Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 68 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Reviewer lease acquisition rejects canonical preflight order #763

New Issue
Closed
opened 2026-07-19 15:13:11 -05:00 by jcwalker3 · 3 comments
jcwalker3 commented 2026-07-19 15:13:11 -05:00
Owner
Copy Link
Copy Source

Summary

gitea_acquire_reviewer_pr_lease fails closed with a deterministic, non-retryable preflight_order_violation even when the documented reviewer preflight sequence is green end-to-end.

This is a workflow tooling defect discovered while attempting formal review of PR #762 (issue #605). It is not implementation work for #605.

Affected review

Field Value
PR #762
Linked issue #605
Required head 7f2b9f36de4fa958e43fcee36e07b36e4cb53759
Intended profile prgs-reviewer / sysadmin
Workflow review-merge-pr.md
Workflow hash 263d0a6cb8a6
Control master 8a851eb87e63fc236d8897ed67f67cbe295bc3ae

Observed behavior

The following canonical sequence fails deterministically:

  1. gitea_whoami(remote=prgs) returns identity_match=true.
  2. gitea_resolve_task_capability(task=review_pr) returns:
    • allowed_in_current_session=true
    • valid workflow proof
    • exact_safe_next_action="None; ready for operations."
  3. gitea_acquire_reviewer_pr_lease(...) refuses with:
    • reason_code=preflight_order_violation
    • error_class=precondition
    • retryable=false

The failure reproduced after repeating the complete identity-to-capability sequence with no intervening call.

Additional schema inconsistency

  • gitea_acquire_reviewer_pr_lease accepts worktree.
  • Related runtime and capability tools expose or use worktree_path.
  • The first call using worktree_path was rejected before API mutation.
  • After correcting the parameter and repeating preflight once, the order gate still refused.

Proven green conditions

  • reviewer identity sysadmin
  • profile prgs-reviewer
  • role reviewer
  • identity_match=true
  • repository Scaled-Tech-Consulting/Gitea-Tools
  • runtime/local/live master 8a851eb87e63fc236d8897ed67f67cbe295bc3ae
  • in_parity=true
  • restart_required=false
  • namespace healthy
  • ide_namespace_proven=true
  • workflow hash 263d0a6cb8a6
  • boundary clean
  • review worktree clean and pinned
  • PR head unchanged (7f2b9f36de4fa958e43fcee36e07b36e4cb53759)
  • no competing reviewer lease
  • no Gitea mutation occurred

Exact recorded reproduction signature

signature=reviewer_lease_preflight_order_violation_v1
tool=gitea_acquire_reviewer_pr_lease
reason_code=preflight_order_violation
error_class=precondition
retryable=false
preflight=whoami -> resolve_task_capability(review_pr) -> acquire_reviewer_pr_lease
capability_next_action="None; ready for operations."
profile=prgs-reviewer
identity=sysadmin
identity_match=true
role=reviewer
repo=Scaled-Tech-Consulting/Gitea-Tools
pr=762
issue=605
head=7f2b9f36de4fa958e43fcee36e07b36e4cb53759
master=8a851eb87e63fc236d8897ed67f67cbe295bc3ae
in_parity=true
restart_required=false
workflow=review-merge-pr.md
workflow_hash=263d0a6cb8a6
lease_present=false
mutation_performed=false
param_inconsistency=worktree vs worktree_path

Expected behavior

A valid documented reviewer preflight sequence should allow reviewer-lease acquisition. If another immediately preceding call is required, the capability resolver and refusal payload must identify it precisely.

Acceptance criteria

  1. Document and enforce one canonical reviewer-lease preflight sequence.
  2. A valid whoami → workflow proof → resolve review capability → acquire lease sequence succeeds.
  3. Missing, stale, wrong-profile, wrong-repository, or out-of-order proof continues to fail closed.
  4. The capability resolver’s exact_safe_next_action agrees with the lease tool’s actual requirement.
  5. Lease-tool rejection identifies the missing or stale predecessor rather than returning an unexplained order violation.
  6. Normalize worktree/worktree_path naming or provide an explicit compatibility/validation contract.
  7. Add a regression test reproducing the exact PR #762 sequence.
  8. Add negative tests proving the order gate and reviewer-role separation remain enforced.
  9. No permission widening and no bypass parameter.
  10. Existing reviewer and merger lease behavior remains intact.

Duplicate search (this recording session)

Searched complete live issue inventory (state=all, limit=500, 415 issues returned — inventory complete under limit).

