fix(mcp): bind post-merge moot-lease cleanup to the reconciler capability (Closes #745) #746

2026-07-18T12:00:58-05:00

jcwalker3 commented

2026-07-18 12:00:58 -05:00

Closes #745.

Base: b05075fd25ea7f3ac2e86d68f18a1a14c803962e
Head: b00e09a7814ddb03072d1e09c1b13ae314779a11

Root cause

gitea_cleanup_post_merge_moot_lease (#515) posts a terminal phase: released
lease marker — a durable mutation of the PR lease ledger — but had no entry in
the canonical task-capability map and no role binding.

entry gated on gitea.read;
apply gated only on gitea.pr.comment, which author, reviewer and merger
profiles all hold for ordinary PR discussion, so three unintended roles
reached the mutation path;
no resolvable cleanup task existed, so the reconciler could not satisfy the
operator-required resolve-exact-task -> mutation sequence at all;
the apply path called verify_preflight_purity(remote) with no task=,
org= or repo=, skipping the resolved-task, canonical-root and
explicit-target checks its siblings perform;
request org/repo flowed straight into _resolve(...), so a caller could
retarget the mutation at a foreign repository.

Task / tool contract

name	permission	role
`cleanup_post_merge_moot_lease`	`gitea.pr.comment`	`reconciler`
`gitea_cleanup_post_merge_moot_lease` (tool alias)	`gitea.pr.comment`	`reconciler`

Both names carry an identical contract (the project's established alias
convention). Unknown or misspelled names keep failing closed on the map's
KeyError. Both are also added to role_session_router.RECONCILER_TASKS and
TASK_REQUIRED_ROLE, so the map and the router cannot disagree — the #723
defect-A class of drift.

Role-bound behavior

The two modes are gated differently, on purpose.

apply=false (assessment) stays reachable under gitea.read, with no role
gate. This follows the established convention: cleanup_stale_review_decision_lock
is documented in the map as "Apply path requires reviewer review permission;
assessment itself uses gitea.read inside the tool", and
gitea_cleanup_obsolete_reviewer_comment_lease gates entry the same way. Keeping
assessment read-only means an operator can diagnose a stuck lease from whichever
namespace is attached without switching roles. It performs no mutation and
records append-only dry-run evidence in-session. This choice is documented in
the capability map, the tool docstring and docs/gitea-execution-profiles.md,
and is directly tested for all four roles.

apply=true (mutation) requires, in order:

the session resolved exactly cleanup_post_merge_moot_lease — resolving any
other task, including a sibling reconciler task, does not authorize it;
the reconciler role, checked independently of the permission gate;
gitea.pr.comment;
explicit org/repo validated against the canonical repository identity
derived from the session binding (request parameters can never redirect the
mutation), then worktree_path/task/org/repo forwarded to
verify_preflight_purity for canonical-root, workspace and anti-stomp
binding (#733/#739);
the pre-existing dry-run safety assessment, unchanged;
matching dry-run evidence proving lease_moot and cleanup_allowed for the
same PR, lease session, candidate head and lease marker id, plus any
caller-supplied expected_session_id / expected_candidate_head /
expected_lease_comment_id.

Fails closed on live, non-moot, superseded, mismatched, malformed,
foreign-repository and ambiguous leases. The ledger stays append-only (entries
are only appended, lookup is newest-wins, dry_run_history hands out copies)
and already-terminal cleanup stays idempotent. The tool still only ever appends
a marker — it never edits or deletes another session's comment, and never merges
or adopts a lease.

Files changed

task_capability_map.py — canonical task + tool alias, with the rationale
and the deliberate read-only-assessment carve-out.
role_session_router.py — same two names in RECONCILER_TASKS and
TASK_REQUIRED_ROLE.
post_merge_moot_lease_gate.py (new) — pure authorization logic plus the
append-only dry-run ledger.
gitea_mcp_server.py — the apply-path gate chain; generalizes
_delete_branch_repository_binding_block into
_repository_binding_block(required_permission=...) (retained as a thin
delete-path alias so #733/#739 coverage keeps exercising its permission
label); adds _bound_repository_slug.
tests/test_issue_745_moot_lease_reconciler_gate.py (new) — 39 tests.
tests/test_post_merge_moot_lease.py — updated from the permission-only model
to reconciler + dry-run evidence, plus a negative test pinning that a merger
can no longer apply.
docs/gitea-execution-profiles.md — new "Post-merge moot-lease cleanup
ownership" section.

Tests and results

tests/test_issue_745_moot_lease_reconciler_gate.py + tests/test_post_merge_moot_lease.py
— 50 passed, 35 subtests passed.
Targeted suites (capability map, resolver, role routing, role namespace gate,
delete-branch capability, #733 repo forwarding, reconciler cleanup /
close-gate / profile, anti-stomp preflight, canonical root #706 / cross-repo /
#741, obsolete-lease cleanup #691, lease lifecycle, reviewer lease)
— 368 passed, 161 subtests passed.
Full suite tests/ — 3448 passed, 6 skipped, 2 failed, 400 subtests passed.

The 2 failures are pre-existing on master, reproduced against a clean
detached worktree at b05075f before this branch was applied:

tests/test_issue_702_review_findings_f1_f6.py::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probe
tests/test_reconciler_supersession_close.py::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue
(expects verify_preflight_purity('prgs', task='reconcile_close_superseded_pr')
without the org/repo now forwarded by the #735 change)

git diff --check — clean, no whitespace errors.

Safety

No production lease was touched. PR #744's lease (session 33673-1d54887a0415,
marker 12452) was not used as a test subject and was not cleaned; it
expires naturally. TestNoProductionLeaseTouched asserts the fixtures are
synthetic and that those production identifiers appear nowhere else in the test
module. No reconciler cleanup was performed, no review or merge was attempted,
and no client configuration, launcher, profile or credential was modified.

Note for the reviewer

This adds the mapping and the enforcement. Actually exercising the reconciler
path end-to-end additionally needs the running MCP namespaces restarted onto the
merged code, since the capability map is loaded at process start.

