ttl_boundary(self):
-        self._save_shadow()
-        self._age_record(
-            mss.KIND_REVIEWER_SESSION_LEASE, hours=27.0, instance_id=self.SID
-        )
-        record = self._load_shadow()
-        self.assertIsNotNone(record)
-        self.assertEqual(record.get("session_id"), self.SID)
-
-    def test_stale_binding_audit_record_is_also_durable(self):
-        mss.save_state(
-            kind=mss.KIND_STALE_BINDING_RECOVERY,
-            payload={"cleared_env": "GITEA_ACTIVE_WORKTREE"},
-        )
-        self._age_record(mss.KIND_STALE_BINDING_RECOVERY, hours=27.0)
-        self.assertIsNotNone(
-            mss.load_state(kind=mss.KIND_STALE_BINDING_RECOVERY)
-        )
-
-    def test_non_recovery_kinds_keep_ttl(self):
-        mss.save_state(
-            kind=mss.KIND_WORKFLOW_LOAD, payload={"workflow_hash": "abc"}
-        )
-        self._age_record(mss.KIND_WORKFLOW_LOAD, hours=5.0)
-        self.assertIsNone(mss.load_state(kind=mss.KIND_WORKFLOW_LOAD))
-
-    def test_sanctioned_clear_is_the_terminal_reconciliation(self):
-        self._save_shadow()
-        self._age_record(
-            mss.KIND_REVIEWER_SESSION_LEASE, hours=27.0, instance_id=self.SID
-        )
-        mss.clear_state(
-            kind=mss.KIND_REVIEWER_SESSION_LEASE, instance_id=self.SID
-        )
-        self.assertIsNone(self._load_shadow())
-        self.assertEqual(
-            mss.list_states(kind=mss.KIND_REVIEWER_SESSION_LEASE), []
-        )
-
-    def test_crash_orphan_recovery_works_after_former_ttl(self):
-        # End to end: a crashed session's shadow still proves owner exit a
-        # day later.
-        leases.record_session_lease(
-            {
-                "pr_number": 701,
-                "session_id": self.SID,
-                "worktree": "branches/review-pr-654",
-                "candidate_head": OLD_HEAD,
-                "repo": REPO,
-                "comment_id": 11131,
-                "profile": "prgs-reviewer",
-                "reviewer_identity": "sysadmin",
-                "phase": "claimed",
-            },
-            lease_provenance={"source": "acquire", "comment_id": 11131},
-        )
-        leases._SESSION_LEASE = None  # simulated crash: no sanctioned clear
-        self._age_record(
-            mss.KIND_REVIEWER_SESSION_LEASE, hours=27.0, instance_id=self.SID
-        )
-        shadow = leases.load_session_lease_shadow(session_id=self.SID)
-        self.assertIsNotNone(shadow)
-        verdict = leases.assess_crashed_session_lease_orphan(
-            shadow,
-            lease={"session_id": self.SID},
-            current_pid=os.getpid() + 1,
-            pid_alive=False,
-        )
-        self.assertTrue(verdict["orphan_evidence"])
-        self.assertIs(verdict["owner_process_alive"], False)
-
-
-class TestF5ConcurrentSessionShadows(unittest.TestCase):
-    """F5: concurrent same-profile sessions keep distinct shadow records."""
-
-    SID_A = "11111-aaaaaaaaaaaa"
-    SID_B = "22222-bbbbbbbbbbbb"
-
-    def setUp(self):
-        self._dir = tempfile.TemporaryDirectory()
-        self._env = patch.dict(
-            os.environ, {"GITEA_MCP_SESSION_STATE_DIR": self._dir.name}
-        )
-        self._env.start()
-        leases._SESSION_LEASE = None
-
-    def tearDown(self):
-        self._env.stop()
-        self._dir.cleanup()
-        leases._SESSION_LEASE = None
-
-    def _lease(self, session_id: str, pr_number: int, head: str) -> dict:
-        return {
-            "pr_number": pr_number,
-            "session_id": session_id,
-            "worktree": f"branches/review-pr-{pr_number}-{session_id[:5]}",
-            "candidate_head": head,
-            "repo": REPO,
-            "comment_id": 11221,
-            "profile": "prgs-reviewer",
-            "reviewer_identity": "sysadmin",
-            "phase": "claimed",
-        }
-
-    def _record(self, lease: dict) -> None:
-        leases.record_session_lease(
-            lease,
-            lease_provenance={"source": "acquire", "comment_id": 11221},
-        )
-
-    def test_interleaved_sessions_do_not_overwrite_each_other(self):
-        self._record(self._lease(self.SID_A, 703, OLD_HEAD))
-        self._record(self._lease(self.SID_B, 701, NEW_HEAD))
-        # Session A heartbeats again after B wrote.
-        updated_a = self._lease(self.SID_A, 703, OLD_HEAD)
-        updated_a["phase"] = "validation-start"
-        self._record(updated_a)
-
-        shadow_a = leases.load_session_lease_shadow(session_id=self.SID_A)
-        shadow_b = leases.load_session_lease_shadow(session_id=self.SID_B)
-        self.assertEqual(shadow_a.get("session_id"), self.SID_A)
-        self.assertEqual(shadow_a.get("pr_number"), 703)
-        self.assertEqual(shadow_a.get("phase"), "validation-start")
-        self.assertEqual(shadow_b.get("session_id"), self.SID_B)
-        self.assertEqual(shadow_b.get("pr_number"), 701)
-        self.assertEqual(shadow_b.get("candidate_head"), NEW_HEAD)
-
-    def test_shadow_lookup_never_misattributes(self):
-        self._record(self._lease(self.SID_A, 703, OLD_HEAD))
-        self.assertIsNone(
-            leases.load_session_lease_shadow(session_id=self.SID_B)
-        )
-        verdict = leases.assess_crashed_session_lease_orphan(
-            leases.load_session_lease_shadow(session_id=self.SID_A),
-            lease={"session_id": self.SID_B},
-            pid_alive=False,
-        )
-        self.assertFalse(verdict["orphan_evidence"])
-
-    def test_clearing_one_session_preserves_the_other(self):
-        self._record(self._lease(self.SID_A, 703, OLD_HEAD))
-        self._record(self._lease(self.SID_B, 701, NEW_HEAD))
-        # Sanctioned clear of B (the currently recorded in-memory lease).
