fix: preserve capability preflight across interleaved read-only whoami (Closes #469) #474

2026-07-07T16:50:16-05:00

jcwalker3 commented

2026-07-07 16:50:16 -05:00

Summary

Closes #469. Read-only gitea_whoami calls no longer clear a valid capability preflight when identity was already verified clean. Operators can re-pin live PR/issue state between gitea_resolve_task_capability and the gated mutation without a spurious preflight-order failure.

Root cause

record_preflight_check("whoami") always reset _preflight_capability_called, so a batch like resolve → whoami → view_pr → mutate failed even though capability was correctly resolved moments earlier.

Changes

gitea_mcp_server.py — preserve capability proof across interleaved whoami; track resolved task; consume capability on successful verify_preflight_purity; task-mismatch fail-closed on mutations
tests/test_preflight_read_survival.py — regression cases for interleaved whoami, task mismatch, consumption, and missing-capability fail-closed

Verification

venv/bin/python -m pytest tests/test_preflight_read_survival.py tests/test_mcp_server.py::TestPreflightVerification -q
# 14 passed

venv/bin/python -m pytest tests/ -q
# 1677 passed, 6 skipped

Worktree

branches/issue-469-preflight-read-survival @ 0a6a70b

## Summary Closes #469. Read-only `gitea_whoami` calls no longer clear a valid capability preflight when identity was already verified clean. Operators can re-pin live PR/issue state between `gitea_resolve_task_capability` and the gated mutation without a spurious preflight-order failure. ## Root cause `record_preflight_check("whoami")` always reset `_preflight_capability_called`, so a batch like `resolve → whoami → view_pr → mutate` failed even though capability was correctly resolved moments earlier. ## Changes - `gitea_mcp_server.py` — preserve capability proof across interleaved whoami; track resolved task; consume capability on successful `verify_preflight_purity`; task-mismatch fail-closed on mutations - `tests/test_preflight_read_survival.py` — regression cases for interleaved whoami, task mismatch, consumption, and missing-capability fail-closed ## Verification ```bash venv/bin/python -m pytest tests/test_preflight_read_survival.py tests/test_mcp_server.py::TestPreflightVerification -q # 14 passed venv/bin/python -m pytest tests/ -q # 1677 passed, 6 skipped ``` ## Worktree `branches/issue-469-preflight-read-survival` @ `0a6a70b`

jcwalker3 added 2 commits 2026-07-07 16:50:16 -05:00

fix: preserve capability preflight across interleaved read-only whoami (#469 ) 764db897d4

Read-only gitea_whoami calls no longer clear a valid capability proof when
whoami was already verified clean. Capability is consumed on mutation (one
resolve per mutation), and verify_preflight_purity rejects task mismatches.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

test: reset preflight globals in read-survival setUp (#469 ) 0a6a70b3be

Prevents cross-test leakage that masked the missing-capability fail-closed case.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

sysadmin referenced this pull request

2026-07-08 01:36:38 -05:00

fix: clarify capability preflight lifetime across safe reads (Closes #470) #490

sysadmin closed this pull request

2026-07-08 01:51:11 -05:00

sysadmin commented

2026-07-08 01:51:12 -05:00

PR #474 is closed as superseded by PR #490.

PR #490 extends the capability-preflight contract logic from PR #474 and defines an explicit contract where all safe reads preserve capability preflight until consumed by a mutation. PR #474 is redundant and should not merge independently.

PR #474 is closed as superseded by PR #490. PR #490 extends the capability-preflight contract logic from PR #474 and defines an explicit contract where all safe reads preserve capability preflight until consumed by a mutation. PR #474 is redundant and should not merge independently.

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#474