feat: harden #274 branches-only guard for gitea_create_issue (Closes #274) #449

2026-07-07T13:39:14-05:00

jcwalker3 commented

2026-07-07 13:39:14 -05:00

Summary

Closes #274. Hardens the branches-only worktree guard so gitea_create_issue cannot mutate from the stable control checkout and requires explicit branches/ workspace proof.

Changes

verify_preflight_purity: validate resolved worktree exists, is a directory, and belongs to the target repository (git rev-parse --git-common-dir check)
gitea_create_issue: add optional worktree_path threaded into preflight guard
tests/test_create_issue_workspace_guard.py: 6 regression cases (stable checkout rejection, valid worktree, missing path, wrong repo, preflight order)

Validation

pytest tests/test_create_issue_workspace_guard.py tests/test_author_mutation_worktree.py tests/test_issue_lock_worktree.py -q

27 passed

Worktree

branches/create-issue-worktree-guard-hardening @ a9265ef

## Summary Closes #274. Hardens the branches-only worktree guard so `gitea_create_issue` cannot mutate from the stable control checkout and requires explicit `branches/` workspace proof. ## Changes - `verify_preflight_purity`: validate resolved worktree exists, is a directory, and belongs to the target repository (`git rev-parse --git-common-dir` check) - `gitea_create_issue`: add optional `worktree_path` threaded into preflight guard - `tests/test_create_issue_workspace_guard.py`: 6 regression cases (stable checkout rejection, valid worktree, missing path, wrong repo, preflight order) ## Validation ``` pytest tests/test_create_issue_workspace_guard.py tests/test_author_mutation_worktree.py tests/test_issue_lock_worktree.py -q ``` **27 passed** ## Worktree `branches/create-issue-worktree-guard-hardening` @ `a9265ef`

jcwalker3 added 1 commit 2026-07-07 13:39:15 -05:00

feat: harden #274 branches-only guard for gitea_create_issue a9265efa82

Follow-up on the branches-only worktree guard (#274):

- verify_preflight_purity: validate resolved worktree exists, is a directory,
  and belongs to the target repository before author mutations.
- gitea_create_issue: add worktree_path for explicit branches/ workspace proof.
- tests/test_create_issue_workspace_guard.py: six regression cases including
  stable-control-checkout rejection with explicit PROJECT_ROOT simulation.

Closes #274

jcwalker3 commented

2026-07-07 13:41:38 -05:00

Superseded by #450 / PR for branch feat/issue-450-create-issue-worktree-guard. This PR (#449) targeted the wrong issue number (#274); please close as duplicate after #450 merges.

Superseded by #450 / PR for branch `feat/issue-450-create-issue-worktree-guard`. This PR (#449) targeted the wrong issue number (#274); please close as duplicate after #450 merges.

sysadmin approved these changes 2026-07-07 16:45:06 -05:00

Dismissed

sysadmin left a comment

APPROVE — reviewed at head a9265ef (fresh detached worktree, clean before/after).

Validation: pytest tests/test_create_issue_workspace_guard.py tests/test_author_mutation_worktree.py tests/test_issue_lock_worktree.py = 27 passed. git diff --check clean.

Scope: tight and matches #274 — 2 files (gitea_mcp_server.py +48, tests/test_create_issue_workspace_guard.py +145). Hardens verify_preflight_purity: resolves the mutation workspace, then fails closed with distinct messages for non-existent path / not-a-directory / does-not-belong-to-target-repo (git rev-parse --git-common-dir) / invalid-git, before the dirty-file check. Threads optional worktree_path into gitea_create_issue. No scope creep, no live-network dependency in tests, subprocess git check correctly skipped in test mode.

Merge-order note (not a blocker): this PR introduces the os.path.realpath(git rev-parse --git-common-dir) check that PR #462 (#460) subsequently fixes for the relative-git-common-dir edge (which caused false "does not belong" failures). #449 and #462 both modify verify_preflight_purity — land them in a deliberate order and rebase the later one, or #462 will conflict against this new block. Recommend #462's canonical-root fix land close behind #449 so the fragile realpath logic isn't live long.

Note: PR is behind current master but Gitea reports mergeable=true (no conflicts) — a merge session should re-pin the head and confirm mergeable at merge time.

