feat(bootstrap): add controller-authorized recovery lane for fleet-safety deadlocks #981

New Issue

2026-07-30T11:11:50-05:00

jcwalker3 commented

2026-07-30 11:11:50 -05:00

Summary

Add a narrowly scoped, controller-authorized bootstrap recovery lane for implementing control-plane repairs when the repair itself is blocked by the safety gate it must fix.

This must be an auditable capability with explicit eligibility, authorization, scope, expiration, and revocation—not a general fleet-safety bypass.

Observed deadlock

Issue #980 requires implementing a sanctioned, CAS-protected operation for retiring conclusively stale worker registrations.

Current fleet assessment reported:

88 stale_orphaned_worker registrations.
2 live workers with legacy_incomplete_identity.
live_fleet_safe:false.
Fleet-layer mutation_safe:false.
No existing native stale-worker-retirement mutation.
No explicit bootstrap-remediation classification for issue #980.

The ordinary author resolver reports work_issue as allowed, but the fleet gate still prohibits branch creation, commits, pushes, and PR creation.

This creates a circular dependency:

Fleet safety blocks author code changes.
Issue #980 must change code to repair part of fleet safety.
The workflow has no sanctioned mechanism for authorizing that repair while the fleet remains unsafe.

PR #906 remains blocked behind this condition.

Security principle

The recovery lane must not set live_fleet_safe:true, suppress fleet findings, weaken ordinary fleet enforcement, or allow an author to authorize their own exception.

Issue labels such as bootstrap, control-plane, or status:ready must not independently grant recovery access because an author may be able to create or label issues.

Authorization must originate from an independently authenticated controller or other canonical operator-controlled authority.

Required behavior

1. Dedicated bootstrap capability

Add a canonical task and capability for infrastructure recovery, such as:

bootstrap_control_plane_repair

It must be distinct from ordinary work_issue authorization.

The resolver must return structured results including:

Whether recovery is authorized.
Authorizing identity and controller profile.
Repository and remote.
Exact issue number.
Exact base SHA or permitted base revision.
Authorized author identity/profile.
Allowed operations.
Disallowed operations.
Reason codes.
Creation and expiration timestamps.
Revocation state.
Authorization identifier.

2. Controller-issued recovery grant

Only an authorized controller or equivalent operator-controlled role may issue a recovery grant.

The grant must be:

Repository-specific.
Issue-specific.
Author/profile-specific.
Bound to an exact base revision or validated revision range.
Time-limited.
Revocable.
Auditable.
Invalid after the associated PR is created, closed, merged, or abandoned according to canonical policy.

The author must not be able to issue, broaden, renew, or approve their own grant.

3. Minimal operation scope

A valid grant may permit only the operations required to implement and hand off the repair:

Acquire the issue claim.
Create one canonical issue branch.
Create one branch-bound worktree.
Commit issue-scoped code and tests.
Push without force.
Create one PR closing the authorized issue.
Publish one exact-head author handoff.
Release the author claim.

It must not authorize:

Fleet-registry mutation.
Process termination or restart.
Database manipulation.
Configuration or session-file editing.
Changes to unrelated issues or PRs.
Force-push or rebase.
Review, approval, requested changes, or merge.
Self-authorization.
Suppression or rewriting of fleet findings.

4. Remaining safety gates

Bootstrap authorization must not disable unrelated protections.

The workflow must still require:

Correct authenticated identity and role.
Exact repository and remote binding.
Master/runtime parity.
Clean control checkout.
Canonical issue claim.
Branch and worktree isolation.
No conflicting author ownership.
No duplicate live daemon cohort for the acting namespace.
No unrelated repository changes.
Exact-head handoff.
Independent review and merge.

If another safety failure is unrelated to the fleet deadlock being repaired, the operation must stop.

5. Trusted gate consumption

Do not grant authors unrestricted access to the complete controller/reconciler fleet snapshot merely to use the recovery lane.

The author workflow should consume a compact, trusted controller-produced verdict containing:

Current fleet revision.
Blocking classifications.
Recovery-grant identifier.
Authorized issue and operation scope.
Whether the grant remains valid.

Detailed fleet inventory must remain restricted to its canonical controller/reconciler roles unless a separately justified permission change is approved.

6. Bootstrap installation path

The design must explain how the first recovery capability can be established when ordinary author implementation is already blocked.

Use an existing sanctioned operator-controlled installation, deployment, or control-plane update path if one exists.

