fix(git): reviewer reads must prefer origin over a diverged local ref (#690)

* fix(git): reviewer reads must prefer origin over a diverged local ref

_resolve_head_ref (GitService.diff/list_changed_files/read_file_at_branch)
kept local priority on ANY divergence from origin, real or rewritten. A
reviewer's clone parked on pre-rebase history after the branch's routine
force-push sync stayed frozen there across every subsequent review round,
while origin held every fix commit — QA repeatedly bounced work that had
already landed. Every caller here is a reader, never the branch's own
author mid-write, so origin now wins whenever it carries anything the
local ref lacks; local keeps priority only when it strictly contains
origin (unpushed commits, or equal).

The read-only git MCP surface (roboco_git_log) hit the same staleness
through a separate path: /api/git/log resolved the requested branch as a
bare name straight off whatever the caller's own clone had on disk, with
no fetch at all. It now routes through the same fixed _resolve_head_ref.

* test(e2e): give the armed flow-verb timeout real headroom

The armed value is also verb-2's entire execution budget (claim + every
claim guard + set_plan + start + tracing gate), which grows as guards
land; 1s flaked on loaded CI runners while passing locally. The
cancel-and-release semantics only need the timeout far below the hang.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>
This commit is contained in:
Renzo F
2026-07-24 17:50:13 +02:00
committed by GitHub
co-authored by Renn F
parent eb0dcb6ecb
commit e97f46af6e
8 changed files with 277 additions and 34 deletions
+7 -2
View File
@@ -74,10 +74,15 @@ _SUB_TASKS = [
]
_PLAN = "Land the refresh button via the frontend cell."
# set_plan sleeps this long inside the verb's own transaction. On the fix
# (1s server timeout) the sleep is cancelled well before this; disarmed
# (armed server timeout) the sleep is cancelled well before this; disarmed
# (1000s server timeout, 3s client timeout) the client trips first.
# The armed timeout only needs to sit far below _HANG_SECONDS for the
# cancel-and-release semantics; it is also verb-2's ENTIRE execution budget
# (claim + every claim guard + set_plan + start + tracing gate), which keeps
# growing as guards land — 1s flaked on loaded CI runners while passing
# locally, so keep real headroom here.
_HANG_SECONDS = 8.0
_SERVER_TIMEOUT_SECONDS = 1.0
_SERVER_TIMEOUT_SECONDS = 3.0
_DISARMED_SERVER_TIMEOUT_SECONDS = 1000.0
# The MCP client's HTTP timeout for the disarmed reproduction — must be less
# than _HANG_SECONDS so the client trips before the sleep ends. Applied