Scaled-Tech-Consulting/Gitea-Tools
4
0
Fork 0
Code Issues 110 Pull Requests 12 Actions Packages Projects Releases Wiki Activity

fix(author bootstrap): restore missing runtime identity and session helpers #943

New Issue
Closed
opened 2026-07-26 07:29:45 -05:00 by jcwalker3 · 4 comments
jcwalker3 commented 2026-07-26 07:29:45 -05:00
Owner
Copy Link
Copy Source

Summary

The sanctioned gitea_bootstrap_author_issue_worktree capability crashes before entering author_issue_bootstrap.bootstrap_author_issue_worktree because gitea_mcp_server.py references three undefined helpers:

  • _active_username
  • _active_profile_name
  • _current_session_id

This makes native author issue-worktree bootstrap unusable for every caller, including dry_run=true.

Observed failure

Commissioning was performed against deployed revision:

aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218

The sanctioned call used:

issue_number=941
expected_base_sha=aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218
dry_run=true
remote=prgs
org=Scaled-Tech-Consulting
repo=Gitea-Tools
idempotency_key=commission-941-readonly-aab54d48

Result:

success=false
reason_code=internal_error
exception_class=builtins.NameError
detail=name '_active_username' is not defined
retryable=false
transport_survives=true

The failure occurs while evaluating arguments around gitea_mcp_server.py:10235, before the underlying bootstrap function executes.

Source inspection found:

Helper References Definitions
_active_username 1 0
_active_profile_name 1 0
_current_session_id 1 0

Provenance

The undefined references were introduced by commit a942afe, "Implement native author issue worktree bootstrap (#850)."

This is separate from #941 and PR #942. PR #942 successfully corrected the bootstrap scope guard: commissioning passed verify_preflight_purity and advanced beyond the former missing_issue_worktree refusal before reaching this latent NameError.

Impact

  • gitea_bootstrap_author_issue_worktree is unconditionally broken at the deployed revision.
  • Both dry-run and apply paths are affected.
  • Authors cannot obtain a sanctioned issue-backed worktree through this capability.
  • Issue #931 remains blocked from beginning implementation through the canonical workflow.
  • The defect was previously masked by the #941 scope-guard failure.

Expected behavior

The MCP wrapper must obtain the active username, profile, and session identifier through defined, canonical runtime-context accessors and invoke the underlying bootstrap service successfully.

With dry_run=true, the capability must:

  1. Pass the workflow scope guard for the explicitly sanctioned bootstrap scope.
  2. Validate repository, issue, identity, role, profile, session, and expected-base bindings.
  3. Reach and complete the underlying bootstrap dry-run.
  4. Return the planned transition without creating a branch, worktree, assignment, or persistent lease.
  5. Avoid NameError, internal errors, or reliance on undefined globals.

Acceptance criteria

  • Replace or correctly define all three missing runtime-context helpers.
  • Use the canonical runtime/profile/session sources rather than duplicated or inferred state.
  • Add regression coverage proving every referenced helper is defined and callable.
  • Add an integration-level test for gitea_bootstrap_author_issue_worktree(dry_run=true).
  • Test both successful identity/session binding and fail-closed mismatch behavior.
  • Confirm the expected-base SHA is evaluated by the underlying bootstrap service.
  • Confirm dry-run performs no repository mutation.
  • Confirm apply mode can proceed to the intended transition when all gates pass.
  • Preserve wrong-role, wrong-profile, wrong-identity, stale-runtime, and scope-guard enforcement.
  • Recommission the deployed capability after merge and restart.
  • Keep issue #931 untouched until commissioning succeeds.

Related work

  • #850 — introduced native author issue-worktree bootstrap
  • #941 — bootstrap scope-guard defect
  • PR #942 — fixed #941 and exposed this previously masked failure
  • #931 — remains untouched and blocked pending a working sanctioned bootstrap path
## Summary The sanctioned `gitea_bootstrap_author_issue_worktree` capability crashes before entering `author_issue_bootstrap.bootstrap_author_issue_worktree` because `gitea_mcp_server.py` references three undefined helpers: * `_active_username` * `_active_profile_name` * `_current_session_id` This makes native author issue-worktree bootstrap unusable for every caller, including `dry_run=true`. ## Observed failure Commissioning was performed against deployed revision: `aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218` The sanctioned call used: ```text issue_number=941 expected_base_sha=aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218 dry_run=true remote=prgs org=Scaled-Tech-Consulting repo=Gitea-Tools idempotency_key=commission-941-readonly-aab54d48 ``` Result: ```text success=false reason_code=internal_error exception_class=builtins.NameError detail=name '_active_username' is not defined retryable=false transport_survives=true ``` The failure occurs while evaluating arguments around `gitea_mcp_server.py:10235`, before the underlying bootstrap function executes. Source inspection found: | Helper | References | Definitions | | ---------------------- | ---------: | ----------: | | `_active_username` | 1 | 0 | | `_active_profile_name` | 1 | 0 | | `_current_session_id` | 1 | 0 | ## Provenance The undefined references were introduced by commit `a942afe`, "Implement native author issue worktree bootstrap (#850)." This is separate from #941 and PR #942. PR #942 successfully corrected the bootstrap scope guard: commissioning passed `verify_preflight_purity` and advanced beyond the former `missing_issue_worktree` refusal before reaching this latent `NameError`. ## Impact * `gitea_bootstrap_author_issue_worktree` is unconditionally broken at the deployed revision. * Both dry-run and apply paths are affected. * Authors cannot obtain a sanctioned issue-backed worktree through this capability. * Issue #931 remains blocked from beginning implementation through the canonical workflow. * The defect was previously masked by the #941 scope-guard failure. ## Expected behavior The MCP wrapper must obtain the active username, profile, and session identifier through defined, canonical runtime-context accessors and invoke the underlying bootstrap service successfully. With `dry_run=true`, the capability must: 1. Pass the workflow scope guard for the explicitly sanctioned bootstrap scope. 2. Validate repository, issue, identity, role, profile, session, and expected-base bindings. 3. Reach and complete the underlying bootstrap dry-run. 4. Return the planned transition without creating a branch, worktree, assignment, or persistent lease. 5. Avoid `NameError`, internal errors, or reliance on undefined globals. ## Acceptance criteria * Replace or correctly define all three missing runtime-context helpers. * Use the canonical runtime/profile/session sources rather than duplicated or inferred state. * Add regression coverage proving every referenced helper is defined and callable. * Add an integration-level test for `gitea_bootstrap_author_issue_worktree(dry_run=true)`. * Test both successful identity/session binding and fail-closed mismatch behavior. * Confirm the expected-base SHA is evaluated by the underlying bootstrap service. * Confirm dry-run performs no repository mutation. * Confirm apply mode can proceed to the intended transition when all gates pass. * Preserve wrong-role, wrong-profile, wrong-identity, stale-runtime, and scope-guard enforcement. * Recommission the deployed capability after merge and restart. * Keep issue #931 untouched until commissioning succeeds. ## Related work * #850 — introduced native author issue-worktree bootstrap * #941 — bootstrap scope-guard defect * PR #942 — fixed #941 and exposed this previously masked failure * #931 — remains untouched and blocked pending a working sanctioned bootstrap path
jcwalker3 added the status:readyworkflow-hardeningsafetytype:bug labels 2026-07-26 07:29:46 -05:00
jcwalker3 added status:pr-open and removed status:ready labels 2026-07-26 07:59:37 -05:00
jcwalker3 commented 2026-07-26 08:02:31 -05:00
Author
Owner
Copy Link
Copy Source