If no such path exists, define a narrowly scoped, auditable first-install procedure that:

Requires explicit operator/controller authorization.
Does not use direct database editing.
Does not alter fleet findings.
Does not grant permanent author privileges.
Records exactly what was installed, by whom, from which revision, and for which recovery issue.
Becomes unnecessary after the native recovery capability is available.

The implementation must not merely create another issue that is itself impossible to implement.

7. Audit and revocation

Every grant and attempted use must record:

Authorizing controller identity/profile.
Acting author identity/profile.
Repository, issue, branch, and base revision.
Allowed operation set.
Grant issuance, consumption, expiration, and revocation.
Successful and denied operations with reason codes.
Final PR and exact head, when created.

Expired, revoked, mismatched, or already-consumed grants must fail closed.

8. Independent review

Code produced through the recovery lane must follow the normal independent-review process.

The recovery grant must not authorize approval or merge, and it must not make author-generated test evidence authoritative.

Acceptance criteria

Ordinary author work remains blocked when fleet safety is false.
An independently authorized controller can issue a narrowly scoped recovery grant.
An author cannot issue or broaden their own grant.
Labels alone cannot authorize bootstrap work.
A grant is bound to one repository, issue, author, and base revision.
Only the minimal branch/commit/push/PR handoff operations are enabled.
Unrelated mutations remain blocked.
Fleet findings remain visible and unchanged.
Fleet-registry mutation remains unavailable to the author.
Expired, revoked, consumed, or mismatched grants fail without mutation.
Revision drift invalidates or requires explicit reassessment of the grant.
All grant activity produces structured audit evidence.
The first-install/bootstrap procedure is documented and does not depend on the missing capability it installs.
Tests cover authorization, self-authorization denial, label-only denial, scope enforcement, expiry, revocation, revision drift, identity mismatch, repository mismatch, unrelated safety blockers, audit output, and independent-review preservation.

Non-goals

Declaring the current fleet safe.
Retiring stale workers.
Repairing trusted launcher identity.
Giving authors general controller/reconciler visibility.
Disabling fleet safety globally.
Creating a permanent emergency bypass.
Modifying PR #906 or review #624.
Allowing self-review or merge.

Related work

Issue #978 / merged PR #979: authoritative instance-fleet snapshot.
Issue #980: CAS-protected stale-worker retirement capability.
PR #906 / issue #650: blocked author remediation.
Trusted client_instance_id propagation remains a separate problem.

Canonical handoff

WHO_IS_NEXT: controller/operator to determine and authorize the sanctioned first-install path; PR #906 and issue #980 remain paused

