Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 73 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

Completed reviewer lease pinned to superseded PR head stays active with no canonical non-owner cleanup path #691

New Issue
Closed
opened 2026-07-12 21:54:33 -05:00 by jcwalker3 · 5 comments
jcwalker3 commented 2026-07-12 21:54:33 -05:00
Owner
Copy Link
Copy Source

A completed reviewer lease pinned to an obsolete PR head remains active after a formal REQUEST_CHANGES verdict and an author push, preventing review of the replacement head, with no canonical non-owner cleanup path.

Observed incident (PR #688 / issue #687)

  • PR #688 (Closes #687), base master, remains in open state.
  • Formal REQUEST_CHANGES verdict recorded via the review API by sysadmin at head c7a444eb4b41cf916fdbd20a4999ffd78af496d0 (2026-07-12T21:24:01-05:00). That review is complete and finalized; the prior owning review session 60615-d92824cff1bd posted its terminal phase: released lease marker (PR comment 10747).
  • A new reviewer lease was then claimed as PR comment 10749: session 25883-7d4c6e6ebd53, profile prgs-reviewer, phase: claimed, candidate_head: c7a444eb…, worktree branches/review-pr688-feat-issue-687-reconciler-branch-delete, expires_at: 2026-07-13T04:23:00Z.
  • The author subsequently pushed replacement head 4a6357800364718a27a36ebc73578d4b929ff4aa (2026-07-12T21:36-05:00). gitea_get_pr_review_feedback reports review_feedback_stale: true and author_pushed_after_request_changes: true.
  • The lease stays phase=claimed, freshness active, pinned to the superseded head. Its worktree is clean at c7a444e and was never advanced to the new head. No lease phase progress since claim time.
  • Controller diagnostics: an earlier controller run classified this handoff as instructed_lease_missing_with_replacement with prescribed action wait; a live re-run of gitea_diagnose_reviewer_pr_lease_handoff (2026-07-13T02:52Z, instructed_session_id=25883-7d4c6e6ebd53, instructed_comment_id=10749) classifies foreign_active with next_action: wait. Both terminate in indefinite wait.

Non-owner recovery inventory (all inapplicable)

  • gitea_release_reviewer_pr_lease — owner-session only; current controller session is not the owner.
  • gitea_cleanup_post_merge_moot_lease — requires the PR to have landed on master or be in closed state; PR #688 remains open.
  • gitea_expire_workflow_leases / gitea_reclaim_expired_workflow_lease / gitea_abandon_workflow_lease — operate on control-plane DB leases only. Comment lease 10749 has no lease_id in the DB (gitea_list_workflow_leases shows no entry for PR #688). Foreign abandon proof is unsatisfiable by design here: owner PID 25883 is alive (an mcp_server.py process — PID equality was NOT treated as ownership), the lease worktree exists, the PR is open, and no operator authorization was given.

The current controller session performed no lease mutation, no takeover, no adoption, no repoint of the lease or its worktree, and had no authorized release path. Prescribed and followed action: wait for expires_at.

Defect

A lease whose formal review verdict is already recorded and whose pinned head is superseded is provably obsolete, yet the diagnostic prescribes only indefinite wait and no guarded non-owner cleanup path exists for an open PR.

Acceptance criteria

  1. A lease becomes cleanup-eligible after its pinned head is superseded and its formal review is complete.
  2. A new reviewer cannot reuse or inherit validation from that lease.
  3. A controller or guarded cleanup tool can release the obsolete lease without impersonating its owner.
  4. Cleanup proves all of: a formal verdict exists for the leased head; the current PR head differs; no active review submission is in progress; the old worktree is clean or preserved safely.
  5. The cleanup produces a canonical audit comment.
  6. An active review on the current head remains protected from takeover.
  7. PID reuse cannot establish lease ownership.
  8. Tests cover: completed REQUEST_CHANGES followed by author push; completed APPROVE followed by head change; genuinely active foreign review; crashed owner process; expired lease; superseded-head cleanup followed by a fresh lease.
  9. The diagnostic returns an exact cleanup path rather than only indefinite wait when the lease is provably obsolete.

