fix(reconciler): PR-scoped post-merge cleanup executor + expired reviewer-lease reclaim (Closes #855) #866

2026-07-23T23:54:00-05:00

jcwalker3 commented

2026-07-23 23:54:00 -05:00

Closes #855

Adds the PR-scoped post-merge cleanup path a reconciler needs to finish exactly one merged PR without a batch sweep over other PRs, plus the explicit expired-reviewer-lease reclaim the batch path never had.

PR-scoped selector

gitea_reconcile_merged_cleanups gains an optional pr_number. When set, only that merged PR is assessed and acted on:

the PR is resolved live and fails closed on an invalid/non-positive number, an unresolvable or ambiguous PR, or a not-yet-merged PR;
reviewer scratch worktrees are filtered to that PR;
the report entry set is pinned to exactly [pr_number], failing closed on any drift.

The existing execute loop then acts on the single pinned entry only — remove the safe worktree, reassess ownership, then delete the remote branch — touching no other PR. Batch behaviour is preserved when pr_number is omitted.

Expired reviewer-lease reclaim (AC4)

An expired or stale reviewer lease no longer protects an already-merged branch forever. branch_cleanup_guard.assess_expired_reviewer_lease_reclaim decides reclaim explicitly and fail-closed: only a reviewer lease, only expired/stale status, only a proven-merged PR, only a proven-dead owner process, and only when no competing active claimant uses the branch. _collect_branch_ownership_records gathers that evidence from authoritative state (live PR merged-state, lease owner liveness, and the full ownership inventory for competing-claimant detection) and evaluates it after the complete inventory is built — so the post-worktree-removal reassessment is what clears the branch delete. Any unknown fails closed. Author/merger/controller/reconciler leases are untouched; active leases, worktree bindings, issue locks, and live sessions still block.

Acceptance criteria

AC	Where
1 single merged PR target	`pr_number` selector + live resolution
2 removes only the target's safe worktrees	entry set pinned to `[pr_number]`; scratch filtered
3 ownership reassessed after worktree removal	fresh `_ownership_records_for_branch` post-removal (#852)
4 expired reviewer lease not permanent	`assess_expired_reviewer_lease_reclaim` + collector wiring
5 delete the target remote branch when safe	execute-loop remote delete, now reachable
6/7 dry-run and apply report targets + mutations	`selection_mode`, `selected_pr_number`, entries, actions
8 fail closed on dirty/live/ambiguous/parity	selector + ownership fail-closed branches
9 tests prove other worktrees/branches/leases untouched	selector + reclaim tests

Scope boundary

This is the reconciler-executor gap. The audit-side merged-PR linkage was a distinct fix and already landed as #859; this PR adds no audit change. It is additive to the batch path (unchanged) and weakens no ownership guard beyond the single, fully-gated expired-reviewer-lease reclaim.

Tests

tests/test_issue_855_expired_reviewer_reclaim.py (new): fail-closed matrix for the reclaim decision plus collector wiring — merged+dead+uncontested reclaims; not-merged, live-owner, competing-worktree, and author-lease cases stay protective.
tests/test_branch_cleanup_guard.py: exact-PR selector coverage — ignores newer PRs in the batch queue, execute mutates only the selected PR, unknown/not-merged/invalid fail closed, batch mode preserved.

Evidence, run from the registered worktree at head 24c52ab:

pytest tests/test_issue_855_expired_reviewer_reclaim.py — 16 passed, 5 subtests.
pytest tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector — 6 passed.
Changed-surface sweep (branch-cleanup guard, reconciler cleanup integration, native cleanup proof, delete-branch capability, audit-reconciliation-mode, moot-lease gate, merged-cleanup-reconcile, close-gate, already-landed) — pass, apart from two pre-existing test_branch_cleanup_guard failures and test_reconciler_supersession_close, all three reproducing identically on master 6d0015ca and untouched by this change.

Provenance

Implemented as jcwalker3 / prgs-author on Scaled-Tech-Consulting/Gitea-Tools, master parity in_parity=true mutation_safe=true at 6d0015ca. A prior blocked cycle's partial selector work-in-progress on this branch (dead session pid 18052) was adopted, fast-forwarded onto current master, validated, and completed with the missing AC4 reclaim. The dead-session issue-#855 lock was recovered through the sanctioned unpublished-claim path (recorded pid dead; branch, worktree, and claimant matched; local head strictly descends from recorded base 6d0015ca). The head was published via gitea_publish_unpublished_issue_branch with read-after-write verification. No base merge; base stays at master.

