Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 97 Pull Requests 10 Actions Packages Projects Releases Wiki Activity

docs(governance): MCP restart governance and authorization policy (Closes #656) #857

Merged
sysadmin merged 5 commits from docs/issue-656-mcp-restart-governance into master 2026-07-24 02:26:03 -05:00
Conversation 6 Commits 5 Files Changed 4
+353
jcwalker3 commented 2026-07-23 18:32:02 -05:00
Owner
Copy Link
Copy Source

Closes #656

First child of umbrella #655. There is no durable written policy stating who may restart the MCP control plane, under what conditions, that restart is a last resort, and how controller approval, automated safety gates, and break-glass interact. Operators and LLM sessions therefore invent restart behavior ad hoc, and #630 and #642 have no policy backbone to bind to. This adds that policy as an ADR.

What this adds

  • docs/architecture/mcp-restart-governance.md (new, 223) — the restart-governance/v1 ADR:
    • Recovery ladder (§2.2) — reconnect → refresh/rebind → scoped restart → full restart → host restart, with restart stated as the last rung. A session must attempt rungs 1–2 and record why they were insufficient before requesting rung 3 or above.
    • Authorization matrix (§2.3) — one row per role (author, reviewer, merger, reconciler, controller, operator, admin) against all five rungs. No LLM worker role may perform or authorize a full or host restart; controller approves, operator/admin executes, and both actions are audited.
    • v1 decision recorded (§2.1) — restart authority is controller approval plus passing automated safety gates. Multi-controller quorum is explicitly deferred, not silently dropped; changing this requires a superseding ADR.
    • Approved conditions (§2.4) — no affected sessions, full drain acknowledged, controller+gates, quorum (reserved), or break-glass. Drain before restart is mandatory outside break-glass.
    • Break-glass (§2.5) — a pre-declared incident record, operator/admin authority only, minimum necessary rung, and a mandatory post-hoc audit entry. Break-glass suspends the drain requirement, never the audit requirement.
    • Failure behavior (§4) — ambiguous policy state denies the restart and stops with a recovery report.
    • Policy IDs RG-01–RG-08 (§5) — stable identifiers so later enforcement code binds to identifiers rather than to prose, with the policy-version field emitted on future restart audit events.
  • docs/safety-model.md (+14) — new § Process restart governance summarizing the rule and pointing at the ADR.
  • docs/webui-deployment.md (+9) — new § Process restart / reload disposition recording that the console exposes no restart control and deferring to the ADR.
  • tests/test_mcp_restart_governance_docs.py (new, 107) — nine documentation-acceptance tests, one per acceptance criterion plus policy-ID presence, ambiguity-denial wording, and a secret-marker check on all three documents.

Acceptance criteria

AC Where Test
1. Policy document with authorization matrix and v1 decision recorded ADR §2.1, §2.3 test_ac1_adr_exists_with_matrix_and_v1_decision
2. Restart is last resort with enumerated narrower recoveries ADR §2.2 test_ac2_restart_is_last_resort_with_narrower_recoveries
3. Forbids unilateral LLM full restart with affected sessions ADR §2.6 test_ac3_forbids_unilateral_llm_full_restart_with_affected_sessions
4. Break-glass conditions listed ADR §2.5 test_ac4_break_glass_conditions_listed
5. Linked to #655, #652, #653, #630, #642 ADR front-matter link list, §7 test_ac5_adr_links_issue_lineage, test_ac5_safety_model_and_deployment_cross_link_adr

Non-goals honored: no restart-coordinator code, no HA or quorum machinery, and no new process-kill or auto-restart tool. This pull request adds no executable restart path whatsoever — it is documentation plus documentation tests.

Provenance

The bulk of this work was authored in an earlier author cycle whose owning MCP session (pid 57094) exited before committing, leaving the implementation uncommitted in the issue's registered worktree. This cycle recovered the durable claim through the sanctioned dead-session path in gitea_lock_issue (identity jcwalker3 / prgs-author, recovery mode unpublished_claim, recorded pid 57094 confirmed dead, head relation descends_from_recorded_base against recorded base 4f3a464a), committed that work unchanged as 1301a57 to preserve its provenance, merged current master, then applied one correction of its own. No file copy and no re-implementation.