-        leases.clear_session_lease()
-        self.assertIsNone(
-            leases.load_session_lease_shadow(session_id=self.SID_B)
-        )
-        shadow_a = leases.load_session_lease_shadow(session_id=self.SID_A)
-        self.assertIsNotNone(shadow_a)
-        self.assertEqual(shadow_a.get("session_id"), self.SID_A)
-
-    def test_reconnected_process_recovers_by_session_id(self):
-        self._record(self._lease(self.SID_A, 703, OLD_HEAD))
-        self._record(self._lease(self.SID_B, 701, NEW_HEAD))
-        # Simulated crash + reconnect: in-memory state is gone, durable
-        # records remain enumerable and individually attributable.
-        leases._SESSION_LEASE = None
-        records = mss.list_states(kind=mss.KIND_REVIEWER_SESSION_LEASE)
-        self.assertEqual(
-            sorted(r.get("session_id") for r in records),
-            sorted([self.SID_A, self.SID_B]),
-        )
-        shadow = leases.load_session_lease_shadow(session_id=self.SID_B)
-        self.assertEqual(shadow.get("pr_number"), 701)
-
-    def test_legacy_single_slot_record_still_resolves_by_session_id(self):
-        # Upgrade path: a record written by pre-F5 code (no instance key)
-        # remains usable when its payload names the requested session.
-        mss.save_state(
-            kind=mss.KIND_REVIEWER_SESSION_LEASE,
-            payload={"session_id": self.SID_A, "owner_pid": os.getpid()},
-        )
-        shadow = leases.load_session_lease_shadow(session_id=self.SID_A)
-        self.assertIsNotNone(shadow)
-        self.assertIsNone(
-            leases.load_session_lease_shadow(session_id=self.SID_B)
-        )
-
-
-class TestF6AuditBeforeClear(_CapabilityHarness):
-    """F6: the durable audit record is persisted before the env clears."""
-
-    def _recovery_env(self, missing: str) -> dict:
-        return self._env(
-            GITEA_ACTIVE_WORKTREE=missing,
-            GITEA_FORCE_STALE_BINDING_RECOVERY="1",
-        )
-
-    def test_audit_write_failure_blocks_the_clear(self):
-        missing = self._deleted_worktree()
-        with patch.dict(os.environ, self._recovery_env(missing)):
-            with patch.object(
-                mss, "save_state", side_effect=OSError("disk full")
-            ):
-                report = mcp_server._assess_stale_active_binding(
-                    auto_recover=True
-                )
-            self.assertEqual(os.environ.get("GITEA_ACTIVE_WORKTREE"), missing)
-        self.assertFalse(report["recovery_performed"])
-        self.assertIs(report.get("audit_persisted"), False)
-        self.assertTrue(report.get("audit_write_failed"))
-        self.assertIn("NOT cleared", " ".join(report.get("reasons") or []))
-
-    def test_retry_after_audit_failure_recovers(self):
-        missing = self._deleted_worktree()
-        with patch.dict(os.environ, self._recovery_env(missing)):
-            with patch.object(
-                mss, "save_state", side_effect=OSError("disk full")
-            ):
-                first = mcp_server._assess_stale_active_binding(
-                    auto_recover=True
-                )
-            self.assertFalse(first["recovery_performed"])
-            # Persistence recovered; the retry clears with a durable audit.
-            second = mcp_server._assess_stale_active_binding(auto_recover=True)
-            self.assertTrue(second["recovery_performed"])
-            self.assertIs(second.get("audit_persisted"), True)
-            self.assertNotIn("GITEA_ACTIVE_WORKTREE", os.environ)
-            audit = mss.load_state(kind=mss.KIND_STALE_BINDING_RECOVERY)
-        self.assertIsNotNone(audit)
-        self.assertEqual(audit.get("recovery_status"), "performed")
-        self.assertEqual(audit.get("cleared_value"), missing)
-
-    def test_audit_record_exists_before_env_clear(self):
-        missing = self._deleted_worktree()
-        observed: list[tuple[str | None, str | None]] = []
-        real_save = mss.save_state
-
-        def _spy(**kwargs):
-            observed.append(
-                (
-                    (kwargs.get("payload") or {}).get("recovery_status"),
-                    os.environ.get("GITEA_ACTIVE_WORKTREE"),
-                )
-            )
-            return real_save(**kwargs)
-
-        with patch.dict(os.environ, self._recovery_env(missing)):
-            with patch.object(mss, "save_state", side_effect=_spy):
-                report = mcp_server._assess_stale_active_binding(
-                    auto_recover=True
-                )
-        self.assertTrue(report["recovery_performed"])
-        self.assertGreaterEqual(len(observed), 2)
-        pending_status, env_at_pending = observed[0]
-        performed_status, env_at_performed = observed[-1]
-        # Ordering proof: the binding was still present while the pending
-        # audit persisted, and gone by the time the performed status wrote.
-        self.assertEqual(pending_status, "pending")
-        self.assertEqual(env_at_pending, missing)
-        self.assertEqual(performed_status, "performed")
-        self.assertIsNone(env_at_performed)
-
-    def test_recovery_is_idempotent_after_success(self):
-        missing = self._deleted_worktree()
-        with patch.dict(os.environ, self._recovery_env(missing)):
-            first = mcp_server._assess_stale_active_binding(auto_recover=True)
-            second = mcp_server._assess_stale_active_binding(auto_recover=True)
-        self.assertTrue(first["recovery_performed"])
-        self.assertEqual(second["classification"], sbr.CLASSIFICATION_UNBOUND)
-        self.assertFalse(second["recovery_performed"])
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_issue_702_stale_binding_lease_recovery.py

