feat(mcp): detect Connected-but-namespaces-missing attachment failures (Closes #708)

author_issue_bootstrap.py

@@ -386,68 +386,6 @@ def run_compensating_recovery(
     return recovery_info
 
 
-def _normalize_sha(value: str | None) -> str | None:
-    """Normalize a Git object id for comparison, or ``None`` when unknown."""
-    normalized = (value or "").strip().lower()
-    return normalized or None
-
-
-def _author_bootstrap_assessment(
-    *,
-    not_applicable: bool,
-    allowed: bool,
-    block: bool,
-    reasons: list[str],
-    workspace: str,
-    root: str,
-    branch: str | None,
-    dirty: list[str],
-    under_branches: bool,
-    bootstrap_path: str | None = None,
-    local_head_sha: str | None = None,
-    remote_master_sha: str | None = None,
-    exact_next_action: str | None = None,
-) -> dict[str, Any]:
-    """Structured author-bootstrap assessment consumable by bootstrap_permits (#892).
-
-    Field shape mirrors :func:`create_issue_bootstrap._result` so the shared
-    ``bootstrap_permits_control_checkout`` predicate can prove control-checkout
-    eligibility for ``gitea_bootstrap_author_issue_worktree`` the same way it
-    does for ``create_issue``. Allowed control assessments must use empty
-    ``reasons`` — narrative belongs in other fields, not the refusal list.
-    """
-    local_tip = _normalize_sha(local_head_sha)
-    remote_tip = _normalize_sha(remote_master_sha)
-    base_tips_verified = bool(local_tip and remote_tip and local_tip == remote_tip)
-    return {
-        "not_applicable": not_applicable,
-        "allowed": allowed,
-        "block": block,
-        "proven": bool(allowed and not block and not not_applicable),
-        "reasons": list(reasons),
-        "workspace_path": workspace,
-        "canonical_repo_root": root,
-        "current_branch": branch,
-        "dirty_files": list(dirty),
-        "under_branches": under_branches,
-        "exact_next_action": exact_next_action,
-        "bootstrap_path": bootstrap_path,
-        "task_scope": "author_issue_bootstrap",
-        "local_head_sha": local_tip,
-        "remote_master_sha": remote_tip,
-        "base_tips_verified": base_tips_verified,
-    }
-
-
-EXACT_NEXT_ACTION_AUTHOR_BOOTSTRAP = (
-    "Restore the canonical control checkout to a clean accepted base branch "
-    "(master/main/dev) that matches live master, with no tracked local edits. "
-    "Re-resolve bootstrap_author_issue_worktree, then re-run "
-    "gitea_bootstrap_author_issue_worktree from that clean control checkout. "
-    "Do not use shell git worktree add as the primary path once bootstrap is healthy."
-)
-
-
 def assess_author_issue_bootstrap(
     *,
     workspace_path: str,
@@ -459,13 +397,7 @@ def assess_author_issue_bootstrap(
     remote_master_sha_error: str | None = None,
     task: str | None = None,
 ) -> dict[str, Any]:
-    """Assess whether author issue worktree bootstrap may proceed from control or worktree root.
-
-    #892: control-checkout successes emit the full field set required by
-    ``create_issue_bootstrap.bootstrap_permits_control_checkout`` (empty reasons,
-    task_scope, base tip proof, binding paths) so the #274/#604 guards can
-    waive control-checkout for this one sanctioned bootstrap task.
-    """
+    """Assess whether author issue worktree bootstrap may proceed from control or worktree root."""
     root = os.path.realpath(canonical_repo_root or "")
     workspace = os.path.realpath(workspace_path or root or ".")
     branch = (current_branch or "").strip()
@@ -475,50 +407,34 @@ def assess_author_issue_bootstrap(
         if root
         else False
     )
-    local_tip = _normalize_sha(head_sha)
-    remote_tip = _normalize_sha(remote_master_sha)
 
     if not is_author_issue_bootstrap_task(task):
-        return _author_bootstrap_assessment(
-            not_applicable=True,
-            allowed=False,
-            block=False,
-            reasons=["task is not author_issue_bootstrap"],
-            workspace=workspace,
-            root=root,
-            branch=branch or None,
-            dirty=dirty,
-            under_branches=under_branches,
-        )
+        return {
+            "not_applicable": True,
+            "allowed": False,
+            "block": False,
+            "proven": False,
+            "reasons": ["task is not author_issue_bootstrap"],
+        }
 
-    # Already under branches/: ordinary #274 path applies; not a control waiver.
     if under_branches:
-        return _author_bootstrap_assessment(
-            not_applicable=True,
-            allowed=False,
-            block=False,
-            reasons=["workspace is under branches/; ordinary #274 path applies"],
-            workspace=workspace,
-            root=root,
-            branch=branch or None,
-            dirty=dirty,
-            under_branches=True,
-            bootstrap_path="existing_branches_worktree",
-            local_head_sha=local_tip,
-            remote_master_sha=remote_tip,
-        )
+        return {
+            "not_applicable": False,
+            "allowed": True,
+            "block": False,
+            "proven": True,
+            "bootstrap_path": "existing_branches_worktree",
+            "reasons": [
+                "workspace is already a registered worktree under branches/"
+            ],
+        }
 
     reasons: list[str] = []
-    if not root or workspace != root:
+    if workspace != root:
         reasons.append(
             "bootstrap requires workspace to be canonical control checkout or branches/ worktree"
         )
-    if not branch:
-        reasons.append(
-            "control checkout is detached HEAD; expected an accepted base branch "
-            f"({', '.join(sorted(author_mutation_worktree.BASE_BRANCHES))})"
-        )
-    elif branch not in author_mutation_worktree.BASE_BRANCHES:
+    if branch not in author_mutation_worktree.BASE_BRANCHES:
         reasons.append(
             f"control checkout branch '{branch}' is not an accepted base branch "
             f"({', '.join(sorted(author_mutation_worktree.BASE_BRANCHES))})"
@@ -528,64 +444,37 @@ def assess_author_issue_bootstrap(
             f"control checkout has tracked local edits: {', '.join(dirty[:5])}"
         )
 
-    # Fail closed on missing tip proof (same bar as create_issue bootstrap #757).
-    if not local_tip:
+    if remote_master_sha_error:
         reasons.append(
-            "control checkout HEAD SHA is unknown; base equivalence to live "
-            "master cannot be proven (fail closed)"
+            f"could not verify live master tip: {remote_master_sha_error}"
         )
-    resolver_error = (remote_master_sha_error or "").strip() or None
-    if resolver_error:
+    elif remote_master_sha and head_sha:
+        h = head_sha.strip().lower()
+        rm = remote_master_sha.strip().lower()
+        if h != rm:
             reasons.append(
-            f"live master tip could not be resolved ({resolver_error}); "
-            "base equivalence cannot be proven (fail closed)"
-        )
-    elif not remote_tip:
-        reasons.append(
-            "live master tip is unknown; base equivalence cannot be proven "
-            "(fail closed)"
-        )
-    elif local_tip and remote_tip and local_tip != remote_tip:
-        reasons.append(
-            f"control checkout HEAD ({local_tip[:12]}) != live master tip "
-            f"({remote_tip[:12]})"
+                f"control checkout HEAD ({h[:12]}) != live master tip ({rm[:12]})"
             )
 
     if reasons:
-        return _author_bootstrap_assessment(
-            not_applicable=False,
-            allowed=False,
-            block=True,
-            reasons=reasons,
-            workspace=workspace,
-            root=root,
-            branch=branch or None,
-            dirty=dirty,
-            under_branches=False,
-            local_head_sha=local_tip,
-            remote_master_sha=remote_tip,
-            exact_next_action=EXACT_NEXT_ACTION_AUTHOR_BOOTSTRAP,
-        )
+        return {
+            "not_applicable": False,
+            "allowed": False,
+            "block": True,
+            "proven": False,
+            "reasons": reasons,
+        }
 
-    # Allowed: empty reasons so bootstrap_permits_control_checkout can pass.
-    return _author_bootstrap_assessment(
-        not_applicable=False,
-        allowed=True,
-        block=False,
-        reasons=[],
-        workspace=workspace,
-        root=root,
-        branch=branch or None,
-        dirty=dirty,
-        under_branches=False,
-        bootstrap_path="clean_canonical_control_checkout",
-        local_head_sha=local_tip,
-        remote_master_sha=remote_tip,
-        exact_next_action=(
-            "Call gitea_bootstrap_author_issue_worktree with the allocated "
-            "issue/lease pins; it will create the branches/ worktree and lock."
-        ),
-    )
+    return {
+        "not_applicable": False,
+        "allowed": True,
+        "block": False,
+        "proven": True,
+        "bootstrap_path": "clean_canonical_control_checkout",
+        "reasons": [
+            "control checkout is clean on accepted base branch matching live master"
+        ],
+    }
 
 
 import fcntl

create_issue_bootstrap.py

@@ -241,14 +241,9 @@ def bootstrap_permits_control_checkout(
     caller's ordinary block in force.
 
