Merge branch 'master' into feat/issue-646-policy-guardrail-visibility

Reviewed-on: #876
Reviewed-by: sysadmin <[email protected]>

branch_cleanup_guard.py

@@ -163,7 +163,19 @@ _TERMINAL_OWNERSHIP_STATUSES = frozenset(
     {"released", "abandoned", "done", "blocked", "terminal", "closed"}
 )
 _EXPIRED_STATUSES = frozenset({"expired"})
-_STALE_STATUSES = frozenset({"stale", "stale_dead_process", "stale_missing_worktree"})
+_STALE_STATUSES = frozenset(
+    {
+        "stale",
+        "stale_dead_process",
+        "stale_missing_worktree",
+        # #790 Slice A heartbeat-lifecycle bands. Listed here so they are
+        # *classified* rather than falling through to the unknown-status branch;
+        # they still block unless the ownership record proves
+        # ``reclaim_allowed is True``, so the O2 fail-closed rule is unchanged.
+        "stale_missed_heartbeat",
+        "stale_absolute_cap",
+    }
+)
 
 
 def _norm_str(value: Any) -> str:

control_plane_db.py

@@ -31,7 +31,7 @@ from typing import Any, Iterator, Sequence
 
 import dependency_graph
 
-SCHEMA_VERSION = 4
+SCHEMA_VERSION = 5
 
 # Assignable work kinds only — raw monitoring incidents are never work items.
 WORK_KINDS = frozenset({"issue", "pr"})
@@ -186,6 +186,34 @@ CREATE INDEX IF NOT EXISTS idx_dependency_edges_target
     ON dependency_edges(remote, org, repo, target_kind, target_number);
 CREATE INDEX IF NOT EXISTS idx_assignments_session ON assignments(session_id, status);
 CREATE INDEX IF NOT EXISTS idx_incident_gitea ON incident_links(gitea_org, gitea_repo, gitea_issue_number);
+
+-- Model usage, token cost, latency, and performance events (#651)
+CREATE TABLE IF NOT EXISTS usage_events (
+    usage_id INTEGER PRIMARY KEY AUTOINCREMENT,
+    session_id TEXT,
+    remote TEXT NOT NULL DEFAULT 'dadeschools',
+    org TEXT NOT NULL DEFAULT '',
+    repo TEXT NOT NULL DEFAULT '',
+    project_id TEXT,
+    role TEXT NOT NULL DEFAULT 'unknown',
+    model TEXT NOT NULL DEFAULT 'unknown',
+    issue_number INTEGER,
+    pr_number INTEGER,
+    stage TEXT NOT NULL DEFAULT 'unknown',
+    input_tokens INTEGER,
+    output_tokens INTEGER,
+    total_tokens INTEGER,
+    estimated_cost_usd REAL,
+    latency_ms INTEGER,
+    duration_ms INTEGER,
+    status TEXT NOT NULL DEFAULT 'success',
+    metadata TEXT,
+    created_at TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_usage_events_scope ON usage_events(remote, org, repo);
+CREATE INDEX IF NOT EXISTS idx_usage_events_role_model ON usage_events(role, model);
+CREATE INDEX IF NOT EXISTS idx_usage_events_stage ON usage_events(stage);
 """
 
 
@@ -339,6 +367,7 @@ class ControlPlaneDB:
                 self._migrate_incident_links_null_scope(conn)
                 self._migrate_lease_lifecycle_columns(conn)
                 self._migrate_session_ownership_columns(conn)
+                self._migrate_usage_events_table(conn)
                 conn.execute(
                     "INSERT OR REPLACE INTO schema_meta(key, value) VALUES (?, ?)",
                     ("schema_version", str(SCHEMA_VERSION)),
@@ -518,6 +547,207 @@ class ControlPlaneDB:
                     f"UPDATE incident_links SET {col} = '' WHERE {col} IS NULL"
                 )
 
+    def _migrate_usage_events_table(self, conn: sqlite3.Connection) -> None:
+        """Create usage_events table and indexes if they do not exist (#651)."""
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS usage_events (
+                usage_id INTEGER PRIMARY KEY AUTOINCREMENT,
+                session_id TEXT,
+                remote TEXT NOT NULL DEFAULT 'dadeschools',
+                org TEXT NOT NULL DEFAULT '',
+                repo TEXT NOT NULL DEFAULT '',
+                project_id TEXT,
+                role TEXT NOT NULL DEFAULT 'unknown',
+                model TEXT NOT NULL DEFAULT 'unknown',
+                issue_number INTEGER,
+                pr_number INTEGER,
+                stage TEXT NOT NULL DEFAULT 'unknown',
+                input_tokens INTEGER,
+                output_tokens INTEGER,
+                total_tokens INTEGER,
+                estimated_cost_usd REAL,
+                latency_ms INTEGER,
+                duration_ms INTEGER,
+                status TEXT NOT NULL DEFAULT 'success',
+                metadata TEXT,
+                created_at TEXT NOT NULL
+            );
+        """)
+        conn.execute("CREATE INDEX IF NOT EXISTS idx_usage_events_scope ON usage_events(remote, org, repo);")
+        conn.execute("CREATE INDEX IF NOT EXISTS idx_usage_events_role_model ON usage_events(role, model);")
+        conn.execute("CREATE INDEX IF NOT EXISTS idx_usage_events_stage ON usage_events(stage);")
+
+    # #651 retention: cap growth so unauthenticated or high-volume ingest
+    # cannot DoS the control-plane DB (PR #876 F3). Applied after every write.
+    USAGE_EVENTS_MAX_ROWS = 10_000
+    USAGE_EVENTS_RETENTION_DAYS = 90
+
+    def record_usage_event(
+        self,
+        *,
+        session_id: str | None = None,
+        remote: str = "dadeschools",
+        org: str = "",
+        repo: str = "",
+        project_id: str | None = None,
+        role: str = "unknown",
+        model: str = "unknown",
+        issue_number: int | None = None,
+        pr_number: int | None = None,
+        stage: str = "unknown",
+        input_tokens: int | None = None,
+        output_tokens: int | None = None,
+        total_tokens: int | None = None,
+        estimated_cost_usd: float | None = None,
+        latency_ms: int | None = None,
+        duration_ms: int | None = None,
+        status: str = "success",
+        metadata: str | dict[str, Any] | None = None,
+        created_at: str | None = None,
+    ) -> int:
+        """Record a model usage, token cost, latency, or stage performance event (#651)."""
+        ts = created_at or _ts()
+        meta_str: str | None = None
+        if metadata is not None:
+            from webui import console_redaction
+            redacted_meta = console_redaction.redact_payload(metadata)
+            if isinstance(redacted_meta, str):
+                meta_str = redacted_meta
+            else:
+                try:
+                    meta_str = json.dumps(redacted_meta, default=str)
+                except Exception:
+                    meta_str = str(redacted_meta)
+
+        if total_tokens is None and (input_tokens is not None or output_tokens is not None):
+            total_tokens = (input_tokens or 0) + (output_tokens or 0)
+
+        with self._tx(immediate=True) as conn:
+            cursor = conn.execute(
+                """
+                INSERT INTO usage_events (
+                    session_id, remote, org, repo, project_id, role, model,
+                    issue_number, pr_number, stage, input_tokens, output_tokens,
+                    total_tokens, estimated_cost_usd, latency_ms, duration_ms,
+                    status, metadata, created_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                """,
+                (
+                    session_id,
+                    remote,
+                    org,
+                    repo,
+                    project_id,
+                    role,
+                    model,
+                    issue_number,
+                    pr_number,
+                    stage,
+                    input_tokens,
+                    output_tokens,
+                    total_tokens,
+                    estimated_cost_usd,
+                    latency_ms,
+                    duration_ms,
+                    status,
+                    meta_str,
+                    ts,
+                ),
+            )
+            usage_id = cursor.lastrowid
+            self._enforce_usage_events_retention(conn)
+            return usage_id
+
+    def _enforce_usage_events_retention(self, conn: sqlite3.Connection) -> None:
+        """Drop aged and excess usage_events rows (PR #876 F3)."""
+        # Age-based: ISO-8601 UTC timestamps compare lexicographically.
+        cutoff = (
+            datetime.now(timezone.utc)
+            - timedelta(days=int(self.USAGE_EVENTS_RETENTION_DAYS))
+        ).strftime("%Y-%m-%dT%H:%M:%SZ")
+        conn.execute(
+            "DELETE FROM usage_events WHERE created_at < ?",
+            (cutoff,),
+        )
+        # Count-based: keep the newest USAGE_EVENTS_MAX_ROWS by usage_id.
+        max_rows = int(self.USAGE_EVENTS_MAX_ROWS)
+        if max_rows > 0:
+            conn.execute(
+                """
+                DELETE FROM usage_events
+                WHERE usage_id NOT IN (
+                    SELECT usage_id FROM usage_events
+                    ORDER BY usage_id DESC
+                    LIMIT ?
+                )
+                """,
+                (max_rows,),
+            )
+
+    def query_usage_events(
+        self,
+        *,
+        remote: str | None = None,
+        org: str | None = None,
+        repo: str | None = None,
+        project_id: str | None = None,
+        role: str | None = None,
+        model: str | None = None,
+        issue_number: int | None = None,
+        pr_number: int | None = None,
+        stage: str | None = None,
+        session_id: str | None = None,
+        limit: int = 500,
+        offset: int = 0,
+    ) -> list[dict[str, Any]]:
+        """Query stored usage events matching filters (#651)."""
+        conditions = []
+        params = []
+        if remote:
+            conditions.append("remote = ?")
+            params.append(remote)
+        if org:
+            conditions.append("org = ?")
+            params.append(org)
+        if repo:
+            conditions.append("repo = ?")
+            params.append(repo)
+        if project_id:
+            conditions.append("project_id = ?")
+            params.append(project_id)
+        if role:
+            conditions.append("role = ?")
+            params.append(role)
+        if model:
+            conditions.append("model = ?")
+            params.append(model)
+        if issue_number is not None:
+            conditions.append("issue_number = ?")
+            params.append(issue_number)
+        if pr_number is not None:
+            conditions.append("pr_number = ?")
+            params.append(pr_number)
+        if stage:
+            conditions.append("stage = ?")
+            params.append(stage)
+        if session_id:
+            conditions.append("session_id = ?")
+            params.append(session_id)
+
+        where_clause = f"WHERE {' AND '.join(conditions)}" if conditions else ""
+        sql = f"""
+            SELECT * FROM usage_events
+            {where_clause}
+            ORDER BY usage_id ASC
+            LIMIT ? OFFSET ?
+        """
+        params.extend([limit, offset])
+
+        with self._tx(immediate=False) as conn:
+            cursor = conn.execute(sql, params)
+            rows = cursor.fetchall()
+            return [dict(row) for row in rows]
+
     # ── sessions ──────────────────────────────────────────────────────────
 
     def upsert_session(

docs/mcp-tool-inventory.md

@@ -101,6 +101,7 @@ that gates each call, not which tools exist.
 - `gitea_get_profile`
 - `gitea_get_runtime_context`
 - `gitea_get_shell_health`
+- `gitea_heartbeat_issue_lock`
 - `gitea_heartbeat_reviewer_pr_lease`
 - `gitea_inspect_workflow_lease`
 - `gitea_issue_irrecoverable_provenance_authorization`

docs/observability/analytics-instrumentation.md

@@ -0,0 +1,143 @@
+# Model Usage, Token Cost, Latency, and Workflow Analytics (Phase 4)
+
+- **Tracking Issue:** [#651](https://gitea.prgs.cc/Scaled-Tech-Consulting/Gitea-Tools/issues/651)
+- **Parent Epic:** [#631](https://gitea.prgs.cc/Scaled-Tech-Consulting/Gitea-Tools/issues/651)
+- **Console Surface:** `/analytics`, `/api/v1/analytics`, `/api/v1/analytics/usage`
+
+## 1. Overview
+
+The Web Console Analytics module provides durable, aggregate visibility into **model usage, token cost, latency percentiles, and workflow-stage performance** across projects, worker roles, AI models, issues, and PRs.
+
+### Non-Goals
+- No mandatory client-side telemetry that leaks prompts or secret keys.
+- No third-party payment provider or billing integration.
+- No automatic model routing changes without controller policy (#647).
+
+---
+
+## 2. Event Schema (`usage_events`)
+
+Usage metrics are stored in the control-plane database under table `usage_events`.
+
+| Column | Type | Description |
+|---|---|---|
+| `usage_id` | `INTEGER` | Primary key (autoincrement) |
+| `session_id` | `TEXT` | Optional active session identifier |
+| `remote` | `TEXT` | Known Gitea instance (`dadeschools` or `prgs`) |
+| `org` | `TEXT` | Repository owner / organization |
+| `repo` | `TEXT` | Repository name |
+| `project_id` | `TEXT` | Optional project identifier |
+| `role` | `TEXT` | Active worker role (`author`, `reviewer`, `merger`, `reconciler`, `controller`) |
+| `model` | `TEXT` | LLM model identifier (e.g. `gemini-3.6-flash`, `claude-3-5-sonnet`) |
+| `issue_number` | `INTEGER` | Correlated Gitea issue number (optional) |
+| `pr_number` | `INTEGER` | Correlated Gitea PR number (optional) |
+| `stage` | `TEXT` | Workflow stage (`preflight`, `implementation`, `review`, `merge`, `reconciliation`) |
+| `input_tokens` | `INTEGER` | Input token count (optional / nullable) |
+| `output_tokens` | `INTEGER` | Output token count (optional / nullable) |
+| `total_tokens` | `INTEGER` | Total token count (optional / nullable) |
+| `estimated_cost_usd` | `REAL` | Estimated USD cost (optional / nullable) |
+| `latency_ms` | `INTEGER` | Request latency in milliseconds (optional / nullable) |
+| `duration_ms` | `INTEGER` | Stage execution duration in milliseconds (optional / nullable) |
+| `status` | `TEXT` | Outcome status (`success`, `failure`, `timeout`) |
+| `metadata` | `TEXT` | Redacted metadata or summary string |
+| `created_at` | `TEXT` | ISO 8601 UTC timestamp |
+
+---
+
+## 3. Handling of Missing Data ("Unknown" vs. Zero Fabrication)
+
+To ensure operational metrics accurately reflect evidence:
+- **Untracked or missing metrics are displayed as `Unknown`**, never zero-fabricated.
+- If an event omits `estimated_cost_usd`, `latency_ms`, or token counts, the aggregator marks those fields as missing (`None`) rather than defaulting to `0` or `$0.00`.
+- Summary tables and KPI cards explicitly indicate when data is unmeasured or partially reported.
+
+---
+
+## 4. Redaction & Security Rules
+
+Per `#633` security policy:
+- Free-text fields (`metadata`, `prompt_summary`, `session_id`) are run through `console_redaction.redact_text` before persistence and output serialization.
+- Secret tokens, keychain commands, authorization headers, passwords, and JWTs are stripped automatically.
+
+---
+
+## 5. Opt-in Instrumentation Guide
+
+Applications, MCP servers, and background sessions can report usage metrics through either Python API or HTTP ingestion.
+
+### Python Ingestion
+
+```python
+from webui.analytics_loader import record_usage
+
+record_usage(
+    remote="dadeschools",
+    org="Scaled-Tech-Consulting",
+    repo="Gitea-Tools",
+    role="author",
+    model="gemini-3.6-flash",
+    issue_number=651,
+    stage="implementation",
+    input_tokens=1420,
+    output_tokens=380,
+    total_tokens=1800,
+    estimated_cost_usd=0.00045,
+    latency_ms=320,
+    duration_ms=4500,
+    status="success",
+    metadata={"note": "Implementation of analytics module"},
+)
+```
+
+### HTTP Ingestion API (authorized write)
+
+`POST /api/v1/analytics/usage` is a **gated write**. It runs through
+`console_authz` action `record_analytics_usage` (operator+, Phase 2 execution).
+Unauthenticated or phase-inactive requests receive **403** and do not write.
+Prefer in-process `record_usage` for MCP / session instrumentation.
+
+```http
+POST /api/v1/analytics/usage HTTP/1.1
+Content-Type: application/json
+# Requires authenticated principal with record_analytics_usage execution enabled
+
+{
+  "remote": "dadeschools",
+  "org": "Scaled-Tech-Consulting",
+  "repo": "Gitea-Tools",
+  "role": "author",
+  "model": "gemini-3.6-flash",
+  "issue_number": 651,
+  "stage": "implementation",
+  "input_tokens": 1420,
+  "output_tokens": 380,
+  "total_tokens": 1800,
+  "estimated_cost_usd": 0.00045,
+  "latency_ms": 320,
+  "duration_ms": 4500,
+  "status": "success",
+  "metadata": "Analytics schema landed"
+}
+```
+
+### Retention
+
+`usage_events` is retained with hard caps applied on every write:
+
+| Limit | Default |
+|---|---|
+| Max rows | 10,000 (`ControlPlaneDB.USAGE_EVENTS_MAX_ROWS`) |
+| Max age | 90 days (`ControlPlaneDB.USAGE_EVENTS_RETENTION_DAYS`) |
+
+Older rows (by `created_at`) and excess oldest rows (by `usage_id`) are deleted
+after each insert so unbounded growth / DoS-by-volume cannot fill the DB.
+
+---
+
+## 6. Querying Analytics API
+
+```http
+GET /api/v1/analytics?role=author&stage=implementation HTTP/1.1
+```
+
+Returns `AnalyticsSnapshot` JSON containing aggregations (`by_model`, `by_stage`, `by_role`, `by_work_item`, `by_project`) and latency percentiles (`p50`, `p90`, `p95`, `p99`).

docs/post-restart-reconcile.md

@@ -0,0 +1,56 @@
+# Post-restart MCP reconciliation (#662)
+
+After an MCP process restart, sessions, leases, capabilities, worktrees, and
+interrupted mutations must be reconciled before operators claim a clean runtime.
+This document describes the #662 completion-proof path.
+
+## Components
+
+| Piece | Where | Responsibility |
+|-------|-------|----------------|
+| `post_restart_reconcile.reconcile_after_restart` | `post_restart_reconcile.py` | Pure classification: inventory → completion proof DTO. No I/O. |
+| `RestartCompletionProof` | `post_restart_reconcile.py` | Machine-readable proof (`.as_dict()` is JSON-serializable). |
+| `gitea_reconcile_after_restart` | `gitea_mcp_server.py` | MCP tool: gathers inventory from the #613 control-plane DB + master-parity, classifies, returns the proof. Read-only. |
+| Boot hook | `gitea_assess_master_parity` | First post-restart parity probe also runs reconcile once (log-only by default). |
+
+## Dimensions
+
+The assessor classifies:
+
+- **service_health** — process healthy / parity mutation-safe
+- **clients** — connected client descriptors (optional inventory)
+- **sessions** — active session rows with dead owner pids are unresolved
+- **checkpoints** — soft-depends on #660; skipped with reason when schema absent
+- **leases** — live control-plane leases after restart
+- **capabilities** — master-parity / stale-runtime (#610)
+- **worktrees** — lease-bound paths missing on disk
+- **interrupted_mutations** — mutating lease phases or explicit pending inventory; **never auto-resumed**
+- **duplicates** — multiple live claims on the same work item
+- **queue** — allocator resume safety
+
+## Modes
+
+| Mode | Env / arg | Behavior |
+|------|-----------|----------|
+| `log_only` (default) | unset or `GITEA_POST_RESTART_RECONCILE_MODE=log_only` | Proof only; `mutation_hold=false` |
+| `enforce` | `GITEA_POST_RESTART_RECONCILE_MODE=enforce` or `mode=enforce` | Sets `mutation_hold=true` when overall status is degraded/failed or interrupted mutations remain |
+
+## Follow-up issues
+
+Unresolved dimensions produce `proposed_follow_ups` entries suitable for durable
+Gitea issues. The MCP tool **does not create** those issues in v1 (rollout is
+log-only first). Controllers may file them from the proof payload.
+
+## Links
+
+- Umbrella: #655
+- Vision: #652 · Roadmap: #653
+- Checkpoint schema: #660 (soft dependency)
+- Drain proof: #661 (soft)
+- This issue: #662
+
+## Non-goals
+
+- HA multi-instance failover
+- Automatic silent mutation replay
+- Implementing the #660 checkpoint schema itself

docs/webui-authz-audit.md

@@ -91,6 +91,7 @@ already define, and a regression test asserts each mapping matches.
 | `close_pr` | controller | privileged | `gitea.pr.close` | Yes | No | No | 3 |
 | `merge_pr` | controller | privileged | `gitea.pr.merge` | Yes | **Yes** | **Yes** | 3 |
 | `delete_branch` | admin | destructive | `gitea.branch.delete` | Yes | **Yes** | **Yes** | 3 |
+| `record_analytics_usage` | operator | gated_write | `runtime.record_analytics_usage` | Yes | No | No | 2 |
 | `system.reload_namespace` | controller | privileged | `runtime.reload_namespace` | Yes | No | No | 2 |
 | `system.restart_namespace` | admin | destructive | `runtime.restart_namespace` | Yes | **Yes** | **Yes** | 2 |
 

docs/webui-local-dev.md

@@ -66,6 +66,8 @@ status, onboarding checklist state, and the fail-closed error payloads (#635).
 | `/api/prompts` | JSON prompt export with workflow hashes |
 | `/runtime` | MCP runtime health and stale detection (#430) |
 | `/api/runtime` | JSON runtime health export |
+| `/policy` | Workflow policy and guardrail configuration visibility (#646) |
+| `/api/v1/policy` | Versioned JSON guardrail inventory (redacted, read-only) |
 | `/audit` | Report audit paste + validator preview (#431) |
 | `/api/audit` | JSON validator preview (POST `report_text`, optional `task_kind`) |
 | `/worktrees` | Worktree hygiene dashboard (#432) |
@@ -78,7 +80,6 @@ status, onboarding checklist state, and the fail-closed error payloads (#635).
 | `/sessions` | Phase 1 shell stub — session inventory (backed by #636) |
 | `/inventory` | Phase 1 shell stub — unified inventory (backed by #636) |
 | `/timeline` | Phase 1 shell stub — workflow event timeline |
-| `/policy` | Phase 1 shell stub — capability/role policy placeholder |
 | `/insights` | Phase 1 shell stub — operational insights placeholder |
 
 Most routes are GET-only. POST/PUT/PATCH/DELETE return `405` with
@@ -239,12 +240,25 @@ health, workflow/schema SHA-256 hashes, and stale-runtime warnings when the
 checkout is behind merged safety-gate changes. Restart guidance links to #420;
 no tokens or MCP restart actions are exposed.
 
+## Policy & guardrail visibility (#646)
+
+`/policy` (HTML) and `/api/v1/policy` (JSON) surface a **read-only** projection
+of the major workflow guardrails — role separation/RBAC, lease lifecycle,
+author worktree binding, merge confirmation, secret redaction, contamination
+containment, allocator policy, audit logging, and mutation gating. Each entry
+carries source pointers to the file/module/doc that owns it, a compact active
+value derived from the existing safe policy accessors, and — where a documented
+default is declared — a diff of active vs documented. The whole payload is run
+through the console redaction pass before it is emitted, so a planted or
+accidental secret degrades to the placeholder rather than reaching a client.
+The view never edits policy and exposes no gate-weakening toggle.
+
 ## Application shell — Phase 1 (#638)
 
 The console shell (`webui/layout.py`) renders a grouped navigation driven by a
 single nav-config module, `webui/nav.py`. Nav groups follow the epic #631
 Phase 1 information architecture: **Health, Traffic, Runtime/Sessions,
-Projects, Inventory, Timeline, Policy** (placeholder), and **Insights**
+Projects, Inventory, Timeline, Policy** (live via #646), and **Insights**
 (placeholder). Live views and Phase 1 placeholders (`stub`) are declared in one
 place so the layout and the route table cannot drift.
 
@@ -254,10 +268,10 @@ a **mode: read-only** badge — plus a **Docs** link to this document. No
 privileged action controls are present in the Phase 1 shell.
 
 Not-yet-implemented surfaces (`/sessions`, `/inventory`, `/timeline`,
-`/policy`, `/insights`) resolve to graceful read-only stub pages instead of
-404s; their backing views land in later child issues of #631 (the inventory
-surfaces are backed by #636). Mutating methods on stub routes still fail closed
-with `read-only-mvp`.
+`/insights`) resolve to graceful read-only stub pages instead of 404s; their
+backing views land in later child issues of #631 (the inventory surfaces are
+backed by #636). `/policy` is a live read-only surface (#646), not a stub.
+Mutating methods on stub routes still fail closed with `read-only-mvp`.
 
 ## System-health dashboard (#639)
 

gitea_mcp_server.py

@@ -2065,6 +2065,7 @@ import allocator_dependencies  # noqa: E402
 import dependency_graph  # noqa: E402  # #784 durable dependency edges
 import control_plane_db  # noqa: E402
 import lease_lifecycle  # noqa: E402
+import lease_policy  # noqa: E402
 import workflow_dashboard  # noqa: E402  # #605 live queue/lease dashboard
 import restart_coordinator  # noqa: E402  # #658 MCP restart coordinator/impact
 import incident_bridge  # noqa: E402
@@ -2310,7 +2311,6 @@ import canonical_comment_validator as ccv  # noqa: E402
 # GITEA_ISSUE_LOCK_DIR, bound to the current MCP session via a per-PID pointer.
 # Legacy global path retained only for test/doc references — do not seed manually.
 ISSUE_LOCK_FILE = "/tmp/gitea_issue_lock.json"
-WORK_LEASE_TTL_HOURS = 4
 AUTHOR_ISSUE_WORK_LEASE = "author_issue_work"
 VALID_WORK_LEASE_OPERATIONS = frozenset({
     AUTHOR_ISSUE_WORK_LEASE,
@@ -2485,7 +2485,6 @@ def _evaluate_issue_lock_recovery(
             worktree_path,
             prior_head_sha=local_head,
             synced_head_sha=remote_head,
-            remote=remote,
         )
 
     # #772: with no remote branch there is no head to measure against, so the
@@ -2626,7 +2625,12 @@ def _build_author_issue_work_lease(
     host: str | None,
 ) -> dict:
     created = _work_lease_now()
-    expires = created + timedelta(hours=WORK_LEASE_TTL_HOURS)
+    # #790 Slice A: the window comes from the central policy, not a literal here.
+    # It is also now a *sliding* window — the lease lives ``initial_ttl_minutes``
+    # past its last valid heartbeat rather than a fixed four hours past its
+    # creation, so an abandoned task stops holding the claim within one TTL.
+    policy = lease_policy.policy_for(lease_policy.TASK_CLASS_AUTHOR_ISSUE_WORK)
+    expires = created + timedelta(minutes=policy.initial_ttl_minutes)
     return {
         "operation_type": AUTHOR_ISSUE_WORK_LEASE,
         "issue_number": issue_number,
@@ -2637,6 +2641,15 @@ def _build_author_issue_work_lease(
         "created_at": _work_lease_timestamp(created),
         "expires_at": _work_lease_timestamp(expires),
         "last_heartbeat_at": _work_lease_timestamp(created),
+        # #790 AC-N1: the ownership key for this task. Distinct from the recorded
+        # PID, which is the shared daemon and identifies no individual task.
+        "task_session_id": issue_lock_store.mint_task_session_id(
+            AUTHOR_ISSUE_WORK_LEASE
+        ),
+        # #790 AC-N8: the explicit lifecycle marker. Its absence — never a
+        # timestamp comparison — is what makes a lock legacy.
+        "lifecycle_version": lease_policy.LIFECYCLE_HEARTBEAT_V1,
+        "heartbeat_count": 1,
     }
 
 
@@ -4407,6 +4420,135 @@ def gitea_lock_issue(
 
 
 @mcp.tool()
+def gitea_heartbeat_issue_lock(
+    issue_number: int,
+    branch_name: str,
+    task_session_id: str | None = None,
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    worktree_path: str | None = None,
+    expected_generation: int | None = None,
+) -> dict:
+    """Prove an owned author issue lease is still active (#790 Slice A).
+
+    The task-liveness signal the lifecycle was missing. Before this, an author
+    lease carried a fixed four-hour expiry that nothing could shorten, and the
+    only liveness evidence was the recorded PID — the long-lived MCP daemon,
+    which stays alive across every task it serves and so proved nothing about
+    whether the authoring task still held the work.
+
+    Each successful call slides the lease ``initial_ttl_minutes`` past *now*
+    from the central policy, so an actively heartbeating session is never
+    evicted while an abandoned one releases its claim within one TTL.
+
+    What this tool cannot do, by construction:
+
+    * **Acquire.** It refuses when no durable lock exists.
+    * **Take over.** Exact issue, branch, realpath-normalized worktree,
+      claimant username, claimant profile, and recorded task-session identifier
+      must all match; a superseded session holding an older identifier is
+      refused.
+    * **Revive.** A lease already past its grace is not heartbeatable — that
+      would let a session restore ownership it had stopped proving. It must use
+      the sanctioned reclaim path, which mints a new generation.
+
+    A lock predating the heartbeat lifecycle is rebound rather than heartbeated:
+    its exact owner is re-verified and a genuine task-session identifier and
+    first heartbeat are minted (#790 AC-N8). The rebind is decided server-side
+    from the durable lifecycle marker; there is no caller-facing switch.
+
+    Args:
+        issue_number: The locked issue number.
+        branch_name: The branch recorded on the lock.
+        task_session_id: The identifier this session received when it acquired
+            or rebound the lock. It is a fencing token, not an ownership
+            assertion: it is compared against durable state and can only ever
+            cause a refusal, never grant anything. Omitted only when rebinding a
+            legacy lock, which has no identifier yet and mints one.
+        remote: Known instance — 'dadeschools' or 'prgs'.
+        host: Override the Gitea host.
+        org: Override the owner/organization.
+        repo: Override the repository name.
+        worktree_path: Author worktree recorded on the lock.
+        expected_generation: Optional fencing value. The per-issue flock already
+            serializes the read and the write, so this is for a caller that
+            wants to pin the generation it last observed across calls; a moved
+            generation fails closed.
+
+    Returns:
+        dict with 'success', 'performed', the sliding 'expires_at',
+        'last_heartbeat_at', 'lock_generation', 'task_session_id', the applied
+        'policy', and post-write 'freshness'; on refusal 'success'/'performed'
+        False with 'reasons' naming exactly what did not match.
+    """
+    blocked = _profile_permission_block(
+        task_capability_map.required_permission("heartbeat_issue_lock"),
+        issue_number=issue_number,
+        remote=remote,
+        host=host,
+        org=org,
+        repo=repo,
+        org_explicit=org is not None,
+        repo_explicit=repo is not None,
+    )
+    if blocked:
+        return blocked
+
+    resolved_worktree = issue_lock_worktree.resolve_author_worktree_path(
+        worktree_path, _canonical_local_git_root()
+    )
+    h, o, r = _resolve(remote, host, org, repo)
+    claimant = _work_lease_claimant(h)
+    identity = claimant.get("username")
+    profile = claimant.get("profile")
+
+    existing = _load_existing_issue_lock(
+        remote=remote, org=o, repo=r, issue_number=issue_number
+    )
+    if not existing:
+        return {
+            "success": False,
+            "performed": False,
+            "issue_number": issue_number,
+            "reasons": [
+                f"no durable lock for issue #{issue_number}; heartbeat cannot "
+                "acquire a claim (fail closed)"
+            ],
+        }
+
+    if issue_lock_store.is_legacy_lease(existing):
+        outcome = issue_lock_store.rebind_legacy_lock(
+            remote=remote,
+            org=o,
+            repo=r,
+            issue_number=issue_number,
+            branch_name=branch_name,
+            worktree_path=resolved_worktree,
+            identity=identity,
+            profile=profile,
+            expected_generation=expected_generation,
+        )
+        outcome["operation"] = "legacy_rebind"
+        return outcome
+
+    outcome = issue_lock_store.heartbeat_session_lock(
+        remote=remote,
+        org=o,
+        repo=r,
+        issue_number=issue_number,
+        branch_name=branch_name,
+        worktree_path=resolved_worktree,
+        identity=identity,
+        profile=profile,
+        task_session_id=str(task_session_id or ""),
+        expected_generation=expected_generation,
+    )
+    outcome["operation"] = "heartbeat"
+    return outcome
+
+
 @mcp.tool()
 def gitea_recover_dirty_orphaned_issue_worktree(
     issue_number: int,
@@ -4680,6 +4822,7 @@ def gitea_recover_dirty_orphaned_issue_worktree(
         )
     return result
 
+
 @mcp.tool()
 def gitea_rebind_dirty_same_claimant_author_session(
     issue_number: int,
@@ -4936,8 +5079,6 @@ def gitea_rebind_dirty_same_claimant_author_session(
     }
     return result
 
