[verified] Define fail-closed worktree creator-role compatibility

2026-10-12 02:10:37 +00:00
parent 2ad836f332
commit aeab04289d
5 changed files with 62 additions and 4 deletions
@@ -1037,7 +1037,8 @@ def _validate_registered_source(plan, policy_path, deadline_monotonic):

    if (type(state) is not dict or state.get('schema') != 'gitea-agent.worktree/v1' or state.get('owner') != t['owner']
            or state.get('repository') != t['repository'] or type(state.get('issue')) is not int
-            or state['issue'] != t['issue'] or state.get('created_by_role') != 'gitea-impl-agent'
+            or state['issue'] != t['issue'] or type(state.get('created_by_role')) is not str
+            or state['created_by_role'] not in ('gitea-impl-agent', 'impl')
            or state.get('mode') != 'detached'):
        reject('worktree registration identity mismatch')