A merger that obtained lease proof through the merger-native tool gitea_acquire_merger_pr_lease was then rejected by the merge authorization gate as holding an unsanctioned lease, and had no way to terminally finalize that lease when the merge did not happen.
Root cause (code-backed)
SANCTIONED_PROVENANCE_SOURCES contained SOURCE_ACQUIRE_MERGER, so the membership check passed.
is_sanctioned_session_lease() branched only for SOURCE_ADOPT and {SOURCE_ACQUIRE, SOURCE_HEARTBEAT} and fell through to return False for an acquired merger lease.
reviewer_pr_lease.assess_mutation_lease_gate() therefore appended "in-session lease lacks sanctioned provenance", which gitea_merge_pr consumes through _reviewer_pr_lease_gate and fails closed on.
describe_session_lease_proof() had no branch for that source, reporting lease_proof_kind=unsanctioned for a correctly acquired lease.
No merger-role owner-session release/abandon operation existed, so a failed merger lease could only expire.
Reproduced on clean baseline a8d2087 before the fix: is_sanctioned=False, proof_kind=unsanctioned, no finalization path, _TERMINAL_PHASES without abandoned.
A. Acquired merger provenance
is_sanctioned_session_lease() now accepts SOURCE_ACQUIRE_MERGER, gated by the new assess_acquired_merger_lease_integrity(), which fails closed unless the in-session record is complete and self-consistent:
comment marker present, and matching between provenance and session when both carry one
non-empty session id and holder identity
merger profile (role proof)
non-empty repository and a valid positive PR number
a normalized 40-hex candidate_head
describe_session_lease_proof() reports the explicit kind sanctioned_acquire_merger. Manual _SESSION_LEASE seeding, forged/incomplete records, mismatched fields, and unknown provenance remain rejected. Reviewer-acquire, reviewer-heartbeat, and merger-adoption paths are untouched.
B. Merger owner-session finalization
New native tool gitea_release_merger_pr_lease terminally releases or abandons a merger's own comment-backed lease when the merge does not occur.
merger-only: requires gitea.read + gitea.pr.comment + gitea.pr.merge (reviewer profiles never hold pr.merge)
explicit capability-map task release_merger_pr_lease / gitea_release_merger_pr_lease bound to gitea.pr.comment + role merger, listed as role-exclusive in the resolver
assess_merger_lease_finalization() verifies exact session ownership, repository, PR, candidate_head against the live head, profile, identity, marker presence on the thread, and the native runtime token fingerprint recorded at acquisition
foreign-session release, reviewer-profile use, and any mismatch fail closed
append-only: posts a terminal lease marker; ledger history is never edited or deleted
idempotent: an already-terminal lease returns already_terminal and posts nothing
the PR, its approval, the decision lock, the branch, and the worktree are all preserved
gitea_release_reviewer_pr_lease is unchanged and is not reused for merger sessions
abandoned is added to reviewer_pr_lease._TERMINAL_PHASES; without it an abandoned marker would fall through the generic non-empty phase branch and keep re-arming the lease as active.
Files changed
merger_lease_adoption.py — integrity assessment, acquired-merger sanctioning, explicit proof kind, finalization body + assessment, fingerprint field on provenance
gitea_mcp_server.py — new gitea_release_merger_pr_lease tool, fingerprint recorded at acquisition, role-exclusive task entries
Full suite: 3305 passed, 6 skipped, 2 failed. Both failures — test_issue_702_review_findings_f1_f6::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probe and test_reconciler_supersession_close::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue — reproduce identically on clean baseline master a8d2087 in a throwaway worktree, and are pre-existing #737 org/repo-forwarding drift outside the scope of this change.
git diff --check clean. No credentials, configuration, launcher, or memory files in the diff.
Head (pinned)
22d0fdd25162fba8c23c43af9922d1ab5577c0c1
Scope note
PR #740 and lease session 33780-7168cbeeba58 were used as read-only failure evidence only. Neither was touched, released, adopted, commented on, or merged by this work unit.
Next role
Independent REVIEWER — do not self-review or merge.
## Summary
**Closes #742.**
A merger that obtained lease proof through the merger-native tool `gitea_acquire_merger_pr_lease` was then rejected by the merge authorization gate as holding an unsanctioned lease, and had no way to terminally finalize that lease when the merge did not happen.
### Root cause (code-backed)
1. `SANCTIONED_PROVENANCE_SOURCES` contained `SOURCE_ACQUIRE_MERGER`, so the membership check passed.
2. `is_sanctioned_session_lease()` branched only for `SOURCE_ADOPT` and `{SOURCE_ACQUIRE, SOURCE_HEARTBEAT}` and fell through to `return False` for an acquired merger lease.
3. `reviewer_pr_lease.assess_mutation_lease_gate()` therefore appended "in-session lease lacks sanctioned provenance", which `gitea_merge_pr` consumes through `_reviewer_pr_lease_gate` and fails closed on.
4. `describe_session_lease_proof()` had no branch for that source, reporting `lease_proof_kind=unsanctioned` for a correctly acquired lease.
5. No merger-role owner-session release/abandon operation existed, so a failed merger lease could only expire.
Reproduced on clean baseline `a8d2087` before the fix: `is_sanctioned=False`, `proof_kind=unsanctioned`, no finalization path, `_TERMINAL_PHASES` without `abandoned`.
## A. Acquired merger provenance
`is_sanctioned_session_lease()` now accepts `SOURCE_ACQUIRE_MERGER`, gated by the new `assess_acquired_merger_lease_integrity()`, which fails closed unless the in-session record is complete and self-consistent:
- comment marker present, and matching between provenance and session when both carry one
- non-empty session id and holder identity
- merger profile (role proof)
- non-empty repository and a valid positive PR number
- a normalized 40-hex `candidate_head`
`describe_session_lease_proof()` reports the explicit kind `sanctioned_acquire_merger`. Manual `_SESSION_LEASE` seeding, forged/incomplete records, mismatched fields, and unknown provenance remain rejected. Reviewer-acquire, reviewer-heartbeat, and merger-adoption paths are untouched.
## B. Merger owner-session finalization
New native tool **`gitea_release_merger_pr_lease`** terminally releases or abandons a merger's own comment-backed lease when the merge does not occur.
- merger-only: requires `gitea.read` + `gitea.pr.comment` + `gitea.pr.merge` (reviewer profiles never hold `pr.merge`)
- explicit capability-map task `release_merger_pr_lease` / `gitea_release_merger_pr_lease` bound to `gitea.pr.comment` + role `merger`, listed as role-exclusive in the resolver
- `assess_merger_lease_finalization()` verifies exact session ownership, repository, PR, `candidate_head` against the live head, profile, identity, marker presence on the thread, and the native runtime token fingerprint recorded at acquisition
- foreign-session release, reviewer-profile use, and any mismatch fail closed
- append-only: posts a terminal lease marker; ledger history is never edited or deleted
- idempotent: an already-terminal lease returns `already_terminal` and posts nothing
- the PR, its approval, the decision lock, the branch, and the worktree are all preserved
- `gitea_release_reviewer_pr_lease` is unchanged and is not reused for merger sessions
`abandoned` is added to `reviewer_pr_lease._TERMINAL_PHASES`; without it an abandoned marker would fall through the generic non-empty phase branch and keep re-arming the lease as active.
## Files changed
- `merger_lease_adoption.py` — integrity assessment, acquired-merger sanctioning, explicit proof kind, finalization body + assessment, fingerprint field on provenance
- `gitea_mcp_server.py` — new `gitea_release_merger_pr_lease` tool, fingerprint recorded at acquisition, role-exclusive task entries
- `reviewer_pr_lease.py` — `abandoned` terminal phase
- `task_capability_map.py` — merger-scoped release task entries
- `tests/test_merger_lease_finalization.py` — new
## Tests
```text
venv/bin/python -m pytest tests/test_merger_lease_finalization.py -q
38 passed, 11 subtests passed
```
Targeted lease/capability/provenance/anti-stomp/report suites:
```text
tests/test_merger_lease_finalization.py tests/test_merger_lease_acquire.py
tests/test_merger_lease_adoption.py tests/test_reviewer_pr_lease.py
tests/test_lease_lifecycle.py tests/test_post_merge_moot_lease.py
tests/test_pr_work_lease.py tests/test_issue_691_obsolete_reviewer_lease_cleanup.py
tests/test_anti_stomp_preflight.py tests/test_task_capability_role_invariants.py
tests/test_resolve_task_capability.py tests/test_final_report_validator.py
272 passed, 52 subtests passed
```
Full suite: **3305 passed, 6 skipped, 2 failed**. Both failures — `test_issue_702_review_findings_f1_f6::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probe` and `test_reconciler_supersession_close::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue` — reproduce identically on clean baseline master `a8d2087` in a throwaway worktree, and are pre-existing #737 org/repo-forwarding drift outside the scope of this change.
`git diff --check` clean. No credentials, configuration, launcher, or memory files in the diff.
## Head (pinned)
`22d0fdd25162fba8c23c43af9922d1ab5577c0c1`
## Scope note
PR #740 and lease session `33780-7168cbeeba58` were used as read-only failure evidence only. Neither was touched, released, adopted, commented on, or merged by this work unit.
## Next role
**Independent REVIEWER** — do not self-review or merge.
Root cause (confirmed on PR #740, session 33780-7168cbeeba58, marker 12354):
merger_lease_adoption.SANCTIONED_PROVENANCE_SOURCES already contained
SOURCE_ACQUIRE_MERGER, so the membership check passed, but
is_sanctioned_session_lease() branched only for SOURCE_ADOPT and for
{SOURCE_ACQUIRE, SOURCE_HEARTBEAT} and fell through to `return False` for a
lease minted by gitea_acquire_merger_pr_lease. assess_mutation_lease_gate()
therefore appended "in-session lease lacks sanctioned provenance" and
gitea_merge_pr fail-closed on the merger's own freshly acquired lease.
describe_session_lease_proof() likewise had no branch for that source and
reported the lease as lease_proof_kind=unsanctioned. Separately, no
merger-role owner-session operation existed to end that lease, so a failed
merger lease could only expire.