-    return result
-
 
 @mcp.tool()
 def gitea_assess_work_issue_duplicate(
@@ -17881,6 +18022,17 @@ def gitea_assess_master_parity(
     }
     if parity["restart_required"] and enforced:
         out["report"] = master_parity_gate.parity_report(parity)
+    # #662 AC1: first post-restart master-parity probe also runs the boot
+    # reconcile once (log-only by default; never raises).
+    boot_proof = _ensure_boot_post_restart_reconcile()
+    if boot_proof is not None:
+        out["post_restart_reconcile"] = {
+            "reconcile_id": boot_proof.get("reconcile_id"),
+            "overall_status": boot_proof.get("overall_status"),
+            "mutation_hold": boot_proof.get("mutation_hold"),
+            "unresolved_count": boot_proof.get("unresolved_count"),
+            "mode": boot_proof.get("mode"),
+        }
     return out
 
 
@@ -22329,6 +22481,249 @@ def gitea_request_mcp_restart(
     return payload
 
 
+# --- #662 post-restart reconciliation ---------------------------------------
+
+_POST_RESTART_LAST_PROOF: dict | None = None
+_POST_RESTART_BOOT_RAN = False
+
+
+def _post_restart_reconcile_mode() -> str:
+    """Return log_only (default) or enforce from process environment."""
+    raw = (os.environ.get("GITEA_POST_RESTART_RECONCILE_MODE") or "").strip().lower()
+    if raw in {"enforce", "enforced", "hold"}:
+        return "enforce"
+    return "log_only"
+
+
+def _gather_post_restart_inventory(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    limit: int = 200,
+) -> dict:
+    """Gather live control-plane facts for post-restart reconcile (#662).
+
+    Best-effort and fail-closed: any inventory section that cannot be read is
+    recorded on ``incomplete_reasons`` and ``inventory_complete`` is cleared.
+    Never mutates Gitea or the control-plane DB.
+    """
+    import master_parity_gate
+    import post_restart_reconcile as prr
+
+    inventory_complete = True
+    incomplete_reasons: list[str] = []
+    sessions: list[dict] = []
+    leases: list[dict] = []
+    worktree_bindings: list[dict] = []
+
+    db, db_errs = _control_plane_db_or_error()
+    if db is None:
+        inventory_complete = False
+        incomplete_reasons.extend(
+            db_errs or ["control-plane DB unavailable; cannot reconcile after restart"]
+        )
+    else:
+        try:
+            sessions = db.list_sessions(statuses=("active",), limit=max(1, int(limit)))
+        except Exception as exc:  # noqa: BLE001
+            inventory_complete = False
+            incomplete_reasons.append(
+                f"session inventory failed: {_redact(str(exc))}"
+            )
+        try:
+            lease_result = lease_lifecycle.list_active_leases(
+                db,
+                remote=remote if remote in REMOTES else remote,
+                org=org,
+                repo=repo,
+                role=None,
+                include_non_active=True,
+                limit=max(1, int(limit)),
+            )
+            leases = list(lease_result.get("leases") or [])
+        except Exception as exc:  # noqa: BLE001
+            inventory_complete = False
+            incomplete_reasons.append(
+                f"lease inventory failed: {_redact(str(exc))}"
+            )
+            leases = []
+
+        # Derive worktree bindings from live leases that carry a path.
+        for row in leases:
+            wt = (row.get("worktree_path") or "").strip()
+            if not wt:
+                continue
+            exists = bool(lease_lifecycle.worktree_exists(wt))
+            worktree_bindings.append(
+                {
+                    "path": wt,
+                    "exists": exists,
+                    "missing": not exists,
+                    "lease_id": row.get("lease_id"),
+                    "session_id": row.get("session_id"),
+                    "work_kind": row.get("work_kind"),
+                    "work_number": row.get("work_number"),
+                }
+            )
+
+    # Capability / master-parity dimension (code parity after restart).
+    try:
+        parity = _current_master_parity()
+        capabilities = {
+            "stale": bool(parity.get("stale")),
+            "startup_head": parity.get("startup_head"),
+            "current_head": parity.get("current_head"),
+            "in_parity": parity.get("in_parity"),
+            "mutation_safe": parity.get("mutation_safe"),
+        }
+        service_health = {
+            "healthy": bool(parity.get("mutation_safe", not parity.get("stale"))),
+            "parity_summary": master_parity_gate.format_parity(parity),
+        }
+        boot_head = parity.get("startup_head") or _process_boot_head_sha
+        current_head = parity.get("current_head")
+    except Exception as exc:  # noqa: BLE001
+        inventory_complete = False
+        incomplete_reasons.append(
+            f"master-parity inventory failed: {_redact(str(exc))}"
+        )
+        capabilities = {"stale": None}
+        service_health = {"healthy": None, "error": "parity assessment failed"}
+        boot_head = _process_boot_head_sha
+        current_head = None
+
+    # #660 soft dependency: checkpoint schema not landed → skip dimension.
+    checkpoints_available = False
+    try:
+        import importlib
+
+        importlib.import_module("session_checkpoint_schema")
+        checkpoints_available = True
+    except Exception:  # noqa: BLE001
+        checkpoints_available = False
+
+    return {
+        "inventory_complete": inventory_complete,
+        "incomplete_reasons": incomplete_reasons,
+        "service_health": service_health,
+        "clients": [],  # client transport inventory is host/IDE-owned
+        "sessions": sessions,
+        "leases": leases,
+        "checkpoints_available": checkpoints_available,
+        "checkpoints": [] if checkpoints_available else None,
+        "worktree_bindings": worktree_bindings,
+        "pending_mutations": [],
+        "capabilities": capabilities,
+        "boot_head_sha": boot_head,
+        "current_head_sha": current_head,
+        "queue_state": {"safe_to_resume": inventory_complete},
+        "reconcile_version": prr.RECONCILE_VERSION,
+    }
+
+
+def _run_post_restart_reconcile(
+    *,
+    remote: str = "prgs",
+    org: str | None = None,
+    repo: str | None = None,
+    mode: str | None = None,
+    limit: int = 200,
+) -> dict:
+    """Gather + classify post-restart state; cache the latest proof (#662)."""
+    global _POST_RESTART_LAST_PROOF, _POST_RESTART_BOOT_RAN
+    import post_restart_reconcile as prr
+
+    try:
+        _h, o, r = _resolve(remote, None, org, repo)
+    except ValueError as exc:
+        return {
+            "success": False,
+            "read_only": True,
+            "reasons": [str(exc)],
+        }
+
+    inventory = _gather_post_restart_inventory(
+        remote=remote, org=o, repo=r, limit=limit
+    )
+    proof = prr.reconcile_after_restart(
+        inventory,
+        mode=mode or _post_restart_reconcile_mode(),
+    )
+    payload = proof.as_dict()
+    payload["success"] = True
+    payload["read_only"] = True
+    payload["remote"] = remote
+    payload["org"] = o
+    payload["repo"] = r
+    payload["follow_up_create_supported"] = False
+    payload["follow_up_create_note"] = (
+        "proposed_follow_ups lists durable issues the apply path may create; "
+        "this tool never creates them (log-only by default, #662 rollout)"
+    )
+    _POST_RESTART_LAST_PROOF = payload
+    _POST_RESTART_BOOT_RAN = True
+    return payload
+
+
+def _ensure_boot_post_restart_reconcile() -> dict | None:
+    """Run post-restart reconcile once per process (boot hook, #662 AC1)."""
+    global _POST_RESTART_BOOT_RAN
+    if _POST_RESTART_BOOT_RAN:
+        return _POST_RESTART_LAST_PROOF
+    # Best-effort: never raise from the boot hook.
+    try:
+        return _run_post_restart_reconcile()
+    except Exception:  # noqa: BLE001
+        _POST_RESTART_BOOT_RAN = True
+        return None
+
+
+@mcp.tool()
+def gitea_reconcile_after_restart(
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    mode: str | None = None,
+    limit: int = 200,
+) -> dict:
+    """Run post-restart MCP reconciliation and return a completion proof (#662).
+
+    Gathers live control-plane sessions, leases, worktree bindings, and
+    master-parity evidence, then classifies them with the pure
+    ``post_restart_reconcile.reconcile_after_restart`` assessor. Returns a
+    machine-readable completion proof listing resolved / unresolved dimensions
+    and proposed durable follow-up issues.
+
+    Read-only by design: never restarts MCP, never auto-resumes write
+    mutations, and never creates Gitea issues (those are a separate apply
+    path). Default mode is ``log_only``; set
+    ``GITEA_POST_RESTART_RECONCILE_MODE=enforce`` (or pass ``mode='enforce'``)
+    to set ``mutation_hold`` when anything remains unresolved.
+
+    Soft-depends on #660 for session checkpoints: when the checkpoint schema
+    module is absent the checkpoints dimension is ``skipped`` with an explicit
+    reason rather than inventing a schema.
+    """
+    read_block = _profile_operation_gate("gitea.read")
+    if read_block:
+        return {
+            "success": False,
+            "read_only": True,
+            "reasons": read_block,
+            "permission_report": _permission_block_report("gitea.read"),
+        }
+
+    return _run_post_restart_reconcile(
+        remote=remote,
+        org=org,
+        repo=repo,
+        mode=mode,
+        limit=limit,
+    )
+
+
 @mcp.tool()
 def gitea_inspect_workflow_lease(
     lease_id: str,

issue_lock_store.py

@@ -15,15 +15,27 @@ import json
 import os
 import re
 import tempfile
+import uuid
 from contextlib import contextmanager
 from datetime import datetime, timedelta, timezone
 from typing import Any
 
+import lease_policy
+
 LOCK_DIR_ENV = "GITEA_ISSUE_LOCK_DIR"
 DEFAULT_LOCK_DIR = os.path.expanduser("~/.cache/gitea-tools/issue-locks")
-WORK_LEASE_TTL_HOURS = 4
 AUTHOR_ISSUE_WORK_LEASE = "author_issue_work"
 
+# Freshness classifications. ``STATUS_STALE`` remains the dead-PID band that
+# #753 recovery keys on; the two bands below are new in #790 Slice A and apply
+# only to leases minted under the heartbeat lifecycle.
+STATUS_LIVE = "live"
+STATUS_EXPIRED = "expired"
+STATUS_ABSENT = "absent"
+STATUS_STALE = "stale"
+STATUS_STALE_MISSED_HEARTBEAT = "stale_missed_heartbeat"
+STATUS_STALE_ABSOLUTE_CAP = "stale_absolute_cap"
+
 _SAFE_SEGMENT_RE = re.compile(r"[^A-Za-z0-9._+-]+")
 
 
@@ -257,6 +269,331 @@ def bind_session_lock(
     return path
 
 
+def _ownership_refusals(
+    lock: dict[str, Any],
+    *,
+    issue_number: int,
+    branch_name: str,
+    worktree_path: str,
+    identity: str | None,
+    profile: str | None,
+) -> list[str]:
+    """Exact-ownership mismatches between a durable lock and a live caller.
+
+    Shared by the heartbeat writer and the legacy rebind path so the two cannot
+    disagree about what "the same owner" means. Every field is compared against
+    durable state; nothing is taken on the caller's word beyond the identity the
+    server itself resolved.
+    """
+    reasons: list[str] = []
+    if lock.get("issue_number") != issue_number:
+        reasons.append(
+            f"lock targets issue #{lock.get('issue_number')}, not #{issue_number}"
+        )
+    if str(lock.get("branch_name") or "") != str(branch_name or ""):
+        reasons.append(
+            f"lock branch '{lock.get('branch_name')}' does not match '{branch_name}'"
+        )
+    if not _same_realpath(str(lock.get("worktree_path") or ""), worktree_path):
+        reasons.append(
+            f"lock worktree '{lock.get('worktree_path')}' does not match "
+            f"'{worktree_path}'"
+        )
+    lease = lock.get("work_lease") if isinstance(lock, dict) else None
+    claimant = lease.get("claimant") if isinstance(lease, dict) else None
+    claimant = claimant if isinstance(claimant, dict) else {}
+    recorded_identity = str(claimant.get("username") or "").strip()
+    recorded_profile = str(claimant.get("profile") or "").strip()
+    if not recorded_identity or not recorded_profile:
+        reasons.append("lock does not record both a claimant username and profile")
+    if recorded_identity and recorded_identity != str(identity or "").strip():
+        reasons.append(
+            f"lock claimant '{recorded_identity}' does not match active identity "
+            f"'{str(identity or '').strip() or 'unknown'}'"
+        )
+    if recorded_profile and recorded_profile != str(profile or "").strip():
+        reasons.append(
+            f"lock profile '{recorded_profile}' does not match active profile "
+            f"'{str(profile or '').strip() or 'unknown'}'"
+        )
+    return reasons
+
+
+def _refusal(reasons: list[str], **extra: Any) -> dict[str, Any]:
+    return {"success": False, "performed": False, "reasons": reasons, **extra}
+
+
+def heartbeat_session_lock(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    issue_number: int,
+    branch_name: str,
+    worktree_path: str,
+    identity: str | None,
+    profile: str | None,
+    task_session_id: str,
+    expected_generation: int | None = None,
+    lock_dir: str | None = None,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    """Slide a heartbeat-lifecycle lease forward (#790 Slice A, A4).
+
+    The write happens inside the same per-issue ``flock`` that serializes
+    acquisition, and under the #772 generation compare-and-swap, so a heartbeat
+    can never race a concurrent reclaim: whichever lands first moves the
+    generation and the other fails closed.
+
+    Refuses — never revives — in every ambiguous case. A lease that has already
+    lapsed past its grace is *not* heartbeatable: allowing that would let a
+    session that stopped proving liveness restore ownership retroactively, which
+    is precisely the revival AC-N5 forbids. Such a session must go through the
+    sanctioned reclaim path, which mints a fresh generation.
+    """
+    current = _lease_now(now)
+    root = _ensure_lock_dir(lock_dir)
+    path = lock_file_path(
+        remote=remote, org=org, repo=repo, issue_number=issue_number, lock_dir=root
+    )
+    declared_session = str(task_session_id or "").strip()
+    if not declared_session:
+        return _refusal(["no task_session_id supplied (fail closed)"])
+
+    sentinel = flock_path(path)
+    try:
+        with _exclusive_file_lock(sentinel):
+            lock = read_lock_file(path)
+            if not lock:
+                return _refusal([f"no durable lock for issue #{issue_number}"])
+
+            if is_legacy_lease(lock):
+                return _refusal(
+                    [
+                        "lock predates the heartbeat lifecycle; it must be rebound "
+                        "by its exact owner before it can be heartbeated"
+                    ],
+                    lifecycle=lease_lifecycle_version(lock),
+                    legacy_lease=True,
+                )
+
+            reasons = _ownership_refusals(
+                lock,
+                issue_number=issue_number,
+                branch_name=branch_name,
+                worktree_path=worktree_path,
+                identity=identity,
+                profile=profile,
+            )
+            recorded_session = lease_task_session_id(lock)
+            if not recorded_session:
+                reasons.append(
+                    "lock declares the heartbeat lifecycle but records no "
+                    "task_session_id (fail closed)"
+                )
+            elif recorded_session != declared_session:
+                # A superseded session holding an old identifier cannot heartbeat
+                # over the session that replaced it.
+                reasons.append(
+                    "task_session_id does not match the session recorded on the lock"
+                )
+            if reasons:
+                return _refusal(reasons)
+
+            current_generation = lock_generation(lock)
+            if (
+                expected_generation is not None
+                and current_generation != expected_generation
+            ):
+                return _refusal(
+                    [
+                        f"lock generation changed: expected {expected_generation}, "
+                        f"found {current_generation}; another session reclaimed or "
+                        "replaced this claim (fail closed)"
+                    ],
+                    lock_generation=current_generation,
+                )
+
+            freshness = assess_lock_freshness(lock, now=current)
+            if not freshness.get("live"):
+                return _refusal(
+                    [
+                        f"lease is not live ({freshness.get('status')}): "
+                        f"{freshness.get('reason')}; a lapsed lease must be "
+                        "reclaimed, not heartbeated"
+                    ],
+                    freshness=freshness,
+                )
+
+            policy = lease_policy.policy_for(lease_task_class(lock))
+            expires = current + timedelta(minutes=policy.initial_ttl_minutes)
+            record = dict(lock)
+            lease = dict(record.get("work_lease") or {})
+            prior_heartbeat = lease.get("last_heartbeat_at")
+            lease["last_heartbeat_at"] = _format_lease_timestamp(current)
+            lease["expires_at"] = _format_lease_timestamp(expires)
+            try:
+                lease["heartbeat_count"] = int(lease.get("heartbeat_count") or 0) + 1
+            except (TypeError, ValueError):
+                lease["heartbeat_count"] = 1
+            record["work_lease"] = lease
+            record["lock_generation"] = current_generation + 1
+            save_lock_file(path, record)
+    except LockContentionError as exc:
+        return _refusal([f"issue #{issue_number} lock contention: {exc} (fail closed)"])
+
+    return {
+        "success": True,
+        "performed": True,
+        "issue_number": issue_number,
+        "branch_name": branch_name,
+        "worktree_path": worktree_path,
+        "task_session_id": declared_session,
+        "lock_generation": record["lock_generation"],
+        "prior_generation": current_generation,
+        "prior_heartbeat_at": prior_heartbeat,
+        "last_heartbeat_at": lease["last_heartbeat_at"],
+        "expires_at": lease["expires_at"],
+        "heartbeat_count": lease["heartbeat_count"],
+        "lock_file_path": path,
+        "policy": lease_policy.describe(lease_task_class(record)),
+        "freshness": assess_lock_freshness(record, now=current),
+    }
+
+
+def rebind_legacy_lock(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    issue_number: int,
+    branch_name: str,
+    worktree_path: str,
+    identity: str | None,
+    profile: str | None,
+    expected_generation: int | None = None,
+    lock_dir: str | None = None,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    """Move a legacy lock into the heartbeat lifecycle (#790 AC-N8).
+
+    One of the two sanctioned exits from the preserved-expiry legacy state; the
+    other is terminal retirement, which is Slice B. Only the exact recorded
+    owner may rebind, and only while the legacy lock is still live under its
+    original absolute expiry — an already-expired legacy lease belongs to the
+    #760 renewal path or #601 reclaim, and this must not become a second, weaker
+    way to revive one.
+
+    The rebind mints a genuine task-session identifier and a genuine first
+    heartbeat. It does not fabricate history: the original creation and expiry
+    are preserved under ``legacy_origin`` for audit, and the new lifecycle's
+    absolute cap runs from the rebind, not from the legacy claim.
+    """
+    current = _lease_now(now)
+    root = _ensure_lock_dir(lock_dir)
+    path = lock_file_path(
+        remote=remote, org=org, repo=repo, issue_number=issue_number, lock_dir=root
+    )
+    sentinel = flock_path(path)
+    try:
+        with _exclusive_file_lock(sentinel):
+            lock = read_lock_file(path)
+            if not lock:
+                return _refusal([f"no durable lock for issue #{issue_number}"])
+            if not is_legacy_lease(lock):
+                return _refusal(
+                    [
+                        "lock is already on the heartbeat lifecycle; use the "
+                        "heartbeat path"
+                    ],
+                    lifecycle=lease_lifecycle_version(lock),
+                    legacy_lease=False,
+                )
+
+            reasons = _ownership_refusals(
+                lock,
+                issue_number=issue_number,
+                branch_name=branch_name,
+                worktree_path=worktree_path,
+                identity=identity,
+                profile=profile,
+            )
+            if reasons:
+                return _refusal(reasons)
+
+            current_generation = lock_generation(lock)
+            if (
+                expected_generation is not None
+                and current_generation != expected_generation
+            ):
+                return _refusal(
+                    [
+                        f"lock generation changed: expected {expected_generation}, "
+                        f"found {current_generation} (fail closed)"
+                    ],
+                    lock_generation=current_generation,
+                )
+
+            freshness = assess_lock_freshness(lock, now=current)
+            if not freshness.get("live"):
+                return _refusal(
+                    [
+                        f"legacy lease is not live ({freshness.get('status')}): "
+                        f"{freshness.get('reason')}; rebinding is not a recovery "
+                        "path for a lapsed lease"
+                    ],
+                    freshness=freshness,
+                )
+
+            policy = lease_policy.policy_for(lease_task_class(lock))
+            expires = current + timedelta(minutes=policy.initial_ttl_minutes)
+            session_id = mint_task_session_id(lease_task_class(lock))
+            record = dict(lock)
+            lease = dict(record.get("work_lease") or {})
+            legacy_origin = {
+                "created_at": lease.get("created_at"),
+                "expires_at": lease.get("expires_at"),
+                "last_heartbeat_at": lease.get("last_heartbeat_at"),
+                "lifecycle": lease_policy.LIFECYCLE_LEGACY,
+            }
+            lease["lifecycle_version"] = lease_policy.LIFECYCLE_HEARTBEAT_V1
+            lease["task_session_id"] = session_id
+            lease["created_at"] = _format_lease_timestamp(current)
+            lease["last_heartbeat_at"] = _format_lease_timestamp(current)
+            lease["expires_at"] = _format_lease_timestamp(expires)
+            lease["heartbeat_count"] = 1
+            record["work_lease"] = lease
+            record["legacy_rebind"] = {
+                "rebound_at": _format_lease_timestamp(current),
+                "task_session_id": session_id,
+                "prior_generation": current_generation,
+                "legacy_origin": legacy_origin,
+                "reason": (
+                    "legacy lock rebound into the heartbeat lifecycle by its exact "
+                    "recorded owner"
+                ),
+            }
+            record["lock_generation"] = current_generation + 1
+            save_lock_file(path, record)
+    except LockContentionError as exc:
+        return _refusal([f"issue #{issue_number} lock contention: {exc} (fail closed)"])
+
+    return {
+        "success": True,
+        "performed": True,
+        "issue_number": issue_number,
+        "task_session_id": session_id,
+        "lock_generation": record["lock_generation"],
+        "prior_generation": current_generation,
+        "lifecycle": lease_policy.LIFECYCLE_HEARTBEAT_V1,
+        "legacy_rebind": record["legacy_rebind"],
+        "expires_at": lease["expires_at"],
+        "last_heartbeat_at": lease["last_heartbeat_at"],
+        "lock_file_path": path,
+        "freshness": assess_lock_freshness(record, now=current),
+    }
+
+
 def read_session_issue_lock(lock_dir: str | None = None) -> dict[str, Any] | None:
     root = (lock_dir or default_lock_dir()).strip()
     pointer = read_lock_file(session_pointer_path(root))
@@ -340,6 +677,16 @@ def _parse_lease_timestamp(value: str | None) -> datetime | None:
         return None
 
 
+def _format_lease_timestamp(value: datetime) -> str:
+    """Serialize a lease timestamp in the durable ``...Z`` form already on disk."""
+    return (
+        value.astimezone(timezone.utc)
+        .replace(microsecond=0)
+        .isoformat()
+        .replace("+00:00", "Z")
+    )
+
+
 def lease_expires_at(lock: dict[str, Any] | None) -> datetime | None:
     if not lock:
         return None
@@ -360,26 +707,113 @@ def is_lease_live(lock: dict[str, Any] | None, *, now: datetime | None = None) -
     return assess_lock_freshness(lock, now=now)["live"]
 
 
+def lease_task_class(lock_data: dict[str, Any] | None) -> str:
+    """Policy task class for a durable lock; author work when unrecorded."""
+    lease = lock_data.get("work_lease") if isinstance(lock_data, dict) else None
+    if isinstance(lease, dict):
+        recorded = str(lease.get("operation_type") or "").strip()
+        if recorded:
+            return recorded
+    return AUTHOR_ISSUE_WORK_LEASE
+
+
+def lease_lifecycle_version(lock_data: dict[str, Any] | None) -> str:
+    """Read the durable lifecycle marker (#790 AC-N8).
+
+    The marker is the *only* discriminator between a heartbeat-lifecycle lease
+    and a legacy one. Timestamps are deliberately not consulted: a lock minted
+    before this lifecycle existed has ``last_heartbeat_at == created_at``
+    forever, and reading that equality as "recently heartbeated" would treat
+    every never-heartbeated legacy lock as fresh — the precise inversion AC-N8
+    forbids. A newly minted heartbeat lease also has the two equal, so the
+    equality carries no information in either direction.
+    """
+    lease = lock_data.get("work_lease") if isinstance(lock_data, dict) else None
+    if isinstance(lease, dict):
+        recorded = str(lease.get("lifecycle_version") or "").strip()
+        if recorded:
+            return recorded
+    return lease_policy.LIFECYCLE_LEGACY
+
+
+def is_legacy_lease(lock_data: dict[str, Any] | None) -> bool:
+    """True when a lock predates the shared heartbeat lifecycle."""
+    return lease_lifecycle_version(lock_data) != lease_policy.LIFECYCLE_HEARTBEAT_V1
+
+
+def lease_task_session_id(lock_data: dict[str, Any] | None) -> str:
+    """Recorded per-task session identifier, or empty for a legacy lock."""
+    lease = lock_data.get("work_lease") if isinstance(lock_data, dict) else None
+    if isinstance(lease, dict):
+        return str(lease.get("task_session_id") or "").strip()
+    return ""
+
+
+def mint_task_session_id(task_class: str = AUTHOR_ISSUE_WORK_LEASE) -> str:
+    """Mint an ownership key for one task (#790 AC-N1).
+
+    Deliberately contains no process identifier. The recorded PID belongs to the
+    long-lived MCP daemon, which outlives any individual task and is reused by
+    every task it serves, so PID digits cannot identify *which* task holds a
+    claim. The PID is still recorded alongside this value as evidence.
+    """
+    prefix = _sanitize_segment(str(task_class or AUTHOR_ISSUE_WORK_LEASE))
+    return f"{prefix}-{uuid.uuid4().hex[:16]}"
+
+
+def _lease_heartbeat_at(lock_data: dict[str, Any] | None) -> datetime | None:
+    lease = lock_data.get("work_lease") if isinstance(lock_data, dict) else None
+    heartbeat_at = None
+    if isinstance(lock_data, dict):
+        heartbeat_at = _parse_lease_timestamp(lock_data.get("last_heartbeat_at"))
+    if heartbeat_at is None and isinstance(lease, dict):
+        heartbeat_at = _parse_lease_timestamp(lease.get("last_heartbeat_at"))
+    return heartbeat_at
+
+
 def assess_lock_freshness(
     lock_data: dict[str, Any] | None,
     *,
     now: datetime | None = None,
 ) -> dict[str, Any]:
-    """Classify a lock as live, expired, stale, or absent."""
+    """Classify a lock as live, expired, stale, or absent.
+
+    #790 Slice A makes the heartbeat load-bearing. Before this change
+    ``last_heartbeat_at`` was parsed and then never consulted: liveness was
+    decided entirely by the absolute ``expires_at`` and by PID liveness, and
+    since the recorded PID is the long-lived MCP daemon, an abandoned author
+    task stayed "live" for the full four-hour TTL.
+
+    Two rules govern the rewrite:
+
+    * **An alive PID never establishes freshness** (AC-N2). It proves the daemon
+      is up, nothing about the task. It is recorded as evidence and no branch
+      returns ``live`` because of it.
+    * **A dead PID still corroborates staleness.** The dead-PID band is
+      unchanged and still precedes every heartbeat evaluation, so #753
+      dead-session recovery keys on exactly the classification it always did.
+
+    Legacy leases (AC-N8) keep their recorded absolute expiry and are never
+    evaluated against the short heartbeat grace, so deploying this change cannot
+    make an existing claim instantly reclaimable.
+    """
     current = _lease_now(now)
     if not lock_data:
         return {
-            "status": "absent",
+            "status": STATUS_ABSENT,
             "live": False,
             "stale": False,
             "reason": "no lock record",
         }
 
-    expires_at = lease_expires_at(lock_data)
     lease = lock_data.get("work_lease")
-    heartbeat_at = _parse_lease_timestamp(lock_data.get("last_heartbeat_at"))
-    if heartbeat_at is None and isinstance(lease, dict):
-        heartbeat_at = _parse_lease_timestamp(lease.get("last_heartbeat_at"))
+    expires_at = lease_expires_at(lock_data)
+    heartbeat_at = _lease_heartbeat_at(lock_data)
+    created_at = (
+        _parse_lease_timestamp(lease.get("created_at"))
+        if isinstance(lease, dict)
+        else None
+    )
 
     pid = lock_data.get("session_pid")
     if pid is None:
@@ -397,56 +831,103 @@ def assess_lock_freshness(
         pid_int = None
     pid_alive = is_process_alive(pid_int) if pid_int is not None else False
 
-    if expires_at and expires_at <= current:
-        return {
-            "status": "expired",
-            "live": False,
-            "stale": True,
-            "reason": f"lease expired at {expires_at.isoformat()}",
-            "pid_alive": pid_alive,
-            "pid_missing": pid_missing,
-        }
+    lifecycle = lease_lifecycle_version(lock_data)
+    legacy = lifecycle != lease_policy.LIFECYCLE_HEARTBEAT_V1
+    policy = lease_policy.policy_for(lease_task_class(lock_data))
 
-    # #860: a PID-less lock must never be considered live merely because
-    # expiration / heartbeat fields are absent. Missing PID is insufficient
-    # evidence of a live owner; treat as malformed/stale so recovery routes
-    # can evaluate corroborating pins instead of blocking on a false live flag.
-    if pid_missing:
-        return {
-            "status": "malformed",
-            "live": False,
-            "stale": True,
-            "reason": (
-                "lock has no usable session pid; cannot prove live ownership "
-                "(PID-less locks are never live by missing expiry alone)"
-            ),
-            "pid_alive": False,
-            "pid_missing": True,
-            "heartbeat_at": heartbeat_at.isoformat() if heartbeat_at else None,
-            "expires_at": expires_at.isoformat() if expires_at else None,
-        }
-
-    if pid_int is not None and not pid_alive:
-        return {
-            "status": "stale",
-            "live": False,
-            "stale": True,
-            "reason": f"owner pid {pid_int} is not alive",
-            "pid_alive": False,
-            "pid_missing": False,
-        }
-
-    return {
-        "status": "live",
-        "live": True,
-        "stale": False,
-        "reason": "lock heartbeat and lease are fresh",
+    evidence: dict[str, Any] = {
         "pid_alive": pid_alive,
-        "pid_missing": False,
+        "pid_missing": pid_missing,
+        "lifecycle": lifecycle,
+        "legacy_lease": legacy,
+        "task_session_id": lease_task_session_id(lock_data) or None,
         "heartbeat_at": heartbeat_at.isoformat() if heartbeat_at else None,
         "expires_at": expires_at.isoformat() if expires_at else None,
     }
 
