fix(review): accept bounded Gitea supersession by default

2026-10-14 04:07:25 +00:00
parent 30d4b602f2
commit 8cd24fed2a
4 changed files with 111 additions and 10 deletions
@@ -28,7 +28,7 @@ All fields are explicit; extra/missing fields fail closed.
 - `verdict`: exactly `approve` or `request_changes`. Do not normalize malformed identifiers, hashes, states or verdicts.
 - `body`: finalized UTF-8 review body, beginning with the exact code-review marker and containing exactly one `- Verdict: \`<verdict>\`` line. `marker(plan)` creates the binding line:
  `<!-- gitea-agent:code-review/v1 owner=<owner> repository=<repository> issue=<issue> pr=<pull> head=<head> contract-sha256=<digest> -->`.
- `provider_contract`: three explicit booleans `supersede_same_author`, `retouch_dismissed`, `unordered_commit_files`, and `evidence`, a list of redacted, verifiable provider-contract/observation references. Disable exceptions lacking evidence; never set every flag simply to make a failing check pass.
+- `provider_contract`: retain the explicit booleans `supersede_same_author`, `retouch_dismissed`, `unordered_commit_files`, and `evidence`, a list of redacted, verifiable references. The first two booleans are typed v1 compatibility fields only: normal same-author supersession/retouch is verified by the fixed readback rules below whether they are `true` or `false`. They neither grant permission nor require external evidence. Do not rewrite them in a sealed plan. `unordered_commit_files` remains an opt-in exception and requires nonempty evidence; never enable unrelated normalization merely to make a failing check pass.

 Owner/repository currently support ASCII alphanumeric, underscore, dot and hyphen identifiers, with an alphanumeric/underscore first character. Unsupported names are rejected, not rewritten. Inline comments in a new review are not supported: the Native payload always explicitly sets `comments: []`.

@@ -123,7 +123,8 @@ A durable `intent.json` is fsynced **before** the POST. After timeout, partial s
 - Confirm precisely one new review and unchanged historical author/body/head/state/comments. No unrelated native review, comment, repository, head, branch, Issue contract or source change is silently accepted.
 - Validate a source Issue repository binding when the provider includes it. A PR head may legitimately belong to a fork: the fixed base repository, exact head SHA and unchanged complete PR metadata bind it, rather than incorrectly requiring every head repository to equal the base.
 - `official` is a provider merge-policy flag, not an additional verdict or role-identity requirement. Current accepted entry/publication rules require canonical role/head/contract/state and nondismissed/nonstale status; they do not require `official=True`. Changing that policy requires an explicit acceptance-criteria change.
- When explicitly supported by provider evidence, same-author official-review supersession or retouching an already-dismissed same-author formal review may change only `official`, `dismissed`, `updated_at`. Require the specific expected false/true flag transitions and a timestamp equal to this exact new review's submitted/updated timestamp. This is not a global mutable-field mask. Timestamp/pattern agreement is provider-contract consistency evidence, not proof of a unique server-side causal transaction; a coincident manual mutation matching the full permitted pattern cannot be distinguished without additional authoritative event evidence.
+- Normal same-author formal-review supersession is accepted by default, not rejected for a missing opt-in flag: an old `official=true, dismissed=false` review may become `official=false, dismissed=true`; an already-dismissed `official=false, dismissed=true` review may retain those flags with an updated timestamp. In both cases, only `official`, `dismissed`, `updated_at` may differ; the timestamp must equal this exact new review's submitted/updated timestamp. Preserve the old author, body, commit, verdict, submitted time, comments and every other field, and reject other-author changes or unexpected flag patterns. The complete before/after/exact readback is the evidence for this bounded transition; `supersede_same_author` and `retouch_dismissed` do not disable it. This is not a global mutable-field mask. Timestamp/pattern agreement is consistency evidence, not proof of a unique server-side causal transaction; a coincident manual mutation matching the full permitted pattern cannot be distinguished without additional authoritative event evidence.
+- Existing v1 plans keep their original bytes and fingerprint. A retained uncertain attempt may be reconciled through the existing same-plan, held-lease readback path under the current verifier; never change the plan, delete the journal, or retry POST to accommodate supersession. A saved-wire replay is read-only evidence and does not itself finalize a live journal.
 - Only commit `files` arrays are conditionally sorted by unique filename. File record contents, commit order, parent order and other arrays are still compared without blanket normalization. Changed-file records are compared by unique filename.
 - Source Issue/PR timestamp, PR review-count and requested-reviewer changes are narrowly tied to the exact added review; unrelated derived-state mutation fails.
 - The CLI is **saved-artifact replay**, not fresh network verification or approval authority. Its `read_only: true` output must not be presented as a newly published review. In live results `wrote` refers to a Native POST by that invocation; local journal writes still occur for no-ops.