fix(author bootstrap): restore missing runtime identity and session helpers #943

New Issue

2026-07-26T07:29:45-05:00

jcwalker3 commented

2026-07-26 07:29:45 -05:00

Summary

The sanctioned gitea_bootstrap_author_issue_worktree capability crashes before entering author_issue_bootstrap.bootstrap_author_issue_worktree because gitea_mcp_server.py references three undefined helpers:

_active_username
_active_profile_name
_current_session_id

This makes native author issue-worktree bootstrap unusable for every caller, including dry_run=true.

Observed failure

Commissioning was performed against deployed revision:

aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218

The sanctioned call used:

issue_number=941
expected_base_sha=aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218
dry_run=true
remote=prgs
org=Scaled-Tech-Consulting
repo=Gitea-Tools
idempotency_key=commission-941-readonly-aab54d48

Result:

success=false
reason_code=internal_error
exception_class=builtins.NameError
detail=name '_active_username' is not defined
retryable=false
transport_survives=true

The failure occurs while evaluating arguments around gitea_mcp_server.py:10235, before the underlying bootstrap function executes.

Source inspection found:

Helper	References	Definitions
`_active_username`	1	0
`_active_profile_name`	1	0
`_current_session_id`	1	0

Provenance

The undefined references were introduced by commit a942afe, "Implement native author issue worktree bootstrap (#850)."

This is separate from #941 and PR #942. PR #942 successfully corrected the bootstrap scope guard: commissioning passed verify_preflight_purity and advanced beyond the former missing_issue_worktree refusal before reaching this latent NameError.

Impact

gitea_bootstrap_author_issue_worktree is unconditionally broken at the deployed revision.
Both dry-run and apply paths are affected.
Authors cannot obtain a sanctioned issue-backed worktree through this capability.
Issue #931 remains blocked from beginning implementation through the canonical workflow.
The defect was previously masked by the #941 scope-guard failure.

Expected behavior

The MCP wrapper must obtain the active username, profile, and session identifier through defined, canonical runtime-context accessors and invoke the underlying bootstrap service successfully.

With dry_run=true, the capability must:

Pass the workflow scope guard for the explicitly sanctioned bootstrap scope.
Validate repository, issue, identity, role, profile, session, and expected-base bindings.
Reach and complete the underlying bootstrap dry-run.
Return the planned transition without creating a branch, worktree, assignment, or persistent lease.
Avoid NameError, internal errors, or reliance on undefined globals.

Acceptance criteria

Replace or correctly define all three missing runtime-context helpers.
Use the canonical runtime/profile/session sources rather than duplicated or inferred state.
Add regression coverage proving every referenced helper is defined and callable.
Add an integration-level test for gitea_bootstrap_author_issue_worktree(dry_run=true).
Test both successful identity/session binding and fail-closed mismatch behavior.
Confirm the expected-base SHA is evaluated by the underlying bootstrap service.
Confirm dry-run performs no repository mutation.
Confirm apply mode can proceed to the intended transition when all gates pass.
Preserve wrong-role, wrong-profile, wrong-identity, stale-runtime, and scope-guard enforcement.
Recommission the deployed capability after merge and restart.
Keep issue #931 untouched until commissioning succeeds.

Related work

#850 — introduced native author issue-worktree bootstrap
#941 — bootstrap scope-guard defect
PR #942 — fixed #941 and exposed this previously masked failure
#931 — remains untouched and blocked pending a working sanctioned bootstrap path

