feat(webui): request preview, authorization, and workflow initiation (Closes #643)

Conversation 4 Commits 3 Files Changed 11

+3260 -41

3 Commits

Author SHA1 Message Date

jcwalker3 6da68fffb8 Merge branch 'master' into feat/issue-643-request-preview-initiate 2026-07-25 02:44:58 -05:00

Author	SHA1	Message	Date
jcwalker3	6da68fffb8	Merge branch 'master' into feat/issue-643-request-preview-initiate	2026-07-25 02:44:58 -05:00
sysadminandClaude Opus 5	53ce1b1a5e	fix(webui): compensate stray allocations and keep preview side-effect free Addresses both blockers from the PR #902 review (review 589) for issue #643. B1 — an allocator-created assignment could be orphaned and reported as no mutation. apply_request re-previews, then re-runs the allocator with apply=True. The CAS fingerprint hashes only {kind, number} plus exclusions, so a competing lease taken on the requested unit inside the window leaves the fingerprint identical: the pin passes, the selection loop skips the now-claimed unit and commits an assignment on the next one, and _selection_matches then fails on egress. The old code returned mutation_performed False with that lease still committed and owned by a synthetic session nothing heartbeats. The window contains a second full load_queue_snapshot(), so it is seconds wide, and foreign sessions acting on this repo concurrently are an observed condition. The egress mismatch now releases the assignment the allocator created before refusing. When the release succeeds the refusal reports mutation_performed False and a compensation record; when it fails the response carries mutation_performed True, an explicit orphaned_assignment, and a gitea_release_workflow_lease reclaim action, because claiming nothing changed while a lease is live is the defect rather than a report of it. The same state was reachable through _run_allocator's bare except Exception: allocate_next_work only catches InvalidWorkKindError, LeaseRequiredError and ControlPlaneError, so anything raised after assign_and_lease committed arrived as "no result" with a durable lease. A None result on the apply path now sweeps and releases whatever this flow's session owns. That sweep is only possible because of the B2 fix below — the session id is now stable across the flow, so the lease is findable. B2 — the "read-only" preview wrote to the control-plane DB. allocate_next_work called db.upsert_session and db.expire_stale_leases unconditionally, before the apply branch was consulted, and default_allocator minted a fresh webui-request-<hex> per call. Every preview therefore appended a never-reused session row and mutated global lease state while the payload said dry_run True / mutation_performed False, driven by an operator refreshing a form. One apply wrote two rows and bound the lease to the second, which is why B1's orphan had no reclaimable owner. allocate_next_work gains a keyword-only side_effect_free flag, default False so every existing caller is byte-for-byte unchanged. Under the flag both writes are suppressed and expired leases are instead filtered out of the claim map in memory, which reaches the same selection the sweep would have produced without persisting anything; a claim whose expiry cannot be parsed is kept, since an unreadable expiry is not evidence that work is free. side_effect_free with apply=True fails closed rather than silently reserving. request_service mints one session id per request flow and threads it through both the dry-run and the apply, and the dry-run now routes through the side-effect-free path. Coverage. test_allocator_drift_on_apply_is_not_read_as_an_assignment asserted the defect — it built the orphan state and then required mutation_performed to be False, which a leak satisfies. It now requires the compensating release. Added: release-failure surfacing a reclaim action, an assignment with no lease id, the post-commit exception route, and session-id identity across the flow. The two areas the review named as having zero coverage now have it: default_allocator past its two fail-closed early returns (side_effect_free routing, session-id pass-through and minting, scope and fingerprint propagation) and default_claims_source (scoped read, and an unreadable substrate denying rather than reading as "nothing claimed"). allocator_service gains side-effect-free tests against a real temp-file DB plus the expiry-filter unit tests. Every new guard was mutation-tested by reverting it one at a time: B1 compensation removed → 3 failures; post-commit sweep removed → 1; session id re-minted per call → 2; side_effect_free ignored → 3; in-memory expiry filter removed → 1. Verification: WEBUI_TEST_OFFLINE=1 python -m pytest tests/ -q from this branches/ worktree gives 23 failed, 5263 passed, 6 skipped, 899 subtests. The sorted FAILED set is identical to the reviewer's clean-master baseline at `2f4dec83` (23 failed, 5190 passed) — no new, changed, or disappeared failure — and 21 tests were added over the reviewed head's 5242. Zero conflict markers; py_compile passes; git diff --check clean. Refs #643, PR #902 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01V6xFqovhbArPv61j9KCGkL	2026-07-25 03:32:24 -04:00
sysadminandClaude Opus 4.8	433f66add8	feat(webui): request preview, authorization, and workflow initiation (Closes #643 ) Operators had to paste a role prompt into a terminal to start work, and nothing enforced that the allocator had been consulted first, so two sessions could reach for the same issue and each believe it was theirs. This adds a request surface: a desired role, an issue or PR, and a stated intent, answered by an authorization decision and - on confirmation - an exclusive assignment from the allocator. Preview (POST /api/v1/requests/preview, and the /requests form) runs five checks and reports authorize/deny with a reason for each: console authorization, capability resolution for the desired role, lease availability, whether the allocator would independently select this work unit, and head pinning for PR work. It is read-only - it calls the allocator with apply=false and writes only an audit line. An unauthorized principal never reaches the allocator or the control-plane DB, so a denial cannot enumerate the queue. Initiation (POST /api/v1/requests/apply) never assigns the requested item directly. It runs a dry-run first and proceeds only when the allocator would independently pick that exact work unit, carrying the dry-run's candidate_set_fingerprint as a CAS pin; otherwise it returns wait or blocked and mutates nothing. An active claim on the work unit rejects a duplicate assign before one is attempted. A returned assignment carries a handoff block naming the required profile, namespace, and the actions that stay forbidden. Authorization reuses the #633 model rather than adding a second one. The new initiate_workflow action is operator-class because its outcome is a claim, not a Gitea verdict: requesting reviewer or merger work reserves that work but grants no right to approve or merge. Execution is gated by a new per-action execution_env_flag (WEBUI_REQUESTS_EXECUTION), deliberately in place of raising ACTIVE_PHASE - a phase bump would enable execution for every phase-2 action at once, including ones whose execution path is not implemented. Actions that declare no flag are unchanged and still report execution_enabled false. Every preview and apply emits a console audit record correlated to the resulting assignment by correlation.request_id. Fail-closed throughout: an unreadable control-plane DB, an incomplete queue inventory (#758), an allocator that raises, an unpinned PR head, a moved PR head, and an unconfirmed apply all deny without mutating. Files: - webui/request_service.py (new) - request model, preview, initiation - webui/request_views.py (new) - form and preview rendering, escaped - tests/test_webui_request_initiation.py (new) - 52 tests - webui/console_authz.py - initiate_workflow action, execution_wired() - webui/app.py - /requests, /api/v1/requests/preview, /api/v1/requests/apply - webui/nav.py - Requests nav entry - webui/traffic_loader.py - public candidates_from_queue_snapshot alias - docs/webui-requests.md (new), docs/webui-authz-audit.md Validation: full suite on this branch 5242 passed, 6 skipped, 899 subtests, 23 failed. Clean master baseline at `2f4dec83` in an equivalent branches/ worktree: 5190 passed, 6 skipped, 867 subtests, the same 23 tests failed. The branch adds 52 passing tests and introduces no new full-suite failure signature. Closes #643 Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-07-25 01:47:38 -04:00

