sysadmin
e344e68a13
Addresses the three blocking findings in review 657 on PR #982 and nothing
else.
B1 — apply was authorized by gitea.read
---------------------------------------
Plan and apply shared the observational permission class, so any profile that
could look could also destroy; the mutation landing in the local control-plane
registry rather than in Gitea makes it no less a mutation.
Apply now requires its own capability, gitea.worker_registry.retire, checked at
entry and re-resolved immediately before the registry mutation. Plan stays on
gitea.read. No profile holds the new permission by default, so author,
reviewer, merger, and read-only profiles fail closed on the permission itself
rather than on the role check alone; the controller/reconciler role restriction
remains as defence in depth. Granting it is a deliberate operator edit to
profiles.json, and removing it revokes apply completely. No new Gitea write
permission is introduced and no author permission is broadened.
B2 — complete legacy rows could be retired without identity proof
-----------------------------------------------------------------
"Incomplete identity" previously meant only that pre-existing columns were
null, which a legacy-pid row satisfies trivially. Retirement now requires an
affirmative two-part proof: launcher-minted inst- attribution, plus fencing
evidence (host_id, boot_id, process_start_time) that turns a bare pid into a
statement about one process incarnation.
New mcp_process_fencing supplies those probes; every one returns None rather
than guessing, and None always preserves. Rows written before these columns
existed, and rows on legacy instance identities, are preserved permanently —
they are retired only after re-registering under a trusted identity. That
legacy rows would otherwise remain outstanding is explicitly not treated as
grounds for a weaker proof. A live pid stays an absolute block even across a
boot boundary, and pid reuse is reported distinctly from a live worker.
B3 — lease and OS liveness sat outside the registry transaction
---------------------------------------------------------------
BEGIN IMMEDIATE locks the worker registry only, and the per-target loop runs
after revalidation, so a lease acquired or a pid revived in between would go
unnoticed — the registry-column guard cannot catch it because no registry
column changed.
Two mechanisms now close that window, both applied per target immediately
before its own write: an external_fence_fn version token over active leases,
captured inside the transaction before the authoritative read and re-compared
before every guarded UPDATE (movement aborts the whole transaction; an
unreadable lease store raises rather than comparing equal), and a liveness_fn
re-probe that must affirmatively re-establish that this exact process is gone,
comparing process_start_time so a reused pid is refused. Omitting the re-probe
retires nothing rather than proceeding unfenced. The guarded UPDATE also
asserts the fencing triple is unchanged, and all three columns participate in
the CAS token.
Preserved from the accepted work: registry_fingerprint still excludes
observation time and is order- and numeric-typing stable, plan still mutates
nothing, drift still retires zero, retired rows stay historical, and ordinary
author operations remain ungated by fleet state.
Tests: tests/test_issue_980_stale_worker_retirement.py 87 passed, 46 subtests
(was 40 passed, 23 subtests), covering all three blockers' required
regressions. Adjacent suites (#980, #978, #975, #948, task-capability role
invariants) 242 passed, 156 subtests. Full suite from the branch worktree
28 failed, 6253 passed, 6 skipped, 1152 subtests; master baseline at
108cbfa173 from branches/baseline-980-108cbfa 28 failed, 6166 passed, 6
skipped, 1106 subtests. The failing sets are identical under comm, so zero
regressions and zero masked pre-existing failures; the +87 passing delta is
this branch's tests.
No live worker-registry row was retired — every test uses a throwaway SQLite
database. BAA, issue #981, PR #906, issue #650, review 624, unrelated branches
and worktrees, profiles, configuration, credentials, sessions, and running
processes were not touched.
