Scaled-Tech-Consulting/Gitea-Tools
4
0
Fork 0
Code Issues 110 Pull Requests 12 Actions Packages Projects Releases Wiki Activity

Epic: Make author workflows transactional and safe for multiple LLM clients #887

New Issue
Open
opened 2026-07-24 21:09:41 -05:00 by jcwalker3 · 2 comments
jcwalker3 commented 2026-07-24 21:09:41 -05:00
Owner
Copy Link
Copy Source

Problem

Author workflows are a chain of independently-failing operations with no transaction boundary. Every stage keeps its own state (assignment, workflow lease, keyed lock, /tmp pointer file, generation counter, branch, worktree), and those stores are allowed to contradict one another while the gate layer still reports safe_next_action: proceed. When any single stage fails, the run leaves durable, contradictory state that the next worker — often a different LLM client — cannot interpret or recover from without operator repair.

Observed consequences, all reproduced on live runs:

  • Test suites mutated production workflow state (lock generation counters, /tmp/gitea_issue_lock.json, the global current-issue pointer).
  • preflight_order_violation fires whenever any call — including read-only ones — lands between capability resolution and the intended mutation, so correctness depends on prompt-level instructions to emit two adjacent tool calls.
  • Ownership records disagreed with each other while still reporting proceed.
  • Publish / PR-create / reviewer-handoff / lease-retire are four separate fragile steps, so interruption between any two strands the branch.
  • One transient dirty-checkout observation permanently blocked a run whose immediate diff was empty.
  • A resolved commit_files capability was followed by shell git add / git commit, bypassing the native path entirely.
  • Failed gates prohibited posting the diagnostic handoff, so the failure left no durable record for later workers.

Scope

Eight children: five P0 (correctness and isolation), three P1 (stability, enforcement, observability).

Priority Child
P0 Isolate tests from live workflow state
P0 Replace capability-call adjacency with consumable mutation grants
P0 Unify author ownership and add fenced recovery
P0 Add atomic author finalization
P0 Break the author worktree bootstrap deadlock
P1 Stabilize transient dirty-checkout verification
P1 Enforce native MCP commits
P1 Preserve failure reporting after hard stops

Child issue numbers are linked in a follow-up comment on this issue.

Epic completion gate

Do not restart unattended looping until all of the following hold:

  • All P0 children are closed.
  • The full test suite provably cannot mutate live workflow state.
  • Two different LLM clients each complete a supervised end-to-end author canary (allocate -> lock -> commit -> publish -> PR -> handoff -> retire).
  • No call-adjacency instructions are required in any prompt or skill.
  • No run depends on lease expiry, generation omission, manual lock-file editing, shell publication, or operator repair.
  • Every failure produces a durable diagnostic record discoverable by the next worker.

Non-goals

  • Redesigning the reviewer or merger role chains.
  • Replacing the MCP transport or role-namespace model.
  • Changing Gitea-side branch protection.

Duplicate verdict

No existing epic covers this scope. Issue #820 is the control-plane architecture program and is a different scope. Verified against a full scan of open issues at master ccde9e8f1183bc9a6672393a9923f304086fb874.

