Merge branch 'master' into fix/issue-690-review-profile-switch-guard

Merge pull request 'docs(remote-mcp): threat model, trust boundaries, and decomposition ruling (Closes #956 )' (#965 ) from docs/issue-956-remote-mcp-threat-model into master
docs(remote-mcp): threat model, trust boundaries, and decomposition ruling (Closes #956 )
2026-07-28 08:38:08 -05:00 · 2026-07-28 08:19:45 -05:00 · 2026-07-28 04:41:26 -04:00 · 2026-07-28 02:21:11 -05:00 · 2026-07-25 19:17:19 -04:00
9 changed files with 1312 additions and 1 deletions
@@ -589,6 +589,47 @@ When dynamic profile switching is enabled and a profile is activated via `gitea_
 2. Call `gitea_whoami` with the target remote to prove and verify the fresh Gitea authenticated identity.
 This guarantees the active profile operations align with the actual Gitea authenticated user credential.
 ### 4. Review-State Invalidation on Profile Switch (#690)
 A cross-profile activation (e.g. reviewer → author → reviewer) is a session
 boundary for formal review state. On any switch where the activated profile
 differs from the previous one, `gitea_activate_profile` invalidates, in
 memory **and** in durable session state (for both the old and new profile
 identities):
 - preflight identity/capability stamps (`gitea_whoami` / `gitea_resolve_task_capability` proof),
 - review workflow-load proof (`gitea_load_review_workflow`),
 - the review decision lock (including `final_review_decision_ready` markers),
 - the reviewer PR session lease binding,
 - live namespace-health assessments.
 Before any formal verdict (`gitea_mark_final_review_decision` /
 `gitea_submit_pr_review`) the full reviewer preflight must be re-established
 under the new profile: `gitea_whoami`, `gitea_load_review_workflow`,
 `gitea_resolve_task_capability(review_pr)`, live head re-pin, and lease
 re-acquire/adopt. Switching back to the earlier profile does **not**
 resurrect the prior run — durable state keyed by either profile identity is
 cleared at switch time.
 The supported pattern remains **separate session/namespace per role**
 (dual-namespace, §2): file author-side follow-ups from an author session,
 not by hopping profiles inside a formal review run. Runtime profile
 switching is the operator-approved exception and always carries the
 re-preflight cost above.
 ### 5. Namespace Provenance (#690)
 The server cannot derive its own client-managed MCP namespace name, so a
 launcher may declare it via the `GITEA_MCP_NAMESPACE` environment variable
 (e.g. `gitea-reviewer`). `gitea_whoami`, `gitea_get_runtime_context`, and
 `gitea_resolve_task_capability` report `namespace_provenance` — the
 configured client namespace, the active execution profile, and, for tasks
 with a required namespace (`review_pr` → `gitea-reviewer`, `merge_pr` →
 `gitea-merger`), a mismatch verdict. A declared namespace that disagrees
 with the requested task's required namespace **fails closed**. An
 undeclared namespace is reported as `unknown` and is never treated as
 proof either way.
 ## Gitea MCP Runtime Isolation and Worktree Safety
 To ensure high availability and prevent broken feature worktrees from disabling essential security/identity controls, the Gitea MCP server implements runtime isolation:
@@ -86,3 +86,24 @@ When a namespace returns EOF, follow
 When blocked, repair the IDE namespace and re-record a healthy
 `client_namespace` assessment before retrying the mutation.
 ## Namespace provenance (#690)
 A server process cannot derive the name of the client-managed namespace it is
 registered under, so the launcher may declare it with the
 `GITEA_MCP_NAMESPACE` environment variable (e.g. `GITEA_MCP_NAMESPACE=gitea-reviewer`).
 - `gitea_whoami`, `gitea_get_runtime_context`, and
  `gitea_resolve_task_capability` report `namespace_provenance`: the declared
  client namespace, the active execution profile, and — for tasks with a
  required namespace (`review_pr`/`submit_review` → `gitea-reviewer`,
  `merge_pr` → `gitea-merger`) — a `mismatch` verdict.
 - A declared namespace that disagrees with the requested task's required
  namespace **fails closed** (`allowed_in_current_session=false` with a STOP
  guidance entry).
 - An undeclared namespace is reported as `namespace_source="unknown"` and is
  never treated as proof either way.
 - A profile switch via `gitea_activate_profile` clears all recorded live
  namespace-health assessments; re-probe through the client before further
  review/merge mutations.
@@ -0,0 +1,80 @@
 {
  "_comment": [
    "Machine-checkable anchor table for docs/remote-mcp/threat-model.md (#956).",
    "Every file:line anchor cited in the threat model must appear here, and the",
    "source line at that anchor must contain the 'expect' substring.",
    "tests/test_issue_956_threat_model.py enforces both directions, so a refactor",
    "that shifts a line number fails the suite instead of silently rotting the",
    "document. #930's inventory had no such guard and its gitea_mcp_server.py",
    "anchors drifted between 7bf4f125 and aad5c8b4."
  ],
  "generated_against_commit": "aad5c8b42361d380a8eeb07b94b90815e594c2c5",
  "anchors": [
    {"anchor": "gitea_mcp_server.py:24721", "expect": "bind_native_mcp_transport(transport=\"stdio\")"},
    {"anchor": "mcp_daemon_guard.py:45", "expect": "_PRODUCTION_TRANSPORTS = frozenset({\"stdio\"})"},
    {"anchor": "mcp_daemon_guard.py:174", "expect": "def bind_native_mcp_transport"},
    {"anchor": "irrecoverable_provenance.py:497", "expect": "def assess_transport_for_auth_mint"},
    {"anchor": "gitea_mcp_server.py:9129", "expect": "assess_transport_for_auth_mint()"},
    {"anchor": "gitea_mcp_server.py:9378", "expect": "assess_transport_for_auth_mint()"},
    {"anchor": "mcp_server.py:4", "expect": "Runs over stdio."},
    {"anchor": "gitea_mcp_server.py:15412", "expect": "def _is_client_managed_process"},
    {"anchor": "gitea_mcp_server.py:15442", "expect": "def _provenance_mutation_block"},
    {"anchor": "gitea_mcp_server.py:15450", "expect": "unsupported_manual_launch"},
    {"anchor": "gitea_mcp_server.py:19001", "expect": "server_provenance"},
    {"anchor": "gitea_mcp_server.py:21442", "expect": "def _check_mcp_runtimes_diagnostics"},
    {"anchor": "gitea_mcp_server.py:21462", "expect": "\"ps\", \"-o\", \"pid,lstart,command\""},
    {"anchor": "gitea_mcp_server.py:21506", "expect": "\"ps\", \"eww\""},
    {"anchor": "gitea_config.py:1172", "expect": "RECOGNIZED_GITEA_ENV_KEYS"},
    {"anchor": "gitea_config.py:1233", "expect": "GITEA_CLIENT_MANAGED"},
    {"anchor": "gitea_config.py:54", "expect": "ENV_PROFILE = \"GITEA_MCP_PROFILE\""},
    {"anchor": "gitea_config.py:97", "expect": "_REVIEW_MERGE_OPS"},
    {"anchor": "gitea_config.py:499", "expect": "repository authorization scope"},
    {"anchor": "gitea_config.py:956", "expect": "def _keychain_token"},
    {"anchor": "gitea_config.py:974", "expect": "def resolve_token"},
    {"anchor": "gitea_config.py:1015", "expect": "def keychain_auth"},
    {"anchor": "gitea_config.py:294", "expect": "def _validate_identity_auth"},
    {"anchor": "mcp_daemon_guard.py:440", "expect": "def assert_keychain_access_allowed"},
    {"anchor": "gitea_mcp_server.py:19258", "expect": "def gitea_list_profiles"},
    {"anchor": "gitea_mcp_server.py:19309", "expect": "gitea_config.resolve_token(p)"},
    {"anchor": "gitea_mcp_server.py:19552", "expect": "def gitea_audit_config"},
    {"anchor": "gitea_mcp_server.py:19574", "expect": "service_summaries(config)"},
    {"anchor": "gitea_config.py:704", "expect": "def resolve_service"},
    {"anchor": "gitea_config.py:837", "expect": "def service_summaries"},
    {"anchor": "gitea_config.py:851", "expect": "_keychain_token(auth.get(\"id\"))"},
    {"anchor": "gitea_mcp_server.py:17707", "expect": "\"jenkins-mcp\""},
    {"anchor": "gitea_mcp_server.py:17713", "expect": "external-mcp"},
    {"anchor": "gitea_mcp_server.py:17734", "expect": "\"glitchtip-mcp\""},
    {"anchor": "gitea_mcp_server.py:17739", "expect": "external-mcp"},
    {"anchor": "mcp_discoverability.py:9", "expect": "EXPECTED_JENKINS_TOOLS"},
    {"anchor": "mcp_discoverability.py:17", "expect": "EXPECTED_GLITCHTIP_TOOLS"},
    {"anchor": "sentry_incident_bridge.py:36", "expect": "SENTRY_AUTH_TOKEN"},
    {"anchor": "sentry_incident_bridge.py:190", "expect": "def resolve_token"},
    {"anchor": "sentry_incident_bridge.py:289", "expect": "Authorization"},
    {"anchor": "sentry_observability.py:55", "expect": "SENTRY_DSN"},
    {"anchor": "master_parity_gate.py:168", "expect": "def capture_startup_parity"},
    {"anchor": "master_parity_gate.py:255", "expect": "mutation_safe"},
    {"anchor": "gitea_mcp_server.py:19102", "expect": "def gitea_assess_master_parity"},
    {"anchor": "gitea_mcp_server.py:190", "expect": "ACTIVE_WORKTREE_ENV"},
    {"anchor": "gitea_mcp_server.py:191", "expect": "AUTHOR_WORKTREE_ENV"},
    {"anchor": "gitea_mcp_server.py:2348", "expect": "/tmp/gitea_issue_lock.json"},
    {"anchor": "gitea_mcp_server.py:10894", "expect": "def gitea_bootstrap_author_issue_worktree"},
    {"anchor": "mcp_server.py:10", "expect": "/tmp/mcp_server_stderr.log"},
    {"anchor": "issue_lock_store.py:26", "expect": "DEFAULT_LOCK_DIR"},
    {"anchor": "issue_lock_store.py:83", "expect": "def session_pointer_path"},
    {"anchor": "issue_lock_store.py:98", "expect": "def is_process_alive"},
    {"anchor": "mcp_session_state.py:27", "expect": "DEFAULT_STATE_DIR"},
    {"anchor": "control_plane_db.py:47", "expect": "DEFAULT_DB_PATH"},
    {"anchor": "control_plane_db.py:380", "expect": "mode=0o700"},
    {"anchor": "control_plane_db.py:386", "expect": "sqlite3.connect"},
    {"anchor": "control_plane_db.py:1145", "expect": "os.getpid()"},
    {"anchor": "gitea_mcp_server.py:12801", "expect": "owner_pid_alive"}
  ]
 }
@@ -0,0 +1,403 @@
 # Remote-MCP threat model, trust boundaries, and service decomposition
 What the adversary is, what each boundary protects, and which services may share a process.