@@ -1,517 +0,0 @@
-"""Regression tests for #702: stale runtime binding + orphaned durable lease.
-
-Reproduces the PR #701 incident (lease 65664-4f248d213d60, comments
-11129/11131): the MCP daemon crashed without teardown, destroying the
-in-memory session lease while the durable comment lease survived, and the
-auto-reconnected daemon inherited a stale ``GITEA_ACTIVE_WORKTREE`` binding
-(``branches/review-pr-654``) from its parent environment.
-
-Covers the five mandated scenarios:
-
-1. lost in-session leases  — durable shadow survives a crash and yields
-   provable owner-process evidence
-2. old-head leases         — expired superseded-head lease with no terminal
-   review becomes recoverable only with orphan evidence + controller authority
-3. runtime/worktree mismatch — env bindings to deleted worktrees are demoted,
-   never silently bound
-4. managed reconnect       — boot-inherited uncorroborated bindings are
-   surfaced for managed recovery; provably stale ones are clear-eligible
-5. safe expiry             — pre-expiry stays fail-closed wait (no steal);
-   canonical expiry unlocks acquisition and guarded cleanup
-"""
-
-from __future__ import annotations
-
-import os
-import sys
-import unittest
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-import namespace_workspace_binding as nwb  # noqa: E402
-import reviewer_pr_lease as leases  # noqa: E402
-import stale_binding_recovery as sbr  # noqa: E402
-
-# PR #701 incident fixtures.
-OLD_HEAD = "b4d0cb22e452a07c8e816745c704ddb0f43edf0b"
-NEW_HEAD = "6b675f5c834b41f9d74e8a54294ff44dddf28ae4"
-CRASHED_SESSION = "65664-4f248d213d60"
-LEASE_COMMENT = 11131
-REPO = "Scaled-Tech-Consulting/Gitea-Tools"
-PR = 701
-ISSUE = 699
-LEASE_WORKTREE = "branches/review-fix-issue-699-structured-auth-mcp-errors"
-
-
-def _now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def _lease_comment(
-    *,
-    phase: str = "validation-start",
-    candidate_head: str = OLD_HEAD,
-    session_id: str = CRASHED_SESSION,
-    comment_id: int = LEASE_COMMENT,
-    last_activity: datetime | None = None,
-    expires_at: datetime | None = None,
-    worktree: str = LEASE_WORKTREE,
-) -> dict:
-    stamp = last_activity or _now()
-    body = leases.format_lease_body(
-        repo=REPO,
-        pr_number=PR,
-        issue_number=ISSUE,
-        reviewer_identity="sysadmin",
-        profile="prgs-reviewer",
-        session_id=session_id,
-        worktree=worktree,
-        phase=phase,
-        candidate_head=candidate_head,
-        target_branch="master",
-        target_branch_sha="2" * 40,
-        last_activity=stamp,
-        expires_at=expires_at,
-    )
-    return {
-        "id": comment_id,
-        "body": body,
-        "user": {"login": "sysadmin"},
-        "author": "sysadmin",
-        "created_at": stamp.isoformat(),
-        "updated_at": stamp.isoformat(),
-    }
-
-
-def _expired_superseded_comments() -> list[dict]:
-    stale = _now() - timedelta(hours=3)
-    return [_lease_comment(
-        last_activity=stale,
-        expires_at=stale + timedelta(minutes=120),
-    )]
-
-
-def _fresh_superseded_comments() -> list[dict]:
-    recent = _now() - timedelta(minutes=10)
-    return [_lease_comment(
-        last_activity=recent,
-        expires_at=recent + timedelta(minutes=120),
-    )]
-
-
-class TestLostInSessionLeaseShadow(unittest.TestCase):
-    """Scenario 1: the durable shadow survives a daemon crash (#702 AC3)."""
-
-    def setUp(self):
-        leases._SESSION_LEASE = None
-
-    def tearDown(self):
-        leases._SESSION_LEASE = None
-
-    def _record(self) -> dict:
-        return leases.record_session_lease(
-            {
-                "pr_number": PR,
-                "issue_number": ISSUE,
-                "session_id": CRASHED_SESSION,
-                "reviewer_identity": "sysadmin",
-                "profile": "prgs-reviewer",
-                "worktree": LEASE_WORKTREE,
-                "phase": "claimed",
-                "candidate_head": OLD_HEAD,
-                "repo": REPO,
-                "comment_id": LEASE_COMMENT,
-            },
-            lease_provenance={"source": "acquire", "comment_id": LEASE_COMMENT},
-        )
-
-    def test_shadow_written_on_record_and_survives_simulated_crash(self):
-        self._record()
-        # Simulated unhandled crash: the in-memory dict dies with the process
-        # but the sanctioned clear path never runs.
-        leases._SESSION_LEASE = None
-        shadow = leases.load_session_lease_shadow()
-        self.assertIsNotNone(shadow)
-        self.assertEqual(shadow.get("session_id"), CRASHED_SESSION)
-        self.assertEqual(shadow.get("pr_number"), PR)
-        self.assertEqual(int(shadow.get("owner_pid")), os.getpid())
-
-    def test_sanctioned_clear_removes_shadow(self):
-        self._record()
-        leases.clear_session_lease()
-        self.assertIsNone(leases.load_session_lease_shadow())
-
-    def test_orphan_assessment_dead_owner_pid_proves_exit(self):