## Problem Author workflows are a chain of independently-failing operations with no transaction boundary. Every stage keeps its own state (assignment, workflow lease, keyed lock, `/tmp` pointer file, generation counter, branch, worktree), and those stores are allowed to contradict one another while the gate layer still reports `safe_next_action: proceed`. When any single stage fails, the run leaves durable, contradictory state that the next worker — often a different LLM client — cannot interpret or recover from without operator repair. Observed consequences, all reproduced on live runs: - Test suites mutated production workflow state (lock generation counters, `/tmp/gitea_issue_lock.json`, the global current-issue pointer). - `preflight_order_violation` fires whenever any call — including read-only ones — lands between capability resolution and the intended mutation, so correctness depends on prompt-level instructions to emit two adjacent tool calls. - Ownership records disagreed with each other while still reporting proceed. - Publish / PR-create / reviewer-handoff / lease-retire are four separate fragile steps, so interruption between any two strands the branch. - One transient dirty-checkout observation permanently blocked a run whose immediate diff was empty. - A resolved `commit_files` capability was followed by shell `git add` / `git commit`, bypassing the native path entirely. - Failed gates prohibited posting the diagnostic handoff, so the failure left no durable record for later workers. ## Scope Eight children: five P0 (correctness and isolation), three P1 (stability, enforcement, observability). | Priority | Child | | -------- | ----- | | P0 | Isolate tests from live workflow state | | P0 | Replace capability-call adjacency with consumable mutation grants | | P0 | Unify author ownership and add fenced recovery | | P0 | Add atomic author finalization | | P0 | Break the author worktree bootstrap deadlock | | P1 | Stabilize transient dirty-checkout verification | | P1 | Enforce native MCP commits | | P1 | Preserve failure reporting after hard stops | Child issue numbers are linked in a follow-up comment on this issue. ## Epic completion gate Do not restart unattended looping until all of the following hold: - All P0 children are closed. - The full test suite provably cannot mutate live workflow state. - Two different LLM clients each complete a supervised end-to-end author canary (allocate -> lock -> commit -> publish -> PR -> handoff -> retire). - No call-adjacency instructions are required in any prompt or skill. - No run depends on lease expiry, generation omission, manual lock-file editing, shell publication, or operator repair. - Every failure produces a durable diagnostic record discoverable by the next worker. ## Non-goals - Redesigning the reviewer or merger role chains. - Replacing the MCP transport or role-namespace model. - Changing Gitea-side branch protection. ## Duplicate verdict No existing epic covers this scope. Issue #820 is the control-plane architecture program and is a different scope. Verified against a full scan of open issues at master `ccde9e8f1183bc9a6672393a9923f304086fb874`.
jcwalker3 commented 2026-07-24 22:01:43 -05:00
Author
Owner
Copy Link
Copy Source

[THREAD STATE LEDGER] Issue #887 — infrastructure coverage for the three defects required alongside this epic

What is true now:

  • Server-side decision state: server-side state changed — three infrastructure defects that sit alongside this epic now have durable trackers. #899 owns author-loop disable enforcement, #900 owns MCP daemon cohort lifecycle supervision, #689 owns deterministic namespace attachment.
  • Local verdict/state: prgs-author session, identity jcwalker3, remote prgs, repo Scaled-Tech-Consulting/Gitea-Tools. Runtime parity green throughout: daemon_start_head, local_head, current_head, and live_remote_head all a4c73766f4, mutation_safe true, restart_required false.
  • Latest known validation: read-back of #899, #900, and #689 confirms open state with valid workflow labels; the #689 edit verified read-after-write with labels, state, assignees, and milestone unchanged.

What changed:

  • #689 was promoted from a two-line incident record to the canonical deterministic-attachment tracker. Its original incident text is preserved verbatim; scope, a coverage table, nine acceptance criteria, and explicit non-goals were added. Title now names the tracker while retaining the incident provenance.
  • #899 was created as a child of #797, covering the loop-disable requirements that #804, #805, and #799 leave open: disable actually stopping a scheduled worker, no respawn after disable, refusal of author work while looping is administratively disabled, and regression for bootout plus restart and login persistence.
  • #900 was created to bound the daemon cohort population: one eligible cohort per profile and configuration, drain and reap of superseded cohorts, no accumulation across reconnects, and full cohort identity in status output.
  • Coverage assessment recorded: of the fifteen requirements across the three defects, one was already fully covered. Loop-disable status exposure is satisfied by #799 acceptance criteria for per-worker state display combined with the #797 registry field for enabled or paused state.

