#494–#507 defined the ledger, the canonical state comments, and the Canonical
Thread Handoff shape. None of them enforce the chain: that every actor
consumes exactly one canonical handoff, performs exactly one authorized role,
records the result durably in Gitea, and emits the next complete handoff until
the controller records final closure. This PR owns that systemic enforcement gap.
New module self_propagating_handoff.py (pure assessment — no network calls,
no mutation), wired into final_report_validator.py as rule shared.self_propagating_handoff, plus the canonical schema document skills/llm-project-workflow/schemas/self-propagating-handoff.md.
What it enforces
Canonical handoff contract — 19 required fields (REPOSITORY, ISSUE, PR, WORKFLOW_STATE, HEAD_SHA, BASE_BRANCH, BASE_OR_MERGE_SHA, ACTING_ROLE, ACTING_IDENTITY, COMPLETED_ACTIONS, VALIDATION_EVIDENCE, MUTATION_LEDGER, BLOCKERS, NEXT_ACTOR, NEXT_ACTION, PROHIBITED_ACTIONS, NEXT_PROMPT, WORKFLOW_FAILURE_ISSUES, LAST_UPDATED). Only a named subset may carry none, and PR/HEAD_SHA
only in needs-author or blocked.
Live-state recovery — assess_handoff_live_state fails closed on all
fourteen detection kinds: changed_pr_head, stale_approval, issue_closed, issue_reopened, pr_merged, pr_closed_unmerged, stale_lease, foreign_lease, missing_worktree, dirty_worktree, namespace_mismatch, stale_runtime, changed_base, conflicting_canonical_comments. A changed head invalidates an inherited
review or merge handoff and recovers the chain to needs-review.
Role-limited continuation — assess_role_continuation permits only the
actions the declared WORKFLOW_STATE authorizes for the receiving role.
Mandatory durable state update — assess_durable_state_update rejects a
chat-only report; the canonical state must reach the Gitea thread.
Mandatory next handoff — a non-terminal handoff requires a concrete NEXT_ACTION and a ready-to-run NEXT_PROMPT that names the repository and
issue and does not lean on outside chat history.
Controller completion boundary — assess_merge_completion_transition
moves a merged PR to merged-awaiting-controller, not to accepted work. assess_controller_decision honors accept only with all four closure
proofs recorded, and routes request_tests / request_proof / request_corrections / reopen / return_to_actor.
Workflow-failure escalation — assess_workflow_failure_escalation
requires classification, linked_issue, temporary_impact, next_valid_actor, and recovery_prompt per distinct defect, reuses an
existing durable issue for a known signature instead of filing a duplicate,
and keeps tooling defects out of the active feature issue.
Validation before posting — incomplete handoffs are rejected with
actionable reasons and a safe_next_action.
Final-report integration — the rule is registered for review_pr, merge_pr, reconcile_already_landed, author_issue, work_issue, issue_filing, inventory, issue_selection, and controller_close, so
the handoff is not an optional prose section.
Terminal complete must carry no NEXT_ACTION and no NEXT_PROMPT: a
finished workflow terminates instead of manufacturing more work.
Applicability gating
Enforcement is applicability-gated exactly like the #495 canonical-state gate:
the full schema binds once a report carries the sph:v1 marker, the Canonical Handoff heading, or a WORKFLOW_STATE: line. Reports written
before the protocol existed are untouched.
Non-goals honored
No Issue #601 or PR #625 behavior is hard-coded (they appear in the issue as an
illustration of the gap). No project-specific acceptance criteria leak into
generic workflow prompts. No capability, role, or controller gate is bypassed.
The foundational schema/docs work closed under #494–#507 is not reopened.
handoff requirement wired into each final-report schema
Validation
Focused: pytest tests/test_self_propagating_handoff.py -q → 53 passed.
Coverage includes author→reviewer, reviewer→merger, merger→controller,
controller→author, stale-head rejection, blocked infrastructure path, final
successful closure, incomplete-handoff rejection, and duplicate
workflow-failure issue handling.
Full suite on this branch: 4009 passed, 12 failed, 6 skipped, 493 subtests
passed (672s).