[THREAD STATE LEDGER] Issue #943 / PR #944 — implementation delivered, awaiting independent review

What is true now:

  • Issue state: open, status:pr-open
  • PR state: PR #944 open, mergeable, base master
  • Current head SHA: f49e781102
  • Base SHA: aab54d4825 (verified as the commit parent)
  • Server-side decision state: no review verdict exists on PR #944
  • Local verdict/state: none — the author does not review its own work
  • Latest known validation: 27 new tests pass; 245 pass across targeted bootstrap and guard suites; full suite 28 failed / 5552 passed / 6 skipped / 1006 subtests, where all 28 also fail on the unmodified base

What changed:

  • server-side state changed: branch fix/issue-943-runtime-context-helpers pushed at f49e781102, PR #944 opened, issue #943 moved to status:pr-open

What is blocked:

  • Blocker classification: no blocker

Who/what acts next:

  • Next actor: reviewer
  • Required action: review PR #944 against the #943 acceptance criteria at pinned head f49e781102
  • Do not do: self-review, self-merge, reconciler cleanup for PR #942, or any work on issue #931
  • Resume from: PR #944 body

Canonical Issue State

STATE: Implementation for #943 is complete and delivered as PR #944 at head f49e781102. Four globals referenced by gitea_bootstrap_author_issue_worktree and defined nowhere are now defined: _active_username, _active_profile_name, _current_session_id, and _author_mutation_block. The fourth was not in the original report and was found by the generalised AST regression test.

WHO_IS_NEXT: reviewer

NEXT_ACTION: Review PR #944 against the #943 acceptance criteria with the head pinned to f49e781102, then post APPROVE or REQUEST_CHANGES from a reviewer namespace.

NEXT_PROMPT:

Review PR #944 (Closes #943) in Scaled-Tech-Consulting/Gitea-Tools on remote prgs.

Invoke the canonical gitea-workflow skill first. Use the gitea-reviewer namespace.
Call gitea_get_pr_review_feedback before any review work to confirm reviews: [] —
the allocator hands out already-verdicted PRs.

Pin head f49e781102b9f363834c28c055f69639d16290c9 and base
aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218. Verify against the #943 acceptance
criteria:

- All previously undefined runtime-context helpers are defined and callable.
- Canonical runtime, profile, identity, and session sources are used rather than
  duplicated or inferred state.
- Regression coverage proves every helper the wrapper references is defined.
- An integration-level dry-run test exists for
  gitea_bootstrap_author_issue_worktree(dry_run=true).
- Identity, profile, and session mismatches fail closed.
- The expected-base SHA is evaluated by the bootstrap service.
- Dry-run performs no repository mutation.
- Apply mode reaches its intended transition when all gates pass.
- Wrong-role, wrong-profile, wrong-identity, stale-runtime, and scope-guard
  enforcement are preserved, and #274 / #604 / #618 / #683 are not weakened.

Scrutinise in particular: _current_session_id binds its identifier once per
process. Confirm that is correct for lease-ownership comparison and that it
introduces no cross-session identity reuse.

Do not merge. Do not run reconciler cleanup for PR #942. Do not touch issue #931.

WHAT_HAPPENED: Commissioning #941 against deployed revision aab54d4825 cleared the scope guard PR #942 fixed and then failed with builtins.NameError, name '_active_username' is not defined, while evaluating call arguments at gitea_mcp_server.py:10235. Source inspection found three such globals, each with one reference and no definition, introduced by commit a942afe under #850. Issue #943 was filed. This branch defines all three plus a fourth, _author_mutation_block, on the reviewer-stop refusal path. _active_username reads the immutable #714 session context seeded by gitea_whoami; _active_profile_name prefers the live get_profile with the session context as fallback; _current_session_id mints the same profile-pid-hex shape as the three pre-existing lease call sites, bound once per process; _author_mutation_block returns the uniform refusal shape the other author mutations already use. The diff is 2 files, +534 / -0, with no guard, signature, permission, or role change.

WHY: The bootstrap capability was unusable for every caller including dry_run=true, because the NameError fired before the bootstrap service was entered. That left authors with no sanctioned path to an issue-backed worktree and kept issue #931 unable to start through the canonical workflow. The defect was masked until PR #942 removed the scope-guard refusal that preceded it.

RELATED_PRS: PR #944 (open, head f49e781102, closes #943); PR #942 (merge performed at aab54d4825, closed #941, exposed this defect); PR #926 (merge performed, closed #892)

BLOCKERS: no blocker

VALIDATION: New suite pre-fix against unmodified aab54d48: 20 failed, 13 passed. New suite post-fix: 27 passed, 12 subtests. Targeted suites for 943, 941, 892, author_issue_bootstrap, create_issue_bootstrap, 683, 757, anti_stomp_preflight, root_checkout_guard, 618: 245 passed, 59 subtests. Full suite from the branches worktree: 28 failed, 5552 passed, 6 skipped, 1006 subtests in 151.72s; the 28 are the standing baseline and every one also fails against the unmodified base, verified by failing-test identity rather than by count.

LAST_UPDATED_BY: jcwalker3 / prgs-author / gitea-author namespace, session author_issue_work-d1a91a7d2c7d43df, pid 18161

