jcwalker3andClaude Opus 4.8
c763161702
Addresses the five blocking findings of review 644 on PR #972.
B1 — live ownership and status revalidation. resolve_missing_worktree_binding
now re-reads the authoritative lease, session, checkpoint, and issue-lock rows
immediately before mutating and diffs them against the snapshot the audit
recorded (binding path and identity, lease id/status/session/owner pid,
checkpoint path/status, live-session evidence, trustworthy ownership evidence,
issue-lock state). Any drift fails closed without mutation, and the binding is
reclassified from the live values rather than the audit snapshot. A candidate
carrying no audited snapshot is refused rather than trusted.
B2 — server-enforced cleanup authorization. Apply mode no longer accepts a
client-supplied operator_authorized boolean; it is rejected outright at the MCP
tool and in the module (#709 F1 / review 434). Authorization is now the
project's own reconciliation cleanup gate, required at both the task-capability
boundary (new reconciler-only reconcile_missing_worktree_bindings capability,
gitea.branch.delete, role-exclusive) and the production mutation boundary
(an authorized audit_reconciliation_mode cleanup phase, re-checked at the point
of mutation so a forged authorization mapping cannot stand in for the gate).
Dry-run remains available to any gitea.read profile and stays non-mutating.
Existing role, repository, parity, and provenance gates are unchanged.
B3 — expected-path compare-and-swap. retire_session_checkpoint_worktree_path
now requires expected_path and performs a guarded update keyed on the stored
path, refusing without mutation when the stored path was moved, replaced, or
concurrently changed, when the row is unknown, or when a selector matches more
than one checkpoint. retire_lease_worktree_path gains the same treatment plus
optional status/session/owner-pid compare-and-swap, and its UPDATE is keyed on
the audited path. Both report an idempotent already_retired outcome instead of
falsely reporting a retirement.
B4 — live-session and issue-lock evidence. session_active is now derived from
the control-plane sessions table instead of never being set, along two axes:
genuine liveness (recorded active, PID not dead, heartbeat fresh — the rule
reused from restart_coordinator) and weaker but still trustworthy recorded
ownership. A non-terminal lease now protects its binding regardless of whether
the recorded PID is alive, so dead-PID evidence alone can no longer retire a
lease the control plane still holds. The previously unused issue_lock_store is
now read: a live durable issue lock binding the path or branch blocks cleanup,
and locks whose own paths are missing are reported for release through their
own lifecycle rather than retired here.
B5 — adversarial regression coverage. The suite now drives the registered MCP
tools through mcp_server, the real ControlPlaneDB, and the real cleanup gate,
covering lease status/ownership/session/path drift, expected-path mismatch,
concurrent recreation, an unauthorized caller submitting operator_authorized,
wrong profile and missing capability, live-session and trustworthy-owner
evidence, conflicting issue locks, non-mutating dry-run, exact-binding-only
retirement, preservation of unrelated worktrees and git metadata, idempotent
re-execution, and worktrees-dimension resolution.
All original #970 acceptance criteria are preserved, including the distinctions
between deleted paths, moved paths, unavailable hosts or mounts, transient
filesystem failures, live ownership, and concurrent recreation.
Tests: focused #970 suite 47 passed. Adjacent suites (capability role
invariants, audit reconciliation mode, control plane DB, lease lifecycle,
reconciler cleanup integration, delete-branch capability, restart coordinator,
bootstrap lock contract) 252 passed / 93 subtests. Full suite 28 failed /
6000 passed, an exact match of the pre-change baseline's 28 failing test ids
at 3f584352 (28 failed / 5960 passed).
Closes #970
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
716 lines
24 KiB
Python
716 lines
24 KiB
Python
"""Shared task→permission map for resolver and tool gates (#69).