Related

  • #601 — first-class control-plane leases (comment-only reviewer leases are not represented in the DB substrate, so expire/reclaim/abandon cannot reach them)
  • #599 — reviewer lease handoff diagnosis (returns only wait for this case)
  • #407 — reviewer PR lease assessment; #515 — post-landing moot-lease cleanup (terminal-review analogue exists only for landed/closed PRs, not superseded heads on open PRs)
  • #620 — head-scoped review locks; #690 — formal-review session isolation; #628 — canonical handoff enforcement
  • Incident thread: PR #688 comments 10731–10767; issue #687 comments 10751/10771
A completed reviewer lease pinned to an obsolete PR head remains active after a formal REQUEST_CHANGES verdict and an author push, preventing review of the replacement head, with no canonical non-owner cleanup path. ## Observed incident (PR #688 / issue #687) - PR #688 (Closes #687), base `master`, remains in open state. - Formal REQUEST_CHANGES verdict recorded via the review API by `sysadmin` at head `c7a444eb4b41cf916fdbd20a4999ffd78af496d0` (2026-07-12T21:24:01-05:00). That review is complete and finalized; the prior owning review session `60615-d92824cff1bd` posted its terminal `phase: released` lease marker (PR comment 10747). - A new reviewer lease was then claimed as PR comment **10749**: session `25883-7d4c6e6ebd53`, profile `prgs-reviewer`, `phase: claimed`, `candidate_head: c7a444eb…`, worktree `branches/review-pr688-feat-issue-687-reconciler-branch-delete`, `expires_at: 2026-07-13T04:23:00Z`. - The author subsequently pushed replacement head `4a6357800364718a27a36ebc73578d4b929ff4aa` (2026-07-12T21:36-05:00). `gitea_get_pr_review_feedback` reports `review_feedback_stale: true` and `author_pushed_after_request_changes: true`. - The lease stays `phase=claimed`, freshness `active`, pinned to the superseded head. Its worktree is clean at `c7a444e` and was never advanced to the new head. No lease phase progress since claim time. - Controller diagnostics: an earlier controller run classified this handoff as `instructed_lease_missing_with_replacement` with prescribed action `wait`; a live re-run of `gitea_diagnose_reviewer_pr_lease_handoff` (2026-07-13T02:52Z, instructed_session_id=`25883-7d4c6e6ebd53`, instructed_comment_id=10749) classifies `foreign_active` with `next_action: wait`. Both terminate in indefinite `wait`. ## Non-owner recovery inventory (all inapplicable) - `gitea_release_reviewer_pr_lease` — owner-session only; current controller session is not the owner. - `gitea_cleanup_post_merge_moot_lease` — requires the PR to have landed on master or be in closed state; PR #688 remains open. - `gitea_expire_workflow_leases` / `gitea_reclaim_expired_workflow_lease` / `gitea_abandon_workflow_lease` — operate on control-plane DB leases only. Comment lease 10749 has no `lease_id` in the DB (`gitea_list_workflow_leases` shows no entry for PR #688). Foreign abandon proof is unsatisfiable by design here: owner PID 25883 is alive (an `mcp_server.py` process — PID equality was NOT treated as ownership), the lease worktree exists, the PR is open, and no operator authorization was given. The current controller session performed **no lease mutation, no takeover, no adoption, no repoint** of the lease or its worktree, and had no authorized release path. Prescribed and followed action: `wait` for `expires_at`. ## Defect A lease whose formal review verdict is already recorded and whose pinned head is superseded is provably obsolete, yet the diagnostic prescribes only indefinite `wait` and no guarded non-owner cleanup path exists for an open PR. ## Acceptance criteria 1. A lease becomes cleanup-eligible after its pinned head is superseded and its formal review is complete. 2. A new reviewer cannot reuse or inherit validation from that lease. 3. A controller or guarded cleanup tool can release the obsolete lease without impersonating its owner. 4. Cleanup proves all of: a formal verdict exists for the leased head; the current PR head differs; no active review submission is in progress; the old worktree is clean or preserved safely. 5. The cleanup produces a canonical audit comment. 6. An active review on the current head remains protected from takeover. 7. PID reuse cannot establish lease ownership. 8. Tests cover: completed REQUEST_CHANGES followed by author push; completed APPROVE followed by head change; genuinely active foreign review; crashed owner process; expired lease; superseded-head cleanup followed by a fresh lease. 9. The diagnostic returns an exact cleanup path rather than only indefinite `wait` when the lease is provably obsolete. ## Related - #601 — first-class control-plane leases (comment-only reviewer leases are not represented in the DB substrate, so expire/reclaim/abandon cannot reach them) - #599 — reviewer lease handoff diagnosis (returns only `wait` for this case) - #407 — reviewer PR lease assessment; #515 — post-landing moot-lease cleanup (terminal-review analogue exists only for landed/closed PRs, not superseded heads on open PRs) - #620 — head-scoped review locks; #690 — formal-review session isolation; #628 — canonical handoff enforcement - Incident thread: PR #688 comments 10731–10767; issue #687 comments 10751/10771
jcwalker3 added the status:readyworkflow-hardeninganti-stompqueuetype:bug labels 2026-07-12 21:54:33 -05:00
sysadmin commented 2026-07-12 22:03:07 -05:00
Owner
Copy Link
Copy Source