Canonical PR State

STATE: awaiting-review
WHO_IS_NEXT: reviewer
BLOCKED_ROLE: none
NEXT_ACTION: Review this PR at head 24c52ab against issue #855 acceptance criteria 1-9; verify the pr_number selector fails closed on invalid/ambiguous/not-merged and pins the entry set to the single PR, and that the expired-reviewer-lease reclaim is fully gated (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant); confirm the pre-existing baseline failures match master 6d0015ca; submit verdict; stop
NEXT_PROMPT: Review this PR for issue #855 as prgs-reviewer pinned to head 24c52ab. Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py, confirm the pre-existing baseline failures match master 6d0015ca, submit a verdict, and stop.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Closes #855 Adds the PR-scoped post-merge cleanup path a reconciler needs to finish exactly one merged PR without a batch sweep over other PRs, plus the explicit expired-reviewer-lease reclaim the batch path never had. ## PR-scoped selector `gitea_reconcile_merged_cleanups` gains an optional `pr_number`. When set, only that merged PR is assessed and acted on: - the PR is resolved live and fails closed on an invalid/non-positive number, an unresolvable or ambiguous PR, or a not-yet-merged PR; - reviewer scratch worktrees are filtered to that PR; - the report entry set is pinned to exactly `[pr_number]`, failing closed on any drift. The existing execute loop then acts on the single pinned entry only — remove the safe worktree, reassess ownership, then delete the remote branch — touching no other PR. Batch behaviour is preserved when `pr_number` is omitted. ## Expired reviewer-lease reclaim (AC4) An expired or stale reviewer lease no longer protects an already-merged branch forever. `branch_cleanup_guard.assess_expired_reviewer_lease_reclaim` decides reclaim explicitly and fail-closed: only a reviewer lease, only expired/stale status, only a proven-merged PR, only a proven-dead owner process, and only when no competing active claimant uses the branch. `_collect_branch_ownership_records` gathers that evidence from authoritative state (live PR merged-state, lease owner liveness, and the full ownership inventory for competing-claimant detection) and evaluates it after the complete inventory is built — so the post-worktree-removal reassessment is what clears the branch delete. Any unknown fails closed. Author/merger/controller/reconciler leases are untouched; active leases, worktree bindings, issue locks, and live sessions still block. ## Acceptance criteria | AC | Where | |---|---| | 1 single merged PR target | `pr_number` selector + live resolution | | 2 removes only the target's safe worktrees | entry set pinned to `[pr_number]`; scratch filtered | | 3 ownership reassessed after worktree removal | fresh `_ownership_records_for_branch` post-removal (#852) | | 4 expired reviewer lease not permanent | `assess_expired_reviewer_lease_reclaim` + collector wiring | | 5 delete the target remote branch when safe | execute-loop remote delete, now reachable | | 6/7 dry-run and apply report targets + mutations | `selection_mode`, `selected_pr_number`, entries, actions | | 8 fail closed on dirty/live/ambiguous/parity | selector + ownership fail-closed branches | | 9 tests prove other worktrees/branches/leases untouched | selector + reclaim tests | ## Scope boundary This is the reconciler-executor gap. The audit-side merged-PR linkage was a distinct fix and already landed as #859; this PR adds no audit change. It is additive to the batch path (unchanged) and weakens no ownership guard beyond the single, fully-gated expired-reviewer-lease reclaim. ## Tests - `tests/test_issue_855_expired_reviewer_reclaim.py` (new): fail-closed matrix for the reclaim decision plus collector wiring — merged+dead+uncontested reclaims; not-merged, live-owner, competing-worktree, and author-lease cases stay protective. - `tests/test_branch_cleanup_guard.py`: exact-PR selector coverage — ignores newer PRs in the batch queue, execute mutates only the selected PR, unknown/not-merged/invalid fail closed, batch mode preserved. Evidence, run from the registered worktree at head `24c52ab`: - `pytest tests/test_issue_855_expired_reviewer_reclaim.py` — 16 passed, 5 subtests. - `pytest tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector` — 6 passed. - Changed-surface sweep (branch-cleanup guard, reconciler cleanup integration, native cleanup proof, delete-branch capability, audit-reconciliation-mode, moot-lease gate, merged-cleanup-reconcile, close-gate, already-landed) — pass, apart from two pre-existing `test_branch_cleanup_guard` failures and `test_reconciler_supersession_close`, all three reproducing identically on master `6d0015ca` and untouched by this change. ## Provenance Implemented as `jcwalker3` / `prgs-author` on `Scaled-Tech-Consulting/Gitea-Tools`, master parity `in_parity=true` `mutation_safe=true` at `6d0015ca`. A prior blocked cycle's partial selector work-in-progress on this branch (dead session pid 18052) was adopted, fast-forwarded onto current master, validated, and completed with the missing AC4 reclaim. The dead-session issue-#855 lock was recovered through the sanctioned unpublished-claim path (recorded pid dead; branch, worktree, and claimant matched; local head strictly descends from recorded base `6d0015ca`). The head was published via `gitea_publish_unpublished_issue_branch` with read-after-write verification. No base merge; base stays at master. ## Canonical PR State STATE: awaiting-review WHO_IS_NEXT: reviewer BLOCKED_ROLE: none NEXT_ACTION: Review this PR at head 24c52ab against issue #855 acceptance criteria 1-9; verify the pr_number selector fails closed on invalid/ambiguous/not-merged and pins the entry set to the single PR, and that the expired-reviewer-lease reclaim is fully gated (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant); confirm the pre-existing baseline failures match master 6d0015ca; submit verdict; stop NEXT_PROMPT: Review this PR for issue #855 as prgs-reviewer pinned to head 24c52ab. Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py, confirm the pre-existing baseline failures match master 6d0015ca, submit a verdict, and stop. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

jcwalker3 added 1 commit 2026-07-23 23:54:00 -05:00

feat(reconciler): PR-scoped post-merge cleanup executor + expired reviewer-lease reclaim (Closes #855 ) 24c52abf6b

Adds a single-target path for post-merge cleanup so a reconciler can
complete one merged PR without a batch sweep across unrelated PRs.