+    def _result(status: str, *, live: bool, reason: str, **extra: Any) -> dict[str, Any]:
+        return {
+            "status": status,
+            "live": live,
+            "stale": not live and status != STATUS_ABSENT,
+            "reason": reason,
+            **evidence,
+            **extra,
+        }
+
+    if legacy:
+        # AC-N8: the preserved absolute expiry is the only clock for a lock
+        # written before task-session heartbeats existed.
+        if expires_at and expires_at <= current:
+            return _result(
+                STATUS_EXPIRED,
+                live=False,
+                reason=f"lease expired at {expires_at.isoformat()}",
+            )
+        if pid is not None and not pid_alive:
+            return _result(
+                STATUS_STALE, live=False, reason=f"owner pid {pid} is not alive"
+            )
+        return _result(
+            STATUS_LIVE,
+            live=True,
+            reason=(
+                "legacy lease is within its recorded absolute expiry; the "
+                "heartbeat grace does not apply retroactively"
+            ),
+            legacy_expiry_preserved=True,
+        )
+
+    # ── Heartbeat lifecycle ──
+    if pid is not None and not pid_alive:
+        # Unchanged dead-PID band: #753 recovery depends on this exact status.
+        return _result(STATUS_STALE, live=False, reason=f"owner pid {pid} is not alive")
+
+    if heartbeat_at is None:
+        # Contradictory: a heartbeat lease must carry a heartbeat. Fail closed.
+        return _result(
+            STATUS_STALE_MISSED_HEARTBEAT,
+            live=False,
+            reason=(
+                f"lease declares lifecycle '{lifecycle}' but records no "
+                "last_heartbeat_at (fail closed)"
+            ),
+        )
+
+    if policy.absolute_cap_hours and created_at is not None:
+        cap_at = created_at + timedelta(hours=policy.absolute_cap_hours)
+        if cap_at <= current:
+            return _result(
+                STATUS_STALE_ABSOLUTE_CAP,
+                live=False,
+                reason=(
+                    f"lease exceeded its {policy.absolute_cap_hours}h absolute cap "
+                    f"at {cap_at.isoformat()}; canonical re-adoption is required"
+                ),
+                absolute_cap_at=cap_at.isoformat(),
+            )
+
+    grace_at = heartbeat_at + timedelta(minutes=policy.missed_heartbeat_grace_minutes)
+    if grace_at <= current or (expires_at is not None and expires_at <= current):
+        return _result(
+            STATUS_STALE_MISSED_HEARTBEAT,
+            live=False,
+            reason=(
+                f"no valid heartbeat since {heartbeat_at.isoformat()}; the "
+                f"{policy.missed_heartbeat_grace_minutes}min grace lapsed at "
+                f"{grace_at.isoformat()}"
+            ),
+            missed_heartbeat_since=grace_at.isoformat(),
+        )
+
+    warning_at = heartbeat_at + timedelta(minutes=policy.stale_warning_minutes)
+    return _result(
+        STATUS_LIVE,
+        live=True,
+        reason="lease heartbeat is fresh within the configured grace",
+        heartbeat_warning=warning_at <= current,
+    )
+
 
 def _same_realpath(left: str | None, right: str | None) -> bool:
     if not left or not right:
@@ -483,6 +964,27 @@ def assess_expired_lock_reclaim(
             "reasons": ["lock is still live; cannot reclaim (fail closed)"],
             "freshness": freshness,
         }
+    status = str(freshness.get("status") or "")
+    if status in (STATUS_STALE_MISSED_HEARTBEAT, STATUS_STALE_ABSOLUTE_CAP):
+        # #790: under the heartbeat lifecycle the heartbeat *is* the liveness
+        # proof, so a session that stopped heartbeating past its grace has
+        # released its claim by definition. Requiring a dead PID on top of that
+        # would reinstate the original defect — the recorded PID is the shared
+        # daemon, which stays alive across every abandoned task it ever served.
+        #
+        # This band is unreachable for a legacy lease (AC-N8), so no lock
+        # written before this lifecycle can be reclaimed by this path.
+        return {
+            "reclaim_allowed": True,
+            "reasons": [
+                f"heartbeat-lifecycle lease is {status}: {freshness.get('reason')}"
+            ],
+            "freshness": freshness,
+            "prior_branch": existing_lock.get("branch_name"),
+            "prior_worktree": existing_lock.get("worktree_path"),
+            "prior_pid": existing_lock.get("session_pid") or existing_lock.get("pid"),
+            "prior_task_session_id": lease_task_session_id(existing_lock) or None,
+        }
     pid = existing_lock.get("session_pid")
     if pid is None:
         pid = existing_lock.get("pid")
@@ -557,7 +1059,28 @@ def assess_same_issue_lease_conflict(
     )
     if recovery_sanctioned and existing_issue == issue_number and existing_branch == branch_name:
         return None
-    if is_lease_expired(existing_lock, now=now):
+    expired = is_lease_expired(existing_lock, now=now)
+    # #790 review #502/#516: a heartbeat-lifecycle lease that is non-live but
+    # whose absolute expires_at is still in the future must enter the same
+    # reclaim/renewal disposition as an expired lease. This happens for
+    # stale_absolute_cap (a session that keeps heartbeating past the 8h cap has
+    # expires_at = last_heartbeat + TTL in the future) and for
+    # stale_missed_heartbeat under an independent TTL>grace policy. Keying this
+    # gate on is_lease_expired alone left assess_expired_lock_reclaim — which
+    # already permits exactly those bands — unreachable from the acquisition
+    # path, so the load-bearing heartbeat was not load-bearing for foreign
+    # reclaim: the precise abandonment scenario #790 exists to fix.
+    # assess_foreign_lock_overwrite already keys on is_lease_live; this makes the
+    # same-issue path consistent with it. Legacy leases keep their absolute-expiry
+    # clock (AC-N8): is_lease_live already decides a legacy lease from expires_at
+    # / dead-PID alone and is_legacy_lease excludes it here, so this widening is a
+    # no-op for every pre-lifecycle lock.
+    heartbeat_non_live_reclaimable = (
+        not expired
+        and not is_legacy_lease(existing_lock)
+        and not is_lease_live(existing_lock, now=now)
+    )
+    if expired or heartbeat_non_live_reclaimable:
         # #760 AC1/AC2: exact-owner renewal is a different disposition from
         # foreign takeover and is evaluated first. Before this, both branches
         # below returned unconditionally, so the same_owner allowance further
@@ -571,10 +1094,12 @@ def assess_same_issue_lease_conflict(
         reclaim = assess_expired_lock_reclaim(existing_lock, now=now)
         if reclaim.get("reclaim_allowed"):
             # #601: expired + dead pid / missing worktree may be reclaimed
-            # through the normal lock path (sanctioned overwrite).
+            # through the normal lock path (sanctioned overwrite). #790: the new
+            # stale heartbeat bands are reclaimable here on the same evidence.
             return None
+        descriptor = "expired" if expired else "non-live"
         return (
-            f"Issue #{issue_number} has an expired {operation_type} lease on "
+            f"Issue #{issue_number} has an {descriptor} {operation_type} lease on "
             f"branch '{existing_branch}' from worktree '{existing_worktree}'. "
             "Recovery review is required before takeover (fail closed)"
         )

issue_lock_worktree.py

@@ -150,14 +150,23 @@ def read_merge_sync_provenance(
     *,
     prior_head_sha: str | None,
     synced_head_sha: str | None,
-    remote: str | None = None,
 ) -> dict:
-    """Observe whether ``synced_head_sha`` is a sanctioned merge-sync of a base
-    into the branch above ``prior_head_sha`` (#871/#872).
+    """Observe whether ``synced_head_sha`` is a sanctioned merge-based branch sync
+    that advanced the PR branch past ``prior_head_sha`` (#871).
 
-    Reports server-derived git facts only; the recovery disposition lives in
-    ``issue_lock_recovery``. All comparisons are executed locally in the
-    declared worktree -- nothing is taken from caller parameters.
+    ``gitea_update_pr_branch_by_merge`` advances a PR branch by merging the base
+    branch *into* the branch (``POST /pulls/{n}/update?style=merge``). The result
+    is a merge commit ``M`` on the branch whose **first** parent is the prior
+    branch head and whose second parent is the base tip. When the owning session
+    then dies without the durable lock's recorded head being refreshed, the local
+    worktree still sits at ``prior_head_sha`` while the live PR head is ``M``.
+
+    Recovering that drift safely requires proving the remote head is *exactly*
+    such a merge-sync — not a rewrite, rebase, force-push, or an unrelated
+    commit. This is that server-side observation. It reports facts only; the
+    disposition lives in ``issue_lock_recovery``. Every field is read from git in
+    the declared worktree — nothing is supplied by, or reachable from, an MCP
+    caller (#871).
 
     Provenance is proven only when ALL hold:
 
@@ -174,7 +183,6 @@ def read_merge_sync_provenance(
     path = (worktree_path or "").strip()
     prior = (prior_head_sha or "").strip()
     synced = (synced_head_sha or "").strip()
-    target_remote = (remote or "").strip() or None
     result: dict = {
         "prior_head_sha": prior or None,
         "synced_head_sha": synced or None,
@@ -227,23 +235,6 @@ def read_merge_sync_provenance(
     try:
         result["prior_present"] = _present(prior)
         result["synced_present"] = _present(synced)
-        if not result["synced_present"] and path and os.path.isdir(path):
-            if target_remote:
-                subprocess.run(
-                    ["git", "-C", path, "fetch", target_remote, "--quiet"],
-                    capture_output=True,
-                    text=True,
-                    check=False,
-                )
-                result["synced_present"] = _present(synced)
-            if not result["synced_present"]:
-                subprocess.run(
-                    ["git", "-C", path, "fetch", "--quiet"],
-                    capture_output=True,
-                    text=True,
-                    check=False,
-                )
-                result["synced_present"] = _present(synced)
     except OSError as exc:  # git unavailable — fail closed, never assume
         result["reasons"].append(f"merge-sync provenance probe could not run: {exc}")
         return result

lease_policy.py

@@ -0,0 +1,212 @@
+"""Central lease policy configuration (#790 Slice A, AC-N7).
+
+The single authoritative source for every lease duration in the project. Before
+this module the numbers were scattered: a four-hour author TTL was declared
+twice (``issue_lock_store`` and ``gitea_mcp_server``), the reviewer/merger
+sliding window lived in ``reviewer_pr_lease``, the conflict-fix window in
+``pr_work_lease``, and the control-plane default in ``control_plane_db``.
+Nothing tied them together, so tuning one class silently diverged from the
+others and no reader could answer "how long does a lease live?" without
+grepping four files.
+
+AC-N7 requires that this configuration exist *before* the first heartbeat and
+TTL behavior that reads from it, so it ships in Slice A rather than trailing the
+code it governs.
+
+Deliberate boundaries:
+
+* **Declaration is not rewiring.** Every task class is declared here, but only
+  those with ``heartbeat_lifecycle_active`` were migrated onto the shared
+  heartbeat lifecycle in Slice A — currently ``author_issue_work`` alone.
+  Reviewer, merger, and conflict-fix leases keep their own existing behavior
+  until Slice C moves them; their numbers are recorded here so the two cannot
+  drift apart unnoticed, and ``tests/test_issue_790_lease_policy.py`` asserts
+  the recorded values still equal the constants those modules use.
+* **No policy decision lives here.** This module answers "how long", never "may
+  this session proceed". Freshness, reclaim, and renewal dispositions stay in
+  ``issue_lock_store``.
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from typing import Any
+
+# Task classes. Only the first is migrated onto the shared lifecycle in Slice A.
+TASK_CLASS_AUTHOR_ISSUE_WORK = "author_issue_work"
+TASK_CLASS_REVIEWER_PR = "reviewer_pr"
+TASK_CLASS_MERGER_PR = "merger_pr"
+TASK_CLASS_CONFLICT_FIX = "conflict_fix"
+
+# Durable marker for a lease minted under the shared heartbeat lifecycle.
+#
+# #790 AC-N8: this explicit marker — never a timestamp comparison — is what
+# distinguishes a heartbeat-lifecycle lease from a legacy one. A lock written
+# before this lifecycle existed carries no marker and reads as
+# ``LIFECYCLE_LEGACY``.
+LIFECYCLE_HEARTBEAT_V1 = "heartbeat-v1"
+LIFECYCLE_LEGACY = "legacy"
+
+_ENV_PREFIX = "GITEA_LEASE_POLICY"
+
+
+@dataclass(frozen=True)
+class LeasePolicy:
+    """Durations governing one task class.
+
+    All intervals are minutes except ``absolute_cap_hours``. ``None`` for the
+    cap means the class has no maximum continuous duration.
+    """
+
+    task_class: str
+    initial_ttl_minutes: float
+    heartbeat_cadence_minutes: float
+    stale_warning_minutes: float
+    missed_heartbeat_grace_minutes: float
+    absolute_cap_hours: float | None
+    recovery_grace_minutes: float
+    terminal_race_drain_minutes: float
+    terminal_retirement_eligible: bool
+    heartbeat_lifecycle_active: bool
+
+
+# Defaults. ``author_issue_work`` adopts the reviewer window proven by #747
+# rather than inventing new numbers: a lease expires 10 minutes after its last
+# valid heartbeat, warns at half that, and an actively heartbeating session is
+# never evicted. The prior value was a fixed four hours (240 minutes) that no
+# heartbeat could shorten — the defect this issue exists to correct.
+_DEFAULTS: dict[str, LeasePolicy] = {
+    TASK_CLASS_AUTHOR_ISSUE_WORK: LeasePolicy(
+        task_class=TASK_CLASS_AUTHOR_ISSUE_WORK,
+        initial_ttl_minutes=10.0,
+        heartbeat_cadence_minutes=2.0,
+        stale_warning_minutes=5.0,
+        missed_heartbeat_grace_minutes=10.0,
+        absolute_cap_hours=8.0,
+        recovery_grace_minutes=10.0,
+        terminal_race_drain_minutes=2.0,
+        terminal_retirement_eligible=True,
+        heartbeat_lifecycle_active=True,
+    ),
+    # Declared, not rewired. These mirror reviewer_pr_lease.LEASE_TTL_MINUTES
+    # and STALE_WARNING_MINUTES; Slice C migrates the call sites.
+    TASK_CLASS_REVIEWER_PR: LeasePolicy(
+        task_class=TASK_CLASS_REVIEWER_PR,
+        initial_ttl_minutes=10.0,
+        heartbeat_cadence_minutes=2.0,
+        stale_warning_minutes=5.0,
+        missed_heartbeat_grace_minutes=10.0,
+        absolute_cap_hours=None,
+        recovery_grace_minutes=10.0,
+        terminal_race_drain_minutes=2.0,
+        terminal_retirement_eligible=False,
+        heartbeat_lifecycle_active=False,
+    ),
+    TASK_CLASS_MERGER_PR: LeasePolicy(
+        task_class=TASK_CLASS_MERGER_PR,
+        initial_ttl_minutes=10.0,
+        heartbeat_cadence_minutes=2.0,
+        stale_warning_minutes=5.0,
+        missed_heartbeat_grace_minutes=10.0,
+        absolute_cap_hours=None,
+        recovery_grace_minutes=10.0,
+        terminal_race_drain_minutes=2.0,
+        terminal_retirement_eligible=False,
+        heartbeat_lifecycle_active=False,
+    ),
+    # Mirrors pr_work_lease.DEFAULT_CONFLICT_FIX_TTL_MINUTES. Deliberately left
+    # at its current window; shortening it is Slice C's call, not this slice's.
+    TASK_CLASS_CONFLICT_FIX: LeasePolicy(
+        task_class=TASK_CLASS_CONFLICT_FIX,
+        initial_ttl_minutes=120.0,
+        heartbeat_cadence_minutes=2.0,
+        stale_warning_minutes=5.0,
+        missed_heartbeat_grace_minutes=10.0,
+        absolute_cap_hours=None,
+        recovery_grace_minutes=10.0,
+        terminal_race_drain_minutes=2.0,
+        terminal_retirement_eligible=False,
+        heartbeat_lifecycle_active=False,
+    ),
+}
+
+_NUMERIC_FIELDS = (
+    "initial_ttl_minutes",
+    "heartbeat_cadence_minutes",
+    "stale_warning_minutes",
+    "missed_heartbeat_grace_minutes",
+    "absolute_cap_hours",
+    "recovery_grace_minutes",
+    "terminal_race_drain_minutes",
+)
+
+
+def env_var_name(task_class: str, field: str) -> str:
+    """Environment variable that overrides one field of one task class."""
+    return f"{_ENV_PREFIX}_{task_class.upper()}_{field.upper()}"
+
+
+def _override(task_class: str, field: str, default: float | None) -> float | None:
+    """Read one override, falling back to *default* on anything unusable.
+
+    A malformed or non-positive override is ignored rather than raised: a typo
+    in an environment variable must not be able to mint a zero-length lease that
+    makes every claim instantly reclaimable, nor crash the server at import.
+    """
+    raw = (os.environ.get(env_var_name(task_class, field)) or "").strip()
+    if not raw:
+        return default
+    try:
+        value = float(raw)
+    except (TypeError, ValueError):
+        return default
+    if value <= 0:
+        return default
+    return value
+
+
+def policy_for(task_class: str) -> LeasePolicy:
+    """Return the effective policy for *task_class*.
+
+    Unknown task classes fall back to the author policy, which is the most
+    conservative migrated class, rather than raising — a new caller must never
+    be able to crash a lock write by naming a class this table has not learned.
+    """
+    key = str(task_class or "").strip() or TASK_CLASS_AUTHOR_ISSUE_WORK
+    base = _DEFAULTS.get(key) or _DEFAULTS[TASK_CLASS_AUTHOR_ISSUE_WORK]
+    resolved = {
+        field: _override(base.task_class, field, getattr(base, field))
+        for field in _NUMERIC_FIELDS
+    }
+    if all(resolved[field] == getattr(base, field) for field in _NUMERIC_FIELDS):
+        return base
+    return LeasePolicy(
+        task_class=base.task_class,
+        terminal_retirement_eligible=base.terminal_retirement_eligible,
+        heartbeat_lifecycle_active=base.heartbeat_lifecycle_active,
+        **resolved,
+    )
+
+
+def known_task_classes() -> tuple[str, ...]:
+    """Every declared task class, migrated or not."""
+    return tuple(_DEFAULTS)
+
+
+def describe(task_class: str) -> dict[str, Any]:
+    """Serializable view of a policy, for audit records and tool payloads."""
+    policy = policy_for(task_class)
+    return {
+        "task_class": policy.task_class,
+        "initial_ttl_minutes": policy.initial_ttl_minutes,
+        "heartbeat_cadence_minutes": policy.heartbeat_cadence_minutes,
+        "stale_warning_minutes": policy.stale_warning_minutes,
+        "missed_heartbeat_grace_minutes": policy.missed_heartbeat_grace_minutes,
+        "absolute_cap_hours": policy.absolute_cap_hours,
+        "recovery_grace_minutes": policy.recovery_grace_minutes,
+        "terminal_race_drain_minutes": policy.terminal_race_drain_minutes,
+        "terminal_retirement_eligible": policy.terminal_retirement_eligible,
+        "heartbeat_lifecycle_active": policy.heartbeat_lifecycle_active,
+        "lifecycle_version": LIFECYCLE_HEARTBEAT_V1,
+    }

post_restart_reconcile.py

@@ -0,0 +1,791 @@
+"""Post-restart MCP reconciliation and completion proof (#662).
+
+After an MCP process restart, sessions, leases, capabilities, worktrees, and
+interrupted mutations are not systematically reconciled; operators rebuild
+context from chat. This module is the pure classification core of the
+post-restart reconcile path.
+
+Design rules (mirrors ``restart_coordinator`` / ``workflow_dashboard``):
+
+* **Pure classification.** :func:`reconcile_after_restart` takes an already
+  gathered inventory and returns a structured *completion proof*. It never
+  touches the network, the filesystem, or a live process, so multi-session
+  fixtures can drive every branch in unit tests.
+* **Fail closed.** Incomplete inventory never reports overall ``complete``.
+  Ambiguous interrupted mutations are ``unresolved`` (never silently resumed).
+* **No blind write resume.** The proof never authorizes replaying a mutation;
+  it only classifies evidence and names follow-up work.
+* **#660 soft dependency.** When durable session checkpoints are not present
+  in the inventory, the checkpoint dimension is ``skipped`` with an explicit
+  reason rather than inventing a schema (#660 lands separately).
+* **Log-only then enforce.** Default mode is ``log_only``. ``enforce`` sets
+  ``mutation_hold`` when anything remains unresolved so callers can block
+  write ops until reconcile is complete or degraded mode is documented.
+
+The single sanctioned gather+classify entry point is the MCP tool
+``gitea_reconcile_after_restart`` (read-only inventory gather + pure classify).
+Creating durable follow-up Gitea issues from unresolved items is an explicit
+apply step outside this pure module.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Any, Mapping, Sequence
+from uuid import uuid4
+
+import lease_lifecycle
+
+RECONCILE_VERSION = "1.0.0-issue-662"
+SCHEMA_VERSION = 1
+
+# Overall proof statuses.
+STATUS_COMPLETE = "complete"
+STATUS_DEGRADED = "degraded"
+STATUS_FAILED = "failed"
+
+# Per-dimension item statuses.
+ITEM_RESOLVED = "resolved"
+ITEM_UNRESOLVED = "unresolved"
+ITEM_DEGRADED = "degraded"
+ITEM_SKIPPED = "skipped"
+
+# Modes.
+MODE_LOG_ONLY = "log_only"
+MODE_ENFORCE = "enforce"
+
+# Lease / session phases that imply a write critical section was in flight.
+MUTATING_PHASES = frozenset(
+    {
+        "implementing",
+        "publishing",
+        "merging",
+        "reviewing",
+        "committing",
+        "pushing",
+        "closing",
+        "mutating",
+        "critical_section",
+    }
+)
+
+# Dimensions the acceptance criteria require.
+DIM_SERVICE_HEALTH = "service_health"
+DIM_CLIENTS = "clients"
+DIM_SESSIONS = "sessions"
+DIM_CHECKPOINTS = "checkpoints"
+DIM_LEASES = "leases"
+DIM_CAPABILITIES = "capabilities"
+DIM_WORKTREES = "worktrees"
+DIM_MUTATIONS = "interrupted_mutations"
+DIM_DUPLICATES = "duplicates"
+DIM_QUEUE = "queue"
+
+
+def _utc_now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _ts(dt: datetime) -> str:
+    return dt.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+@dataclass(frozen=True)
+class ReconcileItem:
+    """One dimension of the post-restart reconcile report."""
+
+    dimension: str
+    status: str
+    summary: str
+    details: dict[str, Any] = field(default_factory=dict)
+    follow_up_required: bool = False
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "dimension": self.dimension,
+            "status": self.status,
+            "summary": self.summary,
+            "details": dict(self.details),
+            "follow_up_required": self.follow_up_required,
+        }
+
+
+@dataclass(frozen=True)
+class FollowUpIssue:
+    """A durable follow-up issue the apply path may create for unresolved work."""
+
+    title: str
+    body: str
+    dimension: str
+    severity: str = "high"
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "title": self.title,
+            "body": self.body,
+            "dimension": self.dimension,
+            "severity": self.severity,
+        }
+
+
+@dataclass(frozen=True)
+class RestartCompletionProof:
+    """Machine-readable post-restart completion proof (#662 AC2)."""
+
+    schema_version: int
+    reconcile_version: str
+    reconcile_id: str
+    started_at: str
+    finished_at: str
+    boot_head_sha: str | None
+    current_head_sha: str | None
+    inventory_complete: bool
+    incomplete_reasons: tuple[str, ...]
+    mode: str
+    mutation_hold: bool
+    overall_status: str
+    items: tuple[ReconcileItem, ...]
+    proposed_follow_ups: tuple[FollowUpIssue, ...]
+    resolved_count: int
+    unresolved_count: int
+    skipped_count: int
+    note: str
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "reconcile_version": self.reconcile_version,
+            "reconcile_id": self.reconcile_id,
+            "started_at": self.started_at,
+            "finished_at": self.finished_at,
+            "boot_head_sha": self.boot_head_sha,
+            "current_head_sha": self.current_head_sha,
+            "inventory_complete": self.inventory_complete,
+            "incomplete_reasons": list(self.incomplete_reasons),
+            "mode": self.mode,
+            "mutation_hold": self.mutation_hold,
+            "overall_status": self.overall_status,
+            "items": [i.as_dict() for i in self.items],
+            "proposed_follow_ups": [f.as_dict() for f in self.proposed_follow_ups],
+            "resolved_count": self.resolved_count,
+            "unresolved_count": self.unresolved_count,
+            "skipped_count": self.skipped_count,
+            "note": self.note,
+            "links": {
+                "umbrella": 655,
+                "vision": 652,
+                "roadmap": 653,
+                "issue": 662,
+                "checkpoint_schema": 660,
+                "drain_proof": 661,
+            },
+        }
+
+
+def _item(
+    dimension: str,
+    status: str,
+    summary: str,
+    *,
+    details: dict[str, Any] | None = None,
+    follow_up: bool = False,
+) -> ReconcileItem:
+    return ReconcileItem(
+        dimension=dimension,
+        status=status,
+        summary=summary,
+        details=dict(details or {}),
+        follow_up_required=follow_up,
+    )
+
+
+def _lease_freshness(lease: Mapping[str, Any]) -> str:
+    fr = lease.get("freshness")
+    if isinstance(fr, Mapping):
+        return str(fr.get("freshness") or fr.get("status") or "unknown")
+    if isinstance(fr, str):
+        return fr
+    # Fall back to pure classifier when raw lease rows are supplied.
+    try:
+        return str(lease_lifecycle.classify_lease_freshness(dict(lease)).get("freshness") or "unknown")
+    except Exception:  # noqa: BLE001 - pure path must not raise on bad rows
+        return "unknown"
+
+
+def _is_live_freshness(freshness: str) -> bool:
+    return freshness in {"active", "live", "fresh"}
+
+
+def _is_mutating_phase(phase: str | None) -> bool:
+    p = (phase or "").strip().lower()
+    if not p:
+        return False
+    if p in MUTATING_PHASES:
+        return True
+    # Soft match for compound phases like "author_implementing".
+    return any(token in p for token in MUTATING_PHASES)
+
+
+def _detect_interrupted_mutations(
+    leases: Sequence[Mapping[str, Any]],
+    pending_mutations: Sequence[Mapping[str, Any]],
+) -> list[dict[str, Any]]:
+    """Return interrupted-mutation evidence (never auto-resumes writes)."""
+    found: list[dict[str, Any]] = []
+
+    for raw in pending_mutations or ():
+        if not isinstance(raw, Mapping):
+            continue
+        found.append(
+            {
+                "source": "pending_mutation_inventory",
+                "status": "unresolved",
+                "phase": raw.get("phase"),
+                "session_id": raw.get("session_id"),
+                "work_kind": raw.get("work_kind") or raw.get("kind"),
+                "work_number": raw.get("work_number") or raw.get("number"),
+                "reason": raw.get("reason")
+                or "pending mutation recorded across process restart",
+                "resume_allowed": False,
+            }
+        )
+
+    for lease in leases or ():
+        if not isinstance(lease, Mapping):
+            continue
+        phase = lease.get("phase")
+        freshness = _lease_freshness(lease)
+        if not _is_mutating_phase(str(phase) if phase is not None else None):
+            continue
+        # A mutating phase whose owner is not live is interrupted.
+        if _is_live_freshness(freshness):
+            # Still live after restart is itself surprising — flag for review.
+            found.append(
+                {
+                    "source": "lease_mutating_phase",
+                    "status": "unresolved",
+                    "phase": phase,
+                    "freshness": freshness,
+                    "lease_id": lease.get("lease_id"),
+                    "session_id": lease.get("session_id"),
+                    "work_kind": lease.get("work_kind"),
+                    "work_number": lease.get("work_number"),
+                    "worktree_path": lease.get("worktree_path"),
+                    "reason": (
+                        "mutating lease phase still classified live after restart; "
+                        "do not auto-resume writes"
+                    ),
+                    "resume_allowed": False,
+                }
+            )
+        else:
+            found.append(
+                {
+                    "source": "lease_mutating_phase",
+                    "status": "unresolved",
+                    "phase": phase,
+                    "freshness": freshness,
+                    "lease_id": lease.get("lease_id"),
+                    "session_id": lease.get("session_id"),
+                    "work_kind": lease.get("work_kind"),
+                    "work_number": lease.get("work_number"),
+                    "worktree_path": lease.get("worktree_path"),
+                    "reason": (
+                        f"mutating lease phase '{phase}' with non-live freshness "
+                        f"'{freshness}' — interrupted by restart"
+                    ),
+                    "resume_allowed": False,
+                }
+            )
+    return found
+
+
+def _detect_duplicate_work(
+    leases: Sequence[Mapping[str, Any]],
+) -> list[dict[str, Any]]:
+    """Surface duplicate live claims on the same work item."""
+    by_work: dict[tuple[Any, Any], list[Mapping[str, Any]]] = {}
+    for lease in leases or ():
+        if not isinstance(lease, Mapping):
+            continue
+        if not _is_live_freshness(_lease_freshness(lease)):
+            continue
+        key = (lease.get("work_kind"), lease.get("work_number"))
+        if key[0] is None or key[1] is None:
+            continue
+        by_work.setdefault(key, []).append(lease)
+
+    dups: list[dict[str, Any]] = []
+    for (kind, number), rows in sorted(by_work.items(), key=lambda kv: str(kv[0])):
+        if len(rows) < 2:
+            continue
+        dups.append(
+            {
+                "work_kind": kind,
+                "work_number": number,
+                "claim_count": len(rows),
+                "session_ids": [r.get("session_id") for r in rows],
+                "lease_ids": [r.get("lease_id") for r in rows],
+            }
+        )
+    return dups
+
+
+def _follow_up_for_item(item: ReconcileItem) -> FollowUpIssue | None:
+    if not item.follow_up_required:
+        return None
+    title = f"[post-restart] unresolved {item.dimension} after MCP restart"
+    body = (
+        f"## Post-restart reconcile follow-up (#662)\n\n"
+        f"**Dimension:** `{item.dimension}`\n"
+        f"**Status:** `{item.status}`\n"
+        f"**Summary:** {item.summary}\n\n"
+        f"```json\n{item.details!r}\n```\n\n"
+        f"Parent umbrella: #655 · Vision: #652 · Roadmap: #653 · Reconcile: #662\n"
+        f"Do **not** auto-resume write mutations; reconcile evidence first.\n"
+    )
+    return FollowUpIssue(
+        title=title,
+        body=body,
+        dimension=item.dimension,
+        severity="high" if item.dimension == DIM_MUTATIONS else "medium",
+    )
+
+
+def reconcile_after_restart(
+    inventory: Mapping[str, Any],
+    *,
+    now: datetime | None = None,
+    mode: str = MODE_LOG_ONLY,
+    reconcile_id: str | None = None,
+) -> RestartCompletionProof:
+    """Classify a post-restart inventory into a completion proof (#662).
+
+    Parameters
+    ----------
+    inventory:
+        Gathered facts. Expected keys (all optional except completeness):
+
+        * ``inventory_complete`` (bool) — fail closed when false
+        * ``incomplete_reasons`` (list[str])
+        * ``service_health`` (dict with ``healthy`` bool)
+        * ``clients`` (list) — connected client descriptors
+        * ``sessions`` (list)
+        * ``leases`` (list, optionally with ``freshness``)
+        * ``checkpoints`` (list | None) — durable session checkpoints (#660)
+        * ``checkpoints_available`` (bool) — False when #660 schema absent
+        * ``worktree_bindings`` (list)
+        * ``pending_mutations`` (list) — explicit interrupted-mutation evidence
+        * ``capabilities`` (dict with optional ``stale`` / heads)
+        * ``boot_head_sha`` / ``current_head_sha``
+        * ``queue_state`` (dict)
+    mode:
+        ``log_only`` (default) or ``enforce`` (sets mutation_hold on unresolved).
+    """
+    started = now or _utc_now()
+    mode_norm = (mode or MODE_LOG_ONLY).strip().lower()
+    if mode_norm not in {MODE_LOG_ONLY, MODE_ENFORCE}:
+        mode_norm = MODE_LOG_ONLY
+
+    inventory_complete = bool(inventory.get("inventory_complete", False))
+    incomplete_reasons = tuple(
+        str(r) for r in (inventory.get("incomplete_reasons") or []) if str(r).strip()
+    )
+
+    items: list[ReconcileItem] = []
+
+    # --- service health -------------------------------------------------
+    health = inventory.get("service_health") or {}
+    if not isinstance(health, Mapping):
+        health = {}
+    if not inventory_complete and "service_health" not in inventory:
+        items.append(
+            _item(
+                DIM_SERVICE_HEALTH,
+                ITEM_UNRESOLVED,
+                "service health unknown because inventory is incomplete",
+                details={"inventory_complete": False},
+                follow_up=True,
+            )
+        )
+    elif health.get("healthy") is True:
+        items.append(
+            _item(
+                DIM_SERVICE_HEALTH,
+                ITEM_RESOLVED,
+                "service health verified",
+                details=dict(health),
+            )
+        )
+    elif health.get("healthy") is False:
+        items.append(
+            _item(
+                DIM_SERVICE_HEALTH,
+                ITEM_UNRESOLVED,
+                "service health check failed",
+                details=dict(health),
+                follow_up=True,
+            )
+        )
+    else:
+        items.append(
+            _item(
+                DIM_SERVICE_HEALTH,
+                ITEM_DEGRADED,
+                "service health not reported; treating as degraded",
+                details=dict(health),
+                follow_up=True,
+            )
+        )
+
+    # --- clients --------------------------------------------------------
+    clients = list(inventory.get("clients") or [])
+    disconnected = [
+        c
+        for c in clients
+        if isinstance(c, Mapping) and c.get("connected") is False
+    ]
+    if "clients" not in inventory:
+        items.append(
+            _item(
+                DIM_CLIENTS,
+                ITEM_SKIPPED,
+                "client inventory not supplied",
+                details={},
+            )
+        )
+    elif disconnected:
+        items.append(
+            _item(
+                DIM_CLIENTS,
+                ITEM_UNRESOLVED,
+                f"{len(disconnected)} disconnected client(s) need reconnect",
+                details={"disconnected": disconnected, "total": len(clients)},
+                follow_up=True,
+            )
+        )
+    else:
+        items.append(
+            _item(
+                DIM_CLIENTS,
+                ITEM_RESOLVED,
+                f"{len(clients)} client(s) accounted for",
+                details={"total": len(clients)},
+            )
+        )
+
+    # --- sessions -------------------------------------------------------
+    sessions = [s for s in (inventory.get("sessions") or []) if isinstance(s, Mapping)]
+    orphan_sessions = [
+        s
+        for s in sessions
+        if str(s.get("status") or "").lower() == "active"
+        and s.get("pid") is not None
+        and not lease_lifecycle.is_process_alive(s.get("pid"))
+    ]
+    if orphan_sessions:
+        items.append(
+            _item(
+                DIM_SESSIONS,
+                ITEM_UNRESOLVED,
+                f"{len(orphan_sessions)} active session row(s) with dead owner pid",
+                details={
+                    "orphan_session_ids": [s.get("session_id") for s in orphan_sessions],
+                    "total_sessions": len(sessions),
+                },
+                follow_up=True,
+            )
+        )
+    else:
+        items.append(
+            _item(
+                DIM_SESSIONS,
+                ITEM_RESOLVED,
+                f"{len(sessions)} session row(s) reconciled (no dead-pid orphans)",
+                details={"total_sessions": len(sessions)},
+            )
+        )
+
+    # --- checkpoints (#660 soft) ----------------------------------------
+    checkpoints_available = inventory.get("checkpoints_available")
+    checkpoints = inventory.get("checkpoints")
+    if checkpoints_available is False or (
+        checkpoints is None and "checkpoints" not in inventory
+    ):
+        items.append(
+            _item(
+                DIM_CHECKPOINTS,
+                ITEM_SKIPPED,
+                "durable session checkpoint schema not available yet (#660)",
+                details={"depends_on": 660},
+            )
+        )
+    else:
+        cp_list = [c for c in (checkpoints or []) if isinstance(c, Mapping)]
+        stale_cp = [c for c in cp_list if c.get("stale") or c.get("invalid")]
+        if stale_cp:
+            items.append(
+                _item(
+                    DIM_CHECKPOINTS,
+                    ITEM_UNRESOLVED,
+                    f"{len(stale_cp)} checkpoint(s) invalid or stale vs live state",
+                    details={"stale_count": len(stale_cp), "total": len(cp_list)},
+                    follow_up=True,
+                )
+            )
+        else:
+            items.append(
+                _item(
+                    DIM_CHECKPOINTS,
+                    ITEM_RESOLVED,
+                    f"{len(cp_list)} checkpoint(s) consistent with live state",
+                    details={"total": len(cp_list)},
+                )
+            )
+
+    # --- leases / locks -------------------------------------------------
+    leases = [L for L in (inventory.get("leases") or []) if isinstance(L, Mapping)]
+    live_leases = [L for L in leases if _is_live_freshness(_lease_freshness(L))]
+    items.append(
+        _item(
+            DIM_LEASES,
+            ITEM_RESOLVED if inventory_complete else ITEM_DEGRADED,
+            f"{len(live_leases)} live lease(s) of {len(leases)} inventoried",
+            details={
+                "live_count": len(live_leases),
+                "total": len(leases),
+                "live_lease_ids": [L.get("lease_id") for L in live_leases],
+            },
+            follow_up=not inventory_complete,
+        )
+    )
+
+    # --- capabilities / stale runtime -----------------------------------
+    caps = inventory.get("capabilities") or {}
+    if not isinstance(caps, Mapping):
+        caps = {}
+    if caps.get("stale") is True:
+        items.append(
+            _item(
+                DIM_CAPABILITIES,
+                ITEM_UNRESOLVED,
+                "runtime code is stale vs on-disk master; restart did not reach parity",
+                details=dict(caps),
+                follow_up=True,
+            )
+        )
+    else:
+        items.append(
+            _item(
+                DIM_CAPABILITIES,
+                ITEM_RESOLVED,
+                "capability/runtime parity acceptable",
+                details=dict(caps) if caps else {"stale": False},
+            )
+        )
+
+    # --- worktrees ------------------------------------------------------
+    bindings = [
+        b for b in (inventory.get("worktree_bindings") or []) if isinstance(b, Mapping)
+    ]
+    missing_wt = [
+        b
+        for b in bindings
+        if b.get("missing") is True or b.get("exists") is False
+    ]
+    if "worktree_bindings" not in inventory:
+        items.append(
+            _item(
+                DIM_WORKTREES,
+                ITEM_SKIPPED,
+                "worktree binding inventory not supplied",
+            )
+        )
+    elif missing_wt:
+        items.append(
+            _item(
+                DIM_WORKTREES,
+                ITEM_UNRESOLVED,
+                f"{len(missing_wt)} worktree binding(s) missing on disk",
+                details={"missing": missing_wt, "total": len(bindings)},
+                follow_up=True,
+            )
+        )
+    else:
+        items.append(
+            _item(
+                DIM_WORKTREES,
+                ITEM_RESOLVED,
+                f"{len(bindings)} worktree binding(s) present",
+                details={"total": len(bindings)},
+            )
+        )
+
+    # --- interrupted mutations (AC4) ------------------------------------
+    pending = [
+        m
+        for m in (inventory.get("pending_mutations") or [])
+        if isinstance(m, Mapping)
+    ]
+    interrupted = _detect_interrupted_mutations(leases, pending)
+    if interrupted:
+        items.append(
+            _item(
+                DIM_MUTATIONS,
+                ITEM_UNRESOLVED,
+                f"{len(interrupted)} interrupted mutation(s); write resume forbidden",
+                details={"interrupted": interrupted},
+                follow_up=True,
+            )
+        )
+    else:
+        items.append(
+            _item(
+                DIM_MUTATIONS,
+                ITEM_RESOLVED,
+                "no interrupted mutations detected",
+                details={"interrupted": []},
+            )
+        )
+
+    # --- duplicates -----------------------------------------------------
+    dups = _detect_duplicate_work(leases)
+    if dups:
+        items.append(
+            _item(
+                DIM_DUPLICATES,
+                ITEM_UNRESOLVED,
+                f"{len(dups)} work item(s) have multiple live claims",
+                details={"duplicates": dups},
+                follow_up=True,
+            )
+        )
+    else:
+        items.append(
+            _item(
+                DIM_DUPLICATES,
+                ITEM_RESOLVED,
+                "no duplicate live claims detected",
+                details={"duplicates": []},
+            )
+        )
+
+    # --- queue ----------------------------------------------------------
+    queue = inventory.get("queue_state")
+    if queue is None:
+        items.append(
+            _item(
+                DIM_QUEUE,
+                ITEM_SKIPPED,
+                "allocator queue state not supplied",
+            )
+        )
+    elif isinstance(queue, Mapping) and queue.get("safe_to_resume") is False:
+        items.append(
+            _item(
+                DIM_QUEUE,
+                ITEM_UNRESOLVED,
+                "allocator queue not safe to resume",
+                details=dict(queue),
+                follow_up=True,
+            )
+        )
+    else:
+        items.append(
+            _item(
+                DIM_QUEUE,
+                ITEM_RESOLVED,
+                "allocator queue state acceptable",
+                details=dict(queue) if isinstance(queue, Mapping) else {},
+            )
+        )
+
+    # Incomplete inventory always degrades the whole proof.
+    if not inventory_complete:
+        # Ensure at least one follow-up names the incomplete inventory.
+        items.append(
+            _item(
+                "inventory",
+                ITEM_UNRESOLVED,
+                "control-plane inventory incomplete; reconcile cannot claim success",
+                details={"reasons": list(incomplete_reasons)},
+                follow_up=True,
+            )
+        )
+
+    resolved = sum(1 for i in items if i.status == ITEM_RESOLVED)
+    unresolved = sum(1 for i in items if i.status in {ITEM_UNRESOLVED, ITEM_DEGRADED})
+    skipped = sum(1 for i in items if i.status == ITEM_SKIPPED)
+
+    if not inventory_complete or any(i.status == ITEM_UNRESOLVED for i in items):
+        if any(i.status == ITEM_UNRESOLVED for i in items) and inventory_complete:
+            overall = STATUS_DEGRADED
+        elif not inventory_complete:
+            overall = STATUS_FAILED
+        else:
+            overall = STATUS_DEGRADED
+    elif any(i.status == ITEM_DEGRADED for i in items):
+        overall = STATUS_DEGRADED
+    else:
+        overall = STATUS_COMPLETE
+
+    # Enforce mode holds mutations whenever anything is unresolved/failed.
+    mutation_hold = False
+    if mode_norm == MODE_ENFORCE and overall in {STATUS_DEGRADED, STATUS_FAILED}:
+        mutation_hold = True
+    if mode_norm == MODE_ENFORCE and any(
+        i.dimension == DIM_MUTATIONS and i.status == ITEM_UNRESOLVED for i in items
+    ):
+        mutation_hold = True
+
+    follow_ups = tuple(
+        fu for i in items if (fu := _follow_up_for_item(i)) is not None
+    )
+
+    finished = _utc_now() if now is None else now
+    note = (
+        "Read-only completion proof. Never auto-resumes write mutations. "
+        "Unresolved items require durable follow-up before claiming clean restart. "
+        f"Mode={mode_norm}."
+    )
+
+    return RestartCompletionProof(
+        schema_version=SCHEMA_VERSION,
+        reconcile_version=RECONCILE_VERSION,
+        reconcile_id=(reconcile_id or f"reconcile-{uuid4().hex[:12]}"),
+        started_at=_ts(started),
+        finished_at=_ts(finished),
+        boot_head_sha=(
+            str(inventory.get("boot_head_sha")).strip()
+            if inventory.get("boot_head_sha")
+            else None
+        ),
+        current_head_sha=(
+            str(inventory.get("current_head_sha")).strip()
+            if inventory.get("current_head_sha")
+            else None
+        ),
+        inventory_complete=inventory_complete,
+        incomplete_reasons=incomplete_reasons,
+        mode=mode_norm,
+        mutation_hold=mutation_hold,
+        overall_status=overall,
+        items=tuple(items),
+        proposed_follow_ups=follow_ups,
+        resolved_count=resolved,
+        unresolved_count=unresolved,
+        skipped_count=skipped,
+        note=note,
+    )
+
+
+def mutations_allowed(proof: RestartCompletionProof | Mapping[str, Any] | None) -> bool:
+    """Return whether write mutations may proceed under the given proof."""
+    if proof is None:
+        return True  # no proof yet → caller decides; enforce path sets hold
+    if isinstance(proof, RestartCompletionProof):
+        return not proof.mutation_hold
+    if isinstance(proof, Mapping):
+        return not bool(proof.get("mutation_hold"))
+    return True

