Web UI: Gated action framework #434

New Issue

2026-07-07T12:21:02-05:00

jcwalker3 commented

2026-07-07 12:21:02 -05:00

Problem statement

Future UI write actions (claim issue, comment, review) must not bypass MCP capability gates. The architecture needs a disabled-by-default action framework before any writes ship.

Scope

Prepare UI architecture for future write actions without enabling unsafe writes now:

actions disabled by default
every action requires exact MCP capability proof
action preview shows mutation ledger before execution
no review/merge/delete/comment/create buttons unless gated
tests prove ungated actions cannot run

Acceptance criteria

All actions disabled by default in MVP
Every action declares required MCP capability and profile role
Action preview renders a mutation ledger before execution (even when disabled)
No review/merge/delete/comment/create buttons are enabled without passing capability gates
Automated tests prove ungated actions cannot invoke mutations

Non-goals

Enabling real write actions in MVP
Bypassing MCP tools with direct shell/API fallbacks
Storing operator credentials in the browser

Relation to tracker

Child of tracker #425. Implements one slice of the MCP Control Plane internal web UI. Does not duplicate backend policy already enforced by MCP tools/workflows.

Dependencies

Depends on #426. Should be implemented before any non-read-only UI action ships.

Notes

Align with gitea_resolve_task_capability and task capability map.

## Problem statement Future UI write actions (claim issue, comment, review) must not bypass MCP capability gates. The architecture needs a disabled-by-default action framework before any writes ship. ## Scope Prepare UI architecture for future write actions without enabling unsafe writes now: - actions disabled by default - every action requires exact MCP capability proof - action preview shows mutation ledger before execution - no review/merge/delete/comment/create buttons unless gated - tests prove ungated actions cannot run ## Acceptance criteria - All actions disabled by default in MVP - Every action declares required MCP capability and profile role - Action preview renders a mutation ledger before execution (even when disabled) - No review/merge/delete/comment/create buttons are enabled without passing capability gates - Automated tests prove ungated actions cannot invoke mutations ## Non-goals - Enabling real write actions in MVP - Bypassing MCP tools with direct shell/API fallbacks - Storing operator credentials in the browser ## Relation to tracker Child of tracker #425. Implements one slice of the MCP Control Plane internal web UI. Does not duplicate backend policy already enforced by MCP tools/workflows. ## Dependencies Depends on #426. Should be implemented before any non-read-only UI action ships. ## Notes Align with `gitea_resolve_task_capability` and task capability map.

jcwalker3 referenced this issue

2026-07-07 12:21:04 -05:00

Tracker: MCP Control Plane web UI #425

jcwalker3 referenced this issue from a commit

2026-07-07 14:34:46 -05:00

feat(webui): gated action framework (#434)

jcwalker3 referenced a pull request that will close this issue

2026-07-07 14:34:48 -05:00

Web UI: Gated action framework (#434) #455

jcwalker3 referenced this issue

2026-07-07 14:46:12 -05:00

Web UI: Test coverage and CI checks (#436) #457