 - **Issue:** #956 (Remote-MCP threat model), child of epic #929, cross-linked to #955.
 - **Depends on:** #930 (closed) — `docs/remote-mcp/coupling-inventory.md`.
 - **Blocks:** #932, #933, #934, #938.
 - **Generated against commit:** `aad5c8b42361d380a8eeb07b94b90815e594c2c5` (`master`).
 - **Scope:** documentation only. This child changes no server behavior. It adds one
  document, one anchor fixture, and the test that enforces them.
 ## Relationship to #930
 #930 asked *what breaks when the process stops being local*. This document asks *what an
 attacker gets, and where we stop them*. The two are deliberately different axes: #930
 classifies each coupling as portable, seam, replacement, or cannot-be-remote; this document
 classifies each **credential** by blast radius and each **boundary** by what crossing it
 requires. An entry can be perfectly portable and still be a trust disaster —
 `gitea_config.py:851` is portable Python that reads a CI secret from inside the Gitea server.
 ### Anchors are enforced, not asserted
 Every `file:line` in this document is declared in `docs/remote-mcp/threat-model-anchors.json`
 with the substring that must appear at that line, and
 `tests/test_issue_956_threat_model.py` fails if any anchor does not resolve or if the
 document cites an anchor the fixture does not cover.
 This guard exists because #930 did not have one. Its inventory was generated at
 `7bf4f125`; by `aad5c8b4` its `gitea_mcp_server.py` anchors had drifted — the transport
 bind it cited at line 23750 now lives at `gitea_mcp_server.py:24721`, and its
 client-managed provenance anchor at 14588 now lands in an unrelated function. Nothing
 failed, because nothing checked. Anchors into a ~24,700-line module rot silently, and a
 security document that cannot prove its own citations is worse than none, because it is
 trusted.
 ---
 ## 1. Assets
 What an adversary wants. Ordered by consequence, not by likelihood.
 | ID | Asset | Why it matters |
 | -- | ----- | -------------- |
 | A1 | Merge authority on `Scaled-Tech-Consulting/Gitea-Tools` | This repository *is* the control plane. Code merged here becomes the gate that authorizes every future mutation, so merge authority is self-amplifying: one merge can disable every other control in this document. |
 | A2 | Write authority on the `mdcps` tenant | A second, unrelated organization reachable from the same configuration. Compromise here is a cross-organization incident, not an internal one. |
 | A3 | The eight Gitea role credentials | Long-lived bearer tokens. Possession is authority; there is no second factor at the API. |
 | A4 | Jenkins read access (`mdcps`, enabled) | Build logs routinely carry deployment topology, internal hostnames, and accidentally-echoed secrets. |
 | A5 | Error-tracking read access (GlitchTip / Sentry) | Event payloads carry stack frames, request context, and production user data. |
 | A6 | Coordination-state integrity | The locks, leases, and review-decision records that make "exactly one owner" true. Corrupting them needs no Gitea credential and produces duplicate or lost work. |
 | A7 | The operator's checkout and worktrees | Unmerged code, branch state, and the filesystem the author tools write to. |
 | A8 | The macOS login keychain | The meta-credential. Everything in A3, A4, and A5 resolves from it. |
 | A9 | Separation of duty between review and merge | The property that no single actor both approves and lands a change. An *asset*, not a control, because it is what the controls exist to produce. |
 | A10 | Audit and provenance records | Determine whether an incident is reconstructable. An attacker who can forge provenance makes an intrusion indistinguishable from normal work. |
 ## 2. Adversaries
 | ID | Adversary | Capability assumed | Not assumed |
 | -- | --------- | ------------------ | ----------- |
 | ADV1 | **Compromised LLM client** | Full control of one MCP client. Issues arbitrary tool calls, in any order, with any arguments, at machine speed. Sees every tool result. | Cannot read the operator's disk except through tools; cannot execute arbitrary local code outside the tool surface. |
 | ADV2 | **Prompt injection** via repository content | Controls text the model reads and treats as instruction — issue bodies, PR descriptions, review comments, commit messages, file contents. Reaches the model on any read of untrusted content. | Holds no credential and issues no call directly. Its entire power is causing an *authorized* client to act. |
 | ADV3 | **Malicious tool arguments** | Supplies hostile values to any parameter — paths, branch names, session identifiers, worktree paths, issue numbers — including traversal, injection, and confusion between look-alike identifiers. | Cannot bypass a gate that actually validates its input. |
 | ADV4 | **Network attacker** | Observes and modifies traffic between client, server, and Gitea. Attempts downgrade, replay, and endpoint impersonation. | Does not hold a valid credential at the start. |
 | ADV5 | **Curious operator** | Legitimate local access to the workstation: process table, `/tmp`, home directory, keychain prompts. Not malicious, but not authorized for every role either. | Does not defeat the OS keychain's own access control without a prompt. |
 ADV2 is the adversary this architecture most under-models. Every other adversary must first
 obtain something. Prompt injection obtains nothing: it borrows authority the client already
 holds and is indistinguishable at the tool boundary from legitimate work. Each boundary
 below therefore states whether it constrains ADV2 at all — and most do not, because they
 authenticate the *caller*, not the *intent*.
 ## 3. Trust boundaries
 "Crossing requires today" is what the code actually enforces at
 `aad5c8b42361d380a8eeb07b94b90815e594c2c5`, not what the design intends.
 | ID | Boundary | Protects | Crossing requires today | Crossing must require remotely |
 | -- | -------- | -------- | ----------------------- | ------------------------------ |
 | B1 | LLM client ↔ MCP server session | A1, A3, A10 — that a mutating session was established through the sanctioned client path | A literal `stdio` bind (`gitea_mcp_server.py:24721`) inside a closed allowlist (`mcp_daemon_guard.py:45`, `mcp_daemon_guard.py:174`); client-managed provenance (`gitea_mcp_server.py:15412`) or a refusal (`gitea_mcp_server.py:15450`); production transport before recovery-authorization mint (`irrecoverable_provenance.py:497`, consumed at `gitea_mcp_server.py:9129` and `gitea_mcp_server.py:9378`) | An authenticated handshake issuing a server-side session identity bound to a principal, with the transport recorded in provenance. The physical proof (a pipe) must become a cryptographic one. |
 | B2 | Role ↔ role | A9 — that author, reviewer, merger, and reconciler are distinct authorities | **The process boundary only.** The role is a property of the process, read once from `GITEA_MCP_PROFILE` (`gitea_config.py:54`). A caller gets author permissions by connecting to the author process. Review and merge are the operations singled out for extra care (`gitea_config.py:97`) | A per-request principal, so the role follows from the credential presented and cannot be selected by reaching a different endpoint. |
 | B3 | MCP server ↔ credential store | A3, A8 — that only sanctioned code turns a profile into a token | `_keychain_token` shelling out to the login keychain (`gitea_config.py:956`), dispatched by `resolve_token` (`gitea_config.py:974`) with the reference type built at `gitea_config.py:1015`, gated by `assert_keychain_access_allowed` (`mcp_daemon_guard.py:440`). Inline secrets are rejected at config load (`gitea_config.py:294`) | A credential provider keyed by the *request* principal, returning only that principal's credential, with the source recorded and the value never returned. |
 | B4 | MCP server ↔ Gitea | A1, A2 — that only authorized calls reach the forge | A bearer token over TLS. Server-side, nothing distinguishes one role's token from another beyond the account it belongs to | Unchanged at the forge; the endpoint in front of it must refuse unauthenticated and plaintext connections before tool dispatch. |
 | B5 | MCP server ↔ caller's filesystem | A7 — that a tool acts on the *caller's* disk or refuses | Nothing. The server's disk *is* the caller's disk. Worktree bootstrap writes directly (`gitea_mcp_server.py:10894`); the active workspace is process-global (`gitea_mcp_server.py:190`, `gitea_mcp_server.py:191`) | An explicit per-tool classification, enforced at dispatch, refusing filesystem tools over a transport that cannot reach the caller's disk. A green verdict about the wrong disk is the failure to prevent. |
 | B6 | MCP server ↔ coordination state | A6, A9 — mutual exclusion | Local files and a local SQLite database, with liveness judged from the local process table (`issue_lock_store.py:98`), keyed on paths under one user's home (`issue_lock_store.py:26`, `mcp_session_state.py:27`, `control_plane_db.py:47`) and on `os.getpid()` (`control_plane_db.py:1145`, `gitea_mcp_server.py:12801`). A legacy global slot still exists at `gitea_mcp_server.py:2348`, and the session-pointer file is named per PID (`issue_lock_store.py:83`) | One authority per ownership question, with liveness from session identity and expiry, and atomic acquire, renew, and release across hosts. |
 | B7 | Gitea integration ↔ unrelated integrations | A4, A5 — that a Gitea compromise is not a CI and observability compromise | **Nothing.** See §5. The Gitea server reads Jenkins and GlitchTip secrets (`gitea_config.py:851`, reached from `gitea_config.py:837`) and holds the Sentry token (`sentry_incident_bridge.py:190`) | A hard process boundary. This is the boundary #956 exists to create. |
 | B8 | Tenant ↔ tenant (`prgs` / `mdcps` / `local-lab`) | A2 — that one organization's compromise is not another's | Convention. One configuration declares all three contexts; `resolve_service` fails closed on a *disabled* context (`gitea_config.py:704`) but the credentials of enabled ones remain reachable in-process. A per-profile repository scope exists (`gitea_config.py:499`) | Separate deployments, or at minimum per-tenant credential scopes with no process able to resolve both. |
 | B9 | Deployed code ↔ merged policy | A1, A10 — that the running server enforces the rules that were actually merged | Comparing this process's startup commit against this disk (`master_parity_gate.py:168`), conjoined into a single verdict (`master_parity_gate.py:255`) published by `gitea_mcp_server.py:19102` | Freshness defined against the deployed build identity, with an explicit fail-closed verdict when undeterminable. |
 ### What no boundary constrains
 None of B1–B9 constrains **ADV2**. Every one authenticates a caller or a process; prompt
 injection supplies neither. An injected instruction that reaches an authorized author
 session crosses B1, B2, B3, and B5 legitimately, because at each of those boundaries it *is*
 the author. The only controls that bite ADV2 are those constraining what an authenticated
 principal may do regardless of what it asks for — the per-role permission split (B2), the
 repository scope at `gitea_config.py:499`, and separation of duty (A9). Sizing those
 controls correctly matters more after the migration, not less, because a remote endpoint
 raises the number of clients that can be injected into.