task_capability_map.py

@@ -32,6 +32,15 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.issue.comment",
         "role": "author",
     },
+    # #790 Slice A: prove an owned author lease is still active. Strictly
+    # narrower than lock_issue — it can only slide a lease this exact session
+    # already owns, never acquire, take over, or revive one — so it gates on the
+    # same authority rather than introducing an operation name that every
+    # already-configured author profile would be missing.
+    "heartbeat_issue_lock": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
     # #860: dirty orphaned same-claimant worktree recovery (explicit operation).
     "recover_dirty_orphaned_issue_worktree": {
         "permission": "gitea.issue.comment",
@@ -123,6 +132,16 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.branch.push",
         "role": "author",
     },
+    # #662: post-restart reconcile is read-only inventory + pure classification.
+    # Durable follow-up issue creation is a separate apply path (not this task).
+    "reconcile_after_restart": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "gitea_reconcile_after_restart": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
     # PR synchronization lifecycle: assess is read-only (any role with gitea.read);
     # update-by-merge is author-only and mutates the PR head via Gitea API.
     "assess_pr_sync_status": {
@@ -510,6 +529,15 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.issue.comment",
         "role": "author",
     },
+
+    # #651 console analytics ingest — control-plane DB write, not a Gitea API
+    # call. Authority comes from console RBAC (operator+) plus phase gating;
+    # permission string is a non-Gitea runtime capability so no Gitea profile
+    # can satisfy it by accident.
+    "record_analytics_usage": {
+        "permission": "runtime.record_analytics_usage",
+        "role": "author",
+    },
 }
 
 

tests/test_control_plane_db.py

@@ -36,7 +36,7 @@ class ControlPlaneDBTest(unittest.TestCase):
             rows = dict(conn.execute("SELECT key, value FROM schema_meta").fetchall())
         finally:
             conn.close()
-        self.assertEqual(rows["schema_version"], "4")
+        self.assertEqual(rows["schema_version"], "5")
         self.assertIn("DB coordinates", rows["architecture"])
         self.assertIn("bridge", rows["architecture"].lower())
 

tests/test_issue_628_orchestration.py

@@ -0,0 +1,199 @@
+"""Regression tests for #628 building blocks (child scope only).
+
+Honest scope: unit coverage of pre-existing APIs used by umbrella #628.
+This module does **not** implement or verify all 21 umbrella acceptance
+criteria, automatic handoff store/retrieve, multi-worker product wiring,
+or end-to-end orchestration.
+
+Covered building blocks:
+- CTH format / parse / assess (`format_cth_body`, `parse_cth_comment`,
+  `assess_cth_comment`)
+- Exclusive-ownership skip classification (`classify_skip` with
+  OWNERSHIP_FOREIGN vs OWNERSHIP_OWN)
+- Durable dependency edges (`upsert_dependency_edge` / list) and skip
+  when dependency_unmet
+- Edge state transition UNMET -> MET
+
+Parent umbrella remains #628; this slice is a scoped child issue only.
+"""
+
+import unittest
+from unittest.mock import MagicMock, patch
+import os
+import json
+import tempfile
+
+from canonical_thread_handoff import (
+    format_cth_body,
+    parse_cth_comment,
+    assess_cth_comment,
+)
+import dependency_graph
+from control_plane_db import ControlPlaneDB
+from allocator_service import (
+    WorkCandidate,
+    classify_skip,
+    ROLE_AUTHOR,
+    ROLE_REVIEWER,
+    ROLE_MERGER,
+    ROLE_RECONCILER,
+    OWNERSHIP_OWN,
+    OWNERSHIP_FOREIGN,
+)
+
+
+class TestIssue628Orchestration(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.db_path = os.path.join(self._tmp.name, "cp.sqlite3")
+        self.db = ControlPlaneDB(self.db_path)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_canonical_handoff_serialization_and_retrieval(self):
+        """Building block: format/parse/assess a CTH body (not full AC1/AC2 product path)."""
+        handoff = format_cth_body(
+            cth_type="Author Handoff",
+            status="completed",
+            next_owner="reviewer",
+            current_blocker="none",
+            decision="Implementation complete, tests passing",
+            proof="pytest tests/test_issue_628_orchestration.py passed",
+            next_action="Review PR and run reviewer pre-flight",
+            ready_to_paste_prompt="Review PR for child issue #878 (parent #628)",
+        )
+        self.assertIn("CTH: Author Handoff", handoff)
+
+        parsed = parse_cth_comment(handoff)
+        self.assertIsNotNone(parsed)
+        self.assertEqual(parsed["cth_type"], "Author Handoff")
+
+        assessment = assess_cth_comment(handoff)
+        self.assertFalse(assessment["block"])
+
+    def test_exclusive_task_unit_single_owner(self):
+        """Building block: classify_skip foreign vs own ownership."""
+        candidate = WorkCandidate(
+            kind="issue",
+            number=878,
+            title="Child #878 ownership classify candidate",
+            state="open",
+            labels=["status:in-progress"],
+            blocked=False,
+            dependency_unmet=False,
+        )
+        # Foreign ownership MUST be skipped
+        skip_foreign = classify_skip(
+            c=candidate,
+            role=ROLE_AUTHOR,
+            terminal_pr=None,
+            claim_ownership=OWNERSHIP_FOREIGN,
+        )
+        self.assertIsNotNone(skip_foreign)
+        self.assertIn("active lease", skip_foreign)
+
+        # Own/Self claim remains selectable for session resumption
+        skip_self = classify_skip(
+            c=candidate,
+            role=ROLE_AUTHOR,
+            terminal_pr=None,
+            claim_ownership=OWNERSHIP_OWN,
+        )
+        self.assertIsNone(skip_self)
+
+    def test_durable_dependency_graph_blocking(self):
+        """Building block: unmet dependency edge + classify_skip on dependency_unmet."""
+        # Upsert a blocking dependency edge between issue 878 and blocker 601
+        self.db.upsert_dependency_edge(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            source_kind="issue",
+            source_number=878,
+            target_kind="issue",
+            target_number=601,
+            edge_type=dependency_graph.EDGE_ISSUE_BLOCKED_BY_ISSUE,
+            state=dependency_graph.STATE_UNMET,
+            blocking_condition="Target issue #601 is not closed",
+            completion_condition="Target issue #601 is closed",
+            evidence={"source": "unit_test"},
+        )
+
+        edges = self.db.list_dependency_edges(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            source_kind="issue",
+            source_number=878,
+        )
+        self.assertEqual(len(edges), 1)
+        self.assertEqual(edges[0]["state"], "unmet")
+        self.assertEqual(edges[0]["target_number"], 601)
+
+        # When dependency is unmet, candidate is blocked from selection
+        candidate = WorkCandidate(
+            kind="issue",
+            number=878,
+            title="Blocked candidate",
+            state="open",
+            labels=[],
+            blocked=False,
+            dependency_unmet=True,
+            dependency_reason="issue#878 is blocked by unmet dependency issue#601",
+        )
+        skip_reason = classify_skip(
+            c=candidate,
+            role=ROLE_AUTHOR,
+            terminal_pr=None,
+            claim_ownership=OWNERSHIP_OWN,
+        )
+        self.assertIsNotNone(skip_reason)
+        self.assertIn("issue#601", skip_reason)
+
+    def test_dependency_completion_reevaluation(self):
+        """Building block: dependency edge state can transition UNMET -> MET."""
+        self.db.upsert_dependency_edge(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            source_kind="issue",
+            source_number=878,
+            target_kind="issue",
+            target_number=601,
+            edge_type=dependency_graph.EDGE_ISSUE_BLOCKED_BY_ISSUE,
+            state=dependency_graph.STATE_UNMET,
+            blocking_condition="Target issue #601 is open",
+            completion_condition="Target issue #601 is closed",
+            evidence={"source": "unit_test"},
+        )
+
+        # Mark edge as met upon target issue closure
+        self.db.upsert_dependency_edge(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            source_kind="issue",
+            source_number=878,
+            target_kind="issue",
+            target_number=601,
+            edge_type=dependency_graph.EDGE_ISSUE_BLOCKED_BY_ISSUE,
+            state=dependency_graph.STATE_MET,
+            blocking_condition="Target issue #601 is open",
+            completion_condition="Target issue #601 is closed",
+            evidence={"source": "target_closed_event"},
+        )
+
+        edges = self.db.list_dependency_edges(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            source_kind="issue",
+            source_number=878,
+        )
+        self.assertEqual(len(edges), 1)
+        self.assertEqual(edges[0]["state"], "met")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_issue_662_post_restart_reconcile.py

@@ -0,0 +1,249 @@
+"""Tests for post-restart MCP reconciliation and completion proof (#662)."""
+
+from __future__ import annotations
+
+import json
+import os
+import unittest
+from datetime import datetime, timezone
+
+import post_restart_reconcile as prr
+
+NOW = datetime(2026, 7, 24, 12, 0, 0, tzinfo=timezone.utc)
+
+
+def _base_inventory(**overrides):
+    inv = {
+        "inventory_complete": True,
+        "incomplete_reasons": [],
+        "service_health": {"healthy": True},
+        "clients": [{"session_id": "c1", "connected": True}],
+        "sessions": [
+            {
+                "session_id": "s-live",
+                "status": "active",
+                "pid": os.getpid(),
+                "role": "author",
+            }
+        ],
+        "leases": [],
+        "checkpoints_available": False,
+        "worktree_bindings": [{"path": "/tmp/wt", "exists": True}],
+        "pending_mutations": [],
+        "capabilities": {"stale": False},
+        "boot_head_sha": "a" * 40,
+        "current_head_sha": "a" * 40,
+        "queue_state": {"safe_to_resume": True},
+    }
+    inv.update(overrides)
+    return inv
+
+
+class IncompleteInventoryTest(unittest.TestCase):
+    def test_incomplete_inventory_fails_closed(self) -> None:
+        proof = prr.reconcile_after_restart(
+            {
+                "inventory_complete": False,
+                "incomplete_reasons": ["control-plane DB unavailable"],
+            },
+            now=NOW,
+            mode=prr.MODE_ENFORCE,
+            reconcile_id="test-incomplete",
+        )
+        self.assertEqual(proof.overall_status, prr.STATUS_FAILED)
+        self.assertTrue(proof.mutation_hold)
+        self.assertFalse(proof.inventory_complete)
+        self.assertTrue(proof.proposed_follow_ups)
+        self.assertIn("control-plane DB unavailable", proof.incomplete_reasons)
+
+
+class HappyPathTest(unittest.TestCase):
+    def test_clean_restart_is_complete_without_mutation_hold(self) -> None:
+        proof = prr.reconcile_after_restart(
+            _base_inventory(),
+            now=NOW,
+            mode=prr.MODE_ENFORCE,
+            reconcile_id="test-clean",
+        )
+        self.assertEqual(proof.overall_status, prr.STATUS_COMPLETE)
+        self.assertFalse(proof.mutation_hold)
+        self.assertEqual(proof.unresolved_count, 0)
+        cp = next(i for i in proof.items if i.dimension == prr.DIM_CHECKPOINTS)
+        self.assertEqual(cp.status, prr.ITEM_SKIPPED)
+        links = proof.as_dict()["links"]
+        self.assertEqual(links["umbrella"], 655)
+        self.assertEqual(links["issue"], 662)
+        self.assertEqual(links["vision"], 652)
+        self.assertEqual(links["roadmap"], 653)
+
+
+class InterruptedMutationTest(unittest.TestCase):
+    def test_mutating_lease_with_dead_owner_is_unresolved(self) -> None:
+        proof = prr.reconcile_after_restart(
+            _base_inventory(
+                leases=[
+                    {
+                        "lease_id": "lease-mut",
+                        "session_id": "s-dead",
+                        "phase": "implementing",
+                        "work_kind": "issue",
+                        "work_number": 662,
+                        "worktree_path": "/tmp/wt-662",
+                        "freshness": {"freshness": "stale_dead_process"},
+                    }
+                ]
+            ),
+            now=NOW,
+            mode=prr.MODE_ENFORCE,
+        )
+        mut = next(i for i in proof.items if i.dimension == prr.DIM_MUTATIONS)
+        self.assertEqual(mut.status, prr.ITEM_UNRESOLVED)
+        self.assertTrue(mut.follow_up_required)
+        interrupted = mut.details["interrupted"]
+        self.assertEqual(len(interrupted), 1)
+        self.assertFalse(interrupted[0]["resume_allowed"])
+        self.assertTrue(proof.mutation_hold)
+        self.assertTrue(
+            any(f.dimension == prr.DIM_MUTATIONS for f in proof.proposed_follow_ups)
+        )
+
+    def test_explicit_pending_mutation_inventory(self) -> None:
+        proof = prr.reconcile_after_restart(
+            _base_inventory(
+                pending_mutations=[
+                    {
+                        "session_id": "s1",
+                        "phase": "publishing",
+                        "work_kind": "pr",
+                        "work_number": 856,
+                        "reason": "push interrupted mid-flight",
+                    }
+                ]
+            ),
+            now=NOW,
+            mode=prr.MODE_LOG_ONLY,
+        )
+        mut = next(i for i in proof.items if i.dimension == prr.DIM_MUTATIONS)
+        self.assertEqual(mut.status, prr.ITEM_UNRESOLVED)
+        # log_only never holds mutations even when unresolved
+        self.assertFalse(proof.mutation_hold)
+        self.assertEqual(proof.overall_status, prr.STATUS_DEGRADED)
+
+
+class DuplicateClaimsTest(unittest.TestCase):
+    def test_duplicate_live_claims_flagged(self) -> None:
+        proof = prr.reconcile_after_restart(
+            _base_inventory(
+                leases=[
+                    {
+                        "lease_id": "l1",
+                        "session_id": "s1",
+                        "phase": "allocated",
+                        "work_kind": "issue",
+                        "work_number": 100,
+                        "freshness": {"freshness": "active"},
+                    },
+                    {
+                        "lease_id": "l2",
+                        "session_id": "s2",
+                        "phase": "allocated",
+                        "work_kind": "issue",
+                        "work_number": 100,
+                        "freshness": {"freshness": "active"},
+                    },
+                ]
+            ),
+            now=NOW,
+            mode=prr.MODE_ENFORCE,
+        )
+        dups = next(i for i in proof.items if i.dimension == prr.DIM_DUPLICATES)
+        self.assertEqual(dups.status, prr.ITEM_UNRESOLVED)
+        self.assertEqual(dups.details["duplicates"][0]["claim_count"], 2)
+        self.assertTrue(proof.mutation_hold)
+
+
+class OrphanSessionTest(unittest.TestCase):
+    def test_active_session_dead_pid_is_unresolved(self) -> None:
+        proof = prr.reconcile_after_restart(
+            _base_inventory(
+                sessions=[
+                    {
+                        "session_id": "ghost",
+                        "status": "active",
+                        "pid": 2_000_000_000,
+                        "role": "author",
+                    }
+                ]
+            ),
+            now=NOW,
+            mode=prr.MODE_ENFORCE,
+        )
+        sess = next(i for i in proof.items if i.dimension == prr.DIM_SESSIONS)
+        self.assertEqual(sess.status, prr.ITEM_UNRESOLVED)
+        self.assertIn("ghost", sess.details["orphan_session_ids"])
+
+
+class CapabilityStaleTest(unittest.TestCase):
+    def test_stale_runtime_unresolved(self) -> None:
+        proof = prr.reconcile_after_restart(
+            _base_inventory(capabilities={"stale": True, "startup_head": "aaa"}),
+            now=NOW,
+            mode=prr.MODE_ENFORCE,
+        )
+        caps = next(i for i in proof.items if i.dimension == prr.DIM_CAPABILITIES)
+        self.assertEqual(caps.status, prr.ITEM_UNRESOLVED)
+        self.assertTrue(proof.mutation_hold)
+
+
+class MutationsAllowedHelperTest(unittest.TestCase):
+    def test_mutations_allowed_respects_hold(self) -> None:
+        held = prr.reconcile_after_restart(
+            _base_inventory(
+                pending_mutations=[{"phase": "merging", "session_id": "x"}]
+            ),
+            now=NOW,
+            mode=prr.MODE_ENFORCE,
+        )
+        self.assertFalse(prr.mutations_allowed(held))
+        self.assertFalse(prr.mutations_allowed(held.as_dict()))
+        clean = prr.reconcile_after_restart(
+            _base_inventory(), now=NOW, mode=prr.MODE_ENFORCE
+        )
+        self.assertTrue(prr.mutations_allowed(clean))
+
+
+class CheckpointSoftDependencyTest(unittest.TestCase):
+    def test_checkpoints_when_schema_present(self) -> None:
+        proof = prr.reconcile_after_restart(
+            _base_inventory(
+                checkpoints_available=True,
+                checkpoints=[{"session_id": "s1", "stale": False}],
+            ),
+            now=NOW,
+        )
+        cp = next(i for i in proof.items if i.dimension == prr.DIM_CHECKPOINTS)
+        self.assertEqual(cp.status, prr.ITEM_RESOLVED)
+
+    def test_stale_checkpoints_unresolved(self) -> None:
+        proof = prr.reconcile_after_restart(
+            _base_inventory(
+                checkpoints_available=True,
+                checkpoints=[{"session_id": "s1", "stale": True}],
+            ),
+            now=NOW,
+            mode=prr.MODE_ENFORCE,
+        )
+        cp = next(i for i in proof.items if i.dimension == prr.DIM_CHECKPOINTS)
+        self.assertEqual(cp.status, prr.ITEM_UNRESOLVED)
+
+
+class ProofSerializationTest(unittest.TestCase):
+    def test_as_dict_is_json_friendly(self) -> None:
+        proof = prr.reconcile_after_restart(_base_inventory(), now=NOW)
+        blob = json.dumps(proof.as_dict())
+        self.assertIn("reconcile_id", blob)
+        self.assertIn("proposed_follow_ups", blob)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_issue_790_heartbeat_mcp_path.py