Closes #745. Base: `b05075fd25ea7f3ac2e86d68f18a1a14c803962e` Head: `b00e09a7814ddb03072d1e09c1b13ae314779a11` ## Root cause `gitea_cleanup_post_merge_moot_lease` (#515) posts a terminal `phase: released` lease marker — a durable mutation of the PR lease ledger — but had **no entry in the canonical task-capability map and no role binding**. - entry gated on `gitea.read`; - apply gated only on `gitea.pr.comment`, which author, reviewer and merger profiles all hold for ordinary PR discussion, so three unintended roles reached the mutation path; - no resolvable cleanup task existed, so the reconciler could not satisfy the operator-required `resolve-exact-task -> mutation` sequence at all; - the apply path called `verify_preflight_purity(remote)` with no `task=`, `org=` or `repo=`, skipping the resolved-task, canonical-root and explicit-target checks its siblings perform; - request `org`/`repo` flowed straight into `_resolve(...)`, so a caller could retarget the mutation at a foreign repository. ## Task / tool contract | name | permission | role | |---|---|---| | `cleanup_post_merge_moot_lease` | `gitea.pr.comment` | `reconciler` | | `gitea_cleanup_post_merge_moot_lease` (tool alias) | `gitea.pr.comment` | `reconciler` | Both names carry an identical contract (the project's established alias convention). Unknown or misspelled names keep failing closed on the map's `KeyError`. Both are also added to `role_session_router.RECONCILER_TASKS` and `TASK_REQUIRED_ROLE`, so the map and the router cannot disagree — the #723 defect-A class of drift. ## Role-bound behavior The two modes are gated differently, on purpose. **`apply=false` (assessment) stays reachable under `gitea.read`, with no role gate.** This follows the established convention: `cleanup_stale_review_decision_lock` is documented in the map as *"Apply path requires reviewer review permission; assessment itself uses gitea.read inside the tool"*, and `gitea_cleanup_obsolete_reviewer_comment_lease` gates entry the same way. Keeping assessment read-only means an operator can diagnose a stuck lease from whichever namespace is attached without switching roles. It performs no mutation and records append-only dry-run evidence in-session. This choice is documented in the capability map, the tool docstring and `docs/gitea-execution-profiles.md`, and is directly tested for all four roles. **`apply=true` (mutation) requires, in order:** 1. the session resolved exactly `cleanup_post_merge_moot_lease` — resolving any other task, including a sibling reconciler task, does not authorize it; 2. the `reconciler` role, checked independently of the permission gate; 3. `gitea.pr.comment`; 4. explicit `org`/`repo` validated against the canonical repository identity derived from the session binding (request parameters can never redirect the mutation), then `worktree_path`/`task`/`org`/`repo` forwarded to `verify_preflight_purity` for canonical-root, workspace and anti-stomp binding (#733/#739); 5. the pre-existing dry-run safety assessment, unchanged; 6. matching dry-run evidence proving `lease_moot` and `cleanup_allowed` for the same PR, lease session, candidate head and lease marker id, plus any caller-supplied `expected_session_id` / `expected_candidate_head` / `expected_lease_comment_id`. Fails closed on live, non-moot, superseded, mismatched, malformed, foreign-repository and ambiguous leases. The ledger stays append-only (entries are only appended, lookup is newest-wins, `dry_run_history` hands out copies) and already-terminal cleanup stays idempotent. The tool still only ever appends a marker — it never edits or deletes another session's comment, and never merges or adopts a lease. ## Files changed - `task_capability_map.py` — canonical task + tool alias, with the rationale and the deliberate read-only-assessment carve-out. - `role_session_router.py` — same two names in `RECONCILER_TASKS` and `TASK_REQUIRED_ROLE`. - `post_merge_moot_lease_gate.py` *(new)* — pure authorization logic plus the append-only dry-run ledger. - `gitea_mcp_server.py` — the apply-path gate chain; generalizes `_delete_branch_repository_binding_block` into `_repository_binding_block(required_permission=...)` (retained as a thin delete-path alias so #733/#739 coverage keeps exercising its permission label); adds `_bound_repository_slug`. - `tests/test_issue_745_moot_lease_reconciler_gate.py` *(new)* — 39 tests. - `tests/test_post_merge_moot_lease.py` — updated from the permission-only model to reconciler + dry-run evidence, plus a negative test pinning that a merger can no longer apply. - `docs/gitea-execution-profiles.md` — new "Post-merge moot-lease cleanup ownership" section. ## Tests and results - `tests/test_issue_745_moot_lease_reconciler_gate.py` + `tests/test_post_merge_moot_lease.py` — **50 passed, 35 subtests passed**. - Targeted suites (capability map, resolver, role routing, role namespace gate, delete-branch capability, #733 repo forwarding, reconciler cleanup / close-gate / profile, anti-stomp preflight, canonical root #706 / cross-repo / #741, obsolete-lease cleanup #691, lease lifecycle, reviewer lease) — **368 passed, 161 subtests passed**. - Full suite `tests/` — **3448 passed, 6 skipped, 2 failed, 400 subtests passed**. The 2 failures are **pre-existing on master**, reproduced against a clean detached worktree at `b05075f` before this branch was applied: - `tests/test_issue_702_review_findings_f1_f6.py::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probe` - `tests/test_reconciler_supersession_close.py::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue` (expects `verify_preflight_purity('prgs', task='reconcile_close_superseded_pr')` without the `org`/`repo` now forwarded by the #735 change) `git diff --check` — clean, no whitespace errors. ## Safety No production lease was touched. PR #744's lease (session `33673-1d54887a0415`, marker `12452`) was **not** used as a test subject and was not cleaned; it expires naturally. `TestNoProductionLeaseTouched` asserts the fixtures are synthetic and that those production identifiers appear nowhere else in the test module. No reconciler cleanup was performed, no review or merge was attempted, and no client configuration, launcher, profile or credential was modified. ## Note for the reviewer This adds the mapping and the enforcement. Actually *exercising* the reconciler path end-to-end additionally needs the running MCP namespaces restarted onto the merged code, since the capability map is loaded at process start.

jcwalker3 added 1 commit 2026-07-18 12:01:00 -05:00

fix(mcp): bind post-merge moot-lease cleanup to the reconciler capability (Closes #745 ) b00e09a781

gitea_cleanup_post_merge_moot_lease (#515) posts a terminal `phase: released`
lease marker — a durable mutation of the PR lease ledger — but had no entry in
the canonical task-capability map and no role binding. Entry gated on
gitea.read, apply gated only on gitea.pr.comment, so any profile holding the
comment permission (author, reviewer, merger) reached the mutation path, while
the reconciler could not satisfy the operator-required resolve-exact-task ->
mutation sequence because no cleanup task was resolvable at all. The apply path
also called verify_preflight_purity(remote) with no task/org/repo, skipping the
resolved-task, canonical-root and explicit-target checks its siblings perform,
and passed request org/repo straight into _resolve.

Capability map and router:

- Map `cleanup_post_merge_moot_lease` and the tool-name alias
  `gitea_cleanup_post_merge_moot_lease` to gitea.pr.comment + reconciler.
  Both names carry an identical contract; unknown names keep failing closed on
  the map's KeyError.
- Add both to role_session_router RECONCILER_TASKS and TASK_REQUIRED_ROLE so
  the map and the router cannot disagree (the #723 defect-A class).

Tool enforcement (apply path only):

- Require the session to have resolved exactly the cleanup task; resolving a
  different task, including a sibling reconciler task, does not authorize it.
- Require the reconciler role, checked independently of the permission gate.
- Require gitea.pr.comment.
- Validate explicit org/repo against the canonical repository identity derived
  from the session binding, so request parameters can never redirect the
  mutation, and forward worktree_path/task/org/repo to verify_preflight_purity
  for canonical-root, workspace and anti-stomp binding (#733/#739).
- Require matching dry-run evidence proving lease_moot and cleanup_allowed for
  the same PR, lease session, candidate head and lease marker id, with optional
  caller expectations checked against the live lease.

New post_merge_moot_lease_gate module holds the pure authorization logic and an
append-only dry-run ledger: entries are only ever appended, lookup is
newest-wins, and dry_run_history hands out copies. Live, non-moot, superseded,
mismatched, malformed and foreign-repository leases all fail closed;
already-terminal cleanup stays idempotent.

The read-only apply=false assessment deliberately stays reachable under
gitea.read with no role gate, matching gitea_cleanup_stale_review_decision_lock
and gitea_cleanup_obsolete_reviewer_comment_lease, so an operator can diagnose a
stuck lease from any attached namespace. This choice is documented in the map,
the tool docstring and docs/gitea-execution-profiles.md, and is directly tested.

_delete_branch_repository_binding_block is generalized into
_repository_binding_block(required_permission=...) and retained as a thin
delete-path alias so #733/#739 coverage keeps exercising its permission label.