-        self._record()
-        leases._SESSION_LEASE = None
-        shadow = leases.load_session_lease_shadow()
-        lease = {"session_id": CRASHED_SESSION}
-        verdict = leases.assess_crashed_session_lease_orphan(
-            shadow, lease=lease, current_pid=os.getpid() + 1, pid_alive=False
-        )
-        self.assertTrue(verdict["orphan_evidence"])
-        self.assertIs(verdict["owner_process_alive"], False)
-
-    def test_orphan_assessment_alive_pid_is_not_ownership_proof(self):
-        self._record()
-        shadow = leases.load_session_lease_shadow()
-        verdict = leases.assess_crashed_session_lease_orphan(
-            shadow,
-            lease={"session_id": CRASHED_SESSION},
-            current_pid=os.getpid() + 1,
-            pid_alive=True,
-        )
-        self.assertFalse(verdict["orphan_evidence"])
-        self.assertIsNone(verdict["owner_process_alive"])
-
-    def test_orphan_assessment_session_mismatch_proves_nothing(self):
-        self._record()
-        shadow = leases.load_session_lease_shadow()
-        verdict = leases.assess_crashed_session_lease_orphan(
-            shadow, lease={"session_id": "other-999"}, pid_alive=False
-        )
-        self.assertFalse(verdict["orphan_evidence"])
-        self.assertIsNone(verdict["owner_process_alive"])
-
-    def test_orphan_assessment_without_shadow_is_unknown(self):
-        verdict = leases.assess_crashed_session_lease_orphan(
-            None, lease={"session_id": CRASHED_SESSION}
-        )
-        self.assertFalse(verdict["orphan_evidence"])
-        self.assertIsNone(verdict["owner_process_alive"])
-
-
-class TestOldHeadLeaseCleanup(unittest.TestCase):
-    """Scenario 2: expired superseded-head lease with no terminal review."""
-
-    def _assess(self, comments, **kwargs):
-        defaults = dict(
-            pr_number=PR,
-            current_head_sha=NEW_HEAD,
-            formal_reviews=[],
-            repo=REPO,
-            expected_repo=REPO,
-            requesting_session_id="fresh-controller",
-            controller_recovery_authorized=True,
-            worktree_exists=True,
-            worktree_clean=True,
-            owner_process_alive=False,
-        )
-        defaults.update(kwargs)
-        return leases.assess_obsolete_reviewer_comment_lease_cleanup(
-            comments, **defaults
-        )
-
-    def test_expired_orphan_with_full_evidence_is_cleanup_eligible(self):
-        result = self._assess(_expired_superseded_comments())
-        self.assertEqual(result["classification"], "orphaned_expired_superseded_head")
-        self.assertTrue(result["cleanup_allowed"])
-        self.assertIn("phase: released", result["release_body"] or "")
-        self.assertEqual(
-            result["exact_next_action"], "cleanup_obsolete_reviewer_comment_lease"
-        )
-
-    def test_expired_orphan_without_owner_evidence_fails_closed(self):
-        result = self._assess(
-            _expired_superseded_comments(), owner_process_alive=None
-        )
-        self.assertFalse(result["cleanup_allowed"])
-        self.assertIn(
-            "provable owner-process-exit evidence",
-            " ".join(result["fail_closed_reasons"]),
-        )
-
-    def test_expired_orphan_without_controller_authority_fails_closed(self):
-        result = self._assess(
-            _expired_superseded_comments(), controller_recovery_authorized=False
-        )
-        self.assertFalse(result["cleanup_allowed"])
-
-    def test_expired_orphan_with_dirty_worktree_fails_closed(self):
-        result = self._assess(
-            _expired_superseded_comments(),
-            worktree_clean=False,
-            worktree_has_unpreserved_work=True,
-        )
-        self.assertFalse(result["cleanup_allowed"])
-
-    def test_unexpired_superseded_no_terminal_stays_ambiguous_wait(self):
-        # Regression guard: pre-expiry there is still no steal path.
-        result = self._assess(_fresh_superseded_comments())
-        self.assertEqual(result["classification"], "ambiguous_conflicting_evidence")
-        self.assertFalse(result["cleanup_allowed"])
-        self.assertEqual(result["exact_next_action"], "wait")
-
-
-class TestRuntimeWorktreeMismatch(unittest.TestCase):
-    """Scenario 3: env bindings to deleted worktrees are demoted (#702 AC2)."""
-
-    def test_missing_active_env_binding_is_demoted(self):
-        demotions: list[str] = []
-        missing = "/nonexistent/branches/review-pr-654"
-        path, source = nwb.resolve_namespace_workspace(
-            role_kind="reviewer",
-            process_project_root=os.getcwd(),
-            env={"GITEA_ACTIVE_WORKTREE": missing},
-            demotions=demotions,
-            verify_paths=True,
-        )
-        self.assertEqual(source, "MCP server process root (default)")
-        self.assertEqual(len(demotions), 1)
-        self.assertIn("no longer exists", demotions[0])
-
-    def test_missing_active_falls_through_to_existing_role_env(self):