A. Acquired merger provenance
is_sanctioned_session_lease() now accepts SOURCE_ACQUIRE_MERGER, but only via
the new assess_acquired_merger_lease_integrity(), which fails closed unless
the in-session record is complete and self-consistent: comment marker present
and matching between provenance and session, non-empty session id, holder
identity, merger profile, repository, valid PR number, and a normalized
40-hex candidate_head. describe_session_lease_proof() reports the explicit
kind sanctioned_acquire_merger. Manual _SESSION_LEASE seeding, forged or
incomplete records, mismatched fields, and unknown provenance all remain
rejected; reviewer-acquire, reviewer-heartbeat, and merger-adoption paths are
untouched.
B. Merger owner-session finalization
New native tool gitea_release_merger_pr_lease terminally releases or abandons
a merger's own comment-backed lease when the merge does not occur. It is
merger-only (gitea.read + gitea.pr.comment + gitea.pr.merge; reviewer profiles
lack pr.merge) with an explicit capability-map task release_merger_pr_lease /
gitea_release_merger_pr_lease bound to gitea.pr.comment + role merger, and it
is listed as role-exclusive in the resolver. assess_merger_lease_finalization()
verifies exact session ownership, repository, PR, candidate head vs live head,
profile, identity, marker presence on the thread, and the native runtime token
fingerprint recorded at acquisition; foreign-session release, reviewer-profile
use, and any mismatch fail closed. Finalization appends a terminal lease marker
and never edits or deletes ledger history; an already-terminal lease returns
already_terminal and posts nothing. The PR, approval, decision lock, branch,
and worktree are all preserved. gitea_release_reviewer_pr_lease is unchanged
and is not repurposed for merger sessions.
"abandoned" is added to reviewer_pr_lease._TERMINAL_PHASES; without it an
abandoned marker would fall through the generic non-empty phase branch and
keep re-arming the lease as active.
Tests: new tests/test_merger_lease_finalization.py (38 tests, 11 subtests)
covers all twelve acceptance criteria — provenance sanctioning, explicit proof
kind, merge-gate acceptance, manual-seed and unknown-provenance rejection,
profile/role/session/head/repository/fingerprint mismatches, owner release,
foreign-session refusal, reviewer refusal, append-only idempotent
finalization, no surviving lease after finalization, and no regression in
adoption or reviewer-lease behavior. The defect was reproduced on clean
baseline a8d2087 first (is_sanctioned=False, proof_kind=unsanctioned, no
finalization path).
Validation: targeted lease/capability suites 272 passed. Full suite
3305 passed, 6 skipped, 2 failed — both failures
(test_issue_702_review_findings_f1_f6 F1 recovery, reconciler supersession
close) reproduce identically on clean baseline master a8d2087 in a throwaway
worktree and are pre-existing #737 org/repo-forwarding drift, unrelated to
this change.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
STATE: review_requested_changes
WHO_IS_NEXT: author
NEXT_ACTION: Add abandoned to pr_work_lease._TERMINAL_REVIEWER_PHASES plus regression test; push amended head for re-review
NEXT_PROMPT:
AUTHOR remediation for PR #743 (issue #742) after independent REQUEST_CHANGES.
Required fix only:
1. In pr_work_lease.py, add "abandoned" to _TERMINAL_REVIEWER_PHASES (mirror reviewer_pr_lease._TERMINAL_PHASES).
2. Add a regression test that pr_work_lease.find_active_reviewer_lease returns None for phase=abandoned.
3. Re-run tests/test_merger_lease_finalization.py and tests/test_pr_work_lease.py; keep scope minimal.
4. Do not touch PR #740. Do not self-review or merge.
Pinned prior head under review: 22d0fdd25162fba8c23c43af9922d1ab5577c0c1
Base: master @ a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f
WHAT_HAPPENED: Independent reviewer validated acquired-merger provenance and merger owner finalization; found dual-module abandoned terminal gap.
WHY: outcome=abandoned ends the lease in reviewer_pr_lease but remains active in pr_work_lease, violating AC11 and the finalization contract for conflict-fix and inventory readers.
ISSUE: #742
HEAD_SHA: 22d0fdd251
REVIEW_STATUS: REQUEST_CHANGES
MERGE_READY: no
BLOCKERS: pr_work_lease._TERMINAL_REVIEWER_PHASES missing abandoned; dual active-lease truth for abandoned markers
VALIDATION: 38+11 new tests pass; targeted 272/52 pass; full 3305 pass with 2 pre-existing baseline failures; git diff --check clean; defect reproduced on a8d2087
LAST_UPDATED_BY: sysadmin (prgs-reviewer) independent review
Acquired merger provenance integrity path is real (not allowlist-only); proof kind sanctioned_acquire_merger; manual seed fails closed; baseline defect reproduced.
Merger-only finalization tool with ownership/fingerprint gates; append-only; idempotent; does not repurpose reviewer release.
Tests meaningful; full suite failures match clean baseline.
[HIGH] Incomplete dual-module terminal phase for abandoned
reviewer_pr_lease._TERMINAL_PHASES includes abandoned; pr_work_lease._TERMINAL_REVIEWER_PHASES does not.
Proof: abandoned -> pwl active=True, rpl active=False. released/blocked/done agree inactive.
Impact: conflict-fix acquire (~15089), PR sync inventory (~15528), and other pwl readers still treat abandoned finalization as active — AC11 false for outcome=abandoned.
Fix: add abandoned to pwl terminal set + regression test.
Decision
REQUEST_CHANGES. No merge. Worktree retained.
## Canonical PR State
STATE: review_requested_changes
WHO_IS_NEXT: author
NEXT_ACTION: Add abandoned to pr_work_lease._TERMINAL_REVIEWER_PHASES plus regression test; push amended head for re-review
NEXT_PROMPT:
```text
AUTHOR remediation for PR #743 (issue #742) after independent REQUEST_CHANGES.
Required fix only:
1. In pr_work_lease.py, add "abandoned" to _TERMINAL_REVIEWER_PHASES (mirror reviewer_pr_lease._TERMINAL_PHASES).
2. Add a regression test that pr_work_lease.find_active_reviewer_lease returns None for phase=abandoned.
3. Re-run tests/test_merger_lease_finalization.py and tests/test_pr_work_lease.py; keep scope minimal.
4. Do not touch PR #740. Do not self-review or merge.
Pinned prior head under review: 22d0fdd25162fba8c23c43af9922d1ab5577c0c1
Base: master @ a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f
```
WHAT_HAPPENED: Independent reviewer validated acquired-merger provenance and merger owner finalization; found dual-module abandoned terminal gap.
WHY: outcome=abandoned ends the lease in reviewer_pr_lease but remains active in pr_work_lease, violating AC11 and the finalization contract for conflict-fix and inventory readers.
ISSUE: #742
HEAD_SHA: 22d0fdd25162fba8c23c43af9922d1ab5577c0c1
REVIEW_STATUS: REQUEST_CHANGES
MERGE_READY: no
BLOCKERS: pr_work_lease._TERMINAL_REVIEWER_PHASES missing abandoned; dual active-lease truth for abandoned markers
VALIDATION: 38+11 new tests pass; targeted 272/52 pass; full 3305 pass with 2 pre-existing baseline failures; git diff --check clean; defect reproduced on a8d2087
LAST_UPDATED_BY: sysadmin (prgs-reviewer) independent review
---
## Independent review — PR #743 @ 22d0fdd
**Reviewer:** sysadmin / prgs-reviewer / gitea-reviewer
**Base:** master @ a8d2087
**Worktree:** branches/review-pr-743-22d0fdd-20260718T094215 (detached)
**Lease session:** 41698-bb507d799e56 (released after this REQUEST_CHANGES)
### Line counts (a8d2087...22d0fdd)
Production: +557/-1 (merger_lease_adoption.py +350, gitea_mcp_server.py +192, task_capability_map.py +11, reviewer_pr_lease.py +4/-1)
Tests: +645 (tests/test_merger_lease_finalization.py)
Total: +1202/-1. Scope clean; no memory/config/credential files.
### Correct / non-blocking
- Acquired merger provenance integrity path is real (not allowlist-only); proof kind sanctioned_acquire_merger; manual seed fails closed; baseline defect reproduced.
- Merger-only finalization tool with ownership/fingerprint gates; append-only; idempotent; does not repurpose reviewer release.
- Tests meaningful; full suite failures match clean baseline.
### [HIGH] Incomplete dual-module terminal phase for abandoned
reviewer_pr_lease._TERMINAL_PHASES includes abandoned; pr_work_lease._TERMINAL_REVIEWER_PHASES does not.
Proof: abandoned -> pwl active=True, rpl active=False. released/blocked/done agree inactive.
Impact: conflict-fix acquire (~15089), PR sync inventory (~15528), and other pwl readers still treat abandoned finalization as active — AC11 false for outcome=abandoned.
Fix: add abandoned to pwl terminal set + regression test.
### Decision
REQUEST_CHANGES. No merge. Worktree retained.
Addresses REQUEST_CHANGES review 460 on PR #743 @ 22d0fdd.
reviewer_pr_lease._TERMINAL_PHASES gained "abandoned" for owner-session merger
finalization, but pr_work_lease._TERMINAL_REVIEWER_PHASES did not. The two
modules parse the same append-only lease markers, so the same comment read as
terminal through reviewer_pr_lease and active through pr_work_lease, leaving
the conflict-fix acquire and PR-sync inventory readers with a stale active
lease after an abandoned finalization.
Fix: add "abandoned" to pr_work_lease._TERMINAL_REVIEWER_PHASES, with a comment
recording that the two sets must stay mirrored.
Reproduced before the fix (single abandoned marker):
reviewer_pr_lease active=False, pr_work_lease active=True
After: both False; released/blocked/done unchanged in both modules.
Tests: new TestCrossModuleTerminalPhaseAgreement in
tests/test_merger_lease_finalization.py proves the abandoned marker is inactive
in pr_work_lease, that both modules agree for released/blocked/done/abandoned,
that claimed/validating stay active in both, that the two phase sets are
mirrored, that the default 'released' finalization outcome and reason are
unchanged, and that finalization appends without rewriting or deleting the
prior marker.
Separately pinned, NOT fixed here: on a claim-then-terminal ledger,
pr_work_lease.find_active_reviewer_lease skips the terminal marker and walks
back to the older claim, so it still reports an active lease. That newest-wins
gap is pre-existing on clean baseline a8d2087 for released, blocked, and done
alike — the #577 fix landed in reviewer_pr_lease only — and is out of scope for
this bounded remediation. test_abandoned_matches_preexisting_terminal_phases_on_full_ledger
pins that "abandoned" introduces no behavior of its own, so all four phases can
be reconciled in one separate change.
