Allow private Forgejo MCP reads in independent review #208

Merged

adrian.tkacz merged 4 commits from issue-207-private-review-mcp into develop

2026-10-11 19:37:10 +00:00

kilo commented

2026-10-11 18:23:17 +00:00

Member

Refs #207

Change

Reviewer verifies canonical Forgejo repository/current PR metadata against exact prepared local Git objects and the complete PR diff. Anonymous Git access is no longer required. Exact metadata getters replace wildcard MCP access; remote commands, writes, edits and delegation remain denied. The shared rule and source-text regression test enforce the same boundary.

Validation

uv sync --only-dev: PASS.
Final sanitized make check: PASS, full suite and basedpyright.
Focused source-contract test, explicit uv run basedpyright, whitespace checks: PASS.
Fresh independent read-only whole-PR review ordinal 4: APPROVE, no findings, exact base/HEAD. Authorized native Task fallback used after diagnosing stale startup-loaded pr-reviewer instructions; ordinals 1–3 retained as infrastructure COMMENT results.
Final canonical MCP/Git currentness matches; checkout clean.

Base: edd31326d4abe5cc282adb419cb54c78d4677ec4
Head: a7a8108160d7bf8c31cca157a2e1b3ee42e12a66

READY_TO_MERGE. Left open/unmerged as required for standalone delivery. This is a declarative Markdown workflow contract, not proof of runtime Kilo enforcement; already-loaded agent configuration may require a workspace reload.

Refs #207 ## Change Reviewer verifies canonical Forgejo repository/current PR metadata against exact prepared local Git objects and the complete PR diff. Anonymous Git access is no longer required. Exact metadata getters replace wildcard MCP access; remote commands, writes, edits and delegation remain denied. The shared rule and source-text regression test enforce the same boundary. ## Validation - `uv sync --only-dev`: PASS. - Final sanitized `make check`: PASS, full suite and basedpyright. - Focused source-contract test, explicit `uv run basedpyright`, whitespace checks: PASS. - Fresh independent read-only whole-PR review ordinal 4: APPROVE, no findings, exact base/HEAD. Authorized native Task fallback used after diagnosing stale startup-loaded pr-reviewer instructions; ordinals 1–3 retained as infrastructure COMMENT results. - Final canonical MCP/Git currentness matches; checkout clean. Base: `edd31326d4abe5cc282adb419cb54c78d4677ec4` Head: `a7a8108160d7bf8c31cca157a2e1b3ee42e12a66` READY_TO_MERGE. Left open/unmerged as required for standalone delivery. This is a declarative Markdown workflow contract, not proof of runtime Kilo enforcement; already-loaded agent configuration may require a workspace reload.

kilo added 1 commit

2026-10-11 18:23:17 +00:00