Enforce issue-write tool gates to match task capability resolver (mcp-control-plane #69) #222

2026-07-05T20:09:43-05:00

jcwalker3 commented

2026-07-05 20:09:43 -05:00

Summary

Closes the structural defect tracked in mcp-control-plane #69: issue-mutating MCP tools could succeed even when gitea_resolve_task_capability denied the same task.

Changes

Extract TASK_CAPABILITY_MAP into task_capability_map.py (shared by resolver + tool gates)
Gate gitea_create_issue → gitea.issue.create
Gate gitea_close_issue → gitea.issue.close
Gate gitea_mark_issue / gitea_set_issue_labels → gitea.issue.comment
Return structured #142 permission reports on denial (performed: false)
Add tests/test_issue_write_tool_gates.py regression suite

Verification

./venv/bin/python3 -m unittest \
  tests.test_issue_write_tool_gates \
  tests.test_resolve_task_capability \
  tests.test_issue_duplicate_gate.TestCreateIssueMCPGate \
  tests.test_audit.TestSimpleToolAudit \
  tests.test_mcp_server.TestCreateIssue \
  tests.test_mcp_server.TestCloseIssue \
  tests.test_mcp_server.TestMarkIssue \
  tests.test_mcp_server.TestAuthErrors

40 tests OK.

Implements mcp-control-plane #69.

## Summary Closes the structural defect tracked in [mcp-control-plane #69](https://gitea.prgs.cc/Scaled-Tech-Consulting/mcp-control-plane/issues/69): issue-mutating MCP tools could succeed even when `gitea_resolve_task_capability` denied the same task. ## Changes - Extract `TASK_CAPABILITY_MAP` into `task_capability_map.py` (shared by resolver + tool gates) - Gate `gitea_create_issue` → `gitea.issue.create` - Gate `gitea_close_issue` → `gitea.issue.close` - Gate `gitea_mark_issue` / `gitea_set_issue_labels` → `gitea.issue.comment` - Return structured `#142` permission reports on denial (`performed: false`) - Add `tests/test_issue_write_tool_gates.py` regression suite ## Verification ``` ./venv/bin/python3 -m unittest \ tests.test_issue_write_tool_gates \ tests.test_resolve_task_capability \ tests.test_issue_duplicate_gate.TestCreateIssueMCPGate \ tests.test_audit.TestSimpleToolAudit \ tests.test_mcp_server.TestCreateIssue \ tests.test_mcp_server.TestCloseIssue \ tests.test_mcp_server.TestMarkIssue \ tests.test_mcp_server.TestAuthErrors ``` 40 tests OK. Implements mcp-control-plane #69.

jcwalker3 added 2 commits 2026-07-05 20:09:44 -05:00

Rename mcp_server.py to gitea_mcp_server.py c89ae2eb5c

Enforce issue-write tool gates to match task capability resolver (Issue #69 ) 00394d43b7

Extract TASK_CAPABILITY_MAP into task_capability_map.py as the single source
of truth shared by gitea_resolve_task_capability and issue-mutating tools.
Gate gitea_create_issue, gitea_close_issue, gitea_mark_issue, and
gitea_set_issue_labels with structured #142 permission reports. Add regression
tests proving resolver-denied tasks fail closed at the raw tool layer.

Implements mcp-control-plane #69.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

sysadmin reviewed 2026-07-06 00:10:54 -05:00

sysadmin left a comment

Review (sysadmin / prgs-reviewer)

Approved — issue-write tool gates (#69). Extracts task_capability_map.py and gates issue-mutating MCP tools with structured permission reports. Rebased test pass on current master. Branch behind master (#221); mergeable per Gitea.

## Review (sysadmin / prgs-reviewer) Approved — issue-write tool gates (#69). Extracts `task_capability_map.py` and gates issue-mutating MCP tools with structured permission reports. Rebased test pass on current master. Branch behind master (#221); mergeable per Gitea.

sysadmin referenced this pull request

2026-07-06 00:11:04 -05:00

Block role/tool namespace mismatch for author and reviewer mutations (Issue #209) #223

sysadmin merged commit 25c19b26d3 into master

2026-07-06 00:14:40 -05:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#222