[P0] Unify author ownership and add fenced recovery #890

New Issue

2026-07-24T21:11:12-05:00

jcwalker3 commented

2026-07-24 21:11:12 -05:00

Parent epic: #887
Priority: P0

Problem

During the #663 run, seven stores claimed authority over author ownership and disagreed: Gitea assignment, workflow lease, keyed lock, session pointer file, generation counter, branch, and worktree. The gate layer still returned safe_next_action: proceed while they contradicted one another. Recovery had no sanctioned path and in practice meant waiting for lease expiry or editing lock files by hand.

Acceptance criteria

Exactly one authoritative transactional ownership record exists; all other representations are derived from it or removed.
The global "current issue" pointer is either removed or derived from that record — never independently writable.
Contradictory ownership can never return safe_next_action: proceed; it returns a specific blocker kind naming the disagreeing stores.
Add recover_author_ownership taking an expected-generation CAS and owner proof.
Omitting expected_generation cannot weaken fencing — the call fails rather than defaulting to unfenced.
Recovery never requires deliberately waiting for lease expiry.
Regression covers the #663 shape: a lock naming one issue while the session pointer references #651.

Duplicate verdict

PARTIAL overlap with #792 (terminal retirement of author issue leases, #790 Slice B) and #793 (complete lease fencing, #790 Slice C).

Scope boundary: this issue covers only the unification of the competing ownership stores and the fenced recovery entry point. The lease-lifecycle mechanics stay in #792 and #793 and must be consumed by this work, not restated in it.

Parent epic: #887 Priority: P0 ## Problem During the #663 run, seven stores claimed authority over author ownership and disagreed: Gitea assignment, workflow lease, keyed lock, session pointer file, generation counter, branch, and worktree. The gate layer still returned `safe_next_action: proceed` while they contradicted one another. Recovery had no sanctioned path and in practice meant waiting for lease expiry or editing lock files by hand. ## Acceptance criteria - Exactly one authoritative transactional ownership record exists; all other representations are derived from it or removed. - The global "current issue" pointer is either removed or derived from that record — never independently writable. - Contradictory ownership can never return `safe_next_action: proceed`; it returns a specific blocker kind naming the disagreeing stores. - Add `recover_author_ownership` taking an expected-generation CAS and owner proof. - Omitting `expected_generation` cannot weaken fencing — the call fails rather than defaulting to unfenced. - Recovery never requires deliberately waiting for lease expiry. - Regression covers the #663 shape: a lock naming one issue while the session pointer references #651. ## Duplicate verdict PARTIAL overlap with #792 (terminal retirement of author issue leases, #790 Slice B) and #793 (complete lease fencing, #790 Slice C). Scope boundary: this issue covers only the unification of the competing ownership stores and the fenced recovery entry point. The lease-lifecycle mechanics stay in #792 and #793 and must be consumed by this work, not restated in it.

jcwalker3 added the status:ready workflow-hardening anti-stomp safety type:bug labels 2026-07-24 21:11:14 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#890