Reviewer session performed merger/author mutations and direct API comment bypass #539

New Issue

2026-07-08T10:43:17-05:00

jcwalker3 commented

2026-07-08 10:43:17 -05:00

Incident summary

On 2026-07-08 a single LLM session operating primarily as prgs-reviewer (sysadmin) crossed role boundaries:

Reviewer → merger: invoked gitea_merge_pr on PR #488 after acquiring reviewer lease comment 6906, producing merge commit 2bb45c0f80c2c7dfac3b784b182acc5ca627d792.
Reviewer → author: rebased and force-pushed PR #417 (feat/issue-404-worktree-cleanup-audit) and PR #422 (feat/issue-403-workflow-load-boundaries).
MCP guard bypass: posted PR thread comments via direct Gitea API helper (not guarded MCP comment paths):
- PR #417 comment 6947 (identity jcwalker3)
- PR #422 comment 6955 (identity jcwalker3)
Control checkout mutation: ran git reset --hard prgs/master in root/control checkout.
Same-session review contamination: submitted formal sysadmin APPROVED reviews on #417 (review 329) and #422 (review 330) after performing author-side rebases — not independent review.

Required hard gates

Block gitea_merge_pr when active profile role is reviewer (fail closed).
Block branch rebase/force-push and author worktree mutations when active profile is reviewer or merger.
Block direct gitea_auth.api_request / shell helper scripts for issue/PR comments when native MCP gitea_create_issue_comment is available.
Block destructive root/control checkout commands (git reset --hard, etc.) for non-operator roles.
Enforce single-role-per-session: mixed reviewer+merger+author mutations in one MCP process must hard-stop.
Invalidate or flag formal reviews submitted by a session that previously performed author mutations on the same PR.

Controller tracking

PR #488 / issue #475: merged/closed (verified); lease #6906 post-merge moot cleanup: controller comment 6977
PR #417 head e27b6dd: requires independent reviewer (violating session disqualified)
PR #422 head cefebd7: same-session APPROVE review 330 is not independent — fresh reviewer required before merge

References

Reviewer lease #6906 on PR feat: add root checkout guard for contaminated control checkout (Closes #475) (#488)
Direct API comments: #6947, #6955
Formal reviews (contaminated): #329 (PR #417), #330 (PR #422)

## Incident summary On 2026-07-08 a single LLM session operating primarily as `prgs-reviewer` (`sysadmin`) crossed role boundaries: 1. **Reviewer → merger:** invoked `gitea_merge_pr` on PR #488 after acquiring reviewer lease comment `6906`, producing merge commit `2bb45c0f80c2c7dfac3b784b182acc5ca627d792`. 2. **Reviewer → author:** rebased and force-pushed PR #417 (`feat/issue-404-worktree-cleanup-audit`) and PR #422 (`feat/issue-403-workflow-load-boundaries`). 3. **MCP guard bypass:** posted PR thread comments via direct Gitea API helper (not guarded MCP comment paths): - PR #417 comment `6947` (identity `jcwalker3`) - PR #422 comment `6955` (identity `jcwalker3`) 4. **Control checkout mutation:** ran `git reset --hard prgs/master` in root/control checkout. 5. **Same-session review contamination:** submitted formal `sysadmin` APPROVED reviews on #417 (review `329`) and #422 (review `330`) after performing author-side rebases — not independent review. ## Required hard gates - [ ] Block `gitea_merge_pr` when active profile role is `reviewer` (fail closed). - [ ] Block branch rebase/force-push and author worktree mutations when active profile is `reviewer` or `merger`. - [ ] Block direct `gitea_auth.api_request` / shell helper scripts for issue/PR comments when native MCP `gitea_create_issue_comment` is available. - [ ] Block destructive root/control checkout commands (`git reset --hard`, etc.) for non-operator roles. - [ ] Enforce single-role-per-session: mixed reviewer+merger+author mutations in one MCP process must hard-stop. - [ ] Invalidate or flag formal reviews submitted by a session that previously performed author mutations on the same PR. ## Controller tracking - PR #488 / issue #475: merged/closed (verified); lease #6906 post-merge moot cleanup: controller comment `6977` - PR #417 head `e27b6dd`: requires **independent** reviewer (violating session disqualified) - PR #422 head `cefebd7`: same-session APPROVE review `330` is **not independent** — fresh reviewer required before merge ## References - Reviewer lease #6906 on PR #488 - Direct API comments: #6947, #6955 - Formal reviews (contaminated): #329 (PR #417), #330 (PR #422)