Baseline: all 12 failures reproduce identically on a clean checkout at the
exact base SHA 1d11cbab0fdc529859bdace2bd01e20da22ff449
(worktree branches/baseline-master-issue-626, 12 failed / 28 passed). They
are pre-existing on master and are not caused by this branch: tests/test_commit_payloads.py (6), tests/test_issue_702_review_findings_f1_f6.py (2), tests/test_mcp_server.py::TestPreflightVerification::test_declared_clean_task_worktree_ignores_control_checkout_violation, tests/test_post_merge_moot_lease.py::TestAcquireToolRefusesMergedPR::test_acquire_tool_fails_closed_on_merged_pr_without_posting, tests/test_reconciler_supersession_close.py::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue, tests/test_webui_ci_gate.py::TestCiRunnerScript::test_test_webui_smoke.
git diff --check 1d11cbab b2977a35 → clean.
Publication provenance
The implementation was committed locally as b2977a35 by an earlier author
session that exited before publishing. This fire recovered ownership through
canonical dead-session recovery (recovery_mode: unpublished_claim, recovered: true, prior pid 2100 dead, ancestry proven against recorded base 1d11cbab) and published through native MCP gitea_commit_files as ddc9b97d401a3102f4088abc27cbe1be1795f3a0. The published tree 4df467f5746be4f6c86a9d229250b7eefd5354d0 is byte-identical to the local
commit's tree, and the published parent is 1d11cbab.
Reviewer notes
Author profile prgs-author / jcwalker3. This PR needs an independent
reviewer; the author neither reviews nor merges it.
Closes #626
## Summary
#494–#507 defined the ledger, the canonical state comments, and the Canonical
Thread Handoff shape. None of them enforce the **chain**: that every actor
consumes exactly one canonical handoff, performs exactly one authorized role,
records the result durably in Gitea, and emits the next complete handoff until
the controller records final closure. This PR owns that systemic enforcement gap.
New module `self_propagating_handoff.py` (pure assessment — no network calls,
no mutation), wired into `final_report_validator.py` as rule
`shared.self_propagating_handoff`, plus the canonical schema document
`skills/llm-project-workflow/schemas/self-propagating-handoff.md`.
## What it enforces
1. **Canonical handoff contract** — 19 required fields (`REPOSITORY`, `ISSUE`,
`PR`, `WORKFLOW_STATE`, `HEAD_SHA`, `BASE_BRANCH`, `BASE_OR_MERGE_SHA`,
`ACTING_ROLE`, `ACTING_IDENTITY`, `COMPLETED_ACTIONS`, `VALIDATION_EVIDENCE`,
`MUTATION_LEDGER`, `BLOCKERS`, `NEXT_ACTOR`, `NEXT_ACTION`,
`PROHIBITED_ACTIONS`, `NEXT_PROMPT`, `WORKFLOW_FAILURE_ISSUES`,
`LAST_UPDATED`). Only a named subset may carry `none`, and `PR`/`HEAD_SHA`
only in `needs-author` or `blocked`.
2. **Live-state recovery** — `assess_handoff_live_state` fails closed on all
fourteen detection kinds: `changed_pr_head`, `stale_approval`,
`issue_closed`, `issue_reopened`, `pr_merged`, `pr_closed_unmerged`,
`stale_lease`, `foreign_lease`, `missing_worktree`, `dirty_worktree`,
`namespace_mismatch`, `stale_runtime`, `changed_base`,
`conflicting_canonical_comments`. A changed head invalidates an inherited
review or merge handoff and recovers the chain to `needs-review`.
3. **Role-limited continuation** — `assess_role_continuation` permits only the
actions the declared `WORKFLOW_STATE` authorizes for the receiving role.
4. **Mandatory durable state update** — `assess_durable_state_update` rejects a
chat-only report; the canonical state must reach the Gitea thread.
5. **Mandatory next handoff** — a non-terminal handoff requires a concrete
`NEXT_ACTION` and a ready-to-run `NEXT_PROMPT` that names the repository and
issue and does not lean on outside chat history.
6. **Controller completion boundary** — `assess_merge_completion_transition`
moves a merged PR to `merged-awaiting-controller`, not to accepted work.
`assess_controller_decision` honors `accept` only with all four closure
proofs recorded, and routes `request_tests` / `request_proof` /
`request_corrections` / `reopen` / `return_to_actor`.
