ace-git-forgejo 0.2.0 → 0.4.0

data/lib/ace/git/forgejo/provider.rb

@@ -11,9 +11,14 @@ module Ace
       # Forgejo provider implementation of the shared provider contract.
       #
       # Owns Forgejo terminology and translates `fj` responses into the
-      # normalized evidence types defined by the ace-git core. Every failure is
-      # classified with the shared taxonomy; `fj` failures are never hidden
-      # behind ad-hoc curl calls or silent fallbacks.
+      # normalized evidence types defined by the ace-git core. Every
+      # repository-scoped call is bound to the selected server's exact
+      # host/owner/repository through the {CliExecutor} repository boundary:
+      # the selected identity is mandatory, unobserved operations refuse
+      # before launch, and returned evidence is checked for conflicting
+      # identity. Every failure is classified with the shared taxonomy;
+      # `fj` failures are never hidden behind ad-hoc curl calls or silent
+      # fallbacks.
       class Provider < Ace::Git::Providers::Base
         class << self
           def display_name
@@ -31,14 +36,15 @@ module Ace
           CliExecutor.check_installed!(runner: runner)
         end
 
-        # @return [Boolean] true when the server host has a configured `fj` login
+        # @return [Boolean] true when the selected server's host has a
+        #   configured `fj` login
         def authenticated?
-          CliExecutor.authenticated?(server_host, runner: runner)
+          CliExecutor.authenticated?(repository_target.authority, runner: runner)
         end
 
         # @raise [Ace::Git::ProviderAuthenticationError] when unauthenticated
         def check_authenticated!
-          CliExecutor.check_authenticated!(host: server_host, runner: runner)
+          CliExecutor.check_authenticated!(authority: repository_target.authority, runner: runner)
         end
 
         # @return [ProviderPullRequest] normalized pull request evidence
@@ -51,13 +57,13 @@ module Ace
 
         # @return [ProviderPullRequest, nil] evidence for the branch's PR
         def pull_request_for_branch(branch:)
-          # `fj pr search` has no --limit flag; fetch all and order newest-first.
-          listing = fj(["--style", "minimal", "pr", "search", "--state", "all"])
+          # `fj pr search` has no --limit flag (observed v0.6.0); fetch all
+          # and order newest-first.
+          listing = fj(:pr_search, "all")
           entries = Parsers.parse_search(listing).sort_by { |entry| -entry[:number] }
 
           entries.each do |entry|
-            view = fj(["--style", "minimal", "pr", "view", entry[:number].to_s])
-            parsed = Parsers.parse_pr_view(view)
+            parsed = view_pr(entry[:number])
             next unless parsed && parsed[:head_ref] == branch
 
             parsed[:head_sha] = head_sha_of(entry[:number])
@@ -69,7 +75,7 @@ module Ace
 
         # @return [String] unified diff text for the pull request
         def pull_request_diff(number:)
-          fj(["pr", "view", number.to_s, "diff"])
+          fj(:pr_diff, request_number!(number))
         end
 
         # `fj pr search` has no --limit flag; cap client-side after sorting
@@ -77,7 +83,7 @@ module Ace
         #
         # @return [Array<ProviderPullRequest>] recent PRs, newest first
         def recent_pull_requests(limit:)
-          listing = fj(["--style", "minimal", "pr", "search", "--state", "all"])
+          listing = fj(:pr_search, "all")
           Parsers.parse_search(listing)
             .map { |entry| normalize_search_entry(entry) }
             .sort_by { |pr| -pr.number }
@@ -86,10 +92,11 @@ module Ace
 
         # @return [ProviderIssue] normalized issue evidence
         def issue(number:)
-          view = fj(["--style", "minimal", "issue", "view", number.to_s])
+          view = fj(:issue_view, request_number!(number))
           parsed = Parsers.parse_issue_view(view) ||
             raise(Ace::Git::ProviderMalformedOutputError,
               "Unrecognized `fj issue view #{number}` output; update the Forgejo provider parser")
+          verify_returned_number!(parsed, number, "issue")
 