Issue Why not a duplicate
#718 (closed) Merger path; gitea_adopt_merger_pr_lease returned internal_error after expired reviewer lease. Different tool, role, and error class.
#726 (open) gitea_resolve_task_capability internal_error for unknown task name acquire_reviewer_pr_lease. Here capability resolve for review_pr is green; failure is on the lease tool’s order gate.
#547 / #548 (closed) Merger adopt double verify_preflight_purity clearing capability. Not reviewer acquire.
#546 (closed) Lease acquire clears token needed later by gitea_submit_pr_review. Different stage; here acquire itself fails.
#469 / #470 (closed) Read-only interleaving reset capability preflight for mutations. Here the full identity→capability sequence was repeated with no intervening call and still failed.
#252 (closed) Sticky order gate on gitea_submit_pr_review attributing foreign workspace edits. Different tool and root cause family.

Conclusion: no existing issue covers this exact signature. New type:bug required.

Impact / blocker relationship

  • PR #762 remains open and unreviewed.
  • Review validation did not begin.
  • No reviewer lease exists for PR #762.
  • Repeating the same reviewer lease sequence is not a safe next action until this defect is resolved.
  • No code change to PR #762 is requested.
  • This issue is a workflow blocker for reviewing PR #762 / completing #605; it is not implementation of #605.

Non-goals

  • Do not implement or rework #605 dashboard feature in this issue.
  • Do not widen reviewer permissions or add a bypass flag.
  • Do not change PR #762 head or branch.

Recording provenance

  • Session profile: prgs-author / jcwalker3
  • Mode: issue-recording + blocker handoff only
  • No implementation branch, worktree, or issue lock acquired
## Summary `gitea_acquire_reviewer_pr_lease` fails closed with a deterministic, non-retryable `preflight_order_violation` even when the documented reviewer preflight sequence is green end-to-end. This is a **workflow tooling defect** discovered while attempting formal review of PR #762 (issue #605). It is **not** implementation work for #605. ## Affected review | Field | Value | |---|---| | PR | #762 | | Linked issue | #605 | | Required head | `7f2b9f36de4fa958e43fcee36e07b36e4cb53759` | | Intended profile | `prgs-reviewer` / `sysadmin` | | Workflow | `review-merge-pr.md` | | Workflow hash | `263d0a6cb8a6` | | Control master | `8a851eb87e63fc236d8897ed67f67cbe295bc3ae` | ## Observed behavior The following canonical sequence fails deterministically: 1. `gitea_whoami(remote=prgs)` returns `identity_match=true`. 2. `gitea_resolve_task_capability(task=review_pr)` returns: * `allowed_in_current_session=true` * valid workflow proof * `exact_safe_next_action="None; ready for operations."` 3. `gitea_acquire_reviewer_pr_lease(...)` refuses with: * `reason_code=preflight_order_violation` * `error_class=precondition` * `retryable=false` The failure **reproduced after repeating the complete identity-to-capability sequence with no intervening call**. ## Additional schema inconsistency * `gitea_acquire_reviewer_pr_lease` accepts `worktree`. * Related runtime and capability tools expose or use `worktree_path`. * The first call using `worktree_path` was rejected before API mutation. * After correcting the parameter and repeating preflight once, the order gate still refused. ## Proven green conditions * reviewer identity `sysadmin` * profile `prgs-reviewer` * role `reviewer` * `identity_match=true` * repository `Scaled-Tech-Consulting/Gitea-Tools` * runtime/local/live master `8a851eb87e63fc236d8897ed67f67cbe295bc3ae` * `in_parity=true` * `restart_required=false` * namespace healthy * `ide_namespace_proven=true` * workflow hash `263d0a6cb8a6` * boundary clean * review worktree clean and pinned * PR head unchanged (`7f2b9f36de4fa958e43fcee36e07b36e4cb53759`) * no competing reviewer lease * **no Gitea mutation occurred** ## Exact recorded reproduction signature ```text signature=reviewer_lease_preflight_order_violation_v1 tool=gitea_acquire_reviewer_pr_lease reason_code=preflight_order_violation error_class=precondition retryable=false preflight=whoami -> resolve_task_capability(review_pr) -> acquire_reviewer_pr_lease capability_next_action="None; ready for operations." profile=prgs-reviewer identity=sysadmin identity_match=true role=reviewer repo=Scaled-Tech-Consulting/Gitea-Tools pr=762 issue=605 head=7f2b9f36de4fa958e43fcee36e07b36e4cb53759 master=8a851eb87e63fc236d8897ed67f67cbe295bc3ae in_parity=true restart_required=false workflow=review-merge-pr.md workflow_hash=263d0a6cb8a6 lease_present=false mutation_performed=false param_inconsistency=worktree vs worktree_path ``` ## Expected behavior A valid documented reviewer preflight sequence should allow reviewer-lease acquisition. If another immediately preceding call is required, the capability resolver and refusal payload must identify it precisely. ## Acceptance criteria 1. Document and enforce one canonical reviewer-lease preflight sequence. 2. A valid `whoami → workflow proof → resolve review capability → acquire lease` sequence succeeds. 3. Missing, stale, wrong-profile, wrong-repository, or out-of-order proof continues to fail closed. 4. The capability resolver’s `exact_safe_next_action` agrees with the lease tool’s actual requirement. 5. Lease-tool rejection identifies the missing or stale predecessor rather than returning an unexplained order violation. 6. Normalize `worktree`/`worktree_path` naming or provide an explicit compatibility/validation contract. 7. Add a regression test reproducing the exact PR #762 sequence. 8. Add negative tests proving the order gate and reviewer-role separation remain enforced. 9. No permission widening and no bypass parameter. 10. Existing reviewer and merger lease behavior remains intact. ## Duplicate search (this recording session) Searched complete live issue inventory (`state=all`, limit=500, 415 issues returned — inventory complete under limit). | Issue | Why not a duplicate | |---|---| | #718 (closed) | Merger path; `gitea_adopt_merger_pr_lease` returned `internal_error` after expired reviewer lease. Different tool, role, and error class. | | #726 (open) | `gitea_resolve_task_capability` `internal_error` for unknown task name `acquire_reviewer_pr_lease`. Here capability resolve for `review_pr` is green; failure is on the lease tool’s order gate. | | #547 / #548 (closed) | Merger adopt double `verify_preflight_purity` clearing capability. Not reviewer acquire. | | #546 (closed) | Lease acquire clears token needed later by `gitea_submit_pr_review`. Different stage; here acquire itself fails. | | #469 / #470 (closed) | Read-only interleaving reset capability preflight for mutations. Here the full identity→capability sequence was repeated with **no intervening call** and still failed. | | #252 (closed) | Sticky order gate on `gitea_submit_pr_review` attributing foreign workspace edits. Different tool and root cause family. | **Conclusion:** no existing issue covers this exact signature. New `type:bug` required. ## Impact / blocker relationship * PR #762 remains open and **unreviewed**. * Review validation did not begin. * No reviewer lease exists for PR #762. * Repeating the same reviewer lease sequence is **not** a safe next action until this defect is resolved. * No code change to PR #762 is requested. * This issue is a **workflow blocker** for reviewing PR #762 / completing #605; it is not implementation of #605. ## Non-goals * Do not implement or rework #605 dashboard feature in this issue. * Do not widen reviewer permissions or add a bypass flag. * Do not change PR #762 head or branch. ## Recording provenance * Session profile: `prgs-author` / `jcwalker3` * Mode: issue-recording + blocker handoff only * No implementation branch, worktree, or issue lock acquired
sysadmin commented 2026-07-19 15:34:02 -05:00
Owner
Copy Link
Copy Source

