Merge branch 'master' into feat/issue-642-sanctioned-restart-controls

Adds a gated `system.restart_namespace` action so operators and workers can
restart or gracefully reload MCP namespaces through an authorized, audited
path instead of manual host process killing (#630).

- webui/sanctioned_restart.py: restart/reload operation model, dry-run
  intent preview, confirmation-string enforcement, audit emission, and
  post-restart health verification. Fails closed on unknown auth, missing
  capability, or ambiguous target namespace.
- webui/console_authz.py: RBAC entries for the restart capability with
  secret redaction preserved.
- webui/gated_actions.py: registers the restart action in the gated action
  framework so it cannot be invoked without capability + confirmation.
- task_capability_map.py: capability mapping for the restart operation.
- docs/sanctioned-restart-controls.md: operator documentation for the
  sanctioned path and the explicit prohibition on pkill recovery.
- docs/webui-authz-audit.md: audit model updated for restart events.
- tests/test_webui_sanctioned_restart.py: authorized preview, unauthorized
  deny, confirmation enforcement, contamination classification, and audit
  emission coverage.

No unrestricted kill path is exposed; manual pkill remains classified as
contamination and continues to block clean claims.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/sanctioned-restart-controls.md

@@ -0,0 +1,122 @@
+# Sanctioned restart and graceful reload controls (#642)
+
+Sessions used to recover MCP connectivity by killing the host daemon
+(`pkill -f mcp_server.py`, #630). That is forbidden and stays forbidden: it
+kills every namespace on the host, contaminates whichever session survives, and
+leaves no audit trail. This document describes the sanctioned replacement,
+implemented in `webui/sanctioned_restart.py`.
+
+## What the console will and will not do
+
+The console **never** restarts anything. It authorizes an intent, records it,
+and hands off to a host supervisor. There is no code path in which the console
+sends a signal, spawns a process, or renders a kill command — a regression test
+asserts the module contains no `subprocess`, `signal`, `os.kill`, `os.system`,
+or `popen` reference, and that no returned payload contains a kill command.
+
+## Operations
+
+| Mode | Action | Minimum role | Behaviour |
+|------|--------|--------------|-----------|
+| `reload` | `system.reload_namespace` | controller | Host supervisor reloads the namespace in place, draining in-flight requests. |
+| `restart` | `system.restart_namespace` | admin | Host supervisor restarts the namespace. In-flight requests are lost. |
+
+Scope is always exactly one namespace. A fleet-wide restart is an explicit
+non-goal: `all`, `*`, `fleet`, and an empty scope are refused with
+`fleet_scope_not_permitted`, because that is precisely the blast radius the
+forbidden kill already had. An unrecognised namespace is refused rather than
+passed through to the host.
+
+## The gate sequence
+
+`assess_restart_request()` applies every gate in order and reports the first
+failure with a stable reason code:
+
+| Order | Gate | Reason code on failure |
+|-------|------|------------------------|
+| 1 | Mode is `restart` or `reload` | `unknown_mode` |
+| 2 | Scope is a single known namespace | `fleet_scope_not_permitted`, `unknown_namespace` |
+| 3 | Principal holds the required console role | `unauthorized` |
+| 4 | Confirmation phrase supplied | `confirmation_required` |
+| 5 | Confirmation names this namespace and mode | `confirmation_mismatch` |
+| 6 | Out-of-band operator authorization present | `operator_authorization_missing` |
+| 7 | Runtime is not contaminated | `contaminated_runtime` |
+| 8 | Host restart hook configured | `restart_hook_not_configured` |
+
+Passing every gate yields `host_action_required`, never "restarted".
+
+### Confirmation binds the namespace
+
+The required phrase is `"<mode> <namespace>"` — for example
+`restart gitea-author`. Binding the namespace into the phrase is the point: a
+confirmation typed for one namespace cannot be replayed against another.
+
+### Operator authorization is not self-assertable
+
+Host daemon maintenance is authorized out of band through
+`GITEA_OPERATOR_DAEMON_MAINTENANCE_AUTHORIZATION`, read from the process
+environment and nowhere else (#630; #710 finding F1). A worker session cannot
+set an environment variable for an already-running daemon, so this cannot be
+faked the way a tool argument could.
+
+### The host hook
+
+`GITEA_SANCTIONED_RESTART_HOOK` holds an opaque reference the *host* resolves —
+a supervisor label such as a launchd job name, never a command line. With no
+hook configured the request is refused; the console does not fall back to a
+process kill. The value is read server-side and never rendered to a client.
+
+## Manual kill remains contamination
+
+`classify_restart_command()` classifies an operator-proposed recovery command.
+A manual `pkill`/`kill`/`killall` of the MCP daemon is contamination, not a
+restart: it returns `clean_claim_allowed: false` and builds a durable
+contamination marker (redacted command only, never secrets) naming
+`system.restart_namespace` as the sanctioned alternative.
+
+A live, uncleared contamination marker also blocks a restart. This is stricter
+than #630's task-scoped gate, which deliberately lets a contaminated worker keep
+commenting and handing off: restarting a contaminated runtime would launder the
+contamination rather than resolve it. Clear the marker through the reconciler
+path first.
+
+## Post-restart health verification
+
+After the host supervisor acts, `verify_post_restart_health()` decides whether
+the session may claim to be clean:
+
+| Status | Meaning | Clean claim |
+|--------|---------|-------------|
+| `clean` | Required tool callable, proven through the live client namespace | Allowed |
+| `unproven` | Reported healthy without live client-namespace evidence | Refused |
+| `unhealthy` | Probe failed | Refused |
+
+Only `probe_source=client_namespace` evidence clears a session. Static tool
+registration is not proof, and neither is an offline subprocess probe — an IDE
+client can hold a registered tool list while live calls fail with
+`client is closing: EOF` (see
+[`mcp-namespace-health.md`](mcp-namespace-health.md)).
+
+## Audit
+
+Every attempt — allowed or denied — is recorded through
+`webui.console_audit` with actor, target namespace, mode, result, and reason
+code, and is redacted before it is persisted. `system.restart_namespace` is
+break-glass, so its records are retained for 730 days. Records carry
+`process_kill_executed: false`, which is a fact about the code path rather than
+a claim: no such path exists.
+
+## Environment variables
+
+| Variable | Purpose |
+|----------|---------|
+| `GITEA_SANCTIONED_RESTART_HOOK` | Host supervisor reference; absent means restart is refused. |
+| `GITEA_OPERATOR_DAEMON_MAINTENANCE_AUTHORIZATION` | Out-of-band operator authorization reference. |
+| `WEBUI_AUDIT_LOG` | Console audit sink; absent means records are built but not persisted. |
+
+## Non-goals
+
+* No unrestricted `kill` from the UI, in any role, in any phase.
+* No fleet-wide restart.
+* No silent auto-restart loop: every attempt is confirmed and audited.
+* This does not implement the Phase 1 health API (#634).

docs/webui-authz-audit.md

@@ -91,6 +91,8 @@ already define, and a regression test asserts each mapping matches.
 | `close_pr` | controller | privileged | `gitea.pr.close` | Yes | No | No | 3 |
 | `merge_pr` | controller | privileged | `gitea.pr.merge` | Yes | **Yes** | **Yes** | 3 |
 | `delete_branch` | admin | destructive | `gitea.branch.delete` | Yes | **Yes** | **Yes** | 3 |
+| `system.reload_namespace` | controller | privileged | `runtime.reload_namespace` | Yes | No | No | 2 |
+| `system.restart_namespace` | admin | destructive | `runtime.restart_namespace` | Yes | **Yes** | **Yes** | 2 |
 
 **Dual control** means the acting principal may not be the sole authority: a
 second distinct principal must confirm. **Break-glass** means the action is
@@ -102,6 +104,13 @@ honouring it.
 `delete_branch` is admin-only rather than controller because it is the one
 irreversible action in the set.
 
+`system.restart_namespace` is admin-only for the same reason: restarting a
+namespace drops every in-flight request on it. `system.reload_namespace` drains
+first, so it is privileged but not destructive. Neither action is ever executed
+by the console — both hand off to a host supervisor, and neither exposes a raw
+process kill. See
+[`sanctioned-restart-controls.md`](sanctioned-restart-controls.md) (#642).
+
 ### Authorization decision
 
 `authorize(action_id, principal, for_execution=False)` returns a decision
@@ -199,8 +208,8 @@ breaking the request it describes.
 | Class | Applies to | Default |
 |-------|-----------|---------|
 | `standard` | Routine gated writes | 90 days |
-| `privileged` | `review_pr`, `close_pr`, and any unclassifiable action | 365 days |
-| `break_glass` | `merge_pr`, `delete_branch` | 730 days |
+| `privileged` | `review_pr`, `close_pr`, `system.reload_namespace`, and any unclassifiable action | 365 days |
+| `break_glass` | `merge_pr`, `delete_branch`, `system.restart_namespace` | 730 days |
 
 Each record carries its own class, day count, and computed `expires_at`, so
 retention is auditable per record rather than inferred from file age. An

gitea_mcp_server.py

@@ -1469,7 +1469,7 @@ def verify_preflight_purity(
             dirty_files = sorted(
                 _parse_porcelain_entries(_get_workspace_porcelain(workspace))
             )
-            if dirty_files and task != "commit_files":
+            if dirty_files:
                 raise RuntimeError(
                     nwb.format_namespace_workspace_binding_error(
                         role_kind=role,
@@ -2050,7 +2050,6 @@ import issue_lock_store  # noqa: E402
 import issue_lock_adoption  # noqa: E402
 import issue_lock_recovery  # noqa: E402
 import issue_lock_renewal  # noqa: E402
-import dirty_orphan_worktree_recovery  # noqa: E402  # #860 dirty orphan recovery
 import dirty_same_claimant_session_rebind  # noqa: E402  # #864
 import stacked_pr_support  # noqa: E402
 import merge_approval_gate  # noqa: E402
@@ -4363,280 +4362,6 @@ def gitea_lock_issue(
     return result
 