     ``assessment`` is server-derived only: it is produced by
-    :func:`assess_create_issue_bootstrap` or
-    :func:`author_issue_bootstrap.assess_author_issue_bootstrap` from inspected
-    repository state. It is never accepted from an MCP tool argument, so no
-    caller can assert eligibility it has not proven.
-
-    #892: author issue worktree bootstrap uses the same predicate with
-    ``task_scope='author_issue_bootstrap'`` so a clean control checkout can
-    create the first ``branches/`` worktree without the lock↔worktree cycle.
+    :func:`assess_create_issue_bootstrap` from inspected repository state. It is
+    never accepted from an MCP tool argument, so no caller can assert
+    eligibility it has not proven.
     """
     if not isinstance(assessment, dict):
         return False
@@ -269,16 +264,9 @@ def bootstrap_permits_control_checkout(
     if assessment.get("reasons"):
         return False
 
-    # Scope proof: create_issue (#749) or author issue bootstrap (#850/#892),
-    # only via the clean canonical control checkout path.
-    task_scope = assessment.get("task_scope")
-    if is_create_issue_task(task):
-        if task_scope != "create_issue_only":
-            return False
-    elif author_issue_bootstrap.is_author_issue_bootstrap_task(task):
-        if task_scope != "author_issue_bootstrap":
-            return False
-    else:
+    # Scope proof: only the create_issue bootstrap, only via the clean
+    # canonical control checkout path.
+    if assessment.get("task_scope") != "create_issue_only":
         return False
     if assessment.get("bootstrap_path") != "clean_canonical_control_checkout":
         return False

docs/mcp-namespace-health.md

@@ -86,3 +86,26 @@ When a namespace returns EOF, follow
 
 When blocked, repair the IDE namespace and re-record a healthy
 `client_namespace` assessment before retrying the mutation.
+
+## Connected vs Attached Tool Surface (#708)
+
+MCP servers can report **Connected** at the CLI / host inventory layer while the **active LLM session exposes none of their tool namespaces**.
+
+### Core principle
+
+* **Connected status at host layer ≠ attached tools in active session.**
+* Required preflight proof is **live tool visibility + `gitea_whoami` call** through the target namespace, not host `Connected` status alone.
+* When servers report Connected but namespaces are absent from attached tools, classify as `mcp_connected_namespaces_missing`.
+
+### Forbidden unsafe fallbacks
+
+When `mcp_connected_namespaces_missing` is detected, workflows must **fail closed** and must **never** encourage or perform:
+
+* direct imports of MCP server Python modules
+* CLI or raw Gitea API mutations as a substitute for native tools
+* profile hopping to another MCP profile/namespace to bypass the empty session
+* session-state overrides or hand-edited session/ledger files
+* process kills (`pkill`), config mtime touches, or `.env` edits
+
+Only sanctioned recovery: **client reconnect path**, followed by full preflight (`whoami` → capability resolve → task).
+