Validation: focused TestCrossModuleTerminalPhaseAgreement 7 passed / 9 subtests;
tests/test_merger_lease_finalization.py 45 passed / 20 subtests; related
pr_work_lease + reviewer/merger lease + adoption + provenance + capability-map +
anti-stomp + report-validator suites 261 passed / 41 subtests; full suite 3312
passed, 6 skipped, 2 failed. Both failures (test_issue_702_review_findings_f1_f6
F1 recovery, reconciler supersession close) reproduce identically on clean
baseline master a8d2087 and are pre-existing #737 org/repo-forwarding drift.
git diff --check clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
PR #743 remains in open state against master @ a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f. Live head is now 7ae5f3a5414deaf5b297031f9ac01642323420b6. Review 460 (REQUEST_CHANGES, sysadmin / prgs-reviewer) was recorded against 22d0fdd25162fba8c23c43af9922d1ab5577c0c1 and the review API now reports it as stale for the current head. No APPROVE verdict exists at any head. No active reviewer lease exists on this PR. Issue #742 remains in open state with the author issue lock held on branch fix/issue-742-merger-lease-provenance, worktree branches/issue-742.
Server-side decision state: one REQUEST_CHANGES review (id 460) at prior head 22d0fdd, undismissed and now stale; approval_visible=false; approval_at_current_head=false; author_pushed_after_request_changes=true.
Local verdict/state: author remediation implemented, committed, and pushed; no review verdict recorded or attempted by this author session.
what changed
Remediation commit 7ae5f3a was pushed fast-forward on top of the reviewed commit 22d0fdd. The reviewed commit was not amended, rebased, or rewritten.
It fixes the [HIGH] finding from review 460: reviewer_pr_lease._TERMINAL_PHASES included abandoned while pr_work_lease._TERMINAL_REVIEWER_PHASES did not, so the same append-only marker read as terminal through one module and active through the other. abandoned is now present in pr_work_lease._TERMINAL_REVIEWER_PHASES, with an inline note that the two sets must stay mirrored.
Measured before the fix, on a single abandoned marker: reviewer_pr_lease active=False, pr_work_lease active=True. After the fix both report False. The three pre-existing terminal phases in pr_work_lease._TERMINAL_REVIEWER_PHASES are unchanged in both modules.
New regression class TestCrossModuleTerminalPhaseAgreement in tests/test_merger_lease_finalization.py proves: pr_work_lease.find_active_reviewer_lease reports no active lease for an abandoned marker; both modules agree across all four terminal phases; claimed and validating stay active in both; the two phase sets are asserted mirrored so future drift fails a test; the default finalization outcome and its default reason are unchanged; and finalization appends without deleting or rewriting the prior marker (prior body and comment id asserted byte-identical).
Remediation diff: pr_work_lease.py (+5/-1) and tests/test_merger_lease_finalization.py (+110). No capability names or permissions altered, no unrelated lease refactor, no configuration, launcher, memory, or credential files. The namespace-health success versus ok observation was deliberately not addressed, per the bounded scope.
Validation for 7ae5f3a:
focused TestCrossModuleTerminalPhaseAgreement 7 passed, 9 subtests
suite tests/test_merger_lease_finalization.py 45 passed, 20 subtests
related pr_work_lease + reviewer/merger lease + adoption + provenance
+ capability-map + anti-stomp + report-validator
261 passed, 41 subtests
full entire suite 3312 passed, 6 skipped, 2 failed
The two full-suite failures (test_issue_702_review_findings_f1_f6::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probe and test_reconciler_supersession_close::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue) reproduce identically on clean baseline master a8d2087 in a throwaway worktree; they are pre-existing #737 org/repo-forwarding drift. git diff --check is clean.
what is blocked
Blocker classification: no blocker
Nothing prevents the next step. A fresh independent review verdict is required before any merge evaluation because review 460 is stale against the current head and no APPROVE verdict exists.
One finding is pinned for reviewer assessment but deliberately left unfixed. Writing the append-only test surfaced a second, pre-existing defect that the one-line fix does not address: on a claim-then-terminal ledger, pr_work_lease.find_active_reviewer_lease skips the terminal marker and walks back to the older claimed entry, still reporting an active lease. Measured on clean baseline a8d2087, this affects every phase in pr_work_lease._TERMINAL_REVIEWER_PHASES identically, not only abandoned — the #577 newest-wins fix landed in reviewer_pr_lease alone. Correcting it is the unrelated lease refactor this bounded remediation was instructed not to perform. test_abandoned_matches_preexisting_terminal_phases_on_full_ledger pins that abandoned introduces no behavior of its own, so all four phases can be reconciled together in one separate change. A follow-up issue is recommended and can be opened on request.
who/what acts next
Next actor: independent reviewer (prgs-reviewer namespace, sysadmin identity), not the author.
Required action: perform a fresh independent formal review of PR #743 at head 7ae5f3a5414deaf5b297031f9ac01642323420b6, confirm the dual-module terminal-phase gap is closed, and assess the pinned pre-existing pr_work_lease newest-wins finding described above.
Do not do: do not self-review as the author; do not record an APPROVE verdict from this author session; do not merge; do not act on stale review 460 as if it applied to the current head; do not mutate PR #740 or lease session 33780-7168cbeeba58; do not modify client configuration or memory files.
Canonical Issue State
STATE: author_remediation_pushed_awaiting_independent_re_review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Perform a fresh independent formal review of PR #743 at head 7ae5f3a541
NEXT_PROMPT:
INDEPENDENT REVIEWER re-review for PR #743 (issue #742) after author remediation of review 460.
Prior reviewed head: 22d0fdd25162fba8c23c43af9922d1ab5577c0c1 (review 460, now stale)
New head to review: 7ae5f3a5414deaf5b297031f9ac01642323420b6
Base: master @ a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f
Remediation commit 7ae5f3a adds "abandoned" to pr_work_lease._TERMINAL_REVIEWER_PHASES
and adds TestCrossModuleTerminalPhaseAgreement. Verify the dual-module terminal-phase
gap is closed, and assess the separately pinned pre-existing pr_work_lease newest-wins
finding described in the author remediation comment.
Do not self-review or merge. Do not mutate PR #740.
WHAT_HAPPENED: Author fixed the [HIGH] dual-module terminal-phase gap raised by review 460 and pushed one transparent remediation commit; the reviewed commit 22d0fdd was preserved unmodified.
WHY: reviewer_pr_lease treated an abandoned marker as terminal while pr_work_lease treated the same marker as active, producing two conflicting truths for a single comment and making the finalization contract false for pr_work_lease consumers.
RELATED_PRS: #743 (this PR), #725 (added gitea_acquire_merger_pr_lease), #740 (read-only failure evidence only, untouched)
ISSUE: #742
HEAD_SHA: 7ae5f3a541
REVIEW_STATUS: awaiting_independent_re_review
MERGE_READY: no
BLOCKERS: none for this head; review 460 is stale against the current head and a fresh verdict is required
VALIDATION: focused 7 passed/9 subtests; test_merger_lease_finalization.py 45 passed/20 subtests; related suites 261 passed/41 subtests; full suite 3312 passed, 6 skipped, 2 pre-existing baseline failures; git diff --check clean
LAST_UPDATED_BY: jcwalker3 (prgs-author) author remediation
[THREAD STATE LEDGER]
### what is true now
PR #743 remains in open state against master @ `a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f`. Live head is now `7ae5f3a5414deaf5b297031f9ac01642323420b6`. Review 460 (REQUEST_CHANGES, sysadmin / prgs-reviewer) was recorded against `22d0fdd25162fba8c23c43af9922d1ab5577c0c1` and the review API now reports it as stale for the current head. No APPROVE verdict exists at any head. No active reviewer lease exists on this PR. Issue #742 remains in open state with the author issue lock held on branch `fix/issue-742-merger-lease-provenance`, worktree `branches/issue-742`.
Server-side decision state: one REQUEST_CHANGES review (id 460) at prior head `22d0fdd`, undismissed and now stale; `approval_visible=false`; `approval_at_current_head=false`; `author_pushed_after_request_changes=true`.
Local verdict/state: author remediation implemented, committed, and pushed; no review verdict recorded or attempted by this author session.
### what changed
Remediation commit `7ae5f3a` was pushed fast-forward on top of the reviewed commit `22d0fdd`. The reviewed commit was not amended, rebased, or rewritten.
It fixes the [HIGH] finding from review 460: `reviewer_pr_lease._TERMINAL_PHASES` included `abandoned` while `pr_work_lease._TERMINAL_REVIEWER_PHASES` did not, so the same append-only marker read as terminal through one module and active through the other. `abandoned` is now present in `pr_work_lease._TERMINAL_REVIEWER_PHASES`, with an inline note that the two sets must stay mirrored.
Measured before the fix, on a single `abandoned` marker: `reviewer_pr_lease` active=False, `pr_work_lease` active=True. After the fix both report False. The three pre-existing terminal phases in `pr_work_lease._TERMINAL_REVIEWER_PHASES` are unchanged in both modules.
New regression class `TestCrossModuleTerminalPhaseAgreement` in `tests/test_merger_lease_finalization.py` proves: `pr_work_lease.find_active_reviewer_lease` reports no active lease for an `abandoned` marker; both modules agree across all four terminal phases; `claimed` and `validating` stay active in both; the two phase sets are asserted mirrored so future drift fails a test; the default finalization outcome and its default reason are unchanged; and finalization appends without deleting or rewriting the prior marker (prior body and comment id asserted byte-identical).
Remediation diff: `pr_work_lease.py` (+5/-1) and `tests/test_merger_lease_finalization.py` (+110). No capability names or permissions altered, no unrelated lease refactor, no configuration, launcher, memory, or credential files. The namespace-health `success` versus `ok` observation was deliberately not addressed, per the bounded scope.
Validation for `7ae5f3a`:
```text
focused TestCrossModuleTerminalPhaseAgreement 7 passed, 9 subtests
suite tests/test_merger_lease_finalization.py 45 passed, 20 subtests
related pr_work_lease + reviewer/merger lease + adoption + provenance
+ capability-map + anti-stomp + report-validator
261 passed, 41 subtests
full entire suite 3312 passed, 6 skipped, 2 failed
```
The two full-suite failures (`test_issue_702_review_findings_f1_f6::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probe` and `test_reconciler_supersession_close::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue`) reproduce identically on clean baseline master `a8d2087` in a throwaway worktree; they are pre-existing #737 org/repo-forwarding drift. `git diff --check` is clean.