 
-@mcp.tool()
-@mcp.tool()
-def gitea_recover_dirty_orphaned_issue_worktree(
-    issue_number: int,
-    branch_name: str,
-    source_worktree_path: str,
-    expected_local_head: str,
-    expected_remote_head: str,
-    expected_dirty_fingerprints: dict,
-    remote: str = "dadeschools",
-    host: str | None = None,
-    org: str | None = None,
-    repo: str | None = None,
-    recovery_worktree_path: str | None = None,
-    dry_run: bool = False,
-) -> dict:
-    """Recover a dirty orphaned same-claimant author issue worktree (#860).
-
-    Explicit recovery operation — does **not** silently widen ``gitea_lock_issue``.
-
-    Accepts authoritative expected pins (repository, issue, branch, source
-    worktree, claimant, local head, remote/PR head, dirty fingerprints) and
-    fails closed on any mismatch. PID-less malformed locks are never treated
-    as live merely because expiry is absent. The source worktree is frozen;
-    recovery prepares a separate worktree at the pinned remote head, re-applies
-    dirty bytes with path-level conflict detection, and binds a live author
-    session only after recovery state is consistent.
-
-    Args:
-        issue_number: Issue whose durable claim is being recovered.
-        branch_name: Locked branch ``(fix|feat|docs|chore)/issue-N-…``.
-        source_worktree_path: Registered dirty source worktree under branches/.
-        expected_local_head: Full 40-char SHA of the source worktree HEAD.
-        expected_remote_head: Full 40-char SHA of the remote/PR head to sync to.
-        expected_dirty_fingerprints: ``{relative_path: sha256}`` of dirty bytes.
-        remote/host/org/repo: Repository binding.
-        recovery_worktree_path: Optional recovery worktree path under branches/.
-        dry_run: Assess eligibility only; no filesystem or lock mutation.
-
-    Returns:
-        dict with success, outcome, conflicts, recovery_worktree_path, reasons,
-        evidence, and journal metadata.
-    """
-    task = "recover_dirty_orphaned_issue_worktree"
-    ok, block_reasons = role_session_router.check_author_mutation_after_reviewer_stop(
-        task
-    )
-    if not ok:
-        return {
-            "success": False,
-            "performed": False,
-            "outcome": "REFUSED",
-            "reasons": block_reasons,
-        }
-    blocked = _namespace_mutation_block(task, remote=remote)
-    if blocked:
-        return blocked
-    blocked = _profile_permission_block(
-        task_capability_map.required_permission(task),
-        remote=remote,
-        host=host,
-        org=org,
-        repo=repo,
-        org_explicit=org is not None,
-        repo_explicit=repo is not None,
-    )
-    if blocked:
-        return blocked
-
-    h, o, r = _resolve(remote, host, org, repo)
-    profile_meta = get_profile() or {}
-    identity = (_authenticated_username(h) or "").strip()
-    profile = (profile_meta.get("profile_name") or "").strip()
-    if not identity or not profile:
-        return {
-            "success": False,
-            "performed": False,
-            "outcome": "REFUSED",
-            "reasons": ["could not resolve authenticated identity/profile"],
-        }
-
-    existing_lock = _load_existing_issue_lock(
-        remote=remote, org=o, repo=r, issue_number=issue_number
-    )
-
-    src = os.path.realpath(source_worktree_path)
-    git_state = issue_lock_worktree.read_worktree_git_state(src)
-    observed_local = (git_state.get("head_sha") or "").strip()
-    porcelain = git_state.get("porcelain_status") or ""
-    current_branch = git_state.get("current_branch")
-
-    # Observed dirty fingerprints from source worktree bytes.
-    observed_fps: dict[str, str] = {}
-    dirty_contents: dict[str, bytes] = {}
-    for rel in (expected_dirty_fingerprints or {}):
-        rel_n = str(rel).strip()
-        fpath = os.path.join(src, rel_n)
-        if not os.path.isfile(fpath):
-            continue
-        with open(fpath, "rb") as fh:
-            data = fh.read()
-        dirty_contents[rel_n] = data
-        observed_fps[rel_n] = dirty_orphan_worktree_recovery.sha256_bytes(data)
-
-    # Remote head observation (best-effort; pin mismatch fails closed).
-    observed_remote = ""
-    try:
-        probe = subprocess.run(
-            ["git", "ls-remote", remote or "prgs", f"refs/heads/{branch_name}"],
-            cwd=src,
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        if probe.returncode == 0 and (probe.stdout or "").strip():
-            observed_remote = (probe.stdout or "").strip().split()[0]
-    except Exception:
-        observed_remote = ""
-
-    registered = False
-    try:
-        listing = subprocess.run(
-            ["git", "worktree", "list", "--porcelain"],
-            cwd=src,
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        if listing.returncode == 0:
-            registered = src in (listing.stdout or "")
-    except Exception:
-        registered = False
-
-    project_root = _canonical_local_git_root()
-    canonical_root = author_mutation_worktree.resolve_canonical_repo_root(
-        src, project_root
-    )
-
-    competing_locks: list[dict] = []
-    try:
-        all_live = issue_lock_store.list_live_locks()
-        for l in all_live:
-            if l.get("issue_number") == issue_number:
-                wt = l.get("worktree_path")
-                if not wt or not issue_lock_store._same_realpath(wt, src):
-                    competing_locks.append(l)
-    except Exception:
-        competing_locks = []
-
-    wf_active = False
-    wf_expired = True
-    try:
-        db, _ = _control_plane_db_or_error()
-        if db is not None:
-            active_leases_data = lease_lifecycle.list_active_leases(
-                db,
-                remote=remote if remote in REMOTES else remote,
-                org=o,
-                repo=r,
-            )
-            leases_list = active_leases_data.get("leases") or []
-            for l in leases_list:
-                if l.get("work_number") == issue_number and l.get("work_kind") == "issue":
-                    fresh = l.get("freshness") or {}
-                    if fresh.get("status") == "active":
-                        wf_active = True
-                        wf_expired = False
-                    elif fresh.get("status") in ("expired", "stale_dead_process"):
-                        wf_active = False
-                        wf_expired = True
-    except Exception:
-        pass
-
-    assessment = dirty_orphan_worktree_recovery.assess_dirty_orphan_recovery(
-        existing_lock,
-        issue_number=issue_number,
-        branch_name=branch_name,
-        source_worktree_path=src,
-        remote=remote if remote else "prgs",
-        org=o,
-        repo=r,
-        identity=identity,
-        profile=profile,
-        expected_local_head=expected_local_head,
-        expected_remote_head=expected_remote_head,
-        expected_dirty_fingerprints=expected_dirty_fingerprints or {},
-        current_branch=current_branch,
-        porcelain_status=porcelain,
-        observed_local_head=observed_local,
-        observed_remote_head=observed_remote,
-        observed_dirty_fingerprints=observed_fps,
-        competing_live_locks=competing_locks,
-        competing_live_sessions=[],
-        workflow_lease_active=wf_active,
-        workflow_lease_expired=wf_expired,
-        canonical_repo_root=canonical_root,
-        worktree_registered=registered,
-        current_pid=os.getpid(),
-    )
-    if dry_run or not assessment.get("eligible"):
-        return {
-            "success": bool(assessment.get("eligible")),
-            "performed": False,
-            "dry_run": dry_run,
-            "outcome": assessment.get("outcome"),
-            "reasons": list(assessment.get("reasons") or []),
-            "evidence": dict(assessment.get("evidence") or {}),
-            "eligible": bool(assessment.get("eligible")),
-        }
-
-    if not recovery_worktree_path:
-        recovery_worktree_path = os.path.join(
-            canonical_root,
-            "branches",
-            f"recovery-issue-{issue_number}-dirty-orphan",
-        )
-
-    # Load blob contents at local/remote heads for conflict detection.
-    def _blob_at(head: str, rel: str) -> bytes | None:
-        try:
-            proc = subprocess.run(
-                ["git", "show", f"{head}:{rel}"],
-                cwd=src,
-                capture_output=True,
-                check=False,
-            )
-            if proc.returncode != 0:
-                return None
-            return proc.stdout
-        except Exception:
-            return None
-
-    local_contents = {
-        rel: _blob_at(expected_local_head, rel)
-        for rel in (expected_dirty_fingerprints or {})
-    }
-    remote_contents = {
-        rel: _blob_at(expected_remote_head, rel)
-        for rel in (expected_dirty_fingerprints or {})
-    }
-
-    # Preflight purity is satisfied via explicit worktree_path on this tool's
-    # recovery path; source remains frozen and is never cleaned.
-    result = dirty_orphan_worktree_recovery.run_dirty_orphan_recovery(
-        assessment=assessment,
-        existing_lock=existing_lock or {},
-        issue_number=issue_number,
-        branch_name=branch_name,
-        source_worktree_path=src,
-        recovery_worktree_path=recovery_worktree_path,
-        remote=remote if remote else "prgs",
-        org=o,
-        repo=r,
-        identity=identity,
-        profile=profile,
-        expected_local_head=expected_local_head,
-        expected_remote_head=expected_remote_head,
-        expected_dirty_fingerprints=expected_dirty_fingerprints or {},
-        dirty_contents=dirty_contents,
-        local_head_contents=local_contents,
-        remote_head_contents=remote_contents,
-        canonical_repo_root=canonical_root,
-        bind_lock=True,
-        session_pid=os.getpid(),
-    )
-    # Surface preflight recognition for recovered provenance.
-    if result.get("success") and result.get("lock_record"):
-        result["preflight_provenance"] = (
-            dirty_orphan_worktree_recovery.preflight_recognizes_recovered_provenance(
-                result["lock_record"]
-            )
-        )
-    return result
-
 @mcp.tool()
 def gitea_rebind_dirty_same_claimant_author_session(
     issue_number: int,
@@ -4893,8 +4618,6 @@ def gitea_rebind_dirty_same_claimant_author_session(
     }
     return result
 
-    return result
-
 
 @mcp.tool()
 def gitea_assess_work_issue_duplicate(

issue_lock_provenance.py

@@ -16,7 +16,6 @@ ISSUE_LOCK_FILE = os.environ.get("GITEA_ISSUE_LOCK_FILE", "/tmp/gitea_issue_lock
 SOURCE_LOCK_ISSUE = "gitea_lock_issue"
 SOURCE_LOCK_ADOPTION = "gitea_lock_issue_adoption"
 SOURCE_OPERATOR_OVERRIDE = "operator_override"
-SOURCE_RECOVER_DIRTY_ORPHANED = "gitea_recover_dirty_orphaned_issue_worktree"
 # #864: dirty-preserving same-claimant author-session rebind (dead owner PID).
 SOURCE_DIRTY_SAME_CLAIMANT_REBIND = (
     "gitea_rebind_dirty_same_claimant_author_session"
@@ -26,7 +25,6 @@ SANCTIONED_LOCK_SOURCES = frozenset({
     SOURCE_LOCK_ISSUE,
     SOURCE_LOCK_ADOPTION,
     SOURCE_OPERATOR_OVERRIDE,
-    SOURCE_RECOVER_DIRTY_ORPHANED,
     SOURCE_DIRTY_SAME_CLAIMANT_REBIND,
 })
 

issue_lock_store.py

@@ -169,7 +169,6 @@ def bind_session_lock(
     *,
     expected_generation: int | None = None,
     renewal_sanctioned: bool = False,
-    recovery_sanctioned: bool = False,
 ) -> str:
     """Persist a keyed lock and bind it to the current process session.
 
@@ -214,9 +213,7 @@ def bind_session_lock(
     try:
         with _exclusive_file_lock(sentinel):
             existing = read_lock_file(path)
-            overwrite_block = assess_foreign_lock_overwrite(
-                existing, record, recovery_sanctioned=recovery_sanctioned
-            )
+            overwrite_block = assess_foreign_lock_overwrite(existing, record)
             if overwrite_block:
                 raise RuntimeError(overwrite_block)
             lease_block = assess_same_issue_lease_conflict(
@@ -225,7 +222,6 @@ def bind_session_lock(
                 branch_name=str(record.get("branch_name") or ""),
                 worktree_path=str(record.get("worktree_path") or ""),
                 renewal_sanctioned=renewal_sanctioned,
-                recovery_sanctioned=recovery_sanctioned,
             )
             if lease_block:
                 raise RuntimeError(lease_block)
@@ -384,18 +380,7 @@ def assess_lock_freshness(
     pid = lock_data.get("session_pid")
     if pid is None:
         pid = lock_data.get("pid")
-    if pid is None:
-        pid = lock_data.get("owner_pid")
-    pid_missing = pid is None or str(pid).strip() == ""
-    try:
-        pid_int = int(pid) if not pid_missing else None
-        if pid_int is not None and pid_int <= 0:
-            pid_missing = True
-            pid_int = None
-    except (TypeError, ValueError):
-        pid_missing = True
-        pid_int = None
-    pid_alive = is_process_alive(pid_int) if pid_int is not None else False
+    pid_alive = is_process_alive(pid) if pid is not None else False
 
     if expires_at and expires_at <= current:
         return {
@@ -404,36 +389,15 @@ def assess_lock_freshness(
             "stale": True,
             "reason": f"lease expired at {expires_at.isoformat()}",
             "pid_alive": pid_alive,
-            "pid_missing": pid_missing,
         }
 
-    # #860: a PID-less lock must never be considered live merely because
-    # expiration / heartbeat fields are absent. Missing PID is insufficient
-    # evidence of a live owner; treat as malformed/stale so recovery routes
-    # can evaluate corroborating pins instead of blocking on a false live flag.
-    if pid_missing:
-        return {
-            "status": "malformed",
-            "live": False,
-            "stale": True,
-            "reason": (
-                "lock has no usable session pid; cannot prove live ownership "
-                "(PID-less locks are never live by missing expiry alone)"
-            ),
-            "pid_alive": False,
-            "pid_missing": True,
-            "heartbeat_at": heartbeat_at.isoformat() if heartbeat_at else None,
-            "expires_at": expires_at.isoformat() if expires_at else None,
-        }
-
-    if pid_int is not None and not pid_alive:
+    if pid is not None and not pid_alive:
         return {
             "status": "stale",
             "live": False,
             "stale": True,
-            "reason": f"owner pid {pid_int} is not alive",
+            "reason": f"owner pid {pid} is not alive",
             "pid_alive": False,
-            "pid_missing": False,
         }
 
     return {
@@ -442,7 +406,6 @@ def assess_lock_freshness(
         "stale": False,
         "reason": "lock heartbeat and lease are fresh",
         "pid_alive": pid_alive,
-        "pid_missing": False,
         "heartbeat_at": heartbeat_at.isoformat() if heartbeat_at else None,
         "expires_at": expires_at.isoformat() if expires_at else None,
     }
@@ -523,7 +486,6 @@ def assess_same_issue_lease_conflict(
     worktree_path: str,
     operation_type: str = AUTHOR_ISSUE_WORK_LEASE,
     renewal_sanctioned: bool = False,
-    recovery_sanctioned: bool = False,
     now: datetime | None = None,
 ) -> str | None:
     """Return a fail-closed error when a competing live lease blocks acquisition.
@@ -555,8 +517,6 @@ def assess_same_issue_lease_conflict(
         existing_branch == branch_name
         and _same_realpath(str(existing_worktree or ""), worktree_path)
     )
-    if recovery_sanctioned and existing_issue == issue_number and existing_branch == branch_name:
-        return None
     if is_lease_expired(existing_lock, now=now):
         # #760 AC1/AC2: exact-owner renewal is a different disposition from
         # foreign takeover and is evaluated first. Before this, both branches
@@ -587,26 +547,10 @@ def assess_same_issue_lease_conflict(
     )
 