What is blocked:

  • Blocker classification: no blocker

Who/what acts next:

  • Next actor: author
  • Required action: implement #899, #900, and #689 as independent work units. They have different owners and different acceptance tests and must stay separate work items.
  • Do not do: do not treat #897 as lifecycle or attachment coverage, since it scopes only blocker and permission classification. Do not collapse #689 into #708, which explicitly scopes itself to Connected-versus-attached and asks not to be consolidated with transport-pinning trackers. Do not collapse #900 into #686, which is provenance detection for manually launched servers and does not bound the sanctioned cohort population.

Canonical Issue State

STATE:
open — epic children complete; adjacent infrastructure coverage now tracked

WHO_IS_NEXT:
author

NEXT_ACTION:
Implement the three infrastructure trackers independently: #899 loop-disable enforcement, #900 cohort lifecycle supervision, #689 deterministic attachment.

NEXT_PROMPT:

Role: AUTHOR
Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools
Issue: one of #899, #900, #689

1. gitea_whoami + gitea_resolve_task_capability on prgs-author; bind a branches/ worktree.
2. Implement the selected tracker's acceptance criteria only; do not absorb the other two.
3. PR with Closes for that issue; stop; hand off to independent reviewer.

WHAT_HAPPENED:
A focused infrastructure-coverage audit compared the exact bodies, comments, and acceptance criteria of #686, #689, #708, #678, #669, #655, #659, and the #797 worker-management family against the fifteen requirements for loop-disable enforcement, daemon lifecycle supervision, and deterministic namespace attachment. Only one requirement was fully covered. Two trackers were created and one was extended so every remaining requirement has a durable home.

WHY:
The epic's completion gate forbids restarting unattended looping until failures are durably recorded and recoverable. That gate cannot be evaluated while loop-disable is an operator convention, daemon cohorts accumulate unbounded, and attachment to a parity-matching cohort is unverifiable.

RELATED_PRS:
none

BLOCKERS:
none

VALIDATION:
Parity re-checked after every mutation and unchanged at a4c73766f4. #899 and #900 returned valid workflow label validation with exactly one type label and one status label each. #689 returned verified true with preserved_intact true and an empty mismatch list.