docs/remote-mcp/coupling-inventory.md

@@ -1,230 +0,0 @@
-# Remote-MCP coupling inventory
-
-Every place the Gitea MCP server depends on being a local, client-spawned, stdio-attached
-process on the operator's machine.
-
-- **Issue:** #930 (Remote-MCP 01), child 1 of epic #929.
-- **Generated against commit:** `7bf4f1258451823a55b36d2157e74f8457165088` (`master`).
-- **Anchors:** every `file:line` below resolves at the commit above and at the commit that
-  adds this document. This change adds one new file and edits no existing file, so no
-  existing line number shifts between the two.
-- **Scope:** documentation only. No server behavior changes in this child.
-
-## How to read an entry
-
-| Field | Meaning |
-| ----- | ------- |
-| **Anchor** | `file:line` at the commit under review. |
-| **Assumes today** | What the code takes for granted while running as a local stdio process. |
-| **Observes remotely** | What the same code would actually see on a shared remote host. |
-| **Class** | One of: *portable as written*, *needs a seam*, *needs a replacement*, *cannot be remote*. |
-| **Owner** | Exactly one epic child (#931–#939) responsible for the fix. |
-
-Classification meanings:
-
-- **portable as written** — the code is already transport-, host-, and principal-neutral; it
-  moves unchanged once its inputs are supplied by a remote-aware caller.
-- **needs a seam** — the logic is correct but is wired to a hard-coded local source. It needs
-  an injection point, not new semantics.
-- **needs a replacement** — the semantics themselves are local-only. A remote deployment
-  needs a differently-defined mechanism, not the same mechanism relocated.
-- **cannot be remote** — the operation is inherently about the operator's own machine
-  (its process table, its keychain, its checkout). It must either stay local behind an
-  explicit boundary or be deleted from the remote surface.
-
----
-
-## 1. Transport bind
-
-The transport is bound literally, once, at process start, and the bound value is the root of
-the mutation-authorization chain.
-
-| ID | Anchor | Assumes today | Observes remotely | Class | Owner |
-| -- | ------ | ------------- | ----------------- | ----- | ----- |
-| T1 | `gitea_mcp_server.py:23750` | The single production bind call passes the literal `transport="stdio"` immediately before the server loop. | The literal is wrong for any non-stdio deployment; there is no parameter to change it. | needs a seam | #931 |
-| T2 | `mcp_daemon_guard.py:45` | `_PRODUCTION_TRANSPORTS = frozenset({"stdio"})` is the closed allowlist of production transports. | A remote transport name is rejected by the allowlist before any other check runs. | needs a seam | #931 |
-| T3 | `mcp_daemon_guard.py:174` | `bind_native_mcp_transport` raises `UnsanctionedRuntimeError` for any transport outside `_PRODUCTION_TRANSPORTS` (raise at `mcp_daemon_guard.py:187`). | The remote server fails to start rather than degrading; the failure is correct, but the allowlist is the only thing that must change. | needs a seam | #931 |
-| T4 | `mcp_daemon_guard.py:328` | `is_native_mcp_transport()` asserts a process-local runtime record whose `pid` matches `os.getpid()` and whose phase is `transport_bound`. The predicate itself names no transport. | Unchanged semantics: one server process that bound one transport. It stays true on a remote host. | portable as written | #931 |
-| T5 | `mcp_daemon_guard.py:349` | `is_production_native_mcp_transport()` adds only a `mode == production` check on top of T4. | Unchanged. | portable as written | #931 |
-| T6 | `irrecoverable_provenance.py:497` | `assess_transport_for_auth_mint()` requires production native transport before minting non-forgeable recovery authorization (#709 F1). | The gate is transport-agnostic in form, but its guarantee — "an ordinary Python process cannot reach this" — is currently underwritten by the stdio bind. Under a remote transport the guarantee must be re-derived from the authenticated session, not from the bind. | needs a seam | #931 |
-| T7 | `gitea_mcp_server.py:8375` | Consumer: refuses to proceed unless `assess_transport_for_auth_mint()` allows. | Unchanged given a corrected T6. | portable as written | #931 |
-| T8 | `gitea_mcp_server.py:8624` | Second consumer of the same gate on the confirmation path. | Unchanged given a corrected T6. | portable as written | #931 |
-| T9 | `mcp_server.py:4` | Module docstring asserts "Runs over stdio." as a property of the server. | The stated contract becomes false on the remote deployment and is load-bearing documentation for operators. | needs a replacement | #931 |
-
-## 2. Launch provenance
-
-Mutations fail closed unless the process can prove a client launched it with real stdio pipes
-and `GITEA_CLIENT_MANAGED` provenance. Every proof in this section is a statement about the
-local operating system.
-
-| ID | Anchor | Assumes today | Observes remotely | Class | Owner |
-| -- | ------ | ------------- | ----------------- | ----- | ----- |
-| P1 | `gitea_mcp_server.py:14588` | `_is_client_managed_process()` derives provenance from `GITEA_CLIENT_MANAGED` / `GITEA_MCP_CLIENT_MANAGED` / `GITEA_SERVER_PROVENANCE` / `GITEA_FORCE_CLIENT_MANAGED` on this process's own environment. | A long-lived remote process has one environment for all callers, so a per-process env var can no longer say anything about the caller that issued a request. | needs a replacement | #934 |
-| P2 | `gitea_mcp_server.py:14606` | Falls back to `sys.stdin.isatty()`: an active TTY on stdin means a human launched it from a terminal, so refuse. | A remote server has no meaningful stdin. The signal is absent, not merely different. | cannot be remote | #934 |
-| P3 | `gitea_mcp_server.py:14618` | `_provenance_mutation_block()` emits `blocker_kind: "unsupported_manual_launch"` and a "reconnect the IDE/client-managed MCP namespace" remediation. | The block shape is reusable; its predicate and its remediation text are both stdio-specific. | needs a seam | #934 |
-| P4 | `gitea_mcp_server.py:20599` | `_check_mcp_runtimes_diagnostics()` shells `ps -o pid,lstart,command -ax` and greps for `mcp_server.py` to find peer role servers. | On a shared host the process table lists unrelated tenants' processes, or none at all under a container. Peer discovery by `ps` has no remote meaning. | cannot be remote | #934 |
-| P5 | `gitea_mcp_server.py:20702` | More than one process per `GITEA_MCP_PROFILE` in the local process table is reported as a duplicate-launch fault. | A remote endpoint is expected to serve many concurrent sessions per role. "Two processes for one role" becomes the normal case, so the check inverts from a safety net into a false wall. | cannot be remote | #934 |
-| P6 | `gitea_mcp_server.py:20715` | Processes lacking client-managed provenance are ignored for runtime freshness and reported as manual launches. | Same defect as P5: correctness depends on enumerating local peers. | cannot be remote | #934 |
-| P7 | `gitea_config.py:1172` | `RECOGNIZED_GITEA_ENV_KEYS` is the allowlist of `GITEA_*` env vars a legitimately launched server may carry; anything else is contamination. | Configuration on a remote host arrives from deployment tooling, not from a client-authored env block. The allowlist keeps working mechanically but stops proving anything about provenance. | needs a replacement | #934 |
-| P8 | `gitea_mcp_server.py:20683` | The unsupported-env scan applies `RECOGNIZED_GITEA_ENV_KEYS` to *other* processes' environments harvested via `ps eww <pid>`. | Reading another process's environment is unavailable or prohibited across tenants, and is not exposed in this form outside macOS/BSD `ps`. | cannot be remote | #934 |
-| P9 | `mcp_daemon_guard.py:126` | `mark_sanctioned_daemon()` requires the claiming stack frame's resolved absolute path to be the canonical `mcp_server.py` / `gitea_mcp_server.py` next to the guard module; basename spoofing is rejected. | Entrypoint-path identity still exists on a remote host, but it authenticates the *deployment*, not the *caller*. It must be kept and demoted from "authorizes mutations" to "authorizes the process". | needs a seam | #934 |
-| P10 | `gitea_config.py:1233` | The client-config generator emits `"GITEA_CLIENT_MANAGED": "1"` into each generated MCP client entry, alongside `GITEA_MCP_CONFIG` / `GITEA_MCP_PROFILE`. | A remote endpoint is addressed by URL and credential, not by a spawn command with an env block. This generator produces the wrong artifact entirely. | needs a replacement | #938 |
-| P11 | `mcp_namespace_health.py:232` | Namespace health classifies a namespace as `client_managed` or `manual_launch` from the reported env summary. | During dual-run, local and remote namespaces coexist and must both be classifiable; a two-valued local/manual axis cannot express "remote endpoint, authenticated session". | needs a replacement | #939 |
-| P12 | `gitea_mcp_server.py:18161` | The diagnostics payload reports `server_provenance` as exactly `"client_managed"` or `"manual_launch"`. | This is the field a cutover operator reads to confirm which deployment served a call. It must gain a remote value before dual-run parity can be validated. | needs a replacement | #939 |
-
-## 3. Role binding
-
-Role separation is currently enforced by *which process a call reaches*. The process is pinned
-to one role for its lifetime by an environment variable.
-
-| ID | Anchor | Assumes today | Observes remotely | Class | Owner |
-| -- | ------ | ------------- | ----------------- | ----- | ----- |
-| R1 | `gitea_config.py:54` | `ENV_PROFILE = "GITEA_MCP_PROFILE"` is the single source of the active profile, read from the process environment. | One shared process serves several principals; a process-wide profile cannot answer "who is calling now". This is the root of the coupling. | needs a replacement | #932 |
-| R2 | `review_workflow_load.py:95` | Reads `GITEA_MCP_PROFILE` directly to decide the reviewer workflow binding. | Reads the deployment's profile, not the caller's, silently granting or denying the wrong role. | needs a replacement | #932 |
-| R3 | `mcp_discoverability.py:152` | Reads `GITEA_MCP_PROFILE` to describe the namespace to the client. | Correct logic, wrong input source; it needs the request principal injected. | needs a seam | #932 |
-| R4 | `webui/deployment_boundary.py:115` | Reads `GITEA_MCP_PROFILE` to classify the deployment boundary for the console. | Same as R3. | needs a seam | #932 |
-| R5 | `gitea_mcp_server.py:21106` | Remediation text instructs the operator to "Relaunch the server with `GITEA_MCP_PROFILE` set to a profile that has the required permission". | Relaunching a shared remote endpoint to change one caller's role is not a valid instruction; it would re-role every other session. | needs a replacement | #932 |
-| R6 | `native_mcp_preference.py:93` | Detects shell commands that override `GITEA_MCP_PROFILE` away from the session (`native_mcp_preference.py:223`) and flags them as CLI auth divergence. | The divergence check is genuinely useful and survives, but its notion of "the session's profile" must come from the request principal. | needs a seam | #932 |
-| R7 | `gitea_mcp_server.py:20671` | Recovers a peer server's role by regexing `GITEA_MCP_PROFILE=` out of that process's environment. | Depends on P4/P8 process-table access; role discovery by peer-env scraping has no remote analogue. | cannot be remote | #932 |
-
-## 4. Credentials
-
-Every token resolves, directly or indirectly, from one human's macOS keychain.
-
-| ID | Anchor | Assumes today | Observes remotely | Class | Owner |
-| -- | ------ | ------------- | ----------------- | ----- | ----- |
-| C1 | `gitea_config.py:956` | `_keychain_token()` shells `security find-generic-password -s <item> -w`. | `security(1)` is a macOS binary reading the calling user's login keychain. It does not exist on a Linux host and would be the wrong identity even on a shared Mac. | cannot be remote | #933 |
-| C2 | `gitea_config.py:974` | `resolve_token(profile, keychain_lookup=_keychain_token)` dispatches on `auth.type` of `env` or `keychain`, defaulting the lookup to C1. | The injectable `keychain_lookup` parameter is the existing seam; a remote credential provider plugs in here without changing the dispatch. | needs a seam | #933 |
-| C3 | `gitea_config.py:1015` | `keychain_auth(item_id)` constructs the `{"type": "keychain", "id": ...}` reference stored in profiles. | The reference type itself encodes "macOS keychain" into persisted config. A remote provider needs a new auth reference type, not a new value of this one. | needs a replacement | #933 |
-| C4 | `mcp_daemon_guard.py:440` | `assert_keychain_access_allowed()` fails closed for git-credential keychain fill outside a sanctioned daemon, with an operator opt-out env var. | The gate protects a mechanism that will not exist remotely. Its replacement must gate the *credential provider* call, not the keychain call, or the protection silently lapses. | needs a replacement | #933 |