 
-def _lock_claimant(lock: dict[str, Any] | None) -> dict[str, str]:
-    if not isinstance(lock, dict):
-        return {}
-    claimant = lock.get("claimant")
-    if not isinstance(claimant, dict):
-        lease = lock.get("work_lease")
-        claimant = lease.get("claimant") if isinstance(lease, dict) else None
-    if not isinstance(claimant, dict):
-        return {}
-    return {
-        "username": str(claimant.get("username") or ""),
-        "profile": str(claimant.get("profile") or ""),
-    }
-
-
 def assess_foreign_lock_overwrite(
     existing_lock: dict[str, Any] | None,
     incoming_lock: dict[str, Any],
     *,
-    recovery_sanctioned: bool = False,
     now: datetime | None = None,
 ) -> str | None:
     """Block writes that would clobber an unrelated live lease on the same key."""
@@ -621,31 +565,8 @@ def assess_foreign_lock_overwrite(
     )
     if same_issue and same_branch and same_worktree:
         return None
-
-    existing_claimant = _lock_claimant(existing_lock)
-    incoming_claimant = _lock_claimant(incoming_lock)
-    same_claimant = (
-        bool(existing_claimant.get("username"))
-        and existing_claimant.get("username") == incoming_claimant.get("username")
-        and existing_claimant.get("profile") == incoming_claimant.get("profile")
-    )
-
-    if recovery_sanctioned and same_issue and same_branch and same_claimant:
-        return None
-
     if not is_lease_live(existing_lock, now=now):
-        # #860 F8: A non-live or PID-less lock still blocks foreign overwrite
-        # unless same claimant or sanctioned reclaim is proven.
-        if not same_claimant and same_issue:
-            reclaim = assess_expired_lock_reclaim(existing_lock, now=now)
-            if not reclaim.get("reclaim_allowed"):
-                return (
-                    "Refusing foreign overwrite of non-live issue lock "
-                    f"(issue #{existing_lock.get('issue_number')}, owner '{existing_claimant.get('username')}') "
-                    "without sanctioned reclaim proof (fail closed)"
-                )
         return None
-
     return (
         "Refusing to overwrite a live foreign issue lock "
         f"(issue #{existing_lock.get('issue_number')}, "

scripts/worktree-start

@@ -43,7 +43,6 @@ repo_root="$(cd "$script_dir/.." && pwd)"
 
 # Enforce issue-linked, traceable branch names (issue → branch → worktree → PR).
 if [[ "$allow_unlinked" -eq 0 ]]; then
-  if [[ "$dry_run" -eq 0 ]] && [[ ! "$branch" =~ ^review/pr-[0-9]+-.+ ]]; then
   locked_branch=$(python3 -c "
 import sys
 sys.path.insert(0, '$repo_root')
@@ -58,7 +57,6 @@ print(issue_lock_store.resolve_locked_branch_for_session('$branch'))
     echo "Error: Requested branch '$branch' does not match locked branch '$locked_branch' (fail closed)." >&2
     exit 2
   fi
-  fi
 
   if [[ "$branch" =~ ^(fix|feat|docs|chore)/issue-[0-9]+-.+ ]] \
      || [[ "$branch" =~ ^review/pr-[0-9]+-.+ ]]; then

task_capability_map.py

@@ -32,15 +32,6 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.issue.comment",
         "role": "author",
     },
-    # #860: dirty orphaned same-claimant worktree recovery (explicit operation).
-    "recover_dirty_orphaned_issue_worktree": {
-        "permission": "gitea.issue.comment",
-        "role": "author",
-    },
-    "gitea_recover_dirty_orphaned_issue_worktree": {
-        "permission": "gitea.issue.comment",
-        "role": "author",
-    },
     # #864: dirty-preserving same-claimant author-session rebind (dead owner PID).
     # Author MCP tool path. Reconciler execute is gated inside the tool via
     # authorize_reconciler_execute + role_kind checks (not this map entry).
@@ -355,6 +346,21 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "role": "controller",
     },
 
+    # #642: sanctioned host-daemon lifecycle controls. Deliberately *not* a
+    # ``gitea.*`` operation — restarting an MCP namespace is a host action, not
+    # a Gitea API call, and no configured Gitea profile should be able to
+    # satisfy it by accident. Authority comes from the console RBAC model plus
+    # out-of-band operator authorization (#630); these entries exist so the
+    # console cannot invent an authority the capability layer never declared.
+    "restart_namespace": {
+        "permission": "runtime.restart_namespace",
+        "role": "controller",
+    },
+    "reload_namespace": {
+        "permission": "runtime.reload_namespace",
+        "role": "controller",
+    },
+
     # #601 first-class lease lifecycle — inspect/list need read; mutations gate on
     # ownership in the control-plane DB (not a separate Gitea write permission).
     "list_workflow_leases": {
@@ -497,11 +503,6 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
 # merger lease (#763).
 _PREFLIGHT_TASK_TRANSITIONS = frozenset({
     ("review_pr", "acquire_reviewer_pr_lease"),
-    ("work_issue", "lock_issue"),
-    ("work_issue", "recover_dirty_orphaned_issue_worktree"),
-    ("work_issue", "gitea_recover_dirty_orphaned_issue_worktree"),
-    ("work_issue", "commit_files"),
-    ("work_issue", "gitea_commit_files"),
 })
 
 

