Require exact capability proof for every mutation in reviewer final reports #405

New Issue

2026-07-07T10:10:39-05:00

jcwalker3 commented

2026-07-07 10:10:39 -05:00

Context:
Recent review-merge reports correctly prove review_pr capability, but then perform additional mutations such as gitea_merge_pr and gitea_delete_branch without clearly reporting exact capability proof for those specific operations. Nearby capabilities must not authorize different operations.

Problem:
A reviewer final report can show capability proof for review_pr while also merging a PR or deleting a remote branch. Merge and branch deletion are separate mutations and require separate exact capability proof.

Required behavior:
Every mutation must have exact capability proof before execution and must be listed in the final report.

Acceptance criteria:

gitea_submit_pr_review requires exact review_pr capability proof.
gitea_merge_pr requires exact merge_pr capability proof.
gitea_delete_branch requires exact delete_branch / gitea.branch.delete capability proof.
Final report must include a mutation-capability table:
- mutation,
- exact task/capability resolved,
- result,
- timestamp/order before mutation.
Nearby capabilities do not count.
If exact capability proof is missing, the mutation is skipped or the workflow stops.
Tests prove:
- review_pr does not authorize merge,
- merge_pr does not authorize branch deletion,
- branch deletion is skipped when delete capability is missing,
- final report fails validation if mutation proof is missing.
Documentation updates review-merge workflow and handoff template.

Non-goals:

Do not grant branch-delete capability broadly.
Do not weaken existing reviewer/author separation.
Do not allow post-hoc capability proof after mutation.

Context: Recent review-merge reports correctly prove `review_pr` capability, but then perform additional mutations such as `gitea_merge_pr` and `gitea_delete_branch` without clearly reporting exact capability proof for those specific operations. Nearby capabilities must not authorize different operations. Problem: A reviewer final report can show capability proof for `review_pr` while also merging a PR or deleting a remote branch. Merge and branch deletion are separate mutations and require separate exact capability proof. Required behavior: Every mutation must have exact capability proof before execution and must be listed in the final report. Acceptance criteria: 1. `gitea_submit_pr_review` requires exact `review_pr` capability proof. 2. `gitea_merge_pr` requires exact `merge_pr` capability proof. 3. `gitea_delete_branch` requires exact `delete_branch` / `gitea.branch.delete` capability proof. 4. Final report must include a mutation-capability table: * mutation, * exact task/capability resolved, * result, * timestamp/order before mutation. 5. Nearby capabilities do not count. 6. If exact capability proof is missing, the mutation is skipped or the workflow stops. 7. Tests prove: * `review_pr` does not authorize merge, * `merge_pr` does not authorize branch deletion, * branch deletion is skipped when delete capability is missing, * final report fails validation if mutation proof is missing. 8. Documentation updates review-merge workflow and handoff template. Non-goals: * Do not grant branch-delete capability broadly. * Do not weaken existing reviewer/author separation. * Do not allow post-hoc capability proof after mutation.

jcwalker3 commented

2026-07-07 10:29:26 -05:00

PR #388 is another example where the final report proved review_pr capability but did not clearly report exact merge_pr capability before gitea_merge_pr. The merge outcome appears safe, but the report is missing exact mutation-capability proof.

PR #388 is another example where the final report proved `review_pr` capability but did not clearly report exact `merge_pr` capability before `gitea_merge_pr`. The merge outcome appears safe, but the report is missing exact mutation-capability proof.

jcwalker3 added the status:in-progress label 2026-07-07 10:46:04 -05:00

jcwalker3 commented

2026-07-07 10:46:40 -05:00

Claiming #405 for implementation (author session, prgs-author / jcwalker3).

Branch: feat/issue-405-mutation-capability-proof (base master 9fde4f3)

Planned slice (report-verifier pattern, matching sibling PRs #397/#409/#411/#412):

reviewer_mutation_capability_proof.py — assess_mutation_capability_proof(report_text) requiring a mutation-capability table: each mutating operation (gitea_submit_pr_review, gitea_merge_pr, gitea_delete_branch) paired with its exact resolved task/permission (review_pr / merge_pr / delete_branch+gitea.branch.delete), result, and pre-mutation order. Fail closed on: a merge/delete claim with only review_pr proof (nearby capability), missing table, post-hoc proof, or a listed mutation lacking its row.
Wire into final_report_validator.py as reviewer.mutation_capability_proof; export wrapper in review_proofs.py.
Docs: review-merge-pr.md handoff section for the mutation-capability table.
Tests: review_pr does-not-authorize-merge, merge_pr does-not-authorize-delete, delete skipped when capability missing, report fails when proof missing, fully-proven passes.

Scope note: report-layer proof, complementary to server-side gates #392 (#389 load), #410 (#408 delete-branch tool gate) — this issue asserts the report accounts for every mutation's exact proof. Working in branches/issue-405-mutation-capability-proof.

