Harden author-run reporting and mutation capability proof: Controller Handoff, exact issue-claim capability, exact sweep evidence, PR head SHA #183

New Issue

2026-07-05T14:22:16-05:00

jcwalker3 commented

2026-07-05 14:22:16 -05:00

Problem:
A Grok author run selected Gitea-Tools issue #178, created branch feat/issue-178-fix-test-suite-stdout-capture, and opened PR #180 (head ff4ab500df8447f4409b3e9cc262520e8076d806 at filing time). The run was safe — it used jcwalker3 / prgs-author, did not review/approve/merge, checked both configured repositories, and stopped after PR creation — but it exposed several remaining author-side workflow/reporting gaps that no existing open issue covers as a unit.

Observed gaps (evidence: the Grok run's final report):

Missing Controller Handoff.
The final report was detailed but did not include a compact Controller Handoff block (SKILL.md §K). Future controllers must not have to manually extract branch, PR, validation, status, and next action from a long report.
Unknown capability treated as allowed for the issue claim.
The report says: gitea_mark_issue task resolve unknown but profile permits issue ops; used per workflow skill. This is not acceptable as A-level proof. If a mutation task is unknown to the capability resolver, the workflow must not treat general profile permissions as equivalent to exact capability proof. It must either resolve the exact mutation capability, use a known allowed lower-level operation with explicit proof, or fail closed.
Validation did not fully prove the linked issue's acceptance.
Issue #178 is about fixing pytest stdout capture so junitxml is not required, but the report did not clearly prove that ./venv/bin/python -m pytest tests/ --ignore=branches now prints a normal pytest summary without the junitxml workaround (it reported targeted tests, "full relevant" tests, and subprocess pipe capture instead). Issue-specific canonical validation must be shown with the exact visible summary.
Secret/provenance sweep was not exact.
The report cites tests/test_clear_provenance.py and says the staged diff was clean, but does not include the exact diff-level scan command, pattern, or script used. Sweeps must state exact command/method and scope.
PR head SHA missing from the final report.
The report gives the branch but not the final PR #180 head SHA. Controller handoffs must include the branch and the exact head commit.

Required behavior:

Every final report must include a Controller Handoff section.
Every mutation must have exact capability proof, or the report must state that exact proof was unavailable and stop before mutation.
Issue-claim/mark operations must be represented in the capability map or routed through a clearly allowed operation with tests.
For stdout-capture fixes, validation must include a normal full-suite pytest run without junitxml and include the exact visible summary.
Secret/provenance sweeps must include exact command/method and scope.
Author PR reports must include PR number, branch, and exact head SHA.

Tests / harness assertions:

final report without Controller Handoff is downgraded
unknown mutation capability cannot be treated as allowed
issue-claim mutation requires exact capability proof
stdout-capture issue cannot pass without normal pytest summary output
secret/provenance sweep without exact method is downgraded
author PR creation report without head SHA is incomplete

Acceptance criteria:

A Grok-style author run earns an "A" only when it stays inside author role, inventories configured repos, selects one safe unit, proves exact mutation capability for every remote change, validates with issue-specific canonical commands, includes exact secret/provenance scan evidence, and ends with a Controller Handoff.
No review, merge, permission, identity, redaction, or reconciliation gate is weakened.

#173 (merged, PR #176): reviewer-side proofs — this issue is the author-side reporting/capability-proof counterpart, extending the same fail-closed pattern (review_proofs.py) to author final reports.
#177 (PR #181 open): branch-identity proofs at commit/push time; gap 5 (head SHA in the final report) composes with its build_commit_push_report.
#175: role-boundary wall for blind queue runs; its validation-exactness requirement (item 6) is confirmed by this run's gap 3.
#178 / PR #180: origin run; gap 3 defines the acceptance evidence its closing PR must show.
mcp-control-plane #77: MCP-level author walls (exact mutation capability, complete inventory, scoped selection) — gap 2 is the Gitea-Tools resolver/workflow side of the same rule (resolver coverage for gitea_mark_issue-style claim operations).

