Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 73 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

Enforce hard-stop purity after reviewer capability denial #197

New Issue
Closed
opened 2026-07-05 15:09:31 -05:00 by jcwalker3 · 2 comments
jcwalker3 commented 2026-07-05 15:09:31 -05:00
Owner
Copy Link
Copy Source

Problem

Agents can correctly detect that the active profile is not allowed to review or merge, but then continue reasoning into queue selection, sibling repositories, empty-queue claims, or author-side fallback work. This weakens the hard stop and creates opportunities for scope drift.

Observed failure

An agent authenticated as jcwalker3 / prgs-author correctly determined that review_pr and merge_pr were forbidden and that the resolver required a stop. However, after that stop it continued to:

  • claim the target repo had 0 open PRs;
  • assert final-page / no-more-pages proof from the PR list tool;
  • discuss sibling-repo PRs;
  • describe some PRs as “not authored by this session” even though they were under the same jcwalker3 account;
  • suggest author-side fallback work: “or have me rebase conflicted PR 193.”

Required wall

When a reviewer or merge task hits stop_required: true because the active profile lacks reviewer/merge capability, the workflow must enter a strict terminal report mode.

Allowed after hard stop:

  • authenticated identity/profile;
  • exact denied capability result;
  • reason the task cannot proceed;
  • required correct profile/identity for the operator;
  • confirmation that no mutations occurred.

Forbidden after hard stop:

  • PR selection;
  • sibling-repo queue recommendations;
  • author-side fallback suggestions;
  • claims that a queue is empty unless the PR inventory trust gate has returned trusted_empty;
  • eligibility language based on “this session” rather than account identity;
  • suggestions to rebase, implement, branch, push, or otherwise continue author work.

Acceptance criteria

  • Add a test where review_pr returns stop_required: true; expected output must not include PR selection, sibling repo inventory, or author fallback suggestions.
  • Add a test where the agent says “not authored by this session” for a same-account PR; expected result: blocked as invalid eligibility reasoning.
  • Add a test where an author profile attempts to convert a reviewer stop into “rebase conflicted PR”; expected result: blocked.
  • Add a test where empty PR inventory is mentioned after a capability stop without pr_inventory_trust_gate.status == trusted_empty; expected result: blocked.
  • The final report after capability denial must use terminal wording: “Cannot perform reviewer task under current profile. No reviewer mutations performed.”
  • Reviewer eligibility must be based on authenticated account identity, not chat session, branch authoring session, or local working context.

Suggested implementation

Add a capability_stop_terminal_mode wall. Once the resolver returns stop_required: true for a reviewer/merge task, all downstream workflow sections must be suppressed except identity, denied capability, required profile, and mutation confirmation.