7. **Workflow-failure escalation** — `assess_workflow_failure_escalation`
requires `classification`, `linked_issue`, `temporary_impact`,
`next_valid_actor`, and `recovery_prompt` per distinct defect, reuses an
existing durable issue for a known signature instead of filing a duplicate,
and keeps tooling defects out of the active feature issue.
8. **Validation before posting** — incomplete handoffs are rejected with
actionable reasons and a `safe_next_action`.
9. **Final-report integration** — the rule is registered for `review_pr`,
`merge_pr`, `reconcile_already_landed`, `author_issue`, `work_issue`,
`issue_filing`, `inventory`, `issue_selection`, and `controller_close`, so
the handoff is not an optional prose section.
Terminal `complete` must carry no `NEXT_ACTION` and no `NEXT_PROMPT`: a
finished workflow terminates instead of manufacturing more work.
## Applicability gating
Enforcement is applicability-gated exactly like the #495 canonical-state gate:
the full schema binds once a report carries the `sph:v1` marker, the
`Canonical Handoff` heading, or a `WORKFLOW_STATE:` line. Reports written
before the protocol existed are untouched.
## Non-goals honored
No Issue #601 or PR #625 behavior is hard-coded (they appear in the issue as an
illustration of the gap). No project-specific acceptance criteria leak into
generic workflow prompts. No capability, role, or controller gate is bypassed.
The foundational schema/docs work closed under #494–#507 is not reopened.
## Files changed
| File | Change |
| --- | --- |
| `self_propagating_handoff.py` | new — 907 lines, the protocol and its assessors |
| `tests/test_self_propagating_handoff.py` | new — 613 lines, 53 tests |
| `skills/llm-project-workflow/schemas/self-propagating-handoff.md` | new — canonical schema doc |
| `final_report_validator.py` | rule `shared.self_propagating_handoff` registered across nine task kinds |
| `skills/llm-project-workflow/SKILL.md` | protocol documented |
| `skills/llm-project-workflow/schemas/{create-issue,pr-queue-cleanup,reconcile-landed,review-merge,work-issue}-final-report.md` | handoff requirement wired into each final-report schema |
## Validation
- Focused: `pytest tests/test_self_propagating_handoff.py -q` → **53 passed**.
Coverage includes author→reviewer, reviewer→merger, merger→controller,
controller→author, stale-head rejection, blocked infrastructure path, final
successful closure, incomplete-handoff rejection, and duplicate
workflow-failure issue handling.
- Full suite on this branch: **4009 passed, 12 failed, 6 skipped, 493 subtests
passed** (672s).
- Baseline: all 12 failures reproduce identically on a clean checkout at the
exact base SHA `1d11cbab0fdc529859bdace2bd01e20da22ff449`
(worktree `branches/baseline-master-issue-626`, 12 failed / 28 passed). They
are pre-existing on master and are not caused by this branch:
`tests/test_commit_payloads.py` (6),
`tests/test_issue_702_review_findings_f1_f6.py` (2),
`tests/test_mcp_server.py::TestPreflightVerification::test_declared_clean_task_worktree_ignores_control_checkout_violation`,
`tests/test_post_merge_moot_lease.py::TestAcquireToolRefusesMergedPR::test_acquire_tool_fails_closed_on_merged_pr_without_posting`,
`tests/test_reconciler_supersession_close.py::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue`,
`tests/test_webui_ci_gate.py::TestCiRunnerScript::test_test_webui_smoke`.
- `git diff --check 1d11cbab b2977a35` → clean.
## Publication provenance
The implementation was committed locally as `b2977a35` by an earlier author
session that exited before publishing. This fire recovered ownership through
canonical dead-session recovery (`recovery_mode: unpublished_claim`,
`recovered: true`, prior pid 2100 dead, ancestry proven against recorded base
`1d11cbab`) and published through native MCP `gitea_commit_files` as
`ddc9b97d401a3102f4088abc27cbe1be1795f3a0`. The published tree
`4df467f5746be4f6c86a9d229250b7eefd5354d0` is byte-identical to the local
commit's tree, and the published parent is `1d11cbab`.
## Reviewer notes
Author profile `prgs-author` / `jcwalker3`. This PR needs an independent
reviewer; the author neither reviews nor merges it.
