Add sanctioned dirty-preserving same-claimant author-session rebind #864

New Issue

2026-07-23T22:35:14-05:00

jcwalker3 commented

2026-07-23 22:35:14 -05:00

Summary

Add an explicit, auditable recovery operation that rebinds a live author session to an already-registered dirty issue worktree when the durable lock still belongs to the same author identity/profile, the recorded owner PID is provably dead, and ordinary author locking correctly refuses the dirty worktree.

This is not a silent exception in gitea_lock_issue, bind_session_lock, or general worktree resolution. It is a separate operator/author recovery capability required by the reconciler diagnosis:

BLOCKED + DIAGNOSE — OPERATOR REBIND CAPABILITY REQUIRED

Why this is needed

Motivating blocked dependency

Issue #860 / PR #861 implemented dirty-orphan recovery, then received REQUEST_CHANGES (review #530).
Remediation for #861 cannot be published from the existing dirty registered worktree because:
1. the durable lock still names the same author identity/profile (jcwalker3 / prgs-author);
2. its recorded PID is dead (session ended without clean release);
3. the registered worktree holds legitimate unpublished remediation bytes;
4. ordinary author relocking (gitea_lock_issue) correctly refuses a dirty worktree;
5. #753 / #768 / #772 / PR #774 dead-session recovery requires a clean worktree;
6. the reconciler currently has no sanctioned rebind that preserves dirty bytes while replacing only stale session/PID provenance;
7. manual lock/session-file editing is forbidden.

PR #861 therefore cannot land its remediation until this capability exists.

Distinct from #860

Capability	#860 (dirty orphan recovery)	This issue (session rebind)
PID state	PID-less / malformed	Recorded PID present and dead
Worktree	May create recovery worktree + sync remote head	Act only on already-registered dirty worktree
Dirty bytes	Re-apply onto recovery checkout	Preserve every tracked/untracked byte in place
Mutation scope	Recovery worktree + sync + rebind	Only stale lock/session provenance + live session pointer
Heads	Local/remote may diverge (sync)	Local and remote heads must match pins (no movement)

Do not recover, rebind, clean, commit, or publish the real #860 worktree as part of implementing this issue. Use a synthetic #860-class fixture only.

Duplicate search

Inspected open issues including #860, #850, #855, #816, #790 family, #716, #713, #681 and closed recovery issues #753, #768, #772 / PR #774, #760, #755, #812.

No existing open or closed issue provides all of:

same-claimant identity and profile match;
recorded PID present and provably dead;
dirty registered worktree preserved byte-for-byte;
atomic live author-session pointer replacement;
fingerprint-pinned dirty-path enforcement;
explicit operation separate from ordinary locking;
role-gated author same-claimant + optional reconciler tightly-pinned execute without commit/publication authority.

#860 is adjacent but targets PID-less orphan recovery with remote-head sync, not dead-PID dirty session rebind.

Required operation

Name (suggested): gitea_rebind_dirty_same_claimant_author_session

Authoritative pins (all required; verified, never trusted alone)

remote and repository
issue
branch
registered worktree path
claimant identity
claimant profile
old PID
proof that the old PID is dead
current local head
authoritative remote head
expected dirty-path set
expected content fingerprints
absence of competing issue locks, sessions, and workflow leases

Behavioral requirements

act only on an already registered canonical worktree under the branches root
require durable claimant to exactly match the live author identity and profile
preserve every tracked and untracked byte
verify fingerprints immediately before and after rebinding
update only stale lock/session provenance (PID/session pointer/generation)
atomically establish the new live author-session pointer
remove or supersede the stale pointer safely
leave repository, issue, branch, worktree, local head, and remote head unchanged
grant authority only to the matching author session
remain crash-safe, retry-safe, and auditable
return structured read-after-write evidence