@@ -0,0 +1,444 @@
+"""Task heartbeat through the native MCP author path (#790 Slice A, AC-N6).
+
+Assessor-level coverage is not sufficient here, and this project has already
+paid for learning that: in review #499 on PR #791 the #760 renewal waiver was
+computed correctly and then *discarded* at two later gates, so every real
+renewal still failed while the unit suite stayed green. AC-N6 exists because of
+that, and requires driving the real tools against a real git repository and a
+real durable lock file, composing the gates in production order.
+
+These tests therefore call ``gitea_lock_issue`` and
+``gitea_heartbeat_issue_lock`` themselves and assert on what lands on disk,
+never on an assessor's return value alone.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from datetime import datetime, timedelta, timezone
+from unittest.mock import patch
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from mutation_profile_fixture import shared_mutation_env  # noqa: E402
+
+import issue_lock_provenance  # noqa: E402
+import issue_lock_store  # noqa: E402
+import lease_policy  # noqa: E402
+import mcp_server  # noqa: E402
+
+ISSUE = 9791
+BRANCH = f"fix/issue-{ISSUE}-heartbeat-mcp"
+IDENTITY = "example-user"
+PROFILE = "test-author-prgs"
+ORG = "Scaled-Tech-Consulting"
+REPO = "Gitea-Tools"
+
+
+def _ts(moment: datetime) -> str:
+    return (
+        moment.astimezone(timezone.utc)
+        .replace(microsecond=0)
+        .isoformat()
+        .replace("+00:00", "Z")
+    )
+
+
+class _HeartbeatMcpBase(unittest.TestCase):
+    """Real git repo plus a real durable lock, driven through the real tools."""
+
+    def setUp(self):
+        self.lock_dir = tempfile.TemporaryDirectory()
+        self.addCleanup(self.lock_dir.cleanup)
+        self.repo = tempfile.mkdtemp(prefix="issue790-mcp-")
+        self.addCleanup(lambda: subprocess.run(["rm", "-rf", self.repo], check=False))
+        self._init_worktree()
+        self.remotes = patch.dict(
+            mcp_server.REMOTES,
+            {"prgs": {"host": "gitea.prgs.cc", "org": ORG, "repo": REPO}},
+        )
+        self.remotes.start()
+        self.addCleanup(patch.stopall)
+        mcp_server._IDENTITY_CACHE.clear()
+
+    def _git(self, *args):
+        return subprocess.run(
+            ["git", "-C", self.repo, *args], capture_output=True, text=True, check=True
+        )
+
+    def _init_worktree(self):
+        self._git("init", "-q", "-b", "master")
+        self._git("config", "user.email", "[email protected]")
+        self._git("config", "user.name", "Test")
+        with open(os.path.join(self.repo, "seed.txt"), "w") as fh:
+            fh.write("seed\n")
+        self._git("add", "seed.txt")
+        self._git("commit", "-q", "-m", "seed")
+        self.base_sha = self._git("rev-parse", "HEAD").stdout.strip()
+        # A fresh claim starts base-equivalent, which is the ordinary first-lock
+        # shape and exercises assess_issue_lock_worktree on its normal path.
+        self._git("checkout", "-q", "-b", BRANCH)
+        self.head_sha = self.base_sha
+        self.worktree = os.path.realpath(self.repo)
+
+    def _lock_path(self):
+        return issue_lock_store.lock_file_path(
+            remote="prgs",
+            org=ORG,
+            repo=REPO,
+            issue_number=ISSUE,
+            lock_dir=self.lock_dir.name,
+        )
+
+    def _tool_env(self):
+        env = shared_mutation_env(
+            PROFILE, include_example_repo=True, GITEA_ISSUE_LOCK_DIR=self.lock_dir.name
+        )
+        env["GITEA_ISSUE_LOCK_DIR"] = self.lock_dir.name
+        return env
+
+    def _git_state(self, *, porcelain="", base_equivalent=True):
+        return {
+            "current_branch": BRANCH,
+            "porcelain_status": porcelain,
+            "base_equivalent": base_equivalent,
+            "head_sha": self.head_sha,
+            "inspected_git_root": self.worktree,
+            "base_branch": "master",
+        }
+
+    def run_lock_issue(
+        self,
+        *,
+        branch_entries=None,
+        open_prs=None,
+        git_state=None,
+        identity=IDENTITY,
+        profile=PROFILE,
+    ):
+        branch_entries = branch_entries if branch_entries is not None else []
+        open_prs = open_prs if open_prs is not None else []
+        git_state = git_state or self._git_state()
+        env = self._tool_env()
+        with patch(
+            "mcp_server.api_get_all", return_value=list(branch_entries)
+        ), patch(
+            "mcp_server._list_open_pulls", return_value=list(open_prs)
+        ), patch(
+            "mcp_server.get_auth_header", return_value="token x"
+        ), patch(
+            "mcp_server._work_lease_claimant",
+            return_value={"username": identity, "profile": profile},
+        ), patch(
+            "mcp_server.issue_lock_worktree.read_worktree_git_state",
+            return_value=git_state,
+        ), patch(
+            "mcp_server.issue_duplicate_context_fetcher",
+            side_effect=lambda h, o, r, auth, issue_number: (
+                list(open_prs),
+                [b.get("name") for b in branch_entries if isinstance(b, dict)],
+                {"status": "not_claimed"},
+            ),
+        ), patch.dict(os.environ, env, clear=True):
+            os.environ["GITEA_ISSUE_LOCK_DIR"] = self.lock_dir.name
+            return mcp_server.gitea_lock_issue(
+                issue_number=ISSUE,
+                branch_name=BRANCH,
+                remote="prgs",
+                worktree_path=self.worktree,
+            )
+
+    def run_heartbeat(
+        self, *, task_session_id, identity=IDENTITY, profile=PROFILE, **kwargs
+    ):
+        env = self._tool_env()
+        with patch(
+            "mcp_server._work_lease_claimant",
+            return_value={"username": identity, "profile": profile},
+        ), patch("mcp_server.get_auth_header", return_value="token x"), patch.dict(
+            os.environ, env, clear=True
+        ):
+            os.environ["GITEA_ISSUE_LOCK_DIR"] = self.lock_dir.name
+            return mcp_server.gitea_heartbeat_issue_lock(
+                issue_number=ISSUE,
+                branch_name=kwargs.pop("branch_name", BRANCH),
+                task_session_id=task_session_id,
+                remote="prgs",
+                worktree_path=kwargs.pop("worktree_path", self.worktree),
+                **kwargs,
+            )
+
+    def write_legacy_lock(self, *, hours_old: float = 3.0, ttl_hours: float = 4.0):
+        """A durable lock in the shape the store wrote before this slice."""
+        now = datetime.now(timezone.utc)
+        claimant = {"username": IDENTITY, "profile": PROFILE}
+        created = now - timedelta(hours=hours_old)
+        record = {
+            "issue_number": ISSUE,
+            "branch_name": BRANCH,
+            "remote": "prgs",
+            "org": ORG,
+            "repo": REPO,
+            "worktree_path": self.worktree,
+            "session_pid": os.getpid(),
+            "pid": os.getpid(),
+            "lock_generation": 1,
+            "work_lease": {
+                "operation_type": issue_lock_store.AUTHOR_ISSUE_WORK_LEASE,
+                "issue_number": ISSUE,
+                "pr_number": None,
+                "branch": BRANCH,
+                "worktree_path": self.worktree,
+                "claimant": claimant,
+                "created_at": _ts(created),
+                # The legacy signature: never advanced past creation.
+                "last_heartbeat_at": _ts(created),
+                "expires_at": _ts(created + timedelta(hours=ttl_hours)),
+            },
+            "lock_provenance": issue_lock_provenance.build_sanctioned_lock_provenance(
+                tool="gitea_lock_issue", claimant=claimant
+            ),
+        }
+        path = self._lock_path()
+        record["lock_file_path"] = path
+        issue_lock_store.save_lock_file(path, record)
+        return record
+
+
+class TestLockIssueMintsTheLifecycle(_HeartbeatMcpBase):
+    """Durable lock creation and read-back through the real tool."""
+
+    def test_native_lock_writes_the_marker_and_a_task_session_id(self):
+        result = self.run_lock_issue()
+        self.assertTrue(result["success"], result)
+
+        written = issue_lock_store.read_lock_file(result["lock_file_path"])
+        lease = written["work_lease"]
+        self.assertEqual(
+            lease["lifecycle_version"], lease_policy.LIFECYCLE_HEARTBEAT_V1
+        )
+        self.assertTrue(lease["task_session_id"])
+        self.assertFalse(issue_lock_store.is_legacy_lease(written))
+        # AC-N1: the ownership key is not the daemon pid, which is recorded
+        # separately as evidence.
+        self.assertNotIn(str(written["session_pid"]), lease["task_session_id"])
+        self.assertEqual(written["session_pid"], os.getpid())
+
+    def test_native_lease_uses_the_policy_window_not_four_hours(self):
+        result = self.run_lock_issue()
+        lease = result["work_lease"]
+        created = datetime.fromisoformat(lease["created_at"].replace("Z", "+00:00"))
+        expires = datetime.fromisoformat(lease["expires_at"].replace("Z", "+00:00"))
+        policy = lease_policy.policy_for(lease_policy.TASK_CLASS_AUTHOR_ISSUE_WORK)
+        self.assertEqual(
+            (expires - created).total_seconds() / 60.0, policy.initial_ttl_minutes
+        )
+
+    def test_freshness_of_a_new_native_lock_is_live(self):
+        result = self.run_lock_issue()
+        self.assertEqual(
+            result["lock_freshness"]["status"], issue_lock_store.STATUS_LIVE
+        )
+        self.assertTrue(result["lock_freshness"]["live"])
+
+
+class TestHeartbeatThroughTheTool(_HeartbeatMcpBase):
+    def _lock_and_session(self):
+        result = self.run_lock_issue()
+        self.assertTrue(result["success"], result)
+        return result, result["work_lease"]["task_session_id"]
+
+    def test_heartbeat_slides_the_lease_and_advances_the_generation(self):
+        locked, session = self._lock_and_session()
+        before = issue_lock_store.read_lock_file(locked["lock_file_path"])
+
+        beat = self.run_heartbeat(task_session_id=session)
+
+        self.assertTrue(beat["success"], beat)
+        self.assertEqual(beat["operation"], "heartbeat")
+        after = issue_lock_store.read_lock_file(locked["lock_file_path"])
+        self.assertGreater(
+            issue_lock_store.lock_generation(after),
+            issue_lock_store.lock_generation(before),
+        )
+        self.assertGreaterEqual(
+            after["work_lease"]["expires_at"], before["work_lease"]["expires_at"]
+        )
+        self.assertEqual(after["work_lease"]["heartbeat_count"], 2)
+
+    def test_heartbeat_evidence_survives_the_downstream_mutation_gate(self):
+        """The #499 F2 lesson, applied.
+
+        A sanction that is computed and then discarded downstream is worthless.
+        After a heartbeat the lock must still satisfy the gate every author
+        mutation runs through.
+        """
+        locked, session = self._lock_and_session()
+        self.run_heartbeat(task_session_id=session)
+
+        written = issue_lock_store.read_lock_file(locked["lock_file_path"])
+        verdict = issue_lock_store.verify_lock_for_mutation(
+            written,
+            issue_number=ISSUE,
+            branch_name=BRANCH,
+            worktree_path=self.worktree,
+        )
+        self.assertTrue(verdict["proven"], verdict)
+        self.assertFalse(verdict["block"])
+
+    def _duplicate_gate(self, *, open_prs, branches):
+        env = self._tool_env()
+        with patch("mcp_server.get_auth_header", return_value="token x"), patch(
+            "mcp_server.issue_duplicate_context_fetcher",
+            side_effect=lambda h, o, r, auth, issue_number: (
+                list(open_prs),
+                list(branches),
+                {"status": "not_claimed"},
+            ),
+        ), patch.dict(os.environ, env, clear=True):
+            os.environ["GITEA_ISSUE_LOCK_DIR"] = self.lock_dir.name
+            return mcp_server.gitea_assess_work_issue_duplicate(
+                issue_number=ISSUE, branch_name=BRANCH, remote="prgs"
+            )
+
+    def test_heartbeat_does_not_change_the_duplicate_gate_verdict(self):
+        """The gate must be invariant under heartbeating.
+
+        The point is not that the gate passes — with a linked open PR at the
+        lock phase it correctly blocks (#400), heartbeat or not. The property
+        that matters is that sliding a lease neither loosens the gate nor
+        corrupts the lock state it reads: the verdict before and after a
+        heartbeat must be identical, for both the clear and the blocking shape.
+        """
+        _, session = self._lock_and_session()
+        linked = [{"number": 4242, "head": {"ref": BRANCH, "sha": self.head_sha}}]
+
+        clear_before = self._duplicate_gate(open_prs=[], branches=[])
+        blocked_before = self._duplicate_gate(open_prs=linked, branches=[BRANCH])
+
+        self.assertTrue(self.run_heartbeat(task_session_id=session)["success"])
+
+        clear_after = self._duplicate_gate(open_prs=[], branches=[])
+        blocked_after = self._duplicate_gate(open_prs=linked, branches=[BRANCH])
+
+        self.assertEqual(clear_before["outcome"], clear_after["outcome"])
+        self.assertFalse(clear_after["block"])
+        self.assertEqual(blocked_before["outcome"], blocked_after["outcome"])
+        self.assertTrue(blocked_after["block"])
+        self.assertEqual(blocked_after["linked_open_pr"], 4242)
+
+    def test_foreign_session_id_is_refused_through_the_tool(self):
+        self._lock_and_session()
+        beat = self.run_heartbeat(task_session_id="author_issue_work-ffffffffffffffff")
+        self.assertFalse(beat["success"])
+        self.assertIn("task_session_id does not match", " ".join(beat["reasons"]))
+
+    def test_stale_generation_is_refused_through_the_tool(self):
+        locked, session = self._lock_and_session()
+        current = issue_lock_store.lock_generation(
+            issue_lock_store.read_lock_file(locked["lock_file_path"])
+        )
+        beat = self.run_heartbeat(
+            task_session_id=session, expected_generation=current + 5
+        )
+        self.assertFalse(beat["success"])
+        self.assertIn("generation changed", beat["reasons"][0])
+
+    def test_foreign_claimant_is_refused_through_the_tool(self):
+        _, session = self._lock_and_session()
+        beat = self.run_heartbeat(task_session_id=session, identity="someone-else")
+        self.assertFalse(beat["success"])
+
+    def test_heartbeat_cannot_acquire_a_missing_lock(self):
+        beat = self.run_heartbeat(task_session_id="author_issue_work-000000000000")
+        self.assertFalse(beat["success"])
+        self.assertIn("no durable lock", beat["reasons"][0])
+
+    def test_alive_pid_alone_does_not_keep_a_lease_live_through_the_tool(self):
+        """PID-only refusal, end to end.
+
+        The recorded pid is this live process. The lock is aged past its grace
+        with no heartbeat, so the tool must refuse to slide it and the durable
+        record must classify as a missed heartbeat rather than as live.
+        """
+        locked, session = self._lock_and_session()
+        record = issue_lock_store.read_lock_file(locked["lock_file_path"])
+        record["work_lease"]["last_heartbeat_at"] = _ts(
+            datetime.now(timezone.utc) - timedelta(minutes=30)
+        )
+        record["work_lease"]["expires_at"] = _ts(
+            datetime.now(timezone.utc) + timedelta(hours=2)
+        )
+        issue_lock_store.save_lock_file(locked["lock_file_path"], record)
+
+        self.assertTrue(issue_lock_store.is_process_alive(record["session_pid"]))
+        fresh = issue_lock_store.assess_lock_freshness(record)
+        self.assertEqual(
+            fresh["status"], issue_lock_store.STATUS_STALE_MISSED_HEARTBEAT
+        )
+        self.assertTrue(fresh["pid_alive"])
+
+        beat = self.run_heartbeat(task_session_id=session)
+        self.assertFalse(beat["success"])
+        self.assertIn("reclaimed", " ".join(beat["reasons"]))
+
+
+class TestLegacyLocksThroughTheTool(_HeartbeatMcpBase):
+    """AC-N8 end to end: protected on deployment, and rebindable."""
+
+    def test_legacy_lock_stays_protected_after_deployment(self):
+        record = self.write_legacy_lock(hours_old=3.0, ttl_hours=4.0)
+        fresh = issue_lock_store.assess_lock_freshness(record)
+        self.assertEqual(fresh["status"], issue_lock_store.STATUS_LIVE)
+        self.assertTrue(fresh["legacy_lease"])
+        self.assertTrue(fresh["legacy_expiry_preserved"])
+        # It had never heartbeated, so under the new grace alone it would be
+        # long gone; the preserved absolute expiry is what protects it.
+        self.assertEqual(
+            record["work_lease"]["created_at"],
+            record["work_lease"]["last_heartbeat_at"],
+        )
+
+    def test_tool_rebinds_a_legacy_lock_and_mints_a_first_heartbeat(self):
+        self.write_legacy_lock(hours_old=3.0, ttl_hours=4.0)
+
+        result = self.run_heartbeat(task_session_id=None)
+
+        self.assertTrue(result["success"], result)
+        self.assertEqual(result["operation"], "legacy_rebind")
+        self.assertTrue(result["task_session_id"])
+
+        written = issue_lock_store.read_lock_file(self._lock_path())
+        lease = written["work_lease"]
+        self.assertEqual(
+            lease["lifecycle_version"], lease_policy.LIFECYCLE_HEARTBEAT_V1
+        )
+        self.assertEqual(lease["heartbeat_count"], 1)
+        self.assertNotEqual(
+            lease["created_at"],
+            written["legacy_rebind"]["legacy_origin"]["created_at"],
+        )
+        self.assertFalse(issue_lock_store.is_legacy_lease(written))
+
+    def test_rebound_lock_then_heartbeats_through_the_tool(self):
+        self.write_legacy_lock(hours_old=3.0, ttl_hours=4.0)
+        rebound = self.run_heartbeat(task_session_id=None)
+        beat = self.run_heartbeat(task_session_id=rebound["task_session_id"])
+        self.assertTrue(beat["success"], beat)
+        self.assertEqual(beat["operation"], "heartbeat")
+        self.assertEqual(beat["heartbeat_count"], 2)
+
+    def test_rebind_refuses_a_foreign_owner_through_the_tool(self):
+        self.write_legacy_lock(hours_old=3.0, ttl_hours=4.0)
+        result = self.run_heartbeat(task_session_id=None, identity="someone-else")
+        self.assertFalse(result["success"])
+        self.assertEqual(result["operation"], "legacy_rebind")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_issue_790_lease_policy.py

@@ -0,0 +1,594 @@
+"""Central lease policy and load-bearing heartbeat freshness (#790 Slice A).
+
+Before this slice, ``issue_lock_store.assess_lock_freshness`` parsed
+``last_heartbeat_at`` and then never consulted it: liveness was decided by an
+absolute four-hour ``expires_at`` and by PID liveness. Because the recorded PID
+is the long-lived MCP daemon rather than the authoring task, an abandoned claim
+stayed "live" for the full four hours, and a claim whose work had already landed
+blocked reconciliation for just as long (Issue #787 / PR #789, and again Issue
+#760 / PR #791).
+
+These tests pin the corrected semantics, including the two asymmetries that are
+easy to lose in a refactor:
+
+* an **alive** PID must never make anything live (AC-N2), while
+* a **dead** PID must still mark a lease stale, because #753 dead-session
+  recovery keys on exactly that classification.
+
+Durable-state helpers here write real lock files through the real flock path;
+they are not mocks of the store.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+import unittest
+from datetime import datetime, timedelta, timezone
+from unittest.mock import patch
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import issue_lock_store  # noqa: E402
+import lease_policy  # noqa: E402
+import pr_work_lease  # noqa: E402
+import reviewer_pr_lease  # noqa: E402
+
+ISSUE = 9790
+BRANCH = f"fix/issue-{ISSUE}-heartbeat"
+IDENTITY = "example-user"
+PROFILE = "test-author-prgs"
+ORG = "Example-Org"
+REPO = "Example-Repo"
+REMOTE = "prgs"
+DEAD_PID = 2**22  # far above any live pid on a test host
+
+
+def _ts(moment: datetime) -> str:
+    return (
+        moment.astimezone(timezone.utc)
+        .replace(microsecond=0)
+        .isoformat()
+        .replace("+00:00", "Z")
+    )
+
+
+class _LockFixture(unittest.TestCase):
+    def setUp(self):
+        self.lock_dir = tempfile.TemporaryDirectory()
+        self.addCleanup(self.lock_dir.cleanup)
+        self.now = datetime.now(timezone.utc)
+        self.worktree = os.path.realpath(tempfile.mkdtemp(prefix="issue790-"))
+        self.addCleanup(patch.stopall)
+
+    def _path(self):
+        return issue_lock_store.lock_file_path(
+            remote=REMOTE,
+            org=ORG,
+            repo=REPO,
+            issue_number=ISSUE,
+            lock_dir=self.lock_dir.name,
+        )
+
+    def write_lock(
+        self,
+        *,
+        lifecycle: str | None = lease_policy.LIFECYCLE_HEARTBEAT_V1,
+        created_delta: timedelta = timedelta(minutes=1),
+        heartbeat_delta: timedelta = timedelta(minutes=1),
+        expires_delta: timedelta = timedelta(minutes=9),
+        pid: int | None = None,
+        task_session_id: str | None = "author_issue_work-aaaabbbbccccdddd",
+        generation: int = 1,
+        identity: str = IDENTITY,
+        profile: str = PROFILE,
+        branch: str = BRANCH,
+        worktree: str | None = None,
+    ) -> dict:
+        """Write a real durable lock and return the record.
+
+        Deltas are relative to ``self.now``; ``expires_delta`` is added, the
+        others subtracted, so "in the past" reads naturally at each call site.
+        """
+        lease: dict = {
+            "operation_type": issue_lock_store.AUTHOR_ISSUE_WORK_LEASE,
+            "issue_number": ISSUE,
+            "pr_number": None,
+            "branch": branch,
+            "worktree_path": worktree or self.worktree,
+            "claimant": {"username": identity, "profile": profile},
+            "created_at": _ts(self.now - created_delta),
+            "last_heartbeat_at": _ts(self.now - heartbeat_delta),
+            "expires_at": _ts(self.now + expires_delta),
+        }
+        if lifecycle is not None:
+            lease["lifecycle_version"] = lifecycle
+            if task_session_id is not None:
+                lease["task_session_id"] = task_session_id
+        pid_value = os.getpid() if pid is None else pid
+        record = {
+            "issue_number": ISSUE,
+            "branch_name": branch,
+            "remote": REMOTE,
+            "org": ORG,
+            "repo": REPO,
+            "worktree_path": worktree or self.worktree,
+            "session_pid": pid_value,
+            "pid": pid_value,
+            "lock_generation": generation,
+            "work_lease": lease,
+        }
+        path = self._path()
+        record["lock_file_path"] = path
+        issue_lock_store.save_lock_file(path, record)
+        return record
+
+
+class TestPolicyIsTheSingleSource(unittest.TestCase):
+    """AC-N7: one authoritative configuration source for every duration."""
+
+    def test_author_policy_carries_the_agreed_values(self):
+        policy = lease_policy.policy_for(lease_policy.TASK_CLASS_AUTHOR_ISSUE_WORK)
+        self.assertEqual(policy.initial_ttl_minutes, 10.0)
+        self.assertEqual(policy.heartbeat_cadence_minutes, 2.0)
+        self.assertEqual(policy.stale_warning_minutes, 5.0)
+        self.assertEqual(policy.missed_heartbeat_grace_minutes, 10.0)
+        self.assertEqual(policy.absolute_cap_hours, 8.0)
+        self.assertEqual(policy.recovery_grace_minutes, 10.0)
+        self.assertEqual(policy.terminal_race_drain_minutes, 2.0)
+        self.assertTrue(policy.terminal_retirement_eligible)
+        self.assertTrue(policy.heartbeat_lifecycle_active)
+
+    def test_the_four_hour_author_ttl_literal_is_gone(self):
+        """The duplicated literal AC-N7 exists to remove."""
+        self.assertFalse(hasattr(issue_lock_store, "WORK_LEASE_TTL_HOURS"))
+        import gitea_mcp_server
+
+        self.assertFalse(hasattr(gitea_mcp_server, "WORK_LEASE_TTL_HOURS"))
+
+    def test_declared_reviewer_values_match_the_module_still_using_them(self):
+        """Slice A declares reviewer/merger numbers without rewiring them.
+
+        Recording a value in two places is only safe if drift is detectable, so
+        this asserts the declaration still equals the constants #747 owns. When
+        Slice C migrates those call sites, this test becomes the proof the
+        migration changed nothing.
+        """
+        policy = lease_policy.policy_for(lease_policy.TASK_CLASS_REVIEWER_PR)
+        self.assertEqual(
+            policy.initial_ttl_minutes, float(reviewer_pr_lease.LEASE_TTL_MINUTES)
+        )
+        self.assertEqual(
+            policy.stale_warning_minutes,
+            float(reviewer_pr_lease.STALE_WARNING_MINUTES),
+        )
+        self.assertFalse(policy.heartbeat_lifecycle_active)
+
+    def test_declared_conflict_fix_value_matches_its_module(self):
+        policy = lease_policy.policy_for(lease_policy.TASK_CLASS_CONFLICT_FIX)
+        self.assertEqual(
+            policy.initial_ttl_minutes,
+            float(pr_work_lease.DEFAULT_CONFLICT_FIX_TTL_MINUTES),
+        )
+        self.assertFalse(policy.heartbeat_lifecycle_active)
+
+    def test_environment_override_applies(self):
+        var = lease_policy.env_var_name(
+            lease_policy.TASK_CLASS_AUTHOR_ISSUE_WORK, "initial_ttl_minutes"
+        )
+        with patch.dict(os.environ, {var: "7"}):
+            self.assertEqual(
+                lease_policy.policy_for(
+                    lease_policy.TASK_CLASS_AUTHOR_ISSUE_WORK
+                ).initial_ttl_minutes,
+                7.0,
+            )
+
+    def test_unusable_override_falls_back_instead_of_minting_a_zero_lease(self):
+        """A typo must not make every claim instantly reclaimable."""
+        var = lease_policy.env_var_name(
+            lease_policy.TASK_CLASS_AUTHOR_ISSUE_WORK, "initial_ttl_minutes"
+        )
+        for bad in ("0", "-5", "not-a-number", "   "):
+            with self.subTest(value=bad), patch.dict(os.environ, {var: bad}):
+                self.assertEqual(
+                    lease_policy.policy_for(
+                        lease_policy.TASK_CLASS_AUTHOR_ISSUE_WORK
+                    ).initial_ttl_minutes,
+                    10.0,
+                )
+
+    def test_unknown_task_class_does_not_raise(self):
+        policy = lease_policy.policy_for("something-new")
+        self.assertEqual(policy.task_class, lease_policy.TASK_CLASS_AUTHOR_ISSUE_WORK)
+
+
+class TestLifecycleDiscrimination(_LockFixture):
+    """AC-N8: the marker, never a timestamp, decides legacy vs heartbeat."""
+
+    def test_missing_marker_reads_as_legacy(self):
+        record = self.write_lock(lifecycle=None)
+        self.assertTrue(issue_lock_store.is_legacy_lease(record))
+        self.assertEqual(
+            issue_lock_store.lease_lifecycle_version(record),
+            lease_policy.LIFECYCLE_LEGACY,
+        )
+
+    def test_marker_present_reads_as_heartbeat_lifecycle(self):
+        record = self.write_lock()
+        self.assertFalse(issue_lock_store.is_legacy_lease(record))
+
+    def test_equal_created_and_heartbeat_never_implies_a_fresh_heartbeat(self):
+        """The exact inversion AC-N8 forbids.
+
+        A legacy lock has ``last_heartbeat_at == created_at`` forever because
+        nothing ever advanced it. Reading that equality as "recently
+        heartbeated" would classify every never-heartbeated lock as fresh.
+        """
+        legacy = self.write_lock(
+            lifecycle=None,
+            created_delta=timedelta(hours=3),
+            heartbeat_delta=timedelta(hours=3),
+        )
+        lease = legacy["work_lease"]
+        self.assertEqual(lease["created_at"], lease["last_heartbeat_at"])
+        self.assertTrue(issue_lock_store.is_legacy_lease(legacy))
+
+        # A brand-new heartbeat lease has them equal too, so the equality
+        # carries no information in either direction.
+        fresh = self.write_lock(
+            created_delta=timedelta(seconds=0), heartbeat_delta=timedelta(seconds=0)
+        )
+        self.assertEqual(
+            fresh["work_lease"]["created_at"],
+            fresh["work_lease"]["last_heartbeat_at"],
+        )
+        self.assertFalse(issue_lock_store.is_legacy_lease(fresh))
+
+    def test_minted_session_id_contains_no_pid(self):
+        """AC-N1: the ownership key must not be derived from the daemon pid."""
+        minted = issue_lock_store.mint_task_session_id()
+        self.assertNotIn(str(os.getpid()), minted)
+        self.assertNotEqual(minted, issue_lock_store.mint_task_session_id())
+
+
+class TestFreshnessIsHeartbeatDriven(_LockFixture):
+    """AC-N2 and the new bands."""
+
+    def test_fresh_heartbeat_is_live(self):
+        record = self.write_lock(heartbeat_delta=timedelta(minutes=1))
+        fresh = issue_lock_store.assess_lock_freshness(record, now=self.now)
+        self.assertEqual(fresh["status"], issue_lock_store.STATUS_LIVE)
+        self.assertTrue(fresh["live"])
+        self.assertFalse(fresh["heartbeat_warning"])
+
+    def test_heartbeat_past_warning_is_still_live_but_flagged(self):
+        record = self.write_lock(heartbeat_delta=timedelta(minutes=6))
+        fresh = issue_lock_store.assess_lock_freshness(record, now=self.now)
+        self.assertEqual(fresh["status"], issue_lock_store.STATUS_LIVE)
+        self.assertTrue(fresh["heartbeat_warning"])
+
+    def test_missed_heartbeat_past_grace_is_classified_explicitly(self):
+        record = self.write_lock(
+            heartbeat_delta=timedelta(minutes=11),
+            expires_delta=timedelta(minutes=30),
+        )
+        fresh = issue_lock_store.assess_lock_freshness(record, now=self.now)
+        self.assertEqual(
+            fresh["status"], issue_lock_store.STATUS_STALE_MISSED_HEARTBEAT
+        )
+        self.assertFalse(fresh["live"])
+        self.assertTrue(fresh["stale"])
+
+    def test_alive_pid_never_establishes_freshness(self):
+        """The defect in one assertion.
+
+        The recorded PID is this very process, so it is unambiguously alive —
+        and the lease is still not live, because the task stopped heartbeating.
+        """
+        record = self.write_lock(
+            pid=os.getpid(),
+            heartbeat_delta=timedelta(hours=4),
+            expires_delta=timedelta(hours=4),
+        )
+        fresh = issue_lock_store.assess_lock_freshness(record, now=self.now)
+        self.assertTrue(fresh["pid_alive"])
+        self.assertFalse(fresh["live"])
+        self.assertEqual(
+            fresh["status"], issue_lock_store.STATUS_STALE_MISSED_HEARTBEAT
+        )
+
+    def test_dead_pid_still_marks_stale_for_issue_753(self):
+        """The opposite asymmetry: dead-PID corroboration is preserved."""
+        record = self.write_lock(pid=DEAD_PID, heartbeat_delta=timedelta(minutes=1))
+        fresh = issue_lock_store.assess_lock_freshness(record, now=self.now)
+        self.assertEqual(fresh["status"], issue_lock_store.STATUS_STALE)
+        self.assertFalse(fresh["live"])
+        self.assertIn("not alive", fresh["reason"])
+
+    def test_absolute_cap_requires_readoption(self):
+        record = self.write_lock(
+            created_delta=timedelta(hours=9), heartbeat_delta=timedelta(minutes=1)
+        )
+        fresh = issue_lock_store.assess_lock_freshness(record, now=self.now)
+        self.assertEqual(fresh["status"], issue_lock_store.STATUS_STALE_ABSOLUTE_CAP)
+        self.assertIn("re-adoption", fresh["reason"])
+
+    def test_heartbeat_lifecycle_without_a_heartbeat_fails_closed(self):
+        record = self.write_lock()
+        del record["work_lease"]["last_heartbeat_at"]
+        issue_lock_store.save_lock_file(self._path(), record)
+        fresh = issue_lock_store.assess_lock_freshness(record, now=self.now)
+        self.assertEqual(
+            fresh["status"], issue_lock_store.STATUS_STALE_MISSED_HEARTBEAT
+        )
+        self.assertIn("fail closed", fresh["reason"])
+
+    def test_absent_lock(self):
+        fresh = issue_lock_store.assess_lock_freshness(None)
+        self.assertEqual(fresh["status"], issue_lock_store.STATUS_ABSENT)
+        self.assertFalse(fresh["stale"])
+
+
+class TestLegacyLocksStayProtected(_LockFixture):
+    """AC-N8: deployment must not retroactively shorten an existing claim."""
+
+    def test_legacy_lock_with_a_stale_heartbeat_remains_live(self):
+        """The deployment-safety case.
+
+        A four-hour legacy lease minted three hours ago has not heartbeated
+        once. Under the new grace it would be long gone; under its preserved
+        absolute expiry it is still live, and must stay that way.
+        """
+        record = self.write_lock(
+            lifecycle=None,
+            created_delta=timedelta(hours=3),
+            heartbeat_delta=timedelta(hours=3),
+            expires_delta=timedelta(hours=1),
+        )
+        fresh = issue_lock_store.assess_lock_freshness(record, now=self.now)
+        self.assertEqual(fresh["status"], issue_lock_store.STATUS_LIVE)
+        self.assertTrue(fresh["live"])
+        self.assertTrue(fresh["legacy_lease"])
+        self.assertTrue(fresh["legacy_expiry_preserved"])
+
+    def test_legacy_lock_past_its_absolute_expiry_is_expired_as_before(self):
+        record = self.write_lock(
+            lifecycle=None,
+            created_delta=timedelta(hours=5),
+            heartbeat_delta=timedelta(hours=5),
+            expires_delta=timedelta(hours=-1),
+        )
+        fresh = issue_lock_store.assess_lock_freshness(record, now=self.now)
+        self.assertEqual(fresh["status"], issue_lock_store.STATUS_EXPIRED)
+
+    def test_legacy_lock_is_never_reclaimed_by_the_heartbeat_band(self):
+        record = self.write_lock(
+            lifecycle=None,
+            created_delta=timedelta(hours=3),
+            heartbeat_delta=timedelta(hours=3),
+            expires_delta=timedelta(hours=1),
+        )
+        reclaim = issue_lock_store.assess_expired_lock_reclaim(record, now=self.now)
+        self.assertFalse(reclaim["reclaim_allowed"])
+
+
+class TestReclaimAfterMissedHeartbeat(_LockFixture):
+    def test_missed_heartbeat_makes_ownership_reclaimable(self):
+        record = self.write_lock(
+            pid=os.getpid(),
+            heartbeat_delta=timedelta(minutes=15),
+            expires_delta=timedelta(hours=3),
+        )
+        reclaim = issue_lock_store.assess_expired_lock_reclaim(record, now=self.now)
+        self.assertTrue(reclaim["reclaim_allowed"])
+        self.assertIn("stale_missed_heartbeat", reclaim["reasons"][0])
+
+    def test_live_lease_is_never_reclaimable(self):
+        record = self.write_lock(heartbeat_delta=timedelta(minutes=1))
+        reclaim = issue_lock_store.assess_expired_lock_reclaim(record, now=self.now)
+        self.assertFalse(reclaim["reclaim_allowed"])
+
+    def test_dead_pid_reclaim_path_is_unchanged(self):
+        """#753 must keep working through its original conditions."""
+        record = self.write_lock(pid=DEAD_PID, heartbeat_delta=timedelta(minutes=1))
+        reclaim = issue_lock_store.assess_expired_lock_reclaim(record, now=self.now)
+        self.assertTrue(reclaim["reclaim_allowed"])
+        self.assertTrue(reclaim["owner_pid_dead"])
+
+
+class TestHeartbeatWriter(_LockFixture):
+    """A4: flock + CAS + exact verification, and no revival path."""
+
+    def _heartbeat(self, **kwargs):
+        params = {
+            "remote": REMOTE,
+            "org": ORG,
+            "repo": REPO,
+            "issue_number": ISSUE,
+            "branch_name": BRANCH,
+            "worktree_path": self.worktree,
+            "identity": IDENTITY,
+            "profile": PROFILE,
+            "task_session_id": "author_issue_work-aaaabbbbccccdddd",
+            "lock_dir": self.lock_dir.name,
+            "now": self.now,
+        }
+        params.update(kwargs)
+        return issue_lock_store.heartbeat_session_lock(**params)
+
+    def test_heartbeat_slides_expiry_and_advances_generation(self):
+        self.write_lock(heartbeat_delta=timedelta(minutes=4), generation=5)
+        result = self._heartbeat()
+        self.assertTrue(result["success"], result)
+        self.assertEqual(result["prior_generation"], 5)
+        self.assertEqual(result["lock_generation"], 6)
+        self.assertEqual(result["heartbeat_count"], 1)
+        self.assertEqual(result["last_heartbeat_at"], _ts(self.now))
+        self.assertEqual(result["expires_at"], _ts(self.now + timedelta(minutes=10)))
+        self.assertTrue(result["freshness"]["live"])
+
+    def test_heartbeat_is_durable_and_repeatable(self):
+        self.write_lock(heartbeat_delta=timedelta(minutes=4))
+        self._heartbeat()
+        second = self._heartbeat(now=self.now + timedelta(minutes=1))
+        self.assertTrue(second["success"], second)
+        self.assertEqual(second["heartbeat_count"], 2)
+        written = issue_lock_store.read_lock_file(self._path())
+        self.assertEqual(written["work_lease"]["heartbeat_count"], 2)
+
+    def test_stale_generation_is_refused(self):
+        self.write_lock(generation=5)
+        result = self._heartbeat(expected_generation=4)
+        self.assertFalse(result["success"])
+        self.assertIn("generation changed", result["reasons"][0])
+
+    def test_foreign_session_is_refused(self):
+        self.write_lock()
+        result = self._heartbeat(task_session_id="author_issue_work-ffffffffffffffff")
+        self.assertFalse(result["success"])
+        self.assertIn("task_session_id does not match", " ".join(result["reasons"]))
+
+    def test_missing_session_id_is_refused(self):
+        self.write_lock()
+        result = self._heartbeat(task_session_id="")
+        self.assertFalse(result["success"])
+
+    def test_foreign_claimant_is_refused(self):
+        self.write_lock()
+        for field, value in (
+            ("identity", "someone-else"),
+            ("profile", "other-profile"),
+        ):
+            with self.subTest(field=field):
+                result = self._heartbeat(**{field: value})
+                self.assertFalse(result["success"])
+
+    def test_branch_and_worktree_mismatch_are_refused(self):
+        self.write_lock()
+        wrong_branch = self._heartbeat(branch_name=f"fix/issue-{ISSUE}-other")
+        self.assertFalse(wrong_branch["success"])
+        wrong_worktree = self._heartbeat(worktree_path="/tmp/not-the-worktree")
+        self.assertFalse(wrong_worktree["success"])
+
+    def test_lapsed_lease_cannot_be_heartbeated_back_to_life(self):
+        """No revival path (A4).
+
+        A session that stopped proving liveness must reclaim under a fresh
+        generation, not restore ownership retroactively.
+        """
+        self.write_lock(
+            heartbeat_delta=timedelta(minutes=30), expires_delta=timedelta(hours=1)
+        )
+        result = self._heartbeat()
+        self.assertFalse(result["success"])
+        self.assertIn("reclaimed", " ".join(result["reasons"]))
+
+    def test_absent_lock_cannot_be_created_by_heartbeat(self):
+        result = self._heartbeat()
+        self.assertFalse(result["success"])
+        self.assertIn("no durable lock", result["reasons"][0])
+
+    def test_legacy_lock_is_refused_until_rebound(self):
+        self.write_lock(lifecycle=None)
+        result = self._heartbeat()
+        self.assertFalse(result["success"])
+        self.assertTrue(result["legacy_lease"])
+        self.assertIn("rebound", " ".join(result["reasons"]))
+
+
+class TestLegacyRebind(_LockFixture):
+    """AC-N8 exit route: canonical exact-owner rebinding."""
+
+    def _rebind(self, **kwargs):
+        params = {
+            "remote": REMOTE,
+            "org": ORG,
+            "repo": REPO,
+            "issue_number": ISSUE,
+            "branch_name": BRANCH,
+            "worktree_path": self.worktree,
+            "identity": IDENTITY,
+            "profile": PROFILE,
+            "lock_dir": self.lock_dir.name,
+            "now": self.now,
+        }
+        params.update(kwargs)
+        return issue_lock_store.rebind_legacy_lock(**params)
+
+    def test_rebind_mints_a_session_and_a_genuine_first_heartbeat(self):
+        self.write_lock(
+            lifecycle=None,
+            created_delta=timedelta(hours=3),
+            heartbeat_delta=timedelta(hours=3),
+            expires_delta=timedelta(hours=1),
+            generation=2,
+        )
+        result = self._rebind()
+        self.assertTrue(result["success"], result)
+        self.assertTrue(result["task_session_id"])
+        self.assertEqual(result["lock_generation"], 3)
+
+        written = issue_lock_store.read_lock_file(self._path())
+        lease = written["work_lease"]
+        self.assertEqual(
+            lease["lifecycle_version"], lease_policy.LIFECYCLE_HEARTBEAT_V1
+        )
+        self.assertEqual(lease["last_heartbeat_at"], _ts(self.now))
+        self.assertEqual(lease["expires_at"], _ts(self.now + timedelta(minutes=10)))
+        self.assertFalse(issue_lock_store.is_legacy_lease(written))
+        # The original claim is preserved for audit rather than overwritten.
+        origin = written["legacy_rebind"]["legacy_origin"]
+        self.assertTrue(origin["created_at"])
+        self.assertEqual(origin["lifecycle"], lease_policy.LIFECYCLE_LEGACY)
+
+    def test_rebound_lock_can_then_heartbeat(self):
+        self.write_lock(
+            lifecycle=None,
+            created_delta=timedelta(hours=3),
+            heartbeat_delta=timedelta(hours=3),
+            expires_delta=timedelta(hours=1),
+        )
+        rebound = self._rebind()
+        beat = issue_lock_store.heartbeat_session_lock(
+            remote=REMOTE,
+            org=ORG,
+            repo=REPO,
+            issue_number=ISSUE,
+            branch_name=BRANCH,
+            worktree_path=self.worktree,
+            identity=IDENTITY,
+            profile=PROFILE,
+            task_session_id=rebound["task_session_id"],
+            lock_dir=self.lock_dir.name,
+            now=self.now + timedelta(minutes=1),
+        )
+        self.assertTrue(beat["success"], beat)
+
+    def test_rebind_refuses_a_foreign_owner(self):
+        self.write_lock(lifecycle=None, expires_delta=timedelta(hours=1))
+        result = self._rebind(identity="someone-else")
+        self.assertFalse(result["success"])
+
+    def test_rebind_refuses_a_lock_already_on_the_lifecycle(self):
+        self.write_lock()
+        result = self._rebind()
+        self.assertFalse(result["success"])
+        self.assertFalse(result["legacy_lease"])
+
+    def test_rebind_is_not_a_recovery_path_for_a_lapsed_legacy_lease(self):
+        """An expired legacy lease belongs to #760 renewal or #601 reclaim."""
+        self.write_lock(
+            lifecycle=None,
+            created_delta=timedelta(hours=5),
+            heartbeat_delta=timedelta(hours=5),
+            expires_delta=timedelta(hours=-1),
+        )
+        result = self._rebind()
+        self.assertFalse(result["success"])
+        self.assertIn("not a recovery path", " ".join(result["reasons"]))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_issue_794_conflict_gate_reclaim.py