           Ace::Git::ProviderIssue.new(
             server_name: server.name,
@@ -104,9 +111,11 @@ module Ace
 
         # @return [Array<ProviderCheck>] normalized check evidence for a ref
         def checks(ref:)
-          tasks = fj(["--style", "minimal", "actions", "tasks"])
+          tasks = fj(:actions_tasks)
           Parsers.parse_actions_tasks(tasks)
-            .select { |task| task[:sha].start_with?(ref.to_s) || ref.to_s.start_with?(task[:sha]) }
+            # Exact-head evidence requires the complete 40-character SHA
+            # equal to the reviewed head; prefix matches are rejected.
+            .select { |task| task[:sha] == ref.to_s }
             .map do |task|
               Ace::Git::ProviderCheck.new(
                 server_name: server.name,
@@ -119,25 +128,224 @@ module Ace
         end
 
         # @return [ProviderRepository] normalized repository evidence
+        # @raise [ProviderIdentityMismatchError] when the CLI reports a
+        #   repository other than the selected one
         def repository
-          view = fj(["--style", "minimal", "repo", "view"])
+          target = repository_target
+          view = fj(:repo_view)
           parsed = Parsers.parse_repo_view(view)
+          verify_returned_repository!(parsed, target)
 
           Ace::Git::ProviderRepository.new(
             server_name: server.name,
             full_name: parsed[:full_name],
             default_branch: nil,
-            url: parsed[:url]
+            url: parsed[:url] || target.url
+          )
+        end
+
+        # The fj CLI surface omits the PR body; the repository-bound API
+        # supplies it for review evidence. Malformed payloads fail closed.
+        def pull_request_body(number:)
+          number = request_number!(number)
+          data = review_http.request(:get, "pulls/#{number}")
+          unless data.is_a?(Hash) && data["number"] == number && data.key?("body") &&
+                    (data["body"].nil? || data["body"].is_a?(String))
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo PR body evidence"
+          end
+          data["body"]
+        end
+
+        def pull_request_review_evidence(number:, expected_head:)
+          number = request_number!(number)
+          verify_expected_head!(pull_request(number: number), expected_head)
+          comments = review_http.paginate("issues/#{number}/comments").map do |entry|
+            review_comment(entry, number, expected_head)
+          end
+          reviews = review_http.paginate("pulls/#{number}/reviews").map do |entry|
+            review_entry(entry, number, expected_head)
+          end
+          # Review comments live under each review, not at the PR level.
+          inline = reviews.flat_map do |review|
+            # The per-review endpoint returns the complete list (no
+            # pagination); a repeated nonempty page would trip the loop
+            # guard, so fetch once and require an array.
+            entries = review_http.request(:get, "pulls/#{number}/reviews/#{review.id}/comments")
+            unless entries.is_a?(Array)
+              raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo review comment evidence"
+            end
+            entries.map { |entry| review_comment(entry, number, expected_head) }
+          end
+          verify_expected_head!(pull_request(number: number), expected_head)
+          Ace::Git::ProviderReviewEvidence.new(
+            server_name: server.name, repository_url: server.url,
+            pr_number: number, head_sha: expected_head,
+            comments: comments + inline, reviews: reviews
+          )
+        end
+
+        def pull_request_review_details(number:)
+          number = request_number!(number)
+          data = review_http.request(:get, "pulls/#{number}")
+          files = review_http.paginate("pulls/#{number}/files").map do |entry|
+            entry.is_a?(Hash) && entry["filename"]
+          end
+          unless data.is_a?(Hash) && data["base"].is_a?(Hash) && data["number"] == number &&
+              data.dig("base", "sha").to_s.match?(/\A[0-9a-f]{40}\z/) &&
+              data["changed_files"].is_a?(Integer) && data["changed_files"] == files.length &&
+              files.all? { |path| path.is_a?(String) && !path.empty? }
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed or incomplete Forgejo PR file evidence"
+          end
+          Ace::Git::ProviderReviewDetails.new(
+            server_name: server.name, repository_url: server.url, pr_number: number,
+            base_sha: data.dig("base", "sha"), files: files
           )
         end
 