## Summary Add a narrowly scoped, controller-authorized bootstrap recovery lane for implementing control-plane repairs when the repair itself is blocked by the safety gate it must fix. This must be an auditable capability with explicit eligibility, authorization, scope, expiration, and revocation—not a general fleet-safety bypass. ## Observed deadlock Issue #980 requires implementing a sanctioned, CAS-protected operation for retiring conclusively stale worker registrations. Current fleet assessment reported: * 88 `stale_orphaned_worker` registrations. * 2 live workers with `legacy_incomplete_identity`. * `live_fleet_safe:false`. * Fleet-layer `mutation_safe:false`. * No existing native stale-worker-retirement mutation. * No explicit bootstrap-remediation classification for issue #980. The ordinary author resolver reports `work_issue` as allowed, but the fleet gate still prohibits branch creation, commits, pushes, and PR creation. This creates a circular dependency: 1. Fleet safety blocks author code changes. 2. Issue #980 must change code to repair part of fleet safety. 3. The workflow has no sanctioned mechanism for authorizing that repair while the fleet remains unsafe. PR #906 remains blocked behind this condition. ## Security principle The recovery lane must not set `live_fleet_safe:true`, suppress fleet findings, weaken ordinary fleet enforcement, or allow an author to authorize their own exception. Issue labels such as `bootstrap`, `control-plane`, or `status:ready` must not independently grant recovery access because an author may be able to create or label issues. Authorization must originate from an independently authenticated controller or other canonical operator-controlled authority. ## Required behavior ### 1. Dedicated bootstrap capability Add a canonical task and capability for infrastructure recovery, such as: `bootstrap_control_plane_repair` It must be distinct from ordinary `work_issue` authorization. The resolver must return structured results including: * Whether recovery is authorized. * Authorizing identity and controller profile. * Repository and remote. * Exact issue number. * Exact base SHA or permitted base revision. * Authorized author identity/profile. * Allowed operations. * Disallowed operations. * Reason codes. * Creation and expiration timestamps. * Revocation state. * Authorization identifier. ### 2. Controller-issued recovery grant Only an authorized controller or equivalent operator-controlled role may issue a recovery grant. The grant must be: * Repository-specific. * Issue-specific. * Author/profile-specific. * Bound to an exact base revision or validated revision range. * Time-limited. * Revocable. * Auditable. * Invalid after the associated PR is created, closed, merged, or abandoned according to canonical policy. The author must not be able to issue, broaden, renew, or approve their own grant. ### 3. Minimal operation scope A valid grant may permit only the operations required to implement and hand off the repair: * Acquire the issue claim. * Create one canonical issue branch. * Create one branch-bound worktree. * Commit issue-scoped code and tests. * Push without force. * Create one PR closing the authorized issue. * Publish one exact-head author handoff. * Release the author claim. It must not authorize: * Fleet-registry mutation. * Process termination or restart. * Database manipulation. * Configuration or session-file editing. * Changes to unrelated issues or PRs. * Force-push or rebase. * Review, approval, requested changes, or merge. * Self-authorization. * Suppression or rewriting of fleet findings. ### 4. Remaining safety gates Bootstrap authorization must not disable unrelated protections. The workflow must still require: * Correct authenticated identity and role. * Exact repository and remote binding. * Master/runtime parity. * Clean control checkout. * Canonical issue claim. * Branch and worktree isolation. * No conflicting author ownership. * No duplicate live daemon cohort for the acting namespace. * No unrelated repository changes. * Exact-head handoff. * Independent review and merge. If another safety failure is unrelated to the fleet deadlock being repaired, the operation must stop. ### 5. Trusted gate consumption Do not grant authors unrestricted access to the complete controller/reconciler fleet snapshot merely to use the recovery lane. The author workflow should consume a compact, trusted controller-produced verdict containing: * Current fleet revision. * Blocking classifications. * Recovery-grant identifier. * Authorized issue and operation scope. * Whether the grant remains valid. Detailed fleet inventory must remain restricted to its canonical controller/reconciler roles unless a separately justified permission change is approved. ### 6. Bootstrap installation path The design must explain how the first recovery capability can be established when ordinary author implementation is already blocked. Use an existing sanctioned operator-controlled installation, deployment, or control-plane update path if one exists. If no such path exists, define a narrowly scoped, auditable first-install procedure that: * Requires explicit operator/controller authorization. * Does not use direct database editing. * Does not alter fleet findings. * Does not grant permanent author privileges. * Records exactly what was installed, by whom, from which revision, and for which recovery issue. * Becomes unnecessary after the native recovery capability is available. The implementation must not merely create another issue that is itself impossible to implement. ### 7. Audit and revocation Every grant and attempted use must record: * Authorizing controller identity/profile. * Acting author identity/profile. * Repository, issue, branch, and base revision. * Allowed operation set. * Grant issuance, consumption, expiration, and revocation. * Successful and denied operations with reason codes. * Final PR and exact head, when created. Expired, revoked, mismatched, or already-consumed grants must fail closed. ### 8. Independent review Code produced through the recovery lane must follow the normal independent-review process. The recovery grant must not authorize approval or merge, and it must not make author-generated test evidence authoritative. ## Acceptance criteria * Ordinary author work remains blocked when fleet safety is false. * An independently authorized controller can issue a narrowly scoped recovery grant. * An author cannot issue or broaden their own grant. * Labels alone cannot authorize bootstrap work. * A grant is bound to one repository, issue, author, and base revision. * Only the minimal branch/commit/push/PR handoff operations are enabled. * Unrelated mutations remain blocked. * Fleet findings remain visible and unchanged. * Fleet-registry mutation remains unavailable to the author. * Expired, revoked, consumed, or mismatched grants fail without mutation. * Revision drift invalidates or requires explicit reassessment of the grant. * All grant activity produces structured audit evidence. * The first-install/bootstrap procedure is documented and does not depend on the missing capability it installs. * Tests cover authorization, self-authorization denial, label-only denial, scope enforcement, expiry, revocation, revision drift, identity mismatch, repository mismatch, unrelated safety blockers, audit output, and independent-review preservation. ## Non-goals * Declaring the current fleet safe. * Retiring stale workers. * Repairing trusted launcher identity. * Giving authors general controller/reconciler visibility. * Disabling fleet safety globally. * Creating a permanent emergency bypass. * Modifying PR #906 or review #624. * Allowing self-review or merge. ## Related work * Issue #978 / merged PR #979: authoritative instance-fleet snapshot. * Issue #980: CAS-protected stale-worker retirement capability. * PR #906 / issue #650: blocked author remediation. * Trusted `client_instance_id` propagation remains a separate problem. ## Canonical handoff ```text WHO_IS_NEXT: controller/operator to determine and authorize the sanctioned first-install path; PR #906 and issue #980 remain paused ```