Fail closed for

live old PID
foreign or mismatched identity/profile
ambiguous ownership
unregistered or noncanonical worktree
worktree outside the canonical branches root
branch, issue, repository, or path disagreement
local- or remote-head movement
missing, added, removed, or modified dirty paths
fingerprint disagreement
competing session, issue lock, or lease
malformed or unverifiable durable state
symlink or traversal attempts
failure to read authoritative state
partial or replayed journal state

Role boundaries

gitea-author may invoke only for its exact same claimant
gitea-reconciler may assess and, only if the capability model explicitly authorizes, execute the tightly pinned rebind without commit/publication authority
reviewer and merger roles cannot use it
permission-level allowed=true is not ownership proof

Non-goals

Do not weaken ordinary author locking or mutation preflights
Do not add an automatic dirty-worktree exception to gitea_lock_issue / bind_session_lock
Do not replace the broader recovery system (#753/#772/#860)
Do not mutate #850, PR #853, #855, or the real #860 worktree during implementation
Do not manually edit lock or session files outside the sanctioned operation

Acceptance criteria

Explicit MCP operation with full pin corroboration and structured RA/W evidence.
Successful dead-PID same-claimant dirty rebind preserves every dirty byte and fingerprint.
Atomic session-pointer replacement; no duplicate ownership after success or retry.
Fail-closed coverage for live PID, foreign claimant, profile mismatch, competing lock/session/lease, head movement, dirty-path/fingerprint drift, path/symlink/registration mismatches, malformed records.
Normal author commit preflight succeeds after rebind; ordinary dirty-worktree locking remains fail-closed.
Integration tests use real repositories, worktrees, lock files, and session pointers (not mocks alone).
Regression fixture matching the blocked #860 class without mutating the real worktree: claimant jcwalker3 / prgs-author, stale/dead prior PID, no live session pointer, registered dirty worktree, matching local and remote head, seven fingerprint-pinned dirty paths, no competing ownership.
Focused + relevant regression suites green; exact commands and pass counts recorded.
Single PR closes this issue only; #850 / PR #853 / #855 / #860 worktree and PR #861 head 18d6583e8362b15621b0a9f4766c6e073419e627 remain unchanged by this work.

Canonical next step

STATE: ready-for-author
WHO_IS_NEXT: author
NEXT_ACTION: Allocate a clean registered worktree from live master, implement the rebind operation + integration tests + #860-class fixture, publish one PR, hand off to gitea-reviewer

