Harden formal-review runs against cross-role profile activation mid-session #690

New Issue

2026-07-12T21:36:11-05:00

jcwalker3 commented

2026-07-12 21:36:11 -05:00

Context

Spawned from the PR #688 / issue #687 formal-review recovery path (REQUEST_CHANGES at head c7a444e). Operator / reviewer workflows sometimes activate an author profile in-session (e.g. to file a follow-up issue) and then resume formal review without durable proof that reviewer identity, workflow load, lease, and capability were re-established under prgs-reviewer.

This issue does not absorb #687 product work (reconciler gitea.branch.delete / migration). It owns only formal-review session boundary hygiene after any profile switch.

Related, not owners:

#687 / PR #688 — reconciler cleanup capability (separate)
#689 — client transport-pinning to obsolete cohort head (stale-runtime class)
#685 / #686 — resolver side effects / manual role-server launches
#332 — one-terminal-review-mutation-per-run (related session gate)

Problem

Canonical PR/issue comments for the #688 review cohort show lease markers and REQUEST_CHANGES under prgs-reviewer, but do not prove a full re-preflight after any mid-run author profile activation:

no durable record that gitea_whoami + gitea_load_review_workflow + gitea_resolve_task_capability(review_pr) were re-run under prgs-reviewer after the switch
no invalidation of prior workflow / lease / capability session state on profile switch
namespace provenance does not always show both configured MCP namespace and active profile after a switch

Without fail-closed isolation, a formal verdict could be recorded under contaminated session state (wrong role stamp, stale lease, inherited capability).

Acceptance criteria

Prohibit or strictly isolate cross-role profile activation during a formal review run (e.g. reviewer → author → reviewer) unless operator-approved and fully re-preflighted.
Invalidate workflow-load proof, reviewer lease binding, final-review decision markers, and capability resolution state when the active profile changes.
Require full reviewer preflight after any profile switch before a formal verdict: gitea_whoami, gitea_load_review_workflow, gitea_resolve_task_capability(review_pr), live head re-pin, lease re-acquire/adopt as applicable.
Namespace provenance in whoami / runtime diagnostics must report both the configured client-managed namespace and the active execution profile, and fail closed if they disagree for the requested task.
Tests cover: mid-run profile switch without re-preflight blocks submit_pr_review / mark_final_review_decision; clean re-preflight after switch allows review; author-side issue create in a separate session does not contaminate an open review run.
Docs: supported pattern is separate session/namespace for author filing vs formal review — not in-process profile hopping.

Explicit non-goals

Do not reimplement #687 branch-delete / migration work here.
Do not require manual process kill for recovery (#630).
Do not weaken #332 terminal-review mutation accounting.

Handoff

WHO_IS_NEXT: author
STATE: ready-for-author

## Context Spawned from the PR **#688** / issue **#687** formal-review recovery path (REQUEST_CHANGES at head `c7a444e`). Operator / reviewer workflows sometimes activate an author profile in-session (e.g. to file a follow-up issue) and then resume formal review without durable proof that reviewer identity, workflow load, lease, and capability were re-established under `prgs-reviewer`. **This issue does not absorb #687 product work** (reconciler `gitea.branch.delete` / migration). It owns only formal-review session boundary hygiene after any profile switch. Related, not owners: * **#687** / **PR #688** — reconciler cleanup capability (separate) * **#689** — client transport-pinning to obsolete cohort head (stale-runtime class) * **#685** / **#686** — resolver side effects / manual role-server launches * **#332** — one-terminal-review-mutation-per-run (related session gate) ## Problem Canonical PR/issue comments for the #688 review cohort show lease markers and REQUEST_CHANGES under `prgs-reviewer`, but **do not prove** a full re-preflight after any mid-run author profile activation: * no durable record that `gitea_whoami` + `gitea_load_review_workflow` + `gitea_resolve_task_capability(review_pr)` were re-run under `prgs-reviewer` after the switch * no invalidation of prior workflow / lease / capability session state on profile switch * namespace provenance does not always show **both** configured MCP namespace and active profile after a switch Without fail-closed isolation, a formal verdict could be recorded under contaminated session state (wrong role stamp, stale lease, inherited capability). ## Acceptance criteria 1. **Prohibit or strictly isolate** cross-role profile activation during a formal review run (e.g. reviewer → author → reviewer) unless operator-approved and fully re-preflighted. 2. **Invalidate** workflow-load proof, reviewer lease binding, final-review decision markers, and capability resolution state when the active profile changes. 3. **Require full reviewer preflight** after any profile switch before a formal verdict: `gitea_whoami`, `gitea_load_review_workflow`, `gitea_resolve_task_capability(review_pr)`, live head re-pin, lease re-acquire/adopt as applicable. 4. **Namespace provenance** in whoami / runtime diagnostics must report both the configured client-managed namespace and the active execution profile, and fail closed if they disagree for the requested task. 5. Tests cover: mid-run profile switch without re-preflight blocks `submit_pr_review` / `mark_final_review_decision`; clean re-preflight after switch allows review; author-side issue create in a **separate** session does not contaminate an open review run. 6. Docs: supported pattern is separate session/namespace for author filing vs formal review — not in-process profile hopping. ## Explicit non-goals * Do not reimplement #687 branch-delete / migration work here. * Do not require manual process kill for recovery (#630). * Do not weaken #332 terminal-review mutation accounting. ## Handoff **WHO_IS_NEXT:** author **STATE:** ready-for-author