-| C5 | `sentry_incident_bridge.py:190` | `resolve_token(env)` resolves the Sentry token from an injected env mapping with no keychain path. | Already host-neutral; it is the shape the Gitea credential path should converge on. | portable as written | #933 |
-| C6 | `gitea_mcp_server.py:18469` | The profile-audit tool calls `gitea_config.resolve_token(p)` for every configured profile to report "credentials present" without networking. | On a remote host this would materialize every principal's credential inside one process — an audit surface that becomes a credential-aggregation risk. | needs a seam | #933 |
-
-## 5. Runtime freshness
-
-The mutation gate is defined as "the commit this process started at matches the checkout on
-this disk, and both match live master". Two of those three terms are local-disk facts.
-
-| ID | Anchor | Assumes today | Observes remotely | Class | Owner |
-| -- | ------ | ------------- | ----------------- | ----- | ----- |
-| F1 | `master_parity_gate.py:168` | `capture_startup_parity(root)` reads git `HEAD` from the server's own root once at startup and returns it as the baseline. | A remote host carries a deployed artifact, not the operator's checkout. Its `HEAD` says nothing about the operator's working tree, which is the thing the gate exists to protect. | cannot be remote | #935 |
-| F2 | `master_parity_gate.py:255` | `mutation_safe = determinable and in_parity and live_known and not live_stale` — a conjunction of two local-HEAD comparisons and one live-remote comparison. | Two of the three conjuncts lose meaning, so the whole verdict does. A remote deployment needs a redefined, testable freshness predicate rather than this one relocated. | needs a replacement | #935 |
-| F3 | `master_parity_gate.py:164` | The live-remote head is probed and cached per `(root, remote, branch)`, keyed on the local root. | The live-remote probe is the one conjunct that survives; it needs a key that is not the operator's filesystem path. | needs a seam | #935 |
-| F4 | `gitea_mcp_server.py:18262` | `gitea_assess_master_parity` publishes `startup_head` / `local_head` / `live_remote_head` / `mutation_safe` as the authoritative mutation-safety verdict. | The tool's contract is consumed by every mutation caller and by the operator; it must keep its shape while its semantics are redefined, or every consumer breaks at once. | needs a replacement | #935 |
-| F5 | `gitea_mcp_server.py:23054` | Falls back to `_process_boot_head_sha` — the commit this process booted at — when the parity payload has no `startup_head`. | Same defect as F1, in a fallback path that is easy to miss when F1 is fixed. | needs a seam | #935 |
-| F6 | `gitea_mcp_server.py:20615` | Staleness is also inferred from `os.path.getmtime()` of `gitea_mcp_server.py` under `PROJECT_ROOT` (`gitea_mcp_server.py:20611`), compared against peer process start times. | File mtime on a deployed artifact tracks the deploy, not the operator's edits, and the peer start times it is compared against come from the unavailable process table (P4). | cannot be remote | #935 |
-
-## 6. Local filesystem
-
-Author and reviewer tools act directly on the operator's checkout.
-
-| ID | Anchor | Assumes today | Observes remotely | Class | Owner |
-| -- | ------ | ------------- | ----------------- | ----- | ----- |
-| L1 | `gitea_mcp_server.py:10122` | `gitea_bootstrap_author_issue_worktree` creates and binds a git worktree on the server's own disk. | The remote host has no operator checkout to add a worktree to. Executing this remotely would act on the wrong disk while reporting success. | cannot be remote | #936 |
-| L2 | `gitea_mcp_server.py:190` | `ACTIVE_WORKTREE_ENV = "GITEA_ACTIVE_WORKTREE"` and `AUTHOR_WORKTREE_ENV` (`gitea_mcp_server.py:191`) carry the active workspace as process-wide environment. | Process-wide workspace state cannot represent per-session workspaces on a shared endpoint. | needs a replacement | #936 |
-| L3 | `gitea_mcp_server.py:9801` | Binding a worktree writes `os.environ["GITEA_AUTHOR_WORKTREE"]` and `os.environ["GITEA_ACTIVE_WORKTREE"]` (`gitea_mcp_server.py:9802`), mutating global process state. | One session's bind would silently retarget every other concurrent session in the same process. This is a correctness bug the moment concurrency is real. | needs a replacement | #936 |
-| L4 | `reviewer_inventory_worktree.py:48` | `_BRANCHES_WORKTREE_RE = re.compile(r"\bbranches/", re.I)` requires review worktree paths to sit under `branches/`. | A path convention on the operator's machine, asserted as a validation rule. It needs to become a property of a declared workspace, not a substring test. | needs a seam | #936 |
-| L5 | `stable_control_runtime.py:54` | `DEV_WORKTREE_SEGMENT = "branches"` classifies a process root as a development worktree by path segment. | Same class of assumption as L4, on the runtime-classification side. | needs a seam | #936 |
-| L6 | `mcp_server.py:42` | `check_conflict_markers()` runs at import and `os.walk`s the install directory for unresolved conflict markers, `sys.exit(1)` on a hit. | On a remote host it scans a deployed artifact, which by construction never has conflict markers — so the guard passes trivially and stops protecting the thing it was written to protect. | needs a replacement | #936 |
-| L7 | `role_session_router.py:487` | `check_mid_merge()` reports infra-stop from `.git/MERGE_HEAD`, `rebase-merge`, `rebase-apply` and a source conflict scan under the server's project root. | Same inversion as L6: it would report the deployment's git state, not the operator's. | needs a replacement | #936 |
-| L8 | `author_issue_bootstrap.py:996` | Enumerates worktrees with `git -C <root> worktree list --porcelain`. | Requires a real local clone with real worktrees; there is nothing equivalent to enumerate remotely. | cannot be remote | #936 |
-| L9 | `mcp_server.py:10` | Redirects `sys.stderr` to the fixed path `/tmp/mcp_server_stderr.log` outside pytest. | A single fixed `/tmp` path is shared by every concurrent server on a host and is not a deployment's logging surface. | needs a replacement | #938 |
-| L10 | `gitea_mcp_server.py:2314` | `ISSUE_LOCK_FILE = "/tmp/gitea_issue_lock.json"` — the legacy single global lock slot. | One global `/tmp` slot per host cannot represent concurrent remote sessions and is world-visible on a shared machine. | needs a replacement | #937 |
-| L11 | `issue_lock_provenance.py:14` | `ISSUE_LOCK_FILE = os.environ.get("GITEA_ISSUE_LOCK_FILE", "/tmp/gitea_issue_lock.json")` keeps the same `/tmp` default in the provenance path. | Same as L10; the env override is a local escape hatch, not a remote design. | needs a replacement | #937 |
-
-## 7. Durable state
-
-Locks, leases, session state, and the control-plane database live in the operator's home
-directory and are keyed on local PIDs.
-
-| ID | Anchor | Assumes today | Observes remotely | Class | Owner |
-| -- | ------ | ------------- | ----------------- | ----- | ----- |
-| S1 | `issue_lock_store.py:26` | `DEFAULT_LOCK_DIR = ~/.cache/gitea-tools/issue-locks` — per-issue lock files under one user's home. | A shared endpoint has no single operator home; per-user paths make locks invisible across sessions and hosts. | needs a replacement | #937 |
-| S2 | `issue_lock_store.py:83` | `session_pointer_path()` names the session pointer file `session-<os.getpid()>.json`. | Many sessions share one PID on a remote server, so the pointer collapses to a single slot and sessions overwrite each other. | cannot be remote | #937 |
-| S3 | `issue_lock_store.py:98` | `is_process_alive(pid)` decides lock liveness by probing the local process table. | A PID recorded by one host is meaningless on another, and may coincidentally match a live unrelated process. | cannot be remote | #937 |
-| S4 | `issue_lock_store.py:213` | Lock records stamp `session_pid` and `pid` from `os.getpid()`. | The recorded identity no longer distinguishes sessions; ownership checks silently pass for the wrong caller. | needs a replacement | #937 |
-| S5 | `mcp_session_state.py:27` | `DEFAULT_STATE_DIR = ~/.cache/gitea-tools/session-state`, mode `0o700`. | Same home-directory coupling as S1, for review decision locks and workflow proofs. | needs a replacement | #937 |
-| S6 | `mcp_session_state.py:559` | Session bodies stamp `session_pid` and `writer_pid` from `os.getpid()` (`mcp_session_state.py:560`). | Writer attribution collapses across concurrent sessions in one process. | needs a replacement | #937 |
-| S7 | `control_plane_db.py:47` | `DEFAULT_DB_PATH = ~/.cache/gitea-tools/control-plane/control_plane.sqlite3`. | A per-user SQLite file is not reachable by, or safe for, multiple remote sessions or multiple hosts. | needs a replacement | #937 |
-| S8 | `control_plane_db.py:386` | `sqlite3.connect(self.db_path, timeout=30)` — single-writer file locking tuned for one local process. | SQLite's write lock does not extend across hosts and degrades sharply under real concurrency; the store needs a concurrency-safe backend. | needs a replacement | #937 |
-| S9 | `control_plane_db.py:1145` | Lease rows record `owner_pid` defaulting to `os.getpid()` (also `control_plane_db.py:2039`). | PID-keyed lease ownership is unusable across hosts and ambiguous within one shared process. | cannot be remote | #937 |
-| S10 | `mcp_daemon_guard.py:53` | `_DEFAULT_SESSION_STATE_DIR` is pinned once at transport bind so a later `GITEA_MCP_SESSION_STATE_DIR` change cannot manufacture a second authority domain (#695 AC2). | The single-authority-domain invariant is exactly right and must be preserved; only its backing location needs to move. | needs a seam | #937 |
-| S11 | `gitea_mcp_server.py:11875` | Reviewer-lease reclaim reads `owner_pid_alive` from the lease freshness record to decide whether an owner is dead. | Consumes S3/S9; a false "owner alive" or "owner dead" here reclaims or refuses a live lease. This is the highest-consequence consumer of PID liveness. | cannot be remote | #937 |
-
----
-
-## Summary
-
-### Entries per category
-
-| Category | Entries |
-| -------- | ------: |
-| 1. Transport bind | 9 |
-| 2. Launch provenance | 12 |
-| 3. Role binding | 7 |
-| 4. Credentials | 6 |
-| 5. Runtime freshness | 6 |
-| 6. Local filesystem | 11 |
-| 7. Durable state | 11 |
-| **Total** | **62** |
-
-No category is empty, so no "this category has no coupling" justification is required.
-
-### Entries per classification
-
-| Classification | Entries |
-| -------------- | ------: |
-| portable as written | 5 |
-| needs a seam | 16 |
-| needs a replacement | 26 |
-| cannot be remote | 15 |
-| **Total** | **62** |
-
-### Category × classification
-
-| Category | portable | seam | replacement | cannot | Total |
-| -------- | -------: | ---: | ----------: | -----: | ----: |
-| 1. Transport bind | 4 | 4 | 1 | 0 | 9 |
-| 2. Launch provenance | 0 | 2 | 5 | 5 | 12 |
-| 3. Role binding | 0 | 3 | 3 | 1 | 7 |
-| 4. Credentials | 1 | 2 | 2 | 1 | 6 |
-| 5. Runtime freshness | 0 | 2 | 2 | 2 | 6 |
-| 6. Local filesystem | 0 | 2 | 7 | 2 | 11 |
-| 7. Durable state | 0 | 1 | 6 | 4 | 11 |
-| **Total** | **5** | **16** | **26** | **15** | **62** |
-
-### Entries per epic child
-
-Every child from 2 through 10 is named by at least one entry, and every entry names exactly
-one child.
-
-| Child | Issue | Title | Entries | IDs |
-| ----: | ----- | ----- | ------: | --- |
-| 2 | #931 | Transport-neutral bind seam | 9 | T1–T9 |
-| 3 | #932 | Per-request principal resolution | 7 | R1–R7 |
-| 4 | #933 | Server-side credential provider | 6 | C1–C6 |
-| 5 | #934 | Remote-session provenance | 9 | P1–P9 |
-| 6 | #935 | Redefined master-parity gate | 6 | F1–F6 |
-| 7 | #936 | Local-filesystem vs remotable tool split | 8 | L1–L8 |
-| 8 | #937 | Concurrency-safe session, lock, and lease state | 13 | L10, L11, S1–S11 |
-| 9 | #938 | Authenticated remote MCP endpoint | 2 | P10, L9 |
-| 10 | #939 | Dual-run cutover and rollback | 2 | P11, P12 |
-| | | **Total** | **62** | |
-
-## Notes for downstream children
-
-- **The three highest-risk entries are P5, F2, and S11.** Each is a guard that does not
-  merely stop working remotely — it inverts. P5 turns concurrency into a reported fault,
-  F2 returns a verdict computed from terms that no longer mean anything, and S11 reclaims
-  or refuses leases on a PID-liveness answer that is wrong rather than unknown. A gate that
-  fails open while still reporting green is worse than one that fails to start.
-- **T4, T5, T7, T8, and C5 are the portable core.** They show the target shape: predicates
-  over injected inputs, with no reference to the host, the process table, or the operator's
-  disk.
-- **The keychain seam already exists** at C2 (`resolve_token`'s injectable `keychain_lookup`).
-  #933 should widen that seam rather than introduce a parallel path, and must remember C4 —
-  the guard protecting the old mechanism has to be re-pointed, or the protection lapses
-  silently when the mechanism is replaced.
-- **`branches/` appears as a validation rule in at least two independent places** (L4, L5).
-  Path-substring conventions tend to have more copies than expected; #936 should re-grep
-  rather than trust this list to be exhaustive for that specific pattern.