### what is blocked
Blocker classification: no blocker
Nothing prevents the next step. A fresh independent review verdict is required before any merge evaluation because review 460 is stale against the current head and no APPROVE verdict exists.
One finding is pinned for reviewer assessment but deliberately left unfixed. Writing the append-only test surfaced a second, pre-existing defect that the one-line fix does not address: on a claim-then-terminal ledger, `pr_work_lease.find_active_reviewer_lease` skips the terminal marker and walks back to the older `claimed` entry, still reporting an active lease. Measured on clean baseline `a8d2087`, this affects every phase in `pr_work_lease._TERMINAL_REVIEWER_PHASES` identically, not only `abandoned` — the #577 newest-wins fix landed in `reviewer_pr_lease` alone. Correcting it is the unrelated lease refactor this bounded remediation was instructed not to perform. `test_abandoned_matches_preexisting_terminal_phases_on_full_ledger` pins that `abandoned` introduces no behavior of its own, so all four phases can be reconciled together in one separate change. A follow-up issue is recommended and can be opened on request.
### who/what acts next
Next actor: independent reviewer (prgs-reviewer namespace, sysadmin identity), not the author.
Required action: perform a fresh independent formal review of PR #743 at head `7ae5f3a5414deaf5b297031f9ac01642323420b6`, confirm the dual-module terminal-phase gap is closed, and assess the pinned pre-existing `pr_work_lease` newest-wins finding described above.
Do not do: do not self-review as the author; do not record an APPROVE verdict from this author session; do not merge; do not act on stale review 460 as if it applied to the current head; do not mutate PR #740 or lease session `33780-7168cbeeba58`; do not modify client configuration or memory files.
## Canonical Issue State
STATE: author_remediation_pushed_awaiting_independent_re_review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Perform a fresh independent formal review of PR #743 at head 7ae5f3a5414deaf5b297031f9ac01642323420b6
NEXT_PROMPT:
```text
INDEPENDENT REVIEWER re-review for PR #743 (issue #742) after author remediation of review 460.
Prior reviewed head: 22d0fdd25162fba8c23c43af9922d1ab5577c0c1 (review 460, now stale)
New head to review: 7ae5f3a5414deaf5b297031f9ac01642323420b6
Base: master @ a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f
Remediation commit 7ae5f3a adds "abandoned" to pr_work_lease._TERMINAL_REVIEWER_PHASES
and adds TestCrossModuleTerminalPhaseAgreement. Verify the dual-module terminal-phase
gap is closed, and assess the separately pinned pre-existing pr_work_lease newest-wins
finding described in the author remediation comment.
Do not self-review or merge. Do not mutate PR #740.
```
WHAT_HAPPENED: Author fixed the [HIGH] dual-module terminal-phase gap raised by review 460 and pushed one transparent remediation commit; the reviewed commit 22d0fdd was preserved unmodified.
WHY: reviewer_pr_lease treated an abandoned marker as terminal while pr_work_lease treated the same marker as active, producing two conflicting truths for a single comment and making the finalization contract false for pr_work_lease consumers.
RELATED_PRS: #743 (this PR), #725 (added gitea_acquire_merger_pr_lease), #740 (read-only failure evidence only, untouched)
ISSUE: #742
HEAD_SHA: 7ae5f3a5414deaf5b297031f9ac01642323420b6
REVIEW_STATUS: awaiting_independent_re_review
MERGE_READY: no
BLOCKERS: none for this head; review 460 is stale against the current head and a fresh verdict is required
VALIDATION: focused 7 passed/9 subtests; test_merger_lease_finalization.py 45 passed/20 subtests; related suites 261 passed/41 subtests; full suite 3312 passed, 6 skipped, 2 pre-existing baseline failures; git diff --check clean
LAST_UPDATED_BY: jcwalker3 (prgs-author) author remediation
Second author remediation on PR #743. Fixes the full-ledger defect surfaced by
the first remediation.
Root cause: pr_work_lease.find_active_reviewer_lease iterated the reviewer
markers newest-first and used `continue` on a terminal marker. On a realistic
append-only ledger (claimed -> validating -> terminal) it therefore stepped
over the terminal marker and returned the older claim of the very chain that
marker had just ended. reviewer_pr_lease got strict newest-wins under #577;
pr_work_lease never did, so the two modules disagreed for released, blocked,
done, and abandoned alike, and merger owner finalization did not leave "no
active lease" for pr_work_lease consumers (conflict-fix acquire, PR sync
inventory).
Fix: a claim is skipped when a later marker terminates its own chain. Chain
identity is (repo, pr_number, candidate_head, session_id, reviewer_identity,
profile) via the new _reviewer_chain_key; _chain_terminated_after scans only
markers appended after the candidate. Consequences:
- a valid terminal marker ends its matching earlier claim (no resurrection);
- a foreign-session, wrong-repo, wrong-PR, wrong-head, wrong-identity, or
wrong-profile terminal marker cannot cancel another session's active lease,
which strict newest-wins alone would have allowed;
- a malformed terminal marker has no provable chain key, so it cancels nothing
and cannot hide a valid active claim;
- expiry, freshness, phase sets, ownership and integrity checks, both parsers,
and find_active_conflict_fix_lease are untouched;
- history stays append-only; no marker is deleted or rewritten.
Reviewer lease markers carry no token field, so token-fingerprint validation
remains where it already lives (session provenance, merger finalization) and is
not weakened here.
Tests: new TestFullLedgerNewestWins in tests/test_merger_lease_finalization.py
covers claimed->released/blocked/done/abandoned, claimed->validating->terminal,
foreign-session and mismatched repo/PR/head/identity/profile terminals, the
malformed terminal marker, a newer active chain surviving an older terminated
chain, newest-valid-chain selection across multiple histories, all-chains-
terminated, single-marker parity between the two modules across eight phases,
expired-claim/freshness non-regression, and the real ledger written by
gitea_release_merger_pr_lease reading as terminal in both modules with the
prior marker preserved. TestCrossModuleTerminalPhaseAgreement's scope-limited
placeholder test is replaced by a real both-modules full-ledger assertion.
Verified 10 of the new tests fail at the prior head 7ae5f3a and pass here.
Validation: focused TestFullLedgerNewestWins 14 passed / 21 subtests;
tests/test_merger_lease_finalization.py 59 passed / 42 subtests; targeted
pr_work_lease + reviewer/merger lease + adoption + provenance + acquire/release
+ anti-stomp + capability-map + decision-lock + report-validator suites 309
passed / 41 subtests; full suite 3326 passed, 6 skipped, 2 failed. Both
failures (test_issue_702_review_findings_f1_f6 F1 recovery, reconciler
supersession close) reproduce identically on clean baseline master a8d2087 and
are pre-existing #737 org/repo-forwarding drift. git diff --check clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
PR #743 remains in open state against master @ a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f. Live head is now fde95b9266e8d610c8400e0290b04e0e0201a822. Review 460 (REQUEST_CHANGES, sysadmin / prgs-reviewer) was recorded against 22d0fdd25162fba8c23c43af9922d1ab5577c0c1 and the review API reports it as stale for the current head. No APPROVE verdict exists at any head. No active reviewer lease exists on this PR. Issue #742 remains in open state; the author issue lock is held on branch fix/issue-742-merger-lease-provenance, worktree branches/issue-742, clean and exactly at the new head.
Server-side decision state: one REQUEST_CHANGES review (id 460) at head 22d0fdd, undismissed and stale; approval_visible=false; approval_at_current_head=false; author_pushed_after_request_changes=true.
Local verdict/state: second author remediation implemented, committed, and pushed; no review verdict recorded or attempted by this author session.
what changed
Remediation commit fde95b9 was pushed fast-forward on top of 7ae5f3a. Neither earlier commit (22d0fdd, 7ae5f3a) was amended, rebased, or rewritten.
Root cause.pr_work_lease.find_active_reviewer_lease iterated reviewer markers newest-first and used continue on a terminal marker. On a realistic append-only ledger (claimed → validating → terminal) it stepped over the terminal marker and returned the older claim of the very chain that marker had just ended. reviewer_pr_lease received strict newest-wins under #577; pr_work_lease never did. The two modules therefore disagreed for every phase in _TERMINAL_REVIEWER_PHASES, and merger owner finalization did not leave no active lease for pr_work_lease consumers (conflict-fix acquire, PR sync inventory).
Production change (pr_work_lease.py, +48/−5). A claim is now skipped when a later marker terminates its own chain. Chain identity is (repo, pr_number, candidate_head, session_id, reviewer_identity, profile) via the new _reviewer_chain_key; _chain_terminated_after scans only markers appended after the candidate. Consequences:
a valid terminal marker ends its matching earlier claim, with no backward resurrection
a foreign-session, wrong-repository, wrong-PR, wrong-head, wrong-identity, or wrong-profile terminal marker cannot cancel another session's valid active lease — strict newest-wins alone would have permitted exactly that
a malformed marker yields no chain key, so it cancels nothing and cannot hide a valid active claim
expiry, freshness, phase sets, ownership and integrity validation, both parsers, and find_active_conflict_fix_lease are untouched
history stays append-only; no marker is deleted or rewritten
Reviewer lease markers carry no token field, so token-fingerprint validation stays where it already lives (session provenance, checked during merger finalization) and is not weakened here.
New tests — TestFullLedgerNewestWins in tests/test_merger_lease_finalization.py: claimed → each of the four terminal phases; claimed → validating → terminal; foreign-session terminal; mismatched repository, PR, candidate head, identity, and profile terminals; malformed terminal marker; a newer active chain surviving an older terminated chain; newest-valid-chain selection across multiple histories; all-chains-terminated; single-marker parity between the two modules across eight phases; expired-claim and freshness non-regression; and the real ledger written by gitea_release_merger_pr_lease reading as terminal in both modules with the prior marker preserved. The scope-limited placeholder test from the first remediation is replaced by a real both-modules full-ledger assertion.
Ten of the new tests were confirmed failing at the prior head 7ae5f3a and passing at fde95b9.
The two full-suite failures (test_issue_702_review_findings_f1_f6::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probe and test_reconciler_supersession_close::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue) reproduce identically on clean baseline master a8d2087 in a throwaway worktree; they are pre-existing #737 org/repo-forwarding drift. git diff --check is clean.