+        def pull_request_checks(number:, head_sha:)
+          verify_expected_head!(pull_request(number: number), head_sha)
+          checks(ref: head_sha)
+        end
+
+        def repository_file(path:, ref:)
+          require "base64"
+          # %20, not form encoding: "+" in a path segment is a literal plus.
+          # Explicit unreserved-character allowlist: percent-encode
+          # everything else (DEFAULT_PARSER leaves ? and + ambiguous).
+          escaped = path.split("/").map { |part|
+            part.gsub(/[^A-Za-z0-9._~!$&'()*+,;=@:-]/) { |c| c.bytes.map { |b| format("%%%02X", b) }.join }
+          }.join("/")
+          data = review_http.request(:get, "contents/#{escaped}?ref=#{ref}")
+          unless data.is_a?(Hash) && data["encoding"] == "base64" && data["content"].is_a?(String)
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo repository file evidence"
+          end
+          Base64.strict_decode64(data["content"].delete("\n"))
+        rescue ArgumentError => e
+          raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo repository file content: #{e.message}"
+        end
+
+        def create_pull_request_comment(number:, expected_head:, body:, correlation:)
+          number = request_number!(number)
+          pr = verify_expected_head!(pull_request(number: number), expected_head)
+          require_open_pr!(pr)
+          marker = comment_marker(correlation)
+          with_session_lock(correlation) do
+          existing = matching_review_comments(number, marker, expected_head)
+          if existing.length > 1
+            raise Ace::Git::ProviderConflictingMatchesError,
+              "Multiple comments match review session #{correlation} on PR ##{number}"
+          end
+          if existing.one?
+            # A repeat reconciles only the exact session comment; a marker
+            # match with different content is a conflict, never our post.
+            sent = "#{body}\n\n#{marker}"
+            if existing.first.body == sent
+              verify_post_mutation_head!(number, expected_head, correlation)
+              return review_mutation(number, expected_head, existing.first, :existing)
+            end
+
+            raise Ace::Git::ProviderConflictingMatchesError,
+              "Review session #{correlation} comment exists on PR ##{number} with different content"
+          end
+          second = verify_expected_head!(pull_request(number: number), expected_head)
+          require_open_pr!(second)
+          begin
+            review_http.request(:post, "issues/#{number}/comments", body: {body: "#{body}\n\n#{marker}"})
+          rescue Ace::Git::ProviderMalformedOutputError => e
+            raise Ace::Git::ProviderUnknownOutcomeError,
+              "PR comment sent but response unreadable for #{server.name}/#{number}, head #{expected_head}, session #{correlation}: #{e.message}; reconcile before repeating"
+          rescue Ace::Git::ProviderUnknownOutcomeError => e
+            raise Ace::Git::ProviderUnknownOutcomeError,
+              "PR comment outcome unknown for #{server.name}/#{number}, head #{expected_head}, " \
+              "session #{correlation}: #{e.message}; reconcile before repeating"
+          end
+          begin
+          matches = matching_review_comments(number, marker, expected_head)
+          rescue Ace::Git::ProviderMalformedOutputError, Ace::Git::ProviderUnreachableError => e
+            raise Ace::Git::ProviderUnknownOutcomeError,
+              "PR comment sent but reconciliation read failed for session #{correlation}: #{e.message}; reconcile before repeating"
+          end
+          unless matches.one? && matches.first.body == "#{body}\n\n#{marker}"
+            raise Ace::Git::ProviderUnknownOutcomeError,
+              "PR comment sent but reconciliation found #{matches.length} exact-content match(es) for session #{correlation}"
+          end
+          verify_post_mutation_head!(number, expected_head, correlation)
+          review_mutation(number, expected_head, matches.first, :created)