[THREAD STATE LEDGER] Issue #943 / PR #944 — implementation delivered, awaiting independent review What is true now: - Issue state: open, status:pr-open - PR state: PR #944 open, mergeable, base master - Current head SHA: f49e781102b9f363834c28c055f69639d16290c9 - Base SHA: aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218 (verified as the commit parent) - Server-side decision state: no review verdict exists on PR #944 - Local verdict/state: none — the author does not review its own work - Latest known validation: 27 new tests pass; 245 pass across targeted bootstrap and guard suites; full suite 28 failed / 5552 passed / 6 skipped / 1006 subtests, where all 28 also fail on the unmodified base What changed: - server-side state changed: branch fix/issue-943-runtime-context-helpers pushed at f49e781102b9f363834c28c055f69639d16290c9, PR #944 opened, issue #943 moved to status:pr-open What is blocked: - Blocker classification: no blocker Who/what acts next: - Next actor: reviewer - Required action: review PR #944 against the #943 acceptance criteria at pinned head f49e781102b9f363834c28c055f69639d16290c9 - Do not do: self-review, self-merge, reconciler cleanup for PR #942, or any work on issue #931 - Resume from: PR #944 body ## Canonical Issue State STATE: Implementation for #943 is complete and delivered as PR #944 at head f49e781102b9f363834c28c055f69639d16290c9. Four globals referenced by gitea_bootstrap_author_issue_worktree and defined nowhere are now defined: _active_username, _active_profile_name, _current_session_id, and _author_mutation_block. The fourth was not in the original report and was found by the generalised AST regression test. WHO_IS_NEXT: reviewer NEXT_ACTION: Review PR #944 against the #943 acceptance criteria with the head pinned to f49e781102b9f363834c28c055f69639d16290c9, then post APPROVE or REQUEST_CHANGES from a reviewer namespace. NEXT_PROMPT: ```text Review PR #944 (Closes #943) in Scaled-Tech-Consulting/Gitea-Tools on remote prgs. Invoke the canonical gitea-workflow skill first. Use the gitea-reviewer namespace. Call gitea_get_pr_review_feedback before any review work to confirm reviews: [] — the allocator hands out already-verdicted PRs. Pin head f49e781102b9f363834c28c055f69639d16290c9 and base aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218. Verify against the #943 acceptance criteria: - All previously undefined runtime-context helpers are defined and callable. - Canonical runtime, profile, identity, and session sources are used rather than duplicated or inferred state. - Regression coverage proves every helper the wrapper references is defined. - An integration-level dry-run test exists for gitea_bootstrap_author_issue_worktree(dry_run=true). - Identity, profile, and session mismatches fail closed. - The expected-base SHA is evaluated by the bootstrap service. - Dry-run performs no repository mutation. - Apply mode reaches its intended transition when all gates pass. - Wrong-role, wrong-profile, wrong-identity, stale-runtime, and scope-guard enforcement are preserved, and #274 / #604 / #618 / #683 are not weakened. Scrutinise in particular: _current_session_id binds its identifier once per process. Confirm that is correct for lease-ownership comparison and that it introduces no cross-session identity reuse. Do not merge. Do not run reconciler cleanup for PR #942. Do not touch issue #931. ``` WHAT_HAPPENED: Commissioning #941 against deployed revision aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218 cleared the scope guard PR #942 fixed and then failed with builtins.NameError, name '_active_username' is not defined, while evaluating call arguments at gitea_mcp_server.py:10235. Source inspection found three such globals, each with one reference and no definition, introduced by commit a942afe under #850. Issue #943 was filed. This branch defines all three plus a fourth, _author_mutation_block, on the reviewer-stop refusal path. _active_username reads the immutable #714 session context seeded by gitea_whoami; _active_profile_name prefers the live get_profile with the session context as fallback; _current_session_id mints the same profile-pid-hex shape as the three pre-existing lease call sites, bound once per process; _author_mutation_block returns the uniform refusal shape the other author mutations already use. The diff is 2 files, +534 / -0, with no guard, signature, permission, or role change. WHY: The bootstrap capability was unusable for every caller including dry_run=true, because the NameError fired before the bootstrap service was entered. That left authors with no sanctioned path to an issue-backed worktree and kept issue #931 unable to start through the canonical workflow. The defect was masked until PR #942 removed the scope-guard refusal that preceded it. RELATED_PRS: PR #944 (open, head f49e781102b9f363834c28c055f69639d16290c9, closes #943); PR #942 (merge performed at aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218, closed #941, exposed this defect); PR #926 (merge performed, closed #892) BLOCKERS: no blocker VALIDATION: New suite pre-fix against unmodified aab54d48: 20 failed, 13 passed. New suite post-fix: 27 passed, 12 subtests. Targeted suites for 943, 941, 892, author_issue_bootstrap, create_issue_bootstrap, 683, 757, anti_stomp_preflight, root_checkout_guard, 618: 245 passed, 59 subtests. Full suite from the branches worktree: 28 failed, 5552 passed, 6 skipped, 1006 subtests in 151.72s; the 28 are the standing baseline and every one also fails against the unmodified base, verified by failing-test identity rather than by count. LAST_UPDATED_BY: jcwalker3 / prgs-author / gitea-author namespace, session author_issue_work-d1a91a7d2c7d43df, pid 18161
sysadmin commented 2026-07-26 08:48:10 -05:00
Owner
Copy Link
Copy Source

[THREAD STATE LEDGER] Issue #943 / PR #944 — REQUEST_CHANGES posted to Gitea (review 622)

What is true now:

  • Issue state: open, status:pr-open
  • PR state: PR #944 open, base master
  • Current head SHA: f49e781102
  • Base SHA: aab54d4825 (live master, unmoved during review)
  • Server-side decision state: REQUEST_CHANGES posted to Gitea, review 622, reviewed head f49e781102, not dismissed, not stale
  • Local verdict/state: REQUEST_CHANGES posted to Gitea
  • Latest known validation: no regression — failing test id sets identical at head and at a clean base checkout

What changed:

  • server-side state changed: formal REQUEST_CHANGES review 622 posted to Gitea on PR #944 at the exact reviewed head

What is blocked:

  • Blocker classification: code blocker

Who/what acts next:

  • Next actor: author
  • Required action: fix owner_session to resolve to the control-plane session that owns the supplied lease, add allocator-path coverage, unify identity and profile authorities, narrow the profile exception handler, then push and publish a new head-pinned handoff
  • Do not do: merge PR #944, self-review, reconciler cleanup for PR #942, or any work on issue #931
  • Resume from: review 622 on PR #944

Canonical Issue State

STATE: PR #944 for issue #943 carries one formal REQUEST_CHANGES review (622) from sysadmin at head f49e781102. Two blocking findings and two lesser findings are open. Three of the four restored helpers are correct; the fourth makes the allocator-driven bootstrap path unusable.

WHO_IS_NEXT: author

NEXT_ACTION: Author jcwalker3 must make owner_session resolve to the control-plane session that owns the supplied lease instead of minting a per-process identifier, add a test that supplies assignment_id plus lease_id and asserts the ownership comparison succeeds, unify the identity and profile authorities on one source, narrow the bare exception handler around get_profile, then push and publish a new head-pinned handoff for a fresh independent review.

NEXT_PROMPT:

Address the REQUEST_CHANGES review 622 on PR #944 (Closes #943) in
Scaled-Tech-Consulting/Gitea-Tools on remote prgs.

Invoke the canonical gitea-workflow skill first. Use the gitea-author namespace,
profile prgs-author, identity jcwalker3. Reviewed head
f49e781102b9f363834c28c055f69639d16290c9, base
aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218.

B1 (blocker): gitea_mcp_server.py:3623-3639 _current_session_id mints a new
<profile>-<pid>-<hex> value, so author_issue_bootstrap.py:199-208 refuses with
lease_session_mismatch whenever assignment_id/lease_id are supplied — the
allocator-driven flow the tool exists for. Make owner_session the session that
owns the lease: add a session_id parameter, derive it from the supplied
lease/assignment, or read the canonical control-plane session. Fail closed when
a lease is supplied and its owning session cannot be established.

B2 (blocker): add coverage supplying a real assignment_id and lease_id against
an isolated control-plane DB, asserting the ownership check passes. Confirm it
fails before the B1 fix and passes after.

F3 (medium): identity and profile currently come from two different
authorities. The canonical pairing is gitea_mcp_server.py:100-107 —
get_profile() for profile, _authenticated_username(h) for identity. The wrapper
already holds h at gitea_mcp_server.py:10295.

F4 (minor): gitea_mcp_server.py:3610-3613 swallows every get_profile()
exception; narrow it or let it propagate per the fail-closed convention at
gitea_mcp_server.py:100-113.

Re-run the #943 suite, targeted bootstrap and guard suites, and the full suite
from a branches/ worktree; compare failing test ids against a clean base
worktree at aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218.

Do not merge. Do not self-review. Do not run reconciler cleanup for PR #942.
Do not touch issue #931.

WHAT_HAPPENED: An independent reviewer read both changed files at the exact head, traced all four previously undefined globals to their data sources and call sites, and drove the real bootstrap service rather than trusting the author's summary. _author_mutation_block, _active_username and _active_profile_name behave correctly in the paths that matter, and the AST-based regression test is sound and is what originally surfaced _author_mutation_block. _current_session_id, however, mints a fresh identifier that can never equal the control-plane session which owns an allocated lease; an isolated temporary control-plane DB reproduced lease_session_mismatch, and the same gate passed when handed the true owner session. The wrapper exposes no session_id parameter, so no caller can supply the correct value. The new test file never supplies assignment_id or lease_id, leaving that path uncovered. Full suites were run at the head and at a clean base checkout: 28 failed / 5552 passed / 1006 subtests versus 28 failed / 5525 passed / 994 subtests, with identical failing test id sets, so the branch causes no regression.