Tests: new tests/test_issue_745_moot_lease_reconciler_gate.py (39 tests, 35
subtests) covers the map/router contract, alias parity, unknown-name rejection,
role and task gates, dry-run/apply sequencing, superseded and malformed leases,
repository binding, ledger append-only behavior, idempotency, and asserts no
production PR/session/marker is referenced. tests/test_post_merge_moot_lease.py
is updated from the permission-only model to reconciler + dry-run evidence, with
a new negative test pinning that a merger can no longer apply.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

sysadmin commented

2026-07-18 12:04:51 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 98044-6c4cbd692695
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-fix-issue-745-reconciler-moot-lease-gate
phase: claimed
candidate_head: b00e09a781
target_branch: master
target_branch_sha: b05075fd25
last_activity: 2026-07-18T17:04:51Z
expires_at: 2026-07-18T19:04:51Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 98044-6c4cbd692695 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-fix-issue-745-reconciler-moot-lease-gate phase: claimed candidate_head: b00e09a7814ddb03072d1e09c1b13ae314779a11 target_branch: master target_branch_sha: b05075fd25ea7f3ac2e86d68f18a1a14c803962e last_activity: 2026-07-18T17:04:51Z expires_at: 2026-07-18T19:04:51Z blocker: none

sysadmin commented

2026-07-18 14:09:01 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 94371-23409093ddd1
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-independent-20260718T190733
phase: claimed
candidate_head: b00e09a781
target_branch: master
target_branch_sha: fdab6b6c69
last_activity: 2026-07-18T19:09:00Z
expires_at: 2026-07-18T19:19:00Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 94371-23409093ddd1 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-independent-20260718T190733 phase: claimed candidate_head: b00e09a7814ddb03072d1e09c1b13ae314779a11 target_branch: master target_branch_sha: fdab6b6c69717d32a0d50e233413cf09be83f6e8 last_activity: 2026-07-18T19:09:00Z expires_at: 2026-07-18T19:19:00Z blocker: none

sysadmin commented

2026-07-18 14:10:31 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 94371-23409093ddd1
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-independent-20260718T190733
phase: validating
candidate_head: b00e09a781
target_branch: master
target_branch_sha: fdab6b6c69
last_activity: 2026-07-18T19:10:31Z
expires_at: 2026-07-18T19:20:31Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 94371-23409093ddd1 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-independent-20260718T190733 phase: validating candidate_head: b00e09a7814ddb03072d1e09c1b13ae314779a11 target_branch: master target_branch_sha: fdab6b6c69717d32a0d50e233413cf09be83f6e8 last_activity: 2026-07-18T19:10:31Z expires_at: 2026-07-18T19:20:31Z blocker: none

sysadmin approved these changes 2026-07-18 14:12:24 -05:00

Dismissed

sysadmin left a comment

Canonical PR State

STATE:
approved

WHO_IS_NEXT:
merger

NEXT_ACTION:
Separate merger session adopts or acquires a merger lease and merges PR #746 at the approved head.

NEXT_PROMPT:

Merge PR #746 at head b00e09a7814ddb03072d1e09c1b13ae314779a11 after adopting or acquiring a merger lease. Do not re-review. Remote prgs org Scaled-Tech-Consulting repo Gitea-Tools.

WHAT_HAPPENED:
Independent gitea-reviewer session completed code review and validation of PR #746 (Closes #745) and is submitting APPROVE at the pinned head.

WHY:
The change correctly binds post-merge moot-lease cleanup apply to reconciler via exact-task resolve, independent role gate, append-only dry-run evidence, and repository binding. Assessment stays gitea.read for all roles by design. Scope matches #745; author/reviewer/merger cannot apply; merge into current master is clean.

ISSUE:
#745

BASE:
master

HEAD:
fix/issue-745-reconciler-moot-lease-gate

HEAD_SHA:
b00e09a781

REVIEW_STATUS:
approved / approval_at_current_head b00e09a781

VALIDATION:
Focused: tests/test_issue_745_moot_lease_reconciler_gate.py + tests/test_post_merge_moot_lease.py — 50 passed, 35 subtests. Targeted related suites — 378 passed, 181 subtests. git diff --check clean. merge simulation of b00e09a into prgs/master fdab6b6 automatic merge clean. Self-review check: author jcwalker3 != reviewer sysadmin.

MERGE_READY:
true — approved at HEAD_SHA b00e09a7814ddb03072d1e09c1b13ae314779a11; mergeable; no blockers for merger handoff

BLOCKERS:
none

NATIVE_REVIEW_PROOF:
transport=native_mcp; entrypoint=mcp_server; token_fingerprint=session-pid-88553; review_session=94371-23409093ddd1

LAST_UPDATED_BY:
sysadmin / prgs-reviewer / 2026-07-18T19:12Z

## Canonical PR State STATE: approved WHO_IS_NEXT: merger NEXT_ACTION: Separate merger session adopts or acquires a merger lease and merges PR #746 at the approved head. NEXT_PROMPT: ```text Merge PR #746 at head b00e09a7814ddb03072d1e09c1b13ae314779a11 after adopting or acquiring a merger lease. Do not re-review. Remote prgs org Scaled-Tech-Consulting repo Gitea-Tools. ``` WHAT_HAPPENED: Independent gitea-reviewer session completed code review and validation of PR #746 (Closes #745) and is submitting APPROVE at the pinned head. WHY: The change correctly binds post-merge moot-lease cleanup apply to reconciler via exact-task resolve, independent role gate, append-only dry-run evidence, and repository binding. Assessment stays gitea.read for all roles by design. Scope matches #745; author/reviewer/merger cannot apply; merge into current master is clean. ISSUE: #745 BASE: master HEAD: fix/issue-745-reconciler-moot-lease-gate HEAD_SHA: b00e09a7814ddb03072d1e09c1b13ae314779a11 REVIEW_STATUS: approved / approval_at_current_head b00e09a7814ddb03072d1e09c1b13ae314779a11 VALIDATION: Focused: tests/test_issue_745_moot_lease_reconciler_gate.py + tests/test_post_merge_moot_lease.py — 50 passed, 35 subtests. Targeted related suites — 378 passed, 181 subtests. git diff --check clean. merge simulation of b00e09a into prgs/master fdab6b6 automatic merge clean. Self-review check: author jcwalker3 != reviewer sysadmin. MERGE_READY: true — approved at HEAD_SHA b00e09a7814ddb03072d1e09c1b13ae314779a11; mergeable; no blockers for merger handoff BLOCKERS: none NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=session-pid-88553; review_session=94371-23409093ddd1 LAST_UPDATED_BY: sysadmin / prgs-reviewer / 2026-07-18T19:12Z

sysadmin commented

2026-07-18 14:13:27 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 94371-23409093ddd1
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-independent-20260718T190733
phase: released
candidate_head: b00e09a781
target_branch: master
target_branch_sha: fdab6b6c69
last_activity: 2026-07-18T19:13:27Z
expires_at: 2026-07-18T19:23:27Z
blocker: manual-release

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 94371-23409093ddd1 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-independent-20260718T190733 phase: released candidate_head: b00e09a7814ddb03072d1e09c1b13ae314779a11 target_branch: master target_branch_sha: fdab6b6c69717d32a0d50e233413cf09be83f6e8 last_activity: 2026-07-18T19:13:27Z expires_at: 2026-07-18T19:23:27Z blocker: manual-release

sysadmin commented

2026-07-18 14:17:12 -05:00

Contaminated formal review quarantine (#695)

Status: QUARANTINED — merge authorization VOID

review_id: 464
pr: #746
reviewed_head_sha: b00e09a7814ddb03072d1e09c1b13ae314779a11
actor: sysadmin
profile: prgs-reconciler
incident_issue: #695
reason: Contaminated reviewer workflow. The reviewer session that submitted this APPROVE (review_session 94371-23409093ddd1, token_fingerprint session-pid-88553) initially bound/resolved against the dadeschools remote, modified ~/.config/gitea-tools/profiles.json, and invoked profile rebind/switch behavior before approving PR #746. The review evidence chain is therefore untrusted regardless of whether its technical findings were correct. Forensic review object and comments retained; a fresh independent reviewer session is required at head b00e09a781.
created_at: 2026-07-18T19:17:11.993459+00:00
native_transport: True
native_token_fingerprint: 05c446d43548c1a9
forensic_comment_ids retained: []

This record does not delete Gitea reviews or historical comments. Fresh native-MCP re-review is required before merge.

