Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 73 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

feat: Block workspace edits before identity and capability verification Closes #210 #212

Closed
jcwalker3 wants to merge 6 commits from feat/issue-210-block-workspace-edits into master
pull from: feat/issue-210-block-workspace-edits
merge into: :master
Conversation 2 Commits 6 Files Changed 8
+820 -12
jcwalker3 commented 2026-07-05 15:43:43 -05:00
Owner
Copy Link
Copy Source

Implement pre-flight order verification and block workspace edits before gitea_whoami and gitea_resolve_task_capability.

Implement pre-flight order verification and block workspace edits before gitea_whoami and gitea_resolve_task_capability.
jcwalker3 added 6 commits 2026-07-05 15:43:44 -05:00
feat(reviewer-workflow): add hard wall against reviewer mutations through alternate profile or CLI side-channel 10d2644790
feat(author-workflow): enforce exact issue lock before branch/commit/push/PR (Closes #204) 88deed4e69
Merge master into feat/issue-204 4fb08a012e
feat(preflight): block workspace edits before identity/capability verification 15bd70167e
test(preflight): add preflight order verification tests 99ffc79e21
feat(reviewer-preflight): check Workspace mutations handoff fields eaead549c3
jcwalker3 commented 2026-07-05 15:49:10 -05:00
Author
Owner
Copy Link
Copy Source

Blocked: Invalid Provenance / Contaminated Branch

PR #212 is being closed as invalid/contaminated due to the following findings:

  1. Branch Stacking: PR #212 is stacked on top of unmerged branches, including #204/#205 and #203 work, leading to unrelated file changes in the diff.
  2. Lock-Order Violation: Issue #210 was locked after commits were made and the branch was pushed, violating the strict lock-before-work rule.
  3. Role/Tool Namespace Mismatch: The session used the gitea-reviewer server namespace for author-side issue and PR creation instead of gitea-author.
  4. Weak Safety Wall: The proposed /tmp/gitea_preflight_check.json design is not a reliable hard wall as it is mutable, filesystem-spoofable, and cross-session unsafe.

A replacement PR will be opened shortly from a clean base with a secure in-memory pre-flight verification design.

### Blocked: Invalid Provenance / Contaminated Branch PR #212 is being closed as invalid/contaminated due to the following findings: 1. **Branch Stacking**: PR #212 is stacked on top of unmerged branches, including #204/#205 and #203 work, leading to unrelated file changes in the diff. 2. **Lock-Order Violation**: Issue #210 was locked *after* commits were made and the branch was pushed, violating the strict lock-before-work rule. 3. **Role/Tool Namespace Mismatch**: The session used the `gitea-reviewer` server namespace for author-side issue and PR creation instead of `gitea-author`. 4. **Weak Safety Wall**: The proposed `/tmp/gitea_preflight_check.json` design is not a reliable hard wall as it is mutable, filesystem-spoofable, and cross-session unsafe. A replacement PR will be opened shortly from a clean base with a secure in-memory pre-flight verification design.
jcwalker3 closed this pull request 2026-07-05 15:49:13 -05:00
jcwalker3 commented 2026-07-05 15:52:30 -05:00
Author
Owner
Copy Link
Copy Source

Replacement PR has been opened as #215.

Replacement PR has been opened as #215.

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 sysadmin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#212