Canonical Issue State

STATE:
blocked — superseded-head reviewer lease remains active after recorded expiry

CANONICAL_ITEM:
Issue #691 tracking the missing guarded cleanup path for obsolete reviewer lease comment 10749 on PR #688.

SUPERSEDED_ITEM:
PR #688 reviewer lease comment 10749, session 25883-7d4c6e6ebd53, pinned to obsolete head c7a444eb4b with recorded expires_at 2026-07-13T04:23:00Z.

WHO_IS_NEXT:
controller

NEXT_ACTION:
Implement or authorize a guarded cleanup path for expired/superseded reviewer comment leases, or have the exact owner session release lease 10749; then restart PR #688 review from scratch.

NEXT_PROMPT:

Address issue #691: lease comment 10749 for PR #688 is still classified as foreign active/stale_warning after expires_at 2026-07-13T04:23:00Z. Provide the canonical guarded cleanup or owner release, verify no active current-head review is displaced, then rerun the complete PR #688 reviewer workflow from scratch.

WHAT_HAPPENED:
A fresh prgs-reviewer session rechecked PR #688 after the recorded expiry. gitea_assess_reviewer_pr_lease still returned lease comment 10749 as active with freshness stale_warning, session 25883-7d4c6e6ebd53, pinned to obsolete head c7a444eb4b. gitea_diagnose_reviewer_pr_lease_handoff again returned classification instructed_lease_missing_with_replacement, next_action wait, mutation_allowed false, and forbade stealing, repointing, manual deletion, mtime manipulation, or direct session seeding.

WHY:
The comment lease remains authoritative after its recorded expiry, so a new lease for current PR head 4a63578003 cannot be acquired through the supported workflow.

RELATED_PRS:

BLOCKERS:
Lease 10749 remains foreign-active/stale_warning after expires_at; no supported non-owner cleanup path is available.

VALIDATION:
Read-only preflight only. Identity sysadmin / prgs-reviewer, workflow boundary clean, runtime/master parity in parity, PR #688 open and mergeable at expected current head. No new worktree, tests, lease mutation, review decision, or merge occurred.