+          end
+        end
+
+        def update_pull_request_comment(number:, expected_head:, comment_id:, body:)
+          number = request_number!(number)
+          comment_id = Integer(comment_id)
+          verify_expected_head!(pull_request(number: number), expected_head)
+          issue_matches = review_http.paginate("issues/#{number}/comments").select { |entry| entry["id"] == comment_id }
+          # Inline ids live under individual reviews; locate them there
+          # so an unsupported edit is classified explicitly instead of
+          # being misread as not-belonging to this PR.
+          inline_found = issue_matches.empty? && review_comment_ids(number).include?(comment_id)
+          if inline_found
+            raise Ace::Git::ProviderUnsupportedCapabilityError,
+              "Editing inline review comments is unsupported by the observed fj v0.6.0 surface (comment #{comment_id})"
+          end
+          matches = issue_matches
+          update_route = "issues/comments/#{comment_id}"
+          unless matches.one?
+            raise Ace::Git::ProviderIdentityMismatchError,
+              "Comment #{comment_id} does not belong to selected PR ##{number}"
+          end
+          comment = review_comment(matches.first, number, expected_head)
+          if comment.body == body
+            verify_post_mutation_head!(number, expected_head, "comment #{comment_id}")
+            return review_mutation(number, expected_head, comment, :existing)
+          end
+
+          verify_expected_head!(pull_request(number: number), expected_head)
+          begin
+            review_http.request(:patch, update_route, body: {body: body})
+          rescue Ace::Git::ProviderMalformedOutputError => e
+            raise Ace::Git::ProviderUnknownOutcomeError,
+              "Comment update sent but response unreadable for #{server.name}/#{number}, comment #{comment_id}: #{e.message}; reconcile before repeating"
+          rescue Ace::Git::ProviderUnknownOutcomeError => e
+            raise Ace::Git::ProviderUnknownOutcomeError,
+              "Comment update outcome unknown for #{server.name}/#{number}, " \
+              "head #{expected_head}, comment #{comment_id}: #{e.message}"
+          end
+          begin
+            # Fetch individually and validate the Forgejo issue identity.
+            begin
+              updated = review_http.request(:get, update_route)
+            rescue Ace::Git::ProviderMalformedOutputError, Ace::Git::ProviderUnreachableError => e
+              raise Ace::Git::ProviderUnknownOutcomeError,
+                "Comment update sent but verification read failed for comment #{comment_id}: #{e.message}; reconcile before repeating"
+            end
+            unless updated.is_a?(Hash) && updated["issue_url"].to_s.end_with?("/#{number}")
+              raise Ace::Git::ProviderUnknownOutcomeError,
+                "Comment update sent but edited comment #{comment_id} does not verify against PR ##{number}; reconcile before repeating"
+            end
+          rescue Ace::Git::ProviderUnreachableError => e
+            raise Ace::Git::ProviderUnknownOutcomeError,
+              "Comment update sent but verification read failed for comment #{comment_id}: #{e.message}; reconcile before repeating"
+          end
+          unless updated && updated["id"] == comment_id && updated["body"] == body
+            raise Ace::Git::ProviderUnknownOutcomeError,
+              "Comment update sent but exact PR comment #{comment_id} could not be verified"
+          end
+          verify_post_mutation_head!(number, expected_head, "comment #{comment_id}")
+          review_mutation(number, expected_head, review_comment(updated, number, expected_head), :updated)
+        end
+
+        def resolve_pull_request_thread(number:, expected_head:, thread_id:)
+          raise Ace::Git::ProviderUnsupportedCapabilityError,
+            "Forgejo does not expose an observed repository-bound review thread resolution capability"
+        end
+
         # ---- PR lifecycle mutations ----
 