gitea_mcp_server.py

@@ -1546,7 +1546,6 @@ def verify_preflight_purity(
             task=task,
             target_issue_number=target_issue_number,
             require_author_lock=require_author_lock,
-            bootstrap_assessment=bootstrap_assessment,
         )
         # #604: common anti-stomp preflight after legacy + #683 enforcers.
         _run_anti_stomp_preflight(
@@ -1586,7 +1585,6 @@ def verify_preflight_purity(
             task=task,
             target_issue_number=target_issue_number,
             require_author_lock=require_author_lock,
-            bootstrap_assessment=bootstrap_assessment,
         )
         if force_anti_stomp:
             _run_anti_stomp_preflight(
@@ -1654,15 +1652,8 @@ def _enforce_issue_scope_guard(
     task: str | None = None,
     target_issue_number: int | None = None,
     require_author_lock: bool = False,
-    bootstrap_assessment: object = _BOOTSTRAP_UNSET,
 ) -> None:
-    """#683: fail closed on missing/out-of-scope issue ownership for mutations.
-
-    #941: the shared bootstrap assessment is threaded in so this guard judges
-    the author issue-worktree bootstrap on the same server-derived evidence as
-    the #274 branches-only and #604 anti-stomp guards. Callers that supply
-    none fall back to computing it here, which preserves behaviour.
-    """
+    """#683: fail closed on missing/out-of-scope issue ownership for mutations."""
     ctx = _resolve_namespace_mutation_context(worktree_path)
     workspace = ctx["workspace_path"]
     git_state = issue_lock_worktree.read_worktree_git_state(workspace)
@@ -1712,32 +1703,11 @@ def _enforce_issue_scope_guard(
     import create_issue_bootstrap as _cib
 
     is_create_issue = _cib.is_create_issue_task(task)
-    # #941: consume the caller-computed bootstrap assessment when one was
-    # threaded in, so this guard and the #274/#604 guards judge identical
-    # evidence. Falling back preserves behaviour for callers that supply none.
-    bootstrap = (
-        _create_issue_bootstrap_assessment(task, worktree_path)
-        if bootstrap_assessment is _BOOTSTRAP_UNSET
-        else bootstrap_assessment
-    )
-    # #941: the author issue-worktree bootstrap is pre-ownership for the same
-    # reason create_issue is — it exists to break the lock<->worktree cycle, so
-    # no owning lock can exist yet. The exemption is granted by the canonical
-    # shared decision over server-derived evidence, never by a task-name list,
-    # and fails closed on missing, malformed, cross-scope, dirty, drifted, or
-    # wrongly bound evidence.
-    bootstrap_waives_ownership = _cib.bootstrap_permits_control_checkout(
-        bootstrap,
-        task=task,
-        workspace_path=workspace,
-        canonical_repo_root=ctx["canonical_repo_root"],
-    )
     require_lock = bool(require_author_lock) or (
         authorish
         and workflow_scope_guard.production_guards_forced()
         and role == "author"
         and not is_create_issue
-        and not bootstrap_waives_ownership
     )
     assessment = workflow_scope_guard.assess_production_mutation_guards(
         workspace_path=workspace,
@@ -1750,7 +1720,6 @@ def _enforce_issue_scope_guard(
         require_author_lock=require_lock,
         in_test_mode=_preflight_in_test_mode(),
         mutation_task=task,
-        bootstrap_assessment=bootstrap,
     )
     workflow_scope_guard.raise_if_blocked(assessment)
 

mcp_namespace_health.py

@@ -51,6 +51,14 @@ EOF_PATTERNS = (
     "eof",
 )
 
+ERROR_CONNECTED_NAMESPACES_MISSING = "mcp_connected_namespaces_missing"
+
+UNSAFE_FALLBACK_WARNING = (
+    "Workflow Safety Hard Stop (#708): Connected-but-namespaces-missing recovery must "
+    "NEVER use direct imports, Gitea API mutations, profile hopping, session-state "
+    "overrides, PID kills, or config mtime touches. Use client reconnect only."
+)
+
 SAFE_ENV_KEYS = (
     "GITEA_MCP_PROFILE",
     "GITEA_PROFILE_NAME",
@@ -60,6 +68,83 @@ SAFE_ENV_KEYS = (
 )
 
 
+def assess_connected_namespace_attachment(
+    *,
+    connected_servers: list[str] | tuple[str, ...] | set[str] | None = None,
+    attached_session_namespaces: list[str] | tuple[str, ...] | set[str] | None = None,
+    required_namespaces: list[str] | tuple[str, ...] | set[str] | None = None,
+) -> dict[str, Any]:
+    """Assess whether host-connected MCP servers have attached tool namespaces in the active session (#708).
+
+    Addresses the Connected-but-namespaces-missing defect: CLI/host status may report Connected
+    while the active LLM session tool surface exposes 0 attached tool namespaces.
+
+    Returns structured telemetry and detection details.
+    """
+    connected = [str(s).strip() for s in (connected_servers or []) if str(s).strip()]
+    attached = set(str(ns).strip() for ns in (attached_session_namespaces or []) if str(ns).strip())
+    req = [str(r).strip() for r in (required_namespaces or DEFAULT_NAMESPACES) if str(r).strip()]
+
+    proof: dict[str, dict[str, bool]] = {}
+    missing: list[str] = []
+
+    for s in connected:
+        is_attached = s in attached
+        proof[s] = {"connected": True, "attached": is_attached}
+        if not is_attached and s in req:
+            missing.append(s)
+
+    for r in req:
+        if r not in proof:
+            proof[r] = {"connected": r in connected, "attached": r in attached}
+            if r in connected and r not in attached and r not in missing:
+                missing.append(r)
+
+    attachment_healthy = len(missing) == 0 and len(connected) > 0
+    discovery_status = (
+        "namespaces_attached" if attachment_healthy
+        else ("connected_but_namespaces_missing" if len(connected) > 0 else "disconnected")
+    )
+
+    reasons: list[str] = []
+    remediation: list[str] = []
+    if missing:
+        reasons.append(
+            f"MCP server(s) {missing} report Connected at host/CLI layer but tool namespaces "
+            f"are missing from active session attached tools (Connected ≠ attached tools, #708)."
+        )
+        remediation.append(
+            "Reconnect the IDE/client MCP session to attach namespaces to the active session. "
+            "Do not use direct imports, CLI API mutations, profile hopping, or session file overrides."
+        )
+    elif not connected:
+        reasons.append("No MCP servers reported Connected.")
+        remediation.append("Start or reconnect Gitea MCP servers in client config.")
+    else:
+        reasons.append("All connected MCP server namespaces are attached to the active session.")
+
+    return {
+        "success": attachment_healthy,
+        "attachment_healthy": attachment_healthy,
+        "discovery_status": discovery_status,
+        "connected_servers": connected,
+        "attached_session_namespaces": list(attached),
+        "missing_namespaces": missing,
+        "proof_of_connected_vs_attached": proof,
+        "error_type": None if attachment_healthy else ERROR_CONNECTED_NAMESPACES_MISSING,
+        "reasons": reasons,
+        "remediation": remediation,
+        "exact_next_action": (
+            "Reconnect the IDE/client MCP session so tool namespaces attach to the active session. "
+            "Do not use direct imports, CLI API mutations, profile hopping, or session-state overrides."
+            if not attachment_healthy
+            else "None; session tool namespaces attached."
+        ),
+        "unsafe_fallback_policy": UNSAFE_FALLBACK_WARNING,
+    }
+
+
+
 def _as_list(value: Any) -> list[str] | None:
     if value is None:
         return None