|
|
|
|
``gitea_resolve_task_capability`` and issue-mutating MCP tools must agree on
|
|
which profile operation each task requires. This module is the single source
|
|
of truth; regression tests assert tool gates cannot drift from it.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
|
|
"create_issue": {
|
|
"permission": "gitea.issue.create",
|
|
"role": "author",
|
|
},
|
|
"comment_issue": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"close_issue": {
|
|
"permission": "gitea.issue.close",
|
|
"role": "author",
|
|
},
|
|
"claim_issue": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"mark_issue": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"lock_issue": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #790 Slice A: prove an owned author lease is still active. Strictly
|
|
# narrower than lock_issue — it can only slide a lease this exact session
|
|
# already owns, never acquire, take over, or revive one — so it gates on the
|
|
# same authority rather than introducing an operation name that every
|
|
# already-configured author profile would be missing.
|
|
"heartbeat_issue_lock": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #953: target-specific upgrade of an incomplete bootstrap lock (explicit
|
|
# operation, never a widening of lock_issue). Author-only, and the tool
|
|
# additionally proves exact-owner claimant match before writing.
|
|
"recover_incomplete_bootstrap_lock": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"gitea_recover_incomplete_bootstrap_lock": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #953: read-only lock contract inspection. Read permission only — it must
|
|
# never be able to mutate.
|
|
"inspect_issue_lock_contract": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_inspect_issue_lock_contract": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
# #860: dirty orphaned same-claimant worktree recovery (explicit operation).
|
|
"recover_dirty_orphaned_issue_worktree": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"gitea_recover_dirty_orphaned_issue_worktree": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #864: dirty-preserving same-claimant author-session rebind (dead owner PID).
|
|
# Author MCP tool path. Reconciler execute is gated inside the tool via
|
|
# authorize_reconciler_execute + role_kind checks (not this map entry).
|
|
"rebind_dirty_same_claimant_author_session": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"gitea_rebind_dirty_same_claimant_author_session": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"set_issue_labels": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #781: editing an issue title/body is issue authoring, the same authority
|
|
# every other non-create/non-close issue mutation gates on. Deliberately not
|
|
# a new operation name: introducing one would silently strip the capability
|
|
# from every already-configured author profile.
|
|
"edit_issue": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #780: retire status:pr-open after a terminal PR transition. Same label
|
|
# authority as set_issue_labels — it is a strictly narrower operation.
|
|
"cleanup_terminal_pr_labels": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"create_label": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"create_branch": {
|
|
"permission": "gitea.branch.create",
|
|
"role": "author",
|
|
},
|
|
"bootstrap_author_issue_worktree": {
|
|
"permission": "gitea.branch.create",
|
|
"role": "author",
|
|
},
|
|
"gitea_bootstrap_author_issue_worktree": {
|
|
"permission": "gitea.branch.create",
|
|
"role": "author",
|
|
},
|
|
"push_branch": {
|
|
"permission": "gitea.branch.push",
|
|
"role": "author",
|
|
},
|
|
# #812 AC20: publish an already-committed, unpublished local head so
|
|
# exact-owner lease renewal has an observable remote head to reason about.
|
|
# Same authority as any other author push — deliberately not a new
|
|
# operation name, so it cannot widen an already-configured author profile.
|
|
"publish_unpublished_branch": {
|
|
"permission": "gitea.branch.push",
|
|
"role": "author",
|
|
},
|
|
"create_pr": {
|
|
"permission": "gitea.pr.create",
|
|
"role": "author",
|
|
},
|
|
"comment_pr": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "author",
|
|
},
|
|
"close_pr": {
|
|
"permission": "gitea.pr.close",
|
|
"role": "author",
|
|
},
|
|
# Non-closing PR metadata edits (title/body/base). Closing uses close_pr.
|
|
"edit_pr": {
|
|
"permission": "gitea.pr.create",
|
|
"role": "author",
|
|
},
|
|
"gitea_edit_pr": {
|
|
"permission": "gitea.pr.create",
|
|
"role": "author",
|
|
},
|
|
"address_pr_change_requests": {
|
|
"permission": "gitea.branch.push",
|
|
"role": "author",
|
|
},
|
|
# #662: post-restart reconcile is read-only inventory + pure classification.
|
|
# Durable follow-up issue creation is a separate apply path (not this task).
|
|
"reconcile_after_restart": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_reconcile_after_restart": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
# #644: Phase 2 Web Console recovery tasks.
|
|
"clear_stale_binding": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"rebind_session_worktree": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