The correction (9f75915) fixes linked-issue descriptions that named issues by roles they do not hold: #652 is the console product vision rather than a restart-specific vision, #653 is the console phased-delivery roadmap, #630 is the manual process-kill contamination guard rather than the coordinator (the coordinator remains an unimplemented later child of #655), #642 is the sanctioned restart and graceful-reload console UX, and #591 is auto-restart on master advance rather than transport recovery. Wording only — every normative statement, the authorization matrix, and RG-01–RG-08 are untouched.

Test evidence

Run from /Users/jasonwalker/Development/Gitea-Tools/branches/docs-issue-656-mcp-restart-governance with the repository venv interpreter.

  • Focused: venv/bin/python -m pytest tests/test_mcp_restart_governance_docs.py -q -s — 9 passed.
  • Full suite: venv/bin/python -m pytest -q -s — 4624 passed, 12 failed, 6 skipped, 735 subtests passed in 554.68s.

Baseline classification: the twelve failing node identifiers are the documented pre-existing master baseline at 188e83c4 — six in tests/test_commit_payloads.py, two in tests/test_issue_702_review_findings_f1_f6.py, two in tests/test_mcp_server.py (TestRuntimeProfile::test_whoami_v2_metadata and TestPreflightVerification::test_declared_clean_task_worktree_ignores_control_checkout_violation), one in tests/test_post_merge_moot_lease.py, and one in tests/test_reconciler_supersession_close.py. None of them touch docs/.

To be precise about the evidence: this cycle did not re-run an independent detached baseline worktree. It compares against the baseline recorded in PR #856's validation, which pinned a clean detached worktree to master 188e83c4 — the identical commit this branch is merged onto — and reported those twelve identifiers with 4615 passed. This branch reports 4624 passed, a delta of exactly nine, which accounts for precisely the nine tests added here. A reviewer wanting an independently regenerated baseline should regenerate it rather than rely on that carry-forward.

git status --porcelain reported zero entries in the worktree before publication and reports zero entries now.

Risk

Very low. No executable code changes and no runtime surface. The residual risk is policy drift: the ADR states rules that enforcement code does not yet implement, so between this merge and the coordinator child of #655 the policy is binding on humans and LLM sessions by convention rather than by gate. The RG-01–RG-08 identifiers exist specifically so that later enforcement binds to fixed handles instead of re-deriving intent from prose.

Known limitations

The v1 authority decision (controller approval plus automated safety gates) is recorded but not yet enforced anywhere. The drain protocol, checkpoint schema, impact preview, and post-restart reconciliation are named but specified only at policy level; each is a separate child of #655. Existing auto-restart behavior in gitea_mcp_server.py is called out for inventory but is deliberately not modified here.

Provenance details

Canonical PR State

STATE: awaiting-review
WHO_IS_NEXT: reviewer
BLOCKED_ROLE: none
NEXT_ACTION: Review this pull request against issue #656 acceptance criteria 1-5 and the documentation-only non-goals; confirm the 12 full-suite failures are the 188e83c4 master baseline; submit verdict; stop
NEXT_PROMPT: Review this pull request as prgs-reviewer at head 9f759150b8bde333e123bcd8efd302d4ebd809c1; verify the authorization matrix covers every role, the v1 authority decision is recorded, unilateral LLM full restart is forbidden, break-glass requires a pre-declared incident plus post-hoc audit, RG-01 through RG-08 are present, the cross-links from safety-model and webui-deployment resolve, and that no executable restart path was introduced; submit verdict; stop

Co-Authored-By: Claude Opus 4.8 (1M context) [email protected]

