process: replace manual lease seeding with a durable, auditable merger lease adoption/recovery flow #536

New Issue

2026-07-08T06:37:14-05:00

jcwalker3 commented

2026-07-08 06:37:14 -05:00

Problem

During the merges of PR #493 and PR #421, the merger profile (prgs-merger) had to bypass the local process-memory session lease check by manually seeding reviewer_pr_lease._SESSION_LEASE in a dedicated Python script. While Gitea API gates remained active and secure, the merge path itself is classified as noncanonical because it bypassed the process-local preflight gate.

Proposed Hardening

Replace manual lease seeding in memory with a durable, auditable, non-bypassable merger lease adoption/recovery flow. A merger session must be able to explicitly verify and adopt the lease state via an authorized MCP tool path without requiring reviewer role permissions or manual variable mutation.

## Problem During the merges of PR #493 and PR #421, the merger profile (`prgs-merger`) had to bypass the local process-memory session lease check by manually seeding `reviewer_pr_lease._SESSION_LEASE` in a dedicated Python script. While Gitea API gates remained active and secure, the merge path itself is classified as noncanonical because it bypassed the process-local preflight gate. ## Proposed Hardening Replace manual lease seeding in memory with a durable, auditable, non-bypassable merger lease adoption/recovery flow. A merger session must be able to explicitly verify and adopt the lease state via an authorized MCP tool path without requiring reviewer role permissions or manual variable mutation.

jcwalker3 commented

2026-07-08 06:38:27 -05:00

Controller Issue Audit & Taxonomy Request

Incidents Audited: Confirmed that PR #493 and PR #421 were merged successfully (accepted outcome) but via a noncanonical merge path involving manual _SESSION_LEASE seeding.
Acceptance Criteria: The solution must include automated test cases that explicitly reject ad hoc in-memory _SESSION_LEASE variable seeding as canonical proof of lease ownership, ensuring only a durable, auditable, signed lease-adoption flow is accepted.
Taxonomy Request: Requesting an authorized operator/controller to apply the following process status labels to this issue:
- type:process-hardening
- area:merger-lease
- guardrail
- priority:high
- status:ready

### Controller Issue Audit & Taxonomy Request 1. **Incidents Audited**: Confirmed that PR #493 and PR #421 were merged successfully (accepted outcome) but via a noncanonical merge path involving manual `_SESSION_LEASE` seeding. 2. **Acceptance Criteria**: The solution must include automated test cases that explicitly reject ad hoc in-memory `_SESSION_LEASE` variable seeding as canonical proof of lease ownership, ensuring only a durable, auditable, signed lease-adoption flow is accepted. 3. **Taxonomy Request**: Requesting an authorized operator/controller to apply the following process status labels to this issue: - `type:process-hardening` - `area:merger-lease` - `guardrail` - `priority:high` - `status:ready`

jcwalker3 referenced this issue from a commit

2026-07-08 10:04:04 -05:00

feat: guarded merger lease adoption flow (#536)

jcwalker3 referenced a pull request that will close this issue

2026-07-08 10:05:30 -05:00

feat: guarded merger lease adoption flow (#536) #538

sysadmin referenced this issue

2026-07-08 10:12:29 -05:00

feat: guarded merger lease adoption flow (#536) #538

sysadmin referenced this issue

2026-07-08 10:22:13 -05:00

feat: guarded merger lease adoption flow (#536) #538