Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 75 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

[reconciler][auth] Route delete_branch capability to the reconciler role #729

New Issue
Closed
opened 2026-07-17 18:21:01 -05:00 by jcwalker3 · 0 comments
jcwalker3 commented 2026-07-17 18:21:01 -05:00
Owner
Copy Link
Copy Source

Problem

Remote post-merge branch deletion is blocked because the capability resolver classifies delete_branch as an author-role task, while gitea.branch.delete is intentionally granted only to prgs-reconciler.

Current behavior

  • prgs-reconciler has gitea.branch.delete.
  • The resolver returns required_role_kind=author for delete_branch.
  • The reconciler passes the permission check but fails the role gate.
  • The author has the role classification but intentionally lacks deletion permission.
  • No configured profile can satisfy both gates.
  • All attempts fail closed with performed=false.

Expected behavior

  • delete_branch requires role_kind=reconciler.
  • gitea.branch.delete remains denied to author, reviewer, and merger.
  • Explicit organization/repository binding remains required.
  • Protected, open, unmerged, locked, leased, dirty, ambiguous, and non-ancestor branches remain fail-closed.

Acceptance criteria

  • Map delete_branch to the reconciler role.
  • Resolve delete_branch to prgs-reconciler.
  • Add tests proving reconciler authorization.
  • Add negative tests proving author, reviewer, and merger remain denied.
  • Preserve protected and unmerged branch rejection.
  • After the fix is merged and MCP restarted, reconcile the five pending eligible remote branches through the native reconciler tool.

Pending remote branches

  • feat/pr-sync-status
  • fix/issue-685-side-effect-free-resolver
  • issue-718-fix-merger-lease
  • feat/issue-727-pr-sync-status
  • fix/issue-714-session-context-immutability

Safety

Do not grant gitea.branch.delete to prgs-author. Do not use direct API, curl, CLI, database, raw POST, or Web UI fallback.

## Problem Remote post-merge branch deletion is blocked because the capability resolver classifies delete_branch as an author-role task, while gitea.branch.delete is intentionally granted only to prgs-reconciler. ## Current behavior - prgs-reconciler has gitea.branch.delete. - The resolver returns required_role_kind=author for delete_branch. - The reconciler passes the permission check but fails the role gate. - The author has the role classification but intentionally lacks deletion permission. - No configured profile can satisfy both gates. - All attempts fail closed with performed=false. ## Expected behavior - delete_branch requires role_kind=reconciler. - gitea.branch.delete remains denied to author, reviewer, and merger. - Explicit organization/repository binding remains required. - Protected, open, unmerged, locked, leased, dirty, ambiguous, and non-ancestor branches remain fail-closed. ## Acceptance criteria - Map delete_branch to the reconciler role. - Resolve delete_branch to prgs-reconciler. - Add tests proving reconciler authorization. - Add negative tests proving author, reviewer, and merger remain denied. - Preserve protected and unmerged branch rejection. - After the fix is merged and MCP restarted, reconcile the five pending eligible remote branches through the native reconciler tool. ## Pending remote branches - feat/pr-sync-status - fix/issue-685-side-effect-free-resolver - issue-718-fix-merger-lease - feat/issue-727-pr-sync-status - fix/issue-714-session-context-immutability ## Safety Do not grant gitea.branch.delete to prgs-author. Do not use direct API, curl, CLI, database, raw POST, or Web UI fallback.
jcwalker3 added reference fix/issue-729-delete-branch-reconciler-role 2026-07-17 18:57:11 -05:00
Sign in to join this conversation.
fix/issue-729-delete-branch-reconciler-role
Branches Tags
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 sysadmin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#729