tests/test_dirty_orphan_worktree_recovery.py

@@ -1,483 +0,0 @@
-"""Synthetic regression coverage for dirty orphaned worktree recovery (#860).
-
-Modeled on the #850 / #855 shape without mutating their real state.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import tempfile
-import unittest
-from unittest import mock
-
-import dirty_orphan_worktree_recovery as dorec
-import issue_lock_store
-
-
-DEAD_PID = 999_999_999
-LIVE_PID = os.getpid()
-BRANCH = "fix/issue-901-dirty-orphan"
-SOURCE_WT = "/repo/branches/issue-901-dirty-orphan"
-RECOVERY_WT_NAME = "recovery-issue-901-dirty-orphan"
-LOCAL_HEAD = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-REMOTE_HEAD = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-OTHER_HEAD = "cccccccccccccccccccccccccccccccccccccccc"
-FP_A = dorec.sha256_bytes(b"dirty-a")
-FP_B = dorec.sha256_bytes(b"dirty-b")
-FP_C = dorec.sha256_bytes(b"dirty-c-conflict")
-
-
-def durable_lock(**overrides):
-    """#850-shaped PID-less malformed same-claimant lock."""
-    lock = {
-        "issue_number": 901,
-        "branch_name": BRANCH,
-        "worktree_path": SOURCE_WT,
-        "remote": "prgs",
-        "org": "Example-Org",
-        "repo": "Example-Repo",
-        # intentionally no pid / session_pid / work_lease expiry
-        "claimant": {"username": "author-user", "profile": "prgs-author"},
-    }
-    lock.update(overrides)
-    return lock
-
-
-def base_kwargs(**overrides):
-    kwargs = {
-        "issue_number": 901,
-        "branch_name": BRANCH,
-        "source_worktree_path": SOURCE_WT,
-        "remote": "prgs",
-        "org": "Example-Org",
-        "repo": "Example-Repo",
-        "identity": "author-user",
-        "profile": "prgs-author",
-        "expected_local_head": LOCAL_HEAD,
-        "expected_remote_head": REMOTE_HEAD,
-        "expected_dirty_fingerprints": {"a.py": FP_A, "b.py": FP_B},
-        "current_branch": BRANCH,
-        "porcelain_status": " M a.py\n M b.py\n",
-        "observed_local_head": LOCAL_HEAD,
-        "observed_remote_head": REMOTE_HEAD,
-        "observed_dirty_fingerprints": {"a.py": FP_A, "b.py": FP_B},
-        "competing_live_locks": [],
-        "competing_live_sessions": [],
-        "workflow_lease_active": False,
-        "workflow_lease_expired": True,
-        "canonical_repo_root": "/repo",
-        "worktree_registered": True,
-        "current_pid": LIVE_PID,
-    }
-    kwargs.update(overrides)
-    return kwargs
-
-
-def assess(lock=None, **overrides):
-    return dorec.assess_dirty_orphan_recovery(
-        durable_lock() if lock is None else lock, **base_kwargs(**overrides)
-    )
-
-
-class FreshnessPidLess(unittest.TestCase):
-    def test_pid_less_lock_is_not_live(self):
-        freshness = issue_lock_store.assess_lock_freshness(durable_lock())
-        self.assertFalse(freshness["live"])
-        self.assertTrue(freshness.get("pid_missing"))
-        self.assertEqual(freshness["status"], "malformed")
-
-    def test_pid_less_with_far_future_expiry_still_not_live(self):
-        lock = durable_lock(
-            work_lease={
-                "operation_type": "author_issue_work",
-                "expires_at": "2999-01-01T00:00:00Z",
-                "last_heartbeat_at": "2999-01-01T00:00:00Z",
-            }
-        )
-        freshness = issue_lock_store.assess_lock_freshness(lock)
-        self.assertFalse(freshness["live"])
-        self.assertTrue(freshness.get("pid_missing"))
-
-
-class EligibilityGranted(unittest.TestCase):
-    def test_dead_same_claimant_pid_less_dirty(self):
-        result = assess()
-        self.assertEqual(result["outcome"], dorec.ELIGIBLE)
-        self.assertTrue(result["eligible"])
-
-    def test_expired_workflow_lease_corroboration(self):
-        result = assess(workflow_lease_active=False, workflow_lease_expired=True)
-        self.assertTrue(result["eligible"])
-
-    def test_older_local_newer_remote_heads(self):
-        result = assess()
-        self.assertTrue(result["evidence"].get("heads_diverged"))
-        self.assertTrue(result["eligible"])
-
-
-class EligibilityRefused(unittest.TestCase):
-    def test_active_owner_with_pid(self):
-        lock = durable_lock(pid=LIVE_PID, session_pid=LIVE_PID)
-        result = assess(lock=lock, owner_process_alive_override=True)
-        self.assertEqual(result["outcome"], dorec.REFUSED)
-        self.assertFalse(result["eligible"])
-        self.assertTrue(any("alive" in r for r in result["reasons"]))
-
-    def test_foreign_claimant(self):
-        result = assess(identity="other-user")
-        self.assertEqual(result["outcome"], dorec.REFUSED)
-        self.assertTrue(any("foreign claimant identity" in r for r in result["reasons"]))
-
-    def test_foreign_profile(self):
-        result = assess(profile="prgs-reviewer")
-        self.assertEqual(result["outcome"], dorec.REFUSED)
-
-    def test_fingerprint_mismatch(self):
-        result = assess(observed_dirty_fingerprints={"a.py": "0" * 64, "b.py": FP_B})
-        self.assertEqual(result["outcome"], dorec.REFUSED)
-        self.assertTrue(any("fingerprint mismatch" in r for r in result["reasons"]))
-
-    def test_head_mismatch(self):
-        result = assess(observed_local_head=OTHER_HEAD)
-        self.assertEqual(result["outcome"], dorec.REFUSED)
-
-    def test_remote_head_mismatch(self):
-        result = assess(observed_remote_head=OTHER_HEAD)
-        self.assertEqual(result["outcome"], dorec.REFUSED)
-
-    def test_path_not_under_branches(self):
-        result = assess(
-            source_worktree_path="/tmp/branches/evil",
-            # lock path also changed so worktree agreement holds
-            lock=durable_lock(worktree_path="/tmp/branches/evil"),
-        )
-        self.assertEqual(result["outcome"], dorec.REFUSED)
-        self.assertTrue(any("canonical branches" in r for r in result["reasons"]))
-
-    def test_unregistered_worktree(self):
-        result = assess(worktree_registered=False)
-        self.assertEqual(result["outcome"], dorec.REFUSED)
-
-    def test_active_workflow_lease(self):
-        result = assess(workflow_lease_active=True, workflow_lease_expired=False)
-        self.assertEqual(result["outcome"], dorec.REFUSED)
-
-    def test_unsafe_dirty_path_pin(self):
-        result = assess(
-            expected_dirty_fingerprints={"../etc/passwd": FP_A},
-            observed_dirty_fingerprints={"../etc/passwd": FP_A},
-        )
-        self.assertEqual(result["outcome"], dorec.REFUSED)
-
-    def test_symlink_escape_rejected_by_ancestry(self):
-        ok, reasons = dorec.is_path_under_canonical_branches(
-            "/tmp/branches/evil", canonical_repo_root="/repo"
-        )
-        self.assertFalse(ok)
-        self.assertTrue(reasons)
-
-
-class ConflictDetection(unittest.TestCase):
-    def test_overlapping_upstream_change(self):
-        conflicts = dorec.detect_path_conflicts(
-            dirty_paths=["c.py"],
-            local_head_contents={"c.py": b"local-base"},
-            remote_head_contents={"c.py": b"remote-changed"},
-            dirty_contents={"c.py": b"dirty-c-conflict"},
-        )
-        self.assertEqual(len(conflicts), 1)
-        self.assertEqual(conflicts[0]["path"], "c.py")
-
-    def test_unchanged_upstream_no_conflict(self):
-        conflicts = dorec.detect_path_conflicts(
-            dirty_paths=["a.py"],
-            local_head_contents={"a.py": b"same"},
-            remote_head_contents={"a.py": b"same"},
-            dirty_contents={"a.py": b"dirty-a"},
-        )
-        self.assertEqual(conflicts, [])
-
-
-class CrashSafeRecovery(unittest.TestCase):
-    def setUp(self):
-        self.tmp = tempfile.mkdtemp(prefix="dirty-orphan-")
-        self.repo = os.path.join(self.tmp, "repo")
-        self.branches = os.path.join(self.repo, "branches")
-        self.source = os.path.join(self.branches, "issue-901-dirty-orphan")
-        self.recovery = os.path.join(self.branches, RECOVERY_WT_NAME)
-        os.makedirs(self.source, exist_ok=True)
-        os.makedirs(self.branches, exist_ok=True)
-        # seed dirty files in source
-        with open(os.path.join(self.source, "a.py"), "wb") as fh:
-            fh.write(b"dirty-a")
-        with open(os.path.join(self.source, "b.py"), "wb") as fh:
-            fh.write(b"dirty-b")
-        self.journal_dir = os.path.join(self.tmp, "journals")
-        self.lock = durable_lock(worktree_path=self.source)
-        self.assessment = dorec.assess_dirty_orphan_recovery(
-            self.lock,
-            **base_kwargs(
-                source_worktree_path=self.source,
-                canonical_repo_root=self.repo,
-            ),
-        )
-
-        class FakeGit(dorec.GitOps):
-            def __init__(self, recovery_path, head):
-                self.recovery_path = recovery_path
-                self.head = head
-                self.calls = []
-
-            def run(self, args, *, cwd):
-                self.calls.append((args, cwd))
-                if args[:3] == ["git", "worktree", "add"]:
-                    os.makedirs(self.recovery_path, exist_ok=True)
-                    return mock.Mock(returncode=0, stdout="", stderr="")
-                if args[:2] == ["git", "checkout"]:
-                    return mock.Mock(returncode=0, stdout="", stderr="")
-                if args[:2] == ["git", "rev-parse"]:
-                    return mock.Mock(returncode=0, stdout=self.head + "\n", stderr="")
-                return mock.Mock(returncode=0, stdout="", stderr="")
-
-        self.git = FakeGit(self.recovery, REMOTE_HEAD)
-        self.written_locks = []
-
-        def lock_writer(record):
-            self.written_locks.append(record)
-
-        self.lock_writer = lock_writer
-
-    def tearDown(self):
-        shutil.rmtree(self.tmp, ignore_errors=True)
-
-    def _run(self, **overrides):
-        kwargs = {
-            "assessment": self.assessment,
-            "existing_lock": self.lock,
-            "issue_number": 901,
-            "branch_name": BRANCH,
-            "source_worktree_path": self.source,
-            "recovery_worktree_path": self.recovery,
-            "remote": "prgs",
-            "org": "Example-Org",
-            "repo": "Example-Repo",
-            "identity": "author-user",
-            "profile": "prgs-author",
-            "expected_local_head": LOCAL_HEAD,
-            "expected_remote_head": REMOTE_HEAD,
-            "expected_dirty_fingerprints": {"a.py": FP_A, "b.py": FP_B},
-            "dirty_contents": {"a.py": b"dirty-a", "b.py": b"dirty-b"},
-            "local_head_contents": {"a.py": b"base-a", "b.py": b"base-b"},
-            "remote_head_contents": {"a.py": b"base-a", "b.py": b"base-b"},
-            "canonical_repo_root": self.repo,
-            "bind_lock": True,
-            "lock_writer": self.lock_writer,
-            "git_ops": self.git,
-            "journal_dir": self.journal_dir,
-            "session_pid": LIVE_PID,
-        }
-        kwargs.update(overrides)
-        return dorec.run_dirty_orphan_recovery(**kwargs)
-
-    def test_success_preserves_dirty_bytes_and_source(self):
-        result = self._run()
-        self.assertTrue(result["success"])
-        self.assertEqual(result["outcome"], dorec.RECOVERY_COMPLETED)
-        self.assertTrue(os.path.isdir(self.source))
-        with open(os.path.join(self.source, "a.py"), "rb") as fh:
-            self.assertEqual(fh.read(), b"dirty-a")
-        with open(os.path.join(self.recovery, "a.py"), "rb") as fh:
-            self.assertEqual(fh.read(), b"dirty-a")
-        with open(os.path.join(self.recovery, "b.py"), "rb") as fh:
-            self.assertEqual(fh.read(), b"dirty-b")
-        self.assertEqual(len(self.written_locks), 1)
-        rec = self.written_locks[0]
-        self.assertEqual(rec["session_pid"], LIVE_PID)
-        self.assertTrue(rec["dirty_orphan_recovery"]["recovered"])
-        self.assertTrue(rec["dirty_orphan_recovery"]["source_frozen"])
-
-    def test_conflict_leaves_governed_state(self):
-        result = self._run(
-            expected_dirty_fingerprints={"c.py": FP_C},
-            dirty_contents={"c.py": b"dirty-c-conflict"},
-            local_head_contents={"c.py": b"local-base"},
-            remote_head_contents={"c.py": b"remote-changed"},
-        )
-        # #860 F4: session binding is NOT finalized while conflicts remain
-        self.assertFalse(result["success"])
-        self.assertEqual(result["outcome"], dorec.CONFLICTS_PRESENT)
-        sidecar = os.path.join(self.recovery, "c.py.recovered-dirty")
-        self.assertTrue(os.path.isfile(sidecar))
-        state = os.path.join(
-            self.recovery, dorec.CONFLICT_STATE_DIR, dorec.CONFLICT_STATE_FILE
-        )
-        self.assertTrue(os.path.isfile(state))
-        with open(state, "r", encoding="utf-8") as fh:
-            payload = json.load(fh)
-        self.assertEqual(payload["resolution"], "author_edit_required")
-
-    def test_interrupt_before_journal_no_artifacts(self):
-        result = self._run(interrupt_after_phase=dorec.PHASE_ELIGIBILITY)
-        self.assertFalse(result["success"])
-        self.assertEqual(result["outcome"], "INTERRUPTED")
-        self.assertFalse(os.path.isdir(self.recovery))
-
-    def test_interrupt_after_journal_then_retry_idempotent(self):
-        first = self._run(interrupt_after_phase=dorec.PHASE_JOURNAL_PERSISTED)
-        self.assertEqual(first["outcome"], "INTERRUPTED")
-        self.assertTrue(first["journal"]["artifacts_created"]["journal"])
-        second = self._run()
-        self.assertTrue(second["success"])
-        # source still recoverable
-        with open(os.path.join(self.source, "a.py"), "rb") as fh:
-            self.assertEqual(fh.read(), b"dirty-a")
-
-    def test_interrupt_after_worktree_then_retry(self):
-        first = self._run(interrupt_after_phase=dorec.PHASE_RECOVERY_WORKTREE)
-        self.assertEqual(first["outcome"], "INTERRUPTED")
-        self.assertTrue(os.path.isdir(self.recovery))
-        second = self._run()
-        self.assertTrue(second["success"])
-
-    def test_interrupt_after_binding_then_retry_complete(self):
-        first = self._run(interrupt_after_phase=dorec.PHASE_BINDING)
-        self.assertEqual(first["outcome"], "INTERRUPTED")
-        second = self._run()
-        self.assertTrue(second["success"])
-        # completed journal makes further retries no-ops
-        third = self._run()
-        self.assertEqual(third["outcome"], dorec.RECOVERY_RESUMED)
-
-    def test_source_worktree_never_deleted(self):
-        self._run()
-        self.assertTrue(os.path.isdir(self.source))
-        self.assertTrue(os.path.isfile(os.path.join(self.source, "a.py")))
-
-    def test_fingerprint_drift_refuses_without_mutation(self):
-        result = self._run(dirty_contents={"a.py": b"CHANGED", "b.py": b"dirty-b"})
-        self.assertFalse(result["success"])
-        self.assertFalse(os.path.isdir(self.recovery))
-
-
-class SessionBindingPreflight(unittest.TestCase):
-    def test_canonical_session_binding_recognized(self):
-        lock = {
-            "worktree_path": "/repo/branches/recovery",
-            "session_pid": LIVE_PID,
-            "dirty_orphan_recovery": {
-                "recovered": True,
-                "conflicts": [],
-                "recovery_worktree_path": "/repo/branches/recovery",
-                "source_worktree_path": SOURCE_WT,
-                "accepted_head": REMOTE_HEAD,
-            },
-        }
-        result = dorec.preflight_recognizes_recovered_provenance(lock)
-        self.assertTrue(result["recognized"])
-
-    def test_conflicts_block_commit_preflight(self):
-        lock = {
-            "worktree_path": "/repo/branches/recovery",
-            "session_pid": LIVE_PID,
-            "dirty_orphan_recovery": {
-                "recovered": True,
-                "conflicts": [{"path": "c.py"}],
-            },
-        }
-        result = dorec.preflight_recognizes_recovered_provenance(lock)
-        self.assertFalse(result["recognized"])
-
-    def test_active_foreign_does_not_mutate(self):
-        # assess-only path: foreign refused before run
-        result = assess(identity="intruder")
-        self.assertFalse(result["eligible"])
-
-
-class JournalSymlinkRefusal(unittest.TestCase):
-    def test_symlink_journal_path_refused_on_load(self):
-        tmp = tempfile.mkdtemp()
-        try:
-            real = os.path.join(tmp, "real.json")
-            with open(real, "w", encoding="utf-8") as fh:
-                fh.write("{}")
-            link = os.path.join(tmp, "link.json")
-            os.symlink(real, link)
-            key = "symlink-test"
-            jdir = tmp
-            path = dorec._journal_path(key, journal_dir=jdir)
-            with open(path, "w", encoding="utf-8") as fh:
-                json.dump({"idempotency_key": key}, fh)
-            os.remove(path)
-            os.symlink(real, path)
-            with self.assertRaises(ValueError):
-                dorec.load_journal(key, journal_dir=jdir)
-        finally:
-            shutil.rmtree(tmp, ignore_errors=True)
-
-
-class RealGitMultiWorktreeIntegration(unittest.TestCase):
-    def setUp(self):
-        import subprocess
-        self.tmp = tempfile.mkdtemp(prefix="git-integration-")
-        self.repo = os.path.join(self.tmp, "repo")
-        os.makedirs(self.repo, exist_ok=True)
-        subprocess.run(["git", "init"], cwd=self.repo, check=True, capture_output=True)
-        subprocess.run(["git", "config", "user.name", "Test User"], cwd=self.repo, check=True)
-        subprocess.run(["git", "config", "user.email", "[email protected]"], cwd=self.repo, check=True)
-        with open(os.path.join(self.repo, "init.txt"), "w") as fh:
-            fh.write("init")
-        subprocess.run(["git", "add", "."], cwd=self.repo, check=True)
-        subprocess.run(["git", "commit", "-m", "init"], cwd=self.repo, check=True)
-        branch = "fix/issue-999-test"
-        subprocess.run(["git", "branch", branch], cwd=self.repo, check=True)
-        self.branches = os.path.join(self.repo, "branches")
-        self.source = os.path.join(self.branches, "issue-999-test")
-        subprocess.run(["git", "worktree", "add", self.source, branch], cwd=self.repo, check=True)
-        self.dirty_path = os.path.join(self.source, "dirty.txt")
-        with open(self.dirty_path, "w") as fh:
-            fh.write("dirty-data")
-
-    def tearDown(self):
-        shutil.rmtree(self.tmp, ignore_errors=True)
-
-    def test_prepare_recovery_worktree_detached_no_exit_128(self):
-        import subprocess
-        head_sha = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=self.repo, text=True).strip()
-        rec_wt = os.path.join(self.branches, "recovery-issue-999-test")
-        res = dorec.prepare_recovery_worktree(
-            canonical_repo_root=self.repo,
-            recovery_worktree_path=rec_wt,
-            branch_name="fix/issue-999-test",
-            remote_head=head_sha,
-        )
-        self.assertTrue(res["success"], res.get("reasons"))
-        self.assertTrue(os.path.isdir(rec_wt))
-
-    def test_real_lock_rebind_recovery_sanctioned(self):
-        lock_dir = os.path.join(self.tmp, "locks")
-        rec_wt = os.path.join(self.branches, "recovery-issue-999-test")
-        os.makedirs(rec_wt, exist_ok=True)
-        record = {
-            "remote": "prgs",
-            "org": "Example-Org",
-            "repo": "Example-Repo",
-            "issue_number": 999,
-            "branch_name": "fix/issue-999-test",
-            "worktree_path": rec_wt,
-            "claimant": {"username": "author-user", "profile": "prgs-author"},
-        }
-        record_src = dict(record)
-        record_src["worktree_path"] = self.source
-        issue_lock_store.bind_session_lock(record_src, lock_dir=lock_dir)
-        path = issue_lock_store.bind_session_lock(
-            record,
-            lock_dir=lock_dir,
-            recovery_sanctioned=True,
-        )
-        self.assertTrue(os.path.isfile(path))
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_issue_lock_store.py

