feat: preserve and resume prepared review verdict drafts (#609) #611

2026-07-09T18:03:12-05:00

jcwalker3 commented

2026-07-09 18:03:12 -05:00

Summary

Implements #609: sanctioned non-terminal draft storage for prepared reviewer verdicts so fully validated reviews can survive MCP disconnect / stale-runtime restart without counting as formal reviews.

Changes

gitea_save_review_draft — persist PR number, head SHA, target branch SHA, worktree path, validation commands/results, intended verdict, and blocker reason via durable session state (KIND_REVIEW_DRAFT)
gitea_resume_review_draft — live revalidation of open state, head SHA, target SHA, #332 terminal lock, active lease ownership, reviewer identity, and worktree binding before mark-ready / optional submit
Drafts never substitute for formal approval without revalidation
Tests cover save, clean resume+submit, head/target/worktree drift, foreign lease, and #332 hard-stop

Validation

pytest tests/test_review_drafts.py → 5 passed

Closes #609

## Summary Implements #609: sanctioned non-terminal draft storage for prepared reviewer verdicts so fully validated reviews can survive MCP disconnect / stale-runtime restart without counting as formal reviews. ## Changes - `gitea_save_review_draft` — persist PR number, head SHA, target branch SHA, worktree path, validation commands/results, intended verdict, and blocker reason via durable session state (`KIND_REVIEW_DRAFT`) - `gitea_resume_review_draft` — live revalidation of open state, head SHA, target SHA, #332 terminal lock, active lease ownership, reviewer identity, and worktree binding before mark-ready / optional submit - Drafts never substitute for formal approval without revalidation - Tests cover save, clean resume+submit, head/target/worktree drift, foreign lease, and #332 hard-stop ## Validation - `pytest tests/test_review_drafts.py` → 5 passed Closes #609

jcwalker3 added 1 commit 2026-07-09 18:03:12 -05:00

feat: preserve and resume prepared review verdict drafts (#609 ) 23e366d9d6

Add non-terminal review draft save/resume tools so a fully validated
reviewer verdict can survive MCP disconnect or stale-runtime restart
without counting as a formal review.

- gitea_save_review_draft: durable draft with PR, head SHA, target SHA,
  worktree, validation evidence, intended verdict, and blocker reason
- gitea_resume_review_draft: live revalidation of head/target/#332/lease/
  identity/worktree before mark-ready or optional submit
- Drafts never substitute for formal approval without revalidation

Closes #609

sysadmin referenced this pull request

2026-07-09 21:04:42 -05:00

docs: ADR for MCP allocator, control-plane DB, and incident bridge (#613) #614

sysadmin commented

2026-07-13 18:23:43 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #611
issue: none
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 3157-7b07b2c43c37
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-611
phase: claimed
candidate_head: none
target_branch: master
target_branch_sha: none
last_activity: 2026-07-13T23:23:43Z
expires_at: 2026-07-14T01:23:43Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #611 issue: none reviewer_identity: sysadmin profile: prgs-reviewer session_id: 3157-7b07b2c43c37 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-611 phase: claimed candidate_head: none target_branch: master target_branch_sha: none last_activity: 2026-07-13T23:23:43Z expires_at: 2026-07-14T01:23:43Z blocker: none

sysadmin commented

2026-07-13 18:45:32 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #611
issue: none
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 3157-7b07b2c43c37
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-611
phase: released
candidate_head: none
target_branch: master
target_branch_sha: none
last_activity: 2026-07-13T23:45:32Z
expires_at: 2026-07-14T01:45:32Z
blocker: manual-release

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #611 issue: none reviewer_identity: sysadmin profile: prgs-reviewer session_id: 3157-7b07b2c43c37 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-611 phase: released candidate_head: none target_branch: master target_branch_sha: none last_activity: 2026-07-13T23:45:32Z expires_at: 2026-07-14T01:45:32Z blocker: manual-release

sysadmin commented

2026-07-13 18:45:34 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #611
issue: none
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 57708-117bddbca592
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-611
phase: claimed
candidate_head: none
target_branch: master
target_branch_sha: none
last_activity: 2026-07-13T23:45:33Z
expires_at: 2026-07-14T01:45:33Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #611 issue: none reviewer_identity: sysadmin profile: prgs-reviewer session_id: 57708-117bddbca592 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-611 phase: claimed candidate_head: none target_branch: master target_branch_sha: none last_activity: 2026-07-13T23:45:33Z expires_at: 2026-07-14T01:45:33Z blocker: none

sysadmin approved these changes 2026-07-13 18:45:36 -05:00

sysadmin referenced this pull request

2026-07-13 18:58:34 -05:00

Critical: offline import of MCP server internals reconstructs session gates and contaminates formal reviews after native transport failure #695