LAST_UPDATED_BY:
jcwalker3 / prgs-author / AUTHOR / 2026-07-24

[THREAD STATE LEDGER] Issue #887 — infrastructure coverage for the three defects required alongside this epic What is true now: - Server-side decision state: server-side state changed — three infrastructure defects that sit alongside this epic now have durable trackers. #899 owns author-loop disable enforcement, #900 owns MCP daemon cohort lifecycle supervision, #689 owns deterministic namespace attachment. - Local verdict/state: prgs-author session, identity jcwalker3, remote prgs, repo Scaled-Tech-Consulting/Gitea-Tools. Runtime parity green throughout: daemon_start_head, local_head, current_head, and live_remote_head all a4c73766f4b0cc32f7c3808688eceeb6fee74335, mutation_safe true, restart_required false. - Latest known validation: read-back of #899, #900, and #689 confirms open state with valid workflow labels; the #689 edit verified read-after-write with labels, state, assignees, and milestone unchanged. What changed: - #689 was promoted from a two-line incident record to the canonical deterministic-attachment tracker. Its original incident text is preserved verbatim; scope, a coverage table, nine acceptance criteria, and explicit non-goals were added. Title now names the tracker while retaining the incident provenance. - #899 was created as a child of #797, covering the loop-disable requirements that #804, #805, and #799 leave open: disable actually stopping a scheduled worker, no respawn after disable, refusal of author work while looping is administratively disabled, and regression for bootout plus restart and login persistence. - #900 was created to bound the daemon cohort population: one eligible cohort per profile and configuration, drain and reap of superseded cohorts, no accumulation across reconnects, and full cohort identity in status output. - Coverage assessment recorded: of the fifteen requirements across the three defects, one was already fully covered. Loop-disable status exposure is satisfied by #799 acceptance criteria for per-worker state display combined with the #797 registry field for enabled or paused state. What is blocked: - Blocker classification: no blocker Who/what acts next: - Next actor: author - Required action: implement #899, #900, and #689 as independent work units. They have different owners and different acceptance tests and must stay separate work items. - Do not do: do not treat #897 as lifecycle or attachment coverage, since it scopes only blocker and permission classification. Do not collapse #689 into #708, which explicitly scopes itself to Connected-versus-attached and asks not to be consolidated with transport-pinning trackers. Do not collapse #900 into #686, which is provenance detection for manually launched servers and does not bound the sanctioned cohort population. ## Canonical Issue State STATE: open — epic children complete; adjacent infrastructure coverage now tracked WHO_IS_NEXT: author NEXT_ACTION: Implement the three infrastructure trackers independently: #899 loop-disable enforcement, #900 cohort lifecycle supervision, #689 deterministic attachment. NEXT_PROMPT: ```text Role: AUTHOR Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools Issue: one of #899, #900, #689 1. gitea_whoami + gitea_resolve_task_capability on prgs-author; bind a branches/ worktree. 2. Implement the selected tracker's acceptance criteria only; do not absorb the other two. 3. PR with Closes for that issue; stop; hand off to independent reviewer. ``` WHAT_HAPPENED: A focused infrastructure-coverage audit compared the exact bodies, comments, and acceptance criteria of #686, #689, #708, #678, #669, #655, #659, and the #797 worker-management family against the fifteen requirements for loop-disable enforcement, daemon lifecycle supervision, and deterministic namespace attachment. Only one requirement was fully covered. Two trackers were created and one was extended so every remaining requirement has a durable home. WHY: The epic's completion gate forbids restarting unattended looping until failures are durably recorded and recoverable. That gate cannot be evaluated while loop-disable is an operator convention, daemon cohorts accumulate unbounded, and attachment to a parity-matching cohort is unverifiable. RELATED_PRS: none BLOCKERS: none VALIDATION: Parity re-checked after every mutation and unchanged at a4c73766f4b0cc32f7c3808688eceeb6fee74335. #899 and #900 returned valid workflow label validation with exactly one type label and one status label each. #689 returned verified true with preserved_intact true and an empty mismatch list. LAST_UPDATED_BY: jcwalker3 / prgs-author / AUTHOR / 2026-07-24
jcwalker3 commented 2026-07-28 03:02:56 -05:00
Author
Owner
Copy Link
Copy Source

[THREAD STATE LEDGER] Issue #887 — verified children, #948 placement, and the five-client canary

What is true now

  • Server-side decision state: this epic's children and their dependency order are verified live at master aad5c8b42361d380a8eeb07b94b90815e594c2c5. The five-client concurrency canary now has a durable tracker, #963, parented here.
  • Local verdict/state: prgs-author session, identity jcwalker3, remote prgs, repo Scaled-Tech-Consulting/Gitea-Tools. Runtime parity verified: startup_head, daemon_start_head, local_head, current_head, and live_remote_head all aad5c8b42361d380a8eeb07b94b90815e594c2c5; mutation_safe true; live_stale false; restart_required false.
  • Latest known validation: read-back of #963 confirms issue state open, full body, and valid workflow labels.

Verified children of this epic

Priority Issue Issue state
P0 #888 — isolate tests from live workflow state open
P0 #889 — replace capability-call adjacency with consumable mutation grants open
P0 #890 — unify author ownership and add fenced recovery open
P0 #891 — add atomic author finalization open
P0 #892 — break the author worktree bootstrap deadlock closed
P1 #893 — stabilize transient dirty-checkout verification open
P1 #894 — enforce native MCP commits open
P1 #895 — preserve failure reporting after hard stops open
— #896 — isolate reviewer final-decision locks by PR and exact head open
— #963 — five concurrent LLM clients with a negative concurrency suite open (created this session)

#948 placement

#948 is the canonical client/session-aware generation-ownership issue, and it is recorded here as belonging to this epic's scope. It previously carried no documented parent. It owns worker identity distinct from role and profile (AC26 through AC44), atomic lease acquisition with fencing (AC9 through AC16), heartbeat and expiration (AC11, AC14), author and reviewer independence (AC18), exact-head verdict and merge gating (AC19 through AC21), and the identity invariants: worker_identity unique, role not unique, profile not unique, exclusivity on the active lease target only. It reconciles #686 and #900 explicitly.