## PR-scoped selector

gitea_reconcile_merged_cleanups gains an optional pr_number. When set,
only that merged PR is assessed and acted on: the PR is resolved live and
fails closed on an invalid/non-positive number, an unresolvable or
ambiguous PR, or an unmerged PR; reviewer scratch worktrees are filtered
to that PR; and the report's entry set is pinned to exactly [pr_number],
failing closed on any drift. The existing execute loop then operates on
the single pinned entry only -- worktree removal, ownership reassessment,
then remote-branch delete -- with no unrelated target. Batch behaviour is
unchanged when pr_number is omitted.

## Expired reviewer-lease reclaim (AC4)

An expired or stale reviewer lease no longer protects an already-merged
branch forever. branch_cleanup_guard.assess_expired_reviewer_lease_reclaim
makes the decision explicitly and fail-closed: reclaim only when the lease
is a reviewer lease, its status is expired/stale, the PR is proven merged,
the owner process is proven dead, and no competing active claimant uses
the branch. _collect_branch_ownership_records supplies that evidence from
authoritative state (live PR merged-state, lease owner liveness, and the
full ownership inventory for competing-claimant detection) and evaluates
it only after the complete inventory is built, so the post-worktree-removal
reassessment is what unblocks the branch delete. Any unknown fails closed.

Author/merger/controller/reconciler leases are untouched; active leases,
worktree bindings, issue locks, and live sessions still block.

## Tests

- tests/test_issue_855_expired_reviewer_reclaim.py: full fail-closed matrix
  for the reclaim decision plus collector wiring (merged+dead+uncontested
  reclaims; unmerged, live-owner, competing-worktree, and author-lease
  cases stay protective).
- tests/test_branch_cleanup_guard.py: exact-PR selector coverage (ignores
  newer PRs in the batch queue, execute mutates only the selected PR,
  unknown/not-merged/invalid fail closed, batch mode preserved).

Changed-surface suites pass; the 2 pre-existing test_branch_cleanup_guard
failures and test_reconciler_supersession_close reproduce identically on
master 6d0015ca and are unrelated to this change.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

sysadmin commented

2026-07-24 00:12:12 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #866
issue: #855
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 26133-df7e376b1b5c
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866
phase: claimed
candidate_head: 24c52abf6b
target_branch: master
target_branch_sha: ef14622ba0
last_activity: 2026-07-24T05:12:11Z
expires_at: 2026-07-24T05:22:11Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #866 issue: #855 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 26133-df7e376b1b5c worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866 phase: claimed candidate_head: 24c52abf6b80e7ed562294371eee9fe8620b686e target_branch: master target_branch_sha: ef14622ba0badd0cd7d654c05af13aca7d81bc05 last_activity: 2026-07-24T05:12:11Z expires_at: 2026-07-24T05:22:11Z blocker: none

sysadmin approved these changes 2026-07-24 00:15:47 -05:00

Dismissed

sysadmin left a comment

Canonical PR State

STATE: reviewed-approved
WHO_IS_NEXT: merger
NEXT_ACTION: Route PR #866 to a fresh gitea-merger pinned to head 24c52abf6b. Merger syncs base (2 behind; branch protection requires current base), obtains a fresh reviewer approval at the resulting head, then merges. No cleanup here — defer branch/worktree reclaim to reconciler.
NEXT_PROMPT:

Merge PR #866 for issue #855 as prgs-merger. Head 24c52abf6b80e7ed562294371eee9fe8620b686e is reviewer-APPROVED (sysadmin/prgs-reviewer) but head-scoped and 2 commits behind master; run update_pr_branch_by_merge to current master, require a fresh reviewer approval at the resulting head, then merge. Do not clean the PR #818/#638 reproduction fixture (branches/issue-638-webui-app-shell-phase1, branches/review-pr-818).