Related

  • #139: role-aware task routing and capability resolution.
  • #175: prevents implicit reviewer-to-author role pivots during blind PR queue workflows.
  • #179: reviewer A-bar proof requirements.
  • #196: PR inventory trust gate enforcement for empty queue claims.
## Problem Agents can correctly detect that the active profile is not allowed to review or merge, but then continue reasoning into queue selection, sibling repositories, empty-queue claims, or author-side fallback work. This weakens the hard stop and creates opportunities for scope drift. ## Observed failure An agent authenticated as `jcwalker3 / prgs-author` correctly determined that `review_pr` and `merge_pr` were forbidden and that the resolver required a stop. However, after that stop it continued to: * claim the target repo had `0 open PRs`; * assert final-page / no-more-pages proof from the PR list tool; * discuss sibling-repo PRs; * describe some PRs as “not authored by this session” even though they were under the same `jcwalker3` account; * suggest author-side fallback work: “or have me rebase conflicted PR 193.” ## Required wall When a reviewer or merge task hits `stop_required: true` because the active profile lacks reviewer/merge capability, the workflow must enter a strict terminal report mode. Allowed after hard stop: * authenticated identity/profile; * exact denied capability result; * reason the task cannot proceed; * required correct profile/identity for the operator; * confirmation that no mutations occurred. Forbidden after hard stop: * PR selection; * sibling-repo queue recommendations; * author-side fallback suggestions; * claims that a queue is empty unless the PR inventory trust gate has returned `trusted_empty`; * eligibility language based on “this session” rather than account identity; * suggestions to rebase, implement, branch, push, or otherwise continue author work. ## Acceptance criteria * Add a test where `review_pr` returns `stop_required: true`; expected output must not include PR selection, sibling repo inventory, or author fallback suggestions. * Add a test where the agent says “not authored by this session” for a same-account PR; expected result: blocked as invalid eligibility reasoning. * Add a test where an author profile attempts to convert a reviewer stop into “rebase conflicted PR”; expected result: blocked. * Add a test where empty PR inventory is mentioned after a capability stop without `pr_inventory_trust_gate.status == trusted_empty`; expected result: blocked. * The final report after capability denial must use terminal wording: “Cannot perform reviewer task under current profile. No reviewer mutations performed.” * Reviewer eligibility must be based on authenticated account identity, not chat session, branch authoring session, or local working context. ## Suggested implementation Add a `capability_stop_terminal_mode` wall. Once the resolver returns `stop_required: true` for a reviewer/merge task, all downstream workflow sections must be suppressed except identity, denied capability, required profile, and mutation confirmation. ## Related * #139: role-aware task routing and capability resolution. * #175: prevents implicit reviewer-to-author role pivots during blind PR queue workflows. * #179: reviewer A-bar proof requirements. * #196: PR inventory trust gate enforcement for empty queue claims.
jcwalker3 commented 2026-07-05 16:13:53 -05:00
Author
Owner
Copy Link
Copy Source

Cross-reference: a new hard-stop purity failure was observed and documented on #206 (comment). Summary: a reviewer task for PR #203 running under jcwalker3 / prgs-author correctly denied reviewer capability and made no mutations, but then continued with read-only review analysis (ls-remote head pinning, base ancestry check, PR body blocker inspection) after detecting the role wall.

Required behavior and acceptance test are specified in the #206 comment: reviewer task + author profile must return wrong_role_stop before any PR analysis, including read-only validation. That requirement extends the hard-stop purity rule tracked here.

Cross-reference: a new hard-stop purity failure was observed and documented on #206 (comment). Summary: a reviewer task for PR #203 running under `jcwalker3 / prgs-author` correctly denied reviewer capability and made no mutations, but then continued with read-only review analysis (`ls-remote` head pinning, base ancestry check, PR body blocker inspection) after detecting the role wall. Required behavior and acceptance test are specified in the #206 comment: reviewer task + author profile must return `wrong_role_stop` before any PR analysis, including read-only validation. That requirement extends the hard-stop purity rule tracked here.
jcwalker3 added the status:in-progress label 2026-07-05 16:16:14 -05:00
jcwalker3 commented 2026-07-05 16:26:37 -05:00
Author
Owner
Copy Link
Copy Source

Acceptance test passed: five repeated reviewer-task prompts in a jcwalker3 / prgs-author static session produced five wrong_role_stop outcomes. No CLI/profile fallback, no review analysis leakage after codification, and no Gitea/repo mutations. Future reviewer work must be launched in a separate sysadmin / prgs-reviewer MCP namespace.

(Posted here because #206 is now closed; this issue is the open tracker for wrong-role-stop / hard-stop purity behavior.)

Acceptance test passed: five repeated reviewer-task prompts in a `jcwalker3 / prgs-author` static session produced five `wrong_role_stop` outcomes. No CLI/profile fallback, no review analysis leakage after codification, and no Gitea/repo mutations. Future reviewer work must be launched in a separate `sysadmin / prgs-reviewer` MCP namespace. (Posted here because #206 is now closed; this issue is the open tracker for wrong-role-stop / hard-stop purity behavior.)
sysadmin removed the status:in-progress label 2026-07-05 19:38:23 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 sysadmin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#197