@@ -24,8 +24,6 @@ def _lease(expires_at: str) -> dict:
 
 
 def _lock_record(**overrides) -> dict:
-    # #860: live locks require a usable session pid; PID-less records are never
-    # classified live merely because expiry/heartbeat fields are present.
     record = {
         "issue_number": 420,
         "branch_name": "feat/issue-420-server-code-parity",
@@ -33,8 +31,6 @@ def _lock_record(**overrides) -> dict:
         "org": "Scaled-Tech-Consulting",
         "repo": "Gitea-Tools",
         "worktree_path": "/tmp/wt-420",
-        "session_pid": os.getpid(),
-        "pid": os.getpid(),
         "work_lease": _lease("2999-01-01T00:00:00Z"),
     }
     record.update(overrides)
@@ -92,8 +88,6 @@ class TestIssueLockStore(unittest.TestCase):
         existing = _lock_record(
             branch_name="feat/issue-420-other",
             worktree_path="/tmp/other",
-            session_pid=os.getpid(),
-            pid=os.getpid(),
             work_lease=_lease("2999-01-01T00:00:00Z"),
         )
         path = ils.lock_file_path(

tests/test_pr_ownership_issue_pr_mismatch.py

@@ -37,7 +37,6 @@ def _live_lock(
         "operation_type": issue_lock_store.AUTHOR_ISSUE_WORK_LEASE,
         "acquired_at": now.isoformat(),
         "expires_at": (now + timedelta(hours=2)).isoformat(),
-        "session_pid": os.getpid(),
         "owner_pid": os.getpid(),
         "status": "active",
     }
@@ -178,24 +177,11 @@ class TestAuthorOwnershipIssuePrMismatch(unittest.TestCase):
         self.assertFalse(result["proven"], result)
         self.assertTrue(any("branch" in r for r in result["reasons"]))
 
-    def test_pidless_durable_lock_rejected(self):
-        """A lock without any PID identity must be classified as malformed/non-live and fail closed."""
-        lock = _live_lock(issue_number=727)
-        lock.pop("session_pid", None)
-        lock.pop("owner_pid", None)
-        lock.pop("pid", None)
-        path = issue_lock_store.lock_file_path(
-            remote="prgs",
-            org="Scaled-Tech-Consulting",
-            repo="Gitea-Tools",
-            issue_number=727,
-            lock_dir=self.lock_dir,
-        )
-        issue_lock_store.save_lock_file(path, lock)
+    def test_no_lock_fail_closed(self):
         result = mcp._prove_author_ownership_for_pr(
             pr_number=728,
             pr_title="feat: pr sync",
-            pr_body="Fixes #727",
+            pr_body="Closes #727",
             source_branch="feat/issue-727-pr-sync-status",
             remote="prgs",
             host=None,