Refs #980
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
766 lines
27 KiB
Python
766 lines
27 KiB
Python
"""Shared task→permission map for resolver and tool gates (#69).
|
|
|
|
``gitea_resolve_task_capability`` and issue-mutating MCP tools must agree on
|
|
which profile operation each task requires. This module is the single source
|
|
of truth; regression tests assert tool gates cannot drift from it.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
|
|
"create_issue": {
|
|
"permission": "gitea.issue.create",
|
|
"role": "author",
|
|
},
|
|
"comment_issue": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"close_issue": {
|
|
"permission": "gitea.issue.close",
|
|
"role": "author",
|
|
},
|
|
"claim_issue": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"mark_issue": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"lock_issue": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #790 Slice A: prove an owned author lease is still active. Strictly
|
|
# narrower than lock_issue — it can only slide a lease this exact session
|
|
# already owns, never acquire, take over, or revive one — so it gates on the
|
|
# same authority rather than introducing an operation name that every
|
|
# already-configured author profile would be missing.
|
|
"heartbeat_issue_lock": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #953: target-specific upgrade of an incomplete bootstrap lock (explicit
|
|
# operation, never a widening of lock_issue). Author-only, and the tool
|
|
# additionally proves exact-owner claimant match before writing.
|
|
"recover_incomplete_bootstrap_lock": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"gitea_recover_incomplete_bootstrap_lock": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #953: read-only lock contract inspection. Read permission only — it must
|
|
# never be able to mutate.
|
|
"inspect_issue_lock_contract": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_inspect_issue_lock_contract": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
# #860: dirty orphaned same-claimant worktree recovery (explicit operation).
|
|
"recover_dirty_orphaned_issue_worktree": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"gitea_recover_dirty_orphaned_issue_worktree": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #864: dirty-preserving same-claimant author-session rebind (dead owner PID).
|
|
# Author MCP tool path. Reconciler execute is gated inside the tool via
|
|
# authorize_reconciler_execute + role_kind checks (not this map entry).
|
|
"rebind_dirty_same_claimant_author_session": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"gitea_rebind_dirty_same_claimant_author_session": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"set_issue_labels": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #781: editing an issue title/body is issue authoring, the same authority
|
|
# every other non-create/non-close issue mutation gates on. Deliberately not
|
|
# a new operation name: introducing one would silently strip the capability
|
|
# from every already-configured author profile.
|
|
"edit_issue": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
# #780: retire status:pr-open after a terminal PR transition. Same label
|
|
# authority as set_issue_labels — it is a strictly narrower operation.
|
|
"cleanup_terminal_pr_labels": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"create_label": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"create_branch": {