# The console playbook orchestrates gitea_reconcile_merged_cleanups, whose
|
|
# own gate is gitea.read (matching the existing reconcile_merged_cleanups
|
|
# entry). Declaring a stricter permission here stated a second, conflicting
|
|
# authority for one operation.
|
|
"reconcile_cleanups": {
|
|
"permission": "gitea.read",
|
|
"role": "reconciler",
|
|
},
|
|
# PR synchronization lifecycle: assess is read-only (any role with gitea.read);
|
|
# update-by-merge is author-only and mutates the PR head via Gitea API.
|
|
"assess_pr_sync_status": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_assess_pr_sync_status": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"update_pr_branch_by_merge": {
|
|
"permission": "gitea.branch.push",
|
|
"role": "author",
|
|
},
|
|
"gitea_update_pr_branch_by_merge": {
|
|
"permission": "gitea.branch.push",
|
|
"role": "author",
|
|
},
|
|
"review_pr": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"submit_pr_review": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"merge_pr": {
|
|
"permission": "gitea.pr.merge",
|
|
"role": "merger",
|
|
},
|
|
"acquire_reviewer_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reviewer",
|
|
},
|
|
"gitea_acquire_reviewer_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reviewer",
|
|
},
|
|
# #695 AC8: controller quarantine of contaminated formal reviews.
|
|
# Apply path posts an append-only forensic audit comment (pr.comment).
|
|
"quarantine_contaminated_review": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_quarantine_contaminated_review": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reconciler",
|
|
},
|
|
"adopt_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
"gitea_adopt_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
"acquire_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
"gitea_acquire_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
# #742: owner-session terminal release/abandon of a merger-held lease when
|
|
# the merge does not occur. Apply path posts an append-only terminal lease
|
|
# marker (gitea.pr.comment); merger-only, never a reviewer path.
|
|
"release_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
"gitea_release_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
# #691: guarded non-owner cleanup of obsolete comment-backed reviewer leases.
|
|
# Apply path posts lease release + audit comments (gitea.pr.comment).
|
|
"cleanup_obsolete_reviewer_comment_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reviewer",
|
|
},
|
|
"gitea_cleanup_obsolete_reviewer_comment_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reviewer",
|
|
},
|
|
# #745: post-merge moot reviewer-lease cleanup is reconciler-owned. The
|
|
# apply path posts an append-only terminal `phase: released` lease marker
|
|
# (gitea.pr.comment), so holding the comment permission alone must not
|
|
# authorize it — author, reviewer and merger fail closed on the role gate
|
|
# even though their profiles carry gitea.pr.comment. The read-only
|
|
# `apply=false` assessment deliberately stays reachable under gitea.read
|
|
# inside the tool (the same convention as cleanup_stale_review_decision_lock
|
|
# below), so any namespace can diagnose a stuck lease; only apply requires
|
|
# this task plus the reconciler role.
|
|
"cleanup_post_merge_moot_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_cleanup_post_merge_moot_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reconciler",
|
|
},
|
|
"blind_pr_queue_review": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"pr_queue_cleanup": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"pr-queue-cleanup": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"request_changes_pr": {
|
|
"permission": "gitea.pr.request_changes",
|
|
"role": "reviewer",
|
|
},
|
|
"approve_pr": {
|
|
"permission": "gitea.pr.approve",
|
|
"role": "reviewer",
|
|
},
|
|
# #594: clear durable #332 decision lock only when last terminal PR is
|
|
# already merged/closed (moot). Apply path requires reviewer review
|
|
# permission; assessment itself uses gitea.read inside the tool.
|
|
"cleanup_stale_review_decision_lock": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"gitea_cleanup_stale_review_decision_lock": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
# #693: read-only classification of durable decision locks (incl. open PRs).
|
|
"diagnose_review_decision_lock": {
|
|
"permission": "gitea.read",
|
|
"role": "reviewer",
|
|
},
|
|
"gitea_diagnose_review_decision_lock": {
|
|
"permission": "gitea.read",
|
|
"role": "reviewer",
|
|
},
|
|
"authorize_review_correction": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"gitea_authorize_review_correction": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
