Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 73 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

Reviewer workflows must prove worktree ownership before reset or validation #312

New Issue
Closed
opened 2026-07-07 01:08:52 -05:00 by jcwalker3 · 1 comment
jcwalker3 commented 2026-07-07 01:08:52 -05:00
Owner
Copy Link
Copy Source

A reviewer workflow merged PR #279 successfully, but it reused a branch-named worktree and ran git reset --hard FETCH_HEAD before validation.

Observed behavior:

  • Review worktree path: /Users/jasonwalker/Development/Gitea-Tools/branches/docs-issue-260-forbid-commit-fallbacks
  • The path appears to be the PR branch worktree, not a session-owned reviewer worktree.
  • The workflow ran git reset --hard FETCH_HEAD.
  • The workflow reported this as a worktree mutation.
  • The merge succeeded, but the workflow did not clearly prove the reused worktree was session-owned or safe to reset.

Problem:

Reviewers should not destructively reset arbitrary or author-owned worktrees. A git reset --hard is safe only in a fresh session-owned review worktree or when explicit safe-reuse proof exists.

Required behavior:

  1. Reviewer validation must prefer a fresh session-owned review worktree under branches/, such as:
    branches/review-pr<PR_NUMBER>-<branch-name>

  2. If reusing an existing worktree, the workflow must prove:

    • exact worktree path
    • worktree is inside branches/
    • worktree is not the main checkout
    • worktree is not owned by another active task/session
    • worktree has no uncommitted changes
    • worktree has no untracked files that would be lost
    • worktree branch/head before reset
    • reset target SHA
    • explicit project policy allowing reuse/reset

  3. git reset --hard, checkout, clean, or destructive commands must be forbidden unless the worktree is session-owned or safe-reuse proof passes.

  4. Final reports must distinguish:

    • file edits by reviewer
    • worktree mutations
    • destructive reset operations
    • cleanup operations

Acceptance criteria:

  • Fresh session-owned review worktrees pass.
  • Reused worktrees require safe-reuse proof.
  • Destructive reset in an unproven worktree fails.
  • Final-report validation rejects Workspace mutations: none when git reset --hard occurred.
  • Tests cover fresh review worktree, reused clean worktree, reused dirty worktree, untracked files, and destructive reset.
A reviewer workflow merged PR #279 successfully, but it reused a branch-named worktree and ran `git reset --hard FETCH_HEAD` before validation. Observed behavior: * Review worktree path: `/Users/jasonwalker/Development/Gitea-Tools/branches/docs-issue-260-forbid-commit-fallbacks` * The path appears to be the PR branch worktree, not a session-owned reviewer worktree. * The workflow ran `git reset --hard FETCH_HEAD`. * The workflow reported this as a worktree mutation. * The merge succeeded, but the workflow did not clearly prove the reused worktree was session-owned or safe to reset. Problem: Reviewers should not destructively reset arbitrary or author-owned worktrees. A `git reset --hard` is safe only in a fresh session-owned review worktree or when explicit safe-reuse proof exists. Required behavior: 1. Reviewer validation must prefer a fresh session-owned review worktree under `branches/`, such as: `branches/review-pr<PR_NUMBER>-<branch-name>` 2. If reusing an existing worktree, the workflow must prove: * exact worktree path * worktree is inside `branches/` * worktree is not the main checkout * worktree is not owned by another active task/session * worktree has no uncommitted changes * worktree has no untracked files that would be lost * worktree branch/head before reset * reset target SHA * explicit project policy allowing reuse/reset 3. `git reset --hard`, checkout, clean, or destructive commands must be forbidden unless the worktree is session-owned or safe-reuse proof passes. 4. Final reports must distinguish: * file edits by reviewer * worktree mutations * destructive reset operations * cleanup operations Acceptance criteria: * Fresh session-owned review worktrees pass. * Reused worktrees require safe-reuse proof. * Destructive reset in an unproven worktree fails. * Final-report validation rejects `Workspace mutations: none` when `git reset --hard` occurred. * Tests cover fresh review worktree, reused clean worktree, reused dirty worktree, untracked files, and destructive reset.
jcwalker3 added the status:in-progress label 2026-07-07 04:26:37 -05:00
jcwalker3 commented 2026-07-07 04:26:49 -05:00
Author
Owner
Copy Link
Copy Source

Implementation ready for review — see linked PR.

Adds worktree ownership verifier with tests for fresh session-owned worktrees, safe-reuse proof, dirty/untracked reuse failures, and workspace-none contradictions after git reset --hard.

Implementation ready for review — see linked PR. Adds worktree ownership verifier with tests for fresh session-owned worktrees, safe-reuse proof, dirty/untracked reuse failures, and workspace-none contradictions after `git reset --hard`.
sysadmin removed the status:in-progress label 2026-07-07 08:12:58 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 sysadmin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#312