Canonical Issue State

STATE: operator_authorized_blocker_remediation
WHO_IS_NEXT: author
NEXT_ACTION: Fresh prgs-author/jcwalker3 session claims exactly #763 under this one-time WIP exception, implements only #763, publishes one PR with Closes #763, posts author handoff, and stops for independent review
NEXT_PROMPT:

As prgs-author / jcwalker3 on Scaled-Tech-Consulting/Gitea-Tools: honor OPERATOR BLOCKER-REMEDIATION AUTHORIZATION on issue #763. Override allocator with candidates_json for exactly #763 only. Claim #763, create one canonical branch/worktree from base 8a851eb87e63fc236d8897ed67f67cbe295bc3ae, implement and test only #763, open one PR with Closes #763, post canonical author handoff, stop for independent review. Do not select #607, do not touch PR #762, do not self-review/merge.

WHAT_HAPPENED: Human operator authorized a one-time blocker-remediation WIP exception so #763 can be implemented while PR #762 remains open; posted by prgs-reconciler/sysadmin via native MCP.
WHY: #763 repairs the tooling defect blocking independent review of PR #762; without that review PR #762 cannot become terminal; ordinary WIP and allocator rules cannot break the cycle; this is not #557.
RELATED_PRS: PR #762 (blocked product PR; do not modify); future single #763 remediation PR when published
BLOCKERS: none for authorized #763 author work under this record; PR #762 remains blocked until #763 is fixed and verified such that whoami → resolve_task_capability(review_pr) → gitea_acquire_reviewer_pr_lease succeeds
VALIDATION: Pre-post pins verified on prgs-reconciler/sysadmin: PR #762 head 7f2b9f36de4fa958e43fcee36e07b36e4cb53759; #763 unclaimed unimplemented no PR; open inventory only #762; master/runtime 8a851eb87e in_parity=true; comment_issue allowed
LAST_UPDATED_BY: sysadmin / prgs-reconciler (operator authorization record only; no implementation)