## Contaminated formal review quarantine (#695) Status: **QUARANTINED — merge authorization VOID** - review_id: `464` - pr: `#746` - reviewed_head_sha: `b00e09a7814ddb03072d1e09c1b13ae314779a11` - actor: `sysadmin` - profile: `prgs-reconciler` - incident_issue: `#695` - reason: Contaminated reviewer workflow. The reviewer session that submitted this APPROVE (review_session 94371-23409093ddd1, token_fingerprint session-pid-88553) initially bound/resolved against the dadeschools remote, modified ~/.config/gitea-tools/profiles.json, and invoked profile rebind/switch behavior before approving PR #746. The review evidence chain is therefore untrusted regardless of whether its technical findings were correct. Forensic review object and comments retained; a fresh independent reviewer session is required at head b00e09a7814ddb03072d1e09c1b13ae314779a11. - created_at: `2026-07-18T19:17:11.993459+00:00` - native_transport: `True` - native_token_fingerprint: `05c446d43548c1a9` - forensic_comment_ids retained: `[]` This record does **not** delete Gitea reviews or historical comments. Fresh native-MCP re-review is required before merge.

sysadmin commented

2026-07-18 14:21:00 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 5266-a43db67d6a0c
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-fresh-rereview-20260718T192048
phase: claimed
candidate_head: b00e09a781
target_branch: master
target_branch_sha: fdab6b6c69
last_activity: 2026-07-18T19:21:00Z
expires_at: 2026-07-18T19:31:00Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 5266-a43db67d6a0c worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-fresh-rereview-20260718T192048 phase: claimed candidate_head: b00e09a7814ddb03072d1e09c1b13ae314779a11 target_branch: master target_branch_sha: fdab6b6c69717d32a0d50e233413cf09be83f6e8 last_activity: 2026-07-18T19:21:00Z expires_at: 2026-07-18T19:31:00Z blocker: none

sysadmin commented

2026-07-18 14:23:05 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 5266-a43db67d6a0c
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-fresh-rereview-20260718T192048
phase: validating
candidate_head: b00e09a781
target_branch: master
target_branch_sha: fdab6b6c69
last_activity: 2026-07-18T19:23:05Z
expires_at: 2026-07-18T19:33:05Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 5266-a43db67d6a0c worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-fresh-rereview-20260718T192048 phase: validating candidate_head: b00e09a7814ddb03072d1e09c1b13ae314779a11 target_branch: master target_branch_sha: fdab6b6c69717d32a0d50e233413cf09be83f6e8 last_activity: 2026-07-18T19:23:05Z expires_at: 2026-07-18T19:33:05Z blocker: none

sysadmin commented

2026-07-18 14:25:36 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 5266-a43db67d6a0c
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-fresh-rereview-20260718T192048
phase: deciding
candidate_head: b00e09a781
target_branch: master
target_branch_sha: fdab6b6c69
last_activity: 2026-07-18T19:25:35Z
expires_at: 2026-07-18T19:35:35Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 5266-a43db67d6a0c worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-fresh-rereview-20260718T192048 phase: deciding candidate_head: b00e09a7814ddb03072d1e09c1b13ae314779a11 target_branch: master target_branch_sha: fdab6b6c69717d32a0d50e233413cf09be83f6e8 last_activity: 2026-07-18T19:25:35Z expires_at: 2026-07-18T19:35:35Z blocker: none

sysadmin commented

2026-07-18 14:26:06 -05:00

Review correction authorization audit (#693)

Status: AUTHORIZED

actor: sysadmin
profile: prgs-reviewer
timestamp: 2026-07-18T19:26:06.371973+00:00
prior_review_id: 464
prior_review_state: approve
target_pr: #746
target_head_sha: b00e09a7814ddb03072d1e09c1b13ae314779a11
reason: Controller-quarantined contaminated formal review #464 on PR #746 (audit comment 12557 / #695). Merge authorization is void; operator jasonwalker explicitly ordered a fresh independent gitea-reviewer re-review at head b00e09a781. Correction authorizes one clean re-mark/submit only; quarantine forensic record retained.
scope: same_pr_head_only (cannot unlock a different PR)

This is not a generic decision-lock unlock. Cross-PR recovery uses isolation (#693) or moot cleanup (#594), never correction.

## Review correction authorization audit (#693) Status: **AUTHORIZED** - actor: `sysadmin` - profile: `prgs-reviewer` - timestamp: `2026-07-18T19:26:06.371973+00:00` - prior_review_id: `464` - prior_review_state: `approve` - target_pr: `#746` - target_head_sha: `b00e09a7814ddb03072d1e09c1b13ae314779a11` - reason: Controller-quarantined contaminated formal review #464 on PR #746 (audit comment 12557 / #695). Merge authorization is void; operator jasonwalker explicitly ordered a fresh independent gitea-reviewer re-review at head b00e09a7814ddb03072d1e09c1b13ae314779a11. Correction authorizes one clean re-mark/submit only; quarantine forensic record retained. - scope: `same_pr_head_only` (cannot unlock a different PR) This is **not** a generic decision-lock unlock. Cross-PR recovery uses isolation (#693) or moot cleanup (#594), never correction.

sysadmin approved these changes 2026-07-18 14:26:25 -05:00

Dismissed

sysadmin left a comment

Fresh independent re-review (post-quarantine of #464)

STATE:
approved

WHO_IS_NEXT:
merger

NEXT_ACTION:
Separate merger session adopts or acquires a merger lease and merges PR #746 at the approved head. Do not re-review. Do not count quarantined review #464.

NEXT_PROMPT:

Merge PR #746 at head b00e09a7814ddb03072d1e09c1b13ae314779a11 after adopting or acquiring a merger lease. Contaminated review #464 is void. Remote prgs org Scaled-Tech-Consulting repo Gitea-Tools.

WHAT_HAPPENED:
Fresh gitea-reviewer session (sysadmin / prgs-reviewer / reviewer, remote=prgs only; no profile rebind) completed an independent re-review of PR #746 at head b00e09a after controller quarantine voided contaminated review #464.

WHY:
All acceptance criteria for #745 are met:

Canonical task cleanup_post_merge_moot_lease and alias gitea_cleanup_post_merge_moot_lease map identically to gitea.pr.comment + reconciler (task_capability_map + role_session_router RECONCILER_TASKS/TASK_REQUIRED_ROLE).
Author/reviewer/merger cannot resolve or apply the cleanup mutation (role gate independent of permission).
apply=false is genuinely read-only under gitea.read, intentional cross-role diagnostic; dry-run ledger append-only with copy isolation.
apply=true requires exact cleanup task resolution, reconciler role, gitea.pr.comment, immutable repository/root/workspace binding via _bound_repository_slug + _repository_binding_block + verify_preflight_purity(task/org/repo/worktree), and matching dry-run evidence.
Dry-run evidence is session-local and fails closed across PR/session/head/marker/repo mismatch or supersession.
6–7. Only genuinely moot merged/closed leases finalize; non-moot/superseded/malformed/foreign fail closed.
Cleanup is append-only (POST terminal marker) and already-terminal is idempotent.
_delete_branch_repository_binding_block retained as thin safe alias of generalized _repository_binding_block.
PR #748 10-minute TTL changes touch overlapping gitea_mcp_server.py only; automatic merge into master fdab6b6 is clean; no TTL conflict.
Scope is exactly the seven declared files; docs profile section is documentation only — no credentials/launchers/config mutation.