Adds the canonical cross-role handoff schema and its fail-closed validator,
live-state recovery, role-limited continuation, mandatory durable posting,
the merged-awaiting-controller boundary, controller accept/reject
continuation, and workflow-failure escalation with duplicate handling.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
No correctness, security, regression, or workflow-compliance defects that block merge.
Issue #626 acceptance areas are implemented in pure assessment module self_propagating_handoff.py (907 lines), wired as shared.self_propagating_handoff across nine final-report task kinds, with schema skills/llm-project-workflow/schemas/self-propagating-handoff.md and 53 focused tests covering author→reviewer, reviewer→merger, merger→controller, controller→author, stale-head, blocked path, final closure, incomplete rejection, and failure-escalation dedupe.
Applicability gating matches #495. No hard-coded #601/#625. Published tree 4df467f matches local b2977a35.
STATE: approved
WHO_IS_NEXT: merger
NEXT_ACTION: Verify approval still applies to live head ddc9b97d40, then merge PR #779 through sanctioned merger workflow only
NEXT_PROMPT:
Act as merger for Scaled-Tech-Consulting/Gitea-Tools on remote prgs. Merge PR #779 which closes issue #626 (self-propagating canonical handoffs). Use a merger profile/namespace whose identity is not jcwalker3. Load the canonical merge workflow, verify runtime/master parity and namespace health, confirm live PR head is still ddc9b97d401a3102f4088abc27cbe1be1795f3a0 and that sysadmin APPROVE is current-head-valid and non-stale, adopt the reviewer lease or acquire a merger lease as required, then merge only through gitea_merge_pr with expected_head_sha pinned. After merge, leave the handoff at merged-awaiting-controller. Everything needed is in issue #626, PR #779, workflow docs, and live repository state.
WHAT_HAPPENED: Independent reviewer sysadmin approved PR #779 at exact head ddc9b97 after full suite and baseline verification
WHY: Implementation matches issue #626 acceptance criteria; focused and full validation pass aside from 11 pre-existing master failures; no blocking review findings
ISSUE: #626
BASE: master
HEAD: feat/issue-626-self-propagating-handoffs
HEAD_SHA: ddc9b97d40
REVIEW_STATUS: approved / approval_at_current_head by sysadmin via native MCP gitea_submit_pr_review
MERGE_READY: true if live head remains ddc9b97d40 and merger re-verifies approval_at_current_head
BLOCKERS: none
VALIDATION: focused 53 passed; full suite 4010 passed / 11 failed identical on master 1d11cbab; git diff --check clean
NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; namespace=gitea-reviewer; profile=prgs-reviewer; identity=sysadmin; tool=gitea_submit_pr_review; head=ddc9b97d401a3102f4088abc27cbe1be1795f3a0; lease_session=34450-27cb9909e8c3
LAST_UPDATED_BY: sysadmin / prgs-reviewer / 2026-07-21
Canonical Handoff
REPOSITORY: Scaled-Tech-Consulting/Gitea-Tools
ISSUE: 626
PR: 779
WORKFLOW_STATE: approved-awaiting-merge
HEAD_SHA: ddc9b97d401a3102f4088abc27cbe1be1795f3a0
BASE_BRANCH: master
BASE_OR_MERGE_SHA: 1d11cbab0fdc529859bdace2bd01e20da22ff449
ACTING_ROLE: reviewer
ACTING_IDENTITY: sysadmin (prgs-reviewer)
COMPLETED_ACTIONS: independent native review of PR #779 at pinned head; full and focused pytest; baseline comparison; APPROVE via gitea_submit_pr_review
VALIDATION_EVIDENCE: focused 53 passed; full suite 4010 passed / 11 failed / 6 skipped / 493 subtests; 11 failures identical on master 1d11cbab; git diff --check clean
MUTATION_LEDGER: reviewer lease 34450-27cb9909e8c3; formal APPROVE at head ddc9b97; no source edits
BLOCKERS: none
NEXT_ACTOR: merger
NEXT_ACTION: Verify approval still applies to live head ddc9b97, adopt or acquire merger lease, merge PR #779; do not auto-accept as complete
PROHIBITED_ACTIONS: author self-merge; force-push/rebase; treating the 11 master baseline failures as branch regressions; skipping approval-at-current-head recheck
NEXT_PROMPT: Act as merger for Scaled-Tech-Consulting/Gitea-Tools on remote prgs. Merge PR #779 which closes issue #626. Use a merger profile whose identity is not jcwalker3. Load the canonical merge workflow, verify parity and namespace health, confirm live head is still ddc9b97d401a3102f4088abc27cbe1be1795f3a0 with current-head-valid sysadmin APPROVE, then merge only through gitea_merge_pr with expected_head_sha pinned. After merge leave merged-awaiting-controller. Everything needed is in issue #626, PR #779, workflow docs, and live repository state.