 ## 4. Data flows
 Flows that cross a boundary. `==>` carries a credential; `-->` does not.
 ```
                          B1                         B4
  [LLM client] ====================> [MCP server] ========> [Gitea]
        ^        stdio pipe today          |  ^               (A1,A2)
        |        session identity          |  |
        |        after migration           |  |
        |                                  |  | B3
   untrusted repository content            |  +======> [macOS login keychain] (A8)
   read back into the model (ADV2)         |              resolves A3, A4, A5
        ^                                  |
        +----------------------------------+
                                           |
                  B5                       |  B6
   [operator checkout / worktrees] <--------+-------> [locks · leases · sqlite]
              (A7)                         |                  (A6)
                                           |
                  B7  <-- boundary does not exist today
                                           |
                  +========================+========================+
                  |                        |                        |
            [Jenkins] (A4)         [GlitchTip] (A5)          [Sentry] (A5)
        external MCP server      external MCP server      in-process bridge
 ```
 Two flows deserve attention because neither is obvious from the code:
 1. **The keychain flow fans out.** B3 is drawn once but resolves credentials for *every*
   configured profile and service, not only the active one. `gitea_list_profiles`
   (`gitea_mcp_server.py:19258`) reports each profile's credential status by calling
   `resolve_token` on it (`gitea_mcp_server.py:19309`), and `gitea_audit_config`
   (`gitea_mcp_server.py:19552`) reports service credential status through
   `service_summaries` (`gitea_mcp_server.py:19574`).
 2. **The return path is a flow too.** Content read from Gitea travels back into the model
   and is treated as instruction. This is the ADV2 edge, and it is the only edge in the
   diagram with no authentication on it, because it is not a request.
 ## 5. Per-boundary credential inventory
 **14 credentials in total.** Blast radius is stated as what the credential yields *on its
 own*, assuming every gate not backed by the credential itself has been bypassed — because
 an attacker holding a token calls the API, not our tools.
 | ID | Credential | Holder | Boundary | Blast radius |
 | -- | ---------- | ------ | -------- | ------------ |
 | CR1 | `prgs-author` Gitea token — account `jcwalker3` | macOS keychain; resolved in-process (`gitea_config.py:974`) | B3 → B4 | Create branches, push, commit, open PRs, create/close/comment issues on the control-plane repo. Cannot approve or merge. The one credential whose identity is genuinely distinct. |
 | CR2 | `prgs-reviewer` Gitea token — account `sysadmin` | macOS keychain | B3 → B4 | Approve and request changes. **Shares one Gitea account with CR3, CR4, CR5.** |
 | CR3 | `prgs-merger` Gitea token — account `sysadmin` | macOS keychain | B3 → B4 | Merge to `master` — A1 in full. Same account as CR2. |
 | CR4 | `prgs-reconciler` Gitea token — account `sysadmin` | macOS keychain | B3 → B4 | Close PRs, delete branches, irrecoverable decision-lock recovery. Same account as CR2. |
 | CR5 | `prgs-controller` Gitea token — account `sysadmin` | macOS keychain | B3 → B4 | Same operation set as CR4. Same account as CR2. |
 | CR6 | `mdcps-author` Gitea token — account `913443` | macOS keychain | B3 → B4, B8 | Author operations on a second organization. **Shares one account with CR7 and CR8.** |
 | CR7 | `mdcps-reviewer` Gitea token — account `913443` | macOS keychain | B3 → B4, B8 | Approve and request changes on `mdcps`. Same account as CR6. |
 | CR8 | `mdcps-merger` Gitea token — account `913443` | macOS keychain | B3 → B4, B8 | Merge on `mdcps` — A2 in full. Same account as CR6. |
 | CR9 | MDCPS Jenkins read credential | macOS keychain, read from the Gitea server process (`gitea_config.py:851`) | B7 | Read CI jobs, builds, and logs (A4). Enabled today. |
 | CR10 | MDCPS GlitchTip read credential | macOS keychain, read from the Gitea server process (`gitea_config.py:851`) | B7 | Read error events and their payloads (A5). Enabled today. |
 | CR11 | `SENTRY_AUTH_TOKEN` | Process environment, read in-process (`sentry_incident_bridge.py:36`, `sentry_incident_bridge.py:190`), sent as a bearer header (`sentry_incident_bridge.py:289`) | B7 | Read and reconcile Sentry issues (A5). Not a keychain credential — an env var, so it is inherited by anything the process spawns. |
 | CR12 | `SENTRY_DSN` | Process environment (`sentry_observability.py:55`) | B7 | Write events into the observability project. Low read value, real forgery value: an attacker can inject fabricated events into the record (A10). |
 | CR13 | macOS login keychain access | The operator's login session; gated by `assert_keychain_access_allowed` (`mcp_daemon_guard.py:440`) | B3, ADV5 | **Every other credential in this table except CR11 and CR12.** This is the aggregation point. |
 | CR14 | Coordination-store access (no secret) | Filesystem permissions — `control_plane_db.py:47`, created `0o700` (`control_plane_db.py:380`), opened with a local file lock (`control_plane_db.py:386`) | B6, ADV5 | Full read/write of locks, leases, and decision records (A6). **There is no credential here at all** — anything running as the operator can rewrite ownership. |
 ### Findings
 **Finding 1 — Role separation is not credential separation.** Four `prgs` roles resolve to
 one Gitea account (`sysadmin`): reviewer, merger, reconciler, and controller. A stolen
 reviewer credential *is* a merger credential. A9 — separation of duty between approving and
 landing — is therefore enforced entirely by which local process a call reaches (B2), and not
 at all by the forge. It survives exactly as long as B2 does, and B2 is the boundary the
 migration dissolves.
 **Finding 2 — The `mdcps` tenant has no role separation at all.** Author, reviewer, and
 merger all resolve to account `913443`. One credential can open a PR, approve it, and merge
 it. The in-process self-review check compares the authenticated username against the PR
 author and would refuse — but that check runs on our side of B4. It is not a property of
 the credential, and an attacker holding the token does not call our tools.
 **Finding 3 — Any one role process can resolve every other role's credential.** This is not
 inferred; it is demonstrated by tool output. `gitea_list_profiles`
 (`gitea_mcp_server.py:19258`) called from the **author** session reports
 `identity_status: "credentials present"` for `prgs-merger`, `prgs-reviewer`,
 `prgs-reconciler`, and every `mdcps` profile, because it calls `resolve_token` on each one
 (`gitea_mcp_server.py:19309`). The author process does not merely *have access to* the
 merger's credential — it reads it to answer a status query. B2 is not a credential boundary
 in either direction.
 **Finding 4 — The Gitea server reads CI and observability secrets.** `gitea_audit_config`
 (`gitea_mcp_server.py:19552`) reports `MDCPS Jenkins: enabled, read-only, authenticated`.
 That word `authenticated` is produced by `service_summaries` (`gitea_mcp_server.py:19574`,
 defined at `gitea_config.py:837`), whose default check calls `_keychain_token` on the
 service's own keychain reference (`gitea_config.py:851`). Producing that one line requires
 the Gitea MCP server to read the Jenkins secret and the GlitchTip secret out of the
 keychain. B7 does not exist.
 **Finding 5 — Jenkins and GlitchTip are already decomposed; the reach is residual.** Their
 tools live in separately registered servers, marked `external-mcp`
 (`gitea_mcp_server.py:17707`, `gitea_mcp_server.py:17713`, `gitea_mcp_server.py:17734`,
 `gitea_mcp_server.py:17739`) with their own expected tool sets (`mcp_discoverability.py:9`,
 `mcp_discoverability.py:17`). The correct decomposition was already chosen. What remains is
 a leak across it: the credential *references* still live in the Gitea configuration and are
 still resolved by the Gitea process. #75 bundled these services into one control-plane
 umbrella; the tools were separated afterwards, the credentials were not.
 **Finding 6 — Sentry is the exception that is not decomposed.** Unlike Jenkins and
 GlitchTip, the Sentry bridge runs *inside* the Gitea server, resolving its token from the
 process environment (`sentry_incident_bridge.py:190`) and sending it as a bearer header
 (`sentry_incident_bridge.py:289`). Being an environment variable rather than a keychain item
 makes it strictly worse: it needs no keychain prompt and is inherited by every subprocess the
 server spawns — including the `ps` invocations at `gitea_mcp_server.py:21462` and
 `gitea_mcp_server.py:21506`, reached from `gitea_mcp_server.py:21442`.
 **Finding 7 — The highest-value coordination asset has the weakest gate.** A6 is protected
 by filesystem permissions alone (CR14). Corrupting a lease requires no Gitea credential,
 produces no forge-side audit record, and breaks the mutual exclusion the entire workflow
 assumes. Every other asset costs an attacker a credential; this one costs nothing beyond
 local access, which is exactly ADV5's position.