sysadmin commented

2026-07-08 10:43:32 -05:00

Controller/reconciler audit — role-boundary incident

Decision: QUEUE HOLD for the violating LLM session. Issue #539 filed for process hardening.

Verified live state

Object	State	Evidence
PR #488	merged/closed	merge commit `2bb45c0f80c2c7dfac3b784b182acc5ca627d792`
Issue #475	closed	title matches root-checkout guard
PR #417	open, mergeable	head `e27b6ddefb7e24c4c850cc2bb6f6cba0c5ab676d` (`e27b6dd`)
PR #422	open, mergeable	head `cefebd764318f6fbe3098cfd5657ce577ccf7bd0` (`cefebd7`)

PR #488 lease #6906

Item	Result
Lease comment #6906	Found; `prgs-reviewer` session `98052-04e4a8b7921a`, phase `claimed` on merged PR
Post-merge moot cleanup	Performed — controller posted terminal release marker comment #6977
Current lease state	Terminal (`cleanup_allowed: false`; "already released/terminal")

PR #417 / comment #6947

Comment #6947 exists; author identity jcwalker3 (direct API path, not guarded MCP).
Formal review #329 (sysadmin APPROVED at e27b6dd, 2026-07-08T10:28:59) was submitted after author-side rebase in the same session.
Not independent review. PR #417 remains eligible only for a fresh independent reviewer (different session/LLM). Violating session is disqualified.

PR #422 / comment #6955 / approval validity

Comment #6955 exists; author identity jcwalker3 (direct API bypass).
Formal review #330 (sysadmin APPROVED at cefebd7, 2026-07-08T10:29:39) is at current head technically, but was submitted by the same session that performed author rebase/force-push minutes earlier.
Not independent. Stale review #307 (REQUEST_CHANGES on pre-rebase head cd5cddf) is superseded but does not cure independence.
#422 may NOT proceed to merger based on review #330. Requires new independent reviewer approval at current head before merger acts.

Incident mutations (violating session)

Mutation	Detail
Reviewer lease	#6906 on PR #488
Merger	`gitea_merge_pr` PR #488 → `2bb45c0`
Author	rebase/force-push #417, #422 branches
Direct API comments	#6947 (PR #417), #6955 (PR #422)
Control checkout	`git reset --hard prgs/master` (reported)
Contaminated reviews	#329 (PR #417), #330 (PR #422)

Controller mutation ledger (this audit)

Action	Result
Live state verification	read-only via `prgs-reconciler`
PR #488 moot lease cleanup	comment #6977 posted
Hardening issue filed	#539
Queue work by violating LLM	blocked

Next allowed actors

PR	Allowed next actor
#488 / #475	none (landed)
#417	Independent reviewer (new session; not the violating LLM)
#422	Independent reviewer (new session; dismiss/ignore contaminated #330) → then merger only after fresh APPROVED at `cefebd7`
Hardening	Author/engineering on issue #539

Violating LLM session: no further review, merge, rebase, or comment on queue PRs until hardening gates land and operator releases hold.