Problem: A Grok author run selected Gitea-Tools issue #178, created branch `feat/issue-178-fix-test-suite-stdout-capture`, and opened PR #180 (head `ff4ab500df8447f4409b3e9cc262520e8076d806` at filing time). The run was safe — it used `jcwalker3 / prgs-author`, did not review/approve/merge, checked both configured repositories, and stopped after PR creation — but it exposed several remaining author-side workflow/reporting gaps that no existing open issue covers as a unit. Observed gaps (evidence: the Grok run's final report): 1. Missing Controller Handoff. The final report was detailed but did not include a compact `Controller Handoff` block (SKILL.md §K). Future controllers must not have to manually extract branch, PR, validation, status, and next action from a long report. 2. Unknown capability treated as allowed for the issue claim. The report says: `gitea_mark_issue task resolve unknown but profile permits issue ops; used per workflow skill`. This is not acceptable as A-level proof. If a mutation task is unknown to the capability resolver, the workflow must not treat general profile permissions as equivalent to exact capability proof. It must either resolve the exact mutation capability, use a known allowed lower-level operation with explicit proof, or fail closed. 3. Validation did not fully prove the linked issue's acceptance. Issue #178 is about fixing pytest stdout capture so junitxml is not required, but the report did not clearly prove that `./venv/bin/python -m pytest tests/ --ignore=branches` now prints a normal pytest summary without the junitxml workaround (it reported targeted tests, "full relevant" tests, and subprocess pipe capture instead). Issue-specific canonical validation must be shown with the exact visible summary. 4. Secret/provenance sweep was not exact. The report cites `tests/test_clear_provenance.py` and says the staged diff was clean, but does not include the exact diff-level scan command, pattern, or script used. Sweeps must state exact command/method and scope. 5. PR head SHA missing from the final report. The report gives the branch but not the final PR #180 head SHA. Controller handoffs must include the branch and the exact head commit. Required behavior: * Every final report must include a `Controller Handoff` section. * Every mutation must have exact capability proof, or the report must state that exact proof was unavailable and stop before mutation. * Issue-claim/mark operations must be represented in the capability map or routed through a clearly allowed operation with tests. * For stdout-capture fixes, validation must include a normal full-suite pytest run without junitxml and include the exact visible summary. * Secret/provenance sweeps must include exact command/method and scope. * Author PR reports must include PR number, branch, and exact head SHA. Tests / harness assertions: * final report without Controller Handoff is downgraded * unknown mutation capability cannot be treated as allowed * issue-claim mutation requires exact capability proof * stdout-capture issue cannot pass without normal pytest summary output * secret/provenance sweep without exact method is downgraded * author PR creation report without head SHA is incomplete Acceptance criteria: * A Grok-style author run earns an "A" only when it stays inside author role, inventories configured repos, selects one safe unit, proves exact mutation capability for every remote change, validates with issue-specific canonical commands, includes exact secret/provenance scan evidence, and ends with a Controller Handoff. * No review, merge, permission, identity, redaction, or reconciliation gate is weakened. Related: * #173 (merged, PR #176): reviewer-side proofs — this issue is the author-side reporting/capability-proof counterpart, extending the same fail-closed pattern (`review_proofs.py`) to author final reports. * #177 (PR #181 open): branch-identity proofs at commit/push time; gap 5 (head SHA in the final report) composes with its `build_commit_push_report`. * #175: role-boundary wall for blind queue runs; its validation-exactness requirement (item 6) is confirmed by this run's gap 3. * #178 / PR #180: origin run; gap 3 defines the acceptance evidence its closing PR must show. * mcp-control-plane #77: MCP-level author walls (exact mutation capability, complete inventory, scoped selection) — gap 2 is the Gitea-Tools resolver/workflow side of the same rule (resolver coverage for `gitea_mark_issue`-style claim operations).

Harden author-run reporting and mutation capability proof: Controller Handoff, exact issue-claim capability, exact sweep evidence, PR head SHA #183

Additional resolver-coverage gap: edit_pr (observed during PR #203 remediation)

Additional resolver-coverage gap: `edit_pr` (observed during PR #203 remediation)