sysadminandClaude Opus 5

53ce1b1a5e

fix(webui): compensate stray allocations and keep preview side-effect free

Addresses both blockers from the PR #902 review (review 589) for issue #643.

B1 — an allocator-created assignment could be orphaned and reported as no
mutation.

apply_request re-previews, then re-runs the allocator with apply=True. The CAS
fingerprint hashes only {kind, number} plus exclusions, so a competing lease
taken on the requested unit inside the window leaves the fingerprint identical:
the pin passes, the selection loop skips the now-claimed unit and commits an
assignment on the *next* one, and _selection_matches then fails on egress. The
old code returned mutation_performed False with that lease still committed and
owned by a synthetic session nothing heartbeats. The window contains a second
full load_queue_snapshot(), so it is seconds wide, and foreign sessions acting
on this repo concurrently are an observed condition.

The egress mismatch now releases the assignment the allocator created before
refusing. When the release succeeds the refusal reports mutation_performed
False and a compensation record; when it fails the response carries
mutation_performed True, an explicit orphaned_assignment, and a
gitea_release_workflow_lease reclaim action, because claiming nothing changed
while a lease is live is the defect rather than a report of it.

The same state was reachable through _run_allocator's bare except Exception:
allocate_next_work only catches InvalidWorkKindError, LeaseRequiredError and
ControlPlaneError, so anything raised after assign_and_lease committed arrived
as "no result" with a durable lease. A None result on the apply path now sweeps
and releases whatever this flow's session owns. That sweep is only possible
because of the B2 fix below — the session id is now stable across the flow, so
the lease is findable.

B2 — the "read-only" preview wrote to the control-plane DB.

allocate_next_work called db.upsert_session and db.expire_stale_leases
unconditionally, before the apply branch was consulted, and default_allocator
minted a fresh webui-request-<hex> per call. Every preview therefore appended a
never-reused session row and mutated global lease state while the payload said
dry_run True / mutation_performed False, driven by an operator refreshing a
form. One apply wrote two rows and bound the lease to the second, which is why
B1's orphan had no reclaimable owner.

allocate_next_work gains a keyword-only side_effect_free flag, default False so
every existing caller is byte-for-byte unchanged. Under the flag both writes are
suppressed and expired leases are instead filtered out of the claim map in
memory, which reaches the same selection the sweep would have produced without
persisting anything; a claim whose expiry cannot be parsed is kept, since an
unreadable expiry is not evidence that work is free. side_effect_free with
apply=True fails closed rather than silently reserving. request_service mints
one session id per request flow and threads it through both the dry-run and the
apply, and the dry-run now routes through the side-effect-free path.