ISSUE: #745
BASE: master @ fdab6b6c69
HEAD: fix/issue-745-reconciler-moot-lease-gate
HEAD_SHA: b00e09a781

REVIEW_STATUS:
approved at current head (fresh session; #464 quarantined/void)

VALIDATION:

moot modules: 50 passed, 35 subtests
targeted suites (router/resolver/capability-invariants/anti-stomp/lease/reconciler/canonical-root/workflow): 310 passed, 145 subtests
full suite on PR head: 3448 passed, 6 skipped, 2 failed, 400 subtests
same 2 failures reproduce on current master (pre-existing; not introduced by this PR)
git diff --check: clean
merge simulation into fdab6b6: automatic merge clean
Self-review: author jcwalker3 != reviewer sysadmin

CONTAMINATED PRIOR:
review #464 quarantined; audit 12557; must not count toward eligibility

MERGE_READY:
true — fresh APPROVE at HEAD_SHA b00e09a…; mergeable; hand off to separate merger

BLOCKERS:
none

NATIVE_REVIEW_PROOF:
transport=native_mcp; entrypoint=mcp_server; token_fingerprint=30e0655c5dd62772; review_session=5266-a43db67d6a0c; remote=prgs; profile=prgs-reviewer; role=reviewer; operator=jasonwalker UID=502

Workflow-load helper result:

workflow_hash: 263d0a6cb8a6
final_report_schema_hash: a7634e7b8689
boundary_status: clean

LAST_UPDATED_BY:
sysadmin / prgs-reviewer / fresh session 5266-a43db67d6a0c

## Fresh independent re-review (post-quarantine of #464) STATE: approved WHO_IS_NEXT: merger NEXT_ACTION: Separate merger session adopts or acquires a merger lease and merges PR #746 at the approved head. Do not re-review. Do not count quarantined review #464. NEXT_PROMPT: ```text Merge PR #746 at head b00e09a7814ddb03072d1e09c1b13ae314779a11 after adopting or acquiring a merger lease. Contaminated review #464 is void. Remote prgs org Scaled-Tech-Consulting repo Gitea-Tools. ``` WHAT_HAPPENED: Fresh gitea-reviewer session (sysadmin / prgs-reviewer / reviewer, remote=prgs only; no profile rebind) completed an independent re-review of PR #746 at head b00e09a after controller quarantine voided contaminated review #464. WHY: All acceptance criteria for #745 are met: 1. Canonical task `cleanup_post_merge_moot_lease` and alias `gitea_cleanup_post_merge_moot_lease` map identically to `gitea.pr.comment` + `reconciler` (task_capability_map + role_session_router RECONCILER_TASKS/TASK_REQUIRED_ROLE). 2. Author/reviewer/merger cannot resolve or apply the cleanup mutation (role gate independent of permission). 3. `apply=false` is genuinely read-only under `gitea.read`, intentional cross-role diagnostic; dry-run ledger append-only with copy isolation. 4. `apply=true` requires exact cleanup task resolution, reconciler role, `gitea.pr.comment`, immutable repository/root/workspace binding via `_bound_repository_slug` + `_repository_binding_block` + `verify_preflight_purity(task/org/repo/worktree)`, and matching dry-run evidence. 5. Dry-run evidence is session-local and fails closed across PR/session/head/marker/repo mismatch or supersession. 6–7. Only genuinely moot merged/closed leases finalize; non-moot/superseded/malformed/foreign fail closed. 8. Cleanup is append-only (POST terminal marker) and already-terminal is idempotent. 9. `_delete_branch_repository_binding_block` retained as thin safe alias of generalized `_repository_binding_block`. 10. PR #748 10-minute TTL changes touch overlapping `gitea_mcp_server.py` only; automatic merge into master `fdab6b6` is clean; no TTL conflict. 11. Scope is exactly the seven declared files; docs profile section is documentation only — no credentials/launchers/config mutation. ISSUE: #745 BASE: master @ fdab6b6c69717d32a0d50e233413cf09be83f6e8 HEAD: fix/issue-745-reconciler-moot-lease-gate HEAD_SHA: b00e09a7814ddb03072d1e09c1b13ae314779a11 REVIEW_STATUS: approved at current head (fresh session; #464 quarantined/void) VALIDATION: - moot modules: 50 passed, 35 subtests - targeted suites (router/resolver/capability-invariants/anti-stomp/lease/reconciler/canonical-root/workflow): 310 passed, 145 subtests - full suite on PR head: 3448 passed, 6 skipped, 2 failed, 400 subtests - same 2 failures reproduce on current master (pre-existing; not introduced by this PR) - git diff --check: clean - merge simulation into fdab6b6: automatic merge clean - Self-review: author jcwalker3 != reviewer sysadmin CONTAMINATED PRIOR: review #464 quarantined; audit 12557; must not count toward eligibility MERGE_READY: true — fresh APPROVE at HEAD_SHA b00e09a…; mergeable; hand off to separate merger BLOCKERS: none NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=30e0655c5dd62772; review_session=5266-a43db67d6a0c; remote=prgs; profile=prgs-reviewer; role=reviewer; operator=jasonwalker UID=502 Workflow-load helper result: - workflow_hash: 263d0a6cb8a6 - final_report_schema_hash: a7634e7b8689 - boundary_status: clean LAST_UPDATED_BY: sysadmin / prgs-reviewer / fresh session 5266-a43db67d6a0c

sysadmin commented

2026-07-18 14:26:41 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 5266-a43db67d6a0c
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-fresh-rereview-20260718T192048
phase: released
candidate_head: b00e09a781
target_branch: master
target_branch_sha: fdab6b6c69
last_activity: 2026-07-18T19:26:40Z
expires_at: 2026-07-18T19:36:40Z
blocker: manual-release

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 5266-a43db67d6a0c worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746-fresh-rereview-20260718T192048 phase: released candidate_head: b00e09a7814ddb03072d1e09c1b13ae314779a11 target_branch: master target_branch_sha: fdab6b6c69717d32a0d50e233413cf09be83f6e8 last_activity: 2026-07-18T19:26:40Z expires_at: 2026-07-18T19:36:40Z blocker: manual-release

jcwalker3 referenced this pull request

2026-07-18 15:19:39 -05:00

fix(mcp): allow create_issue from clean control checkout (Closes #749) #750

sysadmin referenced this pull request

2026-07-18 15:36:22 -05:00

fix(mcp): allow create_issue from clean control checkout (Closes #749) #750

jcwalker3 added 1 commit 2026-07-18 17:19:42 -05:00

Merge branch 'master' into fix/issue-745-reconciler-moot-lease-gate 03c64a3219

jcwalker3 referenced this pull request

2026-07-18 17:34:47 -05:00

fix(mcp): derive checks requirement from live branch protection (Closes #751) #752

jcwalker3 referenced this pull request

2026-07-18 18:33:05 -05:00

fix(mcp): allow author-lock recovery after the owning session exits (Closes #753) #754

jcwalker3 referenced this pull request

2026-07-18 18:35:39 -05:00

Allow safe author-lock recovery after the owning MCP session exits #753

jcwalker3 referenced this pull request

2026-07-18 20:51:23 -05:00

fix(mcp): let a sanctioned recovery keep its own owning PR (Closes #755) #756

jcwalker3 referenced this pull request

2026-07-18 20:54:43 -05:00

fix(mcp): let a sanctioned recovery keep its own owning PR (Closes #755) #756

jcwalker3 referenced this pull request

2026-07-18 21:22:34 -05:00

fix(mcp): allow create_issue from clean control checkout (Closes #749) #750

sysadmin referenced this pull request

2026-07-18 21:31:17 -05:00

fix(mcp): allow create_issue from clean control checkout (Closes #749) #750

jcwalker3 added 1 commit 2026-07-18 21:45:51 -05:00

Merge branch 'master' into fix/issue-745-reconciler-moot-lease-gate a517655aad

jcwalker3 commented

2026-07-18 21:51:59 -05:00

Canonical Issue State

STATE:
open — PR #746 reconciled to the live base; it carries no review verdict at the current exact head.