         # @return [Array<ProviderPullRequest>] open PRs matching the exact
         #   base/head identity, with head SHA provenance
         def find_open_pull_requests(head_repository_url:, head_ref:, base_repository_url:, base_ref:)
           require_base_on_server!(base_repository_url)
-          listing = fj(["--style", "minimal", "pr", "search", "--state", "open"])
+          listing = fj(:pr_search, "open")
           Parsers.parse_search(listing).filter_map do |entry|
             parsed = view_pr(entry[:number])
             next unless parsed && parsed[:state] == :open
@@ -150,14 +358,14 @@ module Ace
 
         # Create a PR via `fj pr create`, reconciling to an exact open match
         # first and proving the resulting head against `expected_head`.
-        # `fj` cannot create draft PRs; the receipt reports the provider's
-        # real draft state.
+        # `fj` cannot encode an explicit fork head; the receipt reports the
+        # provider's real draft state.
         #
         # @return [ProviderMutationReceipt] idempotency :created/:existing
         def create_pull_request(head_ref:, head_repository_url:, base_ref:, expected_head:, title:, body: nil, draft: true)
-          # `fj pr create` operates on the checkout's repository and cannot
-          # encode an explicit fork head; refusing before any command (even
-          # lookups) beats creating the wrong PR.
+          # `fj pr create -r` binds the base repository, but no observed form
+          # encodes a cross-repository fork head; refusing before any command
+          # (even lookups) beats creating the wrong PR.
           unless Ace::Git::Atoms::ServerUrl.match?(head_repository_url, server.url)
             raise Ace::Git::ProviderUnsupportedCapabilityError,
               "Forgejo CLI (fj) pr create cannot target head repository " \
@@ -178,9 +386,8 @@ module Ace
             return receipt(:create, verify_expected_head!(matches.first, expected_head), :existing)
           end
 
-          args = ["pr", "create", title, "--head", head_ref, "--base", base_ref]
-          args += ["--body", body] if body
-          send_mutation(args, ambiguous: true, identity: identity_text(head_repository_url, head_ref, base_ref))
+          send_mutation(:pr_create, title, head_ref, base_ref, body,
+            ambiguous: true, identity: identity_text(head_repository_url, head_ref, base_ref))
 
           created = reconcile_created(
             head_repository_url: head_repository_url, head_ref: head_ref,
@@ -195,9 +402,10 @@ module Ace
         #
         # @return [ProviderMutationReceipt] operation :update
         def update_pull_request(number:, expected_head:, title: nil, body: nil)
+          number = request_number!(number)
           verify_expected_head!(fetch_pr(number), expected_head)
-          send_mutation(["pr", "edit", number.to_s, "title", title], ambiguous: false) if title
-          send_mutation(["pr", "edit", number.to_s, "body", body], ambiguous: false) if body
+          send_mutation(:pr_edit_title, number, title, ambiguous: false) if title
+          send_mutation(:pr_edit_body, number, body, ambiguous: false) if body
           receipt(:update, fetch_pr(number), nil)
         end
 