Coverage.

test_allocator_drift_on_apply_is_not_read_as_an_assignment asserted the defect —
it built the orphan state and then required mutation_performed to be False, which
a leak satisfies. It now requires the compensating release. Added: release-failure
surfacing a reclaim action, an assignment with no lease id, the post-commit
exception route, and session-id identity across the flow. The two areas the review
named as having zero coverage now have it: default_allocator past its two
fail-closed early returns (side_effect_free routing, session-id pass-through and
minting, scope and fingerprint propagation) and default_claims_source (scoped
read, and an unreadable substrate denying rather than reading as "nothing
claimed"). allocator_service gains side-effect-free tests against a real
temp-file DB plus the expiry-filter unit tests.

Every new guard was mutation-tested by reverting it one at a time: B1
compensation removed → 3 failures; post-commit sweep removed → 1; session id
re-minted per call → 2; side_effect_free ignored → 3; in-memory expiry filter
removed → 1.

Verification: WEBUI_TEST_OFFLINE=1 python -m pytest tests/ -q from this
branches/ worktree gives 23 failed, 5263 passed, 6 skipped, 899 subtests. The
sorted FAILED set is identical to the reviewer's clean-master baseline at
2f4dec83 (23 failed, 5190 passed) — no new, changed, or disappeared failure —
and 21 tests were added over the reviewed head's 5242. Zero conflict markers;
py_compile passes; git diff --check clean.

Refs #643, PR #902

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01V6xFqovhbArPv61j9KCGkL

2026-07-25 03:32:24 -04:00

sysadminandClaude Opus 4.8

433f66add8

feat(webui): request preview, authorization, and workflow initiation (Closes #643 )

Operators had to paste a role prompt into a terminal to start work, and
nothing enforced that the allocator had been consulted first, so two sessions
could reach for the same issue and each believe it was theirs. This adds a
request surface: a desired role, an issue or PR, and a stated intent, answered
by an authorization decision and - on confirmation - an exclusive assignment
from the allocator.

Preview (POST /api/v1/requests/preview, and the /requests form) runs five
checks and reports authorize/deny with a reason for each: console
authorization, capability resolution for the desired role, lease availability,
whether the allocator would independently select this work unit, and head
pinning for PR work. It is read-only - it calls the allocator with apply=false
and writes only an audit line. An unauthorized principal never reaches the
allocator or the control-plane DB, so a denial cannot enumerate the queue.

Initiation (POST /api/v1/requests/apply) never assigns the requested item
directly. It runs a dry-run first and proceeds only when the allocator would
independently pick that exact work unit, carrying the dry-run's
candidate_set_fingerprint as a CAS pin; otherwise it returns wait or blocked
and mutates nothing. An active claim on the work unit rejects a duplicate
assign before one is attempted. A returned assignment carries a handoff block
naming the required profile, namespace, and the actions that stay forbidden.

Authorization reuses the #633 model rather than adding a second one. The new
initiate_workflow action is operator-class because its outcome is a claim, not
a Gitea verdict: requesting reviewer or merger work reserves that work but
grants no right to approve or merge. Execution is gated by a new per-action
execution_env_flag (WEBUI_REQUESTS_EXECUTION), deliberately in place of raising
ACTIVE_PHASE - a phase bump would enable execution for every phase-2 action at
once, including ones whose execution path is not implemented. Actions that
declare no flag are unchanged and still report execution_enabled false.

Every preview and apply emits a console audit record correlated to the
resulting assignment by correlation.request_id.

Fail-closed throughout: an unreadable control-plane DB, an incomplete queue
inventory (#758), an allocator that raises, an unpinned PR head, a moved PR
head, and an unconfirmed apply all deny without mutating.

Files:
- webui/request_service.py (new) - request model, preview, initiation
- webui/request_views.py (new) - form and preview rendering, escaped
- tests/test_webui_request_initiation.py (new) - 52 tests
- webui/console_authz.py - initiate_workflow action, execution_wired()
- webui/app.py - /requests, /api/v1/requests/preview, /api/v1/requests/apply
- webui/nav.py - Requests nav entry
- webui/traffic_loader.py - public candidates_from_queue_snapshot alias
- docs/webui-requests.md (new), docs/webui-authz-audit.md

Validation: full suite on this branch 5242 passed, 6 skipped, 899 subtests, 23
failed. Clean master baseline at 2f4dec83 in an equivalent branches/ worktree:
5190 passed, 6 skipped, 867 subtests, the same 23 tests failed. The branch adds
52 passing tests and introduces no new full-suite failure signature.

Closes #643

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-07-25 01:47:38 -04:00

feat(webui): request preview, authorization, and workflow initiation (Closes #643) #902