## Summary Add an **explicit, auditable** recovery operation that rebinds a live author session to an already-registered dirty issue worktree when the durable lock still belongs to the same author identity/profile, the recorded owner PID is **provably dead**, and ordinary author locking correctly refuses the dirty worktree. This is **not** a silent exception in `gitea_lock_issue`, `bind_session_lock`, or general worktree resolution. It is a separate operator/author recovery capability required by the reconciler diagnosis: `BLOCKED + DIAGNOSE — OPERATOR REBIND CAPABILITY REQUIRED` ## Why this is needed ### Motivating blocked dependency - **Issue #860 / PR #861** implemented dirty-orphan recovery, then received REQUEST_CHANGES (review #530). - Remediation for #861 cannot be published from the existing dirty registered worktree because: 1. the durable lock still names the same author identity/profile (`jcwalker3` / `prgs-author`); 2. its recorded PID is dead (session ended without clean release); 3. the registered worktree holds legitimate unpublished remediation bytes; 4. ordinary author relocking (`gitea_lock_issue`) correctly **refuses a dirty worktree**; 5. #753 / #768 / #772 / PR #774 dead-session recovery **requires a clean worktree**; 6. the reconciler currently has **no sanctioned rebind** that preserves dirty bytes while replacing only stale session/PID provenance; 7. manual lock/session-file editing is **forbidden**. PR #861 therefore cannot land its remediation until this capability exists. ### Distinct from #860 | Capability | #860 (dirty orphan recovery) | This issue (session rebind) | |---|---|---| | PID state | PID-less / malformed | Recorded PID present and **dead** | | Worktree | May create recovery worktree + sync remote head | Act **only** on already-registered dirty worktree | | Dirty bytes | Re-apply onto recovery checkout | Preserve **every** tracked/untracked byte in place | | Mutation scope | Recovery worktree + sync + rebind | **Only** stale lock/session provenance + live session pointer | | Heads | Local/remote may diverge (sync) | Local and remote heads must **match pins** (no movement) | Do **not** recover, rebind, clean, commit, or publish the real #860 worktree as part of implementing this issue. Use a synthetic #860-class fixture only. ## Duplicate search Inspected open issues including #860, #850, #855, #816, #790 family, #716, #713, #681 and closed recovery issues #753, #768, #772 / PR #774, #760, #755, #812. **No existing open or closed issue provides all of:** 1. same-claimant identity **and** profile match; 2. recorded PID present and provably dead; 3. dirty registered worktree preserved byte-for-byte; 4. atomic live author-session pointer replacement; 5. fingerprint-pinned dirty-path enforcement; 6. explicit operation separate from ordinary locking; 7. role-gated author same-claimant + optional reconciler tightly-pinned execute without commit/publication authority. #860 is adjacent but targets PID-less orphan recovery with remote-head sync, not dead-PID dirty session rebind. ## Required operation Name (suggested): `gitea_rebind_dirty_same_claimant_author_session` ### Authoritative pins (all required; verified, never trusted alone) - remote and repository - issue - branch - registered worktree path - claimant identity - claimant profile - old PID - proof that the old PID is dead - current local head - authoritative remote head - expected dirty-path set - expected content fingerprints - absence of competing issue locks, sessions, and workflow leases ### Behavioral requirements - act only on an already registered canonical worktree under the branches root - require durable claimant to exactly match the live author identity and profile - preserve every tracked and untracked byte - verify fingerprints immediately before and after rebinding - update **only** stale lock/session provenance (PID/session pointer/generation) - atomically establish the new live author-session pointer - remove or supersede the stale pointer safely - leave repository, issue, branch, worktree, local head, and remote head unchanged - grant authority only to the matching author session - remain crash-safe, retry-safe, and auditable - return structured read-after-write evidence ### Fail closed for - live old PID - foreign or mismatched identity/profile - ambiguous ownership - unregistered or noncanonical worktree - worktree outside the canonical branches root - branch, issue, repository, or path disagreement - local- or remote-head movement - missing, added, removed, or modified dirty paths - fingerprint disagreement - competing session, issue lock, or lease - malformed or unverifiable durable state - symlink or traversal attempts - failure to read authoritative state - partial or replayed journal state ### Role boundaries - `gitea-author` may invoke only for its **exact same claimant** - `gitea-reconciler` may assess and, only if the capability model explicitly authorizes, execute the tightly pinned rebind **without** commit/publication authority - reviewer and merger roles **cannot** use it - permission-level `allowed=true` is **not** ownership proof ### Non-goals - Do not weaken ordinary author locking or mutation preflights - Do not add an automatic dirty-worktree exception to `gitea_lock_issue` / `bind_session_lock` - Do not replace the broader recovery system (#753/#772/#860) - Do not mutate #850, PR #853, #855, or the real #860 worktree during implementation - Do not manually edit lock or session files outside the sanctioned operation ## Acceptance criteria 1. Explicit MCP operation with full pin corroboration and structured RA/W evidence. 2. Successful dead-PID same-claimant dirty rebind preserves every dirty byte and fingerprint. 3. Atomic session-pointer replacement; no duplicate ownership after success or retry. 4. Fail-closed coverage for live PID, foreign claimant, profile mismatch, competing lock/session/lease, head movement, dirty-path/fingerprint drift, path/symlink/registration mismatches, malformed records. 5. Normal author commit preflight succeeds after rebind; ordinary dirty-worktree locking remains fail-closed. 6. Integration tests use real repositories, worktrees, lock files, and session pointers (not mocks alone). 7. Regression fixture matching the blocked #860 class without mutating the real worktree: claimant `jcwalker3` / `prgs-author`, stale/dead prior PID, no live session pointer, registered dirty worktree, matching local and remote head, seven fingerprint-pinned dirty paths, no competing ownership. 8. Focused + relevant regression suites green; exact commands and pass counts recorded. 9. Single PR closes this issue only; #850 / PR #853 / #855 / #860 worktree and PR #861 head `18d6583e8362b15621b0a9f4766c6e073419e627` remain unchanged by this work. ## Canonical next step ```text STATE: ready-for-author WHO_IS_NEXT: author NEXT_ACTION: Allocate a clean registered worktree from live master, implement the rebind operation + integration tests + #860-class fixture, publish one PR, hand off to gitea-reviewer ```