## Summary The sanctioned `gitea_bootstrap_author_issue_worktree` capability crashes before entering `author_issue_bootstrap.bootstrap_author_issue_worktree` because `gitea_mcp_server.py` references three undefined helpers: * `_active_username` * `_active_profile_name` * `_current_session_id` This makes native author issue-worktree bootstrap unusable for every caller, including `dry_run=true`. ## Observed failure Commissioning was performed against deployed revision: `aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218` The sanctioned call used: ```text issue_number=941 expected_base_sha=aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218 dry_run=true remote=prgs org=Scaled-Tech-Consulting repo=Gitea-Tools idempotency_key=commission-941-readonly-aab54d48 ``` Result: ```text success=false reason_code=internal_error exception_class=builtins.NameError detail=name '_active_username' is not defined retryable=false transport_survives=true ``` The failure occurs while evaluating arguments around `gitea_mcp_server.py:10235`, before the underlying bootstrap function executes. Source inspection found: | Helper | References | Definitions | | ---------------------- | ---------: | ----------: | | `_active_username` | 1 | 0 | | `_active_profile_name` | 1 | 0 | | `_current_session_id` | 1 | 0 | ## Provenance The undefined references were introduced by commit `a942afe`, "Implement native author issue worktree bootstrap (#850)." This is separate from #941 and PR #942. PR #942 successfully corrected the bootstrap scope guard: commissioning passed `verify_preflight_purity` and advanced beyond the former `missing_issue_worktree` refusal before reaching this latent `NameError`. ## Impact * `gitea_bootstrap_author_issue_worktree` is unconditionally broken at the deployed revision. * Both dry-run and apply paths are affected. * Authors cannot obtain a sanctioned issue-backed worktree through this capability. * Issue #931 remains blocked from beginning implementation through the canonical workflow. * The defect was previously masked by the #941 scope-guard failure. ## Expected behavior The MCP wrapper must obtain the active username, profile, and session identifier through defined, canonical runtime-context accessors and invoke the underlying bootstrap service successfully. With `dry_run=true`, the capability must: 1. Pass the workflow scope guard for the explicitly sanctioned bootstrap scope. 2. Validate repository, issue, identity, role, profile, session, and expected-base bindings. 3. Reach and complete the underlying bootstrap dry-run. 4. Return the planned transition without creating a branch, worktree, assignment, or persistent lease. 5. Avoid `NameError`, internal errors, or reliance on undefined globals. ## Acceptance criteria * Replace or correctly define all three missing runtime-context helpers. * Use the canonical runtime/profile/session sources rather than duplicated or inferred state. * Add regression coverage proving every referenced helper is defined and callable. * Add an integration-level test for `gitea_bootstrap_author_issue_worktree(dry_run=true)`. * Test both successful identity/session binding and fail-closed mismatch behavior. * Confirm the expected-base SHA is evaluated by the underlying bootstrap service. * Confirm dry-run performs no repository mutation. * Confirm apply mode can proceed to the intended transition when all gates pass. * Preserve wrong-role, wrong-profile, wrong-identity, stale-runtime, and scope-guard enforcement. * Recommission the deployed capability after merge and restart. * Keep issue #931 untouched until commissioning succeeds. ## Related work * #850 — introduced native author issue-worktree bootstrap * #941 — bootstrap scope-guard defect * PR #942 — fixed #941 and exposed this previously masked failure * #931 — remains untouched and blocked pending a working sanctioned bootstrap path

jcwalker3 added the status:ready workflow-hardening safety type:bug labels 2026-07-26 07:29:46 -05:00

jcwalker3 referenced this issue from a commit

2026-07-26 07:56:15 -05:00

fix(author bootstrap): restore missing runtime identity and session helpers (Closes #943)

jcwalker3 referenced a pull request that will close this issue

2026-07-26 07:59:35 -05:00

fix(author bootstrap): restore missing runtime identity and session helpers (Closes #943) #944

jcwalker3 added status:pr-open and removed status:ready labels 2026-07-26 07:59:37 -05:00

jcwalker3 commented

2026-07-26 08:02:31 -05:00

[THREAD STATE LEDGER] Issue #943 / PR #944 — implementation delivered, awaiting independent review

What is true now:

Issue state: open, status:pr-open
PR state: PR #944 open, mergeable, base master
Current head SHA: f49e781102
Base SHA: aab54d4825 (verified as the commit parent)
Server-side decision state: no review verdict exists on PR #944
Local verdict/state: none — the author does not review its own work
Latest known validation: 27 new tests pass; 245 pass across targeted bootstrap and guard suites; full suite 28 failed / 5552 passed / 6 skipped / 1006 subtests, where all 28 also fail on the unmodified base

What changed:

server-side state changed: branch fix/issue-943-runtime-context-helpers pushed at f49e781102, PR #944 opened, issue #943 moved to status:pr-open

What is blocked:

Blocker classification: no blocker

Who/what acts next:

Next actor: reviewer
Required action: review PR #944 against the #943 acceptance criteria at pinned head f49e781102
Do not do: self-review, self-merge, reconciler cleanup for PR #942, or any work on issue #931
Resume from: PR #944 body

Canonical Issue State

STATE: Implementation for #943 is complete and delivered as PR #944 at head f49e781102. Four globals referenced by gitea_bootstrap_author_issue_worktree and defined nowhere are now defined: _active_username, _active_profile_name, _current_session_id, and _author_mutation_block. The fourth was not in the original report and was found by the generalised AST regression test.

WHO_IS_NEXT: reviewer

NEXT_ACTION: Review PR #944 against the #943 acceptance criteria with the head pinned to f49e781102, then post APPROVE or REQUEST_CHANGES from a reviewer namespace.

NEXT_PROMPT:

Review PR #944 (Closes #943) in Scaled-Tech-Consulting/Gitea-Tools on remote prgs.

Invoke the canonical gitea-workflow skill first. Use the gitea-reviewer namespace.
Call gitea_get_pr_review_feedback before any review work to confirm reviews: [] —
the allocator hands out already-verdicted PRs.

Pin head f49e781102b9f363834c28c055f69639d16290c9 and base
aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218. Verify against the #943 acceptance
criteria:

- All previously undefined runtime-context helpers are defined and callable.
- Canonical runtime, profile, identity, and session sources are used rather than
  duplicated or inferred state.
- Regression coverage proves every helper the wrapper references is defined.
- An integration-level dry-run test exists for
  gitea_bootstrap_author_issue_worktree(dry_run=true).
- Identity, profile, and session mismatches fail closed.
- The expected-base SHA is evaluated by the bootstrap service.
- Dry-run performs no repository mutation.
- Apply mode reaches its intended transition when all gates pass.
- Wrong-role, wrong-profile, wrong-identity, stale-runtime, and scope-guard
  enforcement are preserved, and #274 / #604 / #618 / #683 are not weakened.

Scrutinise in particular: _current_session_id binds its identifier once per
process. Confirm that is correct for lease-ownership comparison and that it
introduces no cross-session identity reuse.

Do not merge. Do not run reconciler cleanup for PR #942. Do not touch issue #931.

WHAT_HAPPENED: Commissioning #941 against deployed revision aab54d4825 cleared the scope guard PR #942 fixed and then failed with builtins.NameError, name '_active_username' is not defined, while evaluating call arguments at gitea_mcp_server.py:10235. Source inspection found three such globals, each with one reference and no definition, introduced by commit a942afe under #850. Issue #943 was filed. This branch defines all three plus a fourth, _author_mutation_block, on the reviewer-stop refusal path. _active_username reads the immutable #714 session context seeded by gitea_whoami; _active_profile_name prefers the live get_profile with the session context as fallback; _current_session_id mints the same profile-pid-hex shape as the three pre-existing lease call sites, bound once per process; _author_mutation_block returns the uniform refusal shape the other author mutations already use. The diff is 2 files, +534 / -0, with no guard, signature, permission, or role change.

WHY: The bootstrap capability was unusable for every caller including dry_run=true, because the NameError fired before the bootstrap service was entered. That left authors with no sanctioned path to an issue-backed worktree and kept issue #931 unable to start through the canonical workflow. The defect was masked until PR #942 removed the scope-guard refusal that preceded it.