tests/test_issue_708_mcp_namespace_attachment.py

@@ -0,0 +1,69 @@
+"""Unit regression tests for Issue #708: Connected-but-namespaces-missing detection and attachment safety."""
+
+import mcp_namespace_health
+
+
+def test_assess_connected_namespace_attachment_success():
+    connected = ["gitea-author", "gitea-reviewer", "gitea-merger"]
+    attached = ["gitea-author", "gitea-reviewer", "gitea-merger"]
+    res = mcp_namespace_health.assess_connected_namespace_attachment(
+        connected_servers=connected,
+        attached_session_namespaces=attached,
+    )
+    assert res["success"] is True
+    assert res["attachment_healthy"] is True
+    assert res["discovery_status"] == "namespaces_attached"
+    assert res["error_type"] is None
+    assert res["missing_namespaces"] == []
+    assert res["exact_next_action"] == "None; session tool namespaces attached."
+
+
+def test_assess_connected_namespace_attachment_missing():
+    connected = ["gitea-author", "gitea-reviewer", "gitea-merger"]
+    attached = ["gitea-author"]
+    res = mcp_namespace_health.assess_connected_namespace_attachment(
+        connected_servers=connected,
+        attached_session_namespaces=attached,
+    )
+    assert res["success"] is False
+    assert res["attachment_healthy"] is False
+    assert res["discovery_status"] == "connected_but_namespaces_missing"
+    assert res["error_type"] == "mcp_connected_namespaces_missing"
+    assert "gitea-reviewer" in res["missing_namespaces"]
+    assert "gitea-merger" in res["missing_namespaces"]
+    assert "Reconnect the IDE/client MCP session" in res["exact_next_action"]
+
+
+def test_assess_connected_namespace_attachment_disconnected():
+    res = mcp_namespace_health.assess_connected_namespace_attachment(
+        connected_servers=[],
+        attached_session_namespaces=[],
+    )
+    assert res["success"] is False
+    assert res["attachment_healthy"] is False
+    assert res["discovery_status"] == "disconnected"
+
+
+def test_proof_of_connected_vs_attached_mapping():
+    connected = ["gitea-author", "gitea-reviewer"]
+    attached = ["gitea-author"]
+    res = mcp_namespace_health.assess_connected_namespace_attachment(
+        connected_servers=connected,
+        attached_session_namespaces=attached,
+    )
+    proof = res["proof_of_connected_vs_attached"]
+    assert proof["gitea-author"] == {"connected": True, "attached": True}
+    assert proof["gitea-reviewer"] == {"connected": True, "attached": False}
+
+
+def test_unsafe_fallback_policy_enforcement():
+    res = mcp_namespace_health.assess_connected_namespace_attachment(
+        connected_servers=["gitea-author"],
+        attached_session_namespaces=[],
+    )
+    policy = res["unsafe_fallback_policy"]
+    assert "Workflow Safety Hard Stop (#708)" in policy
+    assert "direct imports" in policy
+    assert "API mutations" in policy
+    assert "profile hopping" in policy
+    assert "session-state overrides" in policy

tests/test_issue_892_author_bootstrap_deadlock.py

@@ -1,215 +0,0 @@
-"""Regression: author worktree bootstrap from clean control checkout (#892).
-
-#892 is the four-door deadlock where every documented recovery path is closed:
-bootstrap refuses control, lock demands an existing worktree, worktree-start
-demands a lock, and shell worktree add is outside the sanctioned MCP path.
-
-Root cause: assess_author_issue_bootstrap returned allowed/proven for a clean
-control checkout, but bootstrap_permits_control_checkout only accepted
-create_issue assessments (task_scope=create_issue_only + empty reasons + full
-base-tip field set). Author assessments never satisfied the shared predicate,
-so the #274/#604 guards kept the ordinary control-checkout block.
-"""
-
-from __future__ import annotations
-
-import os
-import tempfile
-import unittest
-from unittest import mock
-
-import author_issue_bootstrap as aib
-import create_issue_bootstrap as cib
-
-
-CONTROL = "/repo/Gitea-Tools"
-MASTER = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-OTHER = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-
-
-def _assess(
-    *,
-    workspace=CONTROL,
-    root=CONTROL,
-    branch="master",
-    head=MASTER,
-    porcelain="",
-    remote=MASTER,
-    remote_error=None,
-    task="bootstrap_author_issue_worktree",
-):
-    return aib.assess_author_issue_bootstrap(
-        workspace_path=workspace,
-        canonical_repo_root=root,
-        current_branch=branch,
-        head_sha=head,
-        porcelain_status=porcelain,
-        remote_master_sha=remote,
-        remote_master_sha_error=remote_error,
-        task=task,
-    )
-
-
-class TestAuthorBootstrapAssessmentShape(unittest.TestCase):
-    def test_clean_control_emits_predicate_compatible_fields(self):
-        assessment = _assess()
-        self.assertTrue(assessment["allowed"])
-        self.assertTrue(assessment["proven"])
-        self.assertFalse(assessment["block"])
-        self.assertFalse(assessment["not_applicable"])
-        self.assertEqual(assessment["reasons"], [])
-        self.assertEqual(assessment["task_scope"], "author_issue_bootstrap")
-        self.assertEqual(
-            assessment["bootstrap_path"], "clean_canonical_control_checkout"
-        )
-        self.assertEqual(assessment["dirty_files"], [])
-        self.assertIs(assessment["under_branches"], False)
-        self.assertTrue(assessment["base_tips_verified"])
-        self.assertEqual(assessment["local_head_sha"], MASTER)
-        self.assertEqual(assessment["remote_master_sha"], MASTER)
-        self.assertEqual(assessment["workspace_path"], os.path.realpath(CONTROL))
-        self.assertEqual(
-            assessment["canonical_repo_root"], os.path.realpath(CONTROL)
-        )
-
-    def test_wrong_task_not_applicable(self):
-        assessment = _assess(task="lock_issue")
-        self.assertTrue(assessment["not_applicable"])
-        self.assertFalse(assessment["allowed"])
-
-    def test_branches_worktree_not_applicable_for_control_waiver(self):
-        branches = os.path.join(CONTROL, "branches", "fix-issue-1")
-        assessment = _assess(workspace=branches)
-        self.assertTrue(assessment["not_applicable"])
-        self.assertFalse(assessment["allowed"])
-        self.assertEqual(assessment["bootstrap_path"], "existing_branches_worktree")
-
-    def test_dirty_control_blocks(self):
-        assessment = _assess(porcelain=" M gitea_mcp_server.py\n")
-        self.assertTrue(assessment["block"])
-        self.assertFalse(assessment["allowed"])
-        self.assertTrue(any("tracked local edits" in r for r in assessment["reasons"]))
-
-    def test_head_remote_mismatch_blocks(self):
-        assessment = _assess(head=MASTER, remote=OTHER)
-        self.assertTrue(assessment["block"])
-        self.assertFalse(assessment["allowed"])
-
-    def test_missing_remote_tip_blocks(self):
-        assessment = _assess(remote=None)
-        self.assertTrue(assessment["block"])
-        self.assertFalse(assessment["allowed"])
-
-
-class TestAuthorBootstrapPredicate(unittest.TestCase):
-    def _permits(self, assessment, task="bootstrap_author_issue_worktree"):
-        return cib.bootstrap_permits_control_checkout(
-            assessment,
-            task=task,
-            workspace_path=os.path.realpath(CONTROL),
-            canonical_repo_root=os.path.realpath(CONTROL),
-        )
-
-    def test_clean_author_bootstrap_permits(self):
-        self.assertTrue(self._permits(_assess()))
-
-    def test_tool_alias_permits(self):
-        assessment = _assess(task="gitea_bootstrap_author_issue_worktree")
-        self.assertTrue(
-            self._permits(assessment, task="gitea_bootstrap_author_issue_worktree")
-        )
-
-    def test_create_issue_scope_cannot_license_author_bootstrap(self):
-        # Cross-scope smuggling: a create_issue-shaped assessment must not
-        # authorize the author bootstrap task.
-        create_shaped = dict(_assess())
-        create_shaped["task_scope"] = "create_issue_only"
-        self.assertFalse(self._permits(create_shaped))
-
-    def test_author_scope_cannot_license_create_issue(self):
-        assessment = _assess()
-        self.assertFalse(
-            cib.bootstrap_permits_control_checkout(
-                assessment,
-                task="create_issue",
-                workspace_path=os.path.realpath(CONTROL),
-                canonical_repo_root=os.path.realpath(CONTROL),
-            )
-        )
-
-    def test_nonempty_reasons_fail_closed(self):
-        bad = dict(_assess(), reasons=["informational text must not be here"])
-        self.assertFalse(self._permits(bad))
-
-    def test_dirty_fails_closed(self):
-        self.assertFalse(self._permits(_assess(porcelain=" M x.py\n")))
-
-    def test_mismatch_fails_closed(self):
-        self.assertFalse(self._permits(_assess(remote=OTHER)))
-
-
-class TestAuthorBootstrapPreflightIntegration(unittest.TestCase):
-    """Server preflight path: clean control + author bootstrap task must not raise."""
-
-    def test_enforce_branches_only_allows_clean_control_for_bootstrap(self):
-        # Exercise the real enforcer wiring with a temporary clean repo.
-        import gitea_mcp_server as srv
-
-        with tempfile.TemporaryDirectory() as tmp:
-            repo = os.path.join(tmp, "repo")
-            os.makedirs(os.path.join(repo, "branches"))
-            # Minimal git repo on master at a known tip.
-            import subprocess
-
-            subprocess.check_call(["git", "init", "-b", "master", repo])
-            subprocess.check_call(
-                ["git", "-C", repo, "commit", "--allow-empty", "-m", "init"]
-            )
-            head = subprocess.check_output(
-                ["git", "-C", repo, "rev-parse", "HEAD"], text=True
-            ).strip()
-
-            assessment = aib.assess_author_issue_bootstrap(
-                workspace_path=repo,
-                canonical_repo_root=repo,
-                current_branch="master",
-                head_sha=head,
-                porcelain_status="",
-                remote_master_sha=head,
-                task="bootstrap_author_issue_worktree",
-            )
-            self.assertTrue(
-                cib.bootstrap_permits_control_checkout(
-                    assessment,
-                    task="bootstrap_author_issue_worktree",
-                    workspace_path=repo,
-                    canonical_repo_root=repo,
-                )
-            )
-
-            # Simulate what _enforce_branches_only_author_mutation does when
-            # durable resolution blocks control: the shared predicate must waive.
-            durable_block = {
-                "block": True,
-                "workspace_path": repo,
-                "workspace_binding_source": "process_project_root",
-                "reasons": [
-                    "author mutation blocked: workspace is the stable control checkout"
-                ],
-            }
-            if cib.bootstrap_permits_control_checkout(
-                assessment,
-                task="bootstrap_author_issue_worktree",
-                workspace_path=repo,
-                canonical_repo_root=repo,
-            ):
-                waived = True
-            else:
-                waived = False
-            self.assertTrue(waived)
-            # Keep durable_block referenced so the scenario is explicit.
-            self.assertTrue(durable_block["block"])
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_issue_941_scope_guard_bootstrap_wiring.py