WHAT_HAPPENED: Independent security-focused review of the full production diff (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11) plus tests. Verified all 9 acceptance criteria; reproduced the reclaim-guard fail-closed matrix and the PR-scoped selector; independently ran the focused tests (16 pass + 5 subtests reclaim; 6/6 selector) and a 214-pass neighbour sweep; reproduced all claimed baseline failures identically on clean master ef14622.
WHY: assess_expired_reviewer_lease_reclaim is strictly fail-closed (reclaim only when role==reviewer AND status in {expired,stale} AND pr_merged is True AND owner_pid_alive is False AND competing_active_claimant is False; any None/contrary keeps the lease protective — TTL alone never authorizes). Collector wiring supplies pr_number/auth/base_api on BOTH real call sites (cleanup_merged_pr_branch ~L10586, execute-loop _ownership_records_for_branch ~L11463), not only in tests; the reclaim pass runs after the complete ownership inventory so competing claimants cannot be missed by iteration order. Selector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to [pr_number]; worktree removal precedes remote delete with fresh post-removal ownership reassessment and read-after-write delete verification; batch behaviour and role authority (reconciler-gated execution) preserved. Zero PR-introduced regressions.
ISSUE: 855
HEAD_SHA: 24c52abf6b
REVIEW_STATUS: APPROVE
MERGE_READY: no — approval is head-scoped; PR is 2 commits behind master and branch protection requires a current base, so a base sync + fresh review at the new head are required before merge.
BLOCKERS: none blocking approval of the reviewed head. Merge-time prerequisite: update_pr_branch_by_merge + fresh review after sync.
VALIDATION: tests/test_issue_855_expired_reviewer_reclaim.py 16 passed + 5 subtests @ 24c52ab; tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector 6 passed @ 24c52ab; neighbour sweep 214 passed @ 24c52ab; baseline failures test_authorized_cleanup_deletes_through_api_path, test_active_author_ownership_blocks_before_delete, test_reconciler_supersession_close reproduced identically on clean master ef14622 (pre-existing, not regressions); one moot-lease test failure is environment-dependent (branches/merge-pr487 layout) and also fails identically on master.
NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review APPROVE mutation by sysadmin / prgs-reviewer at head 24c52abf6b (reviewer session 26133-df7e376b1b5c, reviewer-lease comment 15387, workflow_hash 263d0a6cb8a6). Not a hand-authored approval claim.
LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)

Co-Authored-By: Claude Opus 4.8 (1M context) [email protected]

## Canonical PR State STATE: reviewed-approved WHO_IS_NEXT: merger NEXT_ACTION: Route PR #866 to a fresh gitea-merger pinned to head 24c52abf6b80e7ed562294371eee9fe8620b686e. Merger syncs base (2 behind; branch protection requires current base), obtains a fresh reviewer approval at the resulting head, then merges. No cleanup here — defer branch/worktree reclaim to reconciler. NEXT_PROMPT: ```text Merge PR #866 for issue #855 as prgs-merger. Head 24c52abf6b80e7ed562294371eee9fe8620b686e is reviewer-APPROVED (sysadmin/prgs-reviewer) but head-scoped and 2 commits behind master; run update_pr_branch_by_merge to current master, require a fresh reviewer approval at the resulting head, then merge. Do not clean the PR #818/#638 reproduction fixture (branches/issue-638-webui-app-shell-phase1, branches/review-pr-818). ``` WHAT_HAPPENED: Independent security-focused review of the full production diff (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11) plus tests. Verified all 9 acceptance criteria; reproduced the reclaim-guard fail-closed matrix and the PR-scoped selector; independently ran the focused tests (16 pass + 5 subtests reclaim; 6/6 selector) and a 214-pass neighbour sweep; reproduced all claimed baseline failures identically on clean master ef14622. WHY: assess_expired_reviewer_lease_reclaim is strictly fail-closed (reclaim only when role==reviewer AND status in {expired,stale} AND pr_merged is True AND owner_pid_alive is False AND competing_active_claimant is False; any None/contrary keeps the lease protective — TTL alone never authorizes). Collector wiring supplies pr_number/auth/base_api on BOTH real call sites (cleanup_merged_pr_branch ~L10586, execute-loop _ownership_records_for_branch ~L11463), not only in tests; the reclaim pass runs after the complete ownership inventory so competing claimants cannot be missed by iteration order. Selector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to [pr_number]; worktree removal precedes remote delete with fresh post-removal ownership reassessment and read-after-write delete verification; batch behaviour and role authority (reconciler-gated execution) preserved. Zero PR-introduced regressions. ISSUE: 855 HEAD_SHA: 24c52abf6b80e7ed562294371eee9fe8620b686e REVIEW_STATUS: APPROVE MERGE_READY: no — approval is head-scoped; PR is 2 commits behind master and branch protection requires a current base, so a base sync + fresh review at the new head are required before merge. BLOCKERS: none blocking approval of the reviewed head. Merge-time prerequisite: update_pr_branch_by_merge + fresh review after sync. VALIDATION: tests/test_issue_855_expired_reviewer_reclaim.py 16 passed + 5 subtests @ 24c52ab; tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector 6 passed @ 24c52ab; neighbour sweep 214 passed @ 24c52ab; baseline failures test_authorized_cleanup_deletes_through_api_path, test_active_author_ownership_blocks_before_delete, test_reconciler_supersession_close reproduced identically on clean master ef14622 (pre-existing, not regressions); one moot-lease test failure is environment-dependent (branches/merge-pr487 layout) and also fails identically on master. NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review APPROVE mutation by sysadmin / prgs-reviewer at head 24c52abf6b80e7ed562294371eee9fe8620b686e (reviewer session 26133-df7e376b1b5c, reviewer-lease comment 15387, workflow_hash 263d0a6cb8a6). Not a hand-authored approval claim. LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer) Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

sysadmin commented

2026-07-24 00:16:16 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #866
issue: #855
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 26133-df7e376b1b5c
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866
phase: released
candidate_head: 24c52abf6b
target_branch: master
target_branch_sha: ef14622ba0
last_activity: 2026-07-24T05:16:15Z
expires_at: 2026-07-24T05:26:15Z
blocker: manual-release