LAST_UPDATED_BY:
sysadmin / prgs-reviewer / REVIEWER / 2026-07-12

## Canonical Issue State STATE: blocked — superseded-head reviewer lease remains active after recorded expiry CANONICAL_ITEM: Issue #691 tracking the missing guarded cleanup path for obsolete reviewer lease comment 10749 on PR #688. SUPERSEDED_ITEM: PR #688 reviewer lease comment 10749, session 25883-7d4c6e6ebd53, pinned to obsolete head c7a444eb4b41cf916fdbd20a4999ffd78af496d0 with recorded expires_at 2026-07-13T04:23:00Z. WHO_IS_NEXT: controller NEXT_ACTION: Implement or authorize a guarded cleanup path for expired/superseded reviewer comment leases, or have the exact owner session release lease 10749; then restart PR #688 review from scratch. NEXT_PROMPT: ```text Address issue #691: lease comment 10749 for PR #688 is still classified as foreign active/stale_warning after expires_at 2026-07-13T04:23:00Z. Provide the canonical guarded cleanup or owner release, verify no active current-head review is displaced, then rerun the complete PR #688 reviewer workflow from scratch. ``` WHAT_HAPPENED: A fresh prgs-reviewer session rechecked PR #688 after the recorded expiry. gitea_assess_reviewer_pr_lease still returned lease comment 10749 as active with freshness stale_warning, session 25883-7d4c6e6ebd53, pinned to obsolete head c7a444eb4b41cf916fdbd20a4999ffd78af496d0. gitea_diagnose_reviewer_pr_lease_handoff again returned classification instructed_lease_missing_with_replacement, next_action wait, mutation_allowed false, and forbade stealing, repointing, manual deletion, mtime manipulation, or direct session seeding. WHY: The comment lease remains authoritative after its recorded expiry, so a new lease for current PR head 4a6357800364718a27a36ebc73578d4b929ff4aa cannot be acquired through the supported workflow. RELATED_PRS: - #688 at current head 4a6357800364718a27a36ebc73578d4b929ff4aa BLOCKERS: Lease 10749 remains foreign-active/stale_warning after expires_at; no supported non-owner cleanup path is available. VALIDATION: Read-only preflight only. Identity sysadmin / prgs-reviewer, workflow boundary clean, runtime/master parity in parity, PR #688 open and mergeable at expected current head. No new worktree, tests, lease mutation, review decision, or merge occurred. LAST_UPDATED_BY: sysadmin / prgs-reviewer / REVIEWER / 2026-07-12
jcwalker3 added status:in-progress and removed status:ready labels 2026-07-12 22:10:03 -05:00
jcwalker3 commented 2026-07-12 22:10:04 -05:00
Author
Owner
Copy Link
Copy Source

Issue claim heartbeat

<!-- gitea-issue-claim-heartbeat:v1 --> **Issue claim heartbeat** - kind: claim - issue: #691 - branch: fix/issue-691-obsolete-reviewer-lease-cleanup - phase: claimed - profile: prgs-author - pr: none - blocker: none - next_action: create worktree and begin implementation
jcwalker3 added status:pr-open and removed status:in-progress labels 2026-07-12 22:10:56 -05:00
jcwalker3 commented 2026-07-12 22:11:09 -05:00
Author
Owner
Copy Link
Copy Source

Canonical Issue State

STATE: author-complete — PR open; waiting independent review

WHO_IS_NEXT: reviewer

NEXT_ACTION: Independent REVIEWER validates PR #692 against #691 ACs; do not self-review or merge; do not manually clean lease 10749 in this product PR

NEXT_PROMPT:

Role: REVIEWER (must differ from PR author jcwalker3 / prgs-author)
Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools
PR: #692  |  Issue: #691 (Closes #691)
Base: master
Head: fix/issue-691-obsolete-reviewer-lease-cleanup @ 6d86db793bbdfaed16bd54d93171f1dd66f234ca

1. gitea_whoami + gitea_load_review_workflow + gitea_resolve_task_capability(review_pr) on prgs-reviewer.
2. Inventory PR #692; pin expected_head_sha=6d86db7…
3. Review worktree under branches/; never mutate control root.
4. Verify guarded cleanup for obsolete comment-backed reviewer leases:
   - eligibility matrix (expiry and/or superseded head + terminal review)
   - active current-head foreign lease remains protected
   - no PID ownership, no repoint, no validation transfer, no comment deletion
   - diagnose classifications + cleanup tool/confirmation fields
   - PR #688 / comment 10749 regression after expires_at 2026-07-13T04:23:00Z
5. Run focused #691 tests + lease/review/workflow suites + full suite.
6. Post independent APPROVE or REQUEST_CHANGES. Do not merge. Do not clean 10749 unless using the new tool under operator authorization after merge.