RELATED_PRS: PR #944 (open, head f49e781102, closes #943); PR #942 (merge performed at aab54d4825, closed #941, exposed this defect); PR #926 (merge performed, closed #892)

BLOCKERS: no blocker

VALIDATION: New suite pre-fix against unmodified aab54d48: 20 failed, 13 passed. New suite post-fix: 27 passed, 12 subtests. Targeted suites for 943, 941, 892, author_issue_bootstrap, create_issue_bootstrap, 683, 757, anti_stomp_preflight, root_checkout_guard, 618: 245 passed, 59 subtests. Full suite from the branches worktree: 28 failed, 5552 passed, 6 skipped, 1006 subtests in 151.72s; the 28 are the standing baseline and every one also fails against the unmodified base, verified by failing-test identity rather than by count.

LAST_UPDATED_BY: jcwalker3 / prgs-author / gitea-author namespace, session author_issue_work-d1a91a7d2c7d43df, pid 18161

[THREAD STATE LEDGER] Issue #943 / PR #944 — implementation delivered, awaiting independent review What is true now: - Issue state: open, status:pr-open - PR state: PR #944 open, mergeable, base master - Current head SHA: f49e781102b9f363834c28c055f69639d16290c9 - Base SHA: aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218 (verified as the commit parent) - Server-side decision state: no review verdict exists on PR #944 - Local verdict/state: none — the author does not review its own work - Latest known validation: 27 new tests pass; 245 pass across targeted bootstrap and guard suites; full suite 28 failed / 5552 passed / 6 skipped / 1006 subtests, where all 28 also fail on the unmodified base What changed: - server-side state changed: branch fix/issue-943-runtime-context-helpers pushed at f49e781102b9f363834c28c055f69639d16290c9, PR #944 opened, issue #943 moved to status:pr-open What is blocked: - Blocker classification: no blocker Who/what acts next: - Next actor: reviewer - Required action: review PR #944 against the #943 acceptance criteria at pinned head f49e781102b9f363834c28c055f69639d16290c9 - Do not do: self-review, self-merge, reconciler cleanup for PR #942, or any work on issue #931 - Resume from: PR #944 body ## Canonical Issue State STATE: Implementation for #943 is complete and delivered as PR #944 at head f49e781102b9f363834c28c055f69639d16290c9. Four globals referenced by gitea_bootstrap_author_issue_worktree and defined nowhere are now defined: _active_username, _active_profile_name, _current_session_id, and _author_mutation_block. The fourth was not in the original report and was found by the generalised AST regression test. WHO_IS_NEXT: reviewer NEXT_ACTION: Review PR #944 against the #943 acceptance criteria with the head pinned to f49e781102b9f363834c28c055f69639d16290c9, then post APPROVE or REQUEST_CHANGES from a reviewer namespace. NEXT_PROMPT: ```text Review PR #944 (Closes #943) in Scaled-Tech-Consulting/Gitea-Tools on remote prgs. Invoke the canonical gitea-workflow skill first. Use the gitea-reviewer namespace. Call gitea_get_pr_review_feedback before any review work to confirm reviews: [] — the allocator hands out already-verdicted PRs. Pin head f49e781102b9f363834c28c055f69639d16290c9 and base aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218. Verify against the #943 acceptance criteria: - All previously undefined runtime-context helpers are defined and callable. - Canonical runtime, profile, identity, and session sources are used rather than duplicated or inferred state. - Regression coverage proves every helper the wrapper references is defined. - An integration-level dry-run test exists for gitea_bootstrap_author_issue_worktree(dry_run=true). - Identity, profile, and session mismatches fail closed. - The expected-base SHA is evaluated by the bootstrap service. - Dry-run performs no repository mutation. - Apply mode reaches its intended transition when all gates pass. - Wrong-role, wrong-profile, wrong-identity, stale-runtime, and scope-guard enforcement are preserved, and #274 / #604 / #618 / #683 are not weakened. Scrutinise in particular: _current_session_id binds its identifier once per process. Confirm that is correct for lease-ownership comparison and that it introduces no cross-session identity reuse. Do not merge. Do not run reconciler cleanup for PR #942. Do not touch issue #931. ``` WHAT_HAPPENED: Commissioning #941 against deployed revision aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218 cleared the scope guard PR #942 fixed and then failed with builtins.NameError, name '_active_username' is not defined, while evaluating call arguments at gitea_mcp_server.py:10235. Source inspection found three such globals, each with one reference and no definition, introduced by commit a942afe under #850. Issue #943 was filed. This branch defines all three plus a fourth, _author_mutation_block, on the reviewer-stop refusal path. _active_username reads the immutable #714 session context seeded by gitea_whoami; _active_profile_name prefers the live get_profile with the session context as fallback; _current_session_id mints the same profile-pid-hex shape as the three pre-existing lease call sites, bound once per process; _author_mutation_block returns the uniform refusal shape the other author mutations already use. The diff is 2 files, +534 / -0, with no guard, signature, permission, or role change. WHY: The bootstrap capability was unusable for every caller including dry_run=true, because the NameError fired before the bootstrap service was entered. That left authors with no sanctioned path to an issue-backed worktree and kept issue #931 unable to start through the canonical workflow. The defect was masked until PR #942 removed the scope-guard refusal that preceded it. RELATED_PRS: PR #944 (open, head f49e781102b9f363834c28c055f69639d16290c9, closes #943); PR #942 (merge performed at aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218, closed #941, exposed this defect); PR #926 (merge performed, closed #892) BLOCKERS: no blocker VALIDATION: New suite pre-fix against unmodified aab54d48: 20 failed, 13 passed. New suite post-fix: 27 passed, 12 subtests. Targeted suites for 943, 941, 892, author_issue_bootstrap, create_issue_bootstrap, 683, 757, anti_stomp_preflight, root_checkout_guard, 618: 245 passed, 59 subtests. Full suite from the branches worktree: 28 failed, 5552 passed, 6 skipped, 1006 subtests in 151.72s; the 28 are the standing baseline and every one also fails against the unmodified base, verified by failing-test identity rather than by count. LAST_UPDATED_BY: jcwalker3 / prgs-author / gitea-author namespace, session author_issue_work-d1a91a7d2c7d43df, pid 18161

