Files

T

sysadminandClaude Opus 4.8 ea51b0196a feat: require MCP-native post-merge cleanup proof (Closes #517 )

Add mcp_native_cleanup_proof verifier that blocks raw git branch deletion and
raw API comment deletion scripts as cleanup proof, requires authorized
reconciler MCP tools in cleanup mutation ledgers, and separates merge from
cleanup mutations in controller handoffs.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-07-08 12:54:37 -04:00

4.1 KiB

Raw Blame History

Template: merge a PR (eligible reviewer only)

Copy, fill the <...> fields, and paste as the task prompt.

Task: merge PR #<pr> for issue #<n> if it is eligible and checks pass.

Load the canonical workflow first:
`skills/llm-project-workflow/workflows/review-merge-pr.md` (task mode: review-merge-pr).
Final report schema: `schemas/review-merge-final-report.md`.

Rules (llm-project-workflow):
- Only an eligible, NON-author reviewer merges. If authenticated user == PR
  author → STOP.
- Do not merge unless the PR is open, mergeable, and its checks/review pass.
- No force-merge, no bypassing branch protections.
- If the PR is closed but `merged=false`, STOP and run reconciliation. Do not clean up.

Steps:
1. Identity Checklist: Before claiming/working on merge, verify and state:
   - Required identity/profile for this task: merger (allowed to merge PRs)
   - Current authenticated identity (from whoami): <username>
   - Target task role: merger identity (must NOT be the PR author)
   *If the current identity does not match the required role (or is the PR author), STOP. Relaunch/switch to the correct profile first.*
2. Verify authenticated identity + active profile.
3. Confirm PR #<pr>: author (not you), state open, mergeable, review approved. Check if PR body uses `Closes #N` or `Fixes #N`; if it uses `Implements #N` or `Refs #N`, manual closing will be needed in step 29.
4. Capability evidence (#179): cite the exact gitea_resolve_task_capability
   output (or runtime context) proving merge_pr is allowed — a bare
   "capability checks passed" claim is downgraded.
5. Final live-state recheck (#179), immediately before the merge mutation —
   re-read the live PR and prove:
   - PR still open
   - live head SHA still equals the pinned/reviewed head SHA
   - base branch unchanged
   - no undismissed REQUEST_CHANGES / blocking review state remains
   If any recheck fails → STOP, re-pin, re-validate.
6. If any gate fails → STOP and report.
7. Merge with explicit confirmation (e.g. confirmation="MERGE PR <pr>"),
   pinning the reviewed head SHA (expected_head_sha) and, where supported,
   the changed-file set.
8. Confirm remote master now contains the merge commit (or the expected changes if squash merged).
   *Note: Gitea PR "closed" state is NOT equivalent to "merged". Do not assume a closed PR succeeded without verifying the actual landed changes.*

Post-merge cleanup (#517): merger sessions must NOT perform ad hoc cleanup.
- Record merge mutations separately from cleanup mutations in the controller handoff.
- Hand cleanup to a `prgs-reconciler` session — never raw `git branch -d`,
  `git push --delete`, curl/API comment deletion, or local scripts.
- Reconciler cleanup must cite authorized MCP tools
  (`gitea_reconcile_merged_cleanups`, `gitea_cleanup_post_merge_moot_lease`,
  `gitea_delete_branch`, etc.) plus `gitea.branch.delete` capability proof.

Then run the cleanup template (worktree-cleanup.md) in a reconciler session:
- Verify expected file/commit presence on master (post-merge file-presence verification):
  - Run: git fetch <remote> --prune; git checkout master; git pull <remote> master --ff-only
  - Verify that the expected files added/modified in the PR are present on master (or absent if deleted).
  - Alternatively, verify with: git log --oneline -- <expected-file> or git merge-base --is-ancestor <pr-head-sha> master
- close/release issue #<n>, remove status:in-progress (if it cannot be removed, report why)
- delete remote branch, remove local branch + worktree folder
- fetch/prune; confirm main checkout is clean and current (0 0).

Handoff: end with a section titled exactly `Controller Handoff` per SKILL.md
§K (long form — a merge is always high-risk), including the review/merge role
fields (Selected PR, Reviewer eligibility, Pinned reviewed head, Review
decision, Merge result, Linked issue status, Cleanup status) plus: merge
commit, PR metadata state/merged flag/hash, remote master hash, and the
post-merge verification method used & verification results. Reports missing
the handoff are downgraded (review_proofs.assess_controller_handoff).

4.1 KiB Raw Blame History

Template: merge a PR (eligible reviewer only)

4.1 KiB

Raw Blame History