[P0] Replace capability-call adjacency with consumable mutation grants #889

New Issue

2026-07-24T21:10:32-05:00

jcwalker3 commented

2026-07-24 21:10:32 -05:00

Parent epic: #887
Priority: P0

Problem

Capability authorization is carried in global "last resolved task" state. Any intervening call — including read-only ones — invalidates it, producing preflight_order_violation. Correctness therefore depends on the agent emitting exactly two adjacent tool calls, which is a prompt-level property, not an enforced one. Different LLM clients fail this differently and unpredictably.

Acceptance criteria

Capability resolution returns an opaque, short-lived grant token.
The grant binds identity, profile, role, repository, task, operation, session, expiration, and the argument set it was issued against.
The intended mutation consumes the grant atomically and exactly once.
Read-only calls never invalidate an outstanding grant.
Replay, cross-operation, cross-repository, expired, and concurrent use all fail closed with distinct blocker kinds.
No prompt, skill, or doc needs to instruct the agent to make two adjacent tool calls; the adjacency requirement is removed, not documented.

Duplicate verdict

NOT a duplicate. Issue #726 is a specific internal_error return from gitea_resolve_task_capability for acquire_reviewer_pr_lease; nothing open addresses the adjacency model itself.

Parent epic: #887 Priority: P0 ## Problem Capability authorization is carried in global "last resolved task" state. Any intervening call — including read-only ones — invalidates it, producing `preflight_order_violation`. Correctness therefore depends on the agent emitting exactly two adjacent tool calls, which is a prompt-level property, not an enforced one. Different LLM clients fail this differently and unpredictably. ## Acceptance criteria - Capability resolution returns an opaque, short-lived grant token. - The grant binds identity, profile, role, repository, task, operation, session, expiration, and the argument set it was issued against. - The intended mutation consumes the grant atomically and exactly once. - Read-only calls never invalidate an outstanding grant. - Replay, cross-operation, cross-repository, expired, and concurrent use all fail closed with distinct blocker kinds. - No prompt, skill, or doc needs to instruct the agent to make two adjacent tool calls; the adjacency requirement is removed, not documented. ## Duplicate verdict NOT a duplicate. Issue #726 is a specific `internal_error` return from `gitea_resolve_task_capability` for `acquire_reviewer_pr_lease`; nothing open addresses the adjacency model itself.

jcwalker3 added the type:feature status:ready workflow-hardening safety mcp-health labels 2026-07-24 21:10:32 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#889