WORKFLOW_FAILURE_ISSUES: none
LAST_UPDATED: 2026-07-21T17:39:00Z
## Independent review: APPROVE
**Reviewer:** sysadmin / prgs-reviewer (not author jcwalker3)
**Reviewed head:** ddc9b97d401a3102f4088abc27cbe1be1795f3a0
**Base:** 1d11cbab0fdc529859bdace2bd01e20da22ff449
**Worktree:** /Users/jasonwalker/Development/Gitea-Tools/branches/review-418 (clean)
**Lease session:** 34450-27cb9909e8c3
### Findings
No correctness, security, regression, or workflow-compliance defects that block merge.
Issue #626 acceptance areas are implemented in pure assessment module `self_propagating_handoff.py` (907 lines), wired as `shared.self_propagating_handoff` across nine final-report task kinds, with schema `skills/llm-project-workflow/schemas/self-propagating-handoff.md` and 53 focused tests covering author→reviewer, reviewer→merger, merger→controller, controller→author, stale-head, blocked path, final closure, incomplete rejection, and failure-escalation dedupe.
Applicability gating matches #495. No hard-coded #601/#625. Published tree 4df467f matches local b2977a35.
### Validation
- pytest tests/test_self_propagating_handoff.py -q: 53 passed
- pytest tests/ -q: 4010 passed, 11 failed, 6 skipped, 493 subtests (94s)
- git diff --check: clean
### Baseline failures (independently verified)
11 failures identical on PR head and clean master 1d11cbab:
- tests/test_commit_payloads.py (6)
- tests/test_issue_702_review_findings_f1_f6.py (2)
- test_mcp_server PreflightVerification declared_clean_task_worktree (1)
- test_post_merge_moot_lease AcquireToolRefusesMergedPR (1)
- test_reconciler_supersession_close tool_posts_comment (1)
webui smoke passed on both; not currently a baseline failure.
### Workflow-load helper result
workflow_source: skills/llm-project-workflow/workflows/review-merge-pr.md
workflow_hash: 263d0a6cb8a6
final_report_schema_hash: a7634e7b8689
boundary_status: clean
## Canonical PR State
STATE: approved
WHO_IS_NEXT: merger
NEXT_ACTION: Verify approval still applies to live head ddc9b97d401a3102f4088abc27cbe1be1795f3a0, then merge PR #779 through sanctioned merger workflow only
NEXT_PROMPT:
```text
Act as merger for Scaled-Tech-Consulting/Gitea-Tools on remote prgs. Merge PR #779 which closes issue #626 (self-propagating canonical handoffs). Use a merger profile/namespace whose identity is not jcwalker3. Load the canonical merge workflow, verify runtime/master parity and namespace health, confirm live PR head is still ddc9b97d401a3102f4088abc27cbe1be1795f3a0 and that sysadmin APPROVE is current-head-valid and non-stale, adopt the reviewer lease or acquire a merger lease as required, then merge only through gitea_merge_pr with expected_head_sha pinned. After merge, leave the handoff at merged-awaiting-controller. Everything needed is in issue #626, PR #779, workflow docs, and live repository state.