 **Finding 8 — Provenance authenticates the launch, not the caller.** `server_provenance` is
 reported as exactly `client_managed` or `manual_launch` (`gitea_mcp_server.py:19001`),
 derived from environment inspection (`gitea_mcp_server.py:15412`) with the recognized-key
 allowlist at `gitea_config.py:1172` and the generator that emits the marker at
 `gitea_config.py:1233`. Every one of those facts is fixed at process start. A client that is
 trustworthy at launch and compromised a minute later remains `client_managed` for the life
 of the process, and the stdio contract that underwrites it is stated as a property of the
 server itself (`mcp_server.py:4`).
 ## 6. Decomposition ruling
 This section is the ruling #956 requires. It is a decision, not a recommendation.
 **D1 — No unrelated co-residency.** A single integration process **must not** hold, resolve,
 or be able to resolve credentials for services it does not itself integrate with.
 Concretely: the Gitea MCP service may hold Gitea credentials and nothing else. Jenkins,
 GlitchTip, Sentry, and any database credential are **not permitted** to co-reside with Gitea
 credentials in one process.
 *Rationale.* A process is the smallest unit an attacker takes whole. Once ADV1 or ADV2
 controls execution in a process, every credential that process can resolve is theirs, and no
 in-process check helps, because the checks are in the process too. Blast radius is therefore
 a property of the process boundary and nothing finer. Findings 4 and 6 show that today one
 compromise of the Gitea server yields CI read access, error-tracking read access, and — via
 CR13 — every role credential on both tenants. That is the single largest reduction in blast
 radius available anywhere in epic #929, and it costs no new mechanism: the decomposition
 already exists (Finding 5) and is merely leaked across.
 **D2 — Separation of duty must be backed by credentials.** Two roles whose separation is a
 security property must not resolve to the same forge account. Specifically, reviewer and
 merger must be distinct accounts. Today they are not, on either tenant (Findings 1 and 2).
 *Rationale.* B2 is a process boundary, and the migration's entire purpose is to replace
 process boundaries with request-level ones. A separation enforced only by which process a
 call reaches does not survive that replacement — and it is already bypassable by anyone who
 holds the token and calls the API instead of the tool.
 **D3 — Credential resolution is scoped to the request principal.** A session must resolve its
 own credential and must have no path to any other principal's. The resolve-every-profile
 behavior behind `gitea_mcp_server.py:19309` and `gitea_mcp_server.py:19574` must report
 configured-or-not from configuration alone, without resolving the secret.
 *Rationale.* Finding 3. An audit surface that proves a credential exists by fetching it is a
 credential-aggregation primitive wearing a diagnostic's clothes.
 **D4 — Coordination state is a protected asset with its own authority.** Access to locks,
 leases, and decision records must require an authenticated session, not merely local
 filesystem access.
 *Rationale.* Finding 7. #937 already moves this store for concurrency reasons; the
 authorization requirement must land with it, or the store becomes remotely reachable while
 still being authorized by nothing.
 ### Exceptions
 **One, time-boxed.** During the dual-run window defined by #939, the **local** stdio fleet
 may continue to resolve Jenkins and GlitchTip credential *references* from the shared
 configuration, because removing them from the local configuration is not a prerequisite for
 standing up the remote endpoint and would strand the operator's existing local workflow.
 This exception is bounded by all of:
 - It applies to the local stdio deployment only. The remote endpoint (#938) must be
  configured with Gitea credentials and no others from its first day.
 - It expires when #939 completes. It does not survive cutover.
 - It does not extend to Sentry: CR11 and CR12 are process-environment credentials in the
  Gitea server (Finding 6) and must be absent from the remote deployment's environment
  regardless of dual-run state.
 No exception is granted to D2, D3, or D4.
 ### Consequences for the target architecture
 - The remote endpoint serves **Gitea only**. It is not a general control-plane endpoint.
 - Jenkins and GlitchTip keep their existing separate servers, and their credential
  references move out of the Gitea configuration.
 - The Sentry bridge either moves behind its own service boundary or is absent from the
  remote deployment. It does not travel with the Gitea server.
 - Reviewer and merger accounts diverge before the endpoint is trusted for merges, or A9 is
  recorded as unenforced.
 ## 7. Child-to-boundary mapping
 Every #929 child from 2 through 10, mapped to the boundary it implements. A child
 implementing more than one boundary names its primary first.
 | Child | Issue | Boundaries | What it must establish | Rulings it must honor |
 | ----: | ----- | ---------- | ---------------------- | --------------------- |
 | 2 | #931 | B1, B9 | The bound transport becomes a validated value that provenance and freshness can both key on. Without it neither B1 nor B9 has an input. | — |
 | 3 | #932 | B2 | The role becomes a property of the request, not the process — the boundary the migration otherwise deletes. | D2, D3 |
 | 4 | #933 | B3, B7 | Credentials come from a provider keyed by principal. This is where D1 and D3 are either enforced or permanently lost. | D1, D3 |
 | 5 | #934 | B1 | Session provenance replaces pipe-and-process-table proof with an authenticated session identity. | — |
 | 6 | #935 | B9 | Freshness redefined against deployed build identity, with an explicit undeterminable verdict. | — |
 | 7 | #936 | B5 | Every tool classified and the filesystem boundary enforced at dispatch, so a tool cannot return green about the wrong disk. | — |
 | 8 | #937 | B6 | One authority per ownership question, with session-identity liveness and atomic transitions. | D4 |
 | 9 | #938 | B4, B1, B8 | The endpoint: authentication, principal binding, transport security, and — critically — the deployed credential set. | D1, D2, D3 |
 | 10 | #939 | B6 | Dual-run with exactly one coordination authority at every instant, and the rollback that proves the way back. | D1 exception expiry |
 Boundary coverage: B1 (#931, #934, #938), B2 (#932), B3 (#933), B4 (#938), B5 (#936),
 B6 (#937, #939), B7 (#933), B8 (#938), B9 (#931, #935).
 B7 has exactly one owner, #933, and that is deliberate. B7 is not created by standing up an
 endpoint; it is created by deciding which credentials a process may resolve, which is
 precisely what the credential-provider child does.
 ## 8. Adversarial walkthrough: a fully compromised LLM client
 The required negative case. ADV1 holds one MCP client and issues arbitrary tool calls. What
 does it reach at each boundary?
 ### Before the migration
 The client is attached to the local fleet over stdio.
 | Boundary | What ADV1 reaches | Stopped by |
 | -------- | ----------------- | ---------- |
 | B1 | Everything the fleet serves. The client *is* the sanctioned launcher: it satisfies the client-managed check (`gitea_mcp_server.py:15412`) by construction, and provenance is never re-verified after launch (Finding 8). | Nothing. The guard authenticates the launch, not the caller. |
 | B2 | All five roles — it is attached to all five namespaces. It can author a PR, approve it from the reviewer namespace, and merge it from the merger namespace. | Only the in-process self-review check, which compares `jcwalker3` (author) against `sysadmin` (reviewer) and **passes**, because Finding 1 made them different accounts while leaving reviewer and merger identical. A9 falls in one sequence of legitimate calls. |
 | B3 | Every credential in CR1–CR10 via CR13, with no additional prompt — the daemon is already sanctioned, so `assert_keychain_access_allowed` (`mcp_daemon_guard.py:440`) returns immediately. | Nothing. |
 | B4 | A1 and A2 in full. | Branch protection at the forge, to the extent configured. |
 | B5 | The operator's checkout and every worktree, through the author tools (`gitea_mcp_server.py:10894`), plus the shared stderr path at `mcp_server.py:10`. | Nothing; the server's disk is the target disk. |
 | B6 | All coordination state — no credential required (CR14). It can forge lease ownership and clear decision locks. | Filesystem permissions, which it already satisfies. |
 | B7 | Jenkins (A4) and GlitchTip (A5) secrets via Finding 4, and CR11/CR12 from its own environment. | Nothing. |
 | B8 | Both tenants. | Nothing in-process; only the disabled-context check (`gitea_config.py:704`), which does not apply to enabled contexts. |
 | B9 | Can it run stale code? Only by advancing the checkout, which parity detects (`master_parity_gate.py:255`). | This gate holds — the one boundary that behaves as designed against ADV1. |
 **Result: total.** One compromised client yields A1 through A8 and A10. The only asset with
 real resistance is A1 via branch protection, and the client holds the merger credential
 anyway. Nine boundaries, one meaningful stop.
 ### After the migration
 The same client authenticates to the remote endpoint with one role's credential, assuming
 #931–#939 land **and honor D1–D4**.
 | Boundary | What ADV1 reaches | Stopped by |
 | -------- | ----------------- | ---------- |
 | B1 | One authenticated session, bound to one principal. | #934: a forged or expired session identity is refused; the client cannot mint one. |
 | B2 | **One role.** Presenting the author credential yields author permissions only. | #932: the principal comes from the credential, not from which endpoint was reached. |
 | B3 | **One credential — its own.** | #933 with D3: the provider resolves by principal, and no diagnostic resolves the others. |
 | B4 | That role's authority on the forge. | Endpoint authentication (#938); plaintext and unauthenticated attempts refused before dispatch. |
 | B5 | **Nothing.** Filesystem tools are refused over the remote transport with a named blocker. | #936. |
 | B6 | Its own leases; contention resolves to exactly one winner. | #937 with D4: authenticated session required, not filesystem access. |
 | B7 | **Nothing.** No CI or observability credential exists in the process. | D1 — the single largest reduction on this table. |
 | B8 | One tenant. | D1 and #938: the deployment carries one tenant's credentials. |
 | B9 | Cannot induce stale enforcement. | #935: explicit fail-closed verdict, including undeterminable. |
 **Result: bounded.** The compromise is contained to one role on one tenant, with no
 filesystem reach and no lateral credential access. A9 survives *only if D2 lands* — if
 reviewer and merger still share `sysadmin`, a compromised reviewer session still merges, and
 this row reads the same after the migration as before it.