-        existing = os.getcwd()
-        path, source = nwb.resolve_namespace_workspace(
-            role_kind="reviewer",
-            process_project_root="/tmp",
-            env={
-                "GITEA_ACTIVE_WORKTREE": "/nonexistent/branches/review-pr-654",
-                "GITEA_REVIEWER_WORKTREE": existing,
-            },
-            verify_paths=True,
-        )
-        self.assertEqual(path, os.path.realpath(existing))
-        self.assertEqual(source, "GITEA_REVIEWER_WORKTREE environment variable")
-
-    def test_existing_active_env_binding_still_wins(self):
-        existing = os.getcwd()
-        path, source = nwb.resolve_namespace_workspace(
-            role_kind="reviewer",
-            process_project_root="/tmp",
-            env={"GITEA_ACTIVE_WORKTREE": existing},
-            verify_paths=True,
-        )
-        self.assertEqual(path, os.path.realpath(existing))
-        self.assertEqual(source, "GITEA_ACTIVE_WORKTREE environment variable")
-
-    def test_explicit_worktree_path_argument_is_never_demoted(self):
-        missing = "/nonexistent/branches/explicit"
-        path, source = nwb.resolve_namespace_workspace(
-            role_kind="reviewer",
-            worktree_path=missing,
-            process_project_root="/tmp",
-            env={},
-            verify_paths=True,
-        )
-        self.assertEqual(source, "worktree_path argument")
-
-    def test_mutation_context_reports_demotion_in_ignored_bindings(self):
-        ctx = nwb.resolve_namespace_mutation_context(
-            role_kind="reviewer",
-            worktree_path=None,
-            process_project_root=os.getcwd(),
-            env={"GITEA_ACTIVE_WORKTREE": "/nonexistent/branches/review-pr-654"},
-        )
-        joined = " ".join(ctx["ignored_bindings"])
-        self.assertIn("stale binding, #702", joined)
-
-
-class TestManagedReconnectRecovery(unittest.TestCase):
-    """Scenario 4: boot-inherited bindings and the sanctioned recovery plan."""
-
-    def test_uncorroborated_inherited_reviewer_binding_is_unverified(self):
-        classification = sbr.classify_active_worktree_binding(
-            active_value=os.getcwd(),
-            role_env_value=None,
-            session_lease_worktree=None,
-            boot_inherited=True,
-            path_exists=True,
-            role_kind="reviewer",
-        )
-        self.assertEqual(
-            classification["classification"], sbr.CLASSIFICATION_UNVERIFIED_INHERITED
-        )
-        self.assertFalse(classification["clear_eligible"])
-        plan = sbr.plan_recovery(classification)
-        self.assertFalse(plan["clear_allowed"])
-        self.assertIn("managed", plan["exact_next_action"])
-        self.assertIn("do not clear or rewrite", plan["exact_next_action"])
-
-    def test_missing_path_binding_is_provably_stale_and_clear_eligible(self):
-        classification = sbr.classify_active_worktree_binding(
-            active_value="/nonexistent/branches/review-pr-654",
-            boot_inherited=True,
-            path_exists=False,
-            role_kind="reviewer",
-        )
-        self.assertEqual(
-            classification["classification"],
-            sbr.CLASSIFICATION_PROVABLY_STALE_MISSING_PATH,
-        )
-        plan = sbr.plan_recovery(classification)
-        self.assertTrue(plan["clear_allowed"])
-
-    def test_inherited_binding_superseded_by_session_lease_is_clear_eligible(self):
-        classification = sbr.classify_active_worktree_binding(
-            active_value="/tmp",
-            session_lease_worktree=os.getcwd(),
-            boot_inherited=True,
-            path_exists=True,
-            role_kind="reviewer",
-        )
-        self.assertEqual(
-            classification["classification"],
-            sbr.CLASSIFICATION_SUPERSEDED_BY_SESSION_LEASE,
-        )
-        self.assertTrue(sbr.plan_recovery(classification)["clear_allowed"])
-
-    def test_post_boot_binding_conflict_is_surfaced_not_cleared(self):
-        classification = sbr.classify_active_worktree_binding(
-            active_value="/tmp",
-            session_lease_worktree=os.getcwd(),
-            boot_inherited=False,
-            path_exists=True,
-            role_kind="reviewer",
-        )
-        self.assertEqual(
-            classification["classification"], sbr.CLASSIFICATION_UNVERIFIED_INHERITED
-        )
-        self.assertFalse(sbr.plan_recovery(classification)["clear_allowed"])
-
-    def test_corroborated_bindings_are_untouched(self):
-        for kwargs in (
-            dict(role_env_value=os.getcwd()),
-            dict(session_lease_worktree=os.getcwd()),
-        ):
-            classification = sbr.classify_active_worktree_binding(
-                active_value=os.getcwd(),
-                boot_inherited=True,
-                path_exists=True,
-                role_kind="reviewer",
-                **kwargs,
-            )
-            self.assertEqual(
-                classification["classification"], sbr.CLASSIFICATION_CORROBORATED