|
|
"permission": "gitea.branch.create",
|
|
"role": "author",
|
|
},
|
|
"bootstrap_author_issue_worktree": {
|
|
"permission": "gitea.branch.create",
|
|
"role": "author",
|
|
},
|
|
"gitea_bootstrap_author_issue_worktree": {
|
|
"permission": "gitea.branch.create",
|
|
"role": "author",
|
|
},
|
|
"push_branch": {
|
|
"permission": "gitea.branch.push",
|
|
"role": "author",
|
|
},
|
|
# #812 AC20: publish an already-committed, unpublished local head so
|
|
# exact-owner lease renewal has an observable remote head to reason about.
|
|
# Same authority as any other author push — deliberately not a new
|
|
# operation name, so it cannot widen an already-configured author profile.
|
|
"publish_unpublished_branch": {
|
|
"permission": "gitea.branch.push",
|
|
"role": "author",
|
|
},
|
|
"create_pr": {
|
|
"permission": "gitea.pr.create",
|
|
"role": "author",
|
|
},
|
|
"comment_pr": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "author",
|
|
},
|
|
"close_pr": {
|
|
"permission": "gitea.pr.close",
|
|
"role": "author",
|
|
},
|
|
# Non-closing PR metadata edits (title/body/base). Closing uses close_pr.
|
|
"edit_pr": {
|
|
"permission": "gitea.pr.create",
|
|
"role": "author",
|
|
},
|
|
"gitea_edit_pr": {
|
|
"permission": "gitea.pr.create",
|
|
"role": "author",
|
|
},
|
|
"address_pr_change_requests": {
|
|
"permission": "gitea.branch.push",
|
|
"role": "author",
|
|
},
|
|
# #662: post-restart reconcile is read-only inventory + pure classification.
|
|
# Durable follow-up issue creation is a separate apply path (not this task).
|
|
"reconcile_after_restart": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_reconcile_after_restart": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
# #978: instance-level fleet identity/health snapshot. gitea.read is the
|
|
# operation gate; the tool additionally restricts role_kind to
|
|
# controller|reconciler so author/reviewer/merger cannot use it as a
|
|
# mutation surface and no unrelated write permission is introduced.
|
|
"snapshot_instance_fleet": {
|
|
"permission": "gitea.read",
|
|
"role": "controller",
|
|
},
|
|
"gitea_snapshot_instance_fleet": {
|
|
"permission": "gitea.read",
|
|
"role": "controller",
|
|
},
|
|
# #980: CAS-protected retirement of conclusively stale worker
|
|
# registrations.
|
|
#
|
|
# Planning is observational and stays on ``gitea.read``: it opens no
|
|
# transaction, writes nothing, and returns only what a fleet snapshot
|
|
# already exposes to the same roles.
|
|
#
|
|
# Applying is a mutation and review 657 B1 established that ``gitea.read``
|
|
# cannot authorize it. The mutation landing in the local control-plane
|
|
# registry rather than in Gitea makes it *no less* a mutation, and sharing
|
|
# an observational permission class with plan meant any profile that could
|
|
# look could also destroy. It now requires its own permission,
|
|
# ``gitea.worker_registry.retire``, which no profile holds by default — so
|
|
# author, reviewer, merger, and ordinary read-only profiles fail closed on
|
|
# the permission itself rather than relying on the role check alone. The
|
|
# role restriction (controller/reconciler), runtime parity, cohort
|
|
# uniqueness, and the exact registry + candidate fingerprints all remain,
|
|
# and are now defence in depth behind the capability rather than a
|
|
# substitute for it.
|
|
#
|
|
# Granting the permission is a deliberate operator act in profiles.json;
|
|
# removing it from a profile immediately and completely revokes apply.
|
|
"plan_stale_worker_retirement": {
|
|
"permission": "gitea.read",
|
|
"role": "controller",
|
|
},
|
|
"gitea_plan_stale_worker_retirement": {
|
|
"permission": "gitea.read",
|
|
"role": "controller",
|
|
},
|
|
"apply_stale_worker_retirement": {
|
|
"permission": "gitea.worker_registry.retire",
|
|
"role": "controller",
|
|
},
|
|
"gitea_apply_stale_worker_retirement": {
|
|
"permission": "gitea.worker_registry.retire",
|
|
"role": "controller",
|
|
},
|
|
# #644: Phase 2 Web Console recovery tasks.
|
|
"clear_stale_binding": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"rebind_session_worktree": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
# The console playbook orchestrates gitea_reconcile_merged_cleanups, whose
|
|
# own gate is gitea.read (matching the existing reconcile_merged_cleanups
|
|
# entry). Declaring a stricter permission here stated a second, conflicting
|
|
# authority for one operation.
|
|
"reconcile_cleanups": {
|
|
"permission": "gitea.read",
|
|
"role": "reconciler",
|
|
},
|
|
# PR synchronization lifecycle: assess is read-only (any role with gitea.read);
|
|
# update-by-merge is author-only and mutates the PR head via Gitea API.
|
|
"assess_pr_sync_status": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_assess_pr_sync_status": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"update_pr_branch_by_merge": {
|
|
"permission": "gitea.branch.push",
|
|
"role": "author",
|
|
},
|
|
"gitea_update_pr_branch_by_merge": {
|
|
"permission": "gitea.branch.push",
|
|
"role": "author",
|
|
},
|
|
"review_pr": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"submit_pr_review": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"merge_pr": {
|
|
"permission": "gitea.pr.merge",
|
|
"role": "merger",
|
|
},
|
|
"acquire_reviewer_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reviewer",
|
|
},
|
|
"gitea_acquire_reviewer_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reviewer",