# #709: truthful absence-of-proof recovery (server-side auth + record + consume).
|
|
# Dedicated mutation capability — gitea.read is insufficient (review 434 F1).
|
|
"issue_irrecoverable_provenance_authorization": {
|
|
"permission": "gitea.decision_lock.irrecoverable_recovery",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_issue_irrecoverable_provenance_authorization": {
|
|
"permission": "gitea.decision_lock.irrecoverable_recovery",
|
|
"role": "reconciler",
|
|
},
|
|
"record_irrecoverable_decision_lock_provenance": {
|
|
"permission": "gitea.decision_lock.irrecoverable_recovery",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_record_irrecoverable_decision_lock_provenance": {
|
|
"permission": "gitea.decision_lock.irrecoverable_recovery",
|
|
"role": "reconciler",
|
|
},
|
|
"consume_irrecoverable_decision_lock_provenance": {
|
|
"permission": "gitea.pr.merge",
|
|
"role": "merger",
|
|
},
|
|
"gitea_consume_irrecoverable_decision_lock_provenance": {
|
|
"permission": "gitea.pr.merge",
|
|
"role": "merger",
|
|
},
|
|
# #729: delete_branch is reconciler-owned. gitea.branch.delete is granted
|
|
# only to the reconciler profile, so the resolver must classify this task as
|
|
# reconciler (previously "author", which no delete-capable profile held).
|
|
# Raw gitea_delete_branch still redirects reconciler to the guarded
|
|
# gitea_cleanup_merged_pr_branch path (#514/#687); author/reviewer/merger
|
|
# stay denied by both the permission gate and this role gate.
|
|
"delete_branch": {
|
|
"permission": "gitea.branch.delete",
|
|
"role": "reconciler",
|
|
},
|
|
"cleanup_merged_pr_branch": {
|
|
"permission": "gitea.branch.delete",
|
|
"role": "reconciler",
|
|
},
|
|
"commit_files": {
|
|
"permission": "gitea.repo.commit",
|
|
"role": "author",
|
|
},
|
|
"gitea_commit_files": {
|
|
"permission": "gitea.repo.commit",
|
|
"role": "author",
|
|
},
|
|
"reconcile_merged_cleanups": {
|
|
"permission": "gitea.read",
|
|
"role": "reconciler",
|
|
},
|
|
"reconciliation_cleanup": {
|
|
"permission": "gitea.branch.delete",
|
|
"role": "reconciler",
|
|
},
|
|
# #970: auditing missing worktree bindings is read-only; retiring one is a
|
|
# control-plane cleanup mutation and carries the same reconciler-only
|
|
# authority as any other reconciliation cleanup (review 644 B2).
|
|
"audit_missing_worktree_bindings": {
|
|
"permission": "gitea.read",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_audit_missing_worktree_bindings": {
|
|
"permission": "gitea.read",
|
|
"role": "reconciler",
|
|
},
|
|
"reconcile_missing_worktree_bindings": {
|
|
"permission": "gitea.branch.delete",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_reconcile_missing_worktree_bindings": {
|
|
"permission": "gitea.branch.delete",
|
|
"role": "reconciler",
|
|
},
|
|
"work_issue": {
|
|
"permission": "gitea.pr.create",
|
|
"role": "author",
|
|
},
|
|
"work-issue": {
|
|
"permission": "gitea.pr.create",
|
|
"role": "author",
|
|
},
|
|
# #600: workers and controller may call with gitea.read; role-scoped workers
|
|
# pass role=author|reviewer|merger|reconciler. Cross-role routing is the
|
|
# controller default (#840). The canonical generic queue *task type* is
|
|
# process_work_queue (controller-only below).
|
|
"allocate_next_work": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_allocate_next_work": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