Remediation diff is confined to pr_work_lease.py and tests/test_merger_lease_finalization.py. No capability names or permissions changed, no configuration, launcher, credential, or memory files, no worktree cleanup, no namespace-health reporting changes, and no direct API or CLI mutation path used.
what is blocked
Blocker classification: no blocker
Nothing prevents the next step. A fresh independent review verdict is required before any merge evaluation, because review 460 is stale against the current head and no APPROVE verdict exists at fde95b9. The finding pinned as out-of-scope in the previous author comment is now fixed inside this PR, as instructed; no separate issue was opened.
who/what acts next
Next actor: independent reviewer (prgs-reviewer namespace, sysadmin identity), not the author.
Required action: perform a fresh independent formal review of PR #743 at head fde95b9266e8d610c8400e0290b04e0e0201a822, confirming that full-ledger chain-scoped newest-wins terminal behavior holds in pr_work_lease, that foreign and malformed terminal markers cannot cancel a valid active lease, and that ownership, freshness, and integrity validation are not weakened.
Do not do: do not self-review as the author; do not record an APPROVE verdict from this author session; do not merge; do not treat stale review 460 as applying to the current head; do not mutate PR #740 or any active or expired lease; do not modify client configuration or memory files.
Canonical Issue State
STATE: author_remediation_pushed_awaiting_independent_re_review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Perform a fresh independent formal review of PR #743 at head fde95b9266
NEXT_PROMPT:
INDEPENDENT REVIEWER re-review for PR #743 (issue #742) after the second author remediation.
Prior reviewed head: 22d0fdd25162fba8c23c43af9922d1ab5577c0c1 (review 460, stale)
Intermediate head: 7ae5f3a5414deaf5b297031f9ac01642323420b6
New head to review: fde95b9266e8d610c8400e0290b04e0e0201a822
Base: master @ a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f
Commit fde95b9 gives pr_work_lease.find_active_reviewer_lease chain-scoped
newest-wins semantics: a terminal marker ends its own claim chain, keyed by
repository, PR, candidate head, session id, identity, and profile, while
foreign or malformed terminal markers cancel nothing. Verify no backward
resurrection on claimed -> validating -> terminal ledgers, no cross-session
cancellation, and no weakening of expiry, freshness, ownership, or integrity
validation.
Do not self-review or merge. Do not mutate PR #740.
WHAT_HAPPENED: Author fixed the full-ledger backward-walk defect in pr_work_lease with chain-scoped newest-wins semantics and pushed one transparent remediation commit; both earlier commits were preserved unmodified.
WHY: pr_work_lease skipped a terminal marker and returned the older claim of the same chain, so merger owner finalization did not leave the ledger free of an active lease for pr_work_lease consumers, contradicting the issue #742 finalization requirement.
RELATED_PRS: #743 (this PR), #725 (added gitea_acquire_merger_pr_lease), #740 (read-only failure evidence only, untouched)
ISSUE: #742
HEAD_SHA: fde95b9266
REVIEW_STATUS: awaiting_independent_re_review
MERGE_READY: no
BLOCKERS: none for this head; review 460 is stale against the current head and a fresh verdict is required
VALIDATION: focused 14 passed/21 subtests; test_merger_lease_finalization.py 59 passed/42 subtests; targeted suites 309 passed/41 subtests; full suite 3326 passed, 6 skipped, 2 pre-existing baseline failures; 10 new tests confirmed failing at prior head 7ae5f3a; git diff --check clean
LAST_UPDATED_BY: jcwalker3 (prgs-author) second author remediation
[THREAD STATE LEDGER]
### what is true now
PR #743 remains in open state against master @ `a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f`. Live head is now `fde95b9266e8d610c8400e0290b04e0e0201a822`. Review 460 (REQUEST_CHANGES, sysadmin / prgs-reviewer) was recorded against `22d0fdd25162fba8c23c43af9922d1ab5577c0c1` and the review API reports it as stale for the current head. No APPROVE verdict exists at any head. No active reviewer lease exists on this PR. Issue #742 remains in open state; the author issue lock is held on branch `fix/issue-742-merger-lease-provenance`, worktree `branches/issue-742`, clean and exactly at the new head.
Server-side decision state: one REQUEST_CHANGES review (id 460) at head `22d0fdd`, undismissed and stale; `approval_visible=false`; `approval_at_current_head=false`; `author_pushed_after_request_changes=true`.
Local verdict/state: second author remediation implemented, committed, and pushed; no review verdict recorded or attempted by this author session.
### what changed
Remediation commit `fde95b9` was pushed fast-forward on top of `7ae5f3a`. Neither earlier commit (`22d0fdd`, `7ae5f3a`) was amended, rebased, or rewritten.
**Root cause.** `pr_work_lease.find_active_reviewer_lease` iterated reviewer markers newest-first and used `continue` on a terminal marker. On a realistic append-only ledger (`claimed` → `validating` → terminal) it stepped over the terminal marker and returned the older claim of the very chain that marker had just ended. `reviewer_pr_lease` received strict newest-wins under #577; `pr_work_lease` never did. The two modules therefore disagreed for every phase in `_TERMINAL_REVIEWER_PHASES`, and merger owner finalization did not leave no active lease for `pr_work_lease` consumers (conflict-fix acquire, PR sync inventory).
**Production change** (`pr_work_lease.py`, +48/−5). A claim is now skipped when a later marker terminates its own chain. Chain identity is `(repo, pr_number, candidate_head, session_id, reviewer_identity, profile)` via the new `_reviewer_chain_key`; `_chain_terminated_after` scans only markers appended after the candidate. Consequences:
- a valid terminal marker ends its matching earlier claim, with no backward resurrection
- a foreign-session, wrong-repository, wrong-PR, wrong-head, wrong-identity, or wrong-profile terminal marker cannot cancel another session's valid active lease — strict newest-wins alone would have permitted exactly that
- a malformed marker yields no chain key, so it cancels nothing and cannot hide a valid active claim
- expiry, freshness, phase sets, ownership and integrity validation, both parsers, and `find_active_conflict_fix_lease` are untouched
- history stays append-only; no marker is deleted or rewritten
Reviewer lease markers carry no token field, so token-fingerprint validation stays where it already lives (session provenance, checked during merger finalization) and is not weakened here.
**New tests** — `TestFullLedgerNewestWins` in `tests/test_merger_lease_finalization.py`: `claimed` → each of the four terminal phases; `claimed` → `validating` → terminal; foreign-session terminal; mismatched repository, PR, candidate head, identity, and profile terminals; malformed terminal marker; a newer active chain surviving an older terminated chain; newest-valid-chain selection across multiple histories; all-chains-terminated; single-marker parity between the two modules across eight phases; expired-claim and freshness non-regression; and the real ledger written by `gitea_release_merger_pr_lease` reading as terminal in both modules with the prior marker preserved. The scope-limited placeholder test from the first remediation is replaced by a real both-modules full-ledger assertion.
Ten of the new tests were confirmed failing at the prior head `7ae5f3a` and passing at `fde95b9`.
Validation for `fde95b9`:
```text
focused TestFullLedgerNewestWins 14 passed, 21 subtests
suite tests/test_merger_lease_finalization.py 59 passed, 42 subtests
targeted pr_work_lease + reviewer/merger lease + adoption + provenance
+ acquire/release + anti-stomp + capability-map + decision-lock
+ report-validator 309 passed, 41 subtests
full entire suite 3326 passed, 6 skipped, 2 failed
```
The two full-suite failures (`test_issue_702_review_findings_f1_f6::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probe` and `test_reconciler_supersession_close::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue`) reproduce identically on clean baseline master `a8d2087` in a throwaway worktree; they are pre-existing #737 org/repo-forwarding drift. `git diff --check` is clean.
Remediation diff is confined to `pr_work_lease.py` and `tests/test_merger_lease_finalization.py`. No capability names or permissions changed, no configuration, launcher, credential, or memory files, no worktree cleanup, no namespace-health reporting changes, and no direct API or CLI mutation path used.
### what is blocked
Blocker classification: no blocker
Nothing prevents the next step. A fresh independent review verdict is required before any merge evaluation, because review 460 is stale against the current head and no APPROVE verdict exists at `fde95b9`. The finding pinned as out-of-scope in the previous author comment is now fixed inside this PR, as instructed; no separate issue was opened.
### who/what acts next
Next actor: independent reviewer (prgs-reviewer namespace, sysadmin identity), not the author.
Required action: perform a fresh independent formal review of PR #743 at head `fde95b9266e8d610c8400e0290b04e0e0201a822`, confirming that full-ledger chain-scoped newest-wins terminal behavior holds in `pr_work_lease`, that foreign and malformed terminal markers cannot cancel a valid active lease, and that ownership, freshness, and integrity validation are not weakened.
Do not do: do not self-review as the author; do not record an APPROVE verdict from this author session; do not merge; do not treat stale review 460 as applying to the current head; do not mutate PR #740 or any active or expired lease; do not modify client configuration or memory files.
## Canonical Issue State
STATE: author_remediation_pushed_awaiting_independent_re_review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Perform a fresh independent formal review of PR #743 at head fde95b9266e8d610c8400e0290b04e0e0201a822
NEXT_PROMPT:
```text
INDEPENDENT REVIEWER re-review for PR #743 (issue #742) after the second author remediation.
Prior reviewed head: 22d0fdd25162fba8c23c43af9922d1ab5577c0c1 (review 460, stale)
Intermediate head: 7ae5f3a5414deaf5b297031f9ac01642323420b6
New head to review: fde95b9266e8d610c8400e0290b04e0e0201a822
Base: master @ a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f
Commit fde95b9 gives pr_work_lease.find_active_reviewer_lease chain-scoped
newest-wins semantics: a terminal marker ends its own claim chain, keyed by
repository, PR, candidate head, session id, identity, and profile, while
foreign or malformed terminal markers cancel nothing. Verify no backward
resurrection on claimed -> validating -> terminal ledgers, no cross-session
cancellation, and no weakening of expiry, freshness, ownership, or integrity
validation.
Do not self-review or merge. Do not mutate PR #740.
```
WHAT_HAPPENED: Author fixed the full-ledger backward-walk defect in pr_work_lease with chain-scoped newest-wins semantics and pushed one transparent remediation commit; both earlier commits were preserved unmodified.