@@ -222,23 +430,143 @@ module Ace
 
         private
 
-        # Run one `fj` command, classifying every failure with the taxonomy.
-        def fj(args)
-          result = CliExecutor.execute(args, timeout: timeout, runner: runner)
+        def require_open_pr!(pr)
+          return if pr.state == :open
+
+          raise Ace::Git::ProviderUnsupportedCapabilityError,
+            "Cannot post review comment to PR ##{pr.number} in #{pr.state} state"
+        end
+
+        def review_http
+          @review_http ||= HttpClient.new(server: server, timeout: timeout, runner: runner)
+        end
+
+  # A mutation receipt may only bind the expected head; if the PR head
+  # moved during the mutation the outcome stays uncertain.
+  def verify_post_mutation_head!(number, expected_head, correlation)
+    current = begin
+      pull_request(number: number)
+    rescue Ace::Git::ProviderMalformedOutputError, Ace::Git::ProviderUnreachableError => e
+      raise Ace::Git::ProviderUnknownOutcomeError,
+        "Head verification read failed after mutation for #{server.name}: #{e.message}; reconcile before repeating"
+    end
+    return if current.head_sha == expected_head
+
+    raise Ace::Git::ProviderUnknownOutcomeError,
+      "PR head moved during mutation for #{server.name}/##{number} " \
+      "(#{expected_head} -> #{current.head_sha}), session #{correlation}: reconcile before repeating"
+  end
+
+        # Serialize the read/post/reconcile sequence per session so two
+      # concurrent callers cannot both observe "no marker" and post.
+        def with_session_lock(correlation)
+          require "tmpdir"
+          lock_path = File.join(Dir.tmpdir, "ace-review-session-#{correlation}.lock")
+          File.open(lock_path, File::CREAT | File::RDWR, 0600) do |lock|
+            lock.flock(File::LOCK_EX)
+            yield
+          end
+        end
+
+        def comment_marker(correlation)
+          unless correlation.to_s.match?(/\A[a-zA-Z0-9._:-]+\z/)
+            raise Ace::Git::ConfigError, "Invalid review session correlation"
+          end
+          "<!-- ace-review-session:#{correlation} -->"
+        end
+
+        def matching_review_comments(number, marker, expected_head)
+          review_http.paginate("issues/#{number}/comments").filter_map do |entry|
+            next unless entry.is_a?(Hash) && entry["body"].is_a?(String) && entry["body"].include?(marker)
+
+            review_comment(entry, number, expected_head)
+          end
+        end
+
+        def review_comment(entry, number, head)
+          unless entry.is_a?(Hash) && entry["id"].is_a?(Integer) && entry["id"].positive? && entry["body"].is_a?(String) &&
+              entry.dig("user", "login").is_a?(String)
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo PR comment evidence"
+          end
+          Ace::Git::ProviderReviewComment.new(
+            server_name: server.name, repository_url: server.url, pr_number: number,
+            id: entry["id"], author: entry.dig("user", "login"), body: entry["body"],
+            url: entry["html_url"], path: entry["path"],
+            # Forgejo supplies position/original_position rather than
+            # line; the positive side position is the normalized line.
+            line: entry["line"] || [entry["position"], entry["original_position"]].compact.reject { |v| !v.is_a?(Integer) || v <= 0 }.first,
+            head_sha: entry["commit_id"] || head, resolved: entry.key?("resolver") ? !entry["resolver"].nil? : nil,
+            thread_id: nil
+          )
+        end
+
+        # Collect inline (review) comment ids by walking each review.
+        def review_comment_ids(number)
+          review_http.paginate("pulls/#{number}/reviews").flat_map do |review|
+            entries = review_http.request(:get, "pulls/#{number}/reviews/#{review["id"]}/comments")
+            unless entries.is_a?(Array)
+              raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo review comment evidence"
+            end
+            entries.filter_map { |entry| entry["id"] if entry.is_a?(Hash) && entry["id"].is_a?(Integer) }
+          end
+        end
+
+        def review_entry(entry, number, head)
+          reviewer = entry.dig("user", "login") || entry.dig("team", "name")
+          unless entry.is_a?(Hash) && entry["id"].is_a?(Integer) && entry["id"].positive? && reviewer.is_a?(String) &&
+              entry["state"].is_a?(String) && !entry["state"].empty?
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo PR review evidence"
+          end
+          Ace::Git::ProviderReview.new(
+            server_name: server.name, repository_url: server.url, pr_number: number,
+            id: entry["id"], author: entry.dig("user", "login"), body: entry["body"],
+            # Forgejo reports REQUEST_CHANGES; consumers count only the
+            # canonical CHANGES_REQUESTED spelling.
+            state: (entry["state"] == "REQUEST_CHANGES") ? "CHANGES_REQUESTED" : entry["state"],
+            url: entry["html_url"], head_sha: entry["commit_id"] || head
+          )
+        end
+
+        def review_mutation(number, head, comment, idempotency)
+          Ace::Git::ProviderReviewMutation.new(
+            server_name: server.name, repository_url: server.url, pr_number: number,
+            head_sha: head, comment: comment, idempotency: idempotency
+          )
+        end
+
+        # Validated selected repository identity. Built once; malformed
+        # selections fail as configuration errors before any subprocess.
+        def repository_target
+          @repository_target ||= RepositoryBinding::Target.resolve(server.url)
+        end
+
+        # Refuse before any repository subprocess when the installed fj was
+        # never observed; a different version must not inherit capabilities.
+        def ensure_observed_version!
+          return if @version_checked
+
+          CliExecutor.check_version_supported!(runner: runner)
+          @version_checked = true
+        end
+
+        # Run one repository-scoped `fj` command bound to the selected
+        # target, classifying every failure with the taxonomy.
+        def fj(operation, *arguments)
+          result = execute_repository(operation, arguments)
           return result[:stdout] if result[:success]
 