WHO_IS_NEXT:
reviewer

NEXT_ACTION:
A fresh independent prgs-reviewer session performs a full review of PR #746 pinned to exact head a517655aade8641afa516016dc5474c2de093a0b.

NEXT_PROMPT:

Review PR #746 at exact head a517655aade8641afa516016dc5474c2de093a0b. Remote prgs, org Scaled-Tech-Consulting, repo Gitea-Tools. Review verdicts 464 (quarantined) and 465 both pin the former head b00e09a7814ddb03072d1e09c1b13ae314779a11 and carry no authority at the current head. Do not merge.

WHAT_HAPPENED:
An author session (prgs-author / jcwalker3) recovered dead-session ownership of issue #745 and reconciled PR #746 onto the live base by merge.

Runtime commissioning: all four MCP namespaces report startup_head == current_head == 447595b72ba02037db914797bd9ce8dd91fd4028, in_parity=true, no restart requirement, each bound to Scaled-Tech-Consulting/Gitea-Tools (author jcwalker3 / prgs-author; reviewer sysadmin / prgs-reviewer; merger sysadmin / prgs-merger; reconciler sysadmin / prgs-reconciler).
Ownership: the durable author lock for issue #745 named the exact branch, worktree and claimant, but its recorded pid 45054 was dead and its lease had lapsed. Native gitea_lock_issue returned RECOVERY_SANCTIONED dead-session recovery under the #753/#755 server-derived path, retaining the owning PR #746.
Update: native gitea_update_pr_branch_by_merge performed an update-by-merge of base master 447595b… into fix/issue-745-reconciler-moot-lease-gate. merge result: former head 03c64a3219946d10ab965bacffbe10b516f2adc4 → new head a517655aade8641afa516016dc5474c2de093a0b. Style merge only; no rebase, no force-push, no conflict.

WHY:
PR #746 stood 9 commits behind the live base while branch protection required a current base, so the sanctioned assessor recommended update_branch_by_merge. The head change invalidates every former-head review verdict by construction, so the exact new head must go to an independent reviewer.

RELATED_PRS:

#746 — this PR, open at head a517655…
#748 — #747 sliding lease TTL, landed on master
#750 — #749 create-issue bootstrap, landed on master
#754 — #753 dead-pid author-lock recovery, landed on master
#756 — #755 owning-PR recovery, landed on master

BLOCKERS:
none

VALIDATION:

Focused tests/test_issue_745_moot_lease_reconciler_gate.py + tests/test_post_merge_moot_lease.py — 50 passed, 35 subtests passed.
#749/#751/#753/#755 regression suites — 127 passed.
Capability-map, resolver, router, reconciler, delete-branch, anti-stomp preflight, workspace-repo forwarding, lease-lifecycle, reviewer-lease, #691 and #747 suites — 209 passed, 36 subtests passed.
Full suite on the new head — 3586 passed, 6 skipped, 2 failed, 400 subtests passed.
The same 2 failures reproduce on a clean detached worktree at pristine master 447595b72ba02037db914797bd9ce8dd91fd4028, so they are pre-existing and not introduced here: tests/test_issue_702_review_findings_f1_f6.py::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probe and tests/test_reconciler_supersession_close.py::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue.
git diff --check against the base — clean, no whitespace errors.
Syntax/static: py_compile and import checks pass on every PR-changed module; both cleanup_post_merge_moot_lease and its gitea_ alias resolve to gitea.pr.comment + reconciler.
PR-only diff scope against the base is exactly #745's seven declared files (docs/gitea-execution-profiles.md, gitea_mcp_server.py, post_merge_moot_lease_gate.py, role_session_router.py, task_capability_map.py, tests/test_issue_745_moot_lease_reconciler_gate.py, tests/test_post_merge_moot_lease.py). It neither duplicates nor reverts any recently landed fix.

LAST_UPDATED_BY:
jcwalker3 / prgs-author / author reconciliation session, pid 88692

[THREAD STATE LEDGER]

What is true now

Server-side decision state: PR #746 is in open state at exact head a517655aade8641afa516016dc5474c2de093a0b, base master 447595b72ba02037db914797bd9ce8dd91fd4028, 0 commits behind, mergeable=true, no conflicts, checks live-derived as not_required (live branch protection does not require status contexts for the base branch). There is no reviewer lease and no merger lease. The author issue lock for #745 is live. Review verdict 464 is quarantined; review verdict 465 is stale; approval_at_current_head=false and quarantined_approvals_at_current_head=0, so no review verdict carries merge authority at the current head.

Local verdict/state: author reconciliation is complete. The session-owned worktree branches/fix-issue-745-reconciler-moot-lease-gate is clean and its head equals the remote branch head, which equals the PR head.

What changed

Ownership moved from a dead prior session to this one by sanctioned dead-session recovery, and the PR branch advanced from the live base. merge result: former head 03c64a3219946d10ab965bacffbe10b516f2adc4 → new head a517655aade8641afa516016dc5474c2de093a0b. No source file authored by #745 was edited in this session; the only content change is the base merge commit.

What is blocked

Blocker classification: no blocker

Nothing prevents the next step. Merge authority is absent purely because the head advanced, which is the expected consequence of reconciliation rather than a fault.

Who/what acts next

Next actor: reviewer — a fresh independent prgs-reviewer session.

Required action: perform a full independent review of PR #746 pinned to exact head a517655aade8641afa516016dc5474c2de093a0b, then record a formal review verdict through the review API.

Do not do: do not reuse review verdicts 464 or 465, and do not count quarantined verdict 464 toward eligibility; do not merge at any former head; do not rebase, reset, amend, squash, cherry-pick or force-push this branch; do not treat this author session as a review.

Server-side mutation ledger:

gitea_lock_issue — recovered the dead-session author lock for issue #745 (prior pid 45054 dead → replacement session pid 88692), retaining owning PR #746.
gitea_update_pr_branch_by_merge — update-by-merge of base master 447595b… into fix/issue-745-reconciler-moot-lease-gate; merge result: 03c64a3… → a517655….
gitea_create_issue_comment — this handoff comment.