@@ -0,0 +1,193 @@
+"""Conflict gate honors heartbeat-lifecycle non-live reclaim bands (#790 review #502/#516).
+
+``assess_expired_lock_reclaim`` already permits reclaim for the heartbeat-lifecycle
+stale bands (``stale_missed_heartbeat``, ``stale_absolute_cap``) without a dead PID.
+But ``assess_same_issue_lease_conflict`` used to enter that reclaim branch only under
+``is_lease_expired`` (``expires_at <= now``). For a heartbeat-lifecycle lease that is
+non-live yet whose ``expires_at`` is still in the future, the acquisition gate fell
+through to the foreign "already has an active lease" block and never consulted the
+reclaim assessor — so the load-bearing heartbeat was not load-bearing for foreign
+reclaim, the exact abandonment scenario #790 exists to fix.
+
+Two future-``expires_at`` non-live shapes are reachable:
+
+* ``stale_absolute_cap`` — a session that keeps heartbeating past the 8h absolute cap
+  has ``expires_at = last_heartbeat + TTL`` in the future (default policy).
+* ``stale_missed_heartbeat`` — under an independent TTL>grace policy the heartbeat
+  grace lapses while ``expires_at`` is still ahead.
+
+These tests pin: both reclaim from a foreign acquirer; a live lease still blocks a
+foreign acquirer; the same owner may reclaim its own abandoned heartbeat lease; and a
+legacy (pre-lifecycle) lock keeps its absolute-``expires_at`` clock — a non-expired
+legacy lock with a dead PID is *not* reclaimable through this path.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import unittest
+from datetime import datetime, timedelta, timezone
+from unittest import mock
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import issue_lock_store as ils  # noqa: E402
+import lease_policy  # noqa: E402
+
+ISSUE = 790
+OWNER_BRANCH = f"fix/issue-{ISSUE}-slice-a-heartbeat-policy"
+OWNER_WORKTREE = "/tmp/wt-790-owner"
+FOREIGN_BRANCH = f"fix/issue-{ISSUE}-foreign-attempt"
+FOREIGN_WORKTREE = "/tmp/wt-790-foreign"
+
+
+def _ts(moment: datetime) -> str:
+    return (
+        moment.astimezone(timezone.utc)
+        .replace(microsecond=0)
+        .isoformat()
+        .replace("+00:00", "Z")
+    )
+
+
+class _ConflictGateBase(unittest.TestCase):
+    def setUp(self):
+        self.now = datetime(2026, 7, 23, 12, 0, 0, tzinfo=timezone.utc)
+
+    def _lock(
+        self,
+        *,
+        lifecycle: str | None,
+        created_ago: timedelta,
+        heartbeat_ago: timedelta,
+        expires_in: timedelta,
+        pid: int,
+    ) -> dict:
+        lease: dict = {
+            "operation_type": ils.AUTHOR_ISSUE_WORK_LEASE,
+            "issue_number": ISSUE,
+            "branch": OWNER_BRANCH,
+            "worktree_path": OWNER_WORKTREE,
+            "created_at": _ts(self.now - created_ago),
+            "last_heartbeat_at": _ts(self.now - heartbeat_ago),
+            "expires_at": _ts(self.now + expires_in),
+        }
+        if lifecycle is not None:
+            lease["lifecycle_version"] = lifecycle
+            lease["task_session_id"] = "author_issue_work-deadbeefdeadbeef"
+        return {
+            "issue_number": ISSUE,
+            "branch_name": OWNER_BRANCH,
+            "remote": "prgs",
+            "org": "Scaled-Tech-Consulting",
+            "repo": "Gitea-Tools",
+            "worktree_path": OWNER_WORKTREE,
+            "session_pid": pid,
+            "pid": pid,
+            "work_lease": lease,
+        }
+
+    def _foreign_conflict(self, existing: dict) -> str | None:
+        return ils.assess_same_issue_lease_conflict(
+            existing,
+            issue_number=ISSUE,
+            branch_name=FOREIGN_BRANCH,
+            worktree_path=FOREIGN_WORKTREE,
+            now=self.now,
+        )
+
+    def _same_owner_conflict(self, existing: dict) -> str | None:
+        return ils.assess_same_issue_lease_conflict(
+            existing,
+            issue_number=ISSUE,
+            branch_name=OWNER_BRANCH,
+            worktree_path=OWNER_WORKTREE,
+            now=self.now,
+        )
+
+
+class TestHeartbeatNonLiveFutureExpiresReclaim(_ConflictGateBase):
+    def test_stale_absolute_cap_future_expires_allows_foreign_reclaim(self):
+        # Created >8h ago, heartbeated one minute ago, expires 9 min in the FUTURE,
+        # owner PID alive: freshness = stale_absolute_cap, live=False, not expired.
+        existing = self._lock(
+            lifecycle=lease_policy.LIFECYCLE_HEARTBEAT_V1,
+            created_ago=timedelta(hours=9),
+            heartbeat_ago=timedelta(minutes=1),
+            expires_in=timedelta(minutes=9),
+            pid=os.getpid(),
+        )
+        freshness = ils.assess_lock_freshness(existing, now=self.now)
+        self.assertEqual(freshness["status"], ils.STATUS_STALE_ABSOLUTE_CAP)
+        self.assertFalse(freshness["live"])
+        self.assertFalse(ils.is_lease_expired(existing, now=self.now))
+        with mock.patch.object(ils, "is_process_alive", return_value=True):
+            self.assertIsNone(self._foreign_conflict(existing))
+
+    def test_missed_heartbeat_ttl_gt_grace_future_expires_allows_foreign_reclaim(self):
+        # Heartbeat grace (default 10 min) lapsed 5 min ago, but a TTL>grace policy
+        # leaves expires_at 20 min in the FUTURE: stale_missed_heartbeat, not expired.
+        existing = self._lock(
+            lifecycle=lease_policy.LIFECYCLE_HEARTBEAT_V1,
+            created_ago=timedelta(minutes=30),
+            heartbeat_ago=timedelta(minutes=15),
+            expires_in=timedelta(minutes=20),
+            pid=os.getpid(),
+        )
+        freshness = ils.assess_lock_freshness(existing, now=self.now)
+        self.assertEqual(freshness["status"], ils.STATUS_STALE_MISSED_HEARTBEAT)
+        self.assertFalse(freshness["live"])
+        self.assertFalse(ils.is_lease_expired(existing, now=self.now))
+        with mock.patch.object(ils, "is_process_alive", return_value=True):
+            self.assertIsNone(self._foreign_conflict(existing))
+
+    def test_same_owner_may_reclaim_its_own_abandoned_heartbeat_lease(self):
+        existing = self._lock(
+            lifecycle=lease_policy.LIFECYCLE_HEARTBEAT_V1,
+            created_ago=timedelta(hours=9),
+            heartbeat_ago=timedelta(minutes=1),
+            expires_in=timedelta(minutes=9),
+            pid=os.getpid(),
+        )
+        with mock.patch.object(ils, "is_process_alive", return_value=True):
+            self.assertIsNone(self._same_owner_conflict(existing))
+
+
+class TestLiveAndLegacyStillBlockForeign(_ConflictGateBase):
+    def test_live_heartbeat_lease_still_blocks_foreign(self):
+        existing = self._lock(
+            lifecycle=lease_policy.LIFECYCLE_HEARTBEAT_V1,
+            created_ago=timedelta(minutes=5),
+            heartbeat_ago=timedelta(minutes=1),
+            expires_in=timedelta(minutes=9),
+            pid=os.getpid(),
+        )
+        freshness = ils.assess_lock_freshness(existing, now=self.now)
+        self.assertTrue(freshness["live"])
+        with mock.patch.object(ils, "is_process_alive", return_value=True):
+            block = self._foreign_conflict(existing)
+        self.assertIn("already has an active", block or "")
+
+    def test_legacy_lease_future_expires_dead_pid_is_not_reclaimed_here(self):
+        # AC-N8: a legacy lock keeps its absolute expires_at clock. Non-expired +
+        # dead PID is non-live, but the widened band excludes legacy, so the
+        # foreign acquirer is still blocked rather than silently reclaiming.
+        existing = self._lock(
+            lifecycle=None,
+            created_ago=timedelta(hours=9),
+            heartbeat_ago=timedelta(hours=9),
+            expires_in=timedelta(hours=2),
+            pid=4_194_304,  # far above any live pid on a test host
+        )
+        with mock.patch.object(ils, "is_process_alive", return_value=False):
+            freshness = ils.assess_lock_freshness(existing, now=self.now)
+            self.assertTrue(freshness["legacy_lease"])
+            self.assertFalse(freshness["live"])
+            self.assertFalse(ils.is_lease_expired(existing, now=self.now))
+            block = self._foreign_conflict(existing)
+        self.assertIn("already has an active", block or "")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_issue_872_dead_session_two_base_syncs.py

@@ -1,332 +0,0 @@
-"""Dead-session recovery for cross-session PR base-syncs (#872).
-
-Validates that when a sanctioned server-side base-sync (``gitea_update_pr_branch_by_merge``)
-advances a PR's remote head from A to B (a merge commit whose first parent is A),
-a subsequent author session whose local worktree is at A can recover the dead-session
-lock via HEAD_RELATION_REMOTE_MERGE_SYNCED and execute a second base-sync (B to C)
-without deadlock or RuntimeError.
-"""
-
-from __future__ import annotations
-
-import os
-import subprocess
-import sys
-import tempfile
-import unittest
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-import issue_lock_recovery  # noqa: E402
-import issue_lock_store  # noqa: E402
-import issue_lock_worktree  # noqa: E402
-
-ISSUE = 8720
-PR_NUMBER = 8721
-BRANCH = f"fix/issue-{ISSUE}-dead-session-two-base-syncs"
-IDENTITY = "example-author"
-PROFILE = "prgs-author"
-REMOTE = "prgs"
-ORG = "ExampleOrg"
-REPO = "ExampleRepo"
-
-
-def dead_pid() -> int:
-    proc = subprocess.Popen([sys.executable, "-c", "pass"])
-    proc.wait()
-    return proc.pid
-
-
-def future_ts(hours: int = 4) -> str:
-    return (
-        (datetime.now(timezone.utc) + timedelta(hours=hours))
-        .isoformat()
-        .replace("+00:00", "Z")
-    )
-
-
-def _git(cwd, *args):
-    return subprocess.run(
-        ["git", "-C", cwd, *args],
-        capture_output=True,
-        text=True,
-        check=True,
-    )
-
-
-def _rev(cwd, ref="HEAD") -> str:
-    return _git(cwd, "rev-parse", ref).stdout.strip()
-
-
-def build_two_base_sync_repo(tmp: str) -> dict:
-    """Build a repo simulating two sequential base-sync merges."""
-    _git(tmp, "init", "-q", "-b", "master")
-    _git(tmp, "config", "user.email", "[email protected]")
-    _git(tmp, "config", "user.name", "Author")
-    Path(tmp, "base.txt").write_text("base 1\n")
-    _git(tmp, "add", "-A")
-    _git(tmp, "commit", "-q", "-m", "initial master")
-
-    # Feature branch cut from initial master -> Head A (prior/recorded head)
-    _git(tmp, "checkout", "-q", "-b", BRANCH)
-    Path(tmp, "feature.txt").write_text("feature work\n")
-    _git(tmp, "add", "-A")
-    _git(tmp, "commit", "-q", "-m", "feature commit A")
-    head_a = _rev(tmp)
-
-    # Master advances -> Master 1
-    _git(tmp, "checkout", "-q", "master")
-    Path(tmp, "base.txt").write_text("base 1\nbase 2\n")
-    _git(tmp, "add", "-A")
-    _git(tmp, "commit", "-q", "-m", "master advance 1")
-    master_1 = _rev(tmp)
-
-    # First sync: merge master into feature -> Head B (merge commit, first parent = A)
-    _git(tmp, "checkout", "-q", BRANCH)
-    _git(tmp, "merge", "-q", "--no-ff", "-m", "First base-sync (merge master)", "master")
-    head_b = _rev(tmp)
-
-    # Master advances again -> Master 2
-    _git(tmp, "checkout", "-q", "master")
-    Path(tmp, "base.txt").write_text("base 1\nbase 2\nbase 3\n")
-    _git(tmp, "add", "-A")
-    _git(tmp, "commit", "-q", "-m", "master advance 2")
-    master_2 = _rev(tmp)
-
-    # Second sync: merge master into feature -> Head C (merge commit, first parent = B)
-    _git(tmp, "checkout", "-q", BRANCH)
-    _git(tmp, "merge", "-q", "--no-ff", "-m", "Second base-sync (merge master)", "master")
-    head_c = _rev(tmp)
-
-    # Non-merge rebase/force-pushed branch shape
-    _git(tmp, "checkout", "-q", "-b", "rebased-branch", head_a)
-    Path(tmp, "rebase.txt").write_text("rebased\n")
-    _git(tmp, "add", "-A")
-    _git(tmp, "commit", "-q", "-m", "rebased commit")
-    rebased_head = _rev(tmp)
-
-    # Reset worktree back to head A, as a dead session leaving local worktree at A
-    _git(tmp, "checkout", "-q", BRANCH)
-    _git(tmp, "reset", "-q", "--hard", head_a)
-
-    return {
-        "head_a": head_a,
-        "master_1": master_1,
-        "head_b": head_b,
-        "master_2": master_2,
-        "head_c": head_c,
-        "rebased_head": rebased_head,
-    }
-
-
-def make_dead_lock(worktree, **over):
-    pid = dead_pid()
-    lock = {
-        "issue_number": ISSUE,
-        "branch_name": BRANCH,
-        "worktree_path": worktree,
-        "remote": REMOTE,
-        "org": ORG,
-        "repo": REPO,
-        "session_pid": pid,
-        "pid": pid,
-        "claimant": {"username": IDENTITY, "profile": PROFILE},
-        "work_lease": {
-            "operation_type": issue_lock_store.AUTHOR_ISSUE_WORK_LEASE,
-            "issue_number": ISSUE,
-            "branch": BRANCH,
-            "worktree_path": worktree,
-            "claimant": {"username": IDENTITY, "profile": PROFILE},
-            "expires_at": future_ts(),
-        },
-    }
-    lock.update(over)
-    return lock
-
-
-class TestDeadSessionTwoBaseSyncs(unittest.TestCase):
-    def setUp(self):
-        self.tmp = tempfile.mkdtemp()
-        self.shas = build_two_base_sync_repo(self.tmp)
-        self.head_a = self.shas["head_a"]
-        self.head_b = self.shas["head_b"]
-        self.head_c = self.shas["head_c"]
-
-    def test_first_base_sync_dead_session_recovery(self):
-        """AC1: dead session after first base sync (remote=B, local=A) recovers via merge-sync."""
-        lock = make_dead_lock(self.tmp, synced_pr_head=self.head_b)
-        obs = issue_lock_worktree.read_merge_sync_provenance(
-            self.tmp,
-            prior_head_sha=self.head_a,
-            synced_head_sha=self.head_b,
-            remote=REMOTE,
-        )
-        self.assertTrue(obs["is_merge_sync"], obs["reasons"])
-        self.assertTrue(obs["prior_is_ancestor"])
-        self.assertTrue(obs["synced_is_merge"])
-        self.assertTrue(obs["first_parent_reaches_prior"])
-
-        res = issue_lock_recovery.assess_dead_session_lock_recovery(
-            lock,
-            issue_number=ISSUE,
-            branch_name=BRANCH,
-            worktree_path=self.tmp,
-            remote=REMOTE,
-            org=ORG,
-            repo=REPO,
-            identity=IDENTITY,
-            profile=PROFILE,
-            current_branch=BRANCH,
-            porcelain_status="",
-            head_sha=self.head_a,
-            remote_head_sha=self.head_b,
-            pr_head_sha=self.head_b,
-            pr_number=PR_NUMBER,
-            competing_live_locks=[],
-            candidate_branches=[BRANCH],
-            current_pid=os.getpid(),
-            remote_branch_exists=True,
-            sync_provenance=obs,
-        )
-        self.assertEqual(res["outcome"], issue_lock_recovery.RECOVERY_SANCTIONED, res["reasons"])
-        self.assertEqual(
-            res["evidence"]["head_relation"],
-            issue_lock_recovery.HEAD_RELATION_REMOTE_MERGE_SYNCED,
-        )
-        self.assertEqual(res["evidence"]["accepted_head"], self.head_b)
-
-    def test_second_base_sync_head_refresh_after_recovery(self):
-        """AC2: after recovery, second base sync (remote B -> C) updates durable lock head."""
-        lock_dir = tempfile.mkdtemp()
-        lock_data = make_dead_lock(self.tmp, synced_pr_head=self.head_b)
-        # Rebind to current PID as gitea_lock_issue does upon sanctioned recovery
-        lock_data["session_pid"] = os.getpid()
-        lock_data["pid"] = os.getpid()
-        issue_lock_store.save_lock_file(
-            issue_lock_store.lock_file_path(
-                remote=REMOTE, org=ORG, repo=REPO, issue_number=ISSUE, lock_dir=lock_dir
-            ),
-            lock_data,
-        )
-
-        refresh_res = issue_lock_store.apply_durable_lock_head_refresh(
-            remote=REMOTE,
-            org=ORG,
-            repo=REPO,
-            issue_number=ISSUE,
-            branch_name=BRANCH,
-            worktree_path=self.tmp,
-            pr_number=PR_NUMBER,
-            identity=IDENTITY,
-            profile=PROFILE,
-            current_pid=os.getpid(),
-            expected_old_head=self.head_b,
-            new_head=self.head_c,
-            synced_at=future_ts(0),
-            base_head=self.shas["master_2"],
-            lock_dir=lock_dir,
-        )
-        self.assertTrue(refresh_res["refreshed"], refresh_res["reasons"])
-        self.assertTrue(refresh_res["read_after_write_ok"])
-        loaded = issue_lock_store.load_issue_lock(
-            remote=REMOTE, org=ORG, repo=REPO, issue_number=ISSUE, lock_dir=lock_dir
-        )
-        self.assertEqual(loaded.get("synced_pr_head"), self.head_c)
-
-    def test_dirty_worktree_blocks_recovery(self):
-        """AC3: tracked dirty edits block dead-session recovery."""
-        lock = make_dead_lock(self.tmp)
-        obs = issue_lock_worktree.read_merge_sync_provenance(
-            self.tmp, prior_head_sha=self.head_a, synced_head_sha=self.head_b
-        )
-        res = issue_lock_recovery.assess_dead_session_lock_recovery(
-            lock,
-            issue_number=ISSUE,
-            branch_name=BRANCH,
-            worktree_path=self.tmp,
-            remote=REMOTE,
-            org=ORG,
-            repo=REPO,
-            identity=IDENTITY,
-            profile=PROFILE,
-            current_branch=BRANCH,
-            porcelain_status=" M feature.txt\n",
-            head_sha=self.head_a,
-            remote_head_sha=self.head_b,
-            pr_head_sha=self.head_b,
-            pr_number=PR_NUMBER,
-            competing_live_locks=[],
-            candidate_branches=[BRANCH],
-            current_pid=os.getpid(),
-            remote_branch_exists=True,
-            sync_provenance=obs,
-        )
-        self.assertEqual(res["outcome"], issue_lock_recovery.REFUSED)
-        self.assertTrue(any("dirty" in r or "tracked" in r for r in res["reasons"]))
-
-    def test_foreign_reclaimer_blocks_recovery(self):
-        """AC4: a foreign claimant cannot recover a dead-session lock."""
-        lock = make_dead_lock(self.tmp)
-        obs = issue_lock_worktree.read_merge_sync_provenance(
-            self.tmp, prior_head_sha=self.head_a, synced_head_sha=self.head_b
-        )
-        res = issue_lock_recovery.assess_dead_session_lock_recovery(
-            lock,
-            issue_number=ISSUE,
-            branch_name=BRANCH,
-            worktree_path=self.tmp,
-            remote=REMOTE,
-            org=ORG,
-            repo=REPO,
-            identity="intruder-user",
-            profile=PROFILE,
-            current_branch=BRANCH,
-            porcelain_status="",
-            head_sha=self.head_a,
-            remote_head_sha=self.head_b,
-            pr_head_sha=self.head_b,
-            pr_number=PR_NUMBER,
-            competing_live_locks=[],
-            candidate_branches=[BRANCH],
-            current_pid=os.getpid(),
-            remote_branch_exists=True,
-            sync_provenance=obs,
-        )
-        self.assertEqual(res["outcome"], issue_lock_recovery.REFUSED)
-
-    def test_non_merge_rebased_remote_head_blocks_recovery(self):
-        """AC5: a rebased/force-pushed remote head (not a merge commit) is refused."""
-        lock = make_dead_lock(self.tmp)
-        obs = issue_lock_worktree.read_merge_sync_provenance(
-            self.tmp, prior_head_sha=self.head_a, synced_head_sha=self.shas["rebased_head"]
-        )
-        self.assertFalse(obs["is_merge_sync"])
-        res = issue_lock_recovery.assess_dead_session_lock_recovery(
-            lock,
-            issue_number=ISSUE,
-            branch_name=BRANCH,
-            worktree_path=self.tmp,
-            remote=REMOTE,
-            org=ORG,
-            repo=REPO,
-            identity=IDENTITY,
-            profile=PROFILE,
-            current_branch=BRANCH,
-            porcelain_status="",
-            head_sha=self.head_a,
-            remote_head_sha=self.shas["rebased_head"],
-            pr_head_sha=self.shas["rebased_head"],
-            pr_number=PR_NUMBER,
-            competing_live_locks=[],
-            candidate_branches=[BRANCH],
-            current_pid=os.getpid(),
-            remote_branch_exists=True,
-            sync_provenance=obs,
-        )
-        self.assertEqual(res["outcome"], issue_lock_recovery.REFUSED)
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_webui_analytics.py

@@ -0,0 +1,252 @@
+"""Unit and integration tests for Model Usage & Performance Analytics (#651)."""
+
+from __future__ import annotations
+
+import os
+import tempfile
+import unittest
+from starlette.testclient import TestClient
+
+import control_plane_db
+from webui.analytics_loader import (
+    ANALYTICS_SCHEMA_VERSION,
+    compute_percentile,
+    load_analytics,
+    record_usage,
+)
+from webui.app import create_app
+from webui import console_redaction
+
+
+class AnalyticsLoaderTest(unittest.TestCase):
+
+    def setUp(self) -> None:
+        self.temp_dir = tempfile.TemporaryDirectory()
+        self.db_path = os.path.join(self.temp_dir.name, "test_control_plane.sqlite3")
+        os.environ["GITEA_CONTROL_PLANE_DB"] = self.db_path
+        self.db = control_plane_db.ControlPlaneDB(db_path=self.db_path)
+
+    def tearDown(self) -> None:
+        self.temp_dir.cleanup()
+
+    def test_compute_percentile(self) -> None:
+        self.assertIsNone(compute_percentile([], 50.0))
+        self.assertEqual(compute_percentile([100], 50.0), 100.0)
+
+        # 2 elements: [100, 200]
+        self.assertEqual(compute_percentile([100, 200], 50.0), 150.0)
+
+        # 100 elements: 1..100
+        vals = list(range(1, 101))
+        self.assertEqual(compute_percentile(vals, 50.0), 50.5)
+        self.assertAlmostEqual(compute_percentile(vals, 90.0), 90.1)
+
+    def test_record_and_aggregate_usage(self) -> None:
+        # Record event 1 (complete data)
+        u1 = record_usage(
+            db_path=self.db_path,
+            remote="dadeschools",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            role="author",
+            model="gemini-3.6-flash",
+            issue_number=651,
+            stage="implementation",
+            input_tokens=1000,
+            output_tokens=500,
+            estimated_cost_usd=0.0015,
+            latency_ms=200,
+            duration_ms=3000,
+            metadata={"secret_key": "secret123", "note": "token=secret123"},
+        )
+        self.assertGreater(u1, 0)
+
+        # Record event 2 (missing tokens and cost -> unknown)
+        u2 = record_usage(
+            db_path=self.db_path,
+            remote="dadeschools",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            role="reviewer",
+            model="claude-3-5-sonnet",
+            pr_number=846,
+            stage="review",
+            latency_ms=500,
+            duration_ms=6000,
+        )
+        self.assertGreater(u2, u1)
+
+        snapshot = load_analytics(
+            db_path=self.db_path,
+            remote="dadeschools",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+        )
+
+        self.assertTrue(snapshot.ok)
+        self.assertEqual(snapshot.schema_version, ANALYTICS_SCHEMA_VERSION)
+        self.assertEqual(snapshot.total_events, 2)
+
+        # Verify overall summary
+        summary = snapshot.overall_summary
+        self.assertEqual(summary.total_events, 2)
+        self.assertEqual(summary.events_with_tokens, 1)
+        self.assertEqual(summary.total_tokens, 1500)
+        self.assertEqual(summary.events_with_cost, 1)
+        self.assertEqual(summary.estimated_cost_usd, 0.0015)
+        self.assertEqual(summary.events_with_latency, 2)
+        self.assertEqual(summary.latency_p50_ms, 350.0)
+
+        # Verify missing data handling (AC 3: not zero-fabricated)
+        reviewer_model = snapshot.by_model.get("claude-3-5-sonnet")
+        self.assertIsNotNone(reviewer_model)
+        self.assertEqual(reviewer_model.total_events, 1)
+        self.assertEqual(reviewer_model.events_with_tokens, 0)
+        self.assertIsNone(reviewer_model.total_tokens)
+        self.assertEqual(reviewer_model.display_tokens, "Unknown")
+        self.assertEqual(reviewer_model.events_with_cost, 0)
+        self.assertIsNone(reviewer_model.estimated_cost_usd)
+        self.assertEqual(reviewer_model.display_cost, "Unknown")
+
+        # Verify redaction (AC 4)
+        e1 = [e for e in snapshot.events if e.usage_id == u1][0]
+        self.assertIsNotNone(e1.metadata)
+        self.assertNotIn("secret123", e1.metadata)
+        self.assertIn("[REDACTED]", e1.metadata)
+
+    def test_missing_db_fail_soft(self) -> None:
+        invalid_path = "/nonexistent_path_dir/db.sqlite3"
+        snapshot = load_analytics(db_path=invalid_path)
+        self.assertFalse(snapshot.ok)
+        self.assertIn("control_plane_db_unavailable", snapshot.reason)
+        self.assertEqual(snapshot.overall_summary.display_tokens, "Unknown")
+
+
+class AnalyticsWebUITest(unittest.TestCase):
+
+    def setUp(self) -> None:
+        self.temp_dir = tempfile.TemporaryDirectory()
+        self.db_path = os.path.join(self.temp_dir.name, "test_webui.sqlite3")
+        os.environ["GITEA_CONTROL_PLANE_DB"] = self.db_path
+        self.app = create_app()
+        self.client = TestClient(self.app)
+
+        record_usage(
+            db_path=self.db_path,
+            remote="dadeschools",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            role="author",
+            model="gemini-3.6-flash",
+            issue_number=651,
+            stage="implementation",
+            input_tokens=2000,
+            output_tokens=1000,
+            estimated_cost_usd=0.003,
+            latency_ms=150,
+            duration_ms=2500,
+        )
+
+    def tearDown(self) -> None:
+        self.temp_dir.cleanup()
+
+    def test_analytics_html_route(self) -> None:
+        response = self.client.get("/analytics")
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("Model Usage & Performance Analytics", response.text)
+        self.assertIn("gemini-3.6-flash", response.text)
+        self.assertIn("3,000", response.text)
+
+    def test_analytics_api_route(self) -> None:
+        response = self.client.get("/api/v1/analytics")
+        self.assertEqual(response.status_code, 200)
+        data = response.json()
+        self.assertTrue(data["ok"])
+        self.assertEqual(data["total_events"], 1)
+        self.assertIn("gemini-3.6-flash", data["by_model"])
+
+    def test_analytics_ingest_unauthorized_denied(self) -> None:
+        """F2: unauthenticated POST must not write the control-plane DB."""
+        payload = {
+            "remote": "dadeschools",
+            "org": "Scaled-Tech-Consulting",
+            "repo": "Gitea-Tools",
+            "role": "reviewer",
+            "model": "claude-3-5-sonnet",
+            "pr_number": 846,
+            "stage": "review",
+            "input_tokens": 500,
+            "output_tokens": 100,
+            "latency_ms": 400,
+            "metadata": "Review note token=secret456",
+        }
+        response = self.client.post("/api/v1/analytics/usage", json=payload)
+        self.assertEqual(response.status_code, 403)
+        res_json = response.json()
+        self.assertFalse(res_json.get("ok", True))
+        self.assertEqual(res_json.get("error"), "unauthorized")
+        authorization = res_json.get("authorization") or {}
+        self.assertFalse(authorization.get("allowed"))
+        self.assertFalse(authorization.get("execution_enabled"))
+
+        # No new row written
+        res2 = self.client.get("/api/v1/analytics")
+        self.assertEqual(res2.status_code, 200)
+        self.assertEqual(res2.json()["total_events"], 1)
+
+    def test_html_escapes_script_bearing_model_role_stage(self) -> None:
+        """F1: stored XSS — dynamic model/role/stage must render escaped."""
+        xss = '<script>alert(1)</script>'
+        record_usage(
+            db_path=self.db_path,
+            remote="dadeschools",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            role=xss,
+            model=xss,
+            stage=xss,
+            issue_number=999,
+            status="success",
+        )
+        response = self.client.get("/analytics")
+        self.assertEqual(response.status_code, 200)
+        # Raw tag must not appear; escaped form must.
+        self.assertNotIn("<script>alert(1)</script>", response.text)
+        self.assertIn("&lt;script&gt;alert(1)&lt;/script&gt;", response.text)
+
+    def test_load_analytics_coerces_none_scope(self) -> None:
+        """F4: None remote/org/repo become empty strings, never None."""
+        snapshot = load_analytics(db_path=self.db_path, remote=None, org=None, repo=None)
+        self.assertIsInstance(snapshot.remote, str)
+        self.assertIsInstance(snapshot.org, str)
+        self.assertIsInstance(snapshot.repo, str)
+        self.assertEqual(snapshot.remote, "")
+        self.assertEqual(snapshot.org, "")
+        self.assertEqual(snapshot.repo, "")
+
+    def test_usage_events_retention_max_rows(self) -> None:
+        """F3: record_usage_event enforces USAGE_EVENTS_MAX_ROWS."""
+        db = control_plane_db.ControlPlaneDB(db_path=self.db_path)
+        original_max = db.USAGE_EVENTS_MAX_ROWS
+        try:
+            db.USAGE_EVENTS_MAX_ROWS = 3
+            for i in range(5):
+                db.record_usage_event(
+                    remote="dadeschools",
+                    org="org",
+                    repo="repo",
+                    role="author",
+                    model=f"model-{i}",
+                    stage="test",
+                )
+            rows = db.query_usage_events(limit=100)
+            self.assertLessEqual(len(rows), 3)
+            # Newest three retained
+            models = {r["model"] for r in rows}
+            self.assertEqual(models, {"model-2", "model-3", "model-4"})
+        finally:
+            db.USAGE_EVENTS_MAX_ROWS = original_max
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_webui_policy_visibility.py