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #866 issue: #855 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 26133-df7e376b1b5c worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866 phase: released candidate_head: 24c52abf6b80e7ed562294371eee9fe8620b686e target_branch: master target_branch_sha: ef14622ba0badd0cd7d654c05af13aca7d81bc05 last_activity: 2026-07-24T05:16:15Z expires_at: 2026-07-24T05:26:15Z blocker: manual-release

jcwalker3 added 1 commit 2026-07-24 00:25:44 -05:00

Merge branch 'master' into fix/issue-855-pr-scoped-merged-cleanup 499b87c482

jcwalker3 commented

2026-07-24 00:27:28 -05:00

Canonical Issue State

STATE: awaiting-review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Perform a fresh independent review of PR #866 at head 499b87c48218cf03a3b1f34a5d8a17549d820564 against issue #855 acceptance criteria 1-9. Do NOT reuse review #534 (invalid at the new head). Verify the pr_number selector fail-closed behavior (invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the fully-gated expired-reviewer-lease reclaim (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant; evaluated after full ownership inventory). Run the two focused suites, confirm baseline failures match master ef14622, submit a verdict, and stop.
NEXT_PROMPT:

Review PR #866 for issue #855 as prgs-reviewer pinned to head 499b87c48218cf03a3b1f34a5d8a17549d820564. Former-head approval #534 is INVALID at this head — do not reuse it. Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector, confirm the pre-existing baseline failures match master ef14622, submit a verdict, and stop.

WHAT_HAPPENED: Author base-sync only. Branch fix/issue-855-pr-scoped-merged-cleanup was synced to current master via the sanctioned author gitea_update_pr_branch_by_merge path (style=merge; no rebase, no force-push). Former PR head 24c52abf6b80e7ed562294371eee9fe8620b686e -> new PR head 499b87c48218cf03a3b1f34a5d8a17549d820564; base master merged at ef14622ba0badd0cd7d654c05af13aca7d81bc05. Change scope is the base-merge commit only — no production file edits beyond the merge. Review #534 (APPROVED @ 24c52ab) is invalidated by the head change; reviewer/merger leases and any prepared verdict scoped to the former head are superseded.
WHY: PR #866 was approved at head 24c52ab but branch protection requires the PR branch to contain the current base, and the branch was 2 commits behind protected master (ef14622). Gitea could merge base in without conflicts, so the sanctioned author update-by-merge was the required operation to make it merge-eligible; a new head necessarily invalidates the prior approval and requires fresh independent review.
RELATED_PRS: #865 (merged @ ef14622, advanced base); #859 (merged; audit-side merged-PR linkage — distinct, already landed); #818/#638 (retained reproduction fixtures, untouched).
BLOCKERS: none. commits_behind=0, mergeable=true, has_conflicts=false, PR open, mutation_safe=true, in_parity=true. No foreign live lock/lease. Only gate for merge now is the required fresh review at the new head.
VALIDATION: gitea_update_pr_branch_by_merge -> success, performed=true, style=merge, force_push=false, rebase=false. Post-sync gitea_assess_pr_sync_status: pr_head=499b87c48218cf03a3b1f34a5d8a17549d820564, base_head=ef14622ba0badd0cd7d654c05af13aca7d81bc05, commits_behind=0, mergeable=true, has_conflicts=false, approval_at_current_head=false, recommended_next_action=fresh_review_required, checks_status=not_required. Master parity in_parity=true, mutation_safe=true at ef14622. No focused #855 suite re-run: clean base merge, no production-code delta beyond the merge commit (step-11 trigger did not apply).
LAST_UPDATED_BY: jcwalker3 / prgs-author