WHY: pr_work_lease skipped a terminal marker and returned the older claim of the same chain, so merger owner finalization did not leave the ledger free of an active lease for pr_work_lease consumers, contradicting the issue #742 finalization requirement.
RELATED_PRS: #743 (this PR), #725 (added gitea_acquire_merger_pr_lease), #740 (read-only failure evidence only, untouched)
ISSUE: #742
HEAD_SHA: fde95b9266e8d610c8400e0290b04e0e0201a822
REVIEW_STATUS: awaiting_independent_re_review
MERGE_READY: no
BLOCKERS: none for this head; review 460 is stale against the current head and a fresh verdict is required
VALIDATION: focused 14 passed/21 subtests; test_merger_lease_finalization.py 59 passed/42 subtests; targeted suites 309 passed/41 subtests; full suite 3326 passed, 6 skipped, 2 pre-existing baseline failures; 10 new tests confirmed failing at prior head 7ae5f3a; git diff --check clean
LAST_UPDATED_BY: jcwalker3 (prgs-author) second author remediation
STATE: ready-to-merge
WHO_IS_NEXT: merger
NEXT_ACTION: Fresh merger adopts active reviewer lease and merges PR #743 at pinned head fde95b9
NEXT_PROMPT:
INDEPENDENT MERGER for PR #743 (issue #742) after independent APPROVE.
Head (pinned): fde95b9266e8d610c8400e0290b04e0e0201a822
Base: master @ a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f
Reviewer lease (adopt; do not re-acquire unless expired):
session_id: 41698-b545ed31909a
marker comment: 12408 (phase approved)
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-743-fde95b9-20260718T105053
Use gitea-merger / prgs-merger. Adopt the active reviewer lease, re-verify head, merge with confirmation MERGE PR 743. Do not re-review. Do not mutate PR #740.
WHAT_HAPPENED: Independent re-review at fde95b9 confirmed chain-scoped newest-wins in pr_work_lease closes the dual-module finalization gap; provenance and merger owner finalization remain sound.
WHY: Review 460 at 22d0fdd is stale; intermediate 7ae5f3a only mirrored abandoned but still resurrected claim after terminal; fde95b9 ends matching chains and keeps foreign/malformed terminals from cancelling active leases.
ISSUE: #742
HEAD_SHA: fde95b9266
REVIEW_STATUS: approved / approval_at_current_head
MERGE_READY: true
BLOCKERS: none
VALIDATION: TestFullLedgerNewestWins 14/21; finalization suite 59/42; targeted lease suites 293/83; decision-lock 179; full 3326 pass 6 skip 2 pre-existing baseline failures; independent chain proofs; git diff --check clean
NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=gitea-reviewer-prgs-reviewer-session
LAST_UPDATED_BY: sysadmin (prgs-reviewer) independent re-review
7ae5f3a — mirror abandoned into pr_work_lease terminal set (review 460)
fde95b9 — chain-scoped newest-wins in pr_work_lease.find_active_reviewer_lease
Line counts (a8d2087...fde95b9)
Production +608/-4; tests +956; total +1567/-4. Scope clean. No memory/config/credential files.
Chain termination
Matching terminal ends same chain (repo, PR, head, session, identity, profile). released/blocked/done/abandoned consistent. claim→validating→terminal inactive in BOTH modules. Foreign/mismatched/malformed terminals cancel nothing. Multi-history selects newest valid chain. API list ordering (append-only). Proven at 7ae5f3a full ledger still active in pwl; at fde95b9 inactive in both.
Merger finalization reconfirmed
SOURCE_ACQUIRE_MERGER integrity-gated; manual seed rejected; release merger+owner only; append-only terminal in both readers; idempotent; reviewer release unchanged.
Residual note (non-blocking)
reviewer_pr_lease pure newest-wins vs pr_work_lease chain-scoped for multi-session interleaving; same-chain finalization agrees (AC11 satisfied).
Decision
APPROVE. No merge. Lease left active for merger adoption.
## Canonical PR State
STATE: ready-to-merge
WHO_IS_NEXT: merger
NEXT_ACTION: Fresh merger adopts active reviewer lease and merges PR #743 at pinned head fde95b9
NEXT_PROMPT:
```text
INDEPENDENT MERGER for PR #743 (issue #742) after independent APPROVE.
Head (pinned): fde95b9266e8d610c8400e0290b04e0e0201a822
Base: master @ a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f
Reviewer lease (adopt; do not re-acquire unless expired):
session_id: 41698-b545ed31909a
marker comment: 12408 (phase approved)
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-743-fde95b9-20260718T105053
Use gitea-merger / prgs-merger. Adopt the active reviewer lease, re-verify head, merge with confirmation MERGE PR 743. Do not re-review. Do not mutate PR #740.
```
WHAT_HAPPENED: Independent re-review at fde95b9 confirmed chain-scoped newest-wins in pr_work_lease closes the dual-module finalization gap; provenance and merger owner finalization remain sound.
WHY: Review 460 at 22d0fdd is stale; intermediate 7ae5f3a only mirrored abandoned but still resurrected claim after terminal; fde95b9 ends matching chains and keeps foreign/malformed terminals from cancelling active leases.
ISSUE: #742
HEAD_SHA: fde95b9266e8d610c8400e0290b04e0e0201a822
REVIEW_STATUS: approved / approval_at_current_head
MERGE_READY: true
BLOCKERS: none
VALIDATION: TestFullLedgerNewestWins 14/21; finalization suite 59/42; targeted lease suites 293/83; decision-lock 179; full 3326 pass 6 skip 2 pre-existing baseline failures; independent chain proofs; git diff --check clean
NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=gitea-reviewer-prgs-reviewer-session
LAST_UPDATED_BY: sysadmin (prgs-reviewer) independent re-review
---
## Independent re-review — PR #743 @ fde95b9
**Reviewer:** sysadmin / prgs-reviewer / gitea-reviewer
**Base:** master @ a8d2087
**Worktree:** branches/review-pr-743-fde95b9-20260718T105053 (detached)
**Lease:** session 41698-b545ed31909a — LEFT ACTIVE for immediate merger adoption (claim 12404, validating 12406, approved 12408)
**Prior review 460:** REQUEST_CHANGES at 22d0fdd — stale; does not decide this head
### Commits
1. 22d0fdd — acquired merger provenance + gitea_release_merger_pr_lease
2. 7ae5f3a — mirror abandoned into pr_work_lease terminal set (review 460)
3. fde95b9 — chain-scoped newest-wins in pr_work_lease.find_active_reviewer_lease
### Line counts (a8d2087...fde95b9)
Production +608/-4; tests +956; total +1567/-4. Scope clean. No memory/config/credential files.
### Chain termination
Matching terminal ends same chain (repo, PR, head, session, identity, profile). released/blocked/done/abandoned consistent. claim→validating→terminal inactive in BOTH modules. Foreign/mismatched/malformed terminals cancel nothing. Multi-history selects newest valid chain. API list ordering (append-only). Proven at 7ae5f3a full ledger still active in pwl; at fde95b9 inactive in both.
### Merger finalization reconfirmed
SOURCE_ACQUIRE_MERGER integrity-gated; manual seed rejected; release merger+owner only; append-only terminal in both readers; idempotent; reviewer release unchanged.
### Residual note (non-blocking)
reviewer_pr_lease pure newest-wins vs pr_work_lease chain-scoped for multi-session interleaving; same-chain finalization agrees (AC11 satisfied).
### Decision
APPROVE. No merge. Lease left active for merger adoption.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sysadmin
Summary
Closes #742.
A merger that obtained lease proof through the merger-native tool
gitea_acquire_merger_pr_leasewas then rejected by the merge authorization gate as holding an unsanctioned lease, and had no way to terminally finalize that lease when the merge did not happen.Root cause (code-backed)
SANCTIONED_PROVENANCE_SOURCEScontainedSOURCE_ACQUIRE_MERGER, so the membership check passed.is_sanctioned_session_lease()branched only forSOURCE_ADOPTand{SOURCE_ACQUIRE, SOURCE_HEARTBEAT}and fell through toreturn Falsefor an acquired merger lease.reviewer_pr_lease.assess_mutation_lease_gate()therefore appended "in-session lease lacks sanctioned provenance", whichgitea_merge_prconsumes through_reviewer_pr_lease_gateand fails closed on.describe_session_lease_proof()had no branch for that source, reportinglease_proof_kind=unsanctionedfor a correctly acquired lease.Reproduced on clean baseline
a8d2087before the fix:is_sanctioned=False,proof_kind=unsanctioned, no finalization path,_TERMINAL_PHASESwithoutabandoned.A. Acquired merger provenance
is_sanctioned_session_lease()now acceptsSOURCE_ACQUIRE_MERGER, gated by the newassess_acquired_merger_lease_integrity(), which fails closed unless the in-session record is complete and self-consistent:candidate_headdescribe_session_lease_proof()reports the explicit kindsanctioned_acquire_merger. Manual_SESSION_LEASEseeding, forged/incomplete records, mismatched fields, and unknown provenance remain rejected. Reviewer-acquire, reviewer-heartbeat, and merger-adoption paths are untouched.B. Merger owner-session finalization
New native tool
gitea_release_merger_pr_leaseterminally releases or abandons a merger's own comment-backed lease when the merge does not occur.gitea.read+gitea.pr.comment+gitea.pr.merge(reviewer profiles never holdpr.merge)release_merger_pr_lease/gitea_release_merger_pr_leasebound togitea.pr.comment+ rolemerger, listed as role-exclusive in the resolverassess_merger_lease_finalization()verifies exact session ownership, repository, PR,candidate_headagainst the live head, profile, identity, marker presence on the thread, and the native runtime token fingerprint recorded at acquisitionalready_terminaland posts nothinggitea_release_reviewer_pr_leaseis unchanged and is not reused for merger sessionsabandonedis added toreviewer_pr_lease._TERMINAL_PHASES; without it an abandoned marker would fall through the generic non-empty phase branch and keep re-arming the lease as active.Files changed
merger_lease_adoption.py— integrity assessment, acquired-merger sanctioning, explicit proof kind, finalization body + assessment, fingerprint field on provenancegitea_mcp_server.py— newgitea_release_merger_pr_leasetool, fingerprint recorded at acquisition, role-exclusive task entriesreviewer_pr_lease.py—abandonedterminal phasetask_capability_map.py— merger-scoped release task entriestests/test_merger_lease_finalization.py— newTests
Targeted lease/capability/provenance/anti-stomp/report suites:
Full suite: 3305 passed, 6 skipped, 2 failed. Both failures —
test_issue_702_review_findings_f1_f6::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probeandtest_reconciler_supersession_close::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue— reproduce identically on clean baseline mastera8d2087in a throwaway worktree, and are pre-existing #737 org/repo-forwarding drift outside the scope of this change.git diff --checkclean. No credentials, configuration, launcher, or memory files in the diff.Head (pinned)
22d0fdd25162fba8c23c43af9922d1ab5577c0c1Scope note
PR #740 and lease session
33780-7168cbeeba58were used as read-only failure evidence only. Neither was touched, released, adopted, commented on, or merged by this work unit.Next role
Independent REVIEWER — do not self-review or merge.