```
WHAT_HAPPENED: Independent reviewer sysadmin approved PR #779 at exact head ddc9b97 after full suite and baseline verification
WHY: Implementation matches issue #626 acceptance criteria; focused and full validation pass aside from 11 pre-existing master failures; no blocking review findings
ISSUE: #626
BASE: master
HEAD: feat/issue-626-self-propagating-handoffs
HEAD_SHA: ddc9b97d401a3102f4088abc27cbe1be1795f3a0
REVIEW_STATUS: approved / approval_at_current_head by sysadmin via native MCP gitea_submit_pr_review
MERGE_READY: true if live head remains ddc9b97d401a3102f4088abc27cbe1be1795f3a0 and merger re-verifies approval_at_current_head
BLOCKERS: none
VALIDATION: focused 53 passed; full suite 4010 passed / 11 failed identical on master 1d11cbab; git diff --check clean
NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; namespace=gitea-reviewer; profile=prgs-reviewer; identity=sysadmin; tool=gitea_submit_pr_review; head=ddc9b97d401a3102f4088abc27cbe1be1795f3a0; lease_session=34450-27cb9909e8c3
LAST_UPDATED_BY: sysadmin / prgs-reviewer / 2026-07-21
<!-- sph:v1 -->
## Canonical Handoff
```text
REPOSITORY: Scaled-Tech-Consulting/Gitea-Tools
ISSUE: 626
PR: 779
WORKFLOW_STATE: approved-awaiting-merge
HEAD_SHA: ddc9b97d401a3102f4088abc27cbe1be1795f3a0
BASE_BRANCH: master
BASE_OR_MERGE_SHA: 1d11cbab0fdc529859bdace2bd01e20da22ff449
ACTING_ROLE: reviewer
ACTING_IDENTITY: sysadmin (prgs-reviewer)
COMPLETED_ACTIONS: independent native review of PR #779 at pinned head; full and focused pytest; baseline comparison; APPROVE via gitea_submit_pr_review
VALIDATION_EVIDENCE: focused 53 passed; full suite 4010 passed / 11 failed / 6 skipped / 493 subtests; 11 failures identical on master 1d11cbab; git diff --check clean
MUTATION_LEDGER: reviewer lease 34450-27cb9909e8c3; formal APPROVE at head ddc9b97; no source edits
BLOCKERS: none
NEXT_ACTOR: merger
NEXT_ACTION: Verify approval still applies to live head ddc9b97, adopt or acquire merger lease, merge PR #779; do not auto-accept as complete
PROHIBITED_ACTIONS: author self-merge; force-push/rebase; treating the 11 master baseline failures as branch regressions; skipping approval-at-current-head recheck
NEXT_PROMPT: Act as merger for Scaled-Tech-Consulting/Gitea-Tools on remote prgs. Merge PR #779 which closes issue #626. Use a merger profile whose identity is not jcwalker3. Load the canonical merge workflow, verify parity and namespace health, confirm live head is still ddc9b97d401a3102f4088abc27cbe1be1795f3a0 with current-head-valid sysadmin APPROVE, then merge only through gitea_merge_pr with expected_head_sha pinned. After merge leave merged-awaiting-controller. Everything needed is in issue #626, PR #779, workflow docs, and live repository state.
WORKFLOW_FAILURE_ISSUES: none
LAST_UPDATED: 2026-07-21T17:39:00Z
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sysadmin
Closes #626
Summary
#494–#507 defined the ledger, the canonical state comments, and the Canonical
Thread Handoff shape. None of them enforce the chain: that every actor
consumes exactly one canonical handoff, performs exactly one authorized role,
records the result durably in Gitea, and emits the next complete handoff until
the controller records final closure. This PR owns that systemic enforcement gap.
New module
self_propagating_handoff.py(pure assessment — no network calls,no mutation), wired into
final_report_validator.pyas ruleshared.self_propagating_handoff, plus the canonical schema documentskills/llm-project-workflow/schemas/self-propagating-handoff.md.What it enforces
REPOSITORY,ISSUE,PR,WORKFLOW_STATE,HEAD_SHA,BASE_BRANCH,BASE_OR_MERGE_SHA,ACTING_ROLE,ACTING_IDENTITY,COMPLETED_ACTIONS,VALIDATION_EVIDENCE,MUTATION_LEDGER,BLOCKERS,NEXT_ACTOR,NEXT_ACTION,PROHIBITED_ACTIONS,NEXT_PROMPT,WORKFLOW_FAILURE_ISSUES,LAST_UPDATED). Only a named subset may carrynone, andPR/HEAD_SHAonly in
needs-authororblocked.assess_handoff_live_statefails closed on allfourteen detection kinds:
changed_pr_head,stale_approval,issue_closed,issue_reopened,pr_merged,pr_closed_unmerged,stale_lease,foreign_lease,missing_worktree,dirty_worktree,namespace_mismatch,stale_runtime,changed_base,conflicting_canonical_comments. A changed head invalidates an inheritedreview or merge handoff and recovers the chain to
needs-review.assess_role_continuationpermits only theactions the declared
WORKFLOW_STATEauthorizes for the receiving role.assess_durable_state_updaterejects achat-only report; the canonical state must reach the Gitea thread.
