feat(delete)!: omit all irreversible forge-data deletes from every surface #234

Merged

hexajon merged 2 commits from issue-209-delete-domain-omission into main

2026-07-17 18:35:25 +00:00

hexajon commented

2026-07-17 18:35:09 +00:00

(Migrated from codeberg.org)

Summary

Completes the ADR 0029 strict-omission convergence: repo, issue, release, tag, and wiki-page deletion - irreversible with no forge undelete - are omitted from both surfaces. MCP: the madt_delete tool and the destructive gated domain are gone; each resource's tool description now says deletion is user-only via the forge web UI. CLI: repo/issue/release/tag/wiki delete become discoverable refusal stubs that exit nonzero, name what would be irreversibly destroyed, and point at the web UI (wiki also names its git history). The #2004 fail-open path - where the issue-delete confirm silently skipped on non-elicitation clients - is gone with the tool.

With both the delete gate (this) and the worktree force gate (#208) retired, the elicitation seam has zero live callers, so this merge removes it wholesale (elicitation.go + its test); ADR 0029 remains the record that elicitation is the sanctioned mechanism for any FUTURE reversible-consent feature, which re-adds the thin helper when needed. Recoverable deletes (assets, comments, attachments, labels, milestones, webhooks, keys, hooks, avatar, time entries, protected branches) are untouched. Note: the raw api passthrough can still issue a DELETE - that is the generic escape hatch, never a first-class operation, and out of ADR 0029's scope. Merge reconciles the README consent paragraph to the strict-omission description; full union gate green.

Closes #209

## Summary Completes the ADR 0029 strict-omission convergence: repo, issue, release, tag, and wiki-page deletion - irreversible with no forge undelete - are omitted from both surfaces. MCP: the madt_delete tool and the `destructive` gated domain are gone; each resource's tool description now says deletion is user-only via the forge web UI. CLI: repo/issue/release/tag/wiki delete become discoverable refusal stubs that exit nonzero, name what would be irreversibly destroyed, and point at the web UI (wiki also names its git history). The #2004 fail-open path - where the issue-delete confirm silently skipped on non-elicitation clients - is gone with the tool. With both the delete gate (this) and the worktree force gate (#208) retired, the elicitation seam has zero live callers, so this merge removes it wholesale (elicitation.go + its test); ADR 0029 remains the record that elicitation is the sanctioned mechanism for any FUTURE reversible-consent feature, which re-adds the thin helper when needed. Recoverable deletes (assets, comments, attachments, labels, milestones, webhooks, keys, hooks, avatar, time entries, protected branches) are untouched. Note: the raw api passthrough can still issue a DELETE - that is the generic escape hatch, never a first-class operation, and out of ADR 0029's scope. Merge reconciles the README consent paragraph to the strict-omission description; full union gate green. Closes #209

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!234

No description provided.

Rows
Columns