@@ -0,0 +1,243 @@
+"""Tests for the read-only workflow policy/guardrail visibility view (#646).
+
+Covers issue #646 acceptance criteria:
+
+1. Console lists major guardrails with source pointers.
+2. Secrets redacted.
+3. Tests ensure sample secrets never appear.
+4. Docs explain read-only nature (asserted here for the page copy; the doc
+   itself is covered by inspection).
+"""
+
+import json
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from starlette.testclient import TestClient
+
+from webui import console_redaction
+from webui import policy_inventory
+from webui.app import create_app
+from webui.policy_inventory import (
+    PolicyEntry,
+    PolicyInventorySnapshot,
+    SourcePointer,
+    load_policy_inventory,
+    snapshot_to_dict,
+)
+from webui.policy_views import render_policy_page
+
+
+def _entry(key, category, *, active=None, error=None):
+    return PolicyEntry(
+        key=key,
+        title=key.replace("_", " ").title(),
+        category=category,
+        summary=f"summary for {key}",
+        sources=(SourcePointer("src", f"{key}.py", "module"),),
+        active=active,
+        documented_default=None,
+        diff=None,
+        error=error,
+    )
+
+
+def _snapshot(entries):
+    return PolicyInventorySnapshot(
+        schema_version=1,
+        read_only=True,
+        note="read-only projection",
+        entries=tuple(entries),
+        categories=tuple(dict.fromkeys(e.category for e in entries)),
+        build_errors=(),
+    )
+
+# The guardrail categories issue #646 names as in-scope.
+_EXPECTED_CATEGORIES = {
+    "role_separation",
+    "lease_rules",
+    "worktree_rules",
+    "merge_confirmation",
+    "redaction",
+    "contamination",
+    "allocator_policy",
+    "audit_logging",
+    "mutation_gating",
+}
+
+
+class TestPolicyInventoryModel(unittest.TestCase):
+    def test_major_guardrails_present(self):
+        snapshot = load_policy_inventory()
+        categories = {e.category for e in snapshot.entries}
+        self.assertEqual(_EXPECTED_CATEGORIES, categories)
+        self.assertGreaterEqual(len(snapshot.entries), len(_EXPECTED_CATEGORIES))
+
+    def test_every_guardrail_has_source_pointers(self):
+        # AC1: source attribution (file/module/doc) for every guardrail.
+        snapshot = load_policy_inventory()
+        for entry in snapshot.entries:
+            with self.subTest(entry=entry.key):
+                self.assertTrue(entry.sources, "guardrail must carry source pointers")
+                for source in entry.sources:
+                    self.assertTrue(source.path)
+                    self.assertIn(source.kind, {"module", "doc", "script", "config"})
+
+    def test_diff_reported_where_documented_default_declared(self):
+        snapshot = load_policy_inventory()
+        checked_any = False
+        for entry in snapshot.entries:
+            if entry.documented_default is None:
+                self.assertIsNone(entry.diff)
+                continue
+            checked_any = True
+            self.assertIsNotNone(entry.diff)
+            self.assertEqual(
+                entry.diff["status"],
+                "matches_documented_default",
+                f"{entry.key} drifted from its documented default: {entry.diff}",
+            )
+        self.assertTrue(checked_any, "at least one guardrail should declare a default")
+
+    def test_live_projections_populate_active(self):
+        snapshot = load_policy_inventory()
+        by_key = {e.key: e for e in snapshot.entries}
+        for key in ("role_separation", "redaction", "audit_logging"):
+            self.assertIsNone(by_key[key].error, f"{key} projection failed")
+            self.assertIsInstance(by_key[key].active, dict)
+
+    def test_build_entry_is_fail_soft_on_projection_error(self):
+        def _boom():
+            raise RuntimeError("projection exploded")
+
+        row = (
+            "redaction",
+            "Secret redaction",
+            "redaction",
+            "summary",
+            (SourcePointer("x", "webui/console_redaction.py", "module"),),
+            _boom,
+            {"redact_before_persist": True},
+        )
+        entry = policy_inventory._build_entry(row)
+        self.assertIsNone(entry.active)
+        self.assertIsNotNone(entry.error)
+        self.assertEqual(entry.diff["status"], "active_unavailable")
+
+
+class TestPolicyRedaction(unittest.TestCase):
+    def test_real_snapshot_has_no_secret_shapes(self):
+        # AC3: the real emitted payload never carries a known secret shape.
+        payload = snapshot_to_dict(load_policy_inventory())
+        self.assertEqual(console_redaction.scan_for_secrets(payload), [])
+
+    def test_planted_keychain_secret_is_redacted(self):
+        # AC2/AC3: a secret planted in an active projection is masked before emit.
+        snapshot = _snapshot([
+            _entry(
+                "redaction",
+                "redaction",
+                active={"leaked": "keychain:prgs-author-super-secret", "roles": ["author"]},
+            )
+        ])
+        payload = snapshot_to_dict(snapshot)
+        blob = json.dumps(payload)
+        self.assertNotIn("keychain:prgs-author-super-secret", blob)
+        self.assertEqual(console_redaction.scan_for_secrets(payload), [])
+
+    def test_planted_credential_assignment_is_redacted(self):
+        snapshot = _snapshot([
+            _entry(
+                "audit_logging",
+                "audit_logging",
+                active={"leaked": "token=abcd1234efgh5678", "append_only": True},
+            )
+        ])
+        payload = snapshot_to_dict(snapshot)
+        blob = json.dumps(payload)
+        self.assertNotIn("abcd1234efgh5678", blob)
+        self.assertEqual(console_redaction.scan_for_secrets(payload), [])
+
+    def test_planted_secret_is_redacted_in_html_emit(self):
+        # AC2/AC3: HTML emit path runs redaction before rendering HTML cards.
+        snapshot = _snapshot([
+            _entry(
+                "redaction",
+                "redaction",
+                active={"leaked": "keychain:prgs-author-super-secret", "roles": ["author"]},
+            )
+        ])
+        html_output = render_policy_page(snapshot)
+        self.assertNotIn("keychain:prgs-author-super-secret", html_output)
+        self.assertEqual(console_redaction.scan_for_secrets(html_output), [])
+
+
+class TestPolicyRoutes(unittest.TestCase):
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_policy_html_lists_guardrails_with_sources(self):
+        response = self.client.get("/policy")
+        self.assertEqual(response.status_code, 200)
+        text = response.text
+        self.assertIn("Workflow policy", text)
+        self.assertIn("Role separation and RBAC", text)
+        self.assertIn("Source pointers", text)
+        self.assertIn("task_capability_map.py", text)
+        self.assertIn("docs/safety-model.md", text)
+
+    def test_policy_html_states_read_only(self):
+        # AC4: the page explains its read-only nature.
+        text = self.client.get("/policy").text
+        self.assertIn("read-only", text.lower())
+        self.assertNotIn("<form", text.lower())
+
+    def test_policy_html_has_no_secret_shapes(self):
+        text = self.client.get("/policy").text
+        self.assertEqual(console_redaction.scan_for_secrets(text), [])
+
+    def test_api_v1_policy_returns_inventory(self):
+        response = self.client.get("/api/v1/policy")
+        self.assertEqual(response.status_code, 200)
+        data = response.json()
+        self.assertEqual(data["schema_version"], policy_inventory.SCHEMA_VERSION)
+        self.assertTrue(data["read_only"])
+        self.assertEqual(data["entry_count"], len(data["entries"]))
+        self.assertEqual(set(data["categories"]), _EXPECTED_CATEGORIES)
+
+    def test_policy_is_read_only_no_post(self):
+        # AC4 / non-goal: no mutation endpoint.
+        response = self.client.post("/policy")
+        self.assertIn(response.status_code, (404, 405))
+
+    def test_nav_links_policy(self):
+        # Policy is graduated live: not in STUB_PAGES and not labeled ·stub in nav.
+        from webui.nav import STUB_PAGES, iter_nav_items
+
+        self.assertNotIn("/policy", STUB_PAGES)
+        policy_items = [i for i in iter_nav_items() if i.href == "/policy"]
+        self.assertEqual(len(policy_items), 1)
+        self.assertEqual(policy_items[0].status, "live")
+        text = self.client.get("/").text
+        self.assertIn('href="/policy">Policy</a>', text)
+        self.assertNotIn('href="/policy" class="nav-stub"', text)
+
+
+class TestPolicyViewFailSoft(unittest.TestCase):
+    def test_page_renders_when_a_projection_errors(self):
+        snapshot = _snapshot([
+            _entry("role_separation", "role_separation", error="active projection unavailable: boom"),
+            _entry("redaction", "redaction", active={"redact_before_persist": True}),
+        ])
+        page = render_policy_page(snapshot)
+        # The errored guardrail surfaces its error; other guardrails still render.
+        self.assertIn("Active value unavailable", page)
+        self.assertIn("Redaction", page)
+        self.assertIn("Workflow policy", page)
+
+
+if __name__ == "__main__":
+    unittest.main()

webui/analytics_loader.py

@@ -0,0 +1,433 @@
+"""Model usage, token cost, latency, and workflow-performance analytics (#651, Phase 4).
+
+Ingests session instrumentation metrics, aggregates usage/cost/latency percentiles
+by project, role, model, issue/PR, and stage, enforcing secret redaction and
+explicitly rendering missing metrics as "Unknown" without zero-fabrication.
+"""
+
+from __future__ import annotations
+
+import math
+from dataclasses import asdict, dataclass
+from typing import Any, Sequence
+
+import control_plane_db
+from webui import console_redaction
+
+ANALYTICS_SCHEMA_VERSION = 1
+
+
+@dataclass(frozen=True)
+class UsageEvent:
+    usage_id: int
+    session_id: str | None
+    remote: str
+    org: str
+    repo: str
+    project_id: str | None
+    role: str
+    model: str
+    issue_number: int | None
+    pr_number: int | None
+    stage: str
+    input_tokens: int | None
+    output_tokens: int | None
+    total_tokens: int | None
+    estimated_cost_usd: float | None
+    latency_ms: int | None
+    duration_ms: int | None
+    status: str
+    metadata: str | None
+    created_at: str
+
+    def to_dict(self) -> dict[str, Any]:
+        d = asdict(self)
+        if d["metadata"]:
+            d["metadata"] = console_redaction.redact_text(d["metadata"])
+        return d
+
+
+@dataclass(frozen=True)
+class GroupMetrics:
+    name: str
+    total_events: int
+    events_with_tokens: int
+    input_tokens: int | None
+    output_tokens: int | None
+    total_tokens: int | None
+    events_with_cost: int
+    estimated_cost_usd: float | None
+    events_with_latency: int
+    latency_p50_ms: float | None
+    latency_p90_ms: float | None
+    latency_p95_ms: float | None
+    latency_p99_ms: float | None
+    latency_avg_ms: float | None
+    events_with_duration: int
+    duration_avg_ms: float | None
+    display_tokens: str
+    display_cost: str
+    display_latency_p50: str
+    display_latency_p90: str
+    display_duration_avg: str
+
+    def to_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+@dataclass(frozen=True)
+class AnalyticsSnapshot:
+    ok: bool
+    reason: str
+    schema_version: int
+    remote: str
+    org: str
+    repo: str
+    total_events: int
+    overall_summary: GroupMetrics
+    by_project: dict[str, GroupMetrics]
+    by_role: dict[str, GroupMetrics]
+    by_model: dict[str, GroupMetrics]
+    by_work_item: dict[str, GroupMetrics]
+    by_stage: dict[str, GroupMetrics]
+    events: tuple[UsageEvent, ...]
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "ok": self.ok,
+            "reason": self.reason,
+            "schema_version": self.schema_version,
+            "remote": self.remote,
+            "org": self.org,
+            "repo": self.repo,
+            "total_events": self.total_events,
+            "overall_summary": self.overall_summary.to_dict(),
+            "by_project": {k: v.to_dict() for k, v in self.by_project.items()},
+            "by_role": {k: v.to_dict() for k, v in self.by_role.items()},
+            "by_model": {k: v.to_dict() for k, v in self.by_model.items()},
+            "by_work_item": {k: v.to_dict() for k, v in self.by_work_item.items()},
+            "by_stage": {k: v.to_dict() for k, v in self.by_stage.items()},
+            "events": [e.to_dict() for e in self.events],
+        }
+
+
+def compute_percentile(values: Sequence[float | int], percentile: float) -> float | None:
+    if not values:
+        return None
+    sorted_vals = sorted(values)
+    n = len(sorted_vals)
+    if n == 1:
+        return float(sorted_vals[0])
+    k = (n - 1) * (percentile / 100.0)
+    f = math.floor(k)
+    c = math.ceil(k)
+    if f == c:
+        return float(sorted_vals[int(f)])
+    d0 = sorted_vals[int(f)] * (c - k)
+    d1 = sorted_vals[int(c)] * (k - f)
+    return float(d0 + d1)
+
+
+def aggregate_events(group_name: str, events: Sequence[UsageEvent]) -> GroupMetrics:
+    total_events = len(events)
+    if total_events == 0:
+        return GroupMetrics(
+            name=group_name,
+            total_events=0,
+            events_with_tokens=0,
+            input_tokens=None,
+            output_tokens=None,
+            total_tokens=None,
+            events_with_cost=0,
+            estimated_cost_usd=None,
+            events_with_latency=0,
+            latency_p50_ms=None,
+            latency_p90_ms=None,
+            latency_p95_ms=None,
+            latency_p99_ms=None,
+            latency_avg_ms=None,
+            events_with_duration=0,
+            duration_avg_ms=None,
+            display_tokens="Unknown",
+            display_cost="Unknown",
+            display_latency_p50="Unknown",
+            display_latency_p90="Unknown",
+            display_duration_avg="Unknown",
+        )
+
+    token_events = [
+        e for e in events
+        if e.total_tokens is not None or e.input_tokens is not None or e.output_tokens is not None
+    ]
+    events_with_tokens = len(token_events)
+    if events_with_tokens > 0:
+        input_tokens = sum(e.input_tokens or 0 for e in token_events)
+        output_tokens = sum(e.output_tokens or 0 for e in token_events)
+        total_tokens = sum(
+            e.total_tokens if e.total_tokens is not None else ((e.input_tokens or 0) + (e.output_tokens or 0))
+            for e in token_events
+        )
+        display_tokens = f"{total_tokens:,}"
+    else:
+        input_tokens = None
+        output_tokens = None
+        total_tokens = None
+        display_tokens = "Unknown"
+
+    cost_events = [e for e in events if e.estimated_cost_usd is not None]
+    events_with_cost = len(cost_events)
+    if events_with_cost > 0:
+        estimated_cost_usd = round(sum(e.estimated_cost_usd for e in cost_events), 6)
+        display_cost = f"${estimated_cost_usd:.4f}"
+    else:
+        estimated_cost_usd = None
+        display_cost = "Unknown"
+
+    latency_vals = [e.latency_ms for e in events if e.latency_ms is not None]
+    events_with_latency = len(latency_vals)
+    if events_with_latency > 0:
+        latency_p50_ms = compute_percentile(latency_vals, 50.0)
+        latency_p90_ms = compute_percentile(latency_vals, 90.0)
+        latency_p95_ms = compute_percentile(latency_vals, 95.0)
+        latency_p99_ms = compute_percentile(latency_vals, 99.0)
+        latency_avg_ms = round(sum(latency_vals) / events_with_latency, 2)
+        display_latency_p50 = f"{round(latency_p50_ms, 1)} ms" if latency_p50_ms is not None else "Unknown"
+        display_latency_p90 = f"{round(latency_p90_ms, 1)} ms" if latency_p90_ms is not None else "Unknown"
+    else:
+        latency_p50_ms = None
+        latency_p90_ms = None
+        latency_p95_ms = None
+        latency_p99_ms = None
+        latency_avg_ms = None
+        display_latency_p50 = "Unknown"
+        display_latency_p90 = "Unknown"
+
+    duration_vals = [e.duration_ms for e in events if e.duration_ms is not None]
+    events_with_duration = len(duration_vals)
+    if events_with_duration > 0:
+        duration_avg_ms = round(sum(duration_vals) / events_with_duration, 2)
+        display_duration_avg = f"{round(duration_avg_ms / 1000.0, 2)} s" if duration_avg_ms >= 1000 else f"{round(duration_avg_ms, 1)} ms"
+    else:
+        duration_avg_ms = None
+        display_duration_avg = "Unknown"
+
+    return GroupMetrics(
+        name=group_name,
+        total_events=total_events,
+        events_with_tokens=events_with_tokens,
+        input_tokens=input_tokens,
+        output_tokens=output_tokens,
+        total_tokens=total_tokens,
+        events_with_cost=events_with_cost,
+        estimated_cost_usd=estimated_cost_usd,
+        events_with_latency=events_with_latency,
+        latency_p50_ms=latency_p50_ms,
+        latency_p90_ms=latency_p90_ms,
+        latency_p95_ms=latency_p95_ms,
+        latency_p99_ms=latency_p99_ms,
+        latency_avg_ms=latency_avg_ms,
+        events_with_duration=events_with_duration,
+        duration_avg_ms=duration_avg_ms,
+        display_tokens=display_tokens,
+        display_cost=display_cost,
+        display_latency_p50=display_latency_p50,
+        display_latency_p90=display_latency_p90,
+        display_duration_avg=display_duration_avg,
+    )
+
+
+def record_usage(
+    *,
+    db_path: str | None = None,
+    session_id: str | None = None,
+    remote: str = "dadeschools",
+    org: str = "",
+    repo: str = "",
+    project_id: str | None = None,
+    role: str = "unknown",
+    model: str = "unknown",
+    issue_number: int | None = None,
+    pr_number: int | None = None,
+    stage: str = "unknown",
+    input_tokens: int | None = None,
+    output_tokens: int | None = None,
+    total_tokens: int | None = None,
+    estimated_cost_usd: float | None = None,
+    latency_ms: int | None = None,
+    duration_ms: int | None = None,
+    status: str = "success",
+    metadata: str | dict[str, Any] | None = None,
+    created_at: str | None = None,
+) -> int:
+    """Ingest/record a single usage event with optional metrics."""
+    db = control_plane_db.ControlPlaneDB(db_path=db_path)
+    return db.record_usage_event(
+        session_id=session_id,
+        remote=remote,
+        org=org,
+        repo=repo,
+        project_id=project_id,
+        role=role,
+        model=model,
+        issue_number=issue_number,
+        pr_number=pr_number,
+        stage=stage,
+        input_tokens=input_tokens,
+        output_tokens=output_tokens,
+        total_tokens=total_tokens,
+        estimated_cost_usd=estimated_cost_usd,
+        latency_ms=latency_ms,
+        duration_ms=duration_ms,
+        status=status,
+        metadata=metadata,
+        created_at=created_at,
+    )
+
+
+def load_analytics(
+    *,
+    db_path: str | None = None,
+    remote: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    project_id: str | None = None,
+    role: str | None = None,
+    model: str | None = None,
+    stage: str | None = None,
+    issue_number: int | None = None,
+    pr_number: int | None = None,
+    limit: int = 500,
+) -> AnalyticsSnapshot:
+    """Load analytics snapshot aggregated by project, role, model, issue/PR, and stage."""
+    remote_filter = (remote or "").strip() or None
+    org_filter = (org or "").strip() or None
+    repo_filter = (repo or "").strip() or None
+    role_filter = (role or "").strip() or None
+    model_filter = (model or "").strip() or None
+    stage_filter = (stage or "").strip() or None
+
+    # F4: coerce optional scope filters to str so AnalyticsSnapshot never holds None.
+    scope_remote = (remote or "").strip()
+    scope_org = (org or "").strip()
+    scope_repo = (repo or "").strip()
+
+    try:
+        db = control_plane_db.ControlPlaneDB(db_path=db_path)
+        rows = db.query_usage_events(
+            remote=remote_filter,
+            org=org_filter,
+            repo=repo_filter,
+            project_id=project_id,
+            role=role_filter,
+            model=model_filter,
+            stage=stage_filter,
+            issue_number=issue_number,
+            pr_number=pr_number,
+            limit=limit,
+        )
+    except Exception as exc:
+        empty_summary = aggregate_events("Overall", [])
+        return AnalyticsSnapshot(
+            ok=False,
+            reason=f"control_plane_db_unavailable: {exc}",
+            schema_version=ANALYTICS_SCHEMA_VERSION,
+            remote=scope_remote,
+            org=scope_org,
+            repo=scope_repo,
+            total_events=0,
+            overall_summary=empty_summary,
+            by_project={},
+            by_role={},
+            by_model={},
+            by_work_item={},
+            by_stage={},
+            events=(),
+        )
+
+    parsed_events: list[UsageEvent] = []
+    for r in rows:
+        meta = console_redaction.redact_text(r.get("metadata")) if r.get("metadata") else None
+        parsed_events.append(
+            UsageEvent(
+                usage_id=r["usage_id"],
+                session_id=r.get("session_id"),
+                remote=r.get("remote") or scope_remote,
+                org=r.get("org") or scope_org,
+                repo=r.get("repo") or scope_repo,
+                project_id=r.get("project_id"),
+                role=r.get("role") or "unknown",
+                model=r.get("model") or "unknown",
+                issue_number=r.get("issue_number"),
+                pr_number=r.get("pr_number"),
+                stage=r.get("stage") or "unknown",
+                input_tokens=r.get("input_tokens"),
+                output_tokens=r.get("output_tokens"),
+                total_tokens=r.get("total_tokens"),
+                estimated_cost_usd=r.get("estimated_cost_usd"),
+                latency_ms=r.get("latency_ms"),
+                duration_ms=r.get("duration_ms"),
+                status=r.get("status") or "success",
+                metadata=meta,
+                created_at=r.get("created_at") or "",
+            )
+        )
+
+    overall_summary = aggregate_events("Overall", parsed_events)
+
+    # Group by project
+    groups_by_project: dict[str, list[UsageEvent]] = {}
+    for e in parsed_events:
+        key = e.project_id or (f"{e.org}/{e.repo}" if e.org and e.repo else "default")
+        groups_by_project.setdefault(key, []).append(e)
+    by_project = {k: aggregate_events(k, v) for k, v in groups_by_project.items()}
+
+    # Group by role
+    groups_by_role: dict[str, list[UsageEvent]] = {}
+    for e in parsed_events:
+        groups_by_role.setdefault(e.role, []).append(e)
+    by_role = {k: aggregate_events(k, v) for k, v in groups_by_role.items()}
+
+    # Group by model
+    groups_by_model: dict[str, list[UsageEvent]] = {}
+    for e in parsed_events:
+        groups_by_model.setdefault(e.model, []).append(e)
+    by_model = {k: aggregate_events(k, v) for k, v in groups_by_model.items()}
+
+    # Group by work item
+    groups_by_work_item: dict[str, list[UsageEvent]] = {}
+    for e in parsed_events:
+        if e.issue_number:
+            key = f"issue #{e.issue_number}"
+        elif e.pr_number:
+            key = f"pr #{e.pr_number}"
+        else:
+            key = "unlinked"
+        groups_by_work_item.setdefault(key, []).append(e)
+    by_work_item = {k: aggregate_events(k, v) for k, v in groups_by_work_item.items()}
+
+    # Group by stage
+    groups_by_stage: dict[str, list[UsageEvent]] = {}
+    for e in parsed_events:
+        groups_by_stage.setdefault(e.stage, []).append(e)
+    by_stage = {k: aggregate_events(k, v) for k, v in groups_by_stage.items()}
+
+    return AnalyticsSnapshot(
+        ok=True,
+        reason="ok",
+        schema_version=ANALYTICS_SCHEMA_VERSION,
+        remote=scope_remote,
+        org=scope_org,
+        repo=scope_repo,
+        total_events=len(parsed_events),
+        overall_summary=overall_summary,
+        by_project=by_project,
+        by_role=by_role,
+        by_model=by_model,
+        by_work_item=by_work_item,
+        by_stage=by_stage,
+        events=tuple(parsed_events),
+    )
+
+
+def snapshot_to_dict(snapshot: AnalyticsSnapshot) -> dict[str, Any]:
+    return snapshot.to_dict()

webui/analytics_views.py

@@ -0,0 +1,248 @@
+"""HTML views for the Model Usage & Performance Analytics console (#651)."""
+
+from __future__ import annotations
+
+import html
+
+from webui.analytics_loader import AnalyticsSnapshot, GroupMetrics, UsageEvent
+from webui.layout import render_page
+
+
+def _escape(text: object) -> str:
+    """HTML-escape dynamic analytics fields (mirrors audit_views / project_views)."""
+    return html.escape(str(text), quote=True)
+
+
+def _render_badge(text: str, badge_type: str = "muted") -> str:
+    return f'<span class="badge badge-{_escape(badge_type)}">{_escape(text)}</span>'
+
+
+def _render_group_table(title: str, groups: dict[str, GroupMetrics], key_header: str = "Group") -> str:
+    if not groups:
+        return (
+            f"<h3>{_escape(title)}</h3>"
+            '<div class="card"><p class="muted">No telemetry events recorded for this dimension.</p></div>'
+        )
+
+    rows = []
+    for key, g in sorted(groups.items(), key=lambda x: x[1].total_events, reverse=True):
+        cost_cell = (
+            f'<span class="accent">{_escape(g.display_cost)}</span>'
+            if g.events_with_cost > 0
+            else _render_badge("Unknown")
+        )
+        tokens_cell = (
+            _escape(g.display_tokens)
+            if g.events_with_tokens > 0
+            else _render_badge("Unknown")
+        )
+        lat_p50 = (
+            _escape(g.display_latency_p50)
+            if g.events_with_latency > 0
+            else _render_badge("Unknown")
+        )
+        lat_p90 = (
+            _escape(g.display_latency_p90)
+            if g.events_with_latency > 0
+            else _render_badge("Unknown")
+        )
+        dur_avg = (
+            _escape(g.display_duration_avg)
+            if g.events_with_duration > 0
+            else _render_badge("Unknown")
+        )
+
+        rows.append(
+            "<tr>"
+            f"<td><strong>{_escape(key)}</strong></td>"
+            f"<td>{g.total_events}</td>"
+            f"<td>{tokens_cell}</td>"
+            f"<td>{cost_cell}</td>"
+            f"<td>{lat_p50}</td>"
+            f"<td>{lat_p90}</td>"
+            f"<td>{dur_avg}</td>"
+            "</tr>"
+        )
+
+    rows_html = "".join(rows)
+    return f"""
+    <h3>{_escape(title)}</h3>
+    <div class="card" style="overflow-x: auto;">
+      <table class="data-table">
+        <thead>
+          <tr>
+            <th>{_escape(key_header)}</th>
+            <th>Events</th>
+            <th>Total Tokens</th>
+            <th>Est. Cost</th>
+            <th>Latency (p50)</th>
+            <th>Latency (p90)</th>
+            <th>Avg Stage Duration</th>
+          </tr>
+        </thead>
+        <tbody>
+          {rows_html}
+        </tbody>
+      </table>
+    </div>
+    """
+
+
+def _render_events_table(events: tuple[UsageEvent, ...]) -> str:
+    if not events:
+        return (
+            "<h3>Recent Usage & Instrumentation Events</h3>"
+            '<div class="card"><p class="muted">No individual telemetry events recorded yet. Opt-in instrumentation via session logging or authorized POST /api/v1/analytics/usage.</p></div>'
+        )
+
+    rows = []
+    for e in list(events)[-50:]:  # Display latest 50
+        if e.issue_number is not None:
+            work_item = f"issue #{e.issue_number}"
+        elif e.pr_number is not None:
+            work_item = f"pr #{e.pr_number}"
+        else:
+            work_item = "unlinked"
+        tokens = (
+            _escape(f"{e.total_tokens:,}")
+            if e.total_tokens is not None
+            else _render_badge("Unknown")
+        )
+        cost = (
+            _escape(f"${e.estimated_cost_usd:.4f}")
+            if e.estimated_cost_usd is not None
+            else _render_badge("Unknown")
+        )
+        latency = (
+            _escape(f"{e.latency_ms} ms")
+            if e.latency_ms is not None
+            else _render_badge("Unknown")
+        )
+        duration = (
+            _escape(f"{e.duration_ms} ms")
+            if e.duration_ms is not None
+            else _render_badge("Unknown")
+        )
+        status_badge = _render_badge(
+            e.status, "success" if e.status == "success" else "danger"
+        )
+
+        rows.append(
+            "<tr>"
+            f"<td>#{e.usage_id}</td>"
+            f"<td><small>{_escape(e.created_at)}</small></td>"
+            f"<td><span class=\"badge\">{_escape(e.role)}</span></td>"
+            f"<td><strong>{_escape(e.model)}</strong></td>"
+            f"<td>{_escape(e.stage)}</td>"
+            f"<td>{_escape(work_item)}</td>"
+            f"<td>{tokens}</td>"
+            f"<td>{cost}</td>"
+            f"<td>{latency}</td>"
+            f"<td>{duration}</td>"
+            f"<td>{status_badge}</td>"
+            "</tr>"
+        )
+
+    rows_html = "".join(rows)
+    return f"""
+    <h3>Recent Telemetry Events</h3>
+    <div class="card" style="overflow-x: auto;">
+      <table class="data-table">
+        <thead>
+          <tr>
+            <th>ID</th>
+            <th>Timestamp</th>
+            <th>Role</th>
+            <th>Model</th>
+            <th>Stage</th>
+            <th>Work Item</th>
+            <th>Tokens</th>
+            <th>Cost</th>
+            <th>Latency</th>
+            <th>Duration</th>
+            <th>Status</th>
+          </tr>
+        </thead>
+        <tbody>
+          {rows_html}
+        </tbody>
+      </table>
+    </div>
+    """
+
+
+def render_analytics_page(snapshot: AnalyticsSnapshot) -> str:
+    """Render the main Model Usage & Performance Analytics console page."""
+    summary = snapshot.overall_summary
+
+    kpi_tokens = (
+        _escape(summary.display_tokens)
+        if summary.events_with_tokens > 0
+        else _render_badge("Unknown")
+    )
+    kpi_cost = (
+        _escape(summary.display_cost)
+        if summary.events_with_cost > 0
+        else _render_badge("Unknown")
+    )
+    kpi_lat_p50 = (
+        _escape(summary.display_latency_p50)
+        if summary.events_with_latency > 0
+        else _render_badge("Unknown")
+    )
+    kpi_dur_avg = (
+        _escape(summary.display_duration_avg)
+        if summary.events_with_duration > 0
+        else _render_badge("Unknown")
+    )
+
+    status_notice = ""
+    if not snapshot.ok:
+        status_notice = (
+            f'<div class="card warning-card"><strong>Degraded Data Source:</strong> '
+            f'{_escape(snapshot.reason)}</div>'
+        )
+
+    body_html = f"""
+    <h2>Model Usage & Performance Analytics (Phase 4)</h2>
+    <p class="muted">
+      Durable console analytics for model usage, token cost, latency percentiles, and workflow-stage performance correlated to issues, PRs, and worker roles.
+    </p>
+
+    {status_notice}
+
+    <div class="notice-card" style="background: rgba(91, 159, 212, 0.1); border: 1px solid var(--border); padding: 0.75rem 1rem; border-radius: 6px; margin-bottom: 1.5rem;">
+      <small><strong>Note on telemetry fidelity:</strong> Missing data or untracked metrics are explicitly labeled as <em>Unknown</em>. No token costs or latency metrics are zero-fabricated.</small>
+    </div>
+
+    <div class="card-grid" style="display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 1rem; margin-bottom: 1.5rem;">
+      <div class="card">
+        <span class="muted" style="font-size: 0.85rem;">Total Events</span>
+        <h3 style="margin: 0.25rem 0 0 0;">{summary.total_events}</h3>
+      </div>
+      <div class="card">
+        <span class="muted" style="font-size: 0.85rem;">Total Tokens</span>
+        <h3 style="margin: 0.25rem 0 0 0;">{kpi_tokens}</h3>
+      </div>
+      <div class="card">
+        <span class="muted" style="font-size: 0.85rem;">Est. Token Cost</span>
+        <h3 style="margin: 0.25rem 0 0 0;">{kpi_cost}</h3>
+      </div>
+      <div class="card">
+        <span class="muted" style="font-size: 0.85rem;">Latency (p50)</span>
+        <h3 style="margin: 0.25rem 0 0 0;">{kpi_lat_p50}</h3>
+      </div>
+      <div class="card">
+        <span class="muted" style="font-size: 0.85rem;">Avg Stage Duration</span>
+        <h3 style="margin: 0.25rem 0 0 0;">{kpi_dur_avg}</h3>
+      </div>
+    </div>
+
+    {_render_group_table("Usage & Cost by Model", snapshot.by_model, "Model")}
+    {_render_group_table("Performance by Workflow Stage", snapshot.by_stage, "Stage")}
+    {_render_group_table("Usage & Cost by Role", snapshot.by_role, "Role")}
+    {_render_group_table("Work Item Analytics", snapshot.by_work_item, "Work Item")}
+    {_render_events_table(snapshot.events)}
+    """
+
+    return render_page(title="Model Usage & Performance Analytics", body_html=body_html)