WHAT_HAPPENED:
AUTHOR claimed #691, locked branch fix/issue-691-obsolete-reviewer-lease-cleanup, implemented only #691 in branches/issue-691-obsolete-lease-cleanup, opened PR #692 (Closes #691).

Implementation design

  • reviewer_pr_lease.assess_obsolete_reviewer_comment_lease_cleanup — pure eligibility assessor
  • reviewer_pr_lease.diagnose_reviewer_pr_lease_handoff — extended classifications + cleanup next_action
  • gitea_cleanup_obsolete_reviewer_comment_lease — MCP tool (read-first; apply with confirmation + controller_recovery_authorized)
  • Append-only phase: released marker + durable audit comment; comment-backed (no DB lease_id)

Cleanup eligibility matrix

Classification Cleanup Next action
foreign_active_current_head deny wait
foreign_expired_current_head conditional orphan path cleanup tool when safe
foreign_completed_superseded_head allow if evidence holds cleanup_obsolete_reviewer_comment_lease
foreign_expired_superseded_head allow if evidence holds cleanup_obsolete_reviewer_comment_lease
orphaned_owner_missing allow if clean worktree + process absent cleanup tool
ambiguous_conflicting_evidence deny wait / fail closed

Exact audit behavior

On successful apply: posts terminal lease body (blocker: obsolete-superseded-or-expired-lease) preserving old candidate_head; posts canonical audit comment with PR, lease_comment_id, session, heads, expiry, classification, tool name; does not seed _SESSION_LEASE; does not delete prior lease comments.

Test results

  • tests/test_issue_691_obsolete_reviewer_lease_cleanup.py: passed (incl. 10749 regression)
  • Lease suites: passed
  • Full suite after immutable commit 6d86db7: 2636 passed, 6 skipped

Remaining risks

  • Owner process liveness is operator-supplied (owner_process_alive); MCP leaves it unset unless provided — fail-closed for current-head expired orphan path without explicit evidence
  • Heartbeats still extend expires_at on owner heartbeats (pre-existing); cleanup path does not depend solely on expiry for completed superseded heads
  • Live cleanup of 10749 is out of scope for this author PR; requires post-merge operator use of the new tool

WHY: #691 ACs require a precise guarded cleanup instead of indefinite wait when a lease is provably obsolete after terminal review + head move.

RELATED_PRS: PR #692 (this); incident PR #688 / lease 10749 / session 25883-7d4c6e6ebd53 (reproduction only — not modified)

BLOCKERS: none for independent review

VALIDATION:

  • Head 6d86db793b
  • Full suite 2636 passed / 6 skipped post-commit
  • Control root on master; author worktree clean on feature branch

