fix(auth): route delete_branch capability to the reconciler role (Closes #729) #730

2026-07-17T18:58:59-05:00

jcwalker3 commented

2026-07-17 18:58:59 -05:00

Closes #729

Summary

Remote post-merge branch deletion was blocked because the capability resolver classified delete_branch as an author-role task while gitea.branch.delete is intentionally granted only to prgs-reconciler.

No configured profile could satisfy both the permission and role gates, so every deletion failed closed with performed=false.

Changes

Routes delete_branch from author to reconciler in both role maps:
- task_capability_map.TASK_CAPABILITY_MAP["delete_branch"].role
- role_session_router task-role collections
Makes resolve_task_capability("delete_branch") resolve to prgs-reconciler.
Removes the obsolete reconciler-to-cleanup redirect.
Keeps gitea_cleanup_merged_pr_branch as a separate reconciler-owned workflow with independent merge, ancestry, and ownership verification.
Keeps author, reviewer, and merger profiles denied.
Preserves operator approval, safe_to_delete, protected-branch, repository-binding, and preservation gates.

Tests

Added or updated coverage proving:

Reconciler resolves and performs an eligible deletion.
Author, reviewer, and merger remain denied, even when nearby permissions exist.
Protected and preserved branches remain fail-closed.
Both role maps remain synchronized.
Tests encoding the superseded author-delete and #687 redirect behavior now reflect the reconciler-owned contract.

Full-suite result:

3,190 passed
6 skipped
1 pre-existing unrelated failure in the Issue #702 create_pr stale-binding test

The unrelated failure reproduces on pristine master.

Operator bootstrap note

This PR was opened manually because native gitea_create_pr repeatedly returned a non-retryable internal_error after the author, repository, worktree, capability, test, commit, and push gates passed. No LLM direct API or CLI fallback was used.

Checklist

Author identity and repository binding verified.
No secrets, tokens, keychain IDs, or raw service URLs committed.
Tests covering the changed behavior pass.
git diff --check confirmed clean.
Documentation/wiki impact evaluated.

Closes #729 ## Summary Remote post-merge branch deletion was blocked because the capability resolver classified `delete_branch` as an author-role task while `gitea.branch.delete` is intentionally granted only to `prgs-reconciler`. No configured profile could satisfy both the permission and role gates, so every deletion failed closed with `performed=false`. ## Changes * Routes `delete_branch` from author to reconciler in both role maps: * `task_capability_map.TASK_CAPABILITY_MAP["delete_branch"].role` * `role_session_router` task-role collections * Makes `resolve_task_capability("delete_branch")` resolve to `prgs-reconciler`. * Removes the obsolete reconciler-to-cleanup redirect. * Keeps `gitea_cleanup_merged_pr_branch` as a separate reconciler-owned workflow with independent merge, ancestry, and ownership verification. * Keeps author, reviewer, and merger profiles denied. * Preserves operator approval, `safe_to_delete`, protected-branch, repository-binding, and preservation gates. ## Tests Added or updated coverage proving: * Reconciler resolves and performs an eligible deletion. * Author, reviewer, and merger remain denied, even when nearby permissions exist. * Protected and preserved branches remain fail-closed. * Both role maps remain synchronized. * Tests encoding the superseded author-delete and #687 redirect behavior now reflect the reconciler-owned contract. Full-suite result: * 3,190 passed * 6 skipped * 1 pre-existing unrelated failure in the Issue #702 `create_pr` stale-binding test The unrelated failure reproduces on pristine master. ## Operator bootstrap note This PR was opened manually because native `gitea_create_pr` repeatedly returned a non-retryable `internal_error` after the author, repository, worktree, capability, test, commit, and push gates passed. No LLM direct API or CLI fallback was used. ## Checklist * [x] Author identity and repository binding verified. * [x] No secrets, tokens, keychain IDs, or raw service URLs committed. * [x] Tests covering the changed behavior pass. * [ ] `git diff --check` confirmed clean. * [ ] Documentation/wiki impact evaluated.

jcwalker3 added 1 commit 2026-07-17 18:58:59 -05:00

fix(auth): route delete_branch capability to the reconciler role (Closes #729 ) 7eb4884658

Remote post-merge branch deletion was blocked because the capability
resolver classified delete_branch as an author-role task while
gitea.branch.delete is granted only to prgs-reconciler. No configured
profile could satisfy both the permission gate and the role gate, so
every deletion failed closed with performed=false.

Re-home delete_branch from the author role to the reconciler role in
both single-source-of-truth maps:
  - task_capability_map.TASK_CAPABILITY_MAP["delete_branch"].role
  - role_session_router: TASK_REQUIRED_ROLE + AUTHOR_TASKS/RECONCILER_TASKS

resolve_task_capability("delete_branch") now resolves to prgs-reconciler.
In gitea_delete_branch, the reconciler is now the delete-capable role and
performs raw deletion through the existing reconciliation-cleanup-phase
authorization gate (operator approval + safe_to_delete proof) plus the
preservation/protected guards; the prior reconciler->cleanup redirect is
removed as it would orphan that guarded flow. Author, reviewer, and
merger stay denied by the permission gate and the required-role gate.
gitea_cleanup_merged_pr_branch remains a separate reconciler-owned path
with independent merged/ancestry/ownership verification.

Tests: reconciler resolves + performs eligible deletion; author/reviewer/
merger denied even when holding the permission; protected/preservation
branches remain fail-closed; both role maps asserted in agreement.
Updated pre-existing tests that encoded the superseded author-delete /
#687 reconciler-redirect contract. Full suite: 3190 passed, 6 skipped,
1 pre-existing unrelated failure (test_issue_702 create_pr stale-binding).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01UracxyRHQw49rZBaexHdft

jcwalker3 merged commit 39e27dc63f into master

2026-07-17 18:59:20 -05:00

jcwalker3 deleted branch fix/issue-729-delete-branch-reconciler-role

2026-07-17 18:59:20 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#730