-            )
-            self.assertFalse(sbr.plan_recovery(classification)["clear_allowed"])
-
-    def test_author_inherited_binding_stays_corroborated(self):
-        classification = sbr.classify_active_worktree_binding(
-            active_value=os.getcwd(),
-            boot_inherited=True,
-            path_exists=True,
-            role_kind="author",
-        )
-        self.assertEqual(
-            classification["classification"], sbr.CLASSIFICATION_CORROBORATED
-        )
-
-    def test_apply_recovery_clears_env_only_for_authorized_plan(self):
-        env = {"GITEA_ACTIVE_WORKTREE": "/nonexistent/branches/review-pr-654"}
-        plan = sbr.plan_recovery(
-            sbr.classify_active_worktree_binding(
-                active_value=env["GITEA_ACTIVE_WORKTREE"],
-                boot_inherited=True,
-                path_exists=False,
-                role_kind="reviewer",
-            )
-        )
-        applied = sbr.apply_recovery(plan, env=env)
-        self.assertTrue(applied["performed"])
-        self.assertNotIn("GITEA_ACTIVE_WORKTREE", env)
-        self.assertIn("review-pr-654", applied["cleared_value"])
-
-    def test_apply_recovery_refuses_unauthorized_plan(self):
-        env = {"GITEA_ACTIVE_WORKTREE": os.getcwd()}
-        plan = sbr.plan_recovery(
-            sbr.classify_active_worktree_binding(
-                active_value=env["GITEA_ACTIVE_WORKTREE"],
-                boot_inherited=True,
-                path_exists=True,
-                role_kind="reviewer",
-            )
-        )
-        applied = sbr.apply_recovery(plan, env=env)
-        self.assertFalse(applied["performed"])
-        self.assertIn("GITEA_ACTIVE_WORKTREE", env)
-
-
-class TestSafeExpiryDiagnosis(unittest.TestCase):
-    """Scenario 5: canonical expiry flips wait into acquire/guarded cleanup."""
-
-    def _diagnose(self, comments, **kwargs):
-        defaults = dict(
-            pr_number=PR,
-            current_session_id=None,
-            current_reviewer_identity="fresh-reviewer",
-            current_head_sha=NEW_HEAD,
-            formal_reviews=[],
-        )
-        defaults.update(kwargs)
-        return leases.diagnose_reviewer_pr_lease_handoff(comments, **defaults)
-
-    def setUp(self):
-        leases._SESSION_LEASE = None
-
-    def test_pre_expiry_superseded_no_terminal_stays_wait(self):
-        diagnosis = self._diagnose(_fresh_superseded_comments())
-        self.assertEqual(
-            diagnosis["classification"], "ambiguous_conflicting_evidence"
-        )
-        self.assertEqual(diagnosis["next_action"], "wait")
-
-    def test_post_expiry_without_orphan_evidence_unlocks_acquire(self):
-        diagnosis = self._diagnose(_expired_superseded_comments())
-        self.assertEqual(
-            diagnosis["classification"], "orphaned_expired_superseded_head"
-        )
-        self.assertEqual(diagnosis["next_action"], "acquire")
-
-    def test_post_expiry_with_orphan_evidence_offers_guarded_cleanup(self):
-        diagnosis = self._diagnose(
-            _expired_superseded_comments(),
-            owner_process_alive=False,
-            worktree_clean=True,
-            worktree_exists=True,
-        )
-        self.assertEqual(
-            diagnosis["classification"], "orphaned_expired_superseded_head"
-        )
-        self.assertEqual(
-            diagnosis["next_action"], "cleanup_obsolete_reviewer_comment_lease"
-        )
-
-    def test_expired_lease_no_longer_blocks_fresh_acquisition(self):
-        assessment = leases.assess_acquire_lease(
-            _expired_superseded_comments(),
-            pr_number=PR,
-            reviewer_identity="fresh-reviewer",
-            profile="prgs-reviewer",
-            session_id="99999-fresh",
-            repo=REPO,
-            issue_number=ISSUE,
-            worktree="branches/review-pr-701-fresh",
-            candidate_head=NEW_HEAD,
-            target_branch="master",
-            target_branch_sha="2" * 40,
-        )
-        self.assertTrue(assessment.get("acquire_allowed"))
-
-    def test_unparseable_expiry_fails_closed_in_cleanup(self):
-        comment = _lease_comment(
-            last_activity=_now() - timedelta(hours=3), expires_at=None
-        )
-        comment["body"] = comment["body"].replace(
-            "expires_at: ", "expires_at: not-a-timestamp"
-        )
-        result = leases.assess_obsolete_reviewer_comment_lease_cleanup(
-            [comment],
-            pr_number=PR,
-            current_head_sha=NEW_HEAD,
-            formal_reviews=[],
-            repo=REPO,
-            expected_repo=REPO,
-            requesting_session_id="fresh-controller",
-            controller_recovery_authorized=True,
-            worktree_exists=True,
-            worktree_clean=True,
-            owner_process_alive=False,
-        )
-        self.assertFalse(result["cleanup_allowed"])
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_mcp_server.py