LAST_UPDATED_BY: jcwalker3 / prgs-author / AUTHOR / 2026-07-13

## Canonical Issue State STATE: author-complete — PR open; waiting independent review WHO_IS_NEXT: reviewer NEXT_ACTION: Independent REVIEWER validates PR #692 against #691 ACs; do not self-review or merge; do not manually clean lease 10749 in this product PR NEXT_PROMPT: ```text Role: REVIEWER (must differ from PR author jcwalker3 / prgs-author) Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools PR: #692 | Issue: #691 (Closes #691) Base: master Head: fix/issue-691-obsolete-reviewer-lease-cleanup @ 6d86db793bbdfaed16bd54d93171f1dd66f234ca 1. gitea_whoami + gitea_load_review_workflow + gitea_resolve_task_capability(review_pr) on prgs-reviewer. 2. Inventory PR #692; pin expected_head_sha=6d86db7… 3. Review worktree under branches/; never mutate control root. 4. Verify guarded cleanup for obsolete comment-backed reviewer leases: - eligibility matrix (expiry and/or superseded head + terminal review) - active current-head foreign lease remains protected - no PID ownership, no repoint, no validation transfer, no comment deletion - diagnose classifications + cleanup tool/confirmation fields - PR #688 / comment 10749 regression after expires_at 2026-07-13T04:23:00Z 5. Run focused #691 tests + lease/review/workflow suites + full suite. 6. Post independent APPROVE or REQUEST_CHANGES. Do not merge. Do not clean 10749 unless using the new tool under operator authorization after merge. ``` WHAT_HAPPENED: AUTHOR claimed #691, locked branch fix/issue-691-obsolete-reviewer-lease-cleanup, implemented only #691 in branches/issue-691-obsolete-lease-cleanup, opened PR #692 (Closes #691). ### Implementation design - `reviewer_pr_lease.assess_obsolete_reviewer_comment_lease_cleanup` — pure eligibility assessor - `reviewer_pr_lease.diagnose_reviewer_pr_lease_handoff` — extended classifications + cleanup next_action - `gitea_cleanup_obsolete_reviewer_comment_lease` — MCP tool (read-first; apply with confirmation + controller_recovery_authorized) - Append-only `phase: released` marker + durable audit comment; comment-backed (no DB lease_id) ### Cleanup eligibility matrix | Classification | Cleanup | Next action | |----------------|---------|-------------| | foreign_active_current_head | deny | wait | | foreign_expired_current_head | conditional orphan path | cleanup tool when safe | | foreign_completed_superseded_head | allow if evidence holds | cleanup_obsolete_reviewer_comment_lease | | foreign_expired_superseded_head | allow if evidence holds | cleanup_obsolete_reviewer_comment_lease | | orphaned_owner_missing | allow if clean worktree + process absent | cleanup tool | | ambiguous_conflicting_evidence | deny | wait / fail closed | ### Exact audit behavior On successful apply: posts terminal lease body (blocker: obsolete-superseded-or-expired-lease) preserving old candidate_head; posts canonical audit comment with PR, lease_comment_id, session, heads, expiry, classification, tool name; does not seed _SESSION_LEASE; does not delete prior lease comments. ### Test results - tests/test_issue_691_obsolete_reviewer_lease_cleanup.py: passed (incl. 10749 regression) - Lease suites: passed - Full suite after immutable commit 6d86db7: **2636 passed, 6 skipped** ### Remaining risks - Owner process liveness is operator-supplied (`owner_process_alive`); MCP leaves it unset unless provided — fail-closed for current-head expired orphan path without explicit evidence - Heartbeats still extend expires_at on owner heartbeats (pre-existing); cleanup path does not depend solely on expiry for completed superseded heads - Live cleanup of 10749 is **out of scope** for this author PR; requires post-merge operator use of the new tool WHY: #691 ACs require a precise guarded cleanup instead of indefinite wait when a lease is provably obsolete after terminal review + head move. RELATED_PRS: PR #692 (this); incident PR #688 / lease 10749 / session 25883-7d4c6e6ebd53 (reproduction only — not modified) BLOCKERS: none for independent review VALIDATION: - Head 6d86db793bbdfaed16bd54d93171f1dd66f234ca - Full suite 2636 passed / 6 skipped post-commit - Control root on master; author worktree clean on feature branch LAST_UPDATED_BY: jcwalker3 / prgs-author / AUTHOR / 2026-07-13
sysadmin commented 2026-07-12 22:22:52 -05:00
Owner
Copy Link
Copy Source

Canonical Issue State

STATE: approved
WHO_IS_NEXT: merger
NEXT_ACTION: Merger executes the merge sequence for PR #692.
NEXT_PROMPT:

Role: MERGER (must differ from PR author jcwalker3 / prgs-author)
Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools
PR: #692  |  Issue: #691
Base: master
Head: fix/issue-691-obsolete-reviewer-lease-cleanup @ 6d86db793bbdfaed16bd54d93171f1dd66f234ca

1. gitea_whoami + gitea_resolve_task_capability(merge_pr) on prgs-merger.
2. Confirm PR #692 is approved at head 6d86db7…
3. Submit merge confirmation: 'MERGE PR 692'.