tests/test_webui_sanctioned_restart.py

@@ -0,0 +1,502 @@
+"""Sanctioned restart / graceful reload control tests (#642).
+
+Acceptance criteria under test:
+
+1. The sanctioned restart path is implemented behind gates (capability,
+   confirmation, operator authorization, host hook).
+2. Manual ``pkill`` stays forbidden and is classified as contamination.
+3. Post-restart mutations require clean health/session proof.
+4. Authorized restart preview, unauthorized deny, contamination classification.
+5. No entry point exposes a raw kill.
+"""
+
+import json
+import os
+import tempfile
+import unittest
+
+import mcp_namespace_health
+import runtime_recovery_guard
+from task_capability_map import TASK_CAPABILITY_MAP
+from webui import console_audit, console_authz, gated_actions, sanctioned_restart
+
+NAMESPACE = "gitea-author"
+
+# An operator-authorized, hook-configured host. Passed explicitly so no test
+# depends on (or mutates) the real process environment.
+READY_ENV = {
+    sanctioned_restart.RESTART_HOOK_ENV: "launchd:cc.prgs.gitea-author",
+    runtime_recovery_guard.OPERATOR_AUTHORIZATION_ENV: "ops-ticket-4821",
+}
+
+
+def admin(subject: str = "[email protected]") -> console_authz.Principal:
+    return console_authz.Principal(
+        subject=subject,
+        role=console_authz.ADMIN,
+        identity_source=console_authz.IDENTITY_ACCESS_PROXY,
+        authenticated=True,
+    )
+
+
+def viewer() -> console_authz.Principal:
+    return console_authz.Principal(
+        subject="[email protected]",
+        role=console_authz.VIEWER,
+        identity_source=console_authz.IDENTITY_ACCESS_PROXY,
+        authenticated=True,
+    )
+
+
+class TestCapabilityWiring(unittest.TestCase):
+    """AC1: authority is declared, not invented by the console."""
+
+    def test_actions_resolve_through_the_capability_map(self):
+        for action_id in (
+            sanctioned_restart.ACTION_RESTART_NAMESPACE,
+            sanctioned_restart.ACTION_RELOAD_NAMESPACE,
+        ):
+            with self.subTest(action=action_id):
+                action = console_authz.get_action(action_id)
+                self.assertIsNotNone(action)
+                self.assertIn(action.task_key, TASK_CAPABILITY_MAP)
+                self.assertEqual(
+                    action.mcp_permission,
+                    TASK_CAPABILITY_MAP[action.task_key]["permission"],
+                )
+
+    def test_restart_permission_is_not_a_gitea_operation(self):
+        """No configured Gitea profile should satisfy a host restart."""
+        permission = TASK_CAPABILITY_MAP["restart_namespace"]["permission"]
+        self.assertFalse(permission.startswith("gitea."))
+
+    def test_restart_is_destructive_dual_control_break_glass(self):
+        action = console_authz.get_action(
+            sanctioned_restart.ACTION_RESTART_NAMESPACE
+        )
+        self.assertEqual(action.action_class, console_authz.CLASS_DESTRUCTIVE)
+        self.assertEqual(action.minimum_role, console_authz.ADMIN)
+        self.assertTrue(action.dual_control)
+        self.assertTrue(action.break_glass)
+        self.assertTrue(action.requires_confirmation)
+
+    def test_reload_is_privileged_but_not_destructive(self):
+        action = console_authz.get_action(
+            sanctioned_restart.ACTION_RELOAD_NAMESPACE
+        )
+        self.assertEqual(action.action_class, console_authz.CLASS_PRIVILEGED)
+        self.assertTrue(action.requires_confirmation)
+
+
+class TestPreview(unittest.TestCase):
+    """AC4: an authorized preview renders the plan without executing it."""
+
+    def test_preview_lists_the_mutation_ledger(self):
+        preview = sanctioned_restart.build_restart_preview(
+            NAMESPACE, principal=admin(), env=READY_ENV
+        )
+        steps = [entry["step"] for entry in preview["mutation_ledger"]]
+        self.assertEqual(
+            steps, ["quiesce", "host_restart_hook", "health_recheck", "audit"]
+        )
+        self.assertTrue(preview["scope_valid"])
+        self.assertTrue(preview["post_restart_verification_required"])
+
+    def test_reload_preview_drains_instead_of_restarting(self):
+        preview = sanctioned_restart.build_restart_preview(
+            NAMESPACE, sanctioned_restart.MODE_RELOAD,
+            principal=admin(), env=READY_ENV,
+        )
+        steps = [entry["step"] for entry in preview["mutation_ledger"]]
+        self.assertIn("host_graceful_reload", steps)
+        self.assertNotIn("host_restart_hook", steps)
+
+    def test_preview_never_enables_execution(self):
+        preview = sanctioned_restart.build_restart_preview(
+            NAMESPACE, principal=admin(), env=READY_ENV
+        )
+        self.assertFalse(preview["execution_enabled"])
+        self.assertFalse(preview["authorization"]["execution_enabled"])
+
+    def test_confirmation_phrase_binds_the_namespace(self):
+        self.assertTrue(
+            sanctioned_restart.confirmation_matches(
+                NAMESPACE, sanctioned_restart.MODE_RESTART,
+                "restart gitea-author",
+            )
+        )
+        # A phrase typed for one namespace must not authorize another.
+        self.assertFalse(
+            sanctioned_restart.confirmation_matches(
+                "gitea-merger", sanctioned_restart.MODE_RESTART,
+                "restart gitea-author",
+            )
+        )
+
+
+class TestGates(unittest.TestCase):
+    """AC1/AC4: every gate denies with a stable reason code."""
+
+    def _assess(self, **kwargs):
+        params = {
+            "principal": admin(),
+            "confirmation": f"restart {NAMESPACE}",
+            "env": READY_ENV,
+        }
+        params.update(kwargs)
+        namespace = params.pop("namespace", NAMESPACE)
+        mode = params.pop("mode", sanctioned_restart.MODE_RESTART)
+        return sanctioned_restart.assess_restart_request(
+            namespace, mode, **params
+        )
+
+    def test_authorized_confirmed_request_passes_every_gate(self):
+        result = self._assess()
+        self.assertTrue(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.ALLOW_HOST_ACTION_REQUIRED
+        )
+
+    def test_passing_every_gate_is_not_an_execution_grant(self):
+        """An allowed request still never lets the console touch the process."""
+        result = self._assess()
+        self.assertTrue(result["allowed"])
+        self.assertFalse(result["execution_enabled"])
+        self.assertFalse(result["console_executes"])
+
+    def test_unauthorized_principal_is_denied(self):
+        result = self._assess(principal=viewer())
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_UNAUTHORIZED
+        )
+
+    def test_anonymous_principal_is_denied(self):
+        result = self._assess(principal=None)
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_UNAUTHORIZED
+        )
+
+    def test_missing_confirmation_is_denied(self):
+        result = self._assess(confirmation=None)
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_CONFIRMATION_MISSING
+        )
+
+    def test_confirmation_for_another_namespace_is_denied(self):
+        result = self._assess(confirmation="restart gitea-merger")
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_CONFIRMATION_MISMATCH
+        )
+
+    def test_missing_operator_authorization_is_denied(self):
+        env = {sanctioned_restart.RESTART_HOOK_ENV: "launchd:cc.prgs.author"}
+        result = self._assess(env=env)
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"],
+            sanctioned_restart.DENY_OPERATOR_AUTHORIZATION,
+        )
+
+    def test_missing_host_hook_is_denied_without_kill_fallback(self):
+        env = {
+            runtime_recovery_guard.OPERATOR_AUTHORIZATION_ENV: "ops-ticket-1",
+        }
+        result = self._assess(env=env)
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_HOOK_NOT_CONFIGURED
+        )
+
+    def test_fleet_scope_is_refused(self):
+        for scope in ("all", "*", "fleet"):
+            with self.subTest(scope=scope):
+                result = self._assess(
+                    namespace=scope, confirmation=f"restart {scope}"
+                )
+                self.assertFalse(result["allowed"])
+                self.assertEqual(
+                    result["reason_code"], sanctioned_restart.DENY_FLEET_SCOPE
+                )
+
+    def test_unknown_namespace_is_refused(self):
+        result = self._assess(
+            namespace="gitea-nope", confirmation="restart gitea-nope"
+        )
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_UNKNOWN_NAMESPACE
+        )
+
+    def test_unknown_mode_is_refused(self):
+        result = self._assess(mode="obliterate")
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_UNKNOWN_MODE
+        )
+
+    def test_live_contamination_marker_blocks_restart(self):
+        marker = runtime_recovery_guard.build_contamination_record(
+            reason_class=runtime_recovery_guard.REASON_MANUAL_DAEMON_KILL,
+            command_redacted="pkill -f mcp_server.py",
+        )
+        result = self._assess(contamination_marker=marker)
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["reason_code"], sanctioned_restart.DENY_CONTAMINATED_RUNTIME
+        )
+
+    def test_reconciler_cleared_marker_no_longer_blocks(self):
+        marker = runtime_recovery_guard.build_contamination_record(
+            reason_class=runtime_recovery_guard.REASON_MANUAL_DAEMON_KILL,
+            command_redacted="pkill -f mcp_server.py",
+        )
+        marker = dict(marker, cleared_by_reconciler=True)
+        result = self._assess(contamination_marker=marker)
+        self.assertTrue(result["allowed"])
+
+
+class TestExecutionNeverKills(unittest.TestCase):
+    """AC5: no path exposes or runs a raw process kill."""
+
+    def test_authorized_execution_defers_to_the_host_supervisor(self):
+        result = sanctioned_restart.execute_restart(
+            NAMESPACE,
+            principal=admin(),
+            confirmation=f"restart {NAMESPACE}",
+            env=READY_ENV,
+        )
+        self.assertTrue(result["allowed"])
+        self.assertFalse(result["success"])
+        self.assertFalse(result["process_kill_executed"])
+        self.assertEqual(
+            result["outcome"], sanctioned_restart.ALLOW_HOST_ACTION_REQUIRED
+        )
+
+    def test_denied_execution_reports_the_refusing_gate(self):
+        result = sanctioned_restart.execute_restart(
+            NAMESPACE, principal=viewer(), confirmation=f"restart {NAMESPACE}",
+            env=READY_ENV,
+        )
+        self.assertFalse(result["allowed"])
+        self.assertEqual(
+            result["outcome"], sanctioned_restart.DENY_UNAUTHORIZED
+        )
+        self.assertFalse(result["process_kill_executed"])
+
+    def test_module_never_spawns_a_process(self):
+        path = os.path.join(
+            os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+            "webui", "sanctioned_restart.py",
+        )
+        with open(path, encoding="utf-8") as handle:
+            source = handle.read()
+        for forbidden in (
+            "import subprocess", "import signal", "os.kill", "os.system",
+            "popen",
+        ):
+            with self.subTest(forbidden=forbidden):
+                self.assertNotIn(forbidden, source.lower())
+
+    def test_no_surface_returns_a_kill_command(self):
+        payloads = [
+            sanctioned_restart.build_restart_preview(
+                NAMESPACE, principal=admin(), env=READY_ENV
+            ),
+            sanctioned_restart.restart_policy(),
+            sanctioned_restart.execute_restart(
+                NAMESPACE, principal=admin(),
+                confirmation=f"restart {NAMESPACE}", env=READY_ENV,
+            ),
+        ]
+        for payload in payloads:
+            rendered = json.dumps(payload, default=str).lower()
+            self.assertNotIn("kill -9", rendered)
+            self.assertNotIn("pkill -f", rendered)
+
+    def test_policy_declares_no_raw_kill_and_no_silent_restart(self):
+        policy = sanctioned_restart.restart_policy()
+        self.assertFalse(policy["raw_kill_exposed"])
+        self.assertFalse(policy["console_executes_process_kill"])
+        self.assertFalse(policy["fleet_scope_permitted"])
+        self.assertFalse(policy["silent_auto_restart_permitted"])
+        self.assertTrue(policy["audit_required"])
+
+
+class TestContaminationClassification(unittest.TestCase):
+    """AC2: manual pkill is contamination, and it blocks clean claims."""
+
+    def test_manual_daemon_pkill_is_contamination(self):
+        result = sanctioned_restart.classify_restart_command(
+            "pkill -f mcp_server.py"
+        )
+        self.assertTrue(result["contamination"])
+        self.assertFalse(result["clean_claim_allowed"])
+        self.assertIsNotNone(result["contamination_marker"])
+        self.assertEqual(
+            result["sanctioned_alternative"],
+            sanctioned_restart.ACTION_RESTART_NAMESPACE,
+        )
+
+    def test_broad_process_kill_is_contamination(self):
+        result = sanctioned_restart.classify_restart_command("killall -9 Python")
+        self.assertTrue(result["contamination"])
+        self.assertFalse(result["clean_claim_allowed"])
+
+    def test_marker_names_the_sanctioned_alternative(self):
+        result = sanctioned_restart.classify_restart_command(
+            "pkill -f mcp_server.py"
+        )
+        marker = result["contamination_marker"]
+        self.assertIn(
+            sanctioned_restart.ACTION_RESTART_NAMESPACE, marker["detail"]
+        )
+
+    def test_benign_command_is_not_contamination(self):
+        result = sanctioned_restart.classify_restart_command("git status")
+        self.assertFalse(result["contamination"])
+        self.assertTrue(result["clean_claim_allowed"])
+
+    def test_no_command_is_not_contamination(self):
+        result = sanctioned_restart.classify_restart_command(None)
+        self.assertFalse(result["contamination"])
+        self.assertTrue(result["clean_claim_allowed"])
+
+
+class TestPostRestartHealth(unittest.TestCase):
+    """AC3: a clean post-restart claim needs live client-namespace proof."""
+
+    def test_live_client_probe_clears_the_session(self):
+        result = sanctioned_restart.verify_post_restart_health(
+            NAMESPACE,
+            probe_result={"success": True},
+            probe_source=mcp_namespace_health.PROBE_SOURCE_CLIENT,
+            registered_tools=["gitea_whoami"],
+            required_tool="gitea_whoami",
+        )
+        self.assertEqual(result["status"], sanctioned_restart.HEALTH_CLEAN)
+        self.assertTrue(result["clean_claim_allowed"])
+        self.assertTrue(result["mutations_allowed"])
+
+    def test_offline_probe_does_not_clear_the_session(self):
+        result = sanctioned_restart.verify_post_restart_health(
+            NAMESPACE,
+            probe_result={"success": True},
+            probe_source=mcp_namespace_health.PROBE_SOURCE_OFFLINE,
+            registered_tools=["gitea_whoami"],
+            required_tool="gitea_whoami",
+        )
+        self.assertFalse(result["clean_claim_allowed"])
+        self.assertFalse(result["mutations_allowed"])
+
+    def test_failed_probe_is_unhealthy(self):
+        result = sanctioned_restart.verify_post_restart_health(
+            NAMESPACE,
+            probe_result={"success": False, "error": "client is closing: EOF"},
+            probe_source=mcp_namespace_health.PROBE_SOURCE_CLIENT,
+            registered_tools=["gitea_whoami"],
+            required_tool="gitea_whoami",
+        )
+        self.assertEqual(result["status"], sanctioned_restart.HEALTH_UNHEALTHY)
+        self.assertFalse(result["clean_claim_allowed"])
+
+    def test_static_registration_alone_never_clears_the_session(self):
+        result = sanctioned_restart.verify_post_restart_health(
+            NAMESPACE,
+            registered_tools=["gitea_whoami"],
+            required_tool="gitea_whoami",
+        )
+        self.assertFalse(result["clean_claim_allowed"])
+
+
+class TestAuditEmission(unittest.TestCase):
+    """Every restart attempt is audited with actor, target, and result."""
+
+    def _run(self, principal, sink):
+        prior = os.environ.get(console_audit.AUDIT_LOG_ENV)
+        os.environ[console_audit.AUDIT_LOG_ENV] = sink
+        try:
+            return sanctioned_restart.execute_restart(
+                NAMESPACE,
+                principal=principal,
+                confirmation=f"restart {NAMESPACE}",
+                env=READY_ENV,
+                request_id="req-642",
+            )
+        finally:
+            if prior is None:
+                os.environ.pop(console_audit.AUDIT_LOG_ENV, None)
+            else:
+                os.environ[console_audit.AUDIT_LOG_ENV] = prior
+
+    def test_allowed_attempt_is_written_with_actor_and_target(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            sink = os.path.join(tmp, "audit.jsonl")
+            result = self._run(admin(), sink)
+            self.assertTrue(result["audit"]["written"])
+            with open(sink, encoding="utf-8") as handle:
+                record = json.loads(handle.read().strip())
+        self.assertEqual(
+            record["action"], sanctioned_restart.ACTION_RESTART_NAMESPACE
+        )
+        self.assertEqual(record["target"]["namespace"], NAMESPACE)
+        self.assertEqual(record["target"]["mode"], "restart")
+        self.assertEqual(record["result"], console_audit.RESULT_ALLOWED)
+        self.assertEqual(record["actor"]["subject"], "[email protected]")
+        self.assertFalse(record["metadata"]["process_kill_executed"])
+
+    def test_denied_attempt_is_audited_too(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            sink = os.path.join(tmp, "audit.jsonl")
+            self._run(viewer(), sink)
+            with open(sink, encoding="utf-8") as handle:
+                record = json.loads(handle.read().strip())
+        self.assertEqual(record["result"], console_audit.RESULT_DENIED)
+        self.assertEqual(
+            record["reason_code"], sanctioned_restart.DENY_UNAUTHORIZED
+        )
+
+    def test_restart_audit_uses_break_glass_retention(self):
+        action = console_authz.get_action(
+            sanctioned_restart.ACTION_RESTART_NAMESPACE
+        )
+        self.assertEqual(
+            console_audit.retention_class_for(action),
+            console_audit.RETENTION_BREAK_GLASS,
+        )
+
+
+class TestRegistrySurface(unittest.TestCase):
+    """AC5: the console surfaces the control, still disabled, with no kill."""
+
+    def test_registry_exposes_both_actions_disabled(self):
+        registry = gated_actions.load_action_registry()
+        for action_id in (
+            sanctioned_restart.ACTION_RESTART_NAMESPACE,
+            sanctioned_restart.ACTION_RELOAD_NAMESPACE,
+        ):
+            with self.subTest(action=action_id):
+                action = registry.get(action_id)
+                self.assertIsNotNone(action)
+                self.assertFalse(action.enabled)
+
+    def test_registry_preview_names_the_namespace_target(self):
+        preview = gated_actions.preview_action(
+            sanctioned_restart.ACTION_RESTART_NAMESPACE, namespace=NAMESPACE
+        )
+        target = preview["mutation_ledger"][0]["target"]
+        self.assertIn(NAMESPACE, target)
+        self.assertFalse(preview["enabled"])
+
+    def test_registry_attempt_fails_closed(self):
+        result = gated_actions.attempt_action(
+            sanctioned_restart.ACTION_RESTART_NAMESPACE, namespace=NAMESPACE
+        )
+        self.assertFalse(result["success"])
+
+
+if __name__ == "__main__":
+    unittest.main()

webui/console_authz.py

@@ -236,6 +236,34 @@ _ACTION_SPECS: tuple[ConsoleAction, ...] = (
         phase=3,
         summary="Remove a remote feature branch.",
     ),
+    # #642: sanctioned daemon lifecycle. These exist so operators have an
+    # audited path off `pkill -f mcp_server.py` (#630). Restart drops every
+    # in-flight request on a namespace, so it carries the same dual-control and
+    # break-glass weight as a merge; reload drains first and is privileged but
+    # not destructive. Neither ever exposes a raw kill: execution is handed to
+    # a host supervisor by ``webui.sanctioned_restart``.
+    ConsoleAction(
+        action_id="system.reload_namespace",
+        task_key="reload_namespace",
+        action_class=CLASS_PRIVILEGED,
+        minimum_role=CONTROLLER,
+        requires_confirmation=True,
+        dual_control=False,
+        break_glass=False,
+        phase=2,
+        summary="Gracefully reload one MCP namespace via the host supervisor.",
+    ),
+    ConsoleAction(
+        action_id="system.restart_namespace",
+        task_key="restart_namespace",
+        action_class=CLASS_DESTRUCTIVE,
+        minimum_role=ADMIN,
+        requires_confirmation=True,
+        dual_control=True,
+        break_glass=True,
+        phase=2,
+        summary="Restart one MCP namespace via the host supervisor.",
+    ),
 )
 