sysadmin referenced this issue

2026-07-26 08:39:46 -05:00

fix(author bootstrap): restore missing runtime identity and session helpers (Closes #943) #944

sysadmin referenced this issue

2026-07-26 08:42:50 -05:00

fix(author bootstrap): restore missing runtime identity and session helpers (Closes #943) #944

sysadmin referenced this issue

2026-07-26 08:46:26 -05:00

fix(author bootstrap): restore missing runtime identity and session helpers (Closes #943) #944

sysadmin commented

2026-07-26 08:48:10 -05:00

[THREAD STATE LEDGER] Issue #943 / PR #944 — REQUEST_CHANGES posted to Gitea (review 622)

What is true now:

Issue state: open, status:pr-open
PR state: PR #944 open, base master
Current head SHA: f49e781102
Base SHA: aab54d4825 (live master, unmoved during review)
Server-side decision state: REQUEST_CHANGES posted to Gitea, review 622, reviewed head f49e781102, not dismissed, not stale
Local verdict/state: REQUEST_CHANGES posted to Gitea
Latest known validation: no regression — failing test id sets identical at head and at a clean base checkout

What changed:

server-side state changed: formal REQUEST_CHANGES review 622 posted to Gitea on PR #944 at the exact reviewed head

What is blocked:

Blocker classification: code blocker

Who/what acts next:

Next actor: author
Required action: fix owner_session to resolve to the control-plane session that owns the supplied lease, add allocator-path coverage, unify identity and profile authorities, narrow the profile exception handler, then push and publish a new head-pinned handoff
Do not do: merge PR #944, self-review, reconciler cleanup for PR #942, or any work on issue #931
Resume from: review 622 on PR #944

Canonical Issue State

STATE: PR #944 for issue #943 carries one formal REQUEST_CHANGES review (622) from sysadmin at head f49e781102. Two blocking findings and two lesser findings are open. Three of the four restored helpers are correct; the fourth makes the allocator-driven bootstrap path unusable.

WHO_IS_NEXT: author

NEXT_ACTION: Author jcwalker3 must make owner_session resolve to the control-plane session that owns the supplied lease instead of minting a per-process identifier, add a test that supplies assignment_id plus lease_id and asserts the ownership comparison succeeds, unify the identity and profile authorities on one source, narrow the bare exception handler around get_profile, then push and publish a new head-pinned handoff for a fresh independent review.

NEXT_PROMPT:

Address the REQUEST_CHANGES review 622 on PR #944 (Closes #943) in
Scaled-Tech-Consulting/Gitea-Tools on remote prgs.

Invoke the canonical gitea-workflow skill first. Use the gitea-author namespace,
profile prgs-author, identity jcwalker3. Reviewed head
f49e781102b9f363834c28c055f69639d16290c9, base
aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218.

B1 (blocker): gitea_mcp_server.py:3623-3639 _current_session_id mints a new
<profile>-<pid>-<hex> value, so author_issue_bootstrap.py:199-208 refuses with
lease_session_mismatch whenever assignment_id/lease_id are supplied — the
allocator-driven flow the tool exists for. Make owner_session the session that
owns the lease: add a session_id parameter, derive it from the supplied
lease/assignment, or read the canonical control-plane session. Fail closed when
a lease is supplied and its owning session cannot be established.

B2 (blocker): add coverage supplying a real assignment_id and lease_id against
an isolated control-plane DB, asserting the ownership check passes. Confirm it
fails before the B1 fix and passes after.

F3 (medium): identity and profile currently come from two different
authorities. The canonical pairing is gitea_mcp_server.py:100-107 —
get_profile() for profile, _authenticated_username(h) for identity. The wrapper
already holds h at gitea_mcp_server.py:10295.

F4 (minor): gitea_mcp_server.py:3610-3613 swallows every get_profile()
exception; narrow it or let it propagate per the fail-closed convention at
gitea_mcp_server.py:100-113.

Re-run the #943 suite, targeted bootstrap and guard suites, and the full suite
from a branches/ worktree; compare failing test ids against a clean base
worktree at aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218.

Do not merge. Do not self-review. Do not run reconciler cleanup for PR #942.
Do not touch issue #931.

WHAT_HAPPENED: An independent reviewer read both changed files at the exact head, traced all four previously undefined globals to their data sources and call sites, and drove the real bootstrap service rather than trusting the author's summary. _author_mutation_block, _active_username and _active_profile_name behave correctly in the paths that matter, and the AST-based regression test is sound and is what originally surfaced _author_mutation_block. _current_session_id, however, mints a fresh identifier that can never equal the control-plane session which owns an allocated lease; an isolated temporary control-plane DB reproduced lease_session_mismatch, and the same gate passed when handed the true owner session. The wrapper exposes no session_id parameter, so no caller can supply the correct value. The new test file never supplies assignment_id or lease_id, leaving that path uncovered. Full suites were run at the head and at a clean base checkout: 28 failed / 5552 passed / 1006 subtests versus 28 failed / 5525 passed / 994 subtests, with identical failing test id sets, so the branch causes no regression.