@@ -1425,10 +1425,16 @@ class TestReviewPR(unittest.TestCase):
 class TestDeleteBranch(unittest.TestCase):
 
     DELETE_PROFILE = {
-        "profile_name": "test-deleter",
-        "allowed_operations": ["gitea.read", "gitea.branch.delete"],
+        "profile_name": "test-author-deleter",
+        "role": "author",
+        "allowed_operations": [
+            "gitea.read",
+            "gitea.pr.create",
+            "gitea.branch.push",
+            "gitea.branch.delete",
+        ],
         "forbidden_operations": [],
-        "audit_label": "test-deleter",
+        "audit_label": "test-author-deleter",
     }
 
     @patch("mcp_server.get_profile", return_value=DELETE_PROFILE)

tests/test_migrate_profiles.py

@@ -92,14 +92,19 @@ class TestMigrateProfiles(unittest.TestCase):
         author = prgs_gitea["identities"]["author"]
         self.assertEqual(author["username"], "jcwalker3")
         self.assertEqual(author["auth"]["id"], "redacted-author-ref")
-        self.assertEqual(author["allowed_operations"], ["read", "comment"])
-        self.assertEqual(author["forbidden_operations"], ["approve", "merge"])
+        self.assertEqual(
+            author["allowed_operations"], ["gitea.read", "gitea.pr.comment"]
+        )
+        self.assertEqual(
+            author["forbidden_operations"],
+            ["gitea.pr.approve", "gitea.pr.merge"],
+        )
 
         reviewer = prgs_gitea["identities"]["reviewer"]
         self.assertEqual(reviewer["role"], "reviewer")
         self.assertEqual(reviewer["username"], "sysadmin")
         self.assertEqual(reviewer["auth"]["id"], "redacted-reviewer-ref")
-        self.assertIn("merge", reviewer["allowed_operations"])
+        self.assertIn("gitea.pr.merge", reviewer["allowed_operations"])
 
     def test_alias_generation(self):
         """Test that aliases are correctly generated to support old profile names."""
@@ -188,7 +193,7 @@ class TestMigrateProfiles(unittest.TestCase):
         self.assertNotIn("token", stdout_output.lower())
 
     def test_explicit_operations_are_preserved(self):
-        """Explicit v1 permissions must not be replaced by role defaults."""
+        """Explicit v1 permissions are canonicalized, not replaced by role defaults."""
         v1_data = json.loads(json.dumps(self.v1_content))
         v1_data["profiles"]["prgs-reviewer"]["allowed_operations"] = ["read"]
         v1_data["profiles"]["prgs-reviewer"]["forbidden_operations"] = ["merge"]
@@ -198,8 +203,8 @@ class TestMigrateProfiles(unittest.TestCase):
             v2_data["environments"]["prgs"]["services"]["gitea"]
             ["identities"]["reviewer"]
         )
-        self.assertEqual(reviewer["allowed_operations"], ["read"])
-        self.assertEqual(reviewer["forbidden_operations"], ["merge"])
+        self.assertEqual(reviewer["allowed_operations"], ["gitea.read"])
+        self.assertEqual(reviewer["forbidden_operations"], ["gitea.pr.merge"])
 
     def test_inferred_role_defaults_only_when_unambiguous(self):
         """Role defaults are allowed only for clear author/reviewer profiles."""
@@ -306,6 +311,171 @@ class TestMigrateProfiles(unittest.TestCase):
                 migrate_profiles.main()
             self.assertEqual(cm.exception.code, 1)
 