# #840: documented generic queue task — controller routes only.
|
|
"process_work_queue": {
|
|
"permission": "gitea.read",
|
|
"role": "controller",
|
|
},
|
|
"process-work-queue": {
|
|
"permission": "gitea.read",
|
|
"role": "controller",
|
|
},
|
|
"cross_role_allocate": {
|
|
"permission": "gitea.read",
|
|
"role": "controller",
|
|
},
|
|
|
|
# #642: sanctioned host-daemon lifecycle controls. Deliberately *not* a
|
|
# ``gitea.*`` operation — restarting an MCP namespace is a host action, not
|
|
# a Gitea API call, and no configured Gitea profile should be able to
|
|
# satisfy it by accident. Authority comes from the console RBAC model plus
|
|
# out-of-band operator authorization (#630); these entries exist so the
|
|
# console cannot invent an authority the capability layer never declared.
|
|
"restart_namespace": {
|
|
"permission": "runtime.restart_namespace",
|
|
"role": "controller",
|
|
},
|
|
"reload_namespace": {
|
|
"permission": "runtime.reload_namespace",
|
|
"role": "controller",
|
|
},
|
|
|
|
# #601 first-class lease lifecycle — inspect/list need read; mutations gate on
|
|
# ownership in the control-plane DB (not a separate Gitea write permission).
|
|
"list_workflow_leases": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_list_workflow_leases": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"inspect_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_inspect_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"adopt_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_adopt_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"release_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_release_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"expire_workflow_leases": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_expire_workflow_leases": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"abandon_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_abandon_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"reclaim_expired_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_reclaim_expired_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
# #612 incident bridge — reconcile uses create_issue for apply;
|
|
# dry-run needs read only. Tools gate apply paths themselves.
|
|
"observability_reconcile_incident": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_observability_reconcile_incident": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"observability_list_projects": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_observability_list_projects": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"observability_link_issue": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_observability_link_issue": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
|
|
|
|
"reconcile_landed_pr": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"reconcile-landed-pr": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"reconcile_already_landed_pr": {
|
|
"permission": "gitea.pr.close",
|
|
"role": "reconciler",
|
|
},
|
|
# #309: dedicated reconciler path for already-landed open PRs. Exact
|
|
# close capabilities only — never review/approve/request_changes/merge.
|
|
"reconcile_close_landed_pr": {
|
|
"permission": "gitea.pr.close",
|
|
"role": "reconciler",
|
|
},
|
|
"reconcile_close_landed_issue": {
|
|
"permission": "gitea.issue.close",
|
|
"role": "reconciler",
|
|
},
|
|
"reconcile_close_superseded_pr": {
|
|
"permission": "gitea.pr.close",
|
|
"role": "reconciler",
|
|
},
|
|
"reconcile_close_satisfied_issue": {
|
|
"permission": "gitea.issue.close",
|
|
"role": "reconciler",
|
|
},
|
|
"reconcile_create_followup_issue": {
|
|
"permission": "gitea.issue.create",
|
|
"role": "reconciler",
|
|
},
|
|
"post_heartbeat": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"reconcile_issue_claims": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"cleanup_stale_claims": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
|
|
# #651 console analytics ingest — control-plane DB write, not a Gitea API
|
|
# call. Authority comes from console RBAC (operator+) plus phase gating;
|
|
# permission string is a non-Gitea runtime capability so no Gitea profile
|
|
# can satisfy it by accident.
|
|
"record_analytics_usage": {
|
|
"permission": "runtime.record_analytics_usage",
|
|
"role": "author",
|
|
},
|
|
}
|
|
|
|
|
|
# A reviewer lease is the first mutation in the canonical ``review_pr``
|
|
# workflow, so the already-resolved review capability is valid for that one
|
|
# narrower transition. Keep this directed and explicit: lease acquisition
|
|
# does not authorize a review verdict, and reviewer proof never authorizes a
|
|
# merger lease (#763).
|
|
_PREFLIGHT_TASK_TRANSITIONS = frozenset({
|
|
("review_pr", "acquire_reviewer_pr_lease"),
|
|
# #850: native author issue worktree bootstrap
|
|
("work_issue", "bootstrap_author_issue_worktree"),
|
|
("bootstrap_author_issue_worktree", "lock_issue"),
|
|
# #860: dirty-orphan recovery and related work_issue transitions (master)
|
|
("work_issue", "lock_issue"),
|
|
("work_issue", "recover_dirty_orphaned_issue_worktree"),
|
|
("work_issue", "gitea_recover_dirty_orphaned_issue_worktree"),
|
|
("work_issue", "commit_files"),
|
|
("work_issue", "gitea_commit_files"),
|
|
})
|
|
|
|
|
|
def _canonical_preflight_task(task: str | None) -> str:
|
|
"""Normalize only declared ``gitea_`` aliases for preflight comparison."""