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #743
issue: #742
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 41698-bb507d799e56
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-743-22d0fdd-20260718T094215
phase: claimed
candidate_head:
22d0fdd251target_branch: master
target_branch_sha:
a8d2087b4alast_activity: 2026-07-18T13:42:32Z
expires_at: 2026-07-18T15:42:32Z
blocker: none
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #743
issue: #742
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 41698-bb507d799e56
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-743-22d0fdd-20260718T094215
phase: validating
candidate_head:
22d0fdd251target_branch: master
target_branch_sha:
a8d2087b4alast_activity: 2026-07-18T13:45:08Z
expires_at: 2026-07-18T15:45:08Z
blocker: none
Canonical PR State
STATE: review_requested_changes
WHO_IS_NEXT: author
NEXT_ACTION: Add abandoned to pr_work_lease._TERMINAL_REVIEWER_PHASES plus regression test; push amended head for re-review
NEXT_PROMPT:
WHAT_HAPPENED: Independent reviewer validated acquired-merger provenance and merger owner finalization; found dual-module abandoned terminal gap.
WHY: outcome=abandoned ends the lease in reviewer_pr_lease but remains active in pr_work_lease, violating AC11 and the finalization contract for conflict-fix and inventory readers.
ISSUE: #742
HEAD_SHA:
22d0fdd251REVIEW_STATUS: REQUEST_CHANGES
MERGE_READY: no
BLOCKERS: pr_work_lease._TERMINAL_REVIEWER_PHASES missing abandoned; dual active-lease truth for abandoned markers
VALIDATION: 38+11 new tests pass; targeted 272/52 pass; full 3305 pass with 2 pre-existing baseline failures; git diff --check clean; defect reproduced on
a8d2087LAST_UPDATED_BY: sysadmin (prgs-reviewer) independent review
Independent review — PR #743 @
22d0fddReviewer: sysadmin / prgs-reviewer / gitea-reviewer
Base: master @
a8d2087Worktree: branches/review-pr-743-22d0fdd-20260718T094215 (detached)
Lease session: 41698-bb507d799e56 (released after this REQUEST_CHANGES)
Line counts (a8d2087...22d0fdd)
Production: +557/-1 (merger_lease_adoption.py +350, gitea_mcp_server.py +192, task_capability_map.py +11, reviewer_pr_lease.py +4/-1)
Tests: +645 (tests/test_merger_lease_finalization.py)
Total: +1202/-1. Scope clean; no memory/config/credential files.
Correct / non-blocking
[HIGH] Incomplete dual-module terminal phase for abandoned
reviewer_pr_lease._TERMINAL_PHASES includes abandoned; pr_work_lease._TERMINAL_REVIEWER_PHASES does not.
Proof: abandoned -> pwl active=True, rpl active=False. released/blocked/done agree inactive.
Impact: conflict-fix acquire (~15089), PR sync inventory (~15528), and other pwl readers still treat abandoned finalization as active — AC11 false for outcome=abandoned.
Fix: add abandoned to pwl terminal set + regression test.
Decision
REQUEST_CHANGES. No merge. Worktree retained.
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #743
issue: #742
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 41698-bb507d799e56
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-743-22d0fdd-20260718T094215
phase: released
candidate_head:
22d0fdd251target_branch: master
target_branch_sha:
a8d2087b4alast_activity: 2026-07-18T13:47:21Z
expires_at: 2026-07-18T15:47:21Z
blocker: manual-release
[THREAD STATE LEDGER]
what is true now
PR #743 remains in open state against master @
a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f. Live head is now7ae5f3a5414deaf5b297031f9ac01642323420b6. Review 460 (REQUEST_CHANGES, sysadmin / prgs-reviewer) was recorded against22d0fdd25162fba8c23c43af9922d1ab5577c0c1and the review API now reports it as stale for the current head. No APPROVE verdict exists at any head. No active reviewer lease exists on this PR. Issue #742 remains in open state with the author issue lock held on branchfix/issue-742-merger-lease-provenance, worktreebranches/issue-742.Server-side decision state: one REQUEST_CHANGES review (id 460) at prior head
22d0fdd, undismissed and now stale;approval_visible=false;approval_at_current_head=false;author_pushed_after_request_changes=true.Local verdict/state: author remediation implemented, committed, and pushed; no review verdict recorded or attempted by this author session.
what changed
Remediation commit
7ae5f3awas pushed fast-forward on top of the reviewed commit22d0fdd. The reviewed commit was not amended, rebased, or rewritten.It fixes the [HIGH] finding from review 460:
reviewer_pr_lease._TERMINAL_PHASESincludedabandonedwhilepr_work_lease._TERMINAL_REVIEWER_PHASESdid not, so the same append-only marker read as terminal through one module and active through the other.abandonedis now present inpr_work_lease._TERMINAL_REVIEWER_PHASES, with an inline note that the two sets must stay mirrored.Measured before the fix, on a single
abandonedmarker:reviewer_pr_leaseactive=False,pr_work_leaseactive=True. After the fix both report False. The three pre-existing terminal phases inpr_work_lease._TERMINAL_REVIEWER_PHASESare unchanged in both modules.New regression class
TestCrossModuleTerminalPhaseAgreementintests/test_merger_lease_finalization.pyproves:pr_work_lease.find_active_reviewer_leasereports no active lease for anabandonedmarker; both modules agree across all four terminal phases;claimedandvalidatingstay active in both; the two phase sets are asserted mirrored so future drift fails a test; the default finalization outcome and its default reason are unchanged; and finalization appends without deleting or rewriting the prior marker (prior body and comment id asserted byte-identical).Remediation diff:
pr_work_lease.py(+5/-1) andtests/test_merger_lease_finalization.py(+110). No capability names or permissions altered, no unrelated lease refactor, no configuration, launcher, memory, or credential files. The namespace-healthsuccessversusokobservation was deliberately not addressed, per the bounded scope.Validation for
7ae5f3a:The two full-suite failures (
test_issue_702_review_findings_f1_f6::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probeandtest_reconciler_supersession_close::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue) reproduce identically on clean baseline mastera8d2087in a throwaway worktree; they are pre-existing #737 org/repo-forwarding drift.git diff --checkis clean.what is blocked
Blocker classification: no blocker
Nothing prevents the next step. A fresh independent review verdict is required before any merge evaluation because review 460 is stale against the current head and no APPROVE verdict exists.
One finding is pinned for reviewer assessment but deliberately left unfixed. Writing the append-only test surfaced a second, pre-existing defect that the one-line fix does not address: on a claim-then-terminal ledger,
pr_work_lease.find_active_reviewer_leaseskips the terminal marker and walks back to the olderclaimedentry, still reporting an active lease. Measured on clean baselinea8d2087, this affects every phase inpr_work_lease._TERMINAL_REVIEWER_PHASESidentically, not onlyabandoned— the #577 newest-wins fix landed inreviewer_pr_leasealone. Correcting it is the unrelated lease refactor this bounded remediation was instructed not to perform.test_abandoned_matches_preexisting_terminal_phases_on_full_ledgerpins thatabandonedintroduces no behavior of its own, so all four phases can be reconciled together in one separate change. A follow-up issue is recommended and can be opened on request.who/what acts next
Next actor: independent reviewer (prgs-reviewer namespace, sysadmin identity), not the author.
Required action: perform a fresh independent formal review of PR #743 at head
7ae5f3a5414deaf5b297031f9ac01642323420b6, confirm the dual-module terminal-phase gap is closed, and assess the pinned pre-existingpr_work_leasenewest-wins finding described above.Do not do: do not self-review as the author; do not record an APPROVE verdict from this author session; do not merge; do not act on stale review 460 as if it applied to the current head; do not mutate PR #740 or lease session
33780-7168cbeeba58; do not modify client configuration or memory files.Canonical Issue State
STATE: author_remediation_pushed_awaiting_independent_re_review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Perform a fresh independent formal review of PR #743 at head
7ae5f3a541NEXT_PROMPT:
WHAT_HAPPENED: Author fixed the [HIGH] dual-module terminal-phase gap raised by review 460 and pushed one transparent remediation commit; the reviewed commit
22d0fddwas preserved unmodified.WHY: reviewer_pr_lease treated an abandoned marker as terminal while pr_work_lease treated the same marker as active, producing two conflicting truths for a single comment and making the finalization contract false for pr_work_lease consumers.