+    def test_reconciler_profile_migration(self):
+        """Legacy reconciler shorthands migrate to valid canonical operations."""
+        import gitea_config
+        import reconciler_profile
+
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                    "allowed_operations": [
+                        "read",
+                        "pr.close",
+                        "pr.comment",
+                        "issue.comment",
+                        "issue.close",
+                        "gitea.branch.delete",
+                    ],
+                    "forbidden_operations": [
+                        "merge",
+                        "approve",
+                        "review",
+                        "pr.create",
+                        "branch.push",
+                        "commit",
+                    ],
+                }
+            }
+        }
+        v2_data = migrate_profiles.migrate_v1_to_v2(v1_data)
+        reconciler = (
+            v2_data["environments"]["prgs"]["services"]["gitea"]
+            ["identities"]["reconciler"]
+        )
+        self.assertEqual(reconciler["role"], "reconciler")
+        allowed = reconciler["allowed_operations"]
+        forbidden = reconciler["forbidden_operations"]
+        # No invalid shorthand remains
+        for bad in ("pr.close", "pr.comment", "issue.close", "read", "merge"):
+            self.assertNotIn(bad, allowed)
+            self.assertNotIn(bad, forbidden)
+        for required in (
+            "gitea.read",
+            "gitea.pr.close",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+            "gitea.issue.close",
+            "gitea.branch.delete",
+        ):
+            self.assertIn(required, allowed)
+            # Production loader accepts every allowed op
+            self.assertEqual(
+                gitea_config.normalize_operation(required), required
+            )
+        self.assertEqual(v2_data["aliases"]["prgs-reconciler"], "prgs.gitea.reconciler")
+        assessment = reconciler_profile.assess_reconciler_profile(allowed, forbidden)
+        self.assertTrue(assessment["valid"])
+        self.assertTrue(migrate_profiles.validate_v2_data(v2_data))
+
+    def test_reconciler_profile_defaults(self):
+        """Reconciler defaults are fully canonical and loader-valid."""
+        import gitea_config
+        import reconciler_profile
+
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                }
+            }
+        }
+        v2_data = migrate_profiles.migrate_v1_to_v2(v1_data)
+        reconciler = (
+            v2_data["environments"]["prgs"]["services"]["gitea"]
+            ["identities"]["reconciler"]
+        )
+        self.assertEqual(reconciler["role"], "reconciler")
+        self.assertEqual(
+            reconciler["allowed_operations"],
+            migrate_profiles.RECONCILER_DEFAULT_ALLOWED,
+        )
+        self.assertEqual(
+            reconciler["forbidden_operations"],
+            migrate_profiles.RECONCILER_DEFAULT_FORBIDDEN,
+        )
+        for op in reconciler["allowed_operations"]:
+            self.assertEqual(gitea_config.normalize_operation(op), op)
+            self.assertTrue(op.startswith("gitea."))
+        assessment = reconciler_profile.assess_reconciler_profile(
+            reconciler["allowed_operations"],
+            reconciler["forbidden_operations"],
+        )
+        self.assertTrue(assessment["valid"])
+        self.assertNotIn(
+            "gitea.branch.delete", assessment["missing_recommended_operations"]
+        )
+
+    def test_reconciler_migration_idempotent_canonicalize(self):
+        """Second canonicalize of already-canonical ops is a no-op."""
+        first = migrate_profiles.canonicalize_operations(
+            list(migrate_profiles.RECONCILER_DEFAULT_ALLOWED)
+        )
+        second = migrate_profiles.canonicalize_operations(first)
+        self.assertEqual(first, second)
+        self.assertEqual(first, list(migrate_profiles.RECONCILER_DEFAULT_ALLOWED))
+
+    def test_reconciler_missing_required_fails_visibly(self):
+        """Missing gitea.pr.close after migration fails closed (not silent drop)."""
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                    "allowed_operations": ["read", "gitea.branch.delete"],
+                    "forbidden_operations": ["merge"],
+                }
+            },
+        }
+        with self.assertRaisesRegex(ValueError, "missing required"):
+            migrate_profiles.migrate_v1_to_v2(v1_data)
+
+    def test_unknown_operation_fails_visibly(self):
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-author": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "jcwalker3",
+                    "auth": {"type": "keychain", "id": "hidden-author-ref"},
+                    "execution_profile": "prgs-author",
+                    "allowed_operations": ["read", "not.a.real.op"],
+                    "forbidden_operations": ["merge"],
+                }
+            },
+        }
+        with self.assertRaisesRegex(ValueError, "cannot be canonicalized"):
+            migrate_profiles.migrate_v1_to_v2(v1_data)
+
+    def test_role_inference_author_reviewer_merger_reconciler(self):
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-author", "prgs-author"), "author"
+        )
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-reviewer", "prgs-reviewer"),
+            "reviewer",
+        )
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-reconciler", "prgs-reconciler"),
+            "reconciler",
+        )
+        self.assertIsNone(
+            migrate_profiles.infer_role("prgs-merger", "prgs-merger")
+        )
+
 
 if __name__ == "__main__":
     unittest.main()
+

tests/test_reconciler_profile.py

@@ -82,6 +82,42 @@ class TestReconcilerProfileModel(unittest.TestCase):
             "reconciler",
         )
 
+    def test_branch_delete_is_recommended_for_reconciler(self):
+        self.assertIn(
+            "gitea.branch.delete",
+            reconciler_profile.RECONCILER_RECOMMENDED_OPERATIONS,
+        )
+        self.assertNotIn(
+            "gitea.branch.delete",
+            reconciler_profile.RECONCILER_REQUIRED_OPERATIONS,
+        )
+
+    def test_reconciler_with_branch_delete_stays_valid(self):
+        allowed = PRGS_RECONCILER_ALLOWED + ["gitea.branch.delete"]
+        result = reconciler_profile.assess_reconciler_profile(
+            allowed,
+            PRGS_RECONCILER_FORBIDDEN,
+        )
+        self.assertTrue(result["is_reconciler_profile"])
+        self.assertTrue(result["valid"])
+        self.assertNotIn(
+            "gitea.branch.delete", result["missing_recommended_operations"]
+        )
+        self.assertEqual(
+            mcp_server._role_kind(allowed, PRGS_RECONCILER_FORBIDDEN),
+            "reconciler",
+        )
+
+    def test_reconciler_without_branch_delete_reports_missing_recommended(self):
+        result = reconciler_profile.assess_reconciler_profile(
+            PRGS_RECONCILER_ALLOWED,
+            PRGS_RECONCILER_FORBIDDEN,
+        )
+        self.assertTrue(result["valid"])
+        self.assertIn(
+            "gitea.branch.delete", result["missing_recommended_operations"]
+        )
+
 
 if __name__ == "__main__":
     unittest.main()