 ### What the migration does not fix
 Against **ADV2**, both tables are identical. Prompt injection does not need to cross a
 boundary: it arrives inside an authorized session and asks that session to do what it is
 already permitted to do. Every "stopped by" above authenticates a principal, and the
 injected instruction has the correct principal. The migration reduces ADV1's blast radius by
 roughly an order of magnitude and reduces ADV2's by nothing.
 The controls that do constrain ADV2 are per-principal permission scope (#932), repository
 scope (`gitea_config.py:499`), and credential-backed separation of duty (D2) — each limiting
 what an authenticated session may do *regardless of what it is asked for*. #955's
 secure-isolation end state should be read with that distinction in mind: removing credentials
 from clients defeats ADV1 and ADV5, and does not by itself defeat ADV2.
 Two further items are explicitly out of scope here and unowned by #929:
 - **Session-credential rotation and revocation.** #938 names rotation as documentation, but
  no child owns proving that a revoked credential stops an in-flight session.
 - **ADV3** (malicious tool arguments) is diffused across every child rather than owned. The
  per-request principal work in #932 is the natural place to assert that identifiers taken
  from the request never authorize anything on their own.
 ## 9. How to verify this document
 1. `PYTHONPATH=. pytest tests/test_issue_956_threat_model.py` — resolves every anchor
   against the working tree and checks the document's structural obligations.
 2. Pick any five anchors at random and read them; the fixture states what each line must
   contain.
 3. Reproduce Findings 3 and 4 live: call `gitea_list_profiles` and `gitea_audit_config`
   from the **author** namespace. Credential presence reported for roles other than the
   active one is Finding 3; `MDCPS Jenkins: enabled, read-only, authenticated` is Finding 4.
 If the anchor test fails after an unrelated refactor, the anchors moved and the fixture
 needs regenerating — the claims are still true, but they are no longer traceable, which
 #956 treats as the same defect.
@@ -839,6 +839,75 @@ def _invalidate_preflight_identity_state() -> None:
    _clear_preflight_capability_state()
 # #690: session-boundary invalidation record for the most recent cross-profile
 # activation. Surfaced in runtime diagnostics so a formal review run can prove
 # its state was reset by a profile switch and must be fully re-established.
 _PROFILE_SWITCH_INVALIDATION: dict | None = None
 def _invalidate_review_state_on_profile_switch(
    before_profile: str,
    after_profile: str,
 ) -> dict:
    """Invalidate review-critical session state on a profile switch (#690).
    Workflow-load proof, reviewer lease binding, the review decision lock,
    live namespace health, and preflight identity/capability stamps recorded
    under the prior profile are contaminated for the new role. Durable state
    keyed by *either* profile identity is cleared so a reviewer → author →
    reviewer hop cannot resurrect a stale review run: the full reviewer
    preflight (gitea_whoami, gitea_load_review_workflow,
    gitea_resolve_task_capability(review_pr), live head re-pin, lease
    re-acquire/adopt) must be re-established before any formal verdict.
    """
    global _PROFILE_SWITCH_INVALIDATION
    invalidated: list[str] = []
    _invalidate_preflight_identity_state()
    invalidated.append("preflight_identity_capability")
    review_workflow_load.clear_review_workflow_load()
    invalidated.append("review_workflow_load")
    _save_review_decision_lock(None)
    invalidated.append("review_decision_lock")
    reviewer_pr_lease.clear_session_lease()
    invalidated.append("reviewer_session_lease")
    if _LIVE_NAMESPACE_HEALTH:
        _LIVE_NAMESPACE_HEALTH.clear()
        invalidated.append("live_namespace_health")
    # Durable records keyed by either profile identity must not survive the
    # switch, or activating author → reviewer → author could revive a stale
    # review run without re-preflight.
    for identity in {before_profile, after_profile}:
        if not identity:
            continue
        try:
            mcp_session_state.clear_state(
                kind=mcp_session_state.KIND_DECISION_LOCK,
                profile_identity=identity,
            )
            mcp_session_state.clear_state(
                kind=mcp_session_state.KIND_WORKFLOW_LOAD,
                profile_identity=identity,
            )
        except Exception:
            pass  # best-effort durable cleanup; in-memory state already reset
    invalidated.append("durable_profile_state")
    _PROFILE_SWITCH_INVALIDATION = {
        "from_profile": before_profile,
        "to_profile": after_profile,
        "invalidated": invalidated,
        "invalidated_at": datetime.now(timezone.utc).isoformat(),
        "re_preflight_required": True,
    }
    return dict(_PROFILE_SWITCH_INVALIDATION)
 def record_preflight_check(
    type_name: str,
    resolved_role: str | None = None,
@@ -18108,6 +18177,11 @@ def gitea_whoami(
        "session_context_audit": session_ctx.mutation_context_audit_fields(),
        "identity_match": not id_match.get("block"),
        "identity_match_reasons": id_match.get("reasons") or [],
        # #690 AC4: report launcher-declared client namespace alongside the
        # active execution profile so drift is visible in diagnostics.
        "namespace_provenance": mcp_namespace_health.namespace_provenance(
            active_profile=profile["profile_name"]
        ),
    }
    if id_match.get("block"):
        _invalidate_preflight_identity_state()
@@ -19012,6 +19086,11 @@ def gitea_get_runtime_context(
        "shell_health": native_mcp_preference.shell_health_status(),
        "workflow_load_proof": review_workflow_load.workflow_load_status(
            PROJECT_ROOT),
        # #690: namespace provenance + profile-switch invalidation evidence.
        "namespace_provenance": mcp_namespace_health.namespace_provenance(
            active_profile=profile["profile_name"]
        ),
        "profile_switch_invalidation": _PROFILE_SWITCH_INVALIDATION,
    }
    if not is_client_managed:
@@ -19522,6 +19601,17 @@ def gitea_activate_profile(
        source="gitea_activate_profile",
    )
    # 4.7 #690: a profile switch is a session-boundary event for review state.
    # Any workflow-load proof, reviewer lease, decision lock, namespace
    # health, or preflight stamp recorded under the prior profile is
    # contaminated for the new role and must be re-established under the new
    # profile before any formal review verdict.
    switch_invalidation = None
    if before_profile != after_profile:
        switch_invalidation = _invalidate_review_state_on_profile_switch(
            before_profile, after_profile
        )
    # 5. Audit the switch if auditing is on
    _audit(
        "activate_profile",
@@ -19532,11 +19622,12 @@ def gitea_activate_profile(
            "before": before_profile,
            "after": after_profile,
            "session_context": session_ctx.mutation_context_audit_fields(),
            "review_state_invalidated": bool(switch_invalidation),
        },
        username=after_identity,
    )
-    return {
+    result = {
        "success": True,
        "message": f"Successfully activated profile '{profile_name}' (fresh identity verification complete).",
        "before_profile": before_profile,
@@ -19546,6 +19637,18 @@ def gitea_activate_profile(
        "session_context_audit": session_ctx.mutation_context_audit_fields(),
        "auto_profile_substitution": False,
    }
    if switch_invalidation is not None:
        result["review_state_invalidation"] = switch_invalidation
        result["re_preflight_required"] = True
        result["exact_next_action"] = (
            "Profile switch invalidated workflow-load proof, reviewer lease, "
            "decision lock, and preflight stamps (#690). Before any formal "
            "review verdict, re-run the full reviewer preflight: "
            "gitea_whoami, gitea_load_review_workflow, "
            "gitea_resolve_task_capability(review_pr), live head re-pin, and "
            "lease re-acquire/adopt."
        )
    return result
@mcp.tool()
@@ -21835,12 +21938,22 @@ def gitea_resolve_task_capability(
            f"{required_role} task '{task}' even if nearby permissions are "
            "present (fail closed)."
        )
    # #690 AC4: when the launcher declares a client namespace, a task with a
    # required namespace must fail closed on mismatch (e.g. review_pr served
    # from an author namespace).
    ns_provenance = mcp_namespace_health.namespace_provenance(
        task=task_key, active_profile=profile.get("profile_name")
    )
    ns_mismatch_reason = None
    if ns_provenance.get("mismatch"):
        ns_mismatch_reason = "; ".join(ns_provenance.get("reasons") or [])
    cross_host_block = bool(remote_assess.get("block"))
    identity_block = bool(id_assess.get("block"))
    drift_block = bool(ctx_assess.get("block"))
    allowed_in_current_session = (
        permission_allowed_in_current_session
        and role_matches_current_session
        and not ns_provenance.get("mismatch")
        and not cross_host_block
        and not identity_block
        and not drift_block
@@ -21891,6 +22004,8 @@ def gitea_resolve_task_capability(
            )
        if role_mismatch_reason:
            deny_parts.append(role_mismatch_reason)
        if ns_mismatch_reason:
            deny_parts.append(ns_mismatch_reason)
        if deny_parts:
            reason_msg = "; ".join(deny_parts)
        elif configured and switching:
@@ -21973,6 +22088,8 @@ def gitea_resolve_task_capability(
    task_role_guidance = []
    if role_mismatch_reason:
        task_role_guidance.append(f"STOP: {role_mismatch_reason}")
    if ns_mismatch_reason:
        task_role_guidance.append(f"STOP: {ns_mismatch_reason}")
    if required_role == "reviewer":
        if allowed_in_current_session:
            task_role_guidance.append(
@@ -22039,6 +22156,7 @@ def gitea_resolve_task_capability(
        "session_context_audit": session_ctx.mutation_context_audit_fields(),
        "profile_remote_compatible": not cross_host_block,
        "identity_match": not identity_block,
        "namespace_provenance": ns_provenance,
        "auto_profile_substitution": False,
    }
    # #685: report typed reconnect blocker without mutating config or exiting.
@@ -16,6 +16,7 @@ Probe sources
 from __future__ import annotations
 import os
 from typing import Any
@@ -57,8 +58,56 @@ SAFE_ENV_KEYS = (
    "GITEA_SERVICE",
    "GITEA_EXECUTION_ROLE",
    "GITEA_MCP_CONFIG",
    "GITEA_MCP_NAMESPACE",
 )
 # Optional launcher-provided env declaring the client-managed MCP namespace
 # this process is registered under (e.g. ``gitea-reviewer``). The server
 # cannot derive its own IDE namespace name, so the launcher declares it; when
 # declared, reviewers/mergers can fail closed on a namespace/task mismatch
 # (#690 AC4). Absence means "unknown" — reported, never guessed.
 NAMESPACE_ENV = "GITEA_MCP_NAMESPACE"
 def configured_client_namespace(env: dict[str, str] | None = None) -> str | None:
    """Return the launcher-declared client namespace, or None when unknown."""
    source = os.environ if env is None else env
    value = (source.get(NAMESPACE_ENV) or "").strip()
    return value or None
 def namespace_provenance(
    task: str | None = None,
    *,
    active_profile: str | None = None,
    env: dict[str, str] | None = None,
 ) -> dict[str, Any]:
    """Report configured client namespace vs active execution profile (#690).