|
|
},
|
|
# #695 AC8: controller quarantine of contaminated formal reviews.
|
|
# Apply path posts an append-only forensic audit comment (pr.comment).
|
|
"quarantine_contaminated_review": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_quarantine_contaminated_review": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reconciler",
|
|
},
|
|
"adopt_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
"gitea_adopt_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
"acquire_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
"gitea_acquire_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
# #742: owner-session terminal release/abandon of a merger-held lease when
|
|
# the merge does not occur. Apply path posts an append-only terminal lease
|
|
# marker (gitea.pr.comment); merger-only, never a reviewer path.
|
|
"release_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
"gitea_release_merger_pr_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "merger",
|
|
},
|
|
# #691: guarded non-owner cleanup of obsolete comment-backed reviewer leases.
|
|
# Apply path posts lease release + audit comments (gitea.pr.comment).
|
|
"cleanup_obsolete_reviewer_comment_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reviewer",
|
|
},
|
|
"gitea_cleanup_obsolete_reviewer_comment_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reviewer",
|
|
},
|
|
# #745: post-merge moot reviewer-lease cleanup is reconciler-owned. The
|
|
# apply path posts an append-only terminal `phase: released` lease marker
|
|
# (gitea.pr.comment), so holding the comment permission alone must not
|
|
# authorize it — author, reviewer and merger fail closed on the role gate
|
|
# even though their profiles carry gitea.pr.comment. The read-only
|
|
# `apply=false` assessment deliberately stays reachable under gitea.read
|
|
# inside the tool (the same convention as cleanup_stale_review_decision_lock
|
|
# below), so any namespace can diagnose a stuck lease; only apply requires
|
|
# this task plus the reconciler role.
|
|
"cleanup_post_merge_moot_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_cleanup_post_merge_moot_lease": {
|
|
"permission": "gitea.pr.comment",
|
|
"role": "reconciler",
|
|
},
|
|
"blind_pr_queue_review": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"pr_queue_cleanup": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"pr-queue-cleanup": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"request_changes_pr": {
|
|
"permission": "gitea.pr.request_changes",
|
|
"role": "reviewer",
|
|
},
|
|
"approve_pr": {
|
|
"permission": "gitea.pr.approve",
|
|
"role": "reviewer",
|
|
},
|
|
# #594: clear durable #332 decision lock only when last terminal PR is
|
|
# already merged/closed (moot). Apply path requires reviewer review
|
|
# permission; assessment itself uses gitea.read inside the tool.
|
|
"cleanup_stale_review_decision_lock": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"gitea_cleanup_stale_review_decision_lock": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
# #693: read-only classification of durable decision locks (incl. open PRs).
|
|
"diagnose_review_decision_lock": {
|
|
"permission": "gitea.read",
|
|
"role": "reviewer",
|
|
},
|
|
"gitea_diagnose_review_decision_lock": {
|
|
"permission": "gitea.read",
|
|
"role": "reviewer",
|
|
},
|
|
"authorize_review_correction": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
"gitea_authorize_review_correction": {
|
|
"permission": "gitea.pr.review",
|
|
"role": "reviewer",
|
|
},
|
|
# #709: truthful absence-of-proof recovery (server-side auth + record + consume).
|
|
# Dedicated mutation capability — gitea.read is insufficient (review 434 F1).
|
|
"issue_irrecoverable_provenance_authorization": {
|
|
"permission": "gitea.decision_lock.irrecoverable_recovery",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_issue_irrecoverable_provenance_authorization": {
|
|
"permission": "gitea.decision_lock.irrecoverable_recovery",
|
|
"role": "reconciler",
|
|
},
|
|
"record_irrecoverable_decision_lock_provenance": {
|
|
"permission": "gitea.decision_lock.irrecoverable_recovery",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_record_irrecoverable_decision_lock_provenance": {
