fix: allow Forgejo MCP refs for independent PR review (#86) #87

Merged

adrian.tkacz merged 1 commit from issue-86-review-mcp into develop

2026-10-11 16:16:07 +00:00

kilo commented

2026-10-11 15:58:28 +00:00

Member

Refs #86

Goal and scope

Remove anonymous Git transport as a prerequisite for independent whole-PR review. The reviewer verifies canonical repository metadata, the current open PR, and exact current base/head branch commits through read-only Forgejo MCP, then matches those SHAs to the primary-prepared clean local checkout and inspects the complete merge-base-to-HEAD diff. No anonymous Git transport is needed or used.

Reviewer independence, inherited provider/model/reasoning binding, review limits, sanitized validation, no-write permissions, normal Git ownership of repository operations, and merge authority are unchanged. The reviewer cannot write files or mutate Git/Forgejo. The semantic contract fixture accepts matching private-repository metadata and exact prepared objects without anonymous Git, and refuses missing or mismatched evidence.

Validation

Focused pytest tests/test_workflow_contract.py: 17 passed, 103 subtests passed.
Sanitized make check: 1429 passed, 85 optional skips, 103 subtests; formatting, lint, basedpyright, import boundaries, secret scan, and diff check passed.
Sanitized make package-check: passed; reproducible wheel/sdist, isolated install, CLI, intake, and source smokes passed.
Exact-head canonical CI run #2529: success.
Exact base: fa157fb3890f29cc36e48677c45a588d3b29b4d0.
Exact head: 40f3b5254069056c76e0a9bc5e3052d0f1e71b9d.
Independent whole-PR review: APPROVE, no findings, on the exact HEAD/base via canonical read-only MCP verification and the clean prepared local checkout. Review checks ran make check and make package-check successfully.
No dependencies changed. PR remains open/unmerged; this handoff does not authorize merge.

PR #85 / issue #53 were not modified. Its active checkout and HEAD were preserved, its 9/13 review history was not changed, and no PR #85 review ordinal was used.

Refs #86 ## Goal and scope Remove anonymous Git transport as a prerequisite for independent whole-PR review. The reviewer verifies canonical repository metadata, the current open PR, and exact current base/head branch commits through read-only Forgejo MCP, then matches those SHAs to the primary-prepared clean local checkout and inspects the complete merge-base-to-HEAD diff. No anonymous Git transport is needed or used. Reviewer independence, inherited provider/model/reasoning binding, review limits, sanitized validation, no-write permissions, normal Git ownership of repository operations, and merge authority are unchanged. The reviewer cannot write files or mutate Git/Forgejo. The semantic contract fixture accepts matching private-repository metadata and exact prepared objects without anonymous Git, and refuses missing or mismatched evidence. ## Validation - Focused `pytest tests/test_workflow_contract.py`: 17 passed, 103 subtests passed. - Sanitized `make check`: 1429 passed, 85 optional skips, 103 subtests; formatting, lint, basedpyright, import boundaries, secret scan, and diff check passed. - Sanitized `make package-check`: passed; reproducible wheel/sdist, isolated install, CLI, intake, and source smokes passed. - Exact-head canonical CI run #2529: success. - Exact base: `fa157fb3890f29cc36e48677c45a588d3b29b4d0`. - Exact head: `40f3b5254069056c76e0a9bc5e3052d0f1e71b9d`. - Independent whole-PR review: APPROVE, no findings, on the exact HEAD/base via canonical read-only MCP verification and the clean prepared local checkout. Review checks ran `make check` and `make package-check` successfully. - No dependencies changed. PR remains open/unmerged; this handoff does not authorize merge. PR #85 / issue #53 were not modified. Its active checkout and HEAD were preserved, its 9/13 review history was not changed, and no PR #85 review ordinal was used.

kilo added 1 commit

2026-10-11 15:58:28 +00:00