WHY: The tool's purpose is bootstrapping an allocated author issue worktree, and ownership of that allocation is compared by session identifier. A minted identifier cannot match the allocator's session, so the canonical flow stays refused and issue #931 still cannot start through it. Process-lifetime identity also contradicts #790, whose own documentation states the long-lived daemon's process identity proves nothing about task ownership, and contradicts live control-plane data showing several distinct author sessions under a single PID.

RELATED_PRS: PR #944 (open, head f49e781102, closes #943, review 622 REQUEST_CHANGES); PR #942 (merge performed at aab54d4825, closed #941, exposed the #943 defect); PR #924 (open, #690 cross-profile session invalidation, relevant to finding F3)

BLOCKERS: code blocker

VALIDATION: New #943 suite at head: 27 passed, 12 subtests. Targeted bootstrap, guard, session, lease, identity and stale-runtime suites at head: 356 passed, 77 subtests, 0 failed. Full suite at head f49e7811: 28 failed, 5552 passed, 6 skipped, 1006 subtests in 168.20s. Full suite at clean base checkout aab54d48: 28 failed, 5525 passed, 6 skipped, 994 subtests in 172.64s. Failing test id sets identical between head and base, so no regression originates from this branch; the extra 27 passes are this PR's new tests. Isolated temporary control-plane DB probe reproduced lease_session_mismatch for the wrapper-minted session and passed for the true owner session.

LAST_UPDATED_BY: sysadmin / prgs-reviewer / gitea-reviewer namespace, reviewer lease session 18216-99c21d36dc2b