## Canonical Issue State STATE: open — PR #746 reconciled to the live base; it carries no review verdict at the current exact head. WHO_IS_NEXT: reviewer NEXT_ACTION: A fresh independent prgs-reviewer session performs a full review of PR #746 pinned to exact head `a517655aade8641afa516016dc5474c2de093a0b`. NEXT_PROMPT: ```text Review PR #746 at exact head a517655aade8641afa516016dc5474c2de093a0b. Remote prgs, org Scaled-Tech-Consulting, repo Gitea-Tools. Review verdicts 464 (quarantined) and 465 both pin the former head b00e09a7814ddb03072d1e09c1b13ae314779a11 and carry no authority at the current head. Do not merge. ``` WHAT_HAPPENED: An author session (prgs-author / jcwalker3) recovered dead-session ownership of issue #745 and reconciled PR #746 onto the live base by merge. 1. Runtime commissioning: all four MCP namespaces report `startup_head == current_head == 447595b72ba02037db914797bd9ce8dd91fd4028`, `in_parity=true`, no restart requirement, each bound to `Scaled-Tech-Consulting/Gitea-Tools` (author `jcwalker3 / prgs-author`; reviewer `sysadmin / prgs-reviewer`; merger `sysadmin / prgs-merger`; reconciler `sysadmin / prgs-reconciler`). 2. Ownership: the durable author lock for issue #745 named the exact branch, worktree and claimant, but its recorded pid 45054 was dead and its lease had lapsed. Native `gitea_lock_issue` returned `RECOVERY_SANCTIONED` dead-session recovery under the #753/#755 server-derived path, retaining the owning PR #746. 3. Update: native `gitea_update_pr_branch_by_merge` performed an update-by-merge of base master `447595b…` into `fix/issue-745-reconciler-moot-lease-gate`. merge result: former head `03c64a3219946d10ab965bacffbe10b516f2adc4` → new head `a517655aade8641afa516016dc5474c2de093a0b`. Style merge only; no rebase, no force-push, no conflict. WHY: PR #746 stood 9 commits behind the live base while branch protection required a current base, so the sanctioned assessor recommended `update_branch_by_merge`. The head change invalidates every former-head review verdict by construction, so the exact new head must go to an independent reviewer. RELATED_PRS: - #746 — this PR, open at head `a517655…` - #748 — #747 sliding lease TTL, landed on master - #750 — #749 create-issue bootstrap, landed on master - #754 — #753 dead-pid author-lock recovery, landed on master - #756 — #755 owning-PR recovery, landed on master BLOCKERS: none VALIDATION: - Focused `tests/test_issue_745_moot_lease_reconciler_gate.py` + `tests/test_post_merge_moot_lease.py` — 50 passed, 35 subtests passed. - #749/#751/#753/#755 regression suites — 127 passed. - Capability-map, resolver, router, reconciler, delete-branch, anti-stomp preflight, workspace-repo forwarding, lease-lifecycle, reviewer-lease, #691 and #747 suites — 209 passed, 36 subtests passed. - Full suite on the new head — 3586 passed, 6 skipped, 2 failed, 400 subtests passed. - The same 2 failures reproduce on a clean detached worktree at pristine master `447595b72ba02037db914797bd9ce8dd91fd4028`, so they are pre-existing and not introduced here: `tests/test_issue_702_review_findings_f1_f6.py::TestF1RecoveryBeforeTerminalProbe::test_removed_worktree_recovers_before_probe` and `tests/test_reconciler_supersession_close.py::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue`. - `git diff --check` against the base — clean, no whitespace errors. - Syntax/static: `py_compile` and import checks pass on every PR-changed module; both `cleanup_post_merge_moot_lease` and its `gitea_` alias resolve to `gitea.pr.comment` + `reconciler`. - PR-only diff scope against the base is exactly #745's seven declared files (`docs/gitea-execution-profiles.md`, `gitea_mcp_server.py`, `post_merge_moot_lease_gate.py`, `role_session_router.py`, `task_capability_map.py`, `tests/test_issue_745_moot_lease_reconciler_gate.py`, `tests/test_post_merge_moot_lease.py`). It neither duplicates nor reverts any recently landed fix. LAST_UPDATED_BY: jcwalker3 / prgs-author / author reconciliation session, pid 88692 [THREAD STATE LEDGER] **What is true now** Server-side decision state: PR #746 is in open state at exact head `a517655aade8641afa516016dc5474c2de093a0b`, base master `447595b72ba02037db914797bd9ce8dd91fd4028`, 0 commits behind, `mergeable=true`, no conflicts, checks live-derived as `not_required` (live branch protection does not require status contexts for the base branch). There is no reviewer lease and no merger lease. The author issue lock for #745 is live. Review verdict 464 is quarantined; review verdict 465 is stale; `approval_at_current_head=false` and `quarantined_approvals_at_current_head=0`, so no review verdict carries merge authority at the current head. Local verdict/state: author reconciliation is complete. The session-owned worktree `branches/fix-issue-745-reconciler-moot-lease-gate` is clean and its head equals the remote branch head, which equals the PR head. **What changed** Ownership moved from a dead prior session to this one by sanctioned dead-session recovery, and the PR branch advanced from the live base. merge result: former head `03c64a3219946d10ab965bacffbe10b516f2adc4` → new head `a517655aade8641afa516016dc5474c2de093a0b`. No source file authored by #745 was edited in this session; the only content change is the base merge commit. **What is blocked** Blocker classification: no blocker Nothing prevents the next step. Merge authority is absent purely because the head advanced, which is the expected consequence of reconciliation rather than a fault. **Who/what acts next** Next actor: reviewer — a fresh independent prgs-reviewer session. Required action: perform a full independent review of PR #746 pinned to exact head `a517655aade8641afa516016dc5474c2de093a0b`, then record a formal review verdict through the review API. Do not do: do not reuse review verdicts 464 or 465, and do not count quarantined verdict 464 toward eligibility; do not merge at any former head; do not rebase, reset, amend, squash, cherry-pick or force-push this branch; do not treat this author session as a review. Server-side mutation ledger: - `gitea_lock_issue` — recovered the dead-session author lock for issue #745 (prior pid 45054 dead → replacement session pid 88692), retaining owning PR #746. - `gitea_update_pr_branch_by_merge` — update-by-merge of base master `447595b…` into `fix/issue-745-reconciler-moot-lease-gate`; merge result: `03c64a3…` → `a517655…`. - `gitea_create_issue_comment` — this handoff comment.

sysadmin commented

2026-07-18 21:56:28 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 17652-0dcbbdd9a409
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746
phase: claimed
candidate_head: a517655aad
target_branch: master
target_branch_sha: 447595b72b
last_activity: 2026-07-19T02:56:27Z
expires_at: 2026-07-19T03:06:27Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 17652-0dcbbdd9a409 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746 phase: claimed candidate_head: a517655aade8641afa516016dc5474c2de093a0b target_branch: master target_branch_sha: 447595b72ba02037db914797bd9ce8dd91fd4028 last_activity: 2026-07-19T02:56:27Z expires_at: 2026-07-19T03:06:27Z blocker: none

sysadmin approved these changes 2026-07-18 22:00:10 -05:00

sysadmin left a comment

Canonical PR State

STATE:
approved

WHO_IS_NEXT:
merger

NEXT_ACTION:
Fresh prgs-merger session merges PR #746 at the approved head. Do not re-review. Do not count reviews #464 or #465.

NEXT_PROMPT:

Merge PR #746 at exact head a517655aade8641afa516016dc5474c2de093a0b after adopting or acquiring a merger lease. Remote prgs, org Scaled-Tech-Consulting, repo Gitea-Tools. Prior reviews #464 (quarantined) and #465 (stale at b00e09a) carry no merge authority.

WHAT_HAPPENED:
Fresh independent Grok gitea-reviewer session (sysadmin / prgs-reviewer / reviewer) completed full preflight, lease acquisition, code review, and validation of PR #746 (Closes #745) at exact head a517655aad on base 447595b72b.