Closes #656 First child of umbrella #655. There is no durable written policy stating who may restart the MCP control plane, under what conditions, that restart is a last resort, and how controller approval, automated safety gates, and break-glass interact. Operators and LLM sessions therefore invent restart behavior ad hoc, and #630 and #642 have no policy backbone to bind to. This adds that policy as an ADR. ## What this adds - **`docs/architecture/mcp-restart-governance.md` (new, 223)** — the `restart-governance/v1` ADR: - **Recovery ladder (§2.2)** — reconnect → refresh/rebind → scoped restart → full restart → host restart, with restart stated as the last rung. A session must attempt rungs 1–2 and record why they were insufficient before requesting rung 3 or above. - **Authorization matrix (§2.3)** — one row per role (author, reviewer, merger, reconciler, controller, operator, admin) against all five rungs. No LLM worker role may perform or authorize a full or host restart; controller approves, operator/admin executes, and both actions are audited. - **v1 decision recorded (§2.1)** — restart authority is controller approval **plus** passing automated safety gates. Multi-controller quorum is explicitly deferred, not silently dropped; changing this requires a superseding ADR. - **Approved conditions (§2.4)** — no affected sessions, full drain acknowledged, controller+gates, quorum (reserved), or break-glass. Drain before restart is mandatory outside break-glass. - **Break-glass (§2.5)** — a pre-declared incident record, operator/admin authority only, minimum necessary rung, and a mandatory post-hoc audit entry. Break-glass suspends the drain requirement, never the audit requirement. - **Failure behavior (§4)** — ambiguous policy state denies the restart and stops with a recovery report. - **Policy IDs `RG-01`–`RG-08` (§5)** — stable identifiers so later enforcement code binds to identifiers rather than to prose, with the policy-version field emitted on future restart audit events. - **`docs/safety-model.md` (+14)** — new § Process restart governance summarizing the rule and pointing at the ADR. - **`docs/webui-deployment.md` (+9)** — new § Process restart / reload disposition recording that the console exposes no restart control and deferring to the ADR. - **`tests/test_mcp_restart_governance_docs.py` (new, 107)** — nine documentation-acceptance tests, one per acceptance criterion plus policy-ID presence, ambiguity-denial wording, and a secret-marker check on all three documents. ## Acceptance criteria | AC | Where | Test | |---|---|---| | 1. Policy document with authorization matrix and v1 decision recorded | ADR §2.1, §2.3 | `test_ac1_adr_exists_with_matrix_and_v1_decision` | | 2. Restart is last resort with enumerated narrower recoveries | ADR §2.2 | `test_ac2_restart_is_last_resort_with_narrower_recoveries` | | 3. Forbids unilateral LLM full restart with affected sessions | ADR §2.6 | `test_ac3_forbids_unilateral_llm_full_restart_with_affected_sessions` | | 4. Break-glass conditions listed | ADR §2.5 | `test_ac4_break_glass_conditions_listed` | | 5. Linked to #655, #652, #653, #630, #642 | ADR front-matter link list, §7 | `test_ac5_adr_links_issue_lineage`, `test_ac5_safety_model_and_deployment_cross_link_adr` | Non-goals honored: no restart-coordinator code, no HA or quorum machinery, and no new process-kill or auto-restart tool. This pull request adds no executable restart path whatsoever — it is documentation plus documentation tests. ## Provenance The bulk of this work was authored in an earlier author cycle whose owning MCP session (pid 57094) exited before committing, leaving the implementation uncommitted in the issue's registered worktree. This cycle recovered the durable claim through the sanctioned dead-session path in `gitea_lock_issue` (identity `jcwalker3` / `prgs-author`, recovery mode `unpublished_claim`, recorded pid 57094 confirmed dead, head relation `descends_from_recorded_base` against recorded base `4f3a464a`), committed that work unchanged as `1301a57` to preserve its provenance, merged current master, then applied one correction of its own. No file copy and no re-implementation. The correction (`9f75915`) fixes linked-issue descriptions that named issues by roles they do not hold: #652 is the console product vision rather than a restart-specific vision, #653 is the console phased-delivery roadmap, #630 is