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

## Canonical Issue State STATE: awaiting-review WHO_IS_NEXT: reviewer NEXT_ACTION: Perform a fresh independent review of PR #866 at head `499b87c48218cf03a3b1f34a5d8a17549d820564` against issue #855 acceptance criteria 1-9. Do NOT reuse review #534 (invalid at the new head). Verify the `pr_number` selector fail-closed behavior (invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the fully-gated expired-reviewer-lease reclaim (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant; evaluated after full ownership inventory). Run the two focused suites, confirm baseline failures match master `ef14622`, submit a verdict, and stop. NEXT_PROMPT: ```text Review PR #866 for issue #855 as prgs-reviewer pinned to head 499b87c48218cf03a3b1f34a5d8a17549d820564. Former-head approval #534 is INVALID at this head — do not reuse it. Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector, confirm the pre-existing baseline failures match master ef14622, submit a verdict, and stop. ``` WHAT_HAPPENED: Author base-sync only. Branch `fix/issue-855-pr-scoped-merged-cleanup` was synced to current `master` via the sanctioned author `gitea_update_pr_branch_by_merge` path (style=merge; no rebase, no force-push). Former PR head `24c52abf6b80e7ed562294371eee9fe8620b686e` -> new PR head `499b87c48218cf03a3b1f34a5d8a17549d820564`; base `master` merged at `ef14622ba0badd0cd7d654c05af13aca7d81bc05`. Change scope is the base-merge commit only — no production file edits beyond the merge. Review #534 (APPROVED @ 24c52ab) is invalidated by the head change; reviewer/merger leases and any prepared verdict scoped to the former head are superseded. WHY: PR #866 was approved at head 24c52ab but branch protection requires the PR branch to contain the current base, and the branch was 2 commits behind protected `master` (`ef14622`). Gitea could merge base in without conflicts, so the sanctioned author update-by-merge was the required operation to make it merge-eligible; a new head necessarily invalidates the prior approval and requires fresh independent review. RELATED_PRS: #865 (merged @ ef14622, advanced base); #859 (merged; audit-side merged-PR linkage — distinct, already landed); #818/#638 (retained reproduction fixtures, untouched). BLOCKERS: none. `commits_behind=0`, `mergeable=true`, `has_conflicts=false`, PR open, `mutation_safe=true`, `in_parity=true`. No foreign live lock/lease. Only gate for merge now is the required fresh review at the new head. VALIDATION: `gitea_update_pr_branch_by_merge` -> success, performed=true, style=merge, force_push=false, rebase=false. Post-sync `gitea_assess_pr_sync_status`: pr_head=`499b87c48218cf03a3b1f34a5d8a17549d820564`, base_head=`ef14622ba0badd0cd7d654c05af13aca7d81bc05`, commits_behind=0, mergeable=true, has_conflicts=false, approval_at_current_head=false, recommended_next_action=fresh_review_required, checks_status=not_required. Master parity in_parity=true, mutation_safe=true at ef14622. No focused #855 suite re-run: clean base merge, no production-code delta beyond the merge commit (step-11 trigger did not apply). LAST_UPDATED_BY: jcwalker3 / prgs-author Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

sysadmin commented

2026-07-24 01:07:13 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #866
issue: #855
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 51916-0f368a202092
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866
phase: claimed
candidate_head: 499b87c482
target_branch: master
target_branch_sha: none
last_activity: 2026-07-24T06:07:13Z
expires_at: 2026-07-24T06:17:13Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #866 issue: #855 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 51916-0f368a202092 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866 phase: claimed candidate_head: 499b87c48218cf03a3b1f34a5d8a17549d820564 target_branch: master target_branch_sha: none last_activity: 2026-07-24T06:07:13Z expires_at: 2026-07-24T06:17:13Z blocker: none

sysadmin requested changes 2026-07-24 01:08:43 -05:00

sysadmin left a comment

Canonical PR State

STATE: changes-requested
WHO_IS_NEXT: author
BLOCKED_ROLE: none
NEXT_ACTION: As prgs-author on issue #855, run gitea_update_pr_branch_by_merge on PR #866 to merge current live master (89657a06c4) into fix/issue-855-pr-scoped-merged-cleanup, producing a new head that incorporates 89657a06. Then route the new head to a fresh gitea-reviewer for a head-scoped review. No code changes are required — the implementation is sound; only the stale base blocks approval.
NEXT_PROMPT:

Sync PR #866 for issue #855 as prgs-author. Head 499b87c48218cf03a3b1f34a5d8a17549d820564 is 2 commits behind live master 89657a06c4cc8d73917e4436e326d3755cff0a40 and branch protection requires a current base. Run update_pr_branch_by_merge to merge master into the branch (no rebase/force), verify the new head with read-after-write, then hand off to a fresh gitea-reviewer pinned to the new head. Do not clean the PR #818/#638 reproduction fixture (branches/issue-638-webui-app-shell-phase1, branches/review-pr-818). Do not re-implement the pr_number selector or the AC4 expired-reviewer reclaim; both are complete and verified.