|
|
"permission": "gitea.decision_lock.irrecoverable_recovery",
|
|
"role": "reconciler",
|
|
},
|
|
"consume_irrecoverable_decision_lock_provenance": {
|
|
"permission": "gitea.pr.merge",
|
|
"role": "merger",
|
|
},
|
|
"gitea_consume_irrecoverable_decision_lock_provenance": {
|
|
"permission": "gitea.pr.merge",
|
|
"role": "merger",
|
|
},
|
|
# #729: delete_branch is reconciler-owned. gitea.branch.delete is granted
|
|
# only to the reconciler profile, so the resolver must classify this task as
|
|
# reconciler (previously "author", which no delete-capable profile held).
|
|
# Raw gitea_delete_branch still redirects reconciler to the guarded
|
|
# gitea_cleanup_merged_pr_branch path (#514/#687); author/reviewer/merger
|
|
# stay denied by both the permission gate and this role gate.
|
|
"delete_branch": {
|
|
"permission": "gitea.branch.delete",
|
|
"role": "reconciler",
|
|
},
|
|
"cleanup_merged_pr_branch": {
|
|
"permission": "gitea.branch.delete",
|
|
"role": "reconciler",
|
|
},
|
|
"commit_files": {
|
|
"permission": "gitea.repo.commit",
|
|
"role": "author",
|
|
},
|
|
"gitea_commit_files": {
|
|
"permission": "gitea.repo.commit",
|
|
"role": "author",
|
|
},
|
|
"reconcile_merged_cleanups": {
|
|
"permission": "gitea.read",
|
|
"role": "reconciler",
|
|
},
|
|
"reconciliation_cleanup": {
|
|
"permission": "gitea.branch.delete",
|
|
"role": "reconciler",
|
|
},
|
|
# #970: auditing missing worktree bindings is read-only; retiring one is a
|
|
# control-plane cleanup mutation and carries the same reconciler-only
|
|
# authority as any other reconciliation cleanup (review 644 B2).
|
|
"audit_missing_worktree_bindings": {
|
|
"permission": "gitea.read",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_audit_missing_worktree_bindings": {
|
|
"permission": "gitea.read",
|
|
"role": "reconciler",
|
|
},
|
|
"reconcile_missing_worktree_bindings": {
|
|
"permission": "gitea.branch.delete",
|
|
"role": "reconciler",
|
|
},
|
|
"gitea_reconcile_missing_worktree_bindings": {
|
|
"permission": "gitea.branch.delete",
|
|
"role": "reconciler",
|
|
},
|
|
"work_issue": {
|
|
"permission": "gitea.pr.create",
|
|
"role": "author",
|
|
},
|
|
"work-issue": {
|
|
"permission": "gitea.pr.create",
|
|
"role": "author",
|
|
},
|
|
# #600: workers and controller may call with gitea.read; role-scoped workers
|
|
# pass role=author|reviewer|merger|reconciler. Cross-role routing is the
|
|
# controller default (#840). The canonical generic queue *task type* is
|
|
# process_work_queue (controller-only below).
|
|
"allocate_next_work": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_allocate_next_work": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