OPERATOR BLOCKER-REMEDIATION AUTHORIZATION

STATUS: APPROVED
AUTHORITY: human operator
AUTHORIZATION_KIND: one-time blocker-remediation WIP exception
REPOSITORY: Scaled-Tech-Consulting/Gitea-Tools
BLOCKED_PR: #762
BLOCKED_PR_HEAD: 7f2b9f36de
BLOCKED_ISSUE: #605
BLOCKER_HANDOFF: comment #12977
AUTHORIZED_ISSUE: #763
AUTHORIZED_PROFILE: prgs-author
AUTHORIZED_IDENTITY: jcwalker3
AUTHORIZED_BASE: 8a851eb87e
ALLOCATOR_EXCEPTION: controller candidates_json override permitted for exactly issue #763
WIP_EXCEPTION: one additional blocker-remediation PR permitted while PR #762 remains open
MAXIMUM_NEW_PRS: 1
REQUIRED_PR_LINKAGE: Closes #763
REQUIRED_NEXT_PHASE: independent reviewer
AUTHORIZATION_TERMINATION: expires immediately when the #763 PR is published and its author handoff is posted
REAUTHORIZATION_REQUIRED_IF: PR #762 head changes, live master changes before assignment, issue #763 gains competing ownership, or any pin differs

Justification

Issue #763 repairs the tooling defect (gitea_acquire_reviewer_pr_lease / reviewer_lease_preflight_order_violation_v1) that prevents independent review of PR #762. Without that review, PR #762 cannot become terminal. The supervised-pilot WIP rule refuses a second authored PR while #762 remains open, and the ordinary allocator selects other work instead of #763. Canonical Bootstrap Review Path (#557) is inapplicable because no #763 fix PR exists yet. This one-time exception exists only to restore the normal author → independent reviewer → merger workflow.

This record is not a Bootstrap Review Authorization (#557) and must not be treated as one.

Explicitly authorized (subsequent fresh prgs-author / jcwalker3 session only)

  1. Override the allocator’s ordinary selection using the documented controller candidates_json override for exactly issue #763.
  2. Claim exactly issue #763.
  3. Create one canonical #763 branch and worktree under branches/.
  4. Implement and test only #763.
  5. Publish one PR containing Closes #763, based at authorized base 8a851eb87e (or re-verified live master if reauthorization is obtained after a master change).
  6. Post the canonical author handoff.
  7. Stop for independent review.