[THREAD STATE LEDGER] Issue #943 / PR #944 — REQUEST_CHANGES posted to Gitea (review 622) What is true now: - Issue state: open, status:pr-open - PR state: PR #944 open, base master - Current head SHA: f49e781102b9f363834c28c055f69639d16290c9 - Base SHA: aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218 (live master, unmoved during review) - Server-side decision state: REQUEST_CHANGES posted to Gitea, review 622, reviewed head f49e781102b9f363834c28c055f69639d16290c9, not dismissed, not stale - Local verdict/state: REQUEST_CHANGES posted to Gitea - Latest known validation: no regression — failing test id sets identical at head and at a clean base checkout What changed: - server-side state changed: formal REQUEST_CHANGES review 622 posted to Gitea on PR #944 at the exact reviewed head What is blocked: - Blocker classification: code blocker Who/what acts next: - Next actor: author - Required action: fix owner_session to resolve to the control-plane session that owns the supplied lease, add allocator-path coverage, unify identity and profile authorities, narrow the profile exception handler, then push and publish a new head-pinned handoff - Do not do: merge PR #944, self-review, reconciler cleanup for PR #942, or any work on issue #931 - Resume from: review 622 on PR #944 ## Canonical Issue State STATE: PR #944 for issue #943 carries one formal REQUEST_CHANGES review (622) from sysadmin at head f49e781102b9f363834c28c055f69639d16290c9. Two blocking findings and two lesser findings are open. Three of the four restored helpers are correct; the fourth makes the allocator-driven bootstrap path unusable. WHO_IS_NEXT: author NEXT_ACTION: Author jcwalker3 must make owner_session resolve to the control-plane session that owns the supplied lease instead of minting a per-process identifier, add a test that supplies assignment_id plus lease_id and asserts the ownership comparison succeeds, unify the identity and profile authorities on one source, narrow the bare exception handler around get_profile, then push and publish a new head-pinned handoff for a fresh independent review. NEXT_PROMPT: ```text Address the REQUEST_CHANGES review 622 on PR #944 (Closes #943) in Scaled-Tech-Consulting/Gitea-Tools on remote prgs. Invoke the canonical gitea-workflow skill first. Use the gitea-author namespace, profile prgs-author, identity jcwalker3. Reviewed head f49e781102b9f363834c28c055f69639d16290c9, base aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218. B1 (blocker): gitea_mcp_server.py:3623-3639 _current_session_id mints a new <profile>-<pid>-<hex> value, so author_issue_bootstrap.py:199-208 refuses with lease_session_mismatch whenever assignment_id/lease_id are supplied — the allocator-driven flow the tool exists for. Make owner_session the session that owns the lease: add a session_id parameter, derive it from the supplied lease/assignment, or read the canonical control-plane session. Fail closed when a lease is supplied and its owning session cannot be established. B2 (blocker): add coverage supplying a real assignment_id and lease_id against an isolated control-plane DB, asserting the ownership check passes. Confirm it fails before the B1 fix and passes after. F3 (medium): identity and profile currently come from two different authorities. The canonical pairing is gitea_mcp_server.py:100-107 — get_profile() for profile, _authenticated_username(h) for identity. The wrapper already holds h at gitea_mcp_server.py:10295. F4 (minor): gitea_mcp_server.py:3610-3613 swallows every get_profile() exception; narrow it or let it propagate per the fail-closed convention at gitea_mcp_server.py:100-113. Re-run the #943 suite, targeted bootstrap and guard suites, and the full suite from a branches/ worktree; compare failing test ids against a clean base worktree at aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218. Do not merge. Do not self-review. Do not run reconciler cleanup for PR #942. Do not touch issue #931. ``` WHAT_HAPPENED: An independent reviewer read both changed files at the exact head, traced all four previously undefined globals to their data sources and call sites, and drove the real bootstrap service rather than trusting the author's summary. _author_mutation_block, _active_username and _active_profile_name behave correctly in the paths that matter, and the AST-based regression test is sound and is what originally surfaced _author_mutation_block. _current_session_id, however, mints a fresh identifier that can never equal the control-plane session which owns an allocated lease; an isolated temporary control-plane DB reproduced lease_session_mismatch, and the same gate passed when handed the true owner session. The wrapper exposes no session_id parameter, so no caller can supply the correct value. The new test file never supplies assignment_id or lease_id, leaving that path uncovered. Full suites were run at the head and at a clean base checkout: 28 failed / 5552 passed / 1006 subtests versus 28 failed / 5525 passed / 994 subtests, with identical failing test id sets, so the branch causes no regression. WHY: The tool's purpose is bootstrapping an allocated author issue worktree, and ownership of that allocation is compared by session identifier. A minted identifier cannot match the allocator's session, so the canonical flow stays refused and issue #931 still cannot start through it. Process-lifetime identity also contradicts #790, whose own documentation states the long-lived daemon's process identity proves nothing about task ownership, and contradicts live control-plane data showing several distinct author sessions under a single PID. RELATED_PRS: PR #944 (open, head f49e781102b9f363834c28c055f69639d16290c9, closes #943, review 622 REQUEST_CHANGES); PR #942 (merge performed at aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218, closed #941, exposed the #943 defect); PR #924 (open, #690 cross-profile session invalidation, relevant to finding F3) BLOCKERS: code blocker VALIDATION: New #943 suite at head: 27 passed, 12 subtests. Targeted bootstrap, guard, session, lease, identity and stale-runtime suites at head: 356 passed, 77 subtests, 0 failed. Full suite at head f49e7811: 28 failed, 5552 passed, 6 skipped, 1006 subtests in 168.20s. Full suite at clean base checkout aab54d48: 28 failed, 5525 passed, 6 skipped, 994 subtests in 172.64s. Failing test id sets identical between head and base, so no regression originates from this branch; the extra 27 passes are this PR's new tests. Isolated temporary control-plane DB probe reproduced lease_session_mismatch for the wrapper-minted session and passed for the true owner session. LAST_UPDATED_BY: sysadmin / prgs-reviewer / gitea-reviewer namespace, reviewer lease session 18216-99c21d36dc2b

sysadmin referenced this issue

2026-07-26 08:48:39 -05:00

fix(author bootstrap): restore missing runtime identity and session helpers (Closes #943) #944

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#943