feat: gate gitea_delete_branch on gitea.branch.delete capability (Closes #408) #410

2026-07-07T10:27:42-05:00

jcwalker3 commented

2026-07-07 10:27:42 -05:00

Summary

Closes #408.

gitea_delete_branch now enforces the exact gitea.branch.delete capability at tool entry via _profile_operation_gate, matching gitea_reconcile_merged_cleanups and other mutating tools.

Changes

Fail closed before preflight/auth/API when the active profile lacks gitea.branch.delete
Return structured #142 permission report on block (no DELETE issued)
Record required_permission in delete_branch audit metadata on allowed deletes
Add regression tests proving resolver-denied sessions cannot bypass the raw tool

Validation

python3 -m unittest tests.test_delete_branch_capability tests.test_mcp_server.TestDeleteBranch -v

All 5 tests passed.

Non-goals

No profile operation changes (no profile gains gitea.branch.delete)

## Summary Closes #408. `gitea_delete_branch` now enforces the exact `gitea.branch.delete` capability at tool entry via `_profile_operation_gate`, matching `gitea_reconcile_merged_cleanups` and other mutating tools. ## Changes - Fail closed before preflight/auth/API when the active profile lacks `gitea.branch.delete` - Return structured `#142` permission report on block (no DELETE issued) - Record `required_permission` in `delete_branch` audit metadata on allowed deletes - Add regression tests proving resolver-denied sessions cannot bypass the raw tool ## Validation ``` python3 -m unittest tests.test_delete_branch_capability tests.test_mcp_server.TestDeleteBranch -v ``` All 5 tests passed. ## Non-goals - No profile operation changes (no profile gains `gitea.branch.delete`)

jcwalker3 added 1 commit 2026-07-07 10:27:42 -05:00

feat: gate gitea_delete_branch on gitea.branch.delete capability (Closes #408 ) af7131abf1

Add fail-closed profile gate at tool entry before preflight or API calls,
return structured permission reports on block, and record required_permission
in delete_branch audit metadata. Regression tests prove resolver-denied
sessions cannot bypass the gate through the raw tool.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

jcwalker3 referenced this pull request

2026-07-07 10:46:40 -05:00

Require exact capability proof for every mutation in reviewer final reports #405

sysadmin approved these changes 2026-07-07 10:48:44 -05:00

sysadmin left a comment

Manual review of changed files and test suite validation passed. The new delete branch capability gate correctly restricts gitea_delete_branch to sessions authorized with gitea.branch.delete capability, resolving issue #408. All tests pass cleanly. Approved.

sysadmin merged commit 1a1e679246 into master

2026-07-07 10:48:51 -05:00

jcwalker3 referenced this pull request

2026-07-07 10:51:57 -05:00

Require exact capability proof for every mutation in reviewer final reports #405

jcwalker3 referenced this pull request

2026-07-07 11:51:48 -05:00

Require exact capability proof for every mutation in reviewer final reports #405

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#410