Explicitly prohibited

  • selecting or implementing #607 (or any issue other than #763)
  • modifying PR #762 or its branch
  • reviewing or merging PR #762
  • bypassing reviewer leases after #763 lands
  • implementing unrelated work
  • creating more than one additional PR
  • releasing, modifying, or deleting the #605 lock
  • deleting lock JSON files
  • self-review or self-merge
  • profile substitution
  • direct API / UI / CLI Gitea mutations outside native sanctioned MCP for the authorized role
  • broad cleanup
  • treating this record as a reusable general WIP exception
  • treating this record as #557 authorization
## Canonical Issue State STATE: operator_authorized_blocker_remediation WHO_IS_NEXT: author NEXT_ACTION: Fresh prgs-author/jcwalker3 session claims exactly #763 under this one-time WIP exception, implements only #763, publishes one PR with Closes #763, posts author handoff, and stops for independent review NEXT_PROMPT: ```text As prgs-author / jcwalker3 on Scaled-Tech-Consulting/Gitea-Tools: honor OPERATOR BLOCKER-REMEDIATION AUTHORIZATION on issue #763. Override allocator with candidates_json for exactly #763 only. Claim #763, create one canonical branch/worktree from base 8a851eb87e63fc236d8897ed67f67cbe295bc3ae, implement and test only #763, open one PR with Closes #763, post canonical author handoff, stop for independent review. Do not select #607, do not touch PR #762, do not self-review/merge. ``` WHAT_HAPPENED: Human operator authorized a one-time blocker-remediation WIP exception so #763 can be implemented while PR #762 remains open; posted by prgs-reconciler/sysadmin via native MCP. WHY: #763 repairs the tooling defect blocking independent review of PR #762; without that review PR #762 cannot become terminal; ordinary WIP and allocator rules cannot break the cycle; this is not #557. RELATED_PRS: PR #762 (blocked product PR; do not modify); future single #763 remediation PR when published BLOCKERS: none for authorized #763 author work under this record; PR #762 remains blocked until #763 is fixed and verified such that whoami → resolve_task_capability(review_pr) → gitea_acquire_reviewer_pr_lease succeeds VALIDATION: Pre-post pins verified on prgs-reconciler/sysadmin: PR #762 head 7f2b9f36de4fa958e43fcee36e07b36e4cb53759; #763 unclaimed unimplemented no PR; open inventory only #762; master/runtime 8a851eb87e63fc236d8897ed67f67cbe295bc3ae in_parity=true; comment_issue allowed LAST_UPDATED_BY: sysadmin / prgs-reconciler (operator authorization record only; no implementation) ## OPERATOR BLOCKER-REMEDIATION AUTHORIZATION STATUS: APPROVED AUTHORITY: human operator AUTHORIZATION_KIND: one-time blocker-remediation WIP exception REPOSITORY: Scaled-Tech-Consulting/Gitea-Tools BLOCKED_PR: #762 BLOCKED_PR_HEAD: 7f2b9f36de4fa958e43fcee36e07b36e4cb53759 BLOCKED_ISSUE: #605 BLOCKER_HANDOFF: comment #12977 AUTHORIZED_ISSUE: #763 AUTHORIZED_PROFILE: prgs-author AUTHORIZED_IDENTITY: jcwalker3 AUTHORIZED_BASE: 8a851eb87e63fc236d8897ed67f67cbe295bc3ae ALLOCATOR_EXCEPTION: controller candidates_json override permitted for exactly issue #763 WIP_EXCEPTION: one additional blocker-remediation PR permitted while PR #762 remains open MAXIMUM_NEW_PRS: 1 REQUIRED_PR_LINKAGE: Closes #763 REQUIRED_NEXT_PHASE: independent reviewer AUTHORIZATION_TERMINATION: expires immediately when the #763 PR is published and its author handoff is posted REAUTHORIZATION_REQUIRED_IF: PR #762 head changes, live master changes before assignment, issue #763 gains competing ownership, or any pin differs ### Justification Issue #763 repairs the tooling defect (gitea_acquire_reviewer_pr_lease / reviewer_lease_preflight_order_violation_v1) that prevents independent review of PR #762. Without that review, PR #762 cannot become terminal. The supervised-pilot WIP rule refuses a second authored PR while #762 remains open, and the ordinary allocator selects other work instead of #763. Canonical Bootstrap Review Path (#557) is inapplicable because no #763 fix PR exists yet. This one-time exception exists only to restore the normal author → independent reviewer → merger workflow. This record is **not** a Bootstrap Review Authorization (#557) and must not be treated as one. ### Explicitly authorized (subsequent fresh prgs-author / jcwalker3 session only) 1. Override the allocator’s ordinary selection using the documented controller candidates_json override for **exactly issue #763**. 2. Claim **exactly** issue #763. 3. Create **one** canonical #763 branch and worktree under branches/. 4. Implement and test **only** #763. 5. Publish **one** PR containing Closes #763, based at authorized base 8a851eb87e63fc236d8897ed67f67cbe295bc3ae (or re-verified live master if reauthorization is obtained after a master change). 6. Post the canonical author handoff. 7. **Stop** for independent review. ### Explicitly prohibited * selecting or implementing #607 (or any issue other than #763) * modifying PR #762 or its branch * reviewing or merging PR #762 * bypassing reviewer leases after #763 lands * implementing unrelated work * creating more than one additional PR * releasing, modifying, or deleting the #605 lock * deleting lock JSON files * self-review or self-merge * profile substitution * direct API / UI / CLI Gitea mutations outside native sanctioned MCP for the authorized role * broad cleanup * treating this record as a reusable general WIP exception * treating this record as #557 authorization
sysadmin commented 2026-07-19 16:56:15 -05:00
Owner
Copy Link
Copy Source

Canonical Issue State

STATE: operator_authorized_blocker_remediation_amended
WHO_IS_NEXT: author
NEXT_ACTION: Fresh prgs-author/jcwalker3 session claims exactly #763 via the sanctioned native issue-lock/claim path under this amendment, implements only #763, publishes one PR with Closes #763, posts author handoff, and stops for independent review
NEXT_PROMPT:

As prgs-author / jcwalker3 on Scaled-Tech-Consulting/Gitea-Tools: honor OPERATOR BLOCKER-REMEDIATION AUTHORIZATION comment #12981 as amended by this comment. Do NOT use candidates_json; that path is proven unreachable and retry is prohibited. After verifying all live pins and duplicate-ownership gates, claim exactly #763 using the sanctioned native author issue-lock/claim tools without ranking or selecting another issue. Create one canonical branch/worktree from base 8a851eb87e63fc236d8897ed67f67cbe295bc3ae, implement and test only #763, open one PR with Closes #763, post canonical author handoff, stop for independent review. Do not select #607, do not touch PR #762 or #605 ownership, do not self-review/merge.