RELATED_PRS: #743 (this PR), #725 (added gitea_acquire_merger_pr_lease), #740 (read-only failure evidence only, untouched)
ISSUE: #742
HEAD_SHA:
7ae5f3a541REVIEW_STATUS: awaiting_independent_re_review
MERGE_READY: no
BLOCKERS: none for this head; review 460 is stale against the current head and a fresh verdict is required
VALIDATION: focused 7 passed/9 subtests; test_merger_lease_finalization.py 45 passed/20 subtests; related suites 261 passed/41 subtests; full suite 3312 passed, 6 skipped, 2 pre-existing baseline failures; git diff --check clean
LAST_UPDATED_BY: jcwalker3 (prgs-author) author remediation
[THREAD STATE LEDGER]
what is true now
PR #743 remains in open state against master @
a8d2087b4af3ae143b839c5c0c821e2a3ca7fd4f. Live head is nowfde95b9266e8d610c8400e0290b04e0e0201a822. Review 460 (REQUEST_CHANGES, sysadmin / prgs-reviewer) was recorded against22d0fdd25162fba8c23c43af9922d1ab5577c0c1and the review API reports it as stale for the current head. No APPROVE verdict exists at any head. No active reviewer lease exists on this PR. Issue #742 remains in open state; the author issue lock is held on branchfix/issue-742-merger-lease-provenance, worktreebranches/issue-742, clean and exactly at the new head.Server-side decision state: one REQUEST_CHANGES review (id 460) at head
22d0fdd, undismissed and stale;approval_visible=false;approval_at_current_head=false;author_pushed_after_request_changes=true.Local verdict/state: second author remediation implemented, committed, and pushed; no review verdict recorded or attempted by this author session.
what changed
Remediation commit
fde95b9was pushed fast-forward on top of7ae5f3a. Neither earlier commit (22d0fdd,7ae5f3a) was amended, rebased, or rewritten.Root cause.
pr_work_lease.find_active_reviewer_leaseiterated reviewer markers newest-first and usedcontinueon a terminal marker. On a realistic append-only ledger (claimed→validating→ terminal) it stepped over the terminal marker and returned the older claim of the very chain that marker had just ended.reviewer_pr_leasereceived strict newest-wins under #577;pr_work_leasenever did. The two modules therefore disagreed for every phase in_TERMINAL_REVIEWER_PHASES, and merger owner finalization did not leave no active lease forpr_work_leaseconsumers (conflict-fix acquire, PR sync inventory).Production change (
pr_work_lease.py, +48/−5). A claim is now skipped when a later marker terminates its own chain. Chain identity is(repo, pr_number, candidate_head, session_id, reviewer_identity, profile)via the new_reviewer_chain_key;_chain_terminated_afterscans only markers appended after the candidate. Consequences:find_active_conflict_fix_leaseare untouchedReviewer lease markers carry no token field, so token-fingerprint validation stays where it already lives (session provenance, checked during merger finalization) and is not weakened here.
New tests —
TestFullLedgerNewestWinsintests/test_merger_lease_finalization.py:claimed→ each of the four terminal phases;claimed→validating→ terminal; foreign-session terminal; mismatched repository, PR, candidate head, identity, and profile terminals; malformed terminal marker; a newer active chain surviving an older terminated chain; newest-valid-chain selection across multiple histories; all-chains-terminated; single-marker parity between the two modules across eight phases; expired-claim and freshness non-regression; and the real ledger written bygitea_release_merger_pr_leasereading as terminal in both modules with the prior marker preserved. The scope-limited placeholder test from the first remediation is replaced by a real both-modules full-ledger assertion.Ten of the new tests were confirmed failing at the prior head
7ae5f3aand passing atfde95b9.Validation for
fde95b9:The two full-suite failures (
test_issue_702_review_findings_f1_f6::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probeandtest_reconciler_supersession_close::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue) reproduce identically on clean baseline mastera8d2087in a throwaway worktree; they are pre-existing #737 org/repo-forwarding drift.git diff --checkis clean.Remediation diff is confined to
pr_work_lease.pyandtests/test_merger_lease_finalization.py. No capability names or permissions changed, no configuration, launcher, credential, or memory files, no worktree cleanup, no namespace-health reporting changes, and no direct API or CLI mutation path used.what is blocked
Blocker classification: no blocker
Nothing prevents the next step. A fresh independent review verdict is required before any merge evaluation, because review 460 is stale against the current head and no APPROVE verdict exists at
fde95b9. The finding pinned as out-of-scope in the previous author comment is now fixed inside this PR, as instructed; no separate issue was opened.who/what acts next
Next actor: independent reviewer (prgs-reviewer namespace, sysadmin identity), not the author.
Required action: perform a fresh independent formal review of PR #743 at head
fde95b9266e8d610c8400e0290b04e0e0201a822, confirming that full-ledger chain-scoped newest-wins terminal behavior holds inpr_work_lease, that foreign and malformed terminal markers cannot cancel a valid active lease, and that ownership, freshness, and integrity validation are not weakened.Do not do: do not self-review as the author; do not record an APPROVE verdict from this author session; do not merge; do not treat stale review 460 as applying to the current head; do not mutate PR #740 or any active or expired lease; do not modify client configuration or memory files.
Canonical Issue State
STATE: author_remediation_pushed_awaiting_independent_re_review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Perform a fresh independent formal review of PR #743 at head
fde95b9266NEXT_PROMPT:
WHAT_HAPPENED: Author fixed the full-ledger backward-walk defect in pr_work_lease with chain-scoped newest-wins semantics and pushed one transparent remediation commit; both earlier commits were preserved unmodified.
WHY: pr_work_lease skipped a terminal marker and returned the older claim of the same chain, so merger owner finalization did not leave the ledger free of an active lease for pr_work_lease consumers, contradicting the issue #742 finalization requirement.
RELATED_PRS: #743 (this PR), #725 (added gitea_acquire_merger_pr_lease), #740 (read-only failure evidence only, untouched)
ISSUE: #742
HEAD_SHA:
fde95b9266REVIEW_STATUS: awaiting_independent_re_review
MERGE_READY: no
BLOCKERS: none for this head; review 460 is stale against the current head and a fresh verdict is required
VALIDATION: focused 14 passed/21 subtests; test_merger_lease_finalization.py 59 passed/42 subtests; targeted suites 309 passed/41 subtests; full suite 3326 passed, 6 skipped, 2 pre-existing baseline failures; 10 new tests confirmed failing at prior head 7ae5f3a; git diff --check clean
LAST_UPDATED_BY: jcwalker3 (prgs-author) second author remediation
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #743
issue: #742
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 41698-b545ed31909a
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-743-fde95b9-20260718T105053
phase: claimed
candidate_head:
fde95b9266target_branch: master
target_branch_sha:
a8d2087b4alast_activity: 2026-07-18T14:50:59Z
expires_at: 2026-07-18T16:50:59Z
blocker: none
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #743
issue: #742
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 41698-b545ed31909a
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-743-fde95b9-20260718T105053
phase: validating
candidate_head:
fde95b9266target_branch: master
target_branch_sha:
a8d2087b4alast_activity: 2026-07-18T14:52:43Z
expires_at: 2026-07-18T16:52:43Z
blocker: none
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #743
issue: #742
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 41698-b545ed31909a
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-743-fde95b9-20260718T105053
phase: approved
candidate_head:
fde95b9266target_branch: master
target_branch_sha:
a8d2087b4alast_activity: 2026-07-18T14:52:54Z
expires_at: 2026-07-18T16:52:54Z
blocker: none
Canonical PR State
STATE: ready-to-merge
WHO_IS_NEXT: merger
NEXT_ACTION: Fresh merger adopts active reviewer lease and merges PR #743 at pinned head
fde95b9NEXT_PROMPT:
WHAT_HAPPENED: Independent re-review at
fde95b9confirmed chain-scoped newest-wins in pr_work_lease closes the dual-module finalization gap; provenance and merger owner finalization remain sound.WHY: Review 460 at
22d0fddis stale; intermediate7ae5f3aonly mirrored abandoned but still resurrected claim after terminal;fde95b9ends matching chains and keeps foreign/malformed terminals from cancelling active leases.ISSUE: #742
HEAD_SHA:
fde95b9266REVIEW_STATUS: approved / approval_at_current_head
MERGE_READY: true
BLOCKERS: none
VALIDATION: TestFullLedgerNewestWins 14/21; finalization suite 59/42; targeted lease suites 293/83; decision-lock 179; full 3326 pass 6 skip 2 pre-existing baseline failures; independent chain proofs; git diff --check clean
NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=gitea-reviewer-prgs-reviewer-session
LAST_UPDATED_BY: sysadmin (prgs-reviewer) independent re-review
Independent re-review — PR #743 @
fde95b9Reviewer: sysadmin / prgs-reviewer / gitea-reviewer
Base: master @
a8d2087Worktree: branches/review-pr-743-fde95b9-20260718T105053 (detached)
Lease: session 41698-b545ed31909a — LEFT ACTIVE for immediate merger adoption (claim 12404, validating 12406, approved 12408)
Prior review 460: REQUEST_CHANGES at
22d0fdd— stale; does not decide this headCommits
22d0fdd— acquired merger provenance + gitea_release_merger_pr_lease7ae5f3a— mirror abandoned into pr_work_lease terminal set (review 460)fde95b9— chain-scoped newest-wins in pr_work_lease.find_active_reviewer_leaseLine counts (a8d2087...fde95b9)
Production +608/-4; tests +956; total +1567/-4. Scope clean. No memory/config/credential files.
Chain termination
Matching terminal ends same chain (repo, PR, head, session, identity, profile). released/blocked/done/abandoned consistent. claim→validating→terminal inactive in BOTH modules. Foreign/mismatched/malformed terminals cancel nothing. Multi-history selects newest valid chain. API list ordering (append-only). Proven at
7ae5f3afull ledger still active in pwl; atfde95b9inactive in both.Merger finalization reconfirmed
SOURCE_ACQUIRE_MERGER integrity-gated; manual seed rejected; release merger+owner only; append-only terminal in both readers; idempotent; reviewer release unchanged.
Residual note (non-blocking)
reviewer_pr_lease pure newest-wins vs pr_work_lease chain-scoped for multi-session interleaving; same-chain finalization agrees (AC11 satisfied).
Decision
APPROVE. No merge. Lease left active for merger adoption.
adopted_at: 2026-07-18T15:12:00Z
adopted_by_identity: sysadmin
adopted_by_profile: prgs-merger
adopted_from_session_id: 41698-b545ed31909a
adopted_from_profile: prgs-reviewer
adopted_from_reviewer_identity: sysadmin
adopted_from_comment_id: 12408
adoption_reason: merger-handoff-approved-head
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #743
issue: #742
reviewer_identity: sysadmin
profile: prgs-merger
session_id: 8638-614082671b65
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merge-pr-743-fde95b9
phase: adopted
candidate_head:
fde95b9266target_branch: master
target_branch_sha:
a8d2087b4alast_activity: 2026-07-18T15:12:00Z
expires_at: 2026-07-18T17:12:00Z
blocker: none
Stale #332 review-decision lock cleanup (#594)
Status: APPLIED
sysadminprgs-merger2026-07-18T15:12:39.666120+00:00approveon PR fix(mcp): accept acquired merger-lease provenance and add owner finalization (Closes #742) (#743)closed(merged=True)0a38d9238206fa75b569f1f5c60371621b0928963prgs-reviewerManual deletion of session-state files is not the workflow.
This path only clears a lock when the referenced PR is merged/closed.