-          classify_failure(result[:stderr], context: args.join(" "))
+          classify_failure(result[:stderr], context: operation_context(operation, arguments))
         end
 
-        # Send one mutating `fj` command. When `ambiguous` is true (create),
-        # any transport-level failure becomes an unknown outcome: the request
-        # may have mutated the forge, so callers must reconcile by exact
-        # identity instead of retrying blindly.
-        def send_mutation(args, ambiguous:, identity: nil)
-          result = CliExecutor.execute(args, timeout: timeout, runner: runner)
+        # Send one mutating repository operation. When `ambiguous` is true
+        # (create), any transport-level failure becomes an unknown outcome:
+        # the request may have mutated the forge, so callers must reconcile
+        # by exact identity instead of retrying blindly.
+        def send_mutation(operation, *arguments, ambiguous:, identity: nil)
+          result = execute_repository(operation, arguments)
           return result if result[:success]
 
-          classify_failure(result[:stderr], context: args.join(" "))
+          classify_failure(result[:stderr], context: operation_context(operation, arguments))
         rescue Ace::Git::ProviderUnreachableError => e
           raise e unless ambiguous
 
@@ -247,12 +575,36 @@ module Ace
             "reconcile by exact identity before repeating: #{identity}"
         end
 
+        def execute_repository(operation, arguments)
+          target = repository_target
+          ensure_observed_version!
+          ensure_not_redirecting!(target)
+          CliExecutor.execute_repository(
+            target: target, operation: operation,
+            arguments: arguments, timeout: timeout, runner: runner
+          )
+        end
+
+        # Refuse before any subprocess when the readable fj configuration
+        # aliases the selected host to a different endpoint: `-H` cannot
+        # prevent that redirect, and returned-identity checks cannot see it.
+        def ensure_not_redirecting!(target)
+          return if @redirect_checked
+
+          RepositoryBinding.reject_selected_host_redirect!(target.host_url)
+          @redirect_checked = true
+        end
+
+        def operation_context(operation, arguments)
+          "#{operation} #{arguments.compact.join(" ")}".strip
+        end
+
         def classify_failure(message, context:)
           message = message.to_s
           case message
           when /not found|does not exist|no pull request|no issue/i
             raise Ace::Git::ProviderObjectNotFoundError, "Object not found (#{context}): #{message}"
-          when /access denied|unauthorized|token/i
+          when /access denied|unauthorized|token|only signed in|not logged in|log ?in required/i
             raise Ace::Git::ProviderAuthenticationError, "Not authenticated with Forgejo: #{message}"
           else
             raise Ace::Git::ProviderUnreachableError, "Forgejo request failed (#{context}): #{message}"
@@ -270,12 +622,17 @@ module Ace
           normalize_pr(parsed)
         end
 
-        # View one PR and parse its stable minimal-style output.
+        # View one PR and parse its stable minimal-style output. The
+        # qualified `owner/repo#N` reference binds the read to the selected
+        # repository; a returned number that disagrees with the request is a
+        # routed mismatch and fails closed.
         def view_pr(number)
-          view = fj(["--style", "minimal", "pr", "view", number.to_s])
-          Parsers.parse_pr_view(view) ||
+          view = fj(:pr_view, number)
+          parsed = Parsers.parse_pr_view(view) ||
             raise(Ace::Git::ProviderMalformedOutputError,
               "Unrecognized `fj pr view #{number}` output; update the Forgejo provider parser")
+          verify_returned_number!(parsed, number, "pull request")
+          parsed
         end
 
         # Re-fetch and verify the PR created by an accepted create request.
@@ -319,7 +676,7 @@ module Ace
         end
 
         def head_sha_of(number)
-          commits = fj(["--style", "minimal", "pr", "view", number.to_s, "commits"])
+          commits = fj(:pr_commits, number)
           Parsers.parse_head_sha(commits)
         end
 