jcwalker3 added the type:feature status:ready workflow-hardening safety mcp-health control-plane labels 2026-07-30 11:11:50 -05:00

sysadmin commented

2026-07-30 12:30:23 -05:00

Canonical Issue State

STATE: blocked — Decision C: no sanctioned first-install path exists
WHO_IS_NEXT: controller
NEXT_ACTION: Authenticated controller/operator authority must define and approve a narrowly scoped first-install mechanism for the controller-authorized recovery lane. Do not implement #981 or #980 and do not resume PR #906 until that mechanism exists.
NEXT_PROMPT:

As authenticated controller/operator authority on prgs for Scaled-Tech-Consulting/Gitea-Tools: define and approve the narrowly scoped first-install mechanism required by #981 so a controller-authorized recovery lane can be established while live_fleet_safe remains false. Do not implement #981/#980 or resume PR #906 until that sanctioned path exists. Do not create another issue for the same requirement — #981 remains the durable owner.

WHAT_HAPPENED:

Decision C — no sanctioned first-install path exists

A controller/reconciler assessment found no existing native recovery-grant capability and no documented operator-controlled first-install path capable of authorizing implementation of #981 while fleet safety remains false.

Assessment evidence:

Controller identity/profile: sysadmin / prgs-controller
Reconciler identity/profile: sysadmin / prgs-reconciler
Repository: Scaled-Tech-Consulting/Gitea-Tools
Assessed master: 108cbfa173de34470d7abc022b929e6b3adc418a
Runtime parity: in parity
Fleet revision: fleetrev-6e7790e8faf9fed6
Total registered workers: 93
Live workers: 2
Stale workers: 91
Retired workers: 0
Trusted live identities: 0
Live legacy_incomplete_identity blockers: 2
Duplicate cohorts or collisions: none
live_fleet_safe:false
Fleet-layer mutation_safe:false

The two live workers were separate controller and reconciler sessions. Sharing the same client type did not constitute a duplicate cohort.

The following proposed recovery capabilities were absent or returned unknown_task:

bootstrap_control_plane_repair
authorize_bootstrap_repair
bootstrap_repair
issue_recovery_grant
authorize_recovery_grant
recovery_authorization
install_control_plane_capability
control_plane_update
reconcile_instance_fleet
retire_stale_workers

The existing issue_irrecoverable_provenance_authorization capability is limited to review-decision-lock provenance recovery. It does not authorize author branches, commits, pushes, pull requests, or implementation of #981.

The resulting circular dependency is:

Fleet safety is false.
Fleet enforcement blocks ordinary author mutations.
Issue #981 requires code changes to establish a controller-authorized recovery lane.
No existing native capability or documented first-install path can authorize those changes.

Retiring the 91 stale registrations would not independently make the fleet safe. The two live legacy_incomplete_identity blockers would remain. Trusted launcher identity propagation remains a separate operator-owned problem.

Issue #981 therefore remains the durable owner of the missing first-install mechanism. Do not create another issue for the same requirement.

No mutation occurred during the assessment. This establishes only that the assessment session performed no repository mutation; it does not claim that uninspected external resources were independently verified unchanged.

The approving operator authority must be authenticated and validated separately. Do not infer operator authority merely from the jcwalker3 author identity.

WHY: Fleet safety is false and no native recovery-grant or documented operator-controlled first-install path can authorize implementing #981 while that condition holds, producing a circular dependency that leaves #981 blocked.
RELATED_PRS: PR #906 remains paused; issue #980 remains paused; no new PR created for #981.
BLOCKERS: live_fleet_safe:false; fleet-layer mutation_safe:false; 2 live legacy_incomplete_identity blockers; 91 stale workers (retirement alone insufficient); missing native first-install/recovery-grant capability; no sanctioned path to authorize #981 implementation. Unblock after authenticated controller/operator authority defines and approves the narrowly scoped first-install mechanism for the controller-authorized recovery lane.
VALIDATION: Assessment-only session — no repository mutation, no branch/commit/push/PR, no lease/grant issuance, no changes to #980, PR #906, #650, or review 624. Live preflight for this recording: identity sysadmin / prgs-controller, repo Scaled-Tech-Consulting/Gitea-Tools, issue #981 open with status:ready before status update, gitea.issue.comment allowed on controller profile.
LAST_UPDATED_BY: sysadmin / prgs-controller (gitea-controller)

WHO_IS_NEXT: authenticated controller/operator authority to define and approve the narrowly scoped first-install mechanism. Issue #980 and PR #906 remain paused.