WHAT_HAPPENED: Independent security-focused review of the complete current diff at head 499b87c (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11, two test files). Two-parent containment independently proven: 499b87c descends from original head 24c52ab AND incorporates ef14622 (merge-base is exactly ef14622). It does NOT incorporate current live master 89657a06.
WHY: BLOCKING — the reviewed head is NOT mergeable at a current base. Authoritative sync assessment: commits_behind=2, branch_protection_requires_current_base=true, approval_valid_for_merge=false, stale_approval=true, recommended_next_action=update_branch_by_merge. Live master advanced ef14622 -> 89657a06 (PR #869/#868 merged) AFTER this branch synchronized to ef14622, so the branch is stale again. Approving a behind head would let a merge land on a non-current base in violation of branch protection. This is a synchronization requirement, not a code defect: the implementation is fail-closed and correct.
CODE_ASSESSMENT (no changes required):

assess_expired_reviewer_lease_reclaim is strictly fail-closed — reclaim only when role=='reviewer' AND status in {expired,stale} AND pr_merged is True AND owner_pid_alive is False AND competing_active_claimant is False; every gate uses identity checks (is True / is False), so any None/unknown/contrary value keeps the lease protective. TTL expiry alone never authorizes reclaim.
Collector wiring (_collect_branch_ownership_records): reviewer reclaim candidates gated to role=='reviewer' + reclaimable status; owner_pid_alive coerced to None unless a real bool; whole reclaim pass skipped on inventory_error (candidates stay protective); pr_merged_state from a live PR GET with exception -> None (fail closed); competing-claimant detection scans the FULL ownership inventory and runs only after it is built, so iteration order cannot miss an active claimant.
PR-scoped selector (gitea_reconcile_merged_cleanups pr_number): fails closed on non-int (invalid_pr_number), <=0 (invalid_pr_number), unresolvable/empty (pr_unresolvable), live-number mismatch (pr_ambiguous), not-merged (pr_not_merged); closed set pinned to [pr_live]; scratch worktrees filtered to pr_number==exact_pr; post-report entry-set pin rejects any set != [exact_pr] (exact_selection_mismatch), blocking both zero and extra entries. Open-PR heads still fetched for remote-delete safety. Batch behaviour preserved when pr_number is omitted.
Author/merger/controller/reconciler leases, active leases, worktree bindings, issue locks, and live sessions remain protective. No ownership guard is weakened beyond the single fully-gated reclaim. No PR-introduced regression found in the diff.
ISSUE: 855
HEAD_SHA: 499b87c482
REVIEW_STATUS: REQUEST_CHANGES
MERGE_READY: no — head is 2 commits behind live master 89657a06c4 and branch protection requires a current base.
BLOCKERS: Stale base. Required change: update_pr_branch_by_merge onto current master 89657a06c4, then fresh head-scoped review. No source edits required.
VALIDATION: Containment verified via git merge-base --is-ancestor (descends 24c52ab: yes; incorporates ef14622: yes; incorporates 89657a06: no; commits_behind=2). Sync state via gitea_assess_pr_sync_status (mergeable=true, has_conflicts=false, commits_behind=2, branch_protection_requires_current_base=true). Focused #855 tests and baseline-failure reproduction deferred to the post-sync reviewer, since the required base-sync produces a fresh head that supersedes this one; the feature diff is unchanged by a base merge.
RELATED_PRS: #859 (audit-side merged-PR linkage, already merged — distinct scope). Reproduction fixture PR #818 / issue #638 must remain untouched.
NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review REQUEST_CHANGES mutation by sysadmin / prgs-reviewer at head 499b87c482 (reviewer session 51916-0f368a202092, reviewer-lease comment 15460, workflow_hash 263d0a6cb8a6). Not a hand-authored claim.
LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)

Co-Authored-By: Claude Opus 4.8 (1M context) [email protected]

