Preserve and resume prepared review verdicts after MCP namespace disconnect or stale backend #609

New Issue

2026-07-09T17:14:22-05:00

jcwalker3 commented

2026-07-09 17:14:22 -05:00

Problem

Reviewer sessions can complete validation and prepare a formal verdict, but then fail to submit because the reviewer namespace disconnects or the backend daemon is stale after another PR merge/restart. The review evidence is valuable, but it is currently preserved only in chat/session output and must be manually reconstructed.

Example

PR #598 was fully reviewed with a prepared APPROVE verdict and local merge-sim validation:

merge-sim clean
git diff --check clean
relevant tests passed
test_mcp_server.py included
total 228 passed

But formal submission was blocked because:

gitea-reviewer namespace disconnected
backend daemon was stale relative to current master
mutation tools correctly failed closed

The fail-closed behavior is correct. The gap is that a fully-validated verdict is lost with no sanctioned way to persist it as non-terminal evidence for a fresh session to resume.

Required behavior

Add a sanctioned way to persist a prepared review verdict as non-terminal draft evidence.
The draft must not count as a formal review.
A fresh reviewer session may resume the draft only after re-checking:
- current PR head
- #332 terminal lock
- active leases
- runtime/master parity
- reviewer identity
- worktree binding
- validation freshness
If the PR head changed, the draft must be invalidated or require fresh validation.

Acceptance criteria

Prepared review evidence can be saved without submitting a formal review.
Saved evidence includes: PR number, head SHA, target branch SHA, worktree path, validation commands/results, intended verdict, and blocker reason.
Resume tool refuses to submit if head SHA, target branch, #332, lease, runtime, or worktree binding has changed unsafely.
Resume tool can produce a ready-to-submit verdict only after fresh live-state checks.
Tests cover: disconnected namespace, stale backend, changed PR head, foreign lease, #332 occupied, and clean resume.
No path allows a stale prepared verdict to become a formal review without live revalidation.

Labels

workflow-hardening, reviewer, stale-runtime, resumable-review, anti-stomp

## Problem Reviewer sessions can complete validation and prepare a formal verdict, but then fail to submit because the reviewer namespace disconnects or the backend daemon is stale after another PR merge/restart. The review evidence is valuable, but it is currently preserved only in chat/session output and must be manually reconstructed. ## Example PR #598 was fully reviewed with a prepared APPROVE verdict and local merge-sim validation: - merge-sim clean - `git diff --check` clean - relevant tests passed - `test_mcp_server.py` included - total `228 passed` But formal submission was blocked because: - `gitea-reviewer` namespace disconnected - backend daemon was stale relative to current master - mutation tools correctly failed closed The fail-closed behavior is correct. The gap is that a fully-validated verdict is lost with no sanctioned way to persist it as non-terminal evidence for a fresh session to resume. ## Required behavior - Add a sanctioned way to persist a prepared review verdict as **non-terminal draft evidence**. - The draft **must not** count as a formal review. - A fresh reviewer session may resume the draft **only after re-checking**: - current PR head - #332 terminal lock - active leases - runtime/master parity - reviewer identity - worktree binding - validation freshness - If the PR head changed, the draft **must be invalidated** or require fresh validation. ## Acceptance criteria 1. Prepared review evidence can be saved without submitting a formal review. 2. Saved evidence includes: PR number, head SHA, target branch SHA, worktree path, validation commands/results, intended verdict, and blocker reason. 3. Resume tool refuses to submit if head SHA, target branch, #332, lease, runtime, or worktree binding has changed unsafely. 4. Resume tool can produce a ready-to-submit verdict only after fresh live-state checks. 5. Tests cover: disconnected namespace, stale backend, changed PR head, foreign lease, #332 occupied, and clean resume. 6. No path allows a stale prepared verdict to become a formal review without live revalidation. ## Labels `workflow-hardening`, `reviewer`, `stale-runtime`, `resumable-review`, `anti-stomp`