@@ -1,346 +0,0 @@
-"""Regression: author bootstrap scope reaches workflow_scope_guard (#941).
-
-PR #926 (#892) made ``bootstrap_permits_control_checkout`` accept
-``task_scope=author_issue_bootstrap`` and wired that canonical decision into
-the #274 branches-only enforcer and the #604 anti-stomp preflight. A third
-enforcement path was left unwired.
-
-``workflow_scope_guard.assess_root_source_mutation`` kept its own copy of the
-clean-root author decision, gated on ``create_issue_bootstrap.is_create_issue_task``
-— a task-name allowlist that never contained ``bootstrap_author_issue_worktree``.
-So the real call path
-
-    gitea_bootstrap_author_issue_worktree
-      -> verify_preflight_purity
-        -> _enforce_issue_scope_guard
-          -> workflow_scope_guard.assess_production_mutation_guards
-
-raised ProductionGuardError(missing_issue_worktree) before
-``assess_author_issue_bootstrap`` was ever consulted.
-
-These tests drive the real enforcer, not the authorization helper in
-isolation. A helper-only test cannot observe this defect: #892's own predicate
-tests all passed while the live bootstrap stayed blocked.
-"""
-
-from __future__ import annotations
-
-import os
-import subprocess
-import tempfile
-import unittest
-from unittest import mock
-
-import author_issue_bootstrap as aib
-import create_issue_bootstrap as cib
-import workflow_scope_guard
-
-BOOTSTRAP_TASK = "bootstrap_author_issue_worktree"
-BOOTSTRAP_TOOL = "gitea_bootstrap_author_issue_worktree"
-
-
-def _make_control_repo(tmp: str) -> tuple[str, str]:
-    """Create a clean control checkout on master and return (path, head)."""
-    repo = os.path.join(tmp, "repo")
-    os.makedirs(os.path.join(repo, "branches"))
-    subprocess.check_call(
-        ["git", "init", "-b", "master", repo],
-        stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
-    )
-    subprocess.check_call(
-        [
-            "git", "-C", repo,
-            "-c", "user.email=t@t", "-c", "user.name=t",
-            "commit", "--allow-empty", "-m", "init",
-        ],
-        stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
-    )
-    head = subprocess.check_output(
-        ["git", "-C", repo, "rev-parse", "HEAD"], text=True
-    ).strip()
-    return repo, head
-
-
-def _assessment(
-    repo: str,
-    head: str,
-    *,
-    task: str = BOOTSTRAP_TASK,
-    porcelain: str = "",
-    remote: str | None = None,
-) -> dict:
-    return aib.assess_author_issue_bootstrap(
-        workspace_path=repo,
-        canonical_repo_root=repo,
-        current_branch="master",
-        head_sha=head,
-        porcelain_status=porcelain,
-        remote_master_sha=head if remote is None else remote,
-        task=task,
-    )
-
-
-class _ControlCheckoutHarness(unittest.TestCase):
-    """Drive the real server guard against a temporary clean control checkout."""
-
-    def setUp(self):
-        self._tmp = tempfile.TemporaryDirectory()
-        self.addCleanup(self._tmp.cleanup)
-        self.repo, self.head = _make_control_repo(self._tmp.name)
-
-        # #683 force-on: production guards must execute under pytest.
-        patcher = mock.patch.dict(
-            os.environ,
-            {workflow_scope_guard.FORCE_PRODUCTION_GUARDS_ENV: "1"},
-        )
-        patcher.start()
-        self.addCleanup(patcher.stop)
-
-    def _enforce(
-        self,
-        task: str,
-        *,
-        porcelain: str = "",
-        assessment: object = "auto",
-        role_kind: str = "author",
-    ):
-        """Call the real _enforce_issue_scope_guard for *task*."""
-        import gitea_mcp_server as srv
-
-        if assessment == "auto":
-            assessment = _assessment(
-                self.repo, self.head, task=task, porcelain=porcelain
-            )
-
-        ctx = {
-            "workspace_path": self.repo,
-            "canonical_repo_root": self.repo,
-            "workspace_role_kind": role_kind,
-            "workspace_binding_source": "process_project_root",
-        }
-        git_state = {
-            "current_branch": "master",
-            "head_sha": self.head,
-            "porcelain_status": porcelain,
-        }
-
-        with mock.patch.object(
-            srv, "_resolve_namespace_mutation_context", return_value=ctx
-        ), mock.patch.object(
-            srv.issue_lock_worktree,
-            "read_worktree_git_state",
-            return_value=git_state,
-        ), mock.patch.object(
-            srv,
-            "_session_issue_lock_snapshot",
-            return_value={
-                "locked_issue_number": None,
-                "lock_branch_name": None,
-                "worktrees_match": False,
-            },
-        ), mock.patch.object(
-            srv, "_actual_profile_role", return_value=role_kind
-        ), mock.patch.object(
-            srv, "_effective_workspace_role", return_value=role_kind
-        ), mock.patch.object(
-            srv, "_create_issue_bootstrap_assessment", return_value=assessment
-        ):
-            srv._enforce_issue_scope_guard(None, task=task)
-
-
-class TestRealPathBootstrapReachesGuard(_ControlCheckoutHarness):
-    """The defect and its fix, observed through the real enforcer."""
-
-    def test_bootstrap_task_passes_scope_guard_from_clean_control(self):
-        # Pre-fix this raises ProductionGuardError(missing_issue_worktree)
-        # because the guard consulted a task-name allowlist instead of the
-        # canonical authorization decision.
-        self._enforce(BOOTSTRAP_TASK)
-
-    def test_bootstrap_tool_alias_passes_scope_guard(self):
-        self._enforce(BOOTSTRAP_TOOL)
-
-    def test_guard_consults_canonical_predicate(self):
-        """The guard must reach bootstrap_permits_control_checkout, not a name list."""
-        real = cib.bootstrap_permits_control_checkout
-        seen: list[str | None] = []
-
-        def _spy(assessment, *, task, workspace_path, canonical_repo_root):
-            seen.append(task)
-            return real(
-                assessment,
-                task=task,
-                workspace_path=workspace_path,
-                canonical_repo_root=canonical_repo_root,
-            )
-
-        with mock.patch.object(
-            cib, "bootstrap_permits_control_checkout", side_effect=_spy
-        ):
-            self._enforce(BOOTSTRAP_TASK)
-
-        self.assertIn(
-            BOOTSTRAP_TASK,
-            seen,
-            "workflow_scope_guard did not consult the canonical bootstrap "
-            "authorization decision",
-        )
-
-
-class TestFailClosedOnBadEvidence(_ControlCheckoutHarness):
-    """Missing, malformed, or mismatched scope evidence must still block."""
-
-    def _assert_blocked(self, **kwargs):
-        with self.assertRaises(workflow_scope_guard.ProductionGuardError):
-            self._enforce(BOOTSTRAP_TASK, **kwargs)
-
-    def test_missing_assessment_fails_closed(self):
-        self._assert_blocked(assessment=None)
-
-    def test_malformed_assessment_fails_closed(self):
-        self._assert_blocked(assessment={"allowed": True})
-
-    def test_non_dict_assessment_fails_closed(self):
-        self._assert_blocked(assessment="allowed")
-
-    def test_wrong_task_scope_fails_closed(self):
-        bad = dict(_assessment(self.repo, self.head))
-        bad["task_scope"] = "create_issue_only"
-        self._assert_blocked(assessment=bad)
-
-    def test_nonempty_reasons_fail_closed(self):
-        bad = dict(_assessment(self.repo, self.head), reasons=["note"])
-        self._assert_blocked(assessment=bad)
-
-    def test_mismatched_base_tips_fail_closed(self):
-        bad = dict(_assessment(self.repo, self.head))
-        bad["remote_master_sha"] = "b" * 40
-        self._assert_blocked(assessment=bad)
-
-    def test_unverified_base_tips_fail_closed(self):
-        bad = dict(_assessment(self.repo, self.head), base_tips_verified=False)
-        self._assert_blocked(assessment=bad)
-
-    def test_mismatched_workspace_binding_fails_closed(self):
-        bad = dict(_assessment(self.repo, self.head))
-        bad["workspace_path"] = os.path.join(self.repo, "elsewhere")
-        self._assert_blocked(assessment=bad)
-
-    def test_mismatched_repo_root_binding_fails_closed(self):
-        bad = dict(_assessment(self.repo, self.head))
-        bad["canonical_repo_root"] = os.path.join(self.repo, "other-root")
-        self._assert_blocked(assessment=bad)
-
-    def test_blocked_assessment_fails_closed(self):
-        bad = dict(_assessment(self.repo, self.head), block=True, allowed=False)
-        self._assert_blocked(assessment=bad)
-
-
-class TestOrdinaryControlCheckoutMutationStillForbidden(_ControlCheckoutHarness):
-    """The waiver must not leak to ordinary author work."""
-
-    def test_ordinary_author_task_still_blocked(self):
-        with self.assertRaises(workflow_scope_guard.ProductionGuardError):
-            self._enforce("commit_files", assessment=None)
-
-    def test_lock_issue_still_blocked_from_control(self):
-        with self.assertRaises(workflow_scope_guard.ProductionGuardError):
-            self._enforce("lock_issue", assessment=None)
-
-    def test_bootstrap_assessment_cannot_license_other_task(self):
-        # Cross-task smuggling: valid bootstrap evidence must not waive a
-        # different author mutation.
-        good = _assessment(self.repo, self.head)
-        with self.assertRaises(workflow_scope_guard.ProductionGuardError):
-            self._enforce("commit_files", assessment=good)
-
-    def test_dirty_control_checkout_still_blocked_for_bootstrap(self):
-        with self.assertRaises(workflow_scope_guard.ProductionGuardError):
-            self._enforce(BOOTSTRAP_TASK, porcelain=" M gitea_mcp_server.py\n")
-
-
-class TestCreateIssueBehaviorUnchanged(_ControlCheckoutHarness):
-    """#749 create_issue keeps its own sanctioned path."""
-
-    def test_create_issue_still_allowed_from_clean_control(self):
-        self._enforce("create_issue", assessment=None)
-
-    def test_create_issue_tool_alias_still_allowed(self):
-        self._enforce("gitea_create_issue", assessment=None)
-
-    def test_create_issue_blocked_when_control_dirty(self):
-        with self.assertRaises(workflow_scope_guard.ProductionGuardError):
-            self._enforce(
-                "create_issue",
-                porcelain=" M gitea_mcp_server.py\n",
-                assessment=None,
-            )
-
-
-class TestGuardUnitLevelWiring(unittest.TestCase):
-    """assess_root_source_mutation itself must accept and honour the evidence."""
-
-    def setUp(self):
-        self._tmp = tempfile.TemporaryDirectory()
-        self.addCleanup(self._tmp.cleanup)
-        self.repo, self.head = _make_control_repo(self._tmp.name)
-        patcher = mock.patch.dict(
-            os.environ,
-            {workflow_scope_guard.FORCE_PRODUCTION_GUARDS_ENV: "1"},
-        )
-        patcher.start()
-        self.addCleanup(patcher.stop)
-
-    def _assess(self, *, task=BOOTSTRAP_TASK, bootstrap_assessment="auto"):
-        if bootstrap_assessment == "auto":
-            bootstrap_assessment = _assessment(self.repo, self.head, task=task)
-        return workflow_scope_guard.assess_root_source_mutation(
-            workspace_path=self.repo,
-            canonical_repo_root=self.repo,
-            porcelain_status="",
-            current_branch="master",
-            role_kind="author",
-            mutation_task=task,
-            bootstrap_assessment=bootstrap_assessment,
-        )
-
-    def test_valid_evidence_unblocks(self):
-        result = self._assess()
-        self.assertFalse(result["block"])
-        self.assertIsNone(result["blocker_kind"])
-
-    def test_absent_evidence_blocks(self):
-        result = self._assess(bootstrap_assessment=None)
-        self.assertTrue(result["block"])
-        self.assertEqual(
-            result["blocker_kind"], workflow_scope_guard.BLOCKER_MISSING_WORKTREE
-        )
-
-    def test_reconciler_exemption_preserved(self):
-        result = workflow_scope_guard.assess_root_source_mutation(
-            workspace_path=self.repo,
-            canonical_repo_root=self.repo,
-            porcelain_status="",
-            current_branch="master",
-            role_kind="reconciler",
-            mutation_task=BOOTSTRAP_TASK,
-        )
-        self.assertFalse(result["block"])
-
-    def test_signature_accepts_evidence_without_it_being_required(self):
-        # Callers that supply no evidence keep the pre-existing behaviour.
-        result = workflow_scope_guard.assess_root_source_mutation(
-            workspace_path=self.repo,
-            canonical_repo_root=self.repo,
-            porcelain_status="",
-            current_branch="master",
-            role_kind="author",
-            mutation_task="create_issue",
-        )
-        self.assertFalse(result["block"])
-
-
-if __name__ == "__main__":
-    unittest.main()