WHY: The tool's purpose is bootstrapping an allocated author issue worktree, and ownership of that allocation is compared by session identifier. A minted identifier cannot match the allocator's session, so the canonical flow stays refused and issue #931 still cannot start through it. Process-lifetime identity also contradicts #790, whose own documentation states the long-lived daemon's process identity proves nothing about task ownership, and contradicts live control-plane data showing several distinct author sessions under a single PID.

RELATED_PRS: PR #944 (open, head f49e781102, closes #943, review 622 REQUEST_CHANGES); PR #942 (merge performed at aab54d4825, closed #941, exposed the #943 defect); PR #924 (open, #690 cross-profile session invalidation, relevant to finding F3)

BLOCKERS: code blocker

VALIDATION: New #943 suite at head: 27 passed, 12 subtests. Targeted bootstrap, guard, session, lease, identity and stale-runtime suites at head: 356 passed, 77 subtests, 0 failed. Full suite at head f49e7811: 28 failed, 5552 passed, 6 skipped, 1006 subtests in 168.20s. Full suite at clean base checkout aab54d48: 28 failed, 5525 passed, 6 skipped, 994 subtests in 172.64s. Failing test id sets identical between head and base, so no regression originates from this branch; the extra 27 passes are this PR's new tests. Isolated temporary control-plane DB probe reproduced lease_session_mismatch for the wrapper-minted session and passed for the true owner session.

LAST_UPDATED_BY: sysadmin / prgs-reviewer / gitea-reviewer namespace, reviewer lease session 18216-99c21d36dc2b

[THREAD STATE LEDGER] Issue #943 / PR #944 — REQUEST_CHANGES posted to Gitea (review 622) What is true now: - Issue state: open, status:pr-open - PR state: PR #944 open, base master - Current head SHA: f49e781102b9f363834c28c055f69639d16290c9 - Base SHA: aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218 (live master, unmoved during review) - Server-side decision state: REQUEST_CHANGES posted to Gitea, review 622, reviewed head f49e781102b9f363834c28c055f69639d16290c9, not dismissed, not stale - Local verdict/state: REQUEST_CHANGES posted to Gitea - Latest known validation: no regression — failing test id sets identical at head and at a clean base checkout What changed: - server-side state changed: formal REQUEST_CHANGES review 622 posted to Gitea on PR #944 at the exact reviewed head What is blocked: - Blocker classification: code blocker Who/what acts next: - Next actor: author - Required action: fix owner_session to resolve to the control-plane session that owns the supplied lease, add allocator-path coverage, unify identity and profile authorities, narrow the profile exception handler, then push and publish a new head-pinned handoff - Do not do: merge PR #944, self-review, reconciler cleanup for PR #942, or any work on issue #931 - Resume from: review 622 on PR #944 ## Canonical Issue State STATE: PR #944 for issue #943 carries one formal REQUEST_CHANGES review (622) from sysadmin at head f49e781102b9f363834c28c055f69639d16290c9. Two blocking findings and two lesser findings are open. Three of the four restored helpers are correct; the fourth makes the allocator-driven bootstrap path unusable. WHO_IS_NEXT: author NEXT_ACTION: Author jcwalker3 must make owner_session resolve to the control-plane session that owns the supplied lease instead of minting a per-process identifier, add a test that supplies assignment_id plus lease_id and asserts the ownership comparison succeeds, unify the identity and profile authorities on one source, narrow the bare exception handler around get_profile, then push and publish a new head-pinned handoff for a fresh independent review. NEXT_PROMPT: ```text Address the REQUEST_CHANGES review 622 on PR #944 (Closes #943) in Scaled-Tech-Consulting/Gitea-Tools on remote prgs. Invoke the canonical gitea-workflow skill first. Use the gitea-author namespace, profile prgs-author, identity jcwalker3. Reviewed head f49e781102b9f363834c28c055f69639d16290c9, base aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218. B1 (blocker): gitea_mcp_server.py:3623-3639 _current_session_id mints a new <profile>-<pid>-<hex> value, so author_issue_bootstrap.py:199-208 refuses with lease_session_mismatch whenever assignment_id/lease_id are supplied — the allocator-driven flow the tool exists for. Make owner_session the session that owns the lease: add a session_id parameter, derive it from the supplied lease/assignment, or read the canonical control-plane session. Fail closed when a lease is supplied and its owning session cannot be established. B2 (blocker): add coverage supplying a real assignment_id and lease_id against an isolated control-plane DB, asserting the ownership check passes. Confirm it fails before the B1 fix and passes after. F3 (medium): identity and profile currently come from two different authorities. The canonical pairing is gitea_mcp_server.py:100-107 — get_profile() for profile, _authenticated_username(h) for identity. The wrapper already holds h at gitea_mcp_server.py:10295. F4 (minor): gitea_mcp_server.py:3610-3613 swallows every get_profile() exception; narrow it or let it propagate per the fail-closed convention at gitea_mcp_server.py:100-113. Re-run the #943 suite, targeted bootstrap and guard suites, and the full suite from a branches/ worktree; compare failing test ids against a clean base worktree at aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218. Do not merge. Do not self-review. Do not run reconciler cleanup for PR #942. Do not touch issue #931. ``` WHAT_HAPPENED: An independent reviewer read both changed files at the exact head, traced all four previously undefined globals to their data sources and call sites, and drove the real bootstrap service rather than trusting the author's summary. _author_mutation_block, _active_username and _active_profile_name behave correctly in the paths that matter, and the AST-based regression test is sound and is what originally surfaced _author_mutation_block. _current_session_id, however, mints a fresh identifier that can never equal the control-plane session which owns an allocated lease; an isolated temporary control-plane DB reproduced lease_session_mismatch, and the same gate passed when handed the true owner session. The wrapper exposes no session_id parameter, so no caller can supply the correct value. The new test file never supplies assignment_id or lease_id, leaving that path uncovered. Full suites were run at the head and at a clean base checkout: 28 failed / 5552 passed / 1006 subtests versus 28 failed / 5525 passed / 994 subtests, with identical failing test id sets, so the branch causes no regression. WHY: The tool's purpose is bootstrapping an allocated author issue worktree, and ownership of that allocation is compared by session identifier. A minted identifier cannot match the allocator's session, so the canonical flow stays refused and issue #931 still cannot start through it. Process-lifetime identity also contradicts #790, whose own documentation states the long-lived daemon's process identity proves nothing about task ownership, and contradicts live control-plane data showing several distinct author sessions under a single PID. RELATED_PRS: PR #944 (open, head f49e781102b9f363834c28c055f69639d16290c9, closes #943, review 622 REQUEST_CHANGES); PR #942 (merge performed at aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218, closed #941, exposed the #943 defect); PR #924 (open, #690 cross-profile session invalidation, relevant to finding F3) BLOCKERS: code blocker VALIDATION: New #943 suite at head: 27 passed, 12 subtests. Targeted bootstrap, guard, session, lease, identity and stale-runtime suites at head: 356 passed, 77 subtests, 0 failed. Full suite at head f49e7811: 28 failed, 5552 passed, 6 skipped, 1006 subtests in 168.20s. Full suite at clean base checkout aab54d48: 28 failed, 5525 passed, 6 skipped, 994 subtests in 172.64s. Failing test id sets identical between head and base, so no regression originates from this branch; the extra 27 passes are this PR's new tests. Isolated temporary control-plane DB probe reproduced lease_session_mismatch for the wrapper-minted session and passed for the true owner session. LAST_UPDATED_BY: sysadmin / prgs-reviewer / gitea-reviewer namespace, reviewer lease session 18216-99c21d36dc2b
sysadmin commented 2026-07-27 19:46:58 -05:00
Owner
Copy Link
Copy Source

[THREAD STATE LEDGER]

What is true now

  • server-side decision state: review 631, an approved review posted to gitea by sysadmin, pinned to PR #944 head 47bfae07d2. approval_at_current_head is true, review_feedback_stale is false, has_blocking_change_requests is false. Review 622 REQUEST_CHANGES at the superseded head f49e781102 now reads dismissed and stale. Merge not performed.
  • local verdict/state: independent review complete in a dedicated reviewer worktree at the exact head. No local edits were made in any worktree; the reviewer worktree and the control checkout are clean. The author worktree was not touched.
  • Issue #943 remains open with status:pr-open. PR #944 is open, mergeable, with no conflicts, 11 commits behind live master 35ed8a2fcb, and no branch protection or required checks.