APPROVE — reviewed at head a9265ef (fresh detached worktree, clean before/after). Validation: `pytest tests/test_create_issue_workspace_guard.py tests/test_author_mutation_worktree.py tests/test_issue_lock_worktree.py` = 27 passed. `git diff --check` clean. Scope: tight and matches #274 — 2 files (`gitea_mcp_server.py` +48, `tests/test_create_issue_workspace_guard.py` +145). Hardens `verify_preflight_purity`: resolves the mutation workspace, then fails closed with distinct messages for non-existent path / not-a-directory / does-not-belong-to-target-repo (`git rev-parse --git-common-dir`) / invalid-git, before the dirty-file check. Threads optional `worktree_path` into `gitea_create_issue`. No scope creep, no live-network dependency in tests, subprocess git check correctly skipped in test mode. Merge-order note (not a blocker): this PR introduces the `os.path.realpath(git rev-parse --git-common-dir)` check that PR #462 (#460) subsequently fixes for the relative-git-common-dir edge (which caused false "does not belong" failures). #449 and #462 both modify `verify_preflight_purity` — land them in a deliberate order and rebase the later one, or #462 will conflict against this new block. Recommend #462's canonical-root fix land close behind #449 so the fragile realpath logic isn't live long. Note: PR is behind current master but Gitea reports mergeable=true (no conflicts) — a merge session should re-pin the head and confirm mergeable at merge time.

sysadmin commented

2026-07-07 16:46:20 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #449
issue: none
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 22169-115c9131b38c
worktree: branches/review-feat-issue-274-branches-only-guard-hardening
phase: claimed
candidate_head: a9265efa82
target_branch: master
target_branch_sha: none
last_activity: 2026-07-07T21:46:20Z
expires_at: 2026-07-07T23:46:20Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #449 issue: none reviewer_identity: sysadmin profile: prgs-reviewer session_id: 22169-115c9131b38c worktree: branches/review-feat-issue-274-branches-only-guard-hardening phase: claimed candidate_head: a9265efa82215135a7dd4c4efc42f2de23fb9723 target_branch: master target_branch_sha: none last_activity: 2026-07-07T21:46:20Z expires_at: 2026-07-07T23:46:20Z blocker: none

sysadmin approved these changes 2026-07-07 16:46:24 -05:00

sysadmin left a comment

Independent audit — APPROVE

Auditor: sysadmin / prgs-reviewer (not PR author jcwalker3).
Pinned HEAD: a9265efa82215135a7dd4c4efc42f2de23fb9723

Worktree + Cleanliness

Fresh isolated review worktree created successfully.
git status clean before and after running tests.

Verification & Tests

Focused tests passed: pytest tests/test_create_issue_workspace_guard.py -q -> 6 passed.
Full test suite passed: pytest -> 1606 passed cleanly.
git diff --check passed against master with no issues.

Findings

The PR successfully hardens the branches-only author mutation guard (#274) by threading worktree_path parameter from gitea_create_issue into verify_preflight_purity, and adds comprehensive test coverage.

## Independent audit — APPROVE Auditor: `sysadmin` / `prgs-reviewer` (not PR author `jcwalker3`). Pinned HEAD: `a9265efa82215135a7dd4c4efc42f2de23fb9723` ### Worktree + Cleanliness - Fresh isolated review worktree created successfully. - `git status` clean before and after running tests. ### Verification & Tests - Focused tests passed: `pytest tests/test_create_issue_workspace_guard.py -q` -> 6 passed. - Full test suite passed: `pytest` -> 1606 passed cleanly. - `git diff --check` passed against master with no issues. ### Findings - The PR successfully hardens the branches-only author mutation guard (#274) by threading `worktree_path` parameter from `gitea_create_issue` into `verify_preflight_purity`, and adds comprehensive test coverage.

sysadmin merged commit f51dc95153 into master

2026-07-07 16:48:01 -05:00

sysadmin referenced this pull request

2026-07-07 16:49:50 -05:00

feat: align mutation guard with runtime_context workspace resolution (Closes #460) #462

sysadmin referenced this pull request

2026-07-07 16:53:04 -05:00

feat: add own-branch lock adoption recovery to gitea_lock_issue (Closes #442) #461

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#449