workflow_scope_guard.py

@@ -279,7 +279,6 @@ def assess_root_source_mutation(
     locked_issue_number: int | None = None,
     role_kind: str | None = None,
     mutation_task: str | None = None,
-    bootstrap_assessment: Any | None = None,
 ) -> dict[str, Any]:
     """Fail closed for diagnostic/source edits on the control/root checkout.
 
@@ -287,13 +286,6 @@ def assess_root_source_mutation(
     tracked source/test files on the control checkout always block, including
     temporary/diagnostic/test-only intent.
 
-    #941: ``bootstrap_author_issue_worktree`` is judged by the canonical
-    ``create_issue_bootstrap.bootstrap_permits_control_checkout`` decision over
-    *bootstrap_assessment* — the same server-derived evidence the #274 and
-    #604 guards consume — instead of a task-name allowlist local to this
-    module. Evidence that is absent, malformed, wrongly scoped, or bound to
-    another workspace leaves the ordinary block in force.
-
     #749: ``create_issue`` is a pure remote mutation with no local tree write.
     When *mutation_task* is create_issue and the control checkout has no dirty
     source/test files, the missing-worktree signal is suppressed so the
@@ -344,19 +336,6 @@ def assess_root_source_mutation(
         if _cib is not None and _cib.is_create_issue_task(mutation_task):
             # #749: clean-root create_issue is the sanctioned bootstrap path.
             create_issue_bootstrap = True
-        elif _cib is not None and _cib.bootstrap_permits_control_checkout(
-            bootstrap_assessment,
-            task=mutation_task,
-            workspace_path=workspace,
-            canonical_repo_root=root,
-        ):
-            # #941: the author issue-worktree bootstrap is authorized by the
-            # canonical shared decision over server-derived task-scope
-            # evidence, never by a task-name allowlist kept in this module.
-            # The predicate fails closed on missing, malformed, cross-scope,
-            # dirty, drifted, or wrongly bound evidence, so this arm cannot
-            # widen the waiver beyond the one sanctioned bootstrap task.
-            create_issue_bootstrap = True
         else:
             # Explicit missing-worktree signal for force-on author entrypoints.
             reasons.append(
@@ -414,15 +393,8 @@ def assess_production_mutation_guards(
     require_author_lock: bool = False,
     in_test_mode: bool = False,
     mutation_task: str | None = None,
-    bootstrap_assessment: Any | None = None,
 ) -> dict[str, Any]:
-    """Compose root + scope production guards when they must be active (#683).
-
-    #941: *bootstrap_assessment* is the server-derived author-bootstrap
-    evidence, forwarded unchanged to :func:`assess_root_source_mutation` so
-    this guard reaches the same canonical decision as the #274 and #604
-    guards. Omitting it preserves the pre-existing behaviour.
-    """
+    """Compose root + scope production guards when they must be active (#683)."""
     if not production_guards_active(in_test_mode=in_test_mode):
         return {
             "proven": True,
@@ -442,7 +414,6 @@ def assess_production_mutation_guards(
         locked_issue_number=locked_issue_number,
         role_kind=role_kind,
         mutation_task=mutation_task,
-        bootstrap_assessment=bootstrap_assessment,
     )
     if root_assess["block"]:
         return {**root_assess, "skipped": False}