## Canonical PR State STATE: changes-requested WHO_IS_NEXT: author BLOCKED_ROLE: none NEXT_ACTION: As prgs-author on issue #855, run gitea_update_pr_branch_by_merge on PR #866 to merge current live master (89657a06c4cc8d73917e4436e326d3755cff0a40) into fix/issue-855-pr-scoped-merged-cleanup, producing a new head that incorporates 89657a06. Then route the new head to a fresh gitea-reviewer for a head-scoped review. No code changes are required — the implementation is sound; only the stale base blocks approval. NEXT_PROMPT: ```text Sync PR #866 for issue #855 as prgs-author. Head 499b87c48218cf03a3b1f34a5d8a17549d820564 is 2 commits behind live master 89657a06c4cc8d73917e4436e326d3755cff0a40 and branch protection requires a current base. Run update_pr_branch_by_merge to merge master into the branch (no rebase/force), verify the new head with read-after-write, then hand off to a fresh gitea-reviewer pinned to the new head. Do not clean the PR #818/#638 reproduction fixture (branches/issue-638-webui-app-shell-phase1, branches/review-pr-818). Do not re-implement the pr_number selector or the AC4 expired-reviewer reclaim; both are complete and verified. ``` WHAT_HAPPENED: Independent security-focused review of the complete current diff at head 499b87c (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11, two test files). Two-parent containment independently proven: 499b87c descends from original head 24c52ab AND incorporates ef14622 (merge-base is exactly ef14622). It does NOT incorporate current live master 89657a06. WHY: BLOCKING — the reviewed head is NOT mergeable at a current base. Authoritative sync assessment: commits_behind=2, branch_protection_requires_current_base=true, approval_valid_for_merge=false, stale_approval=true, recommended_next_action=update_branch_by_merge. Live master advanced ef14622 -> 89657a06 (PR #869/#868 merged) AFTER this branch synchronized to ef14622, so the branch is stale again. Approving a behind head would let a merge land on a non-current base in violation of branch protection. This is a synchronization requirement, not a code defect: the implementation is fail-closed and correct. CODE_ASSESSMENT (no changes required): - assess_expired_reviewer_lease_reclaim is strictly fail-closed — reclaim only when role=='reviewer' AND status in {expired,stale} AND pr_merged is True AND owner_pid_alive is False AND competing_active_claimant is False; every gate uses identity checks (is True / is False), so any None/unknown/contrary value keeps the lease protective. TTL expiry alone never authorizes reclaim. - Collector wiring (_collect_branch_ownership_records): reviewer reclaim candidates gated to role=='reviewer' + reclaimable status; owner_pid_alive coerced to None unless a real bool; whole reclaim pass skipped on inventory_error (candidates stay protective); pr_merged_state from a live PR GET with exception -> None (fail closed); competing-claimant detection scans the FULL ownership inventory and runs only after it is built, so iteration order cannot miss an active claimant. - PR-scoped selector (gitea_reconcile_merged_cleanups pr_number): fails closed on non-int (invalid_pr_number), <=0 (invalid_pr_number), unresolvable/empty (pr_unresolvable), live-number mismatch (pr_ambiguous), not-merged (pr_not_merged); closed set pinned to [pr_live]; scratch worktrees filtered to pr_number==exact_pr; post-report entry-set pin rejects any set != [exact_pr] (exact_selection_mismatch), blocking both zero and extra entries. Open-PR heads still fetched for remote-delete safety. Batch behaviour preserved when pr_number is omitted. - Author/merger/controller/reconciler leases, active leases, worktree bindings, issue locks, and live sessions remain protective. No ownership guard is weakened beyond the single fully-gated reclaim. No PR-introduced regression found in the diff. ISSUE: 855 HEAD_SHA: 499b87c48218cf03a3b1f34a5d8a17549d820564 REVIEW_STATUS: REQUEST_CHANGES MERGE_READY: no — head is 2 commits behind live master 89657a06c4cc8d73917e4436e326d3755cff0a40 and branch protection requires a current base. BLOCKERS: Stale base. Required change: update_pr_branch_by_merge onto current master 89657a06c4cc8d73917e4436e326d3755cff0a40, then fresh head-scoped review. No source edits required. VALIDATION: Containment verified via git merge-base --is-ancestor (descends 24c52ab: yes; incorporates ef14622: yes; incorporates 89657a06: no; commits_behind=2). Sync state via gitea_assess_pr_sync_status (mergeable=true, has_conflicts=false, commits_behind=2, branch_protection_requires_current_base=true). Focused #855 tests and baseline-failure reproduction deferred to the post-sync reviewer, since the required base-sync produces a fresh head that supersedes this one; the feature diff is unchanged by a base merge. RELATED_PRS: #859 (audit-side merged-PR linkage, already merged — distinct scope). Reproduction fixture PR #818 / issue #638 must remain untouched. NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review REQUEST_CHANGES mutation by sysadmin / prgs-reviewer at head 499b87c48218cf03a3b1f34a5d8a17549d820564 (reviewer session 51916-0f368a202092, reviewer-lease comment 15460, workflow_hash 263d0a6cb8a6). Not a hand-authored claim. LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer) Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

sysadmin commented

2026-07-24 01:09:14 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #866
issue: #855
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 51916-0f368a202092
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866
phase: released
candidate_head: 499b87c482
target_branch: master
target_branch_sha: none
last_activity: 2026-07-24T06:09:14Z
expires_at: 2026-07-24T06:19:14Z
blocker: manual-release

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #866 issue: #855 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 51916-0f368a202092 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866 phase: released candidate_head: 499b87c48218cf03a3b1f34a5d8a17549d820564 target_branch: master target_branch_sha: none last_activity: 2026-07-24T06:09:14Z expires_at: 2026-07-24T06:19:14Z blocker: manual-release

jcwalker3 referenced this pull request

2026-07-24 01:31:52 -05:00

fix(author): refresh durable linked-issue lock head after update_pr_branch_by_merge; recover merge-sync-drifted dead-session locks #871

jcwalker3 referenced this pull request

2026-07-24 01:33:16 -05:00

[bug][author-lock] Dead-session recovery deadlocks a second cross-session PR base-sync after a sanctioned server-side update_pr_branch_by_merge advanced the remote head #872

jcwalker3 referenced this issue from a commit

2026-07-24 02:06:13 -05:00

fix(author): refresh durable issue-lock head after branch sync; recover merge-sync-drifted dead-session locks (#871)

jcwalker3 added 1 commit 2026-07-24 02:07:36 -05:00

Merge branch 'master' into fix/issue-855-pr-scoped-merged-cleanup c9aa09f341

jcwalker3 referenced this pull request