|
|
value = (task or "").strip()
|
|
if value.startswith("gitea_") and value[6:] in TASK_CAPABILITY_MAP:
|
|
return value[6:]
|
|
return value
|
|
|
|
|
|
def preflight_task_matches(
|
|
resolved_task: str | None,
|
|
mutation_task: str | None,
|
|
) -> bool:
|
|
"""Return whether capability proof authorizes this mutation transition."""
|
|
resolved = _canonical_preflight_task(resolved_task)
|
|
mutation = _canonical_preflight_task(mutation_task)
|
|
if not resolved or not mutation:
|
|
return False
|
|
return resolved == mutation or (resolved, mutation) in _PREFLIGHT_TASK_TRANSITIONS
|
|
|
|
|
|
# Tasks for which permission alone is insufficient: the active/configured
|
|
# profile's declared role must also match the task role. This is the complete
|
|
# resolver set from master at the #723 reconstruction point, shared with
|
|
# runtime reporting so those two authorities cannot drift again.
|
|
ROLE_EXCLUSIVE_TASKS: frozenset[str] = frozenset(
|
|
{
|
|
"acquire_reviewer_pr_lease",
|
|
"gitea_acquire_reviewer_pr_lease",
|
|
"review_pr",
|
|
"approve_pr",
|
|
"request_changes_pr",
|
|
"blind_pr_queue_review",
|
|
"pr_queue_cleanup",
|
|
"pr-queue-cleanup",
|
|
"merge_pr",
|
|
"acquire_merger_pr_lease",
|
|
"gitea_acquire_merger_pr_lease",
|
|
"adopt_merger_pr_lease",
|
|
"gitea_adopt_merger_pr_lease",
|
|
"release_merger_pr_lease",
|
|
"gitea_release_merger_pr_lease",
|
|
"create_branch",
|
|
"push_branch",
|
|
"bootstrap_author_issue_worktree",
|
|
"gitea_bootstrap_author_issue_worktree",
|
|
"publish_unpublished_branch",
|
|
"create_pr",
|
|
"commit_files",
|
|
"gitea_commit_files",
|
|
"address_pr_change_requests",
|
|
"update_pr_branch_by_merge",
|
|
"gitea_update_pr_branch_by_merge",
|
|
"delete_branch",
|
|
"cleanup_merged_pr_branch",
|
|
"reconciliation_cleanup",
|
|
"reconcile_missing_worktree_bindings",
|
|
"gitea_reconcile_missing_worktree_bindings",
|
|
"work_issue",
|
|
"work-issue",
|
|
}
|
|
)
|
|
|
|
# Issue-mutating MCP tools and their resolver task keys.
|
|
ISSUE_MUTATION_TOOL_TASKS: dict[str, str] = {
|
|
"gitea_create_issue": "create_issue",
|
|
"gitea_close_issue": "close_issue",
|
|
"gitea_edit_issue": "edit_issue",
|
|
"gitea_create_issue_comment": "comment_issue",
|
|
"gitea_mark_issue": "mark_issue",
|
|
"gitea_set_issue_labels": "set_issue_labels",
|
|
"gitea_cleanup_terminal_pr_labels": "cleanup_terminal_pr_labels",
|
|
"gitea_create_label": "create_label",
|
|
"gitea_bootstrap_author_issue_worktree": "bootstrap_author_issue_worktree",
|
|
"gitea_commit_files": "commit_files",
|
|
}
|
|
|
|
|
|
def required_permission(task: str) -> str:
|
|
"""Return the canonical operation a *task* requires (fail closed)."""
|
|
try:
|
|
return TASK_CAPABILITY_MAP[task]["permission"]
|
|
except KeyError as exc:
|
|
raise KeyError(f"Unknown task/action: {task!r} (fail closed)") from exc
|
|
|
|
|
|
def required_role(task: str) -> str:
|
|
"""Return author/reviewer role kind for *task* (fail closed)."""
|
|
try:
|
|
return TASK_CAPABILITY_MAP[task]["role"]
|
|
except KeyError as exc:
|
|
raise KeyError(f"Unknown task/action: {task!r} (fail closed)") from exc
|
|
|
|
|
|
def tool_required_permission(tool_name: str) -> str:
|
|
"""Return the operation an issue-mutating tool must gate on."""
|
|
return required_permission(ISSUE_MUTATION_TOOL_TASKS[tool_name])
|