fix(author bootstrap): restore missing runtime identity and session helpers (Closes #943) #944

Open

jcwalker3 wants to merge 1 commits from fix/issue-943-runtime-context-helpers into master

Author SHA1 Message Date

Author	SHA1	Message	Date
jcwalker3andClaude Opus 5	f49e781102	fix(author bootstrap): restore missing runtime identity and session helpers (Closes #943 ) gitea_bootstrap_author_issue_worktree referenced four globals that commit `a942afe` (#850) introduced without ever defining: _active_username 1 reference, 0 definitions _active_profile_name 1 reference, 0 definitions _current_session_id 1 reference, 0 definitions _author_mutation_block 1 reference, 0 definitions Evaluating the call arguments therefore raised NameError: name '_active_username' is not defined before author_issue_bootstrap.bootstrap_author_issue_worktree was entered, so the capability was unusable for every caller including dry_run=true. The fourth name, _author_mutation_block, sits on the reviewer-stop refusal path and was found by the generalised regression test rather than by the original report. The defect was unreachable until PR #942 (#941) wired the bootstrap scope into workflow_scope_guard: before that, verify_preflight_purity refused first with missing_issue_worktree, masking it. Changes: * _active_username reads the immutable #714 session context that gitea_whoami seeds — the identity pin every other mutation gate already consults. An unbound context returns None so callers fail closed rather than acting as an unverified actor; a profile's expected_username is never substituted. * _active_profile_name prefers the live get_profile() and falls back to the bound session context only when the profile cannot be read. * _current_session_id mints the same "<profile>-<pid>-<hex>" shape as the three pre-existing lease call sites, bound once per process so repeated calls describe one session instead of a fresh owner per call, which would make lease-ownership comparisons unsatisfiable. None is never memoised. * _author_mutation_block returns the uniform refusal shape the other author mutations already return for the same check_author_mutation_after_reviewer_stop block. No guard, signature, or permission changes. Wrong-role, wrong-profile, wrong-identity, stale-runtime, expected-base and workflow-scope enforcement all still gate the call; the helpers only supply values the service then validates fail-closed (missing_active_identity / missing_active_profile / missing_owner_session / stale_concurrency_pin). Regression: tests/test_issue_943_runtime_context_helpers.py (27 tests). The generalised test resolves every global the wrapper's body references against module globals and builtins, so the next missing reference fails too rather than only the three named here — that test is what found _author_mutation_block. Coverage also coversdry-run reaching and completing the service with helper-produced bindings, dry-run leaving no branch, worktree, assignment or lease, apply reaching its intended transition, each fail-closed mismatch, expected-base mismatch, and the #941/PR #942 scope wiring. Pre-fix 20 failed / 13 passed against unmodified aab54d48; post-fix 27 passed. Targeted bootstrap and guard suites: 245 passed, 59 subtests. Full suite: 28 failed, 5552 passed, 6 skipped, 1006 subtests — the 28 are the standing baseline, every one of which also fails on the unmodified base. Closes #943 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013ygVZQLbbhJTChuVuLaJWb	2026-07-26 07:56:14 -05:00

jcwalker3andClaude Opus 5

f49e781102

fix(author bootstrap): restore missing runtime identity and session helpers (Closes #943 )

gitea_bootstrap_author_issue_worktree referenced four globals that commit
a942afe (#850) introduced without ever defining:

    _active_username        1 reference, 0 definitions
    _active_profile_name    1 reference, 0 definitions
    _current_session_id     1 reference, 0 definitions
    _author_mutation_block  1 reference, 0 definitions

Evaluating the call arguments therefore raised

    NameError: name '_active_username' is not defined

before author_issue_bootstrap.bootstrap_author_issue_worktree was entered, so
the capability was unusable for every caller including dry_run=true. The fourth
name, _author_mutation_block, sits on the reviewer-stop refusal path and was
found by the generalised regression test rather than by the original report.

The defect was unreachable until PR #942 (#941) wired the bootstrap scope into
workflow_scope_guard: before that, verify_preflight_purity refused first with
missing_issue_worktree, masking it.

Changes:

* _active_username reads the immutable #714 session context that gitea_whoami
  seeds — the identity pin every other mutation gate already consults. An
  unbound context returns None so callers fail closed rather than acting as an
  unverified actor; a profile's expected_username is never substituted.
* _active_profile_name prefers the live get_profile() and falls back to the
  bound session context only when the profile cannot be read.
* _current_session_id mints the same "<profile>-<pid>-<hex>" shape as the three
  pre-existing lease call sites, bound once per process so repeated calls
  describe one session instead of a fresh owner per call, which would make
  lease-ownership comparisons unsatisfiable. None is never memoised.
* _author_mutation_block returns the uniform refusal shape the other author
  mutations already return for the same check_author_mutation_after_reviewer_stop
  block.

No guard, signature, or permission changes. Wrong-role, wrong-profile,
wrong-identity, stale-runtime, expected-base and workflow-scope enforcement all
still gate the call; the helpers only supply values the service then validates
fail-closed (missing_active_identity / missing_active_profile /
missing_owner_session / stale_concurrency_pin).

Regression: tests/test_issue_943_runtime_context_helpers.py (27 tests). The
generalised test resolves every global the wrapper's body references against
module globals and builtins, so the next missing reference fails too rather
than only the three named here — that test is what found
_author_mutation_block. Coverage also coversdry-run reaching and completing the
service with helper-produced bindings, dry-run leaving no branch, worktree,
assignment or lease, apply reaching its intended transition, each fail-closed
mismatch, expected-base mismatch, and the #941/PR #942 scope wiring.

Pre-fix 20 failed / 13 passed against unmodified aab54d48; post-fix 27 passed.
Targeted bootstrap and guard suites: 245 passed, 59 subtests.
Full suite: 28 failed, 5552 passed, 6 skipped, 1006 subtests — the 28 are the
standing baseline, every one of which also fails on the unmodified base.

Closes #943

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_013ygVZQLbbhJTChuVuLaJWb

2026-07-26 07:56:14 -05:00