    When *task* carries a required namespace (``TASK_REQUIRED_NAMESPACES``)
    and the launcher declared a different one, ``mismatch`` is True and the
    caller must fail closed for that task. An undeclared namespace is
    reported as unknown — never treated as proof either way.
    """
    configured = configured_client_namespace(env)
    required = TASK_REQUIRED_NAMESPACES.get(task or "")
    mismatch = bool(configured and required and configured != required)
    reasons: list[str] = []
    if mismatch:
        reasons.append(
            f"configured client namespace '{configured}' does not match "
            f"required namespace '{required}' for task '{task}' (fail closed)"
        )
    return {
        "configured_namespace": configured,
        "namespace_source": NAMESPACE_ENV if configured else "unknown",
        "active_profile": active_profile,
        "requested_task": task,
        "required_namespace": required,
        "mismatch": mismatch,
        "reasons": reasons,
    }
 def _as_list(value: Any) -> list[str] | None:
    if value is None:
@@ -41,6 +41,7 @@ def _reset_mutation_authority(monkeypatch):
        "GITEA_REVIEWER_WORKTREE",
        "GITEA_MERGER_WORKTREE",
        "GITEA_RECONCILER_WORKTREE",
        "GITEA_MCP_NAMESPACE",
    ]:
        monkeypatch.delenv(env_key, raising=False)
@@ -117,6 +118,7 @@ def _reset_mutation_authority(monkeypatch):
        monkeypatch.setattr(mcp_server, "_ACTOR_IDENTITY_CACHE", {})
    monkeypatch.setattr(mcp_server, "_REVIEW_DECISION_LOCK", None)
    monkeypatch.setattr(mcp_server, "_LIVE_NAMESPACE_HEALTH", {})
    monkeypatch.setattr(mcp_server, "_PROFILE_SWITCH_INVALIDATION", None)
    monkeypatch.setattr(mcp_server, "_preflight_whoami_called", False)
    monkeypatch.setattr(mcp_server, "_preflight_capability_called", False)
    monkeypatch.setattr(mcp_server, "_preflight_resolved_role", None)
@@ -0,0 +1,274 @@
 """Regression coverage for #690: cross-role profile activation invalidation.
 A mid-run profile switch (e.g. reviewer → author → reviewer) must invalidate
 workflow-load proof, reviewer lease binding, review decision lock, live
 namespace health, and preflight identity/capability stamps, and must require
 a full reviewer preflight before any formal verdict. Namespace provenance
 must be reported and fail closed on task/namespace mismatch.
 """
 import json
 import os
 import sys
 import tempfile
 import unittest
 from unittest.mock import patch
 sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent))
 import gitea_config
 import mcp_namespace_health
 import mcp_server
 import mcp_session_state
 import review_workflow_load
 import reviewer_pr_lease
 from tests.test_runtime_clarity import CONFIG_SWITCHING_ENABLED
 class TestProfileSwitchReviewGuard(unittest.TestCase):
    def setUp(self):
        self._remotes_patch = patch.dict(mcp_server.REMOTES, {
            "dadeschools": {"host": "gitea.example.com", "org": "Example-Org", "repo": "Example-Repo"},
            "prgs": {"host": "gitea.example.com", "org": "Example-Org", "repo": "Example-Repo"},
        })
        self._remotes_patch.start()
        mcp_server._IDENTITY_CACHE.clear()
        gitea_config._active_profile_override = None
        self._dir = tempfile.TemporaryDirectory()
        self.config_path = os.path.join(self._dir.name, "profiles.json")
        with open(self.config_path, "w", encoding="utf-8") as fh:
            fh.write(json.dumps(CONFIG_SWITCHING_ENABLED))
    def tearDown(self):
        self._remotes_patch.stop()
        mcp_server._IDENTITY_CACHE.clear()
        gitea_config._active_profile_override = None
        self._dir.cleanup()
    def _env(self, profile="reviewer-profile"):
        return {
            "GITEA_MCP_CONFIG": self.config_path,
            "GITEA_MCP_PROFILE": profile,
            "GITEA_TOKEN_AUTHOR": "author-pass",
            "GITEA_TOKEN_REVIEWER": "reviewer-pass",
            "GITEA_TOKEN_MERGER": "merger-pass",
        }
    def _seed_contaminated_review_state(self):
        """Simulate an in-flight reviewer run under reviewer-profile."""
        mcp_server._preflight_whoami_called = True
        mcp_server._preflight_capability_called = True
        mcp_server._preflight_resolved_role = "reviewer"
        mcp_server._preflight_resolved_task = "review_pr"
        review_workflow_load._REVIEW_WORKFLOW_LOAD = {"loaded": True}
        mcp_server._REVIEW_DECISION_LOCK = {
            "session_profile": "reviewer-profile",
            "final_review_decision_ready": True,
            "ready_pr_number": 688,
        }
        reviewer_pr_lease.record_session_lease(
            {"session_id": "lease-session-1", "pr_number": 688}
        )
        mcp_server._LIVE_NAMESPACE_HEALTH["gitea-reviewer"] = {
            "namespace": "gitea-reviewer",
            "healthy": True,
            "ide_namespace_proven": True,
        }
        # Durable records keyed by the reviewer identity must also be cleared.
        mcp_session_state.save_state(
            kind=mcp_session_state.KIND_WORKFLOW_LOAD,
            payload={"loaded": True},
            profile_identity="reviewer-profile",
        )
        mcp_session_state.save_state(
            kind=mcp_session_state.KIND_DECISION_LOCK,
            payload={"final_review_decision_ready": True, "ready_pr_number": 688},
            profile_identity="reviewer-profile",
        )
    def _activate(self, target, logins):
        with patch.object(
            mcp_server, "get_auth_header", side_effect=[f"token p" for _ in logins]
        ), patch.object(
            mcp_server, "api_request", side_effect=[{"login": l} for l in logins]
        ), patch.object(
            mcp_server,
            "_workspace_repository_slug",
            return_value="Example-Org/Example-Repo",
        ), patch.object(
            mcp_server, "_canonical_repository_slug", return_value=(None, [])
        ):
            return mcp_server.gitea_activate_profile(profile_name=target)
    # -----------------------------------------------------------------
    # AC1/AC2/AC3: switch invalidates review state; re-preflight required
    # -----------------------------------------------------------------
    def test_switch_invalidates_review_state_and_blocks_verdict(self):
        with patch.dict(os.environ, self._env("reviewer-profile"), clear=True):
            self._seed_contaminated_review_state()
            res = self._activate("author-profile", ["reviewer-user", "author-user"])
            self.assertTrue(res["success"])
            self.assertTrue(res["re_preflight_required"])
            inv = res["review_state_invalidation"]
            self.assertEqual(inv["from_profile"], "reviewer-profile")
            self.assertEqual(inv["to_profile"], "author-profile")
            for item in (
                "preflight_identity_capability",
                "review_workflow_load",
                "review_decision_lock",
                "reviewer_session_lease",
                "live_namespace_health",
            ):
                self.assertIn(item, inv["invalidated"])
            # In-memory state cleared.
            self.assertFalse(mcp_server._preflight_whoami_called)
            self.assertFalse(mcp_server._preflight_capability_called)
            self.assertIsNone(mcp_server._preflight_resolved_task)
            self.assertIsNone(review_workflow_load._REVIEW_WORKFLOW_LOAD)
            self.assertIsNone(mcp_server._REVIEW_DECISION_LOCK)
            self.assertIsNone(reviewer_pr_lease.get_session_lease())
            self.assertEqual(mcp_server._LIVE_NAMESPACE_HEALTH, {})
            self.assertIsNotNone(mcp_server._PROFILE_SWITCH_INVALIDATION)
            # Durable records keyed by the reviewer identity are gone.
            self.assertIsNone(
                mcp_session_state.load_state(
                    kind=mcp_session_state.KIND_WORKFLOW_LOAD,
                    profile_identity="reviewer-profile",
                )
            )
            self.assertIsNone(
                mcp_session_state.load_state(
                    kind=mcp_session_state.KIND_DECISION_LOCK,
                    profile_identity="reviewer-profile",
                )
            )
            # A formal verdict without re-preflight fails closed.
            reasons = mcp_server.check_review_decision_gate(
                688, "APPROVE", final_review_decision_ready=True
            )
            self.assertTrue(reasons)
    def test_switch_back_cannot_resurrect_stale_review_run(self):
        with patch.dict(os.environ, self._env("reviewer-profile"), clear=True):
            self._seed_contaminated_review_state()
            self._activate("author-profile", ["reviewer-user", "author-user"])
            res = self._activate("reviewer-profile", ["author-user", "reviewer-user"])
            self.assertTrue(res["success"])
            # The pre-switch review run must not reappear.
            self.assertIsNone(mcp_server._REVIEW_DECISION_LOCK)
            self.assertIsNone(review_workflow_load._REVIEW_WORKFLOW_LOAD)
            self.assertIsNone(reviewer_pr_lease.get_session_lease())
            status = review_workflow_load.workflow_load_status()
            self.assertFalse(status["workflow_load_valid"])
            reasons = mcp_server.check_review_decision_gate(
                688, "APPROVE", final_review_decision_ready=True
            )
            self.assertTrue(reasons)
    def test_same_profile_reactivation_keeps_state(self):
        with patch.dict(os.environ, self._env("reviewer-profile"), clear=True):
            self._seed_contaminated_review_state()
            res = self._activate("reviewer-profile", ["reviewer-user", "reviewer-user"])
            self.assertTrue(res["success"], res)
            self.assertNotIn("review_state_invalidation", res)
            self.assertIsNotNone(mcp_server._REVIEW_DECISION_LOCK)
            self.assertTrue(mcp_server._preflight_whoami_called)
    def test_clean_repreflight_after_switch_allows_gate(self):
        with patch.dict(os.environ, self._env("reviewer-profile"), clear=True):
            self._seed_contaminated_review_state()
            self._activate("author-profile", ["reviewer-user", "author-user"])
            self._activate("reviewer-profile", ["author-user", "reviewer-user"])