# #840: documented generic queue task — controller routes only.
|
|
"process_work_queue": {
|
|
"permission": "gitea.read",
|
|
"role": "controller",
|
|
},
|
|
"process-work-queue": {
|
|
"permission": "gitea.read",
|
|
"role": "controller",
|
|
},
|
|
"cross_role_allocate": {
|
|
"permission": "gitea.read",
|
|
"role": "controller",
|
|
},
|
|
|
|
# #642: sanctioned host-daemon lifecycle controls. Deliberately *not* a
|
|
# ``gitea.*`` operation — restarting an MCP namespace is a host action, not
|
|
# a Gitea API call, and no configured Gitea profile should be able to
|
|
# satisfy it by accident. Authority comes from the console RBAC model plus
|
|
# out-of-band operator authorization (#630); these entries exist so the
|
|
# console cannot invent an authority the capability layer never declared.
|
|
"restart_namespace": {
|
|
"permission": "runtime.restart_namespace",
|
|
"role": "controller",
|
|
},
|
|
"reload_namespace": {
|
|
"permission": "runtime.reload_namespace",
|
|
"role": "controller",
|
|
},
|
|
|
|
# #601 first-class lease lifecycle — inspect/list need read; mutations gate on
|
|
# ownership in the control-plane DB (not a separate Gitea write permission).
|
|
"list_workflow_leases": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_list_workflow_leases": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"inspect_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_inspect_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"adopt_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_adopt_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"release_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_release_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"expire_workflow_leases": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_expire_workflow_leases": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"abandon_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_abandon_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"reclaim_expired_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_reclaim_expired_workflow_lease": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
# #612 incident bridge — reconcile uses create_issue for apply;
|
|
# dry-run needs read only. Tools gate apply paths themselves.
|
|
"observability_reconcile_incident": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_observability_reconcile_incident": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"observability_list_projects": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_observability_list_projects": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"observability_link_issue": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"gitea_observability_link_issue": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
|
|
|
|
"reconcile_landed_pr": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"reconcile-landed-pr": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"reconcile_already_landed_pr": {
|
|
"permission": "gitea.pr.close",
|
|
"role": "reconciler",
|
|
},
|
|
# #309: dedicated reconciler path for already-landed open PRs. Exact
|
|
# close capabilities only — never review/approve/request_changes/merge.
|
|
"reconcile_close_landed_pr": {
|
|
"permission": "gitea.pr.close",
|
|
"role": "reconciler",
|
|
},
|
|
"reconcile_close_landed_issue": {
|
|
"permission": "gitea.issue.close",
|
|
"role": "reconciler",
|
|
},
|
|
"reconcile_close_superseded_pr": {
|
|
"permission": "gitea.pr.close",
|
|
"role": "reconciler",
|
|
},
|
|
"reconcile_close_satisfied_issue": {
|
|
"permission": "gitea.issue.close",
|
|
"role": "reconciler",
|
|
},
|
|
"reconcile_create_followup_issue": {
|
|
"permission": "gitea.issue.create",
|
|
"role": "reconciler",
|
|
},
|
|
"post_heartbeat": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
"reconcile_issue_claims": {
|
|
"permission": "gitea.read",
|
|
"role": "author",
|
|
},
|
|
"cleanup_stale_claims": {
|
|
"permission": "gitea.issue.comment",
|
|
"role": "author",
|
|
},
|
|
|
|
# #651 console analytics ingest — control-plane DB write, not a Gitea API
|
|
# call. Authority comes from console RBAC (operator+) plus phase gating;
|
|
# permission string is a non-Gitea runtime capability so no Gitea profile
|
|
# can satisfy it by accident.
|
|
"record_analytics_usage": {
|
|
"permission": "runtime.record_analytics_usage",
|
|
"role": "author",
|
|
},
|
|
}
|
|
|
|
|
|
# A reviewer lease is the first mutation in the canonical ``review_pr``
|
|
# workflow, so the already-resolved review capability is valid for that one
|
|
# narrower transition. Keep this directed and explicit: lease acquisition
|
|
# does not authorize a review verdict, and reviewer proof never authorizes a
|
|
# merger lease (#763).
|
|
_PREFLIGHT_TASK_TRANSITIONS = frozenset({
|
|
("review_pr", "acquire_reviewer_pr_lease"),
|
|
# #850: native author issue worktree bootstrap
|
|
("work_issue", "bootstrap_author_issue_worktree"),
|
|
("bootstrap_author_issue_worktree", "lock_issue"),
|
|
# #860: dirty-orphan recovery and related work_issue transitions (master)
|
|
("work_issue", "lock_issue"),
|
|
("work_issue", "recover_dirty_orphaned_issue_worktree"),
|
|
("work_issue", "gitea_recover_dirty_orphaned_issue_worktree"),
|
|
("work_issue", "commit_files"),
|
|
("work_issue", "gitea_commit_files"),
|
|
})
|
|
|
|
|
|
def _canonical_preflight_task(task: str | None) -> str:
|
|
"""Normalize only declared ``gitea_`` aliases for preflight comparison."""
|
|
value = (task or "").strip()
|
|
if value.startswith("gitea_") and value[6:] in TASK_CAPABILITY_MAP:
|
|
return value[6:]
|
|
return value
|
|
|
|
|
|
def preflight_task_matches(
|
|
resolved_task: str | None,
|
|
mutation_task: str | None,
|
|
) -> bool:
|
|
"""Return whether capability proof authorizes this mutation transition."""