 ACTIONS: dict[str, ConsoleAction] = {a.action_id: a for a in _ACTION_SPECS}

webui/gated_actions.py

@@ -110,6 +110,8 @@ def _format_target(action_id: str, params: dict[str, Any]) -> str:
         )
     if action_id == "create_issue":
         return f"issue {params.get('title', '?')!r}"
+    if action_id in {"system.restart_namespace", "system.reload_namespace"}:
+        return f"MCP namespace {params.get('namespace', '?')!r}"
     return "unspecified"
 
 
@@ -165,6 +167,17 @@ def build_action_registry() -> ActionRegistry:
          "gitea_create_issue_comment", "Post a PR review thread comment."),
         ("close_pr", "Close PR", "close_pr", "gitea_edit_pr",
          "Close a pull request without merge."),
+        # #642: the sanctioned replacement for the forbidden manual daemon-kill
+        # recovery path (#630). The "tool" is a host supervisor hook, not an MCP
+        # call — the console never signals a process. Preview and gating live in
+        # ``webui.sanctioned_restart``; these stay disabled like every other
+        # registry entry.
+        ("system.reload_namespace", "Reload MCP namespace", "reload_namespace",
+         "host.supervisor_reload",
+         "Gracefully reload one MCP namespace via the host supervisor."),
+        ("system.restart_namespace", "Restart MCP namespace",
+         "restart_namespace", "host.supervisor_restart",
+         "Restart one MCP namespace via the host supervisor."),
     )
     actions = tuple(
         GatedAction(