webui/app.py

@@ -46,7 +46,15 @@ from webui.worktree_scanner import load_hygiene_snapshot, snapshot_to_dict as wo
 from webui.worktree_views import render_worktrees_page
 from webui.runtime_health import load_runtime_snapshot, snapshot_to_dict as runtime_snapshot_to_dict
 from webui.runtime_views import render_runtime_page
+from webui.policy_inventory import load_policy_inventory, snapshot_to_dict as policy_snapshot_to_dict
+from webui.policy_views import render_policy_page
 from webui.timeline import load_timeline, snapshot_to_dict as timeline_snapshot_to_dict
+from webui.analytics_loader import (
+    load_analytics,
+    record_usage,
+    snapshot_to_dict as analytics_snapshot_to_dict,
+)
+from webui.analytics_views import render_analytics_page
 from webui.system_health import (
     API_PATH as SYSTEM_HEALTH_API_PATH,
     load_system_health,
@@ -302,6 +310,17 @@ async def api_runtime(_request: Request) -> JSONResponse:
     return JSONResponse(runtime_snapshot_to_dict(load_runtime_snapshot()))
 
 
+async def policy(_request: Request) -> HTMLResponse:
+    snapshot = load_policy_inventory()
+    return HTMLResponse(
+        render_page(title="Policy", body_html=render_policy_page(snapshot))
+    )
+
+
+async def api_v1_policy(_request: Request) -> JSONResponse:
+    return JSONResponse(policy_snapshot_to_dict(load_policy_inventory()))
+
+
 async def _parse_audit_form(request: Request) -> tuple[str, str | None]:
     if request.method == "GET":
         return "", None
@@ -567,6 +586,114 @@ async def api_v1_timeline(request: Request) -> JSONResponse:
     return JSONResponse(timeline_snapshot_to_dict(snapshot), status_code=status_code)
 
 
+async def analytics(request: Request) -> HTMLResponse:
+    """Read-only model usage, token cost, latency, and performance analytics HTML view (#651)."""
+    snapshot = load_analytics(
+        remote=request.query_params.get("remote"),
+        org=request.query_params.get("org"),
+        repo=request.query_params.get("repo"),
+        role=request.query_params.get("role"),
+        model=request.query_params.get("model"),
+        stage=request.query_params.get("stage"),
+        issue_number=_query_int(request, "issue"),
+        pr_number=_query_int(request, "pr"),
+        limit=_query_int(request, "limit") or 200,
+    )
+    return HTMLResponse(render_analytics_page(snapshot))
+
+
+async def api_v1_analytics(request: Request) -> JSONResponse:
+    """Read-only model usage, token cost, latency, and performance analytics API (#651)."""
+    snapshot = load_analytics(
+        remote=request.query_params.get("remote"),
+        org=request.query_params.get("org"),
+        repo=request.query_params.get("repo"),
+        role=request.query_params.get("role"),
+        model=request.query_params.get("model"),
+        stage=request.query_params.get("stage"),
+        issue_number=_query_int(request, "issue"),
+        pr_number=_query_int(request, "pr"),
+        limit=_query_int(request, "limit") or 500,
+    )
+    status_code = 200 if snapshot.ok else 500
+    return JSONResponse(analytics_snapshot_to_dict(snapshot), status_code=status_code)
+
+
+async def api_v1_analytics_ingest(request: Request) -> JSONResponse:
+    """Optional session instrumentation ingestion endpoint (#651).
+
+    Fail-closed write: every request is authorized through console_authz
+    (``record_analytics_usage``) before any control-plane DB mutation. Phase 1
+    keeps ``execution_enabled=False`` and denies unauthenticated callers, so
+    this route cannot be used as an unauthenticated write or XSS injection
+    vector (PR #876 F2).
+    """
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
+    if not isinstance(body, dict):
+        body = {}
+
+    principal = resolve_principal(headers=dict(request.headers))
+    decision = authorize(
+        "record_analytics_usage", principal, for_execution=True
+    )
+    allowed = bool(decision.allowed and decision.execution_enabled)
+    console_audit.record_event(
+        action_id="record_analytics_usage",
+        result=(
+            console_audit.RESULT_ALLOWED
+            if allowed
+            else console_audit.RESULT_DENIED
+        ),
+        decision=decision,
+        principal=principal,
+        target=_audit_target("record_analytics_usage", body),
+        request_id=_request_id(),
+        detail=decision.detail,
+    )
+    authorization = decision.to_dict()
+    if not allowed:
+        return JSONResponse(
+            {
+                "ok": False,
+                "error": "unauthorized",
+                "detail": (
+                    "POST /api/v1/analytics/usage requires an authenticated "
+                    "principal with record_analytics_usage execution enabled"
+                ),
+                "authorization": authorization,
+            },
+            status_code=403,
+        )
+
+    usage_id = record_usage(
+        session_id=body.get("session_id"),
+        remote=body.get("remote", "dadeschools"),
+        org=body.get("org", ""),
+        repo=body.get("repo", ""),
+        project_id=body.get("project_id"),
+        role=body.get("role", "unknown"),
+        model=body.get("model", "unknown"),
+        issue_number=body.get("issue_number") or body.get("issue"),
+        pr_number=body.get("pr_number") or body.get("pr"),
+        stage=body.get("stage", "unknown"),
+        input_tokens=body.get("input_tokens"),
+        output_tokens=body.get("output_tokens"),
+        total_tokens=body.get("total_tokens"),
+        estimated_cost_usd=body.get("estimated_cost_usd"),
+        latency_ms=body.get("latency_ms"),
+        duration_ms=body.get("duration_ms"),
+        status=body.get("status", "success"),
+        metadata=body.get("metadata"),
+    )
+    return JSONResponse(
+        {"ok": True, "usage_id": usage_id, "authorization": authorization},
+        status_code=201,
+    )
+
+
 async def method_not_allowed(request: Request, _exc: Exception) -> Response:
     path = request.url.path
     if path in _AUDIT_MUTATION_PATHS and request.method == "POST":
@@ -607,7 +734,13 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
             Route("/api/prompts", api_prompts, methods=["GET"]),
             Route("/runtime", runtime, methods=["GET"]),
             Route("/api/runtime", api_runtime, methods=["GET"]),
+            Route("/policy", policy, methods=["GET"]),
+            Route("/api/v1/policy", api_v1_policy, methods=["GET"]),
             Route("/api/v1/timeline", api_v1_timeline, methods=["GET"]),
+            Route("/analytics", analytics, methods=["GET"]),
+            Route("/api/analytics", api_v1_analytics, methods=["GET"]),
+            Route("/api/v1/analytics", api_v1_analytics, methods=["GET"]),
+            Route("/api/v1/analytics/usage", api_v1_analytics_ingest, methods=["POST"]),
             Route("/audit", audit, methods=["GET", "POST"]),
             Route("/api/audit", api_audit, methods=["GET", "POST"]),
             Route("/worktrees", worktrees, methods=["GET"]),

webui/console_authz.py

@@ -236,6 +236,19 @@ _ACTION_SPECS: tuple[ConsoleAction, ...] = (
         phase=3,
         summary="Remove a remote feature branch.",
     ),
+    # #651 analytics ingest: local control-plane write, not a Gitea mutation.
+    # Phase 2 gated write so Phase 1 (ACTIVE_PHASE=1) fails closed on execution.
+    ConsoleAction(
+        action_id="record_analytics_usage",
+        task_key="record_analytics_usage",
+        action_class=CLASS_WRITE,
+        minimum_role=OPERATOR,
+        requires_confirmation=True,
+        dual_control=False,
+        break_glass=False,
+        phase=2,
+        summary="Ingest a model-usage / latency analytics event into the control-plane DB.",
+    ),
     # #642: sanctioned daemon lifecycle. These exist so operators have an
     # audited path off `pkill -f mcp_server.py` (#630). Restart drops every
     # in-flight request on a namespace, so it carries the same dual-control and

webui/nav.py

@@ -5,7 +5,7 @@ the ``webui/app.py`` route table stay aligned with epic #631. Read-only: every
 destination is a GET view or a Phase 1 placeholder. No mutation links.
 
 Nav groups follow the #631 Phase 1 information architecture: Health, Traffic,
-Runtime/Sessions, Projects, Inventory, Timeline, Policy (placeholder), and
+Runtime/Sessions, Projects, Inventory, Timeline, Policy (live via #646), and
 Insights (placeholder). Later-phase surfaces are declared as ``stub`` items and
 backed by ``STUB_PAGES`` so their nav links resolve to a graceful placeholder
 instead of a 404.
@@ -60,11 +60,12 @@ NAV_GROUPS: tuple[NavGroup, ...] = (
         NavItem("/timeline", "Timeline", "stub"),
     )),
     NavGroup("Policy", (
-        NavItem("/policy", "Policy", "stub"),
+        NavItem("/policy", "Policy"),
         NavItem("/prompts", "Prompts"),
     )),
     NavGroup("Insights", (
         NavItem("/insights", "Insights", "stub"),
+        NavItem("/analytics", "Analytics"),
         NavItem("/audit", "Audit"),
     )),
 )
@@ -88,10 +89,6 @@ STUB_PAGES: dict[str, tuple[str, str]] = {
         "Timeline",
         "Workflow event timeline across issues and PRs. A later Phase 1 surface.",
     ),
-    "/policy": (
-        "Policy",
-        "Capability and role policy surface. Placeholder until a later phase.",
-    ),
     "/insights": (
         "Insights",
         "Aggregate operational insights and trends. Placeholder until a later "

webui/policy_inventory.py

@@ -0,0 +1,387 @@
+"""Read-only workflow policy and guardrail inventory for the web UI (#646).
+
+Policy and guardrails live in code, profiles, docs, and skills. An operator
+cannot *see* the active workflow policy configuration from the console without
+reading the repository tree. This module projects the major guardrails into a
+redacted, machine-readable inventory with source attribution (file / module /
+doc), so the console can render them as HTML tables with source pointers.
+
+Design constraints (Phase 3, #646):
+
+- **Read-only projection.** Nothing here edits policy or exposes a toggle that
+  could weaken a gate. It reports what is already enforced elsewhere.
+- **Source attribution without secrets.** Every guardrail carries pointers to
+  the file/module/doc that owns it. Live values are compact summaries derived
+  from the safe policy accessors that already exist (``rbac_matrix``,
+  ``redaction_policy``, ``audit_policy``); raw regex, tokens, and endpoints are
+  never embedded.
+- **Redact before emit.** ``snapshot_to_dict`` runs the whole payload through
+  ``console_redaction.redact_payload`` so a planted or accidental secret in any
+  projected value degrades to the placeholder rather than reaching a client.
+- **Fail soft.** A projection that raises is recorded as a per-entry error and
+  never takes the page down; a guardrail is still listed with its sources.
+- **Diff vs documented defaults where feasible.** When a guardrail declares a
+  documented invariant, the active projection is compared against it and the
+  result is reported; otherwise the diff is explicitly ``None`` with a reason.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Callable
+
+from webui import console_audit
+from webui import console_authz
+from webui import console_redaction
+
+SCHEMA_VERSION = 1
+
+READ_ONLY_NOTE = (
+    "Read-only projection of guardrails enforced in code, profiles, docs, and "
+    "skills. This view never edits policy and exposes no gate-weakening toggle."
+)
+
+
+@dataclass(frozen=True)
+class SourcePointer:
+    """Where a guardrail is defined. Attribution only — never a secret."""
+
+    label: str
+    path: str
+    kind: str  # "module" | "doc" | "script" | "config"
+    anchor: str | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "label": self.label,
+            "path": self.path,
+            "kind": self.kind,
+            "anchor": self.anchor,
+        }
+
+
+@dataclass(frozen=True)
+class PolicyEntry:
+    key: str
+    title: str
+    category: str
+    summary: str
+    sources: tuple[SourcePointer, ...]
+    active: dict[str, Any] | None
+    documented_default: dict[str, Any] | None
+    diff: dict[str, Any] | None
+    error: str | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "key": self.key,
+            "title": self.title,
+            "category": self.category,
+            "summary": self.summary,
+            "sources": [s.to_dict() for s in self.sources],
+            "active": self.active,
+            "documented_default": self.documented_default,
+            "diff": self.diff,
+            "error": self.error,
+        }
+
+
+@dataclass(frozen=True)
+class PolicyInventorySnapshot:
+    schema_version: int
+    read_only: bool
+    note: str
+    entries: tuple[PolicyEntry, ...]
+    categories: tuple[str, ...]
+    build_errors: tuple[str, ...]
+
+
+def _diff_active_vs_default(
+    active: dict[str, Any] | None,
+    documented_default: dict[str, Any] | None,
+) -> dict[str, Any] | None:
+    """Compare only the keys the documented default declares.
+
+    Returns ``None`` when no documented default is declared (diff not feasible)
+    or when the active projection is unavailable. Otherwise reports, per
+    declared key, whether the active value matches the documented invariant.
+    """
+    if not documented_default:
+        return None
+    if not active:
+        return {"status": "active_unavailable", "checked": {}}
+    checked: dict[str, Any] = {}
+    matches = True
+    for key, expected in documented_default.items():
+        observed = active.get(key)
+        ok = observed == expected
+        matches = matches and ok
+        checked[key] = {"expected": expected, "observed": observed, "matches": ok}
+    return {
+        "status": "matches_documented_default" if matches else "drift_detected",
+        "checked": checked,
+    }
+
+
+# ── Live projections (compact, safe, fail-soft) ──────────────────────────────
+# Each returns a small dict of already-safe machine values. They are module
+# level so tests can substitute one to prove the redaction pass runs.
+
+
+def _project_role_separation() -> dict[str, Any]:
+    matrix = console_authz.rbac_matrix()
+    return {
+        "model_version": matrix.get("model_version"),
+        "active_phase": matrix.get("active_phase"),
+        "roles": [r.get("role") for r in matrix.get("roles", [])],
+        "privileged_action_count": len(matrix.get("privileged_actions", [])),
+        "default_decision": matrix.get("default_decision"),
+        "execution_enabled": matrix.get("execution_enabled"),
+    }
+
+
+def _project_redaction() -> dict[str, Any]:
+    policy = console_redaction.redaction_policy()
+    return {
+        "policy_version": policy.get("policy_version"),
+        "placeholder": policy.get("placeholder"),
+        "applies_to": policy.get("applies_to"),
+        "console_detector_count": len(policy.get("console_rules", [])),
+        "redact_before_persist": policy.get("redact_before_persist"),
+        "failure_mode": policy.get("failure_mode"),
+    }
+
+
+def _project_audit() -> dict[str, Any]:
+    policy = console_audit.audit_policy()
+    return {
+        "schema_version": policy.get("schema_version"),
+        "required_field_count": len(policy.get("required_fields", [])),
+        "results": policy.get("results"),
+        "retention_defaults_days": policy.get("retention_defaults_days"),
+        "append_only": policy.get("append_only"),
+        "redact_before_persist": policy.get("redact_before_persist"),
+        "enabled": policy.get("enabled"),
+    }
+
+
+def _static(value: dict[str, Any]) -> Callable[[], dict[str, Any]]:
+    return lambda: dict(value)
+
+
+# ── Guardrail catalog ────────────────────────────────────────────────────────
+# One row per major guardrail. ``project`` yields the active value (may raise;
+# caught per entry). ``documented_default`` drives the feasible diff.
+
+_CatalogRow = tuple[
+    str,
+    str,
+    str,
+    str,
+    tuple[SourcePointer, ...],
+    Callable[[], dict[str, Any]] | None,
+    dict[str, Any] | None,
+]
+
+_CATALOG: tuple[_CatalogRow, ...] = (
+    (
+        "role_separation",
+        "Role separation and RBAC",
+        "role_separation",
+        "Author, reviewer, merger, and reconciler capabilities are disjoint and "
+        "role-exclusive; self-review and self-merge are always blocked. The "
+        "console RBAC model defaults to deny.",
+        (
+            SourcePointer("task capability map", "task_capability_map.py", "module"),
+            SourcePointer("role/namespace gate", "role_namespace_gate.py", "module"),
+            SourcePointer("console RBAC", "webui/console_authz.py", "module"),
+        ),
+        _project_role_separation,
+        {"default_decision": "deny", "execution_enabled": False},
+    ),
+    (
+        "lease_rules",
+        "Issue and PR lease lifecycle",
+        "lease_rules",
+        "Durable work is claimed through issue locks and control-plane leases "
+        "with freshness, expiry, and dead-session recovery; abandoned or stale "
+        "claims are reclaimed only through the sanctioned recovery path.",
+        (
+            SourcePointer("issue lock store", "issue_lock_store.py", "module"),
+            SourcePointer("branch cleanup guard", "branch_cleanup_guard.py", "module"),
+            SourcePointer("safety model §5", "docs/safety-model.md", "doc", "5-mutation-gating"),
+        ),
+        None,
+        None,
+    ),
+    (
+        "worktree_rules",
+        "Author worktree binding",
+        "worktree_rules",
+        "Author mutations require a validated worktree under branches/ derived "
+        "from the active issue lock; silent fallback to the stable control "
+        "checkout or master is forbidden (#618).",
+        (
+            SourcePointer("author worktree gate", "author_mutation_worktree.py", "module"),
+            SourcePointer("worktree bootstrap", "scripts/worktree-start", "script"),
+            SourcePointer("workflow scope guard", "workflow_scope_guard.py", "module"),
+        ),
+        None,
+        None,
+    ),
+    (
+        "merge_confirmation",
+        "Explicit merge confirmation",
+        "merge_confirmation",
+        "A merge fails closed unless the caller passes the exact confirmation "
+        "phrase for that PR; reviewing never implies merging.",
+        (
+            SourcePointer("merge path", "merge_pr.py", "module"),
+            SourcePointer("merge tool gate", "gitea_mcp_server.py", "module"),
+        ),
+        _static({"required_confirmation_format": "MERGE PR <n>", "auto_merge": False}),
+        {"auto_merge": False},
+    ),
+    (
+        "redaction",
+        "Secret redaction",
+        "redaction",
+        "Every console surface runs the shared gitea_audit pass then console "
+        "patterns before any payload, HTML, log line, or audit record leaves "
+        "the server; unredactable values fail closed to the placeholder.",
+        (
+            SourcePointer("console redaction", "webui/console_redaction.py", "module"),
+            SourcePointer("shared redaction", "gitea_audit.py", "module"),
+            SourcePointer("safety model §3", "docs/safety-model.md", "doc", "3-secret-redaction"),
+        ),
+        _project_redaction,
+        {"redact_before_persist": True},
+    ),
+    (
+        "contamination",
+        "Contamination containment",
+        "contamination",
+        "A session contaminated by a direct stable-branch push or a manual MCP "
+        "daemon kill is blocked from review, merge, close, and completion "
+        "mutations until cleared (reconciler-exempt).",
+        (
+            SourcePointer("contamination gates", "gitea_mcp_server.py", "module"),
+            SourcePointer("stable-branch audit", "workflow_scope_guard.py", "module"),
+        ),
+        None,
+        None,
+    ),
+    (
+        "allocator_policy",
+        "Work allocation policy",
+        "allocator_policy",
+        "Workers do not self-select exclusive work; the controller-owned "
+        "allocator ranks the complete queue by priority then PRs-before-issues "
+        "then ascending number, honoring dependency edges and foreign claims.",
+        (
+            SourcePointer("allocator", "gitea_mcp_server.py", "module"),
+            SourcePointer("safety model §5", "docs/safety-model.md", "doc", "5-mutation-gating"),
+        ),
+        _static(
+            {
+                "self_select_exclusive_work": False,
+                "ranking": "priority desc, PRs before issues, number asc",
+                "respects_dependency_edges": True,
+                "respects_foreign_claims": True,
+            }
+        ),
+        {"self_select_exclusive_work": False},
+    ),
+    (
+        "audit_logging",
+        "Audit logging",
+        "audit_logging",
+        "Console intent and authorization outcomes are recorded to an "
+        "append-only, redact-before-persist audit log; MCP mutations are "
+        "recorded by gitea_audit and correlated by request id.",
+        (
+            SourcePointer("console audit", "webui/console_audit.py", "module"),
+            SourcePointer("MCP audit", "gitea_audit.py", "module"),
+            SourcePointer("safety model §1", "docs/safety-model.md", "doc", "1-audit-logging-and-confirmation"),
+        ),
+        _project_audit,
+        {"append_only": True, "redact_before_persist": True},
+    ),
+    (
+        "mutation_gating",
+        "Mutation gating and master parity",
+        "mutation_gating",
+        "Mutations fail closed while the running server is stale relative to "
+        "master, and every mutation is preceded by identity and capability "
+        "resolution in a fixed pre-flight order.",
+        (
+            SourcePointer("mutation gate", "gitea_mcp_server.py", "module"),
+            SourcePointer("safety model §5", "docs/safety-model.md", "doc", "5-mutation-gating"),
+        ),
+        _static(
+            {
+                "stale_runtime_blocks_mutations": True,
+                "preflight_order": "whoami -> resolve_task_capability -> mutation",
+            }
+        ),
+        {"stale_runtime_blocks_mutations": True},
+    ),
+)
+
+
+def _build_entry(row: _CatalogRow) -> PolicyEntry:
+    key, title, category, summary, sources, project, documented_default = row
+    active: dict[str, Any] | None = None
+    error: str | None = None
+    if project is not None:
+        try:
+            active = project()
+        except Exception as exc:  # noqa: BLE001 — fail soft; never take the page down
+            active = None
+            error = f"active projection unavailable: {exc}"
+    diff = _diff_active_vs_default(active, documented_default)
+    return PolicyEntry(
+        key=key,
+        title=title,
+        category=category,
+        summary=summary,
+        sources=sources,
+        active=active,
+        documented_default=documented_default,
+        diff=diff,
+        error=error,
+    )
+
+
+def load_policy_inventory() -> PolicyInventorySnapshot:
+    """Build the read-only guardrail inventory. Never raises for one bad entry."""
+    entries: list[PolicyEntry] = []
+    build_errors: list[str] = []
+    for row in _CATALOG:
+        try:
+            entries.append(_build_entry(row))
+        except Exception as exc:  # noqa: BLE001 — one row must not break the rest
+            build_errors.append(f"{row[0]}: {exc}")
+    categories = tuple(dict.fromkeys(e.category for e in entries))
+    return PolicyInventorySnapshot(
+        schema_version=SCHEMA_VERSION,
+        read_only=True,
+        note=READ_ONLY_NOTE,
+        entries=tuple(entries),
+        categories=categories,
+        build_errors=tuple(build_errors),
+    )
+
+
+def snapshot_to_dict(snapshot: PolicyInventorySnapshot) -> dict[str, Any]:
+    """Serialize the snapshot, redacting the entire payload before it is emitted."""
+    payload = {
+        "schema_version": snapshot.schema_version,
+        "read_only": snapshot.read_only,
+        "note": snapshot.note,
+        "categories": list(snapshot.categories),
+        "entry_count": len(snapshot.entries),
+        "entries": [entry.to_dict() for entry in snapshot.entries],
+        "build_errors": list(snapshot.build_errors),
+    }
+    return console_redaction.redact_payload(payload)

webui/policy_views.py

@@ -0,0 +1,145 @@
+"""HTML views for the workflow policy and guardrail inventory (#646)."""
+
+from __future__ import annotations
+
+import html
+import json
+from typing import Any
+
+from webui import console_redaction
+from webui.policy_inventory import (
+    PolicyEntry,
+    PolicyInventorySnapshot,
+    SourcePointer,
+    snapshot_to_dict,
+)
+
+
+def _source_pointer(source: dict[str, Any] | SourcePointer) -> str:
+    if isinstance(source, dict):
+        label = str(source.get("label") or "")
+        path = str(source.get("path") or "")
+        anchor = source.get("anchor")
+        kind = str(source.get("kind") or "")
+    else:
+        label = source.label
+        path = source.path
+        anchor = source.anchor
+        kind = source.kind
+
+    if anchor:
+        path = f"{path}#{anchor}"
+    return (
+        f"<li>{html.escape(label)} — "
+        f"<code>{html.escape(path)}</code> "
+        f"<span class='muted'>({html.escape(kind)})</span></li>"
+    )
+
+
+def _active_block(entry: dict[str, Any] | PolicyEntry) -> str:
+    error = entry.get("error") if isinstance(entry, dict) else entry.error
+    active = entry.get("active") if isinstance(entry, dict) else entry.active
+    if error:
+        return (
+            "<p class='muted'><strong>Active value unavailable:</strong> "
+            f"{html.escape(error)}</p>"
+        )
+    if not active:
+        return "<p class='muted'>No live projection for this guardrail.</p>"
+    pretty = json.dumps(active, indent=2, sort_keys=True, default=str)
+    return f"<pre class='prompt-text'>{html.escape(pretty)}</pre>"
+
+
+def _diff_block(entry: dict[str, Any] | PolicyEntry) -> str:
+    diff = entry.get("diff") if isinstance(entry, dict) else entry.diff
+    documented_default = entry.get("documented_default") if isinstance(entry, dict) else entry.documented_default
+    if diff is None:
+        if documented_default is None:
+            return "<p class='muted'>Diff vs documented default: not feasible (no declared default).</p>"
+        return "<p class='muted'>Diff vs documented default: unavailable.</p>"
+    status = str(diff.get("status") if isinstance(diff, dict) else "unknown")
+    badge = "badge-claimed" if status == "matches_documented_default" else "badge-blocked"
+    rows = []
+    checked = diff.get("checked") if isinstance(diff, dict) else {}
+    if isinstance(checked, dict):
+        for key, cell in checked.items():
+            cell_dict = cell if isinstance(cell, dict) else {}
+            marker = "✓" if cell_dict.get("matches") else "✗"
+            rows.append(
+                "<tr>"
+                f"<td><code>{html.escape(str(key))}</code></td>"
+                f"<td><code>{html.escape(str(cell_dict.get('expected')))}</code></td>"
+                f"<td><code>{html.escape(str(cell_dict.get('observed')))}</code></td>"
+                f"<td>{marker}</td>"
+                "</tr>"
+            )
+    table = ""
+    if rows:
+        table = (
+            "<table class='detail'><thead><tr>"
+            "<th>Key</th><th>Documented</th><th>Active</th><th>Match</th>"
+            "</tr></thead><tbody>"
+            f"{''.join(rows)}</tbody></table>"
+        )
+    return (
+        f"<p class='meta'>Diff vs documented default: "
+        f"<span class='badge {badge}'>{html.escape(status)}</span></p>"
+        f"{table}"
+    )
+
+
+def _entry_card(entry: dict[str, Any] | PolicyEntry) -> str:
+    title = str(entry.get("title") if isinstance(entry, dict) else entry.title)
+    category = str(entry.get("category") if isinstance(entry, dict) else entry.category)
+    summary = str(entry.get("summary") if isinstance(entry, dict) else entry.summary)
+    sources_data = entry.get("sources", []) if isinstance(entry, dict) else entry.sources
+
+    sources = "".join(_source_pointer(s) for s in sources_data)
+    return (
+        "<div class='prompt-card'>"
+        f"<h3>{html.escape(title)} "
+        f"<span class='badge'>{html.escape(category)}</span></h3>"
+        f"<p>{html.escape(summary)}</p>"
+        "<p class='meta'><strong>Source pointers</strong></p>"
+        f"<ul>{sources}</ul>"
+        "<p class='meta'><strong>Active configuration</strong></p>"
+        f"{_active_block(entry)}"
+        f"{_diff_block(entry)}"
+        "</div>"
+    )
+
+
+def render_policy_page(snapshot: PolicyInventorySnapshot | dict[str, Any]) -> str:
+    if isinstance(snapshot, PolicyInventorySnapshot):
+        payload = snapshot_to_dict(snapshot)
+    elif isinstance(snapshot, dict):
+        payload = console_redaction.redact_payload(snapshot)
+    else:
+        payload = {}
+
+    categories_list = payload.get("categories") or []
+    categories = ", ".join(html.escape(str(c)) for c in categories_list) or "none"
+    entries_list = payload.get("entries") or []
+    cards = "".join(_entry_card(e) for e in entries_list)
+    build_errors = ""
+    errors_list = payload.get("build_errors") or []
+    if errors_list:
+        items = "".join(
+            f"<li>{html.escape(str(err))}</li>" for err in errors_list
+        )
+        build_errors = (
+            "<div class='stub'><p><strong>Some guardrails could not be built:"
+            f"</strong></p><ul>{items}</ul></div>"
+        )
+    note = str(payload.get("note") or "")
+    schema_version = payload.get("schema_version") or 1
+    return (
+        "<h2>Workflow policy &amp; guardrails</h2>"
+        f"<p class='muted'>{html.escape(note)}</p>"
+        f"<p class='meta'>Schema v{schema_version} · "
+        f"{len(entries_list)} guardrails · categories: {categories}</p>"
+        f"{build_errors}"
+        f"{cards}"
+        "<p class='muted'>This page is read-only. It reports enforced policy "
+        "and never edits or weakens a gate. Secret values are redacted.</p>"
+    )