NEXT_ACTIONand a ready-to-runNEXT_PROMPTthat names the repository andissue and does not lean on outside chat history.
assess_merge_completion_transitionmoves a merged PR to
merged-awaiting-controller, not to accepted work.assess_controller_decisionhonorsacceptonly with all four closureproofs recorded, and routes
request_tests/request_proof/request_corrections/reopen/return_to_actor.assess_workflow_failure_escalationrequires
classification,linked_issue,temporary_impact,next_valid_actor, andrecovery_promptper distinct defect, reuses anexisting durable issue for a known signature instead of filing a duplicate,
and keeps tooling defects out of the active feature issue.
actionable reasons and a
safe_next_action.review_pr,merge_pr,reconcile_already_landed,author_issue,work_issue,issue_filing,inventory,issue_selection, andcontroller_close, sothe handoff is not an optional prose section.
Terminal
completemust carry noNEXT_ACTIONand noNEXT_PROMPT: afinished workflow terminates instead of manufacturing more work.
Applicability gating
Enforcement is applicability-gated exactly like the #495 canonical-state gate:
the full schema binds once a report carries the
sph:v1marker, theCanonical Handoffheading, or aWORKFLOW_STATE:line. Reports writtenbefore the protocol existed are untouched.
Non-goals honored
No Issue #601 or PR #625 behavior is hard-coded (they appear in the issue as an
illustration of the gap). No project-specific acceptance criteria leak into
generic workflow prompts. No capability, role, or controller gate is bypassed.
The foundational schema/docs work closed under #494–#507 is not reopened.
Files changed
self_propagating_handoff.pytests/test_self_propagating_handoff.pyskills/llm-project-workflow/schemas/self-propagating-handoff.mdfinal_report_validator.pyshared.self_propagating_handoffregistered across nine task kindsskills/llm-project-workflow/SKILL.mdskills/llm-project-workflow/schemas/{create-issue,pr-queue-cleanup,reconcile-landed,review-merge,work-issue}-final-report.mdValidation
pytest tests/test_self_propagating_handoff.py -q→ 53 passed.Coverage includes author→reviewer, reviewer→merger, merger→controller,
controller→author, stale-head rejection, blocked infrastructure path, final
successful closure, incomplete-handoff rejection, and duplicate
workflow-failure issue handling.
passed (672s).
exact base SHA
1d11cbab0fdc529859bdace2bd01e20da22ff449(worktree
branches/baseline-master-issue-626, 12 failed / 28 passed). Theyare pre-existing on master and are not caused by this branch:
tests/test_commit_payloads.py(6),tests/test_issue_702_review_findings_f1_f6.py(2),tests/test_mcp_server.py::TestPreflightVerification::test_declared_clean_task_worktree_ignores_control_checkout_violation,tests/test_post_merge_moot_lease.py::TestAcquireToolRefusesMergedPR::test_acquire_tool_fails_closed_on_merged_pr_without_posting,tests/test_reconciler_supersession_close.py::TestReconcilerSupersessionMcpTool::test_tool_posts_comment_and_closes_superseded_pr_issue,tests/test_webui_ci_gate.py::TestCiRunnerScript::test_test_webui_smoke.git diff --check 1d11cbab b2977a35→ clean.Publication provenance
The implementation was committed locally as
b2977a35by an earlier authorsession that exited before publishing. This fire recovered ownership through
canonical dead-session recovery (
recovery_mode: unpublished_claim,recovered: true, prior pid 2100 dead, ancestry proven against recorded base1d11cbab) and published through native MCPgitea_commit_filesasddc9b97d401a3102f4088abc27cbe1be1795f3a0. The published tree4df467f5746be4f6c86a9d229250b7eefd5354d0is byte-identical to the localcommit's tree, and the published parent is
1d11cbab.Reviewer notes
Author profile
prgs-author/jcwalker3. This PR needs an independentreviewer; the author neither reviews nor merges it.