|
|
resolved = _canonical_preflight_task(resolved_task)
|
|
mutation = _canonical_preflight_task(mutation_task)
|
|
if not resolved or not mutation:
|
|
return False
|
|
return resolved == mutation or (resolved, mutation) in _PREFLIGHT_TASK_TRANSITIONS
|
|
|
|
|
|
# Tasks for which permission alone is insufficient: the active/configured
|
|
# profile's declared role must also match the task role. This is the complete
|
|
# resolver set from master at the #723 reconstruction point, shared with
|
|
# runtime reporting so those two authorities cannot drift again.
|
|
ROLE_EXCLUSIVE_TASKS: frozenset[str] = frozenset(
|
|
{
|
|
"acquire_reviewer_pr_lease",
|
|
"gitea_acquire_reviewer_pr_lease",
|
|
"review_pr",
|
|
"approve_pr",
|
|
"request_changes_pr",
|
|
"blind_pr_queue_review",
|
|
"pr_queue_cleanup",
|
|
"pr-queue-cleanup",
|
|
"merge_pr",
|
|
"acquire_merger_pr_lease",
|
|
"gitea_acquire_merger_pr_lease",
|
|
"adopt_merger_pr_lease",
|
|
"gitea_adopt_merger_pr_lease",
|
|
"release_merger_pr_lease",
|
|
"gitea_release_merger_pr_lease",
|
|
"create_branch",
|
|
"push_branch",
|
|
"bootstrap_author_issue_worktree",
|
|
"gitea_bootstrap_author_issue_worktree",
|
|
"publish_unpublished_branch",
|
|
"create_pr",
|
|
"commit_files",
|
|
"gitea_commit_files",
|
|
"address_pr_change_requests",
|
|
"update_pr_branch_by_merge",
|
|
"gitea_update_pr_branch_by_merge",
|
|
"delete_branch",
|
|
"cleanup_merged_pr_branch",
|
|
"reconciliation_cleanup",
|
|
"reconcile_missing_worktree_bindings",
|
|
"gitea_reconcile_missing_worktree_bindings",
|
|
"work_issue",
|
|
"work-issue",
|
|
}
|
|
)
|
|
|
|
# Issue-mutating MCP tools and their resolver task keys.
|
|
ISSUE_MUTATION_TOOL_TASKS: dict[str, str] = {
|
|
"gitea_create_issue": "create_issue",
|
|
"gitea_close_issue": "close_issue",
|
|
"gitea_edit_issue": "edit_issue",
|
|
"gitea_create_issue_comment": "comment_issue",
|
|
"gitea_mark_issue": "mark_issue",
|
|
"gitea_set_issue_labels": "set_issue_labels",
|
|
"gitea_cleanup_terminal_pr_labels": "cleanup_terminal_pr_labels",
|
|
"gitea_create_label": "create_label",
|
|
"gitea_bootstrap_author_issue_worktree": "bootstrap_author_issue_worktree",
|
|
"gitea_commit_files": "commit_files",
|
|
}
|
|
|
|
|
|
def required_permission(task: str) -> str:
|
|
"""Return the canonical operation a *task* requires (fail closed)."""
|
|
try:
|
|
return TASK_CAPABILITY_MAP[task]["permission"]
|
|
except KeyError as exc:
|
|
raise KeyError(f"Unknown task/action: {task!r} (fail closed)") from exc
|
|
|
|
|
|
def required_role(task: str) -> str:
|
|
"""Return author/reviewer role kind for *task* (fail closed)."""
|
|
try:
|
|
return TASK_CAPABILITY_MAP[task]["role"]
|
|
except KeyError as exc:
|
|
raise KeyError(f"Unknown task/action: {task!r} (fail closed)") from exc
|
|
|
|
|
|
def tool_required_permission(tool_name: str) -> str:
|
|
"""Return the operation an issue-mutating tool must gate on."""
|
|
return required_permission(ISSUE_MUTATION_TOOL_TASKS[tool_name])
|