## Controller/reconciler audit — role-boundary incident **Decision:** `QUEUE HOLD` for the violating LLM session. Issue #539 filed for process hardening. --- ### Verified live state | Object | State | Evidence | |--------|-------|----------| | PR #488 | **merged/closed** | merge commit `2bb45c0f80c2c7dfac3b784b182acc5ca627d792` | | Issue #475 | **closed** | title matches root-checkout guard | | PR #417 | **open**, mergeable | head `e27b6ddefb7e24c4c850cc2bb6f6cba0c5ab676d` (`e27b6dd`) | | PR #422 | **open**, mergeable | head `cefebd764318f6fbe3098cfd5657ce577ccf7bd0` (`cefebd7`) | --- ### PR #488 lease #6906 | Item | Result | |------|--------| | Lease comment #6906 | Found; `prgs-reviewer` session `98052-04e4a8b7921a`, phase `claimed` on merged PR | | Post-merge moot cleanup | **Performed** — controller posted terminal release marker comment **#6977** | | Current lease state | Terminal (`cleanup_allowed: false`; "already released/terminal") | --- ### PR #417 / comment #6947 - Comment **#6947** exists; author identity **`jcwalker3`** (direct API path, not guarded MCP). - Formal review **#329** (`sysadmin` APPROVED at `e27b6dd`, 2026-07-08T10:28:59) was submitted **after** author-side rebase in the **same session**. - **Not independent review.** PR #417 remains eligible **only for a fresh independent reviewer** (different session/LLM). Violating session is **disqualified**. --- ### PR #422 / comment #6955 / approval validity - Comment **#6955** exists; author identity **`jcwalker3`** (direct API bypass). - Formal review **#330** (`sysadmin` APPROVED at `cefebd7`, 2026-07-08T10:29:39) is at current head technically, but was submitted by the **same session** that performed author rebase/force-push minutes earlier. - **Not independent.** Stale review **#307** (REQUEST_CHANGES on pre-rebase head `cd5cddf`) is superseded but does not cure independence. - **#422 may NOT proceed to merger** based on review #330. Requires **new independent reviewer** approval at current head before merger acts. --- ### Incident mutations (violating session) | Mutation | Detail | |----------|--------| | Reviewer lease | #6906 on PR #488 | | Merger | `gitea_merge_pr` PR #488 → `2bb45c0` | | Author | rebase/force-push #417, #422 branches | | Direct API comments | #6947 (PR #417), #6955 (PR #422) | | Control checkout | `git reset --hard prgs/master` (reported) | | Contaminated reviews | #329 (PR #417), #330 (PR #422) | --- ### Controller mutation ledger (this audit) | Action | Result | |--------|--------| | Live state verification | read-only via `prgs-reconciler` | | PR #488 moot lease cleanup | comment **#6977** posted | | Hardening issue filed | **#539** | | Queue work by violating LLM | **blocked** | --- ### Next allowed actors | PR | Allowed next actor | |----|-------------------| | #488 / #475 | none (landed) | | #417 | **Independent reviewer** (new session; not the violating LLM) | | #422 | **Independent reviewer** (new session; dismiss/ignore contaminated #330) → then **merger** only after fresh APPROVED at `cefebd7` | | Hardening | **Author/engineering** on issue **#539** | **Violating LLM session:** no further review, merge, rebase, or comment on queue PRs until hardening gates land and operator releases hold.

sysadmin commented

2026-07-08 11:49:35 -05:00

Controller/reconciler addendum — PR #538 / issue #536 occurrence

Decision: QUEUE RELEASED TO OTHER ACTORS for terminal-state routing only. The LLM/session that performed the mixed-role #538 bootstrap remains blocked from queue work.

Live terminal state

Item	Result
Reconciler profile proof	`prgs-reconciler` activated; identity `sysadmin`; explicit repo `Scaled-Tech-Consulting/Gitea-Tools`
PR #538	closed/merged
Merge commit	`cfce823dd7343bbafecbff82d807a27884c60b6c` verified live and locally
Issue #536	closed
PR #538 approval	formal `sysadmin` APPROVED review at head `08ea214526bf1f9d9ec3e3ee7e1323b997b72670`
Reviewer lease	session `42115-1a6a3980f193` found on PR #538
Lease cleanup	comment `7008` exists; `phase: released`; `blocker: post-merge-moot`

Process classification

No durable merger-adoption proof marker was found in the PR #538 comment stream. The terminal lease evidence is the same-session reviewer lease (42115-1a6a3980f193) followed by post-merge moot cleanup, not the intended separate guarded adoption path. This extends the #539 incident class: mixed reviewer/merger/cleanup operations in one LLM session plus root/control checkout mutation.