jcwalker3 added the mcp status:ready workflow-hardening recovery safety type:bug labels 2026-07-23 22:35:14 -05:00

jcwalker3 referenced this issue from a commit

2026-07-23 22:54:18 -05:00

feat(author): add dirty-preserving same-claimant author-session rebind (Closes #864)

jcwalker3 referenced a pull request that will close this issue

2026-07-23 22:55:10 -05:00

feat(author): dirty-preserving same-claimant author-session rebind (#864) #865

jcwalker3 added status:pr-open and removed status:ready labels 2026-07-23 22:55:11 -05:00

jcwalker3 commented

2026-07-23 22:56:01 -05:00

Canonical Issue State

STATE: pr-open / awaiting-review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Independent formal review of PR #865 for Issue #864; do not merge without approval.
NEXT_PROMPT:

Act as gitea-reviewer (prgs-reviewer) for Scaled-Tech-Consulting/Gitea-Tools on remote prgs.
Formally review PR #865 (Closes #864) at head a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23.
Scope: dirty-preserving same-claimant author-session rebind only. Do not mutate #850, PR #853, #855, or the real #860 worktree.

WHAT_HAPPENED: Author filed #864 after comprehensive duplicate search, allocated clean worktree from live master 6d0015c, implemented explicit rebind + tests, published commit a3f8f67c via sanctioned MCP, opened PR #865, status:pr-open.
WHY: Reconciler diagnosis BLOCKED + DIAGNOSE — OPERATOR REBIND CAPABILITY REQUIRED. Dead-PID same-claimant dirty worktrees cannot re-enter live author sessions without this capability; ordinary locking and #753/#772 recovery correctly refuse dirty worktrees.
RELATED_PRS: PR #865 (this); prerequisite for finishing #861 remediation; #860 remains separate (PID-less orphan recovery + remote sync).
BLOCKERS: none for reviewer start on #865.
VALIDATION: pytest tests/test_dirty_same_claimant_session_rebind.py tests/test_issue_lock_store.py tests/test_issue_753_dead_pid_lock_recovery.py tests/test_issue_772_unpublished_claim_recovery.py tests/test_issue_lock_provenance.py -q → 123 passed. Remote branch head == a3f8f67c93. Base master. Only PR for #864.
LAST_UPDATED_BY: jcwalker3 (prgs-author)

Author handoff

Duplicate search

No open/closed issue owned this exact capability. Adjacent: #753/#768/#772 (clean dead-session), #860 (dirty orphan PID-less + sync). Created #864.

Capability and safety model

Tool gitea_rebind_dirty_same_claimant_author_session
Full pin corroboration; dead PID required; fingerprint before/after; journal + CAS; in-place byte preservation only
Dead-owner session pointers no longer force foreign mutation workspaces

Role restrictions

author: same claimant only
reconciler: assess + optional tightly pinned execute (no commit/publication)
reviewer/merger: refused
permission allowed=true is not ownership

Crash and retry

Journal phases; mid-state retry resumes or fails closed; already_rebound idempotent when already live for this PID with matching fingerprints.

Tests

123 passed on focused rebind + lock-store + #753 + #772 + provenance suites.