WHAT_HAPPENED: Human operator amended authorization comment #12981, replacing its candidates_json allocator-override requirement with a narrowly scoped native direct-claim path for exactly issue #763. Posted by prgs-reconciler/sysadmin via native MCP. No implementation, claim, review, merge, or cleanup performed.
WHY: The candidates_json allocator override required by #12981 is unreachable through every available MCP client, so the original authorization cannot be consumed as written. The amendment restores a reachable path to the normal author to independent reviewer to merger workflow.
RELATED_PRS: PR #762 (blocked product PR; unchanged and unreviewed); future single #763 remediation PR when published
BLOCKERS: none for authorized #763 author work under this amended record; PR #762 remains held until #763 is fixed and verified such that whoami then resolve_task_capability(review_pr) then gitea_acquire_reviewer_pr_lease succeeds
VALIDATION: Pre-post pins verified on prgs-reconciler/sysadmin, non-root OS uid 502 jasonwalker: identity_match=true; profile prgs-reconciler; role reconciler; runtime startup head = runtime current head = local master = live prgs/master = 8a851eb87e63fc236d8897ed67f67cbe295bc3ae; in_parity=true; restart_required=false; control checkout clean on master; #763 open, unassigned, no lease, no lock, no branch, no worktree, no PR; PR #762 open at 7f2b9f36de with zero reviews (approval_visible=false); #605 lease-1dfc4167c6bc490d present and unchanged; authorization #12981 unconsumed; no competing ownership
LAST_UPDATED_BY: sysadmin / prgs-reconciler (operator authorization amendment only; no implementation)

OPERATOR BLOCKER-REMEDIATION AUTHORIZATION — AMENDMENT

STATUS: APPROVED
AUTHORITY: human operator
AUTHORIZATION_KIND: one-time blocker-remediation direct-claim exception
REPOSITORY: Scaled-Tech-Consulting/Gitea-Tools
ORIGINAL_AUTHORIZATION: issue #763 comment #12981
AMENDMENT_SCOPE: allocation path only
SUPERSEDES: the candidates_json allocator-exception requirement in comment #12981
BLOCKED_PR: #762
BLOCKED_PR_HEAD: 7f2b9f36de
BLOCKED_ISSUE: #605
BLOCKER_HANDOFF: PR #762 comment #12977
AUTHORIZED_ISSUE: #763
AUTHORIZED_PROFILE: prgs-author
AUTHORIZED_IDENTITY: jcwalker3
AUTHORIZED_BASE: 8a851eb87e
CANDIDATES_JSON_STATUS: unreachable through Claude, Grok, and Codex MCP clients
CANDIDATES_JSON_RETRY: prohibited
ALLOCATOR_BYPASS: permitted for exactly issue #763
DIRECT_CLAIM_ALLOWED: true
CONTROL_PLANE_ASSIGNMENT_EXCEPTION: issue #763 may proceed without a gitea_allocate_next_work assignment when no native exact-target assignment tool is available
AUTHORIZED_CLAIM_PATH: after all live pins and duplicate-ownership gates pass, prgs-author may use the sanctioned native author issue-lock/claim tools to claim exactly #763 without ranking or selecting another issue
AUTHORIZED_WORK: implement only issue #763
MAXIMUM_NEW_PRS: 1
REQUIRED_PR_LINKAGE: Closes #763
REQUIRED_NEXT_PHASE: independent reviewer
PROTECTED_WORK: issue #605, its lease/lock/branch/worktree, and PR #762 must remain unchanged
AUTHORIZATION_TERMINATION: expires immediately when the #763 PR is published and its author handoff is posted
REAUTHORIZATION_REQUIRED_IF: PR #762 head changes, master changes before the #763 claim, #763 gains competing ownership, or any authorization pin differs

Why this amendment exists

Comment #12981 required the author to override ordinary allocator selection using the documented controller candidates_json override. That path has now been proven unreachable through all three available MCP clients.

The server declares the parameter as:

candidates_json: string | null

but every client decodes a JSON-looking string into a list before tool validation, so the server receives a list where it requires a string.

Client Observed behavior
Claude JSON-looking string coerced into list
Grok JSON-looking string coerced into list
Codex CLI 0.144.6 JSON-looking string coerced into list

Most recent recorded result (Codex CLI 0.144.6):

reason_code=internal_error
error_class=internal
exception_class=pydantic_core._pydantic_core.ValidationError
retryable=false
transport_survives=true
detail=candidates_json Input should be a valid string
input_value=[{...issue 763...}]

No mutation occurred in any attempt, and authorization #12981 remains unconsumed.

Scope of this amendment

This amendment preserves comment #12981 in full except that it replaces the unreachable allocation method. Specifically:

  • The ALLOCATOR_EXCEPTION: controller candidates_json override requirement in #12981 is superseded.
  • In its place, the author is authorized to claim exactly #763 through the sanctioned native author issue-lock/claim tools.
  • Every other authorization, limitation, and prohibition in comment #12981 remains fully effective, including the one-time WIP exception, MAXIMUM_NEW_PRS: 1, the Closes #763 linkage requirement, the independent-reviewer next phase, and the termination and reauthorization conditions.