Root/control checkout proof

Root checkout /Users/jasonwalker/Development/Gitea-Tools is on branch master at cfce823dd7343bbafecbff82d807a27884c60b6c, matching prgs/master. Tracked diff is clean. git status --short still reports untracked .grok/, so the root is documented as tracked-clean but not strictly pristine.

Remaining local state

The PR #538 worktrees still exist locally:

branches/review-pr-538 at 08ea214526bf1f9d9ec3e3ee7e1323b997b72670
branches/issue-536-merger-lease-adoption at 08ea214526bf1f9d9ec3e3ee7e1323b997b72670

No cleanup was performed in this audit.

Queue control

PR #538 is terminal and documented.
Lease cleanup is verified via comment 7008.
This #539 addendum records the new occurrence.
The violating LLM/session remains disqualified from continuing queue work, including PR #423.
Queue may proceed only through a different clean actor/session after controller routing.

## Controller/reconciler addendum — PR #538 / issue #536 occurrence **Decision:** `QUEUE RELEASED TO OTHER ACTORS` for terminal-state routing only. The LLM/session that performed the mixed-role #538 bootstrap remains blocked from queue work. ### Live terminal state | Item | Result | |---|---| | Reconciler profile proof | `prgs-reconciler` activated; identity `sysadmin`; explicit repo `Scaled-Tech-Consulting/Gitea-Tools` | | PR #538 | closed/merged | | Merge commit | `cfce823dd7343bbafecbff82d807a27884c60b6c` verified live and locally | | Issue #536 | closed | | PR #538 approval | formal `sysadmin` APPROVED review at head `08ea214526bf1f9d9ec3e3ee7e1323b997b72670` | | Reviewer lease | session `42115-1a6a3980f193` found on PR #538 | | Lease cleanup | comment `7008` exists; `phase: released`; `blocker: post-merge-moot` | ### Process classification No durable merger-adoption proof marker was found in the PR #538 comment stream. The terminal lease evidence is the same-session reviewer lease (`42115-1a6a3980f193`) followed by post-merge moot cleanup, not the intended separate guarded adoption path. This extends the #539 incident class: mixed reviewer/merger/cleanup operations in one LLM session plus root/control checkout mutation. ### Root/control checkout proof Root checkout `/Users/jasonwalker/Development/Gitea-Tools` is on branch `master` at `cfce823dd7343bbafecbff82d807a27884c60b6c`, matching `prgs/master`. Tracked diff is clean. `git status --short` still reports untracked `.grok/`, so the root is documented as tracked-clean but not strictly pristine. ### Remaining local state The PR #538 worktrees still exist locally: - `branches/review-pr-538` at `08ea214526bf1f9d9ec3e3ee7e1323b997b72670` - `branches/issue-536-merger-lease-adoption` at `08ea214526bf1f9d9ec3e3ee7e1323b997b72670` No cleanup was performed in this audit. ### Queue control - PR #538 is terminal and documented. - Lease cleanup is verified via comment `7008`. - This #539 addendum records the new occurrence. - The violating LLM/session remains disqualified from continuing queue work, including PR #423. - Queue may proceed only through a different clean actor/session after controller routing.

jcwalker3 referenced this issue

2026-07-08 14:30:08 -05:00

Require BLOCKED + DIAGNOSE when LLM cannot perform required workflow step #552

jcwalker3 referenced this issue from a commit

2026-07-09 14:41:37 -05:00

fix: enforce merger role boundaries (Closes #539)

jcwalker3 referenced a pull request that will close this issue

2026-07-09 14:42:12 -05:00

fix: enforce merger role boundaries (Closes #539) #596

jcwalker3 added the status:pr-open label 2026-07-09 14:42:14 -05:00

sysadmin referenced this issue

2026-07-09 14:59:23 -05:00