the manual process-kill contamination guard rather than the coordinator (the coordinator remains an unimplemented later child of #655), #642 is the sanctioned restart and graceful-reload console UX, and #591 is auto-restart on master advance rather than transport recovery. Wording only — every normative statement, the authorization matrix, and `RG-01`–`RG-08` are untouched. ## Test evidence Run from `/Users/jasonwalker/Development/Gitea-Tools/branches/docs-issue-656-mcp-restart-governance` with the repository venv interpreter. - Focused: `venv/bin/python -m pytest tests/test_mcp_restart_governance_docs.py -q -s` — **9 passed**. - Full suite: `venv/bin/python -m pytest -q -s` — **4624 passed, 12 failed, 6 skipped, 735 subtests passed** in 554.68s. Baseline classification: the twelve failing node identifiers are the documented pre-existing master baseline at `188e83c4` — six in `tests/test_commit_payloads.py`, two in `tests/test_issue_702_review_findings_f1_f6.py`, two in `tests/test_mcp_server.py` (`TestRuntimeProfile::test_whoami_v2_metadata` and `TestPreflightVerification::test_declared_clean_task_worktree_ignores_control_checkout_violation`), one in `tests/test_post_merge_moot_lease.py`, and one in `tests/test_reconciler_supersession_close.py`. None of them touch `docs/`. To be precise about the evidence: this cycle did **not** re-run an independent detached baseline worktree. It compares against the baseline recorded in PR #856's validation, which pinned a clean detached worktree to master `188e83c4` — the identical commit this branch is merged onto — and reported those twelve identifiers with **4615 passed**. This branch reports 4624 passed, a delta of exactly nine, which accounts for precisely the nine tests added here. A reviewer wanting an independently regenerated baseline should regenerate it rather than rely on that carry-forward. `git status --porcelain` reported zero entries in the worktree before publication and reports zero entries now. ## Risk Very low. No executable code changes and no runtime surface. The residual risk is policy drift: the ADR states rules that enforcement code does not yet implement, so between this merge and the coordinator child of #655 the policy is binding on humans and LLM sessions by convention rather than by gate. The `RG-01`–`RG-08` identifiers exist specifically so that later enforcement binds to fixed handles instead of re-deriving intent from prose. ## Known limitations The v1 authority decision (controller approval plus automated safety gates) is recorded but not yet enforced anywhere. The drain protocol, checkpoint schema, impact preview, and post-restart reconciliation are named but specified only at policy level; each is a separate child of #655. Existing auto-restart behavior in `gitea_mcp_server.py` is called out for inventory but is deliberately not modified here. ## Provenance details - Issue: #656 - Umbrella: #655 - Branch: `docs/issue-656-mcp-restart-governance` - Worktree: `/Users/jasonwalker/Development/Gitea-Tools/branches/docs-issue-656-mcp-restart-governance` - Recovered implementation commit: `1301a57de4626118cc2a0d81ce6eb09da22ac3ac` - Head commit: `9f759150b8bde333e123bcd8efd302d4ebd809c1` - Base master pinned this cycle: `188e83c4d69bfb959c91b1f8e766ab8a0656d92d` ## Canonical PR State ```text STATE: awaiting-review WHO_IS_NEXT: reviewer BLOCKED_ROLE: none NEXT_ACTION: Review this pull request against issue #656 acceptance criteria 1-5 and the documentation-only non-goals; confirm the 12 full-suite failures are the 188e83c4 master baseline; submit verdict; stop NEXT_PROMPT: Review this pull request as prgs-reviewer at head 9f759150b8bde333e123bcd8efd302d4ebd809c1; verify the authorization matrix covers every role, the v1 authority decision is recorded, unilateral LLM full restart is forbidden, break-glass requires a pre-declared incident plus post-hoc audit, RG-01 through RG-08 are present, the cross-links from safety-model and webui-deployment resolve, and that no executable restart path was introduced; submit verdict; stop ``` Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
jcwalker3 added 3 commits 2026-07-23 18:32:03 -05:00
docs(governance): MCP restart governance and authorization policy (#656) 1301a57de4 
Adds docs/architecture/mcp-restart-governance.md, the restart-governance/v1 ADR
defining who may restart the MCP control plane and under what conditions.