            # Re-establish the full reviewer preflight under the new profile.
            mcp_server.record_preflight_check("whoami")
            mcp_server.record_preflight_check(
                "capability", resolved_role="reviewer", resolved_task="review_pr"
            )
            mcp_server.init_review_decision_lock("dadeschools", "review_pr")
            lock = mcp_server._load_review_decision_lock()
            self.assertIsNotNone(lock)
            lock.update(
                {
                    "final_review_decision_ready": True,
                    "ready_pr_number": 688,
                    "ready_action": "APPROVE",
                    "ready_remote": "dadeschools",
                    "ready_org": "Example-Org",
                    "ready_repo": "Example-Repo",
                }
            )
            mcp_server._save_review_decision_lock(lock)
            with patch.object(
                mcp_server, "_review_workflow_load_gate_reasons", return_value=[]
            ):
                reasons = mcp_server.check_review_decision_gate(
                    688,
                    "APPROVE",
                    final_review_decision_ready=True,
                    remote="dadeschools",
                )
            self.assertEqual(reasons, [])
    # -----------------------------------------------------------------
    # AC4: namespace provenance reporting + fail-closed mismatch
    # -----------------------------------------------------------------
    def test_namespace_provenance_mismatch_detection(self):
        prov = mcp_namespace_health.namespace_provenance(
            task="review_pr",
            active_profile="reviewer-profile",
            env={"GITEA_MCP_NAMESPACE": "gitea-author"},
        )
        self.assertTrue(prov["mismatch"])
        self.assertEqual(prov["required_namespace"], "gitea-reviewer")
        prov_ok = mcp_namespace_health.namespace_provenance(
            task="review_pr",
            active_profile="reviewer-profile",
            env={"GITEA_MCP_NAMESPACE": "gitea-reviewer"},
        )
        self.assertFalse(prov_ok["mismatch"])
        prov_unknown = mcp_namespace_health.namespace_provenance(
            task="review_pr", active_profile="reviewer-profile", env={}
        )
        self.assertIsNone(prov_unknown["configured_namespace"])
        self.assertFalse(prov_unknown["mismatch"])
        self.assertEqual(prov_unknown["namespace_source"], "unknown")
    @patch("mcp_server.api_request", return_value={"login": "reviewer-user"})
    @patch("mcp_server.get_auth_header", return_value="token reviewer-pass")
    def test_whoami_reports_namespace_provenance(self, _auth, _api):
        env = self._env("reviewer-profile")
        env["GITEA_MCP_NAMESPACE"] = "gitea-reviewer"
        with patch.dict(os.environ, env, clear=True):
            res = mcp_server.gitea_whoami(remote="dadeschools")
        prov = res["namespace_provenance"]
        self.assertEqual(prov["configured_namespace"], "gitea-reviewer")
        self.assertEqual(prov["active_profile"], "reviewer-profile")
        self.assertFalse(prov["mismatch"])
    @patch("mcp_server.api_request", return_value={"login": "reviewer-user"})
    @patch("mcp_server.get_auth_header", return_value="token reviewer-pass")
    def test_resolve_fails_closed_on_namespace_mismatch(self, _auth, _api):
        env = self._env("reviewer-profile")
        env["GITEA_MCP_NAMESPACE"] = "gitea-author"
        with patch.dict(os.environ, env, clear=True):
            res = mcp_server.gitea_resolve_task_capability(
                task="review_pr", kwargs="{}", remote="dadeschools"
            )
        self.assertFalse(res["allowed_in_current_session"])
        self.assertTrue(res["namespace_provenance"]["mismatch"])
        self.assertTrue(
            any("namespace" in g for g in res["task_role_guidance"])
        )
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,323 @@
 """Validation tooling for the remote-MCP threat model (#956).
 #956 requires that "every boundary claim [is] traceable to a file and line
 anchor that resolves at the reviewed commit". A prose document cannot enforce
 that about itself, and #930 demonstrated the failure mode: its inventory cited
 ``gitea_mcp_server.py`` anchors generated at ``7bf4f125`` which no longer point
 at the described code at ``aad5c8b4``. Nothing failed, because nothing checked.
 These tests are that check. They enforce, in both directions:
 * every ``file.py:NNN`` anchor cited in the prose is declared in the fixture;
 * every declared anchor resolves — the file exists, the line exists, and the
  source line actually contains the substring the fixture claims for it;
 * the document's structural obligations (assets, adversaries, boundaries,
  credential rows, the co-residency ruling, and the child mapping) are present
  and internally consistent.
 A refactor that shifts a line number therefore breaks the suite instead of
 silently rotting the security documentation.
 """
 import json
 import os
 import re
 import unittest
 REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 DOC_PATH = os.path.join(REPO_ROOT, "docs", "remote-mcp", "threat-model.md")
 FIXTURE_PATH = os.path.join(
    REPO_ROOT, "docs", "remote-mcp", "threat-model-anchors.json"
 )
 # ``module.py:123`` as it appears inside markdown inline code spans.
 ANCHOR_RE = re.compile(r"`([A-Za-z0-9_./-]+\.py):(\d+)`")
 # The epic children this document must map to a boundary (#929 children 2-10).
 REQUIRED_CHILDREN = [931, 932, 933, 934, 935, 936, 937, 938, 939]
 # The adversaries #956 names explicitly.
 REQUIRED_ADVERSARIES = [
    "compromised LLM client",
    "prompt injection",
    "malicious tool arguments",
    "network attacker",
    "curious operator",
 ]
 def _read(path):
    with open(path, "r", encoding="utf-8") as fh:
        return fh.read()
 def _heading_re(title):
    """Match a level-2 heading by title, with or without section numbering.
    The document numbers its sections ('## 6. Decomposition ruling'), so an
    exact-substring assertion would break on renumbering without the document
    having actually lost anything.
    """
    return re.compile(
        r"^##\s+(?:\d+\.\s+)?" + re.escape(title), re.MULTILINE
    )
 def _section_body(doc, title):
    """Return the text of section *title*, bounded by the next level-2 heading.
    Bounding matters: an unbounded slice runs to end-of-document, so the
    walkthrough tables in a later section leak into the child-to-boundary
    mapping and satisfy its coverage check with rows that assign no owner.
    """
    match = _heading_re(title).search(doc)
    if match is None:
        return None
    rest = doc[match.end():]
    nxt = re.search(r"^##\s", rest, re.MULTILINE)
    return rest[: nxt.start()] if nxt else rest
 def _source_line(rel_path, lineno):
    """Return the 1-based *lineno* of *rel_path*, or None if out of range."""
    abs_path = os.path.join(REPO_ROOT, rel_path)
    if not os.path.exists(abs_path):
        return None
    with open(abs_path, "r", encoding="utf-8", errors="replace") as fh:
        for idx, line in enumerate(fh, start=1):
            if idx == lineno:
                return line
    return None
 class ThreatModelFixtureTests(unittest.TestCase):
    """The fixture itself must be well-formed before it can prove anything."""
    def setUp(self):
        self.fixture = json.loads(_read(FIXTURE_PATH))
    def test_fixture_declares_a_generation_commit(self):
        sha = self.fixture.get("generated_against_commit") or ""
        self.assertRegex(
            sha,
            r"^[0-9a-f]{40}$",
            "the fixture must record the full commit its anchors were taken at",
        )
    def test_fixture_anchors_are_unique_and_well_formed(self):
        seen = set()
        for entry in self.fixture["anchors"]:
            anchor = entry["anchor"]
            self.assertNotIn(anchor, seen, f"duplicate anchor entry: {anchor}")
            seen.add(anchor)
            self.assertRegex(anchor, r"^[A-Za-z0-9_./-]+\.py:[1-9]\d*$", anchor)
            self.assertTrue(
                (entry.get("expect") or "").strip(),
                f"anchor {anchor} declares no 'expect' substring, so it proves nothing",
            )
 class ThreatModelAnchorResolutionTests(unittest.TestCase):
    """#956 required positive test: every anchor resolves at the reviewed commit."""
    def setUp(self):
        self.fixture = json.loads(_read(FIXTURE_PATH))
        self.doc = _read(DOC_PATH)
    def test_every_declared_anchor_resolves_to_the_claimed_source_line(self):
        failures = []
        for entry in self.fixture["anchors"]:
            rel_path, _, raw_lineno = entry["anchor"].partition(":")
            lineno = int(raw_lineno)
            line = _source_line(rel_path, lineno)
            if line is None:
                failures.append(f"{entry['anchor']}: file or line does not exist")
                continue
            if entry["expect"] not in line:
                failures.append(
                    f"{entry['anchor']}: expected {entry['expect']!r}, "
                    f"found {line.strip()!r}"
                )
        self.assertEqual(
            [], failures, "unresolved threat-model anchors:\n" + "\n".join(failures)
        )
    def test_every_anchor_cited_in_the_document_is_declared_in_the_fixture(self):
        declared = {e["anchor"] for e in self.fixture["anchors"]}
        cited = {f"{m.group(1)}:{m.group(2)}" for m in ANCHOR_RE.finditer(self.doc)}
        undeclared = sorted(cited - declared)
        self.assertEqual(
            [],
            undeclared,
            "document cites anchors that no test verifies: " + ", ".join(undeclared),
        )
    def test_the_document_actually_cites_anchors(self):
        cited = {f"{m.group(1)}:{m.group(2)}" for m in ANCHOR_RE.finditer(self.doc)}
        self.assertGreaterEqual(
            len(cited),
            30,
            "a boundary document with almost no anchors is not traceable",
        )
    def test_unresolvable_anchor_is_detected(self):
        """Negative control: the checker must fail on a deliberately bad anchor.
