Implement emergency break-glass MCP restart workflow #664

New Issue

2026-07-10T15:32:31-05:00

jcwalker3 commented

2026-07-10 15:32:31 -05:00

Problem statement

Emergency restart must remain possible when drain cannot complete, but today emergency looks like pkill or unguarded process kill without audit, incident, or mandatory reconciliation.

Operational impact

Break-glass becomes the normal path; disrupted sessions untracked; #630 contamination.

Scope

Break-glass restart requires:

Privileged authorization (not author/reviewer/merger/reconciler LLM)
Explicit reason
Impact acknowledgment (impact report from #658)
Immutable audit entry
Automatic incident record
Identification of disrupted sessions
Mandatory post-restart reconciliation (#662)
Durable follow-up issue when graceful drain/normal recovery failed

Must not become normal operational path (rate limit / dual control as policy).

Non-goals

Removing all emergency ability.
Allowing LLM sessions break-glass.

Required implementation investigation

#655 #656 #658 #661 #662 #630; privileged profiles.

Proposed implementation direction

gitea_break_glass_restart with confirmation string + reason; creates Gitea incident issue; forces reconcile.

Security / workflow-safety

Highest privilege; dual-control optional v1; never silent.

Failure behavior

Missing reason/ack → deny; post-restart reconcile failure → additional issues.

Acceptance criteria

Ordinary roles cannot invoke break-glass.
Required fields enforced.
Incident + audit always created.
Post-restart reconcile mandatory.
Tests for deny/allow paths.
Links #652 #653 #655 #630.

Required tests

Role deny matrix; required field validation; incident creation mock.

Observability and audit

Immutable break-glass events.

Dependencies

Parent #655 · Depends #656 #658 #662 · Related #630 · Vision #652 · Roadmap #653

Rollout

Controller-only enablement flag.

Canonical issue state

STATE: ready-for-author
WHO_IS_NEXT: author
NEXT_ACTION: Implement break-glass workflow
NEXT_PROMPT: Author break-glass under #655; PR; stop

Required proof

Code + tests + sample audit/incident.

Required final response and handoff

Brief PR → reviewer/controller.

## Problem statement Emergency restart must remain possible when drain cannot complete, but today emergency looks like pkill or unguarded process kill without audit, incident, or mandatory reconciliation. ## Operational impact Break-glass becomes the normal path; disrupted sessions untracked; #630 contamination. ## Scope Break-glass restart requires: * Privileged authorization (not author/reviewer/merger/reconciler LLM) * Explicit reason * Impact acknowledgment (impact report from #658) * Immutable audit entry * Automatic incident record * Identification of disrupted sessions * Mandatory post-restart reconciliation (#662) * Durable follow-up issue when graceful drain/normal recovery failed Must not become normal operational path (rate limit / dual control as policy). ## Non-goals * Removing all emergency ability. * Allowing LLM sessions break-glass. ## Required implementation investigation #655 #656 #658 #661 #662 #630; privileged profiles. ## Proposed implementation direction `gitea_break_glass_restart` with confirmation string + reason; creates Gitea incident issue; forces reconcile. ## Security / workflow-safety Highest privilege; dual-control optional v1; never silent. ## Failure behavior Missing reason/ack → deny; post-restart reconcile failure → additional issues. ## Acceptance criteria 1. Ordinary roles cannot invoke break-glass. 2. Required fields enforced. 3. Incident + audit always created. 4. Post-restart reconcile mandatory. 5. Tests for deny/allow paths. 6. Links #652 #653 #655 #630. ## Required tests Role deny matrix; required field validation; incident creation mock. ## Observability and audit Immutable break-glass events. ## Dependencies * Parent **#655** · Depends **#656** **#658** **#662** · Related **#630** · Vision **#652** · Roadmap **#653** ## Rollout Controller-only enablement flag. ## Canonical issue state ```text STATE: ready-for-author WHO_IS_NEXT: author NEXT_ACTION: Implement break-glass workflow NEXT_PROMPT: Author break-glass under #655; PR; stop ``` ## Required proof Code + tests + sample audit/incident. ## Required final response and handoff Brief PR → reviewer/controller.