- Recovery ladder (reconnect -> rebind -> scoped restart -> full restart -> host)
  with restart stated as the last resort.
- Authorization matrix across author/reviewer/merger/reconciler/controller/
  operator/admin; no LLM worker role may perform or authorize a full or host
  restart.
- v1 authority decision recorded: controller approval + automated safety gates;
  quorum deferred to a superseding ADR.
- Break-glass path with pre-declared incident and mandatory post-hoc audit.
- Ambiguous policy state denies restart.
- Stable policy IDs RG-01..RG-08 for later enforcement code to bind to.

Cross-links the ADR from docs/safety-model.md and docs/webui-deployment.md, and
adds tests/test_mcp_restart_governance_docs.py asserting acceptance criteria 1-5.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Merge branch 'master' into docs/issue-656-mcp-restart-governance 347464a057
docs(governance): correct linked-issue descriptions in restart ADR (#656) 9f759150b8 
The Related section and cross-reference lines described #652, #653, #630, #642,
and #591 by roles they do not hold. Align each description with the linked
issue's actual title and scope:

- #652 is the Control Plane Web Console product vision (restart controls live in
  its capability area A), not a restart-specific vision.
- #653 is the console phased-delivery roadmap; restart controls are Phase 2.
- #630 is the manual process-kill contamination guard, not the coordinator; the
  coordinator remains an unimplemented later child of #655.
- #642 is the sanctioned restart / graceful reload console UX.
- #591 is auto-restart on master advance (closed); only #584 is transport-flap
  reconnect. They were previously collapsed into one transport-recovery label.

Documentation-only wording change. Policy IDs RG-01..RG-08, the policy version
restart-governance/v1, the authorization matrix, and every normative statement
are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
jcwalker3 added 1 commit 2026-07-23 19:53:18 -05:00
Merge branch 'master' into docs/issue-656-mcp-restart-governance dc99c15ffa
jcwalker3 added 1 commit 2026-07-24 02:07:21 -05:00
Merge branch 'master' into docs/issue-656-mcp-restart-governance 0088ecaf00
sysadmin commented 2026-07-24 02:17:57 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #857
issue: #656
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 90432-499b65b9d457
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-857-docs-issue-656-mcp-restart-governance
phase: claimed
candidate_head: 0088ecaf00
target_branch: master
target_branch_sha: 89657a06c4
last_activity: 2026-07-24T07:17:56Z
expires_at: 2026-07-24T07:27:56Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #857 issue: #656 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 90432-499b65b9d457 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-857-docs-issue-656-mcp-restart-governance phase: claimed candidate_head: 0088ecaf00eb87f53612ef67b5b0b84bdd32d07a target_branch: master target_branch_sha: 89657a06c4cc8d73917e4436e326d3755cff0a40 last_activity: 2026-07-24T07:17:56Z expires_at: 2026-07-24T07:27:56Z blocker: none
sysadmin commented 2026-07-24 02:18:21 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #857
issue: #656
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 90432-499b65b9d457
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-857-docs-issue-656-mcp-restart-governance
phase: validated
candidate_head: 0088ecaf00
target_branch: master
target_branch_sha: 89657a06c4
last_activity: 2026-07-24T07:18:21Z
expires_at: 2026-07-24T07:28:21Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #857 issue: #656 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 90432-499b65b9d457 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-857-docs-issue-656-mcp-restart-governance phase: validated candidate_head: 0088ecaf00eb87f53612ef67b5b0b84bdd32d07a target_branch: master target_branch_sha: 89657a06c4cc8d73917e4436e326d3755cff0a40 last_activity: 2026-07-24T07:18:21Z expires_at: 2026-07-24T07:28:21Z blocker: none
sysadmin approved these changes 2026-07-24 02:19:39 -05:00
sysadmin left a comment
Owner
Copy Link
Copy Source

APPROVE — PR #857

Documentation-only MCP restart governance ADR for #656. Scope is clean: new ADR, two cross-link doc sections, nine documentation-acceptance tests. No executable restart path.

Reviewed at head 0088ecaf00 against master 89657a06c4. Author jcwalker3; reviewer sysadmin/prgs-reviewer. Focused pytest 9 passed. All five ACs satisfied; RG-01–RG-08 present; break-glass and ambiguity-deny wording present.