Identifiers

Issue: #864
Branch: fix/issue-864-dirty-same-claimant-session-rebind
Commit / PR head: a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23
PR: #865 (only PR for #864; body Closes #864)

Non-mutation

#850 / PR #853 / #855 not touched
Real #860 worktree (baseline-master-issue-850 seven dirty paths) not rebound/cleaned/published by this work
This PR did not advance PR #861 (independently observed remote tip is 0b60fd6…; not authored here)

Request

Independent gitea-reviewer assessment of PR #865 at head a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23.

## Canonical Issue State STATE: pr-open / awaiting-review WHO_IS_NEXT: reviewer NEXT_ACTION: Independent formal review of PR #865 for Issue #864; do not merge without approval. NEXT_PROMPT: ```text Act as gitea-reviewer (prgs-reviewer) for Scaled-Tech-Consulting/Gitea-Tools on remote prgs. Formally review PR #865 (Closes #864) at head a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23. Scope: dirty-preserving same-claimant author-session rebind only. Do not mutate #850, PR #853, #855, or the real #860 worktree. ``` WHAT_HAPPENED: Author filed #864 after comprehensive duplicate search, allocated clean worktree from live master 6d0015c, implemented explicit rebind + tests, published commit a3f8f67c via sanctioned MCP, opened PR #865, status:pr-open. WHY: Reconciler diagnosis BLOCKED + DIAGNOSE — OPERATOR REBIND CAPABILITY REQUIRED. Dead-PID same-claimant dirty worktrees cannot re-enter live author sessions without this capability; ordinary locking and #753/#772 recovery correctly refuse dirty worktrees. RELATED_PRS: PR #865 (this); prerequisite for finishing #861 remediation; #860 remains separate (PID-less orphan recovery + remote sync). BLOCKERS: none for reviewer start on #865. VALIDATION: pytest tests/test_dirty_same_claimant_session_rebind.py tests/test_issue_lock_store.py tests/test_issue_753_dead_pid_lock_recovery.py tests/test_issue_772_unpublished_claim_recovery.py tests/test_issue_lock_provenance.py -q → 123 passed. Remote branch head == a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23. Base master. Only PR for #864. LAST_UPDATED_BY: jcwalker3 (prgs-author) --- ## Author handoff ### Duplicate search No open/closed issue owned this exact capability. Adjacent: #753/#768/#772 (clean dead-session), #860 (dirty orphan PID-less + sync). Created #864. ### Capability and safety model - Tool `gitea_rebind_dirty_same_claimant_author_session` - Full pin corroboration; dead PID required; fingerprint before/after; journal + CAS; in-place byte preservation only - Dead-owner session pointers no longer force foreign mutation workspaces ### Role restrictions - author: same claimant only - reconciler: assess + optional tightly pinned execute (no commit/publication) - reviewer/merger: refused - permission `allowed=true` is not ownership ### Crash and retry Journal phases; mid-state retry resumes or fails closed; `already_rebound` idempotent when already live for this PID with matching fingerprints. ### Tests `123 passed` on focused rebind + lock-store + #753 + #772 + provenance suites. ### Identifiers - Issue: **#864** - Branch: `fix/issue-864-dirty-same-claimant-session-rebind` - Commit / PR head: **`a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23`** - PR: **#865** (only PR for #864; body Closes #864) ### Non-mutation - #850 / PR #853 / #855 not touched - Real #860 worktree (baseline-master-issue-850 seven dirty paths) not rebound/cleaned/published by this work - This PR did not advance PR #861 (independently observed remote tip is `0b60fd6…`; not authored here) ### Request Independent **gitea-reviewer** assessment of PR #865 at head `a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23`.

sysadmin referenced this issue

2026-07-23 23:42:55 -05:00

feat(author): dirty-preserving same-claimant author-session rebind (#864) #865

sysadmin referenced this issue

2026-07-23 23:44:34 -05:00

feat(author): dirty-preserving same-claimant author-session rebind (#864) #865

sysadmin referenced this issue

2026-07-23 23:54:18 -05:00

feat(author): dirty-preserving same-claimant author-session rebind (#864) #865

sysadmin closed this issue

2026-07-23 23:55:04 -05:00

sysadmin referenced this issue from a commit