## Canonical Issue State STATE: blocked — Decision C: no sanctioned first-install path exists WHO_IS_NEXT: controller NEXT_ACTION: Authenticated controller/operator authority must define and approve a narrowly scoped first-install mechanism for the controller-authorized recovery lane. Do not implement #981 or #980 and do not resume PR #906 until that mechanism exists. NEXT_PROMPT: ```text As authenticated controller/operator authority on prgs for Scaled-Tech-Consulting/Gitea-Tools: define and approve the narrowly scoped first-install mechanism required by #981 so a controller-authorized recovery lane can be established while live_fleet_safe remains false. Do not implement #981/#980 or resume PR #906 until that sanctioned path exists. Do not create another issue for the same requirement — #981 remains the durable owner. ``` WHAT_HAPPENED: ### Decision C — no sanctioned first-install path exists A controller/reconciler assessment found no existing native recovery-grant capability and no documented operator-controlled first-install path capable of authorizing implementation of #981 while fleet safety remains false. Assessment evidence: * Controller identity/profile: `sysadmin` / `prgs-controller` * Reconciler identity/profile: `sysadmin` / `prgs-reconciler` * Repository: `Scaled-Tech-Consulting/Gitea-Tools` * Assessed master: `108cbfa173de34470d7abc022b929e6b3adc418a` * Runtime parity: in parity * Fleet revision: `fleetrev-6e7790e8faf9fed6` * Total registered workers: 93 * Live workers: 2 * Stale workers: 91 * Retired workers: 0 * Trusted live identities: 0 * Live `legacy_incomplete_identity` blockers: 2 * Duplicate cohorts or collisions: none * `live_fleet_safe:false` * Fleet-layer `mutation_safe:false` The two live workers were separate controller and reconciler sessions. Sharing the same client type did not constitute a duplicate cohort. The following proposed recovery capabilities were absent or returned `unknown_task`: * `bootstrap_control_plane_repair` * `authorize_bootstrap_repair` * `bootstrap_repair` * `issue_recovery_grant` * `authorize_recovery_grant` * `recovery_authorization` * `install_control_plane_capability` * `control_plane_update` * `reconcile_instance_fleet` * `retire_stale_workers` The existing `issue_irrecoverable_provenance_authorization` capability is limited to review-decision-lock provenance recovery. It does not authorize author branches, commits, pushes, pull requests, or implementation of #981. The resulting circular dependency is: 1. Fleet safety is false. 2. Fleet enforcement blocks ordinary author mutations. 3. Issue #981 requires code changes to establish a controller-authorized recovery lane. 4. No existing native capability or documented first-install path can authorize those changes. Retiring the 91 stale registrations would not independently make the fleet safe. The two live `legacy_incomplete_identity` blockers would remain. Trusted launcher identity propagation remains a separate operator-owned problem. Issue #981 therefore remains the durable owner of the missing first-install mechanism. Do not create another issue for the same requirement. No mutation occurred during the assessment. This establishes only that the assessment session performed no repository mutation; it does not claim that uninspected external resources were independently verified unchanged. The approving operator authority must be authenticated and validated separately. Do not infer operator authority merely from the `jcwalker3` author identity. WHY: Fleet safety is false and no native recovery-grant or documented operator-controlled first-install path can authorize implementing #981 while that condition holds, producing a circular dependency that leaves #981 blocked. RELATED_PRS: PR #906 remains paused; issue #980 remains paused; no new PR created for #981. BLOCKERS: live_fleet_safe:false; fleet-layer mutation_safe:false; 2 live legacy_incomplete_identity blockers; 91 stale workers (retirement alone insufficient); missing native first-install/recovery-grant capability; no sanctioned path to authorize #981 implementation. Unblock after authenticated controller/operator authority defines and approves the narrowly scoped first-install mechanism for the controller-authorized recovery lane. VALIDATION: Assessment-only session — no repository mutation, no branch/commit/push/PR, no lease/grant issuance, no changes to #980, PR #906, #650, or review 624. Live preflight for this recording: identity sysadmin / prgs-controller, repo Scaled-Tech-Consulting/Gitea-Tools, issue #981 open with status:ready before status update, gitea.issue.comment allowed on controller profile. LAST_UPDATED_BY: sysadmin / prgs-controller (gitea-controller) `WHO_IS_NEXT: authenticated controller/operator authority to define and approve the narrowly scoped first-install mechanism. Issue #980 and PR #906 remain paused.`