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #779
issue: #626
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 34450-27cb9909e8c3
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-418
phase: claimed
candidate_head:
ddc9b97d40target_branch: master
target_branch_sha:
1d11cbab0flast_activity: 2026-07-21T17:34:36Z
expires_at: 2026-07-21T17:44:36Z
blocker: none
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #779
issue: #626
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 34450-27cb9909e8c3
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-418
phase: validating
candidate_head:
ddc9b97d40target_branch: master
target_branch_sha:
1d11cbab0flast_activity: 2026-07-21T17:35:52Z
expires_at: 2026-07-21T17:45:52Z
blocker: none
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #779
issue: #626
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 34450-27cb9909e8c3
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-418
phase: reviewing
candidate_head:
ddc9b97d40target_branch: master
target_branch_sha:
1d11cbab0flast_activity: 2026-07-21T17:38:09Z
expires_at: 2026-07-21T17:48:09Z
blocker: none
Independent review: APPROVE
Reviewer: sysadmin / prgs-reviewer (not author jcwalker3)
Reviewed head:
ddc9b97d40Base:
1d11cbab0fWorktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-418 (clean)
Lease session: 34450-27cb9909e8c3
Findings
No correctness, security, regression, or workflow-compliance defects that block merge.
Issue #626 acceptance areas are implemented in pure assessment module
self_propagating_handoff.py(907 lines), wired asshared.self_propagating_handoffacross nine final-report task kinds, with schemaskills/llm-project-workflow/schemas/self-propagating-handoff.mdand 53 focused tests covering author→reviewer, reviewer→merger, merger→controller, controller→author, stale-head, blocked path, final closure, incomplete rejection, and failure-escalation dedupe.Applicability gating matches #495. No hard-coded #601/#625. Published tree
4df467fmatches local b2977a35.Validation
Baseline failures (independently verified)
11 failures identical on PR head and clean master
1d11cbab:webui smoke passed on both; not currently a baseline failure.
Workflow-load helper result
workflow_source: skills/llm-project-workflow/workflows/review-merge-pr.md
workflow_hash: 263d0a6cb8a6
final_report_schema_hash: a7634e7b8689
boundary_status: clean
Canonical PR State
STATE: approved
WHO_IS_NEXT: merger
NEXT_ACTION: Verify approval still applies to live head
ddc9b97d40, then merge PR #779 through sanctioned merger workflow onlyNEXT_PROMPT:
WHAT_HAPPENED: Independent reviewer sysadmin approved PR #779 at exact head
ddc9b97after full suite and baseline verificationWHY: Implementation matches issue #626 acceptance criteria; focused and full validation pass aside from 11 pre-existing master failures; no blocking review findings
ISSUE: #626
BASE: master
HEAD: feat/issue-626-self-propagating-handoffs
HEAD_SHA:
ddc9b97d40REVIEW_STATUS: approved / approval_at_current_head by sysadmin via native MCP gitea_submit_pr_review
MERGE_READY: true if live head remains
ddc9b97d40and merger re-verifies approval_at_current_headBLOCKERS: none
VALIDATION: focused 53 passed; full suite 4010 passed / 11 failed identical on master 1d11cbab; git diff --check clean
NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; namespace=gitea-reviewer; profile=prgs-reviewer; identity=sysadmin; tool=gitea_submit_pr_review; head=ddc9b97d401a3102f4088abc27cbe1be1795f3a0; lease_session=34450-27cb9909e8c3
LAST_UPDATED_BY: sysadmin / prgs-reviewer / 2026-07-21
Canonical Handoff
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #779
issue: #626
reviewer_identity: sysadmin
profile: prgs-merger
session_id: 52026-ab9774c6eb54
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-779-ddc9b97
phase: claimed
candidate_head:
ddc9b97d40target_branch: master
target_branch_sha:
1d11cbab0flast_activity: 2026-07-21T17:53:38Z
expires_at: 2026-07-21T18:03:38Z
blocker: none
Stale #332 review-decision lock cleanup (#594)
Status: APPLIED
sysadminprgs-merger2026-07-21T17:53:52.071404+00:00approveon PR feat: enforce self-propagating canonical handoffs through controller closure (Closes #626) (#779)closed(merged=True)df3167488c5451f802549b40463ad59cbaad61091prgs-reviewerManual deletion of session-state files is not the workflow.
This path only clears a lock when the referenced PR is merged/closed.