sysadmin referenced this pull request

2026-07-13 18:58:43 -05:00

fix: map Gitea auth failures to structured MCP tool errors (Closes #699) #701

sysadmin commented

2026-07-13 18:58:50 -05:00

CTH: Containment — merge attempt from contaminated session did NOT succeed

Canonical Issue State

STATE:
open; not-merged; foreign-lease-active; contamination-adjacent

WHO_IS_NEXT:
controller

NEXT_ACTION:
Do not merge PR #611 from containment. Wait for foreign lease 11388 expiry (2026-07-14T01:45:33Z) or post-expiry sanctioned diagnosis only. Do not steal leases. See Issue #695 recurrence evidence.

NEXT_PROMPT:

Role: CONTROLLER (native MCP only)
Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools
PR: #611 | Related incident: #695 / contaminated #701 run

1. Confirm live state still open and not on master before any merge path.
2. Diagnose lease 11388; wait until expiry; never steal/seed.
3. Do not treat approvals produced during contaminated sessions as merge authorization without independent native re-validation.
4. Do not merge #611 from reconciler containment workstreams tied to the #701 direct-import incident.

WHAT_HAPPENED:
Live API readback: PR #611 open at head 23e366d9d65ffe6e0405c620c82c8a97682717e1; merged_at null; mergeable false; head not on master (cc3ad0870a); sysadmin APPROVED undismissed; lease 11388 foreign_active; CP lease-d0f66c9233fb4112 stale_dead_process. Contaminated run attempted #611 merge paths; no merge succeeded.

WHY:
Containment must record failed merge attempts from contaminated sessions so later actors do not assume landing succeeded.

RELATED_PRS:
#611 this PR; #701 contaminated approve; #695 defect class

BLOCKERS:
Foreign active lease 11388; mergeable false; do not merge under contaminated provenance

VALIDATION:
view_pr; get_pr_review_feedback; diagnose_reviewer_pr_lease_handoff; list_workflow_leases; git ancestor check vs prgs/master

LAST_UPDATED_BY:
prgs-reconciler / sysadmin

## CTH: Containment — merge attempt from contaminated session did NOT succeed ## Canonical Issue State STATE: open; not-merged; foreign-lease-active; contamination-adjacent WHO_IS_NEXT: controller NEXT_ACTION: Do not merge PR #611 from containment. Wait for foreign lease 11388 expiry (2026-07-14T01:45:33Z) or post-expiry sanctioned diagnosis only. Do not steal leases. See Issue #695 recurrence evidence. NEXT_PROMPT: ```text Role: CONTROLLER (native MCP only) Repo: prgs / Scaled-Tech-Consulting / Gitea-Tools PR: #611 | Related incident: #695 / contaminated #701 run 1. Confirm live state still open and not on master before any merge path. 2. Diagnose lease 11388; wait until expiry; never steal/seed. 3. Do not treat approvals produced during contaminated sessions as merge authorization without independent native re-validation. 4. Do not merge #611 from reconciler containment workstreams tied to the #701 direct-import incident. ``` WHAT_HAPPENED: Live API readback: PR #611 open at head 23e366d9d65ffe6e0405c620c82c8a97682717e1; merged_at null; mergeable false; head not on master (cc3ad0870aab); sysadmin APPROVED undismissed; lease 11388 foreign_active; CP lease-d0f66c9233fb4112 stale_dead_process. Contaminated run attempted #611 merge paths; no merge succeeded. WHY: Containment must record failed merge attempts from contaminated sessions so later actors do not assume landing succeeded. RELATED_PRS: #611 this PR; #701 contaminated approve; #695 defect class BLOCKERS: Foreign active lease 11388; mergeable false; do not merge under contaminated provenance VALIDATION: view_pr; get_pr_review_feedback; diagnose_reviewer_pr_lease_handoff; list_workflow_leases; git ancestor check vs prgs/master LAST_UPDATED_BY: prgs-reconciler / sysadmin

sysadmin referenced this pull request

2026-07-13 20:54:51 -05:00

feat(guard): native MCP transport binding and contaminated-review quarantine (Closes #695) #696

sysadmin referenced this pull request

2026-07-13 21:33:53 -05:00

MCP servers report Connected but tool namespaces are not attached to the active session #708

sysadmin referenced this pull request

2026-07-13 23:45:20 -05:00

incident: contaminated controller run (PR #696/#695) — credential exposed via shell args/curl, direct API+script fallback, provenance-env spoof, unmanaged MCP kill, false "no credential leaked" report #700

This pull request has changes conflicting with the target branch.