sysadmin added status:blocked and removed status:ready labels 2026-07-30 12:30:38 -05:00

sysadmin commented

2026-07-30 13:08:48 -05:00

Canonical Issue State

STATE: premise-corrected — D2-A; fleet-deadlock premise unsupported at current master
WHO_IS_NEXT: controller
NEXT_ACTION: Correct or dispose #981 under D2-A (unsupported fleet-deadlock premise). Do not implement #981 as framed. Do not activate BAA/first-install. Separately revalidate whether #980 has any remaining real dependency. Do not resume #980 or PR #906 in this session.
NEXT_PROMPT:

As authenticated controller/operator on prgs for Scaled-Tech-Consulting/Gitea-Tools at master 108cbfa173de34470d7abc022b929e6b3adc418a: apply D2-A follow-through for issue #981. The fleet-deadlock premise is unsupported — live_fleet_safe is observational only and is not consumed by ordinary author mutation gates (work_issue/claim/branch/commit/push/PR). Revise or close #981 accordingly without implementing the BAA recovery lane. Separately revalidate #980 dependency; keep #980 and PR #906 paused until that review. Do not invent status:ready for #981 solely from this disposition.

WHAT_HAPPENED:

Disposition D2-A — #981 premise requires correction

Master SHA (parity-verified): 108cbfa173de34470d7abc022b929e6b3adc418a

Stage −1 native author evidence (submitted; not re-impersonated):

Identity jcwalker3 / profile prgs-author / role author
Remote/repo prgs / Scaled-Tech-Consulting/Gitea-Tools
Startup/runtime/live master 108cbfa173de34470d7abc022b929e6b3adc418a; in_parity:true; live_stale:false; parity-layer mutation_safe:true
Classification S1-A — Author work resolves ready without a fleet block
gitea_resolve_task_capability(task="work_issue", issue_number=981, remote="prgs") → required_operation_permission=gitea.pr.create, allowed_in_current_session=true, available_in_session=true, restart_required=false, stop_required=false, mutation_performed=false, exact_safe_next_action="None; ready for operations."
Allowed author ops included gitea.branch.create, gitea.branch.push, gitea.repo.commit, gitea.pr.create, plus issue/PR comment ops

Controller preflight (this session):

Namespace gitea-controller; identity sysadmin; profile prgs-controller; role_kind controller
Binding prgs → Scaled-Tech-Consulting/Gitea-Tools
Same master SHA; in_parity:true; live_stale:false; parity-layer mutation_safe:true
Clean control checkout on master
Issue #981 open with status:blocked before this comment
comment_issue / gitea.issue.comment allowed; labels catalog has neither status:needs-revision nor status:needs-triage

Source-backed verification at 108cbfa:

No fleet-safety consumer in ordinary author workflow: live_fleet_safe produced only by mcp_fleet_snapshot.snapshot_instance_fleet; zero non-test Python readers for authorization; gitea_mcp_server.py has zero live_fleet_safe occurrences; author modules do not import fleet snapshot.
Fleet snapshot observational: gitea_snapshot_instance_fleet is read-only controller/reconciler; capability map gitea.read; docs state no new mutation permissions.
work_issue → gitea.pr.create / author in task_capability_map.py.
Ordinary author gates use _profile_operation_gate only (master parity, runtime mode, profile allow/forbid). _profile_permission_block / _namespace_mutation_block have no fleet terms. gitea_lock_issue, gitea_commit_files, gitea_create_pr have no fleet-derived denial path. Task map: lock_issue→gitea.issue.comment, create_branch→gitea.branch.create, commit_files→gitea.repo.commit, push_branch→gitea.branch.push, create_pr→gitea.pr.create.
No separate downstream fleet-derived author block proven; no fleet-unsafe denial reason code for author ops; no author mutation attempted as a test.
#981 body/AC explicitly claim fleet gate blocks branch/commit/push/PR and that ordinary author work remains blocked when fleet safety is false — unsupported at this revision.
#980 body does not record dependency on #981; claimed sole dependency via fleet-author block is not established from #980's own record.

Decision C comment 18775 — remains valid in part: assessment context; fleet observational findings as observations; absence of native recovery-grant/bootstrap tasks; irrecoverable-provenance grant not a general author path; BAA paused; #980/PR #906 not resumed by that decision.