@@ -328,6 +685,7 @@ module Ace
             server_name: server.name,
             number: parsed[:number],
             title: parsed[:title],
+            body: parsed[:body],
             state: parsed[:state],
             head_ref: parsed[:head_ref],
             base_ref: parsed[:base_ref],
@@ -337,7 +695,10 @@ module Ace
             draft: nil,
             merged_at: nil,
             head_repository_url: head_repository_url_of(parsed),
-            base_repository_url: server.url,
+            base_repository_url: repository_target.url,
+            # fj v0.6.0 exposes no authoritative merge-commit field for a
+            # selected PR (observed; see the task capability evidence), so
+            # merge evidence stays empty and cleanup retains the checkout.
             merge_commit_sha: nil
           )
         end
@@ -347,14 +708,14 @@ module Ace
         # base repository; canonical PRs use the configured repository.
         def head_repository_url_of(parsed)
           repo = parsed[:head_repository]
-          return server.url if repo.nil? || repo.empty?
+          return repository_target.url if repo.nil? || repo.empty?
 
           "#{server_host_root}/#{repo}"
         end
 
         def server_host_root
           @server_host_root ||= begin
-            uri = URI.parse(server.url.to_s)
+            uri = URI.parse(repository_target.url)
             "#{uri.scheme || "https"}://#{uri.host}#{":#{uri.port}" if uri.port && uri.port != uri.default_port}"
           end
         end
@@ -364,6 +725,7 @@ module Ace
             server_name: server.name,
             number: entry[:number],
             title: entry[:title],
+            body: nil,
             state: nil,
             head_ref: nil,
             base_ref: nil,
@@ -373,27 +735,60 @@ module Ace
             draft: nil,
             merged_at: nil,
             head_repository_url: nil,
-            base_repository_url: nil,
+            base_repository_url: repository_target.url,
             merge_commit_sha: nil
           )
         end
 
-        def server_host
-          @server_host ||= begin
-            uri = URI.parse(server.url.to_s)
-            uri.host
-          rescue URI::Error
-            nil
+        # Reject non-numeric or non-positive PR/issue numbers as
+        # configuration failures before any subprocess.
+        def request_number!(number)
+          text = number.to_s
+          unless /\A\d+\z/.match?(text) && text.to_i.positive?
+            raise Ace::Git::ConfigError,
+              "Pull request and issue numbers must be positive integers, got #{number.inspect}"
           end
+
+          text.to_i
+        end
+
+        # PR and issue numbers are not globally unique: evidence whose
+        # number disagrees with the selected reference was not routed to the
+        # selected repository and must never be relabelled.
+        def verify_returned_number!(parsed, requested, kind)
+          return if parsed[:number] == requested.to_i
+
+          raise Ace::Git::ProviderIdentityMismatchError,
+            "Forgejo returned #{kind} ##{parsed[:number]} for selected #{kind} " \
+            "##{requested} on #{repository_target.repo}; refusing misrouted evidence"
+        end
+
+        # `fj repo view` was bound to the selected owner/repository, so
+        # returned identity fields must agree with the selection.
+        def verify_returned_repository!(parsed, target)
+          full_name = parsed[:full_name].to_s.sub(%r{\.git\z}i, "")
+          unless !full_name.empty? && full_name.casecmp(target.repo).zero?
+            raise Ace::Git::ProviderIdentityMismatchError,
+              "Forgejo repo view returned #{full_name.inspect} for selected repository " \
+              "#{target.repo}; refusing misrouted evidence"
+          end
+          return if parsed[:url].nil? || parsed[:url].empty? ||
+            Ace::Git::Atoms::ServerUrl.match?(parsed[:url], target.url)
+
+          raise Ace::Git::ProviderIdentityMismatchError,
+            "Forgejo repo view returned URL #{parsed[:url].inspect} for selected repository " \
+            "#{target.url}; refusing misrouted evidence"
         end
 
         def pr_url(number)
-          base = server.url.to_s.chomp("/")
+          # A configured URL may end in .git (clone form); the web URL
+          # must be built from the repository page base instead.
+          base = repository_target.url.to_s.chomp("/").sub(/\.git\z/i, "")
           "#{base}/pulls/#{number}"
         end
 
         def issue_url(number)
-          base = server.url.to_s.chomp("/")
+          base = repository_target.url.to_s.chomp("/")
           "#{base}/issues/#{number}"
         end
       end