        Without this, a checker that silently passed everything would look
        identical to a correct one.
        """
        self.assertIsNone(_source_line("gitea_config.py", 10**9))
        self.assertIsNone(_source_line("no_such_module_for_956.py", 1))
        real = _source_line("gitea_config.py", 54)
        self.assertIsNotNone(real)
        self.assertNotIn("this substring is not on that line", real)
 class ThreatModelStructureTests(unittest.TestCase):
    """The document must contain what #956's acceptance criteria demand."""
    def setUp(self):
        self.doc = _read(DOC_PATH)
    def test_records_the_commit_it_was_generated_against(self):
        fixture = json.loads(_read(FIXTURE_PATH))
        self.assertIn(
            fixture["generated_against_commit"],
            self.doc,
            "the document must state the commit its anchors resolve at",
        )
    def test_names_every_required_adversary(self):
        low = self.doc.lower()
        for adversary in REQUIRED_ADVERSARIES:
            self.assertIn(adversary.lower(), low, f"adversary not covered: {adversary}")
    def test_maps_every_epic_child_from_two_through_ten(self):
        for number in REQUIRED_CHILDREN:
            self.assertIn(
                f"#{number}",
                self.doc,
                f"epic child #{number} is not mapped to a boundary",
            )
    def test_credential_rows_declare_holder_boundary_and_blast_radius(self):
        for column in ("Holder", "Boundary", "Blast radius"):
            self.assertIn(
                column,
                self.doc,
                f"the credential inventory must state each credential's {column.lower()}",
            )
    def test_states_an_explicit_co_residency_ruling(self):
        """AC3/AC5: an explicit ruling, not an implication."""
        self.assertIsNotNone(
            _heading_re("Decomposition ruling").search(self.doc),
            "the document must contain an explicit decomposition-ruling section",
        )
        for service in ("Jenkins", "GlitchTip", "Sentry", "database"):
            self.assertIn(service, self.doc, f"ruling does not address {service}")
        self.assertRegex(
            self.doc,
            r"D1\b.*must not",
            "the ruling must state the prohibition, not merely discuss it",
        )
    def test_contains_the_compromised_client_walkthrough(self):
        """#956 required negative/adversarial test."""
        self.assertIsNotNone(
            _heading_re("Adversarial walkthrough").search(self.doc),
            "the required compromised-client walkthrough is missing",
        )
        self.assertIn("Before the migration", self.doc)
        self.assertIn("After the migration", self.doc)
    def test_every_boundary_states_what_it_protects_and_what_crossing_requires(self):
        boundary_ids = set(re.findall(r"\bB(\d+)\b", self.doc))
        self.assertGreaterEqual(
            len(boundary_ids), 5, "too few trust boundaries to be a decomposition"
        )
        for column in (
            "Protects",
            "Crossing requires today",
            "Crossing must require remotely",
        ):
            self.assertIn(column, self.doc, f"boundary table is missing '{column}'")
    def test_declares_itself_documentation_only(self):
        self.assertIn("documentation only", self.doc.lower())
 class ThreatModelConsistencyTests(unittest.TestCase):
    """Counts stated in prose must match the rows actually present."""
    def setUp(self):
        self.doc = _read(DOC_PATH)
    def _declared_ids(self, prefix):
        # Table rows begin '| CR1 |' / '| B3 |' / '| A2 |'.
        return sorted(
            {
                int(m)
                for m in re.findall(
                    r"^\|\s*%s(\d+)\s*\|" % prefix, self.doc, re.MULTILINE
                )
            }
        )
    def test_identifier_sequences_have_no_gaps(self):
        for prefix, label in (
            ("A", "assets"),
            ("B", "boundaries"),
            ("CR", "credentials"),
        ):
            ids = self._declared_ids(prefix)
            self.assertTrue(ids, f"no {label} declared")
            self.assertEqual(
                list(range(1, len(ids) + 1)),
                ids,
                f"{label} identifiers must run 1..n with no gaps; got {ids}",
            )
    def test_stated_credential_count_matches_the_rows(self):
        ids = self._declared_ids("CR")
        match = re.search(r"(\d+)\s+credential(?:s)? in total", self.doc)
        self.assertIsNotNone(match, "the credential inventory must state its own total")
        self.assertEqual(
            len(ids),
            int(match.group(1)),
            "stated credential total disagrees with the number of rows",
        )
    def test_every_boundary_is_owned_by_at_least_one_child(self):
        """Each boundary must be owned by a child *in the mapping table*.
        Scanning the whole section would let a prose summary line ("Boundary
        coverage: ... B5 (#936)") satisfy the assertion while the table row
        that actually assigns the owner had been emptied — verified by
        deliberately blanking a row and watching a whole-section check still
        pass. Only table rows count.
        """
        mapping_section = _section_body(self.doc, "Child-to-boundary mapping")
        self.assertIsNotNone(
            mapping_section, "child-to-boundary mapping section is missing"
        )
        rows = [
            line
            for line in mapping_section.splitlines()
            if line.lstrip().startswith("|") and re.search(r"#93\d", line)
        ]
        self.assertGreaterEqual(
            len(rows), len(REQUIRED_CHILDREN), "mapping table has too few child rows"
        )
        mapped = set(re.findall(r"\bB(\d+)\b", "\n".join(rows)))
        declared = {str(i) for i in self._declared_ids("B")}
        unmapped = sorted(declared - mapped, key=int)
        self.assertEqual(
            [],
            unmapped,
            "boundaries with no owning child: " + ", ".join("B" + u for u in unmapped),
        )
 if __name__ == "__main__":
    unittest.main()
Author	SHA1	Message	Date
jcwalker3	a633db6186	Merge branch 'master' into fix/issue-690-review-profile-switch-guard	2026-07-28 08:38:08 -05:00
sysadmin	9b80e75ca3	Merge pull request 'docs(remote-mcp): threat model, trust boundaries, and decomposition ruling (Closes #956 )' (#965 ) from docs/issue-956-remote-mcp-threat-model into master	2026-07-28 08:19:45 -05:00
sysadminandClaude Opus 4.8	b3de9c941c	docs(remote-mcp): threat model, trust boundaries, and decomposition ruling (Closes #956 ) #930 inventoried stdio coupling; nothing stated what the adversary is, what each boundary protects, or why one process may hold credentials for several services. This adds that document as child 2 of epic #929. Adds docs/remote-mcp/threat-model.md covering 10 assets, the 5 adversaries #956 names, 9 trust boundaries, the data flows between them, a 14-entry per-boundary credential inventory, and an explicit decomposition ruling. Findings established from live native evidence at this commit: - Four prgs roles (reviewer, merger, reconciler, controller) resolve to one Gitea account, so separation of duty between approving and landing is enforced only by which process a call reaches. The mdcps tenant has no role separation at all: author, reviewer, and merger share one account. - Any one role process can resolve every other role's credential. gitea_list_profiles reports "credentials present" for other roles because it calls resolve_token on each one. - The Gitea server reads Jenkins and GlitchTip secrets out of the keychain to produce the "authenticated" word in gitea_audit_config's service summaries. - Jenkins and GlitchTip were already decomposed into separate MCP servers; the credential references were left behind in the Gitea configuration. Ruling D1 forbids a single integration process from holding credentials for unrelated services, with one time-boxed dual-run exception for the local fleet that expires with #939. D2 requires separation of duty to be credential-backed, D3 scopes credential resolution to the request principal, and D4 gives coordination state its own authority. Every #929 child from 2 through 10 is mapped to the boundary it implements. Anchors are enforced rather than asserted. #930's inventory anchors into gitea_mcp_server.py had already drifted between `7bf4f125` and `aad5c8b4` with nothing detecting it, so this change ships the guard that was missing: docs/remote-mcp/threat-model-anchors.json declares all 58 anchors with the substring each must contain, and tests/test_issue_956_threat_model.py fails if any anchor does not resolve, if the document cites an anchor the fixture does not cover, or if the structural obligations regress. Documentation only. No server behavior changes. Tests: - tests/test_issue_956_threat_model.py: 17 passed. - Four sabotage probes confirm the validator is not passing vacuously (shifted anchor, undeclared citation, broken count tally, and a blanked boundary owner). The last two probes exposed real weaknesses in the checks themselves, which were fixed: the section slice now stops at the next heading, and boundary ownership is read only from mapping table rows. - Docs-sensitive sweep (17 modules referencing docs/): 559 passed. - Full suite: 30 failed, 5799 passed, 6 skipped. All 30 reproduce on a clean base worktree at aad5c8b4; branch failures are a strict subset of base failures. No production file is modified by this change. Closes #956 Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-07-28 04:41:26 -04:00
sysadmin	aad5c8b423	Merge pull request 'fix(author): unify the bootstrap and lock_issue issue-lock contract (Closes #953 )' (#954 ) from fix/issue-953-bootstrap-lock-provenance into master Merges PR #954 at approved head `b4c9f55890`. Approval: review 633 APPROVE at `b4c9f55890`. Base: master at `82d71b7702`. Closes #953	2026-07-28 02:21:11 -05:00
sysadmin	2b3f5baaeb	fix(mcp): invalidate review session state on cross-profile activation (Closes #690 ) A mid-run profile switch (reviewer -> author -> reviewer) left workflow-load proof, reviewer lease binding, the review decision lock, live namespace health, and preflight identity/capability stamps intact, so a formal verdict could be recorded under contaminated session state. - gitea_activate_profile now invalidates all review-critical session state on a cross-profile switch, in memory and in durable state keyed by either profile identity, and reports the invalidation + re-preflight requirement. - Full reviewer preflight (whoami, load_review_workflow, resolve_task_capability(review_pr), head re-pin, lease re-acquire) is required before any formal verdict after a switch; switching back cannot resurrect the stale run. - Namespace provenance: optional launcher-declared GITEA_MCP_NAMESPACE is reported by whoami/runtime context/capability resolution, and a declared namespace that disagrees with a task's required namespace fails closed. - Docs: supported pattern is separate session/namespace per role, not in-process profile hopping mid-review.	2026-07-25 19:17:19 -04:00