Superseded from Decision C: conclusion that fleet enforcement blocks ordinary author mutations and creates a circular dependency requiring a recovery grant to implement #981; premise that #981 stays blocked pending first-install because authors cannot mutate while live_fleet_safe:false; AC framing that ordinary author work is fleet-gated by live_fleet_safe.

Conclusions: fleet-deadlock premise unsupported; Decision C recovery-grant search historically accurate but need not established; BAA remains paused; #981 must not be implemented as framed; no proof all downstream mutations succeed (no mutation test); multi-LLM focus should be trusted identity, registry accuracy, collisions, ownership isolation, safe concurrency.

Labels: live catalog lacks status:needs-revision and status:needs-triage → labels left unchanged (including status:blocked); no status:ready; issue not closed; body not rewritten.

BAA status: paused / not activated.

WHY: Independent controller verification found no authorization consumer of live_fleet_safe or fleet-layer mutation_safe on ordinary author mutation paths; Stage −1 work_issue resolved ready; therefore #981's fleet-deadlock premise and Decision C's circular-dependency need for a recovery grant are unsupported at master 108cbfa.
RELATED_PRS: PR #906 remains paused; issue #980 remains paused pending separate dependency revalidation; no new PR for #981.
BLOCKERS: #981 premise unsupported (not an author fleet block). Remaining real multi-LLM gaps (trusted unique worker identity, registry accuracy, collision detection, ownership isolation, concurrency) are outside this disposition and do not re-establish the #981 fleet-deadlock premise. Labels could not move to needs-revision/needs-triage because those labels do not exist in the live catalog.
VALIDATION: Controller-only disposition on clean master 108cbfa; whoami + resolve_task_capability(comment_issue) immediately before this post; no author mutation test; no code/branch/worktree/commit/push/PR/claim/lease/grant/fleet/config/process changes; #980, PR #906, #650, review 624 untouched.
LAST_UPDATED_BY: sysadmin / prgs-controller (gitea-controller)