Verified relationships

  • #949 — the native fleet inventory and duplicate-process tracker. Preserved and deliberately untouched; its branch, worktree, lock, and uncreated pull request are unchanged. #963 depends on it because a concurrency canary cannot assert fleet state it cannot enumerate.
  • #953 / PR #954 — satisfied. PR #954 is in state closed with merge_commit_sha aad5c8b42361d380a8eeb07b94b90815e594c2c5, and #953 is in state closed. This removes the prerequisite that previously blocked the P0 chain; #888, #889, #890, and #891 are now implementation-eligible.
  • #896 and #916 — together they own exact-head review validity and a mandatory reviewer verdict recorded at the current head before any merge operation. #963 depends on both, and asserts them adversarially: a reviewer submitting a verdict on its own authored pull request is refused, and a merge attempted at a head other than the head carrying the reviewer verdict is refused.
  • #963 — depends on #948, #949, #890, #891, #896, and #916. It exists because this epic's completion gate names two clients and the author role only. Two is not five, an epic completion gate is prose no code consults, and #948 AC24 runs simulated clients inside pytest rather than five real concurrent ones.
  • #964 — the combined certification gate, parented under the coordination umbrella #955. It makes unattended scheduling fail closed until #963 and #962 both certify.

Dependency order for this epic

#953 / PR #954 (satisfied; PR state closed, merge_commit_sha aad5c8b42361)
  └─> #888, #889, #890, #891  (P0, unblocked)
        └─> #893, #894, #895  (P1)
#948 ─> #900, #792, #793, #896, #916
#949 ─> #950, #951, #952
[#887 P0 complete] + #948 + #949 ─> #963 ─> #964

What changed

  • Server-side mutation ledger: #963 created and parented to this epic; this comment. No other issue, label, branch, pull request, or lease was modified.
  • Local: none. No branch, worktree, commit, or push.

What is blocked

  • Blocker classification: no blocker.
  • #963 carries the status:blocked label pending its listed dependencies, which is its designed state, not a defect.

Who/what acts next

  • Next actor: author.
  • Required action: implement the P0 children #888, #889, #890, and #891 as independent work units, now unblocked because PR #954 reached state closed with merge_commit_sha aad5c8b42361d380a8eeb07b94b90815e594c2c5.
  • Do not do: do not modify or recover #949; do not modify PR #954; do not collapse #963 into #948, which owns the concurrency implementation while #963 only proves it end to end with five real clients.

Canonical Issue State

STATE:
open — children verified; #948 placement recorded; five-client canary tracked as #963

WHO_IS_NEXT:
author

NEXT_ACTION:
Implement the P0 children #888, #889, #890, and #891, now unblocked because PR #954 reached state closed with merge_commit_sha aad5c8b423.

NEXT_PROMPT:

Role: AUTHOR
Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools
Issue: one of #888, #889, #890, #891

1. gitea_whoami + gitea_resolve_task_capability(work_issue) on prgs-author; bind a branches/ worktree.
2. Implement the selected child's acceptance criteria only; do not absorb its siblings.
3. Do not modify or recover #949. Do not modify PR #954.
4. Open a PR with a Closes reference for that issue; stop; hand off to an independent reviewer.

WHAT_HAPPENED:
A live roadmap audit mapped every multi-LLM requirement to a canonical owner at master aad5c8b423. Three requirements had no owner: a five-client simultaneous canary, a negative concurrency suite covering repository crossover, and a certification gate on unattended scheduling. #963 was created under this epic for the first two. #964 was created under umbrella #955 for the third. #948 was confirmed as the canonical generation-ownership issue and its placement under this epic is recorded here.