webui/sanctioned_restart.py

@@ -0,0 +1,613 @@
+"""Sanctioned MCP restart and graceful reload controls (#642, Phase 2).
+
+Sessions have historically recovered MCP connectivity by killing the host
+daemon (``pkill -f mcp_server.py``, #630). That path stays forbidden: it kills
+every namespace on the host, contaminates the surviving session, and leaves no
+audit trail. This module is the sanctioned replacement.
+
+A restart is modelled as a *gated action*, never as a command:
+
+1. **Capability** — the console action resolves through ``console_authz``
+   against ``task_capability_map``, so the console cannot invent an authority
+   the MCP layer does not already define.
+2. **Preview** — :func:`build_restart_preview` renders a mutation ledger and
+   the exact confirmation phrase. It never returns a shell command.
+3. **Confirmation** — the operator echoes a phrase naming the exact namespace
+   and mode. A phrase for one namespace never authorizes another.
+4. **Operator authorization** — host daemon maintenance is authorized out of
+   band through the environment (#630, and #710 finding F1: a worker session
+   cannot set an env var for an already-running daemon, so this cannot be
+   self-asserted the way a tool argument could).
+5. **Execution** — :func:`execute_restart` never spawns a process. Once every
+   gate passes it hands the request to the configured host-managed restart
+   hook; with no hook configured it fails closed.
+6. **Health recheck** — :func:`verify_post_restart_health` requires live
+   client-namespace probe evidence before any post-restart clean claim.
+
+Manual ``pkill`` remains forbidden and is classified as contamination by
+:func:`classify_restart_command`, which blocks clean claims (#630 AC3).
+
+This module performs no I/O beyond reading its own environment configuration,
+imports no MCP client, and holds no credential.
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import asdict, dataclass
+from typing import Any
+
+import mcp_namespace_health
+import runtime_recovery_guard
+from webui import console_audit, console_authz
+
+# --- Operations -------------------------------------------------------------
+
+MODE_RESTART = "restart"
+MODE_RELOAD = "reload"
+MODES: tuple[str, ...] = (MODE_RESTART, MODE_RELOAD)
+
+ACTION_RESTART_NAMESPACE = "system.restart_namespace"
+ACTION_RELOAD_NAMESPACE = "system.reload_namespace"
+
+ACTION_FOR_MODE: dict[str, str] = {
+    MODE_RESTART: ACTION_RESTART_NAMESPACE,
+    MODE_RELOAD: ACTION_RELOAD_NAMESPACE,
+}
+
+# Namespaces the console may target. An unlisted name fails closed rather than
+# being passed through to a host hook.
+KNOWN_NAMESPACES: tuple[str, ...] = tuple(
+    sorted(
+        set(mcp_namespace_health.DEFAULT_NAMESPACES)
+        | {"gitea-author", "gitea-reviewer", "gitea-merger",
+           "gitea-reconciler", "gitea-controller"}
+    )
+)
+
+# Scope tokens that would mean "everything at once". Explicit non-goal: the
+# console never offers a fleet-wide restart, because that is the blast radius
+# `pkill -f mcp_server.py` already had.
+_FLEET_TOKENS = frozenset({"*", "all", "fleet", "any", ""})
+
+# --- Environment configuration ----------------------------------------------
+# Read server-side only; the value is an opaque host hook reference (e.g. a
+# launchd label), never a command line, and is never rendered to a client.
+RESTART_HOOK_ENV = "GITEA_SANCTIONED_RESTART_HOOK"
+
+# --- Reason codes -----------------------------------------------------------
+
+DENY_UNKNOWN_MODE = "unknown_mode"
+DENY_UNKNOWN_NAMESPACE = "unknown_namespace"
+DENY_FLEET_SCOPE = "fleet_scope_not_permitted"
+DENY_UNAUTHORIZED = "unauthorized"
+DENY_CONFIRMATION_MISSING = "confirmation_required"
+DENY_CONFIRMATION_MISMATCH = "confirmation_mismatch"
+DENY_OPERATOR_AUTHORIZATION = "operator_authorization_missing"
+DENY_HOOK_NOT_CONFIGURED = "restart_hook_not_configured"
+DENY_CONTAMINATED_RUNTIME = "contaminated_runtime"
+
+ALLOW_HOST_ACTION_REQUIRED = "host_action_required"
+
+# Post-restart verification outcomes.
+HEALTH_CLEAN = "clean"
+HEALTH_UNPROVEN = "unproven"
+HEALTH_UNHEALTHY = "unhealthy"
+
+
+def _clean(value: Any) -> str:
+    return str(value or "").strip()
+
+
+# --- Mutation ledger --------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class RestartLedgerEntry:
+    """One planned step, shown before anything is asked of the host."""
+
+    sequence: int
+    step: str
+    summary: str
+    executes_process_kill: bool = False
+
+
+def _mutation_ledger(namespace: str, mode: str) -> tuple[RestartLedgerEntry, ...]:
+    if mode == MODE_RELOAD:
+        middle = RestartLedgerEntry(
+            sequence=2,
+            step="host_graceful_reload",
+            summary=(
+                f"Ask the configured host supervisor to reload {namespace} "
+                "in place, draining in-flight requests. The console does not "
+                "signal the process itself."
+            ),
+        )
+    else:
+        middle = RestartLedgerEntry(
+            sequence=2,
+            step="host_restart_hook",
+            summary=(
+                f"Ask the configured host supervisor to restart {namespace}. "
+                "The console never sends a signal and never runs a kill."
+            ),
+        )
+    return (
+        RestartLedgerEntry(
+            sequence=1,
+            step="quiesce",
+            summary=(
+                f"Stop admitting new gated mutations for {namespace} and "
+                "record the intent before anything restarts."
+            ),
+        ),
+        middle,
+        RestartLedgerEntry(
+            sequence=3,
+            step="health_recheck",
+            summary=(
+                f"Re-probe {namespace} through the live client namespace and "
+                "prove the required tool is callable again."
+            ),
+        ),
+        RestartLedgerEntry(
+            sequence=4,
+            step="audit",
+            summary=(
+                "Append actor, target namespace, mode, and result to the "
+                "console audit log."
+            ),
+        ),
+    )
+
+
+# --- Confirmation -----------------------------------------------------------
+
+
+def confirmation_phrase(namespace: str, mode: str) -> str:
+    """Exact phrase an operator must echo, naming the namespace and mode.
+
+    Binding the namespace into the phrase is the point: a confirmation typed
+    for ``gitea-author`` cannot be replayed against ``gitea-merger``.
+    """
+    return f"{_clean(mode)} {_clean(namespace)}"
+
+
+def confirmation_matches(
+    namespace: str, mode: str, confirmation: str | None
+) -> bool:
+    """Compare *confirmation* to the required phrase (exact, whitespace-trimmed)."""
+    return _clean(confirmation) == confirmation_phrase(namespace, mode)
+
+
+# --- Scope validation -------------------------------------------------------
+
+
+def _validate_scope(namespace: str, mode: str) -> tuple[str, str] | None:
+    """Return ``(reason_code, detail)`` when the scope is refused."""
+    ns = _clean(namespace)
+    md = _clean(mode)
+
+    if md not in MODES:
+        return (
+            DENY_UNKNOWN_MODE,
+            f"Mode {md!r} is not one of {', '.join(MODES)}.",
+        )
+    if ns.lower() in _FLEET_TOKENS:
+        return (
+            DENY_FLEET_SCOPE,
+            (
+                "Fleet-wide restart is an explicit non-goal: it reproduces the "
+                "blast radius of `pkill -f mcp_server.py` (#630). Restart one "
+                "namespace at a time."
+            ),
+        )
+    if ns not in KNOWN_NAMESPACES:
+        return (
+            DENY_UNKNOWN_NAMESPACE,
+            f"Namespace {ns!r} is not a known MCP namespace.",
+        )
+    return None
+
+
+# --- Host hook --------------------------------------------------------------
+
+
+def restart_hook(env: dict[str, str] | None = None) -> dict[str, Any]:
+    """Report the configured host-managed restart hook.
+
+    The hook is a reference the *host* resolves (a supervisor label), not a
+    command this process runs. ``configured=False`` fails restart closed.
+    """
+    source = env if env is not None else os.environ
+    reference = _clean(source.get(RESTART_HOOK_ENV))
+    return {
+        "configured": bool(reference),
+        "reference": reference or None,
+        "source": RESTART_HOOK_ENV if reference else None,
+        "self_assertable": False,
+        "console_executes_process": False,
+    }
+
+
+# --- Preview ----------------------------------------------------------------
+
+
+def build_restart_preview(
+    namespace: str,
+    mode: str = MODE_RESTART,
+    *,
+    principal: console_authz.Principal | None = None,
+    env: dict[str, str] | None = None,
+) -> dict[str, Any]:
+    """Render the dry-run preview for a restart/reload request.
+
+    Read-only: no authorization is granted, no host is contacted, and the
+    result never contains a shell command.
+    """
+    ns = _clean(namespace)
+    md = _clean(mode)
+    action_id = ACTION_FOR_MODE.get(md, ACTION_RESTART_NAMESPACE)
+    action = console_authz.get_action(action_id)
+    decision = console_authz.authorize(action_id, principal)
+    scope_error = _validate_scope(ns, md)
+    hook = restart_hook(env)
+    operator = runtime_recovery_guard.operator_authorization(env)
+
+    return {
+        "action_id": action_id,
+        "namespace": ns,
+        "mode": md,
+        "scope_valid": scope_error is None,
+        "scope_reason_code": scope_error[0] if scope_error else None,
+        "scope_detail": scope_error[1] if scope_error else None,
+        "required_role": action.minimum_role if action else None,
+        "required_permission": action.mcp_permission if action else None,
+        "action_class": action.action_class if action else None,
+        "dual_control": action.dual_control if action else True,
+        "break_glass": action.break_glass if action else True,
+        "requires_confirmation": True,
+        "confirmation_phrase": confirmation_phrase(ns, md),
+        "mutation_ledger": [asdict(entry) for entry in _mutation_ledger(ns, md)],
+        "authorization": decision.to_dict(),
+        "operator_authorization": operator,
+        "restart_hook": hook,
+        "execution_enabled": False,
+        "raw_process_kill_exposed": False,
+        "known_namespaces": list(KNOWN_NAMESPACES),
+        "post_restart_verification_required": True,
+    }
+
+
+# --- Gate -------------------------------------------------------------------
+
+
+def assess_restart_request(
+    namespace: str,
+    mode: str = MODE_RESTART,
+    *,
+    principal: console_authz.Principal | None = None,
+    confirmation: str | None = None,
+    contamination_marker: dict[str, Any] | None = None,
+    env: dict[str, str] | None = None,
+) -> dict[str, Any]:
+    """Decide whether a restart request may proceed to the host hook.
+
+    Every gate must pass. The first failure wins and is reported with a stable
+    reason code; a pass never means "restarted", only "may be handed to the
+    configured host hook".
+    """
+    ns = _clean(namespace)
+    md = _clean(mode)
+    action_id = ACTION_FOR_MODE.get(md, ACTION_RESTART_NAMESPACE)
+    preview = build_restart_preview(ns, md, principal=principal, env=env)
+
+    def refuse(reason_code: str, detail: str) -> dict[str, Any]:
+        return {
+            "allowed": False,
+            "gates_passed": False,
+            "reason_code": reason_code,
+            "detail": detail,
+            "action_id": action_id,
+            "namespace": ns,
+            "mode": md,
+            "preview": preview,
+            "execution_enabled": False,
+        }
+
+    scope_error = _validate_scope(ns, md)
+    if scope_error is not None:
+        return refuse(*scope_error)
+
+    # Authority is checked as an authorization decision, not an execution
+    # grant. ``for_execution=True`` asks "may the console perform this write?",
+    # and the answer here is permanently no: step 2 of the ledger is a request
+    # to the host supervisor, so the console's Phase 2 execution gate is not
+    # the relevant gate. Every branch below keeps ``execution_enabled`` False
+    # and :func:`execute_restart` never touches a process.
+    decision = console_authz.authorize(action_id, principal)
+    if not decision.allowed:
+        return refuse(DENY_UNAUTHORIZED, decision.detail)
+
+    if not _clean(confirmation):
+        return refuse(
+            DENY_CONFIRMATION_MISSING,
+            (
+                "Type the confirmation phrase "
+                f"{preview['confirmation_phrase']!r} to proceed."
+            ),
+        )
+    if not confirmation_matches(ns, md, confirmation):
+        return refuse(
+            DENY_CONFIRMATION_MISMATCH,
+            (
+                "Confirmation does not name this namespace and mode; expected "
+                f"{preview['confirmation_phrase']!r}."
+            ),
+        )
+
+    operator = preview["operator_authorization"]
+    if not operator["authorized"]:
+        return refuse(
+            DENY_OPERATOR_AUTHORIZATION,
+            (
+                "Host daemon maintenance requires out-of-band operator "
+                "authorization via "
+                f"{runtime_recovery_guard.OPERATOR_AUTHORIZATION_ENV}."
+            ),
+        )
+
+    # #630's task-scoped gate deliberately lets a contaminated worker keep
+    # commenting and handing off. Restart is stricter and unconditional: a
+    # runtime already contaminated by a manual kill must be reconciled before
+    # it is restarted again, or the restart just launders the contamination.
+    if contamination_marker and not contamination_marker.get(
+        "cleared_by_reconciler"
+    ):
+        return refuse(
+            DENY_CONTAMINATED_RUNTIME,
+            (
+                "A live contamination marker is present; clear it through the "
+                "reconciler path before restarting."
+            ),
+        )
+
+    hook = preview["restart_hook"]
+    if not hook["configured"]:
+        return refuse(
+            DENY_HOOK_NOT_CONFIGURED,
+            (
+                "No host-managed restart hook is configured "
+                f"({RESTART_HOOK_ENV}). The console will not fall back to a "
+                "process kill."
+            ),
+        )
+
+    return {
+        "allowed": True,
+        "gates_passed": True,
+        "reason_code": ALLOW_HOST_ACTION_REQUIRED,
+        "detail": (
+            "Every gate passed. The restart must be performed by the "
+            "configured host supervisor; the console does not signal the "
+            "process."
+        ),
+        "action_id": action_id,
+        "namespace": ns,
+        "mode": md,
+        "preview": preview,
+        "execution_enabled": False,
+        "console_executes": False,
+        "console_active_phase": console_authz.ACTIVE_PHASE,
+    }
+
+
+# --- Execution --------------------------------------------------------------
+
+
+def execute_restart(
+    namespace: str,
+    mode: str = MODE_RESTART,
+    *,
+    principal: console_authz.Principal | None = None,
+    confirmation: str | None = None,
+    contamination_marker: dict[str, Any] | None = None,
+    env: dict[str, str] | None = None,
+    request_id: str | None = None,
+    session_id: str | None = None,
+) -> dict[str, Any]:
+    """Run every gate, audit the outcome, and hand off to the host.
+
+    This function never spawns a process, never sends a signal, and never
+    builds a command line. ``success`` is False in both directions: a refused
+    request is refused, and an authorized request still requires the host
+    supervisor to act.
+    """
+    assessment = assess_restart_request(
+        namespace,
+        mode,
+        principal=principal,
+        confirmation=confirmation,
+        contamination_marker=contamination_marker,
+        env=env,
+    )
+    action_id = assessment["action_id"]
+    allowed = assessment["allowed"]
+
+    audit = console_audit.record_event(
+        action_id=action_id,
+        result=(
+            console_audit.RESULT_ALLOWED if allowed
+            else console_audit.RESULT_DENIED
+        ),
+        principal=principal,
+        target={"namespace": assessment["namespace"], "mode": assessment["mode"]},
+        reason_code=assessment["reason_code"],
+        detail=assessment["detail"],
+        request_id=request_id,
+        session_id=session_id,
+        metadata={
+            "gates_passed": assessment["gates_passed"],
+            "process_kill_executed": False,
+            "post_restart_verification_required": True,
+        },
+    )
+
+    return {
+        "success": False,
+        "outcome": (
+            ALLOW_HOST_ACTION_REQUIRED if allowed else assessment["reason_code"]
+        ),
+        "allowed": allowed,
+        "detail": assessment["detail"],
+        "namespace": assessment["namespace"],
+        "mode": assessment["mode"],
+        "action_id": action_id,
+        "process_kill_executed": False,
+        "host_hook": assessment["preview"]["restart_hook"],
+        "next_action": (
+            "Have the host supervisor perform the restart, then call "
+            "verify_post_restart_health with live client-namespace evidence "
+            "before claiming a clean session."
+            if allowed
+            else assessment["detail"]
+        ),
+        "assessment": assessment,
+        "audit": audit,
+    }
+
+
+# --- Contamination classification -------------------------------------------
+
+
+def classify_restart_command(
+    command: str | None,
+    *,
+    mcp_pids: list[Any] | tuple[Any, ...] | None = None,
+    session_id: str | None = None,
+    remote: str | None = None,
+    role: str | None = None,
+) -> dict[str, Any]:
+    """Classify an operator-proposed recovery command (#630 AC2).
+
+    A manual ``pkill``/``kill`` of the MCP daemon is contamination, not a
+    restart. When contaminating, a durable marker is returned so downstream
+    gated mutations and clean claims fail closed.
+    """
+    classification = runtime_recovery_guard.classify_recovery_command(
+        command, mcp_pids=mcp_pids
+    )
+    contaminating = bool(classification.get("contamination"))
+
+    marker = None
+    if contaminating:
+        marker = runtime_recovery_guard.build_contamination_record(
+            reason_class=(
+                classification.get("reason_class")
+                or runtime_recovery_guard.REASON_MANUAL_DAEMON_KILL
+            ),
+            command_redacted=classification.get("redacted_command"),
+            session_id=session_id,
+            remote=remote,
+            role=role,
+            detail=(
+                "Manual daemon kill is forbidden; use the sanctioned "
+                f"{ACTION_RESTART_NAMESPACE} gated action instead."
+            ),
+        )
+
+    return {
+        "contamination": contaminating,
+        "sanctioned": not contaminating and not classification.get("process_kill"),
+        "clean_claim_allowed": not contaminating,
+        "reason_class": classification.get("reason_class"),
+        "redacted_command": classification.get("redacted_command"),
+        "classification": classification,
+        "contamination_marker": marker,
+        "sanctioned_alternative": ACTION_RESTART_NAMESPACE,
+    }
+
+
+# --- Post-restart health verification ---------------------------------------
+
+
+def verify_post_restart_health(
+    namespace: str,
+    *,
+    probe_result: dict[str, Any] | None = None,
+    probe_source: str | None = None,
+    registered_tools: list[str] | tuple[str, ...] | None = None,
+    required_tool: str | None = None,
+    profile: str | None = None,
+) -> dict[str, Any]:
+    """Require live proof a namespace is callable before any clean claim (AC3).
+
+    Static registration is not proof and neither is an offline subprocess
+    probe: only ``probe_source=client_namespace`` evidence can clear a
+    post-restart session for mutations.
+    """
+    ns = _clean(namespace)
+    health = mcp_namespace_health.classify_namespace_probe(
+        ns,
+        required_tool=required_tool,
+        registered_tools=registered_tools,
+        probe_result=probe_result,
+        profile=profile,
+        probe_source=probe_source,
+    )
+    healthy = bool(health.get("healthy"))
+    proven = bool(health.get("ide_namespace_proven"))
+
+    if healthy and proven:
+        status = HEALTH_CLEAN
+    elif healthy:
+        status = HEALTH_UNPROVEN
+    else:
+        status = HEALTH_UNHEALTHY
+
+    reasons = list(health.get("reasons") or [])
+    if status == HEALTH_UNPROVEN:
+        reasons.append(
+            "Namespace reported healthy without live client-namespace "
+            "evidence; a post-restart clean claim requires "
+            f"probe_source={mcp_namespace_health.PROBE_SOURCE_CLIENT!r}."
+        )
+
+    return {
+        "namespace": ns,
+        "status": status,
+        "healthy": healthy,
+        "ide_namespace_proven": proven,
+        "clean_claim_allowed": status == HEALTH_CLEAN,
+        "mutations_allowed": status == HEALTH_CLEAN,
+        "reasons": reasons,
+        "health": health,
+    }
+
+
+# --- Policy surface ---------------------------------------------------------
+
+
+def restart_policy() -> dict[str, Any]:
+    """Machine-readable description of the sanctioned restart contract."""
+    return {
+        "policy_version": 1,
+        "modes": list(MODES),
+        "actions": [ACTION_RESTART_NAMESPACE, ACTION_RELOAD_NAMESPACE],
+        "known_namespaces": list(KNOWN_NAMESPACES),
+        "fleet_scope_permitted": False,
+        "console_executes_process_kill": False,
+        "raw_kill_exposed": False,
+        "requires_confirmation": True,
+        "confirmation_binds_namespace": True,
+        "operator_authorization_env": (
+            runtime_recovery_guard.OPERATOR_AUTHORIZATION_ENV
+        ),
+        "restart_hook_env": RESTART_HOOK_ENV,
+        "manual_kill_classified_as": runtime_recovery_guard.CONTAMINATION_KIND,
+        "post_restart_clean_claim_requires": (
+            mcp_namespace_health.PROBE_SOURCE_CLIENT
+        ),
+        "audit_required": True,
+        "silent_auto_restart_permitted": False,
+    }