WHO_IS_NEXT: controller

## Canonical Issue State STATE: premise-corrected — D2-A; fleet-deadlock premise unsupported at current master WHO_IS_NEXT: controller NEXT_ACTION: Correct or dispose #981 under D2-A (unsupported fleet-deadlock premise). Do not implement #981 as framed. Do not activate BAA/first-install. Separately revalidate whether #980 has any remaining real dependency. Do not resume #980 or PR #906 in this session. NEXT_PROMPT: ```text As authenticated controller/operator on prgs for Scaled-Tech-Consulting/Gitea-Tools at master 108cbfa173de34470d7abc022b929e6b3adc418a: apply D2-A follow-through for issue #981. The fleet-deadlock premise is unsupported — live_fleet_safe is observational only and is not consumed by ordinary author mutation gates (work_issue/claim/branch/commit/push/PR). Revise or close #981 accordingly without implementing the BAA recovery lane. Separately revalidate #980 dependency; keep #980 and PR #906 paused until that review. Do not invent status:ready for #981 solely from this disposition. ``` WHAT_HAPPENED: ### Disposition D2-A — #981 premise requires correction **Master SHA (parity-verified):** `108cbfa173de34470d7abc022b929e6b3adc418a` **Stage −1 native author evidence (submitted; not re-impersonated):** * Identity `jcwalker3` / profile `prgs-author` / role `author` * Remote/repo `prgs` / `Scaled-Tech-Consulting/Gitea-Tools` * Startup/runtime/live master `108cbfa173de34470d7abc022b929e6b3adc418a`; `in_parity:true`; `live_stale:false`; parity-layer `mutation_safe:true` * Classification **S1-A** — Author work resolves ready without a fleet block * `gitea_resolve_task_capability(task="work_issue", issue_number=981, remote="prgs")` → `required_operation_permission=gitea.pr.create`, `allowed_in_current_session=true`, `available_in_session=true`, `restart_required=false`, `stop_required=false`, `mutation_performed=false`, `exact_safe_next_action="None; ready for operations."` * Allowed author ops included `gitea.branch.create`, `gitea.branch.push`, `gitea.repo.commit`, `gitea.pr.create`, plus issue/PR comment ops **Controller preflight (this session):** * Namespace `gitea-controller`; identity `sysadmin`; profile `prgs-controller`; role_kind `controller` * Binding `prgs` → `Scaled-Tech-Consulting/Gitea-Tools` * Same master SHA; `in_parity:true`; `live_stale:false`; parity-layer `mutation_safe:true` * Clean control checkout on `master` * Issue #981 open with `status:blocked` before this comment * `comment_issue` / `gitea.issue.comment` allowed; labels catalog has neither `status:needs-revision` nor `status:needs-triage` **Source-backed verification at `108cbfa`:** 1. No fleet-safety consumer in ordinary author workflow: `live_fleet_safe` produced only by `mcp_fleet_snapshot.snapshot_instance_fleet`; zero non-test Python readers for authorization; `gitea_mcp_server.py` has zero `live_fleet_safe` occurrences; author modules do not import fleet snapshot. 2. Fleet snapshot observational: `gitea_snapshot_instance_fleet` is read-only controller/reconciler; capability map `gitea.read`; docs state no new mutation permissions. 3. `work_issue` → `gitea.pr.create` / author in `task_capability_map.py`. 4. Ordinary author gates use `_profile_operation_gate` only (master parity, runtime mode, profile allow/forbid). `_profile_permission_block` / `_namespace_mutation_block` have no fleet terms. `gitea_lock_issue`, `gitea_commit_files`, `gitea_create_pr` have no fleet-derived denial path. Task map: lock_issue→`gitea.issue.comment`, create_branch→`gitea.branch.create`, commit_files→`gitea.repo.commit`, push_branch→`gitea.branch.push`, create_pr→`gitea.pr.create`. 5. No separate downstream fleet-derived author block proven; no fleet-unsafe denial reason code for author ops; no author mutation attempted as a test. 6. #981 body/AC explicitly claim fleet gate blocks branch/commit/push/PR and that ordinary author work remains blocked when fleet safety is false — **unsupported** at this revision. 7. #980 body does not record dependency on #981; claimed sole dependency via fleet-author block is not established from #980's own record. **Decision C comment `18775` — remains valid in part:** assessment context; fleet observational findings as observations; absence of native recovery-grant/bootstrap tasks; irrecoverable-provenance grant not a general author path; BAA paused; #980/PR #906 not resumed by that decision. **Superseded from Decision C:** conclusion that fleet enforcement blocks ordinary author mutations and creates a circular dependency requiring a recovery grant to implement #981; premise that #981 stays blocked pending first-install because authors cannot mutate while `live_fleet_safe:false`; AC framing that ordinary author work is fleet-gated by `live_fleet_safe`. **Conclusions:** fleet-deadlock premise unsupported; Decision C recovery-grant search historically accurate but need not established; BAA remains paused; #981 must not be implemented as framed; no proof all downstream mutations succeed (no mutation test); multi-LLM focus should be trusted identity, registry accuracy, collisions, ownership isolation, safe concurrency. **Labels:** live catalog lacks `status:needs-revision` and `status:needs-triage` → labels left unchanged (including `status:blocked`); no `status:ready`; issue not closed; body not rewritten. **BAA status:** paused / not activated. WHY: Independent controller verification found no authorization consumer of `live_fleet_safe` or fleet-layer `mutation_safe` on ordinary author mutation paths; Stage −1 `work_issue` resolved ready; therefore #981's fleet-deadlock premise and Decision C's circular-dependency need for a recovery grant are unsupported at master `108cbfa`. RELATED_PRS: PR #906 remains paused; issue #980 remains paused pending separate dependency revalidation; no new PR for #981. BLOCKERS: #981 premise unsupported (not an author fleet block). Remaining real multi-LLM gaps (trusted unique worker identity, registry accuracy, collision detection, ownership isolation, concurrency) are outside this disposition and do not re-establish the #981 fleet-deadlock premise. Labels could not move to needs-revision/needs-triage because those labels do not exist in the live catalog. VALIDATION: Controller-only disposition on clean master `108cbfa`; whoami + resolve_task_capability(comment_issue) immediately before this post; no author mutation test; no code/branch/worktree/commit/push/PR/claim/lease/grant/fleet/config/process changes; #980, PR #906, #650, review 624 untouched. LAST_UPDATED_BY: sysadmin / prgs-controller (gitea-controller) `WHO_IS_NEXT: controller`

sysadmin referenced this issue

2026-07-30 13:28:58 -05:00

feat(fleet): add CAS-protected stale worker retirement capability #980

jcwalker3 referenced this issue

2026-07-30 13:39:42 -05:00

feat(fleet): add CAS-protected stale worker retirement capability #980

jcwalker3 referenced this issue

2026-07-30 13:40:18 -05:00

feat(fleet): add CAS-protected stale worker retirement capability #980

jcwalker3 referenced this issue

2026-07-30 14:25:50 -05:00

feat(fleet): add CAS-protected stale worker retirement capability (Closes #980) #982