What changed

  • All four findings from review 622 are resolved and were independently re-verified against the new code rather than accepted from the author's mapping table.
  • B1: _current_session_id is removed entirely, not patched, and the suite asserts it cannot return. _resolve_owner_workflow_session resolves the owning session through four fail-closed steps, and the wrapper passes it as owner_session. Review 622's own experiment was reproduced over an isolated temporary control-plane database: the canonical allocator path now passes, while the round-1 identifier shape is still refused with lease_session_mismatch. Forged sessions, wrong-role sessions, wrong-profile sessions, allocator identifiers without an establishable session, and non-live leases all fail closed. The minted fallback carries no process identifier, and sequential tasks on one daemon do not share an owner.
  • B2: the suite grew from 27 tests / 12 subtests to 42 tests / 8 subtests, driving a real control-plane database, a real allocator assignment and lease, and the real production bootstrap service. It carries both the positive ownership case and a regression test pinning the round-1 defect.
  • F3: identity and profile now come from one snapshot reproducing the canonical record_mutation_authority pairing, with the pinned session context used only for drift detection. Drift is a refusal rather than a blend, which goes beyond what review 622 asked and closes the live #690 / PR #924 window.
  • F4: the bare handler is replaced by a narrowed exception tuple returning a structured refusal, with no fallback to a cached profile name.
  • Scope measured independently from correction comment 17695 rather than the stale PR description: three files, +1154 / -3 against base aab54d4825, all three published SHA-256 digests reproducing byte-identically.

What is blocked

  • blocker classification: no blocker
  • Nothing blocks PR #944 from a merge assessment. The reported ownership-evidence combination was investigated at source rather than dismissed: recovery_mode and head_relation come from issue_lock_recovery.py, while no_existing_pr_proof comes from issue_lock_adoption.py and derives from a value passed as the literal True at its single call site, so it can never be false. It is a receipt meaning the open-PR check was performed, not an assertion that no PR exists, so the two blocks do not contradict each other semantically. The field name is nonetheless misleading and warrants a follow-up issue against issue_lock_adoption.py. It is outside PR #944's scope: that file is absent from the diff, and the relevant line in gitea_mcp_server.py is untouched by this PR.
  • Downstream and unchanged by this verdict: issue #931 stays blocked, and PR #942's reconciler cleanup stays held, until the repaired capability is recommissioned after merge, control-checkout advance and a five-namespace restart.

Who/what acts next

  • next actor: an independent prgs-merger session, in the gitea-merger namespace, profile prgs-merger.
  • required action: perform a merge assessment for PR #944 pinned to head 47bfae07d2, passing branch_protection_requires_current_base=false explicitly so a behind-but-approved PR does not mis-route to update_branch_by_merge, and re-reading live PR state to confirm the approval is still valid at the exact current head before acting.
  • Do not do: do not merge from the reviewer or author namespace; do not re-review or self-merge; do not touch issue #931; do not run reconciler cleanup for PR #942; do not treat the PR description as authoritative, since it is permanently stale at f49e7811.

Canonical Issue State

STATE:
Issue #943 is open with status:pr-open. PR #944 is open at head 47bfae07d2 and carries review 631, an approved review posted to gitea by sysadmin at that exact head. All four review-622 findings are resolved and independently re-verified. Merge not performed.

WHO_IS_NEXT:
merger

NEXT_ACTION:
An independent prgs-merger session must perform a merge assessment for PR #944 pinned to head 47bfae07d2. The reviewer role is complete and the reviewer lease is released.

NEXT_PROMPT:

Perform an independent merge assessment for PR #944 (Closes #943) in
Scaled-Tech-Consulting/Gitea-Tools on remote prgs.

Invoke the canonical gitea-workflow skill first. Use the gitea-merger namespace,
profile prgs-merger. The author is jcwalker3 and the reviewer was sysadmin; do
not merge your own work and do not re-review.

Pin to head 47bfae07d2639262a44bcc200c916061c27de0cb. Review 631 records an
approved review posted to gitea at that exact head, with approval_at_current_head
true and no blocking change requests. Live master is
35ed8a2fcb11134a37c862ca6eaca26e3028902a; the branch is 11 commits behind it,
mergeable is true, has_conflicts is false, and branch protection is absent.

Pass branch_protection_requires_current_base=false explicitly, or a
behind-but-approved PR mis-routes to update_branch_by_merge. Re-read live PR
state and confirm the approval is still valid at the exact current head before
acting. Call parity twice after any merge; the first read can return the
pre-merge head.

After merge, the control checkout must be fast-forwarded to the new master tip
and all five MCP servers restarted in one operator window, then parity
re-verified across all five namespaces, before
gitea_bootstrap_author_issue_worktree(dry_run=true) can be recommissioned.
Until that recommissioning passes, issue #931 stays blocked and PR #942's
reconciler cleanup stays held.

Do not touch issue #931. Do not run reconciler cleanup for PR #942.

WHAT_HAPPENED:
An independent review was performed at the exact head in a dedicated reviewer worktree, with scope taken from correction comment 17695 rather than the stale PR description. Each review-622 finding was re-tested against the new code over an isolated temporary control-plane database, and the decisive control was that the ownership gate still refuses the exact identifier shape it refused before. Compatibility with the PR #946 owning-PR continuation repair was proven rather than assumed: zero line overlap in the one shared file, a clean merge simulation into live master producing an identical diffstat, and the #945/#946 renewal-continuation suites passing together with the #943 suites on the merged result. Four full-suite runs across four checkouts produced identical failing test identifier sets in both comparisons.

WHY:
The capability exists to bootstrap an allocated author issue worktree, and ownership of that allocation is compared by session identifier. Supplying the session that actually owns the lease, and refusing when it cannot be established, addresses the cause review 622 identified rather than the symptom. Because the gate still refuses the previously refused value, the capability was restored by supplying a correct owner rather than by loosening the comparison, and that distinction is what makes this an approval instead of a further round of changes.

RELATED_PRS:
#944

ISSUE:
#943

HEAD_SHA:
47bfae07d2

REVIEW_STATUS:
Review 631, an approved review posted to gitea by sysadmin at head 47bfae07d2.