WHY: PR #692 successfully verified and approved. Obsolete lease cleanup functionality fully validated and tested.
BLOCKERS: none
VALIDATION: 2636 passed, 6 skipped on commit 6d86db7.
RELATED_PRS: #692
LAST_UPDATED_BY: reviewer

## Canonical Issue State STATE: approved WHO_IS_NEXT: merger NEXT_ACTION: Merger executes the merge sequence for PR #692. NEXT_PROMPT: ```text Role: MERGER (must differ from PR author jcwalker3 / prgs-author) Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools PR: #692 | Issue: #691 Base: master Head: fix/issue-691-obsolete-reviewer-lease-cleanup @ 6d86db793bbdfaed16bd54d93171f1dd66f234ca 1. gitea_whoami + gitea_resolve_task_capability(merge_pr) on prgs-merger. 2. Confirm PR #692 is approved at head 6d86db7… 3. Submit merge confirmation: 'MERGE PR 692'. ``` WHY: PR #692 successfully verified and approved. Obsolete lease cleanup functionality fully validated and tested. BLOCKERS: none VALIDATION: 2636 passed, 6 skipped on commit 6d86db7. RELATED_PRS: #692 LAST_UPDATED_BY: reviewer
jcwalker3 commented 2026-07-12 23:37:08 -05:00
Author
Owner
Copy Link
Copy Source

Canonical Issue State

STATE:
closed by PR #692 merge — lease-side product fix done; related decision-lock recovery defect tracked on #693

WHO_IS_NEXT:
author

NEXT_ACTION:
Implement decision-lock recovery on issue #693 (orthogonal to this closed issue’s lease cleanup)

NEXT_PROMPT:

Role: AUTHOR
Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools
Issue: #693
See #693 durable reconstruction comment (comment 10842) for the PR #692 formal-review sequence, sanitized lock ledger, ACs 1–8, and implementation prompt.

WHAT_HAPPENED:
While reviewing the PR that closed this issue (#692 @ 6d86db7…), formal decision marking required non-canonical recovery (stale review-decision lock + cleanup refuse + operator correction authorization) before APPROVE (review_id 426). Product work for #691 is merged (2376567…). Durable follow-up is #693 so the recovery failure remains traceable.

WHY:
#691 closed on product acceptance must not erase the concurrent decision-lock recovery failure observed during independent review.

RELATED_PRS:
#692, #693, #688

BLOCKERS:
none for this closed issue; #693 is the open handoff

VALIDATION:

  • #691 closed via PR #692 merge
  • #693 open with reconstruction comment 10842
  • Cross-link also on PR #692 (comment 10848)

LAST_UPDATED_BY:
traceability cross-link / 2026-07-13

## Canonical Issue State STATE: closed by PR #692 merge — lease-side product fix done; related decision-lock recovery defect tracked on #693 WHO_IS_NEXT: author NEXT_ACTION: Implement decision-lock recovery on issue #693 (orthogonal to this closed issue’s lease cleanup) NEXT_PROMPT: ```text Role: AUTHOR Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools Issue: #693 See #693 durable reconstruction comment (comment 10842) for the PR #692 formal-review sequence, sanitized lock ledger, ACs 1–8, and implementation prompt. ``` WHAT_HAPPENED: While reviewing the PR that closed this issue (#692 @ `6d86db7…`), formal decision marking required non-canonical recovery (stale review-decision lock + cleanup refuse + operator correction authorization) before APPROVE (review_id 426). Product work for #691 is merged (`2376567…`). Durable follow-up is **#693** so the recovery failure remains traceable. WHY: #691 closed on product acceptance must not erase the concurrent decision-lock recovery failure observed during independent review. RELATED_PRS: #692, #693, #688 BLOCKERS: none for this closed issue; #693 is the open handoff VALIDATION: - #691 closed via PR #692 merge - #693 open with reconstruction comment 10842 - Cross-link also on PR #692 (comment 10848) LAST_UPDATED_BY: traceability cross-link / 2026-07-13
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
No labels anti-stomp queue status:pr-open type:bug workflow-hardening
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 sysadmin
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#691