Map gitea_commit_files in the task capability resolver #262

New Issue

2026-07-06T12:21:31-05:00

jcwalker3 commented

2026-07-06 12:21:31 -05:00

Context

Issue #152 commit recovery stopped correctly: MCP was responsive and gitea.repo.commit is allowed on prgs-author, but gitea_resolve_task_capability('commit_files') and gitea_resolve_task_capability('gitea_commit_files') both fail with unknown task because TASK_CAPABILITY_MAP has no commit-file entry.

Agents currently satisfy preflight only by resolving a nearby capability such as create_pr, which does not prove commit permission and blurs the audit trail.

Related dogfood follow-ups: #258, #259, #260, #261.

Problem

gitea_commit_files is a live mutating tool gated by verify_preflight_purity, yet the task capability resolver cannot answer whether commit-file work is allowed. Runtime exposes gitea.repo.commit, but the resolver cannot map commit tasks to that operation.

Required behavior

Add resolver entries so commit-file tasks resolve directly to exact operation gitea.repo.commit.

Acceptance criteria

commit_files resolves to permission gitea.repo.commit and role author.
gitea_commit_files resolves to permission gitea.repo.commit and role author.
Author profiles with gitea.repo.commit are allowed.
Reviewer profiles without commit permission are denied.
No nearby capability such as create_pr can satisfy commit permission for commit-file tasks.
Tests cover: allowed author, denied reviewer, unknown profile, dirty workspace, and pre-whoami contamination.
ISSUE_MUTATION_TOOL_TASKS / tool gates stay aligned with task_capability_map.py (no drift).

Non-goals

Changing Gitea API commit semantics.
Solving base64 payload preparation (see separate issue for shell-free encoding).

Ordering

Should land before or alongside shell-free commit payload work so agents can prove commit capability without proxying through create_pr.

## Context Issue #152 commit recovery stopped correctly: MCP was responsive and `gitea.repo.commit` is allowed on `prgs-author`, but `gitea_resolve_task_capability('commit_files')` and `gitea_resolve_task_capability('gitea_commit_files')` both fail with **unknown task** because `TASK_CAPABILITY_MAP` has no commit-file entry. Agents currently satisfy preflight only by resolving a nearby capability such as `create_pr`, which does **not** prove commit permission and blurs the audit trail. Related dogfood follow-ups: #258, #259, #260, #261. ## Problem `gitea_commit_files` is a live mutating tool gated by `verify_preflight_purity`, yet the task capability resolver cannot answer whether commit-file work is allowed. Runtime exposes `gitea.repo.commit`, but the resolver cannot map commit tasks to that operation. ## Required behavior Add resolver entries so commit-file tasks resolve directly to exact operation **`gitea.repo.commit`**. ## Acceptance criteria - [ ] `commit_files` resolves to permission `gitea.repo.commit` and role `author`. - [ ] `gitea_commit_files` resolves to permission `gitea.repo.commit` and role `author`. - [ ] Author profiles with `gitea.repo.commit` are **allowed**. - [ ] Reviewer profiles without commit permission are **denied**. - [ ] No nearby capability such as `create_pr` can satisfy commit permission for commit-file tasks. - [ ] Tests cover: allowed author, denied reviewer, unknown profile, dirty workspace, and pre-whoami contamination. - [ ] `ISSUE_MUTATION_TOOL_TASKS` / tool gates stay aligned with `task_capability_map.py` (no drift). ## Non-goals - Changing Gitea API commit semantics. - Solving base64 payload preparation (see separate issue for shell-free encoding). ## Ordering Should land before or alongside shell-free commit payload work so agents can prove commit capability without proxying through `create_pr`.

jcwalker3 added the status:in-progress label 2026-07-06 13:29:42 -05:00

jcwalker3 referenced this issue from a commit

2026-07-06 13:38:11 -05:00

feat(mcp): map gitea_commit_files in task capability resolver (closes #262)

jcwalker3 referenced this issue from a commit

2026-07-06 13:38:38 -05:00

feat: map commit_files in task capability resolver (#262)

jcwalker3 referenced a pull request that will close this issue

2026-07-06 13:38:56 -05:00

feat: map gitea_commit_files in task capability resolver (Closes #262) #276

sysadmin referenced a pull request that will close this issue

2026-07-06 23:35:19 -05:00