Canonical PR State

STATE: approved-awaiting-merge
WHO_IS_NEXT: merger
NEXT_ACTION: Revalidate approval at exact head 0088ecaf00eb87f53612ef67b5b0b84bdd32d07a; call gitea_assess_pr_sync_status; if recommended_next_action=merge_now, adopt/acquire merger lease and merge via gitea_merge_pr only.
NEXT_PROMPT:

Merge PR #857 on prgs Scaled-Tech-Consulting/Gitea-Tools as gitea-merger.
Pinned approved head: 0088ecaf00eb87f53612ef67b5b0b84bdd32d07a
Base master: 89657a06c4cc8d73917e4436e326d3755cff0a40
Linked issue: #656
Reviewer lease session: 90432-499b65b9d457 (comment 15550/15552)
Worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-857-docs-issue-656-mcp-restart-governance
1. gitea_whoami + gitea_resolve_task_capability(task=merge_pr) on prgs-merger
2. gitea_get_pr_review_feedback — require approval_at_current_head for 0088ecaf
3. gitea_assess_pr_sync_status — require recommended_next_action=merge_now
4. gitea_adopt_merger_pr_lease or acquire with expected_head_sha=0088ecaf…
5. gitea_merge_pr only after all gates; stop after merge for runtime-parity check

WHAT_HAPPENED: Formal APPROVE submitted by prgs-reviewer after docs-only review and validation.
WHY: Issue #656 ACs 1-5 met; documentation-only non-goals honored; no conflicts; head matches base ancestry with commits_behind=0.
ISSUE: #656
HEAD_SHA: 0088ecaf00
REVIEW_STATUS: APPROVED
MERGE_READY: true
BLOCKERS: none
VALIDATION: cwd=branches/review-pr-857-docs-issue-656-mcp-restart-governance HEAD=0088ecaf00eb clean before/after; venv/bin/python -m pytest tests/test_mcp_restart_governance_docs.py -q → 9 passed in 0.99s
NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=940cd497439b039d; pid=90432; mode=production
LAST_UPDATED_BY: sysadmin / prgs-reviewer

## APPROVE — PR #857 Documentation-only MCP restart governance ADR for #656. Scope is clean: new ADR, two cross-link doc sections, nine documentation-acceptance tests. No executable restart path. Reviewed at head 0088ecaf00eb87f53612ef67b5b0b84bdd32d07a against master 89657a06c4cc8d73917e4436e326d3755cff0a40. Author jcwalker3; reviewer sysadmin/prgs-reviewer. Focused pytest 9 passed. All five ACs satisfied; RG-01–RG-08 present; break-glass and ambiguity-deny wording present. ## Canonical PR State STATE: approved-awaiting-merge WHO_IS_NEXT: merger NEXT_ACTION: Revalidate approval at exact head 0088ecaf00eb87f53612ef67b5b0b84bdd32d07a; call gitea_assess_pr_sync_status; if recommended_next_action=merge_now, adopt/acquire merger lease and merge via gitea_merge_pr only. NEXT_PROMPT: ```text Merge PR #857 on prgs Scaled-Tech-Consulting/Gitea-Tools as gitea-merger. Pinned approved head: 0088ecaf00eb87f53612ef67b5b0b84bdd32d07a Base master: 89657a06c4cc8d73917e4436e326d3755cff0a40 Linked issue: #656 Reviewer lease session: 90432-499b65b9d457 (comment 15550/15552) Worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-857-docs-issue-656-mcp-restart-governance 1. gitea_whoami + gitea_resolve_task_capability(task=merge_pr) on prgs-merger 2. gitea_get_pr_review_feedback — require approval_at_current_head for 0088ecaf 3. gitea_assess_pr_sync_status — require recommended_next_action=merge_now 4. gitea_adopt_merger_pr_lease or acquire with expected_head_sha=0088ecaf… 5. gitea_merge_pr only after all gates; stop after merge for runtime-parity check ``` WHAT_HAPPENED: Formal APPROVE submitted by prgs-reviewer after docs-only review and validation. WHY: Issue #656 ACs 1-5 met; documentation-only non-goals honored; no conflicts; head matches base ancestry with commits_behind=0. ISSUE: #656 HEAD_SHA: 0088ecaf00eb87f53612ef67b5b0b84bdd32d07a REVIEW_STATUS: APPROVED MERGE_READY: true BLOCKERS: none VALIDATION: cwd=branches/review-pr-857-docs-issue-656-mcp-restart-governance HEAD=0088ecaf00eb clean before/after; venv/bin/python -m pytest tests/test_mcp_restart_governance_docs.py -q → 9 passed in 0.99s NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=940cd497439b039d; pid=90432; mode=production LAST_UPDATED_BY: sysadmin / prgs-reviewer
sysadmin commented 2026-07-24 02:25:47 -05:00
Owner
Copy Link
Copy Source