Explicit limits

  • This is not general worker self-selection authority.
  • It applies only to issue #763.
  • It does not authorize allocation of, or work on, #607 or any other issue.
  • It does not authorize direct database edits, hand-written assignment rows, or fabricated assignments.
  • It authorizes only sanctioned native prgs-author MCP claim/lock operations.
  • It does not authorize changing the MCP client, the server schema, or the candidates_json implementation as part of #763.
  • candidates_json must not be retried.
  • This record is not a Bootstrap Review Authorization (#557) and must not be treated as one.

Mandatory stop condition

If the native issue claim/lock tooling independently requires an allocator assignment and supplies no exact-target path, the author must stop and report that new blocker. The author must not improvise an allocation, must not fall back to candidates_json, and must not select a different issue in order to proceed.

Tooling defect note

The candidates_json transport incompatibility (server declares string | null; clients deliver a decoded list) should be recorded later as a separate tooling defect. It is explicitly not added to issue #763's implementation scope, and #763's acceptance criteria are unchanged by this amendment.

## Canonical Issue State STATE: operator_authorized_blocker_remediation_amended WHO_IS_NEXT: author NEXT_ACTION: Fresh prgs-author/jcwalker3 session claims exactly #763 via the sanctioned native issue-lock/claim path under this amendment, implements only #763, publishes one PR with Closes #763, posts author handoff, and stops for independent review NEXT_PROMPT: ```text As prgs-author / jcwalker3 on Scaled-Tech-Consulting/Gitea-Tools: honor OPERATOR BLOCKER-REMEDIATION AUTHORIZATION comment #12981 as amended by this comment. Do NOT use candidates_json; that path is proven unreachable and retry is prohibited. After verifying all live pins and duplicate-ownership gates, claim exactly #763 using the sanctioned native author issue-lock/claim tools without ranking or selecting another issue. Create one canonical branch/worktree from base 8a851eb87e63fc236d8897ed67f67cbe295bc3ae, implement and test only #763, open one PR with Closes #763, post canonical author handoff, stop for independent review. Do not select #607, do not touch PR #762 or #605 ownership, do not self-review/merge. ``` WHAT_HAPPENED: Human operator amended authorization comment #12981, replacing its candidates_json allocator-override requirement with a narrowly scoped native direct-claim path for exactly issue #763. Posted by prgs-reconciler/sysadmin via native MCP. No implementation, claim, review, merge, or cleanup performed. WHY: The candidates_json allocator override required by #12981 is unreachable through every available MCP client, so the original authorization cannot be consumed as written. The amendment restores a reachable path to the normal author to independent reviewer to merger workflow. RELATED_PRS: PR #762 (blocked product PR; unchanged and unreviewed); future single #763 remediation PR when published BLOCKERS: none for authorized #763 author work under this amended record; PR #762 remains held until #763 is fixed and verified such that whoami then resolve_task_capability(review_pr) then gitea_acquire_reviewer_pr_lease succeeds VALIDATION: Pre-post pins verified on prgs-reconciler/sysadmin, non-root OS uid 502 jasonwalker: identity_match=true; profile prgs-reconciler; role reconciler; runtime startup head = runtime current head = local master = live prgs/master = 8a851eb87e63fc236d8897ed67f67cbe295bc3ae; in_parity=true; restart_required=false; control checkout clean on master; #763 open, unassigned, no lease, no lock, no branch, no worktree, no PR; PR #762 open at 7f2b9f36de4fa958e43fcee36e07b36e4cb53759 with zero reviews (approval_visible=false); #605 lease-1dfc4167c6bc490d present and unchanged; authorization #12981 unconsumed; no competing ownership LAST_UPDATED_BY: sysadmin / prgs-reconciler (operator authorization amendment only; no implementation) ## OPERATOR BLOCKER-REMEDIATION AUTHORIZATION — AMENDMENT STATUS: APPROVED AUTHORITY: human operator AUTHORIZATION_KIND: one-time blocker-remediation direct-claim exception REPOSITORY: Scaled-Tech-Consulting/Gitea-Tools ORIGINAL_AUTHORIZATION: issue #763 comment #12981 AMENDMENT_SCOPE: allocation path only SUPERSEDES: the candidates_json allocator-exception requirement in comment #12981 BLOCKED_PR: #762 BLOCKED_PR_HEAD: 7f2b9f36de4fa958e43fcee36e07b36e4cb53759 BLOCKED_ISSUE: #605 BLOCKER_HANDOFF: PR #762 comment #12977 AUTHORIZED_ISSUE: #763 AUTHORIZED_PROFILE: prgs-author AUTHORIZED_IDENTITY: jcwalker3 AUTHORIZED_BASE: 8a851eb87e63fc236d8897ed67f67cbe295bc3ae CANDIDATES_JSON_STATUS: unreachable through Claude, Grok, and Codex MCP clients CANDIDATES_JSON_RETRY: prohibited ALLOCATOR_BYPASS: permitted for exactly issue #763 DIRECT_CLAIM_ALLOWED: true CONTROL_PLANE_ASSIGNMENT_EXCEPTION: issue #763 may proceed without a gitea_allocate_next_work assignment when no native exact-target assignment tool is available AUTHORIZED_CLAIM_PATH: after all live pins and duplicate-ownership gates pass, prgs-author may use the sanctioned native author issue-lock/claim tools to claim exactly #763 without ranking or selecting another issue AUTHORIZED_WORK: implement only issue #763 MAXIMUM_NEW_PRS: 1 REQUIRED_PR_LINKAGE: Closes #763 REQUIRED_NEXT_PHASE: independent reviewer PROTECTED_WORK: issue #605, its lease/lock/branch/worktree, and PR #762 must remain unchanged AUTHORIZATION_TERMINATION: expires immediately when the #763 PR is published and its author handoff is posted REAUTHORIZATION_REQUIRED_IF: PR #762 head changes, master changes before the #763 claim, #763 gains competing ownership, or any authorization pin differs ### Why this amendment exists Comment #12981 required the author to override ordinary allocator selection using the documented controller `candidates_json` override. That path has now been proven unreachable through all three available MCP clients. The server declares the parameter as: ```text candidates_json: string | null ``` but every client decodes a JSON-looking string into a list before tool validation, so the server receives a list where it requires a string. | Client | Observed behavior | |---|---| | Claude | JSON-looking string coerced into list | | Grok | JSON-looking string coerced into list | | Codex CLI 0.144.6 | JSON-looking string coerced into list | Most recent recorded result (Codex CLI 0.144.6): ```text reason_code=internal_error error_class=internal exception_class=pydantic_core._pydantic_core.ValidationError retryable=false transport_survives=true detail=candidates_json Input should be a valid string input_value=[{...issue 763...}] ``` No mutation occurred in any attempt, and authorization #12981 remains unconsumed. ### Scope of this amendment This amendment preserves comment #12981 in full **except** that it replaces the unreachable allocation method. Specifically: * The `ALLOCATOR_EXCEPTION: controller candidates_json override` requirement in #12981 is superseded. * In its place, the author is authorized to claim exactly #763 through the sanctioned native author issue-lock/claim tools. * Every other authorization, limitation, and prohibition in comment #12981 remains fully effective, including the one-time WIP exception, `MAXIMUM_NEW_PRS: 1`, the `Closes #763` linkage requirement, the independent-reviewer next phase, and the termination and reauthorization conditions. ### Explicit limits * This is **not** general worker self-selection authority. * It applies **only** to issue #763. * It does **not** authorize allocation of, or work on, #607 or any other issue. * It does **not** authorize direct database edits, hand-written assignment rows, or fabricated assignments. * It authorizes **only** sanctioned native `prgs-author` MCP claim/lock operations. * It does **not** authorize changing the MCP client, the server schema, or the `candidates_json` implementation as part of #763. * `candidates_json` must **not** be retried. * This record is **not** a Bootstrap Review Authorization (#557) and must not be treated as one. ### Mandatory stop condition If the native issue claim/lock tooling independently requires an allocator assignment and supplies no exact-target path, the author must **stop** and report that new blocker. The author must not improvise an allocation, must not fall back to `candidates_json`, and must not select a different issue in order to proceed. ### Tooling defect note The `candidates_json` transport incompatibility (server declares `string | null`; clients deliver a decoded list) should be recorded later as a **separate** tooling defect. It is explicitly **not** added to issue #763's implementation scope, and #763's acceptance criteria are unchanged by this amendment.
jcwalker3 added status:in-progress and removed status:ready labels 2026-07-19 17:05:57 -05:00
jcwalker3 commented 2026-07-19 17:05:58 -05:00
Author
Owner
Copy Link
Copy Source

Issue claim heartbeat

<!-- gitea-issue-claim-heartbeat:v1 --> **Issue claim heartbeat** - kind: claim - issue: #763 - branch: fix/issue-763-reviewer-lease-preflight-order - phase: claimed - profile: prgs-author - pr: none - blocker: none - next_action: create worktree and begin implementation
jcwalker3 added status:pr-open and removed status:in-progress labels 2026-07-19 17:28:43 -05:00
sysadmin removed the status:pr-open label 2026-07-19 18:13:14 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
No labels mcp preflight reliability reviewer safety type:bug workflow-hardening
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 sysadmin
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#763