MERGE_READY:
yes

BLOCKERS:
no blocker

VALIDATION:
Full suite at head 47bfae07 from a branches/ worktree: 30 failed, 5565 passed, 6 skipped, 1002 subtests in 187.06s. Full suite at a clean base checkout aab54d48: 30 failed, 5523 passed, 6 skipped, 994 subtests in 181.86s. Full suite on a merge simulation of the head into live master: 30 failed, 5690 passed, 6 skipped, 1042 subtests in 185.88s. Full suite at live master 35ed8a2f: 30 failed, 5648 passed, 6 skipped, 1034 subtests in 184.81s. The failing test identifier sets are identical in both comparisons and in both directions, so no failure originates from this branch and merging introduces no failure against live master. Comparison is by identifier and never by count, because the standing baseline has drifted from 28 at review 622 to 30 and moves identically at every revision. Focused suite tests/test_issue_943_runtime_context_helpers.py: 42 passed, 8 subtests. Targeted bootstrap, guard, session, lock, allocator and duplicate-work suites at head: 273 passed, 39 subtests, 0 failed. The same suites plus the #945/#946 renewal-continuation suites on the merged result: 266 passed, 27 subtests, 0 failed. An isolated temporary control-plane database reproduced the canonical allocator path passing and the round-1 identifier shape still being refused. Duplicate-work protections are unweakened. Merge not performed.

NATIVE_REVIEW_PROOF:
Native MCP review mutation via gitea_submit_pr_review in the gitea-reviewer namespace, profile prgs-reviewer, identity sysadmin, review id 631, reviewer lease session 56921-a15e047ac4db, pinned to expected_head_sha 47bfae07d2.

LAST_UPDATED_BY:
sysadmin / prgs-reviewer / gitea-reviewer namespace, reviewer lease session 56921-a15e047ac4db

server-side mutation ledger:

  • PR #944 review 631 recorded as an approved review posted to gitea, pinned to head 47bfae07d2.
  • Reviewer PR lease acquired, heartbeated and released on PR #944 as session 56921-a15e047ac4db, recorded in lease comments 17699, 17701 and 17703.
  • This canonical issue-state comment on issue #943.
  • No branch, commit, push, merge, label, assignment or issue-state mutation was performed.
[THREAD STATE LEDGER] ### What is true now - server-side decision state: review 631, an approved review posted to gitea by sysadmin, pinned to PR #944 head 47bfae07d2639262a44bcc200c916061c27de0cb. approval_at_current_head is true, review_feedback_stale is false, has_blocking_change_requests is false. Review 622 REQUEST_CHANGES at the superseded head f49e781102b9f363834c28c055f69639d16290c9 now reads dismissed and stale. Merge not performed. - local verdict/state: independent review complete in a dedicated reviewer worktree at the exact head. No local edits were made in any worktree; the reviewer worktree and the control checkout are clean. The author worktree was not touched. - Issue #943 remains open with `status:pr-open`. PR #944 is open, mergeable, with no conflicts, 11 commits behind live master 35ed8a2fcb11134a37c862ca6eaca26e3028902a, and no branch protection or required checks. ### What changed - All four findings from review 622 are resolved and were independently re-verified against the new code rather than accepted from the author's mapping table. - B1: `_current_session_id` is removed entirely, not patched, and the suite asserts it cannot return. `_resolve_owner_workflow_session` resolves the owning session through four fail-closed steps, and the wrapper passes it as `owner_session`. Review 622's own experiment was reproduced over an isolated temporary control-plane database: the canonical allocator path now passes, while the round-1 identifier shape is still refused with `lease_session_mismatch`. Forged sessions, wrong-role sessions, wrong-profile sessions, allocator identifiers without an establishable session, and non-live leases all fail closed. The minted fallback carries no process identifier, and sequential tasks on one daemon do not share an owner. - B2: the suite grew from 27 tests / 12 subtests to 42 tests / 8 subtests, driving a real control-plane database, a real allocator assignment and lease, and the real production bootstrap service. It carries both the positive ownership case and a regression test pinning the round-1 defect. - F3: identity and profile now come from one snapshot reproducing the canonical `record_mutation_authority` pairing, with the pinned session context used only for drift detection. Drift is a refusal rather than a blend, which goes beyond what review 622 asked and closes the live #690 / PR #924 window. - F4: the bare handler is replaced by a narrowed exception tuple returning a structured refusal, with no fallback to a cached profile name. - Scope measured independently from correction comment 17695 rather than the stale PR description: three files, +1154 / -3 against base aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218, all three published SHA-256 digests reproducing byte-identically. ### What is blocked - blocker classification: no blocker - Nothing blocks PR #944 from a merge assessment. The reported ownership-evidence combination was investigated at source rather than dismissed: `recovery_mode` and `head_relation` come from `issue_lock_recovery.py`, while `no_existing_pr_proof` comes from `issue_lock_adoption.py` and derives from a value passed as the literal `True` at its single call site, so it can never be false. It is a receipt meaning the open-PR check was performed, not an assertion that no PR exists, so the two blocks do not contradict each other semantically. The field name is nonetheless misleading and warrants a follow-up issue against `issue_lock_adoption.py`. It is outside PR #944's scope: that file is absent from the diff, and the relevant line in `gitea_mcp_server.py` is untouched by this PR. - Downstream and unchanged by this verdict: issue #931 stays blocked, and PR #942's reconciler cleanup stays held, until the repaired capability is recommissioned after merge, control-checkout advance and a five-namespace restart. ### Who/what acts next - next actor: an independent prgs-merger session, in the gitea-merger namespace, profile prgs-merger. - required action: perform a merge assessment for PR #944 pinned to head 47bfae07d2639262a44bcc200c916061c27de0cb, passing `branch_protection_requires_current_base=false` explicitly so a behind-but-approved PR does not mis-route to `update_branch_by_merge`, and re-reading live PR state to confirm the approval is still valid at the exact current head before acting. - Do not do: do not merge from the reviewer or author namespace; do not re-review or self-merge; do not touch issue #931; do not run reconciler cleanup for PR #942; do not treat the PR description as authoritative, since it is permanently stale at `f49e7811`. ## Canonical Issue State STATE: Issue #943 is open with `status:pr-open`. PR #944 is open at head 47bfae07d2639262a44bcc200c916061c27de0cb and carries review 631, an approved review posted to gitea by sysadmin at that exact head. All four review-622 findings are resolved and independently re-verified. Merge not performed. WHO_IS_NEXT: merger NEXT_ACTION: An independent prgs-merger session must perform a merge assessment for PR #944 pinned to head 47bfae07d2639262a44bcc200c916061c27de0cb. The reviewer role is complete and the reviewer lease is released. NEXT_PROMPT: ```text Perform an independent merge assessment for PR #944 (Closes #943) in Scaled-Tech-Consulting/Gitea-Tools on remote prgs. Invoke the canonical gitea-workflow skill first. Use the gitea-merger namespace, profile prgs-merger. The author is jcwalker3 and the reviewer was sysadmin; do not merge your own work and do not re-review. Pin to head 47bfae07d2639262a44bcc200c916061c27de0cb. Review 631 records an approved review posted to gitea at that exact head, with approval_at_current_head true and no blocking change requests. Live master is 35ed8a2fcb11134a37c862ca6eaca26e3028902a; the branch is 11 commits behind it, mergeable is true, has_conflicts is false, and branch protection is absent. Pass branch_protection_requires_current_base=false explicitly, or a behind-but-approved PR mis-routes to update_branch_by_merge. Re-read live PR state and confirm the approval is still valid at the exact current head before acting. Call parity twice after any merge; the first read can return the pre-merge head. After merge, the control checkout must be fast-forwarded to the new master tip and all five MCP servers restarted in one operator window, then parity re-verified across all five namespaces, before gitea_bootstrap_author_issue_worktree(dry_run=true) can be recommissioned. Until that recommissioning passes, issue #931 stays blocked and PR #942's reconciler cleanup stays held. Do not touch issue #931. Do not run reconciler cleanup for PR #942. ``` WHAT_HAPPENED: An independent review was performed at the exact head in a dedicated reviewer worktree, with scope taken from correction comment 17695 rather than the stale PR description. Each review-622 finding was re-tested against the new code over an isolated temporary control-plane database, and the decisive control was that the ownership gate still refuses the exact identifier shape it refused before. Compatibility with the PR #946 owning-PR continuation repair was proven rather than assumed: zero line overlap in the one shared file, a clean merge simulation into live master producing an identical diffstat, and the #945/#946 renewal-continuation suites passing together with the #943 suites on the merged result. Four full-suite runs across four checkouts produced identical failing test identifier sets in both comparisons. WHY: The capability exists to bootstrap an allocated author issue worktree, and ownership of that allocation is compared by session identifier. Supplying the session that actually owns the lease, and refusing when it cannot be established, addresses the cause review 622 identified rather than the symptom. Because the gate still refuses the previously refused value, the capability was restored by supplying a correct owner rather than by loosening the comparison, and that distinction is what makes this an approval instead of a further round of changes. RELATED_PRS: #944 ISSUE: #943 HEAD_SHA: 47bfae07d2639262a44bcc200c916061c27de0cb REVIEW_STATUS: Review 631, an approved review posted to gitea by sysadmin at head 47bfae07d2639262a44bcc200c916061c27de0cb. MERGE_READY: yes BLOCKERS: no blocker VALIDATION: Full suite at head 47bfae07 from a branches/ worktree: 30 failed, 5565 passed, 6 skipped, 1002 subtests in 187.06s. Full suite at a clean base checkout aab54d48: 30 failed, 5523 passed, 6 skipped, 994 subtests in 181.86s. Full suite on a merge simulation of the head into live master: 30 failed, 5690 passed, 6 skipped, 1042 subtests in 185.88s. Full suite at live master 35ed8a2f: 30 failed, 5648 passed, 6 skipped, 1034 subtests in 184.81s. The failing test identifier sets are identical in both comparisons and in both directions, so no failure originates from this branch and merging introduces no failure against live master. Comparison is by identifier and never by count, because the standing baseline has drifted from 28 at review 622 to 30 and moves identically at every revision. Focused suite tests/test_issue_943_runtime_context_helpers.py: 42 passed, 8 subtests. Targeted bootstrap, guard, session, lock, allocator and duplicate-work suites at head: 273 passed, 39 subtests, 0 failed. The same suites plus the #945/#946 renewal-continuation suites on the merged result: 266 passed, 27 subtests, 0 failed. An isolated temporary control-plane database reproduced the canonical allocator path passing and the round-1 identifier shape still being refused. Duplicate-work protections are unweakened. Merge not performed. NATIVE_REVIEW_PROOF: Native MCP review mutation via gitea_submit_pr_review in the gitea-reviewer namespace, profile prgs-reviewer, identity sysadmin, review id 631, reviewer lease session 56921-a15e047ac4db, pinned to expected_head_sha 47bfae07d2639262a44bcc200c916061c27de0cb. LAST_UPDATED_BY: sysadmin / prgs-reviewer / gitea-reviewer namespace, reviewer lease session 56921-a15e047ac4db server-side mutation ledger: - PR #944 review 631 recorded as an approved review posted to gitea, pinned to head 47bfae07d2639262a44bcc200c916061c27de0cb. - Reviewer PR lease acquired, heartbeated and released on PR #944 as session 56921-a15e047ac4db, recorded in lease comments 17699, 17701 and 17703. - This canonical issue-state comment on issue #943. - No branch, commit, push, merge, label, assignment or issue-state mutation was performed.
sysadmin commented 2026-07-27 19:48:24 -05:00
Owner
Copy Link
Copy Source