Claiming #405 for implementation (author session, `prgs-author` / `jcwalker3`). **Branch:** `feat/issue-405-mutation-capability-proof` (base master `9fde4f3`) **Planned slice** (report-verifier pattern, matching sibling PRs #397/#409/#411/#412): - `reviewer_mutation_capability_proof.py` — `assess_mutation_capability_proof(report_text)` requiring a mutation-capability table: each mutating operation (`gitea_submit_pr_review`, `gitea_merge_pr`, `gitea_delete_branch`) paired with its exact resolved task/permission (`review_pr` / `merge_pr` / `delete_branch`+`gitea.branch.delete`), result, and pre-mutation order. Fail closed on: a merge/delete claim with only `review_pr` proof (nearby capability), missing table, post-hoc proof, or a listed mutation lacking its row. - Wire into `final_report_validator.py` as `reviewer.mutation_capability_proof`; export wrapper in `review_proofs.py`. - Docs: review-merge-pr.md handoff section for the mutation-capability table. - Tests: review_pr does-not-authorize-merge, merge_pr does-not-authorize-delete, delete skipped when capability missing, report fails when proof missing, fully-proven passes. Scope note: report-layer proof, complementary to server-side gates #392 (#389 load), #410 (#408 delete-branch tool gate) — this issue asserts the *report* accounts for every mutation's exact proof. Working in `branches/issue-405-mutation-capability-proof`.

jcwalker3 commented

2026-07-07 10:51:57 -05:00

PR #410 appears to have fixed the gitea_delete_branch tool-entry gate for Issue #408. However, the PR #410 review/merge final report still only clearly reports review_pr capability proof while performing gitea_merge_pr and gitea_delete_branch.

This shows the remaining gap is report-layer enforcement: reviewer final reports need a mutation-capability table proving exact capability for every mutation.

Evidence:

PR: feat: gate gitea_delete_branch on gitea.branch.delete capability (Closes #408) (#410)
Reviewed/merged head: af7131abf16489baab832c4f74f30d19bce1d276
Mutations performed:
- gitea_submit_pr_review
- gitea_merge_pr
- gitea_delete_branch
Reported capability proof: review_pr only
Missing report proof:
- exact merge_pr
- exact delete_branch / gitea.branch.delete

#408 fixed the tool-entry gate, but #405 still needs report validation.

PR #410 appears to have fixed the `gitea_delete_branch` tool-entry gate for Issue #408. However, the PR #410 review/merge final report still only clearly reports `review_pr` capability proof while performing `gitea_merge_pr` and `gitea_delete_branch`. This shows the remaining gap is report-layer enforcement: reviewer final reports need a mutation-capability table proving exact capability for every mutation. Evidence: * PR: #410 * Reviewed/merged head: `af7131abf16489baab832c4f74f30d19bce1d276` * Mutations performed: * `gitea_submit_pr_review` * `gitea_merge_pr` * `gitea_delete_branch` * Reported capability proof: `review_pr` only * Missing report proof: * exact `merge_pr` * exact `delete_branch` / `gitea.branch.delete` #408 fixed the tool-entry gate, but #405 still needs report validation.

jcwalker3 referenced this issue from a commit

2026-07-07 10:52:49 -05:00

feat: require exact per-mutation capability proof in reviewer reports (Closes #405)

jcwalker3 referenced a pull request that will close this issue

2026-07-07 10:52:51 -05:00

feat: require exact per-mutation capability proof in reviewer reports (Closes #405) #418

jcwalker3 commented

2026-07-07 11:51:48 -05:00

PR #410 appears to have fixed the gitea_delete_branch tool-entry gate for Issue #408, but its review/merge final report still only clearly reported review_pr capability while performing gitea_merge_pr and gitea_delete_branch.

Details:

PR: feat: gate gitea_delete_branch on gitea.branch.delete capability (Closes #408) (#410)
Reviewed/merged head: af7131abf16489baab832c4f74f30d19bce1d276
Successful validations:
- PR-head full suite 1575 passed, 6 skipped
- Merge-simulation suite 1600 passed, 6 skipped
Mutations performed:
- gitea_submit_pr_review
- gitea_merge_pr
- gitea_delete_branch
Missing report proof:
- Exact merge_pr
- Exact delete_branch / gitea.branch.delete

Conclusion:

#408 fixed the tool gate, but #405 still needs report-layer enforcement.

PR #410 appears to have fixed the `gitea_delete_branch` tool-entry gate for Issue #408, but its review/merge final report still only clearly reported `review_pr` capability while performing `gitea_merge_pr` and `gitea_delete_branch`. ### Details: * **PR**: #410 * **Reviewed/merged head**: `af7131abf16489baab832c4f74f30d19bce1d276` * **Successful validations**: * PR-head full suite `1575 passed, 6 skipped` * Merge-simulation suite `1600 passed, 6 skipped` * **Mutations performed**: * `gitea_submit_pr_review` * `gitea_merge_pr` * `gitea_delete_branch` * **Missing report proof**: * Exact `merge_pr` * Exact `delete_branch` / `gitea.branch.delete` ### Conclusion: #408 fixed the tool gate, but #405 still needs report-layer enforcement.

jcwalker3 referenced this issue

2026-07-07 12:21:01 -05:00

Web UI: Report audit paste tool #431

jcwalker3 referenced this issue from a commit

2026-07-07 16:20:12 -05:00

feat: require exact per-mutation capability proof in reviewer reports (Closes #405)

jcwalker3 referenced this issue

2026-07-07 16:21:57 -05:00

Capability preflight should survive safe read calls or report sequencing requirements clearly #470

sysadmin referenced this issue

2026-07-08 10:28:38 -05:00

feat: require exact per-mutation capability proof in reviewer reports (Closes #405) #418