WHY:
This epic's completion gate requires two different LLM clients to complete a supervised author canary. That gate is prose in an epic body, owned by no issue and testable by no command, and the operator runs five scheduled workers rather than two. #948 covers the implementation but its concurrency tests are simulated. Without #963 the gate cannot be evaluated, and without #964 nothing prevents unattended scheduling from starting before it is.

ISSUE: 887

RELATED_PRS:
954 (PR state closed, merge_commit_sha aad5c8b42361d380a8eeb07b94b90815e594c2c5; satisfies #953)

BLOCKERS:
none

VALIDATION:
Parity verified before and after every mutation and unchanged at aad5c8b423 with mutation_safe true, live_stale false, restart_required false. The create_issue capability was resolved immediately before each creation. #963 was read back natively: issue state open, correct title, complete body, eight valid workflow labels with exactly one type label and one status label. The duplicate search was repeated after creation and returned exactly one instance of each new title.

LAST_UPDATED_BY:
jcwalker3 / prgs-author / AUTHOR / 2026-07-28

[THREAD STATE LEDGER] Issue #887 — verified children, #948 placement, and the five-client canary **What is true now** - Server-side decision state: this epic's children and their dependency order are verified live at master `aad5c8b42361d380a8eeb07b94b90815e594c2c5`. The five-client concurrency canary now has a durable tracker, #963, parented here. - Local verdict/state: prgs-author session, identity jcwalker3, remote prgs, repo Scaled-Tech-Consulting/Gitea-Tools. Runtime parity verified: startup_head, daemon_start_head, local_head, current_head, and live_remote_head all `aad5c8b42361d380a8eeb07b94b90815e594c2c5`; mutation_safe true; live_stale false; restart_required false. - Latest known validation: read-back of #963 confirms issue state open, full body, and valid workflow labels. **Verified children of this epic** | Priority | Issue | Issue state | | --- | --- | --- | | P0 | #888 — isolate tests from live workflow state | open | | P0 | #889 — replace capability-call adjacency with consumable mutation grants | open | | P0 | #890 — unify author ownership and add fenced recovery | open | | P0 | #891 — add atomic author finalization | open | | P0 | #892 — break the author worktree bootstrap deadlock | closed | | P1 | #893 — stabilize transient dirty-checkout verification | open | | P1 | #894 — enforce native MCP commits | open | | P1 | #895 — preserve failure reporting after hard stops | open | | — | #896 — isolate reviewer final-decision locks by PR and exact head | open | | — | #963 — five concurrent LLM clients with a negative concurrency suite | open (created this session) | **#948 placement** #948 is the canonical client/session-aware generation-ownership issue, and it is recorded here as belonging to this epic's scope. It previously carried no documented parent. It owns worker identity distinct from role and profile (AC26 through AC44), atomic lease acquisition with fencing (AC9 through AC16), heartbeat and expiration (AC11, AC14), author and reviewer independence (AC18), exact-head verdict and merge gating (AC19 through AC21), and the identity invariants: `worker_identity` unique, role not unique, profile not unique, exclusivity on the active lease target only. It reconciles #686 and #900 explicitly. **Verified relationships** - **#949** — the native fleet inventory and duplicate-process tracker. Preserved and deliberately untouched; its branch, worktree, lock, and uncreated pull request are unchanged. #963 depends on it because a concurrency canary cannot assert fleet state it cannot enumerate. - **#953 / PR #954** — satisfied. PR #954 is in state closed with merge_commit_sha `aad5c8b42361d380a8eeb07b94b90815e594c2c5`, and #953 is in state closed. This removes the prerequisite that previously blocked the P0 chain; #888, #889, #890, and #891 are now implementation-eligible. - **#896** and **#916** — together they own exact-head review validity and a mandatory reviewer verdict recorded at the current head before any merge operation. #963 depends on both, and asserts them adversarially: a reviewer submitting a verdict on its own authored pull request is refused, and a merge attempted at a head other than the head carrying the reviewer verdict is refused. - **#963** — depends on #948, #949, #890, #891, #896, and #916. It exists because this epic's completion gate names two clients and the author role only. Two is not five, an epic completion gate is prose no code consults, and #948 AC24 runs simulated clients inside pytest rather than five real concurrent ones. - **#964** — the combined certification gate, parented under the coordination umbrella #955. It makes unattended scheduling fail closed until #963 and #962 both certify. **Dependency order for this epic** ``` #953 / PR #954 (satisfied; PR state closed, merge_commit_sha aad5c8b42361) └─> #888, #889, #890, #891 (P0, unblocked) └─> #893, #894, #895 (P1) #948 ─> #900, #792, #793, #896, #916 #949 ─> #950, #951, #952 [#887 P0 complete] + #948 + #949 ─> #963 ─> #964 ``` **What changed** - Server-side mutation ledger: #963 created and parented to this epic; this comment. No other issue, label, branch, pull request, or lease was modified. - Local: none. No branch, worktree, commit, or push. **What is blocked** - Blocker classification: no blocker. - #963 carries the `status:blocked` label pending its listed dependencies, which is its designed state, not a defect. **Who/what acts next** - Next actor: author. - Required action: implement the P0 children #888, #889, #890, and #891 as independent work units, now unblocked because PR #954 reached state closed with merge_commit_sha `aad5c8b42361d380a8eeb07b94b90815e594c2c5`. - Do not do: do not modify or recover #949; do not modify PR #954; do not collapse #963 into #948, which owns the concurrency implementation while #963 only proves it end to end with five real clients. ## Canonical Issue State STATE: open — children verified; #948 placement recorded; five-client canary tracked as #963 WHO_IS_NEXT: author NEXT_ACTION: Implement the P0 children #888, #889, #890, and #891, now unblocked because PR #954 reached state closed with merge_commit_sha aad5c8b42361d380a8eeb07b94b90815e594c2c5. NEXT_PROMPT: ```text Role: AUTHOR Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools Issue: one of #888, #889, #890, #891 1. gitea_whoami + gitea_resolve_task_capability(work_issue) on prgs-author; bind a branches/ worktree. 2. Implement the selected child's acceptance criteria only; do not absorb its siblings. 3. Do not modify or recover #949. Do not modify PR #954. 4. Open a PR with a Closes reference for that issue; stop; hand off to an independent reviewer. ``` WHAT_HAPPENED: A live roadmap audit mapped every multi-LLM requirement to a canonical owner at master aad5c8b42361d380a8eeb07b94b90815e594c2c5. Three requirements had no owner: a five-client simultaneous canary, a negative concurrency suite covering repository crossover, and a certification gate on unattended scheduling. #963 was created under this epic for the first two. #964 was created under umbrella #955 for the third. #948 was confirmed as the canonical generation-ownership issue and its placement under this epic is recorded here. WHY: This epic's completion gate requires two different LLM clients to complete a supervised author canary. That gate is prose in an epic body, owned by no issue and testable by no command, and the operator runs five scheduled workers rather than two. #948 covers the implementation but its concurrency tests are simulated. Without #963 the gate cannot be evaluated, and without #964 nothing prevents unattended scheduling from starting before it is. ISSUE: 887 RELATED_PRS: 954 (PR state closed, merge_commit_sha aad5c8b42361d380a8eeb07b94b90815e594c2c5; satisfies #953) BLOCKERS: none VALIDATION: Parity verified before and after every mutation and unchanged at aad5c8b42361d380a8eeb07b94b90815e594c2c5 with mutation_safe true, live_stale false, restart_required false. The create_issue capability was resolved immediately before each creation. #963 was read back natively: issue state open, correct title, complete body, eight valid workflow labels with exactly one type label and one status label. The duplicate search was repeated after creation and returned exactly one instance of each new title. LAST_UPDATED_BY: jcwalker3 / prgs-author / AUTHOR / 2026-07-28
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No labels mcp-health safety status:ready tracker type:feature workflow-hardening
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 jwalker (Regular User Account) superadmin (Admin Account) sysadmin (Regular User Account)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#887