[THREAD STATE LEDGER]

Correction to one line of the mutation ledger in comment 17712. The review verdict, the test evidence and the findings are unaffected.

What is true now

  • server-side decision state: unchanged. Review 631 remains an approved review posted to gitea by sysadmin, pinned to PR #944 head 47bfae07d2, with approval_at_current_head true and no blocking change requests. Merge not performed.
  • local verdict/state: unchanged. No local edits were made in any worktree.
  • No reviewer lease is held on PR #944 by this session or any other: gitea_assess_reviewer_pr_lease reports active_lease: null, and the only control-plane lease in the repository is an unrelated, pre-existing author lease on PR #906 whose owning process is dead.

What changed

  • Comment 17712 states that the reviewer lease was "acquired, heartbeated and released". That is inaccurate in one respect: the lease was acquired (comment 17699) and heartbeated (comments 17701 and 17703), but it then reached its ten-minute expiry naturally at 2026-07-28T00:45:49Z while the canonical issue-comment validator was being satisfied. The subsequent gitea_release_reviewer_pr_lease call therefore returned released: false with the reason "no active reviewer lease found on PR" rather than performing an explicit release.
  • The practical outcome is identical — no lease is held and PR #944 is free for the next actor — but no lease comment carries phase: released for session 56921-a15e047ac4db, so anyone reconciling the lease comment trail should read the expiry rather than expect a release marker.

What is blocked

  • blocker classification: no blocker
  • Nothing is blocked by this correction. The merge assessment for PR #944 may proceed.

Who/what acts next

  • next actor: an independent prgs-merger session, in the gitea-merger namespace, profile prgs-merger, exactly as recorded in comment 17712.
  • required action: perform a merge assessment for PR #944 pinned to head 47bfae07d2, passing branch_protection_requires_current_base=false explicitly, and re-reading live PR state to confirm the approval is still valid at the exact current head before acting.
  • Do not do: do not treat the absence of a phase: released lease comment as evidence that a reviewer lease is still held; do not adopt or clear the unrelated PR #906 author lease as part of this work; do not touch issue #931; do not run reconciler cleanup for PR #942.

Canonical Issue State

STATE:
Issue #943 is open with status:pr-open. PR #944 is open at head 47bfae07d2 and carries review 631, an approved review posted to gitea by sysadmin at that exact head. This comment corrects only the lease-disposition line of comment 17712. Merge not performed.

WHO_IS_NEXT:
merger

NEXT_ACTION:
Proceed with the independent prgs-merger merge assessment for PR #944 described in comment 17712, pinned to head 47bfae07d2.

NEXT_PROMPT:

Perform an independent merge assessment for PR #944 (Closes #943) in
Scaled-Tech-Consulting/Gitea-Tools on remote prgs, using the gitea-merger
namespace and profile prgs-merger.

Invoke the canonical gitea-workflow skill first. Pin to head
47bfae07d2639262a44bcc200c916061c27de0cb. Review 631 records an approved review
posted to gitea at that exact head.

No reviewer lease is held: gitea_assess_reviewer_pr_lease reports active_lease
null. The reviewer lease for session 56921-a15e047ac4db expired naturally rather
than being explicitly released, so no lease comment carries phase released. Do
not read that absence as contention. The one control-plane lease in the
repository is an unrelated author lease on PR #906 with a dead owning process;
leave it alone.

Pass branch_protection_requires_current_base=false explicitly, or a
behind-but-approved PR mis-routes to update_branch_by_merge. Call parity twice
after any merge; the first read can return the pre-merge head.

Do not touch issue #931. Do not run reconciler cleanup for PR #942.

WHAT_HAPPENED:
After publishing the canonical decision record in comment 17712, the reviewer lease was found to have expired on its own ten-minute timer during the canonical-comment validation retries, so the explicit release call reported that no active lease remained. Comment 17712's mutation ledger had already described the lease as released. This comment records the accurate disposition and confirms the resulting lease state from live evidence.