WHY:
All issue #745 acceptance criteria are satisfied with no material defects. Post-merge moot-lease cleanup apply is bound to reconciler via exact-task resolve, independent role gate, append-only dry-run evidence, and repository binding. Assessment stays gitea.read for all roles by design. Author/reviewer/merger cannot apply. Open-PR leases cannot be cleaned. Scope is exactly seven files; #749/#751/#753/#755 behavior is not weakened.

ISSUE:
#745

HEAD_SHA:
a517655aad

REVIEW_STATUS:
approved at current head a517655aad (fresh session; #464 quarantined/void; #465 stale at b00e09a)

MERGE_READY:
true — APPROVE pinned to HEAD_SHA a517655aade8641afa516016dc5474c2de093a0b; open; mergeable; 0 behind base; checks not_required

BLOCKERS:
none

VALIDATION:

Focused #745/#746: 50 passed, 35 subtests
Capability/router/reconciler/lease/canonical-root suites: 330 passed, 130 subtests
#747/#749/#751/#753/#755 regressions: 137 passed
git diff --check: clean
py_compile/ast on all PR modules: OK
Self-review: author jcwalker3 != reviewer sysadmin

LAST_UPDATED_BY:
sysadmin / prgs-reviewer / Grok independent review session 17652-0dcbbdd9a409

NATIVE_REVIEW_PROOF:
transport=native_mcp; entrypoint=mcp_server; review_session=17652-0dcbbdd9a409; lease_comment_id=12779; remote=prgs; profile=prgs-reviewer; role=reviewer; operator=jasonwalker UID=502; workflow_hash=263d0a6cb8a6

## Canonical PR State STATE: approved WHO_IS_NEXT: merger NEXT_ACTION: Fresh prgs-merger session merges PR #746 at the approved head. Do not re-review. Do not count reviews #464 or #465. NEXT_PROMPT: ```text Merge PR #746 at exact head a517655aade8641afa516016dc5474c2de093a0b after adopting or acquiring a merger lease. Remote prgs, org Scaled-Tech-Consulting, repo Gitea-Tools. Prior reviews #464 (quarantined) and #465 (stale at b00e09a) carry no merge authority. ``` WHAT_HAPPENED: Fresh independent Grok gitea-reviewer session (sysadmin / prgs-reviewer / reviewer) completed full preflight, lease acquisition, code review, and validation of PR #746 (Closes #745) at exact head a517655aade8641afa516016dc5474c2de093a0b on base 447595b72ba02037db914797bd9ce8dd91fd4028. WHY: All issue #745 acceptance criteria are satisfied with no material defects. Post-merge moot-lease cleanup apply is bound to reconciler via exact-task resolve, independent role gate, append-only dry-run evidence, and repository binding. Assessment stays gitea.read for all roles by design. Author/reviewer/merger cannot apply. Open-PR leases cannot be cleaned. Scope is exactly seven files; #749/#751/#753/#755 behavior is not weakened. ISSUE: #745 HEAD_SHA: a517655aade8641afa516016dc5474c2de093a0b REVIEW_STATUS: approved at current head a517655aade8641afa516016dc5474c2de093a0b (fresh session; #464 quarantined/void; #465 stale at b00e09a) MERGE_READY: true — APPROVE pinned to HEAD_SHA a517655aade8641afa516016dc5474c2de093a0b; open; mergeable; 0 behind base; checks not_required BLOCKERS: none VALIDATION: - Focused #745/#746: 50 passed, 35 subtests - Capability/router/reconciler/lease/canonical-root suites: 330 passed, 130 subtests - #747/#749/#751/#753/#755 regressions: 137 passed - git diff --check: clean - py_compile/ast on all PR modules: OK - Self-review: author jcwalker3 != reviewer sysadmin LAST_UPDATED_BY: sysadmin / prgs-reviewer / Grok independent review session 17652-0dcbbdd9a409 NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; review_session=17652-0dcbbdd9a409; lease_comment_id=12779; remote=prgs; profile=prgs-reviewer; role=reviewer; operator=jasonwalker UID=502; workflow_hash=263d0a6cb8a6

sysadmin commented

2026-07-18 22:00:38 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 17652-0dcbbdd9a409
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746
phase: released
candidate_head: a517655aad
target_branch: master
target_branch_sha: 447595b72b
last_activity: 2026-07-19T03:00:38Z
expires_at: 2026-07-19T03:10:38Z
blocker: manual-release

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 17652-0dcbbdd9a409 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-746 phase: released candidate_head: a517655aade8641afa516016dc5474c2de093a0b target_branch: master target_branch_sha: 447595b72ba02037db914797bd9ce8dd91fd4028 last_activity: 2026-07-19T03:00:38Z expires_at: 2026-07-19T03:10:38Z blocker: manual-release

sysadmin commented

2026-07-18 22:04:30 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-merger
session_id: 22528-3bf57c19fb60
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merge-pr-746-a517655
phase: claimed
candidate_head: a517655aad
target_branch: master
target_branch_sha: 447595b72b
last_activity: 2026-07-19T03:04:30Z
expires_at: 2026-07-19T03:14:30Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-merger session_id: 22528-3bf57c19fb60 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merge-pr-746-a517655 phase: claimed candidate_head: a517655aade8641afa516016dc5474c2de093a0b target_branch: master target_branch_sha: 447595b72ba02037db914797bd9ce8dd91fd4028 last_activity: 2026-07-19T03:04:30Z expires_at: 2026-07-19T03:14:30Z blocker: none

sysadmin merged commit bde5c5fb20 into master

2026-07-18 22:04:43 -05:00

sysadmin commented

2026-07-18 22:04:44 -05:00

Stale #332 review-decision lock cleanup (#594)

Status: APPLIED

actor: sysadmin
profile: prgs-merger
timestamp: 2026-07-19T03:04:44.357902+00:00
last terminal: approve on PR fix(mcp): bind post-merge moot-lease cleanup to the reconciler capability (Closes #745) (#746)
PR state: closed (merged=True)
merge_commit_sha: bde5c5fb20fbf6aec9cd6b802341c43078921d13
prior live_mutations_count: 1
prior profile_identity: prgs-reviewer

Manual deletion of session-state files is not the workflow.
This path only clears a lock when the referenced PR is merged/closed.

## Stale #332 review-decision lock cleanup (#594) Status: **APPLIED** - actor: `sysadmin` - profile: `prgs-merger` - timestamp: `2026-07-19T03:04:44.357902+00:00` - last terminal: `approve` on PR #746 - PR state: `closed` (merged=True) - merge_commit_sha: `bde5c5fb20fbf6aec9cd6b802341c43078921d13` - prior live_mutations_count: `1` - prior profile_identity: `prgs-reviewer` Manual deletion of session-state files is **not** the workflow. This path only clears a lock when the referenced PR is merged/closed.

sysadmin commented

2026-07-18 22:09:09 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #746
issue: #745
reviewer_identity: sysadmin
profile: prgs-merger
session_id: 22528-3bf57c19fb60
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merge-pr-746-a517655
phase: released
candidate_head: a517655aad
target_branch: master
target_branch_sha: 447595b72b
last_activity: 2026-07-19T03:09:08Z
expires_at: 2026-07-19T03:19:08Z
blocker: post-merge-moot

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #746 issue: #745 reviewer_identity: sysadmin profile: prgs-merger session_id: 22528-3bf57c19fb60 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merge-pr-746-a517655 phase: released candidate_head: a517655aade8641afa516016dc5474c2de093a0b target_branch: master target_branch_sha: 447595b72ba02037db914797bd9ce8dd91fd4028 last_activity: 2026-07-19T03:09:08Z expires_at: 2026-07-19T03:19:08Z blocker: post-merge-moot

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#746