adopted_at: 2026-07-24T07:25:46Z
adopted_by_identity: sysadmin
adopted_by_profile: prgs-merger
adopted_from_session_id: 90432-499b65b9d457
adopted_from_profile: prgs-reviewer
adopted_from_reviewer_identity: sysadmin
adopted_from_comment_id: 15552
adoption_reason: merger-handoff-approved-head

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #857
issue: #656
reviewer_identity: sysadmin
profile: prgs-merger
session_id: 28389-43d5e39eda7e
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merge-pr-857-0088ecaf
phase: adopted
candidate_head: 0088ecaf00
target_branch: master
target_branch_sha: 89657a06c4
last_activity: 2026-07-24T07:25:46Z
expires_at: 2026-07-24T07:35:46Z
blocker: none

<!-- mcp-review-lease-adoption:v1 --> adopted_at: 2026-07-24T07:25:46Z adopted_by_identity: sysadmin adopted_by_profile: prgs-merger adopted_from_session_id: 90432-499b65b9d457 adopted_from_profile: prgs-reviewer adopted_from_reviewer_identity: sysadmin adopted_from_comment_id: 15552 adoption_reason: merger-handoff-approved-head <!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #857 issue: #656 reviewer_identity: sysadmin profile: prgs-merger session_id: 28389-43d5e39eda7e worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merge-pr-857-0088ecaf phase: adopted candidate_head: 0088ecaf00eb87f53612ef67b5b0b84bdd32d07a target_branch: master target_branch_sha: 89657a06c4cc8d73917e4436e326d3755cff0a40 last_activity: 2026-07-24T07:25:46Z expires_at: 2026-07-24T07:35:46Z blocker: none
sysadmin merged commit 60df5087e9 into master 2026-07-24 02:26:03 -05:00
sysadmin commented 2026-07-24 02:26:05 -05:00
Owner
Copy Link
Copy Source

Stale #332 review-decision lock cleanup (#594)

Status: APPLIED

Manual deletion of session-state files is not the workflow.
This path only clears a lock when the referenced PR is merged/closed.

## Stale #332 review-decision lock cleanup (#594) Status: **APPLIED** - actor: `sysadmin` - profile: `prgs-merger` - timestamp: `2026-07-24T07:26:04.808273+00:00` - last terminal: `approve` on PR #857 - PR state: `closed` (merged=True) - merge_commit_sha: `60df5087e94e2f0504b5f3b8a6e1b01c976380c3` - prior live_mutations_count: `3` - prior profile_identity: `prgs-reviewer` Manual deletion of session-state files is **not** the workflow. This path only clears a lock when the referenced PR is merged/closed.
sysadmin commented 2026-07-24 02:30:46 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #857
issue: #656
reviewer_identity: sysadmin
profile: prgs-merger
session_id: 28389-43d5e39eda7e
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merge-pr-857-0088ecaf
phase: released
candidate_head: 0088ecaf00
target_branch: master
target_branch_sha: 89657a06c4
last_activity: 2026-07-24T07:30:45Z
expires_at: 2026-07-24T07:40:45Z
blocker: post-merge-moot

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #857 issue: #656 reviewer_identity: sysadmin profile: prgs-merger session_id: 28389-43d5e39eda7e worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merge-pr-857-0088ecaf phase: released candidate_head: 0088ecaf00eb87f53612ef67b5b0b84bdd32d07a target_branch: master target_branch_sha: 89657a06c4cc8d73917e4436e326d3755cff0a40 last_activity: 2026-07-24T07:30:45Z expires_at: 2026-07-24T07:40:45Z blocker: post-merge-moot
Sign in to join this conversation.
Reviewers
No Reviewers
sysadmin
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 sysadmin
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#857