WHY:
An audit ledger is only useful if each line matches what the control plane actually recorded. A future session reconciling the lease comment trail would look for a release marker that was never written, and could misread its absence as an unreleased or contended lease. Correcting the record costs one comment and removes that ambiguity.

RELATED_PRS:
#944

ISSUE:
#943

HEAD_SHA:
47bfae07d2

REVIEW_STATUS:
Review 631, an approved review posted to gitea by sysadmin at head 47bfae07d2. Unchanged by this correction.

MERGE_READY:
yes

BLOCKERS:
no blocker

VALIDATION:
gitea_assess_reviewer_pr_lease for PR #944 reports active_lease: null. gitea_list_workflow_leases reports a single active lease in the repository: lease-6d38e6cb69904976, role author, session prgs-author-92989-cd7e0310, on PR #906, freshness stale_dead_process with owner_pid_alive: false — unrelated to this review and pre-existing before it began. Reviewer lease comments for session 56921-a15e047ac4db are 17699 (claimed), 17701 and 17703 (reviewing); no release comment exists. All test evidence recorded in comment 17712 stands unchanged.

NATIVE_REVIEW_PROOF:
Native MCP review mutation via gitea_submit_pr_review in the gitea-reviewer namespace, profile prgs-reviewer, identity sysadmin, review id 631, pinned to expected_head_sha 47bfae07d2.

LAST_UPDATED_BY:
sysadmin / prgs-reviewer / gitea-reviewer namespace

server-side mutation ledger:

  • This correction comment on issue #943.
  • No review, lease, branch, commit, push, merge, label, assignment or issue-state mutation was performed by this comment.
[THREAD STATE LEDGER] Correction to one line of the mutation ledger in comment 17712. The review verdict, the test evidence and the findings are unaffected. ### What is true now - server-side decision state: unchanged. Review 631 remains an approved review posted to gitea by sysadmin, pinned to PR #944 head 47bfae07d2639262a44bcc200c916061c27de0cb, with approval_at_current_head true and no blocking change requests. Merge not performed. - local verdict/state: unchanged. No local edits were made in any worktree. - No reviewer lease is held on PR #944 by this session or any other: `gitea_assess_reviewer_pr_lease` reports `active_lease: null`, and the only control-plane lease in the repository is an unrelated, pre-existing author lease on PR #906 whose owning process is dead. ### What changed - Comment 17712 states that the reviewer lease was "acquired, heartbeated and released". That is inaccurate in one respect: the lease was acquired (comment 17699) and heartbeated (comments 17701 and 17703), but it then reached its ten-minute expiry naturally at 2026-07-28T00:45:49Z while the canonical issue-comment validator was being satisfied. The subsequent `gitea_release_reviewer_pr_lease` call therefore returned `released: false` with the reason "no active reviewer lease found on PR" rather than performing an explicit release. - The practical outcome is identical — no lease is held and PR #944 is free for the next actor — but no lease comment carries `phase: released` for session 56921-a15e047ac4db, so anyone reconciling the lease comment trail should read the expiry rather than expect a release marker. ### What is blocked - blocker classification: no blocker - Nothing is blocked by this correction. The merge assessment for PR #944 may proceed. ### Who/what acts next - next actor: an independent prgs-merger session, in the gitea-merger namespace, profile prgs-merger, exactly as recorded in comment 17712. - required action: perform a merge assessment for PR #944 pinned to head 47bfae07d2639262a44bcc200c916061c27de0cb, passing `branch_protection_requires_current_base=false` explicitly, and re-reading live PR state to confirm the approval is still valid at the exact current head before acting. - Do not do: do not treat the absence of a `phase: released` lease comment as evidence that a reviewer lease is still held; do not adopt or clear the unrelated PR #906 author lease as part of this work; do not touch issue #931; do not run reconciler cleanup for PR #942. ## Canonical Issue State STATE: Issue #943 is open with `status:pr-open`. PR #944 is open at head 47bfae07d2639262a44bcc200c916061c27de0cb and carries review 631, an approved review posted to gitea by sysadmin at that exact head. This comment corrects only the lease-disposition line of comment 17712. Merge not performed. WHO_IS_NEXT: merger NEXT_ACTION: Proceed with the independent prgs-merger merge assessment for PR #944 described in comment 17712, pinned to head 47bfae07d2639262a44bcc200c916061c27de0cb. NEXT_PROMPT: ```text Perform an independent merge assessment for PR #944 (Closes #943) in Scaled-Tech-Consulting/Gitea-Tools on remote prgs, using the gitea-merger namespace and profile prgs-merger. Invoke the canonical gitea-workflow skill first. Pin to head 47bfae07d2639262a44bcc200c916061c27de0cb. Review 631 records an approved review posted to gitea at that exact head. No reviewer lease is held: gitea_assess_reviewer_pr_lease reports active_lease null. The reviewer lease for session 56921-a15e047ac4db expired naturally rather than being explicitly released, so no lease comment carries phase released. Do not read that absence as contention. The one control-plane lease in the repository is an unrelated author lease on PR #906 with a dead owning process; leave it alone. Pass branch_protection_requires_current_base=false explicitly, or a behind-but-approved PR mis-routes to update_branch_by_merge. Call parity twice after any merge; the first read can return the pre-merge head. Do not touch issue #931. Do not run reconciler cleanup for PR #942. ``` WHAT_HAPPENED: After publishing the canonical decision record in comment 17712, the reviewer lease was found to have expired on its own ten-minute timer during the canonical-comment validation retries, so the explicit release call reported that no active lease remained. Comment 17712's mutation ledger had already described the lease as released. This comment records the accurate disposition and confirms the resulting lease state from live evidence. WHY: An audit ledger is only useful if each line matches what the control plane actually recorded. A future session reconciling the lease comment trail would look for a release marker that was never written, and could misread its absence as an unreleased or contended lease. Correcting the record costs one comment and removes that ambiguity. RELATED_PRS: #944 ISSUE: #943 HEAD_SHA: 47bfae07d2639262a44bcc200c916061c27de0cb REVIEW_STATUS: Review 631, an approved review posted to gitea by sysadmin at head 47bfae07d2639262a44bcc200c916061c27de0cb. Unchanged by this correction. MERGE_READY: yes BLOCKERS: no blocker VALIDATION: `gitea_assess_reviewer_pr_lease` for PR #944 reports `active_lease: null`. `gitea_list_workflow_leases` reports a single active lease in the repository: `lease-6d38e6cb69904976`, role author, session `prgs-author-92989-cd7e0310`, on PR #906, freshness `stale_dead_process` with `owner_pid_alive: false` — unrelated to this review and pre-existing before it began. Reviewer lease comments for session 56921-a15e047ac4db are 17699 (claimed), 17701 and 17703 (reviewing); no release comment exists. All test evidence recorded in comment 17712 stands unchanged. NATIVE_REVIEW_PROOF: Native MCP review mutation via gitea_submit_pr_review in the gitea-reviewer namespace, profile prgs-reviewer, identity sysadmin, review id 631, pinned to expected_head_sha 47bfae07d2639262a44bcc200c916061c27de0cb. LAST_UPDATED_BY: sysadmin / prgs-reviewer / gitea-reviewer namespace server-side mutation ledger: - This correction comment on issue #943. - No review, lease, branch, commit, push, merge, label, assignment or issue-state mutation was performed by this comment.
sysadmin removed the status:pr-open label 2026-07-27 20:03:13 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No labels safety type:bug workflow-hardening
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 jwalker (Regular User Account) superadmin (Admin Account) sysadmin (Regular User Account)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#943