test: integration coverage report, suite docs and harness isolation fix

docs/integration-coverage.md

@@ -0,0 +1,275 @@
+# Integration coverage
+
+Generated by the live-Gitea integration suite; do not edit by hand. Regenerate with:
+
+```bash
+AEGIS_IT_WRITE_REPORT=1 AEGIS_INTEGRATION=1 uv run pytest tests/integration -m integration --no-cov
+```
+
+Target: Gitea 28.1.0. Every tool of the server (538) is called at least once through the MCP server against a seeded instance (see `tests/integration/test_sweep.py`). A call counts as covered when it reaches Gitea and answers 2xx, answers a status the swagger documents for that operation, or answers a status listed as an explicit allowance below. Scenario tests (`tests/integration/test_scenario_*.py`) add real state changes; a tool counts as 2xx when any call in the run got a 2xx.
+
+| Domain | Tools | 2xx | Documented non-2xx | Allowances | Not covered |
+| --- | --- | --- | --- | --- | --- |
+| actions | 70 | 52 | 18 | 0 | 0 |
+| admin | 33 | 27 | 4 | 2 | 0 |
+| hook | 20 | 20 | 0 | 0 | 0 |
+| issue | 73 | 73 | 0 | 0 | 0 |
+| misc | 20 | 18 | 0 | 2 | 0 |
+| notification | 7 | 7 | 0 | 0 | 0 |
+| org | 45 | 45 | 0 | 0 | 0 |
+| package | 9 | 9 | 0 | 0 | 0 |
+| pull | 26 | 25 | 1 | 0 | 0 |
+| release | 13 | 13 | 0 | 0 | 0 |
+| repo | 124 | 118 | 4 | 2 | 0 |
+| team | 15 | 15 | 0 | 0 | 0 |
+| user | 77 | 71 | 3 | 3 | 0 |
+| wiki | 6 | 6 | 0 | 0 | 0 |
+| total | 538 | 499 | 30 | 9 | 0 |
+
+Excluded from the generic sweep and covered by a dedicated test:
+
+- `gitea_misc_delete_current_token`: deletes the token the sweep itself runs with; covered by test_sweep_isolated.py with a throwaway token
+
+## actions
+
+Tools with a 2xx (52):
+
+`gitea_actions_cancel_workflow_run`, `gitea_actions_create_org_variable`, `gitea_actions_create_repo_variable`, `gitea_actions_create_user_variable`, `gitea_actions_delete_org_secret`, `gitea_actions_delete_org_variable`, `gitea_actions_delete_repo_secret`, `gitea_actions_delete_repo_variable`, `gitea_actions_delete_user_secret`, `gitea_actions_delete_user_variable`, `gitea_actions_disable_workflow`, `gitea_actions_dispatch_workflow`, `gitea_actions_download_run_job_logs`, `gitea_actions_enable_workflow`, `gitea_actions_get_artifacts`, `gitea_actions_get_artifacts_of_run`, `gitea_actions_get_org_runners`, `gitea_actions_get_org_variable`, `gitea_actions_get_org_variables_list`, `gitea_actions_get_org_workflow_jobs`, `gitea_actions_get_org_workflow_runs`, `gitea_actions_get_repo_runners`, `gitea_actions_get_repo_variable`, `gitea_actions_get_repo_variables_list`, `gitea_actions_get_user_runners`, `gitea_actions_get_user_variable`, `gitea_actions_get_user_variables_list`, `gitea_actions_get_user_workflow_jobs`, `gitea_actions_get_user_workflow_runs`, `gitea_actions_get_workflow`, `gitea_actions_get_workflow_job`, `gitea_actions_get_workflow_run`, `gitea_actions_get_workflow_run_attempt`, `gitea_actions_get_workflow_runs`, `gitea_actions_list_action_tasks`, `gitea_actions_list_repository_workflows`, `gitea_actions_list_workflow_jobs`, `gitea_actions_list_workflow_run_attempt_jobs`, `gitea_actions_list_workflow_run_jobs`, `gitea_actions_list_workflow_runs`, `gitea_actions_org_create_runner_registration_token`, `gitea_actions_org_list_secrets`, `gitea_actions_repo_create_runner_registration_token`, `gitea_actions_repo_list_secrets`, `gitea_actions_rerun_failed_workflow_run`, `gitea_actions_update_org_secret`, `gitea_actions_update_org_variable`, `gitea_actions_update_repo_secret`, `gitea_actions_update_repo_variable`, `gitea_actions_update_user_secret`, `gitea_actions_update_user_variable`, `gitea_actions_user_create_runner_registration_token`
+
+Tools with a documented non-2xx status (18):
+
+| Tool | Status |
+| --- | --- |
+| `gitea_actions_approve_workflow_run` | 409 |
+| `gitea_actions_delete_action_run` | 400 |
+| `gitea_actions_delete_artifact` | 404 |
+| `gitea_actions_delete_org_runner` | 404 |
+| `gitea_actions_delete_repo_runner` | 404 |
+| `gitea_actions_delete_user_runner` | 404 |
+| `gitea_actions_download_artifact` | 404 |
+| `gitea_actions_force_cancel_workflow_run` | 409 |
+| `gitea_actions_get_artifact` | 404 |
+| `gitea_actions_get_org_runner` | 404 |
+| `gitea_actions_get_repo_runner` | 404 |
+| `gitea_actions_get_user_runner` | 404 |
+| `gitea_actions_get_workflow_run_logs` | 404 |
+| `gitea_actions_rerun_workflow_job` | 404 |
+| `gitea_actions_rerun_workflow_run` | 400 |
+| `gitea_actions_update_org_runner` | 404 |
+| `gitea_actions_update_repo_runner` | 404 |
+| `gitea_actions_update_user_runner` | 404 |
+
+Allowances (0):
+
+none
+
+## admin
+
+Tools with a 2xx (27):
+
+`gitea_admin_create_hook`, `gitea_admin_create_org`, `gitea_admin_create_public_key`, `gitea_admin_create_repo`, `gitea_admin_create_runner_registration_token`, `gitea_admin_create_user`, `gitea_admin_cron_list`, `gitea_admin_cron_run`, `gitea_admin_delete_hook`, `gitea_admin_delete_user`, `gitea_admin_delete_user_badges`, `gitea_admin_delete_user_public_key`, `gitea_admin_edit_hook`, `gitea_admin_edit_user`, `gitea_admin_get_all_emails`, `gitea_admin_get_all_orgs`, `gitea_admin_get_hook`, `gitea_admin_get_runners`, `gitea_admin_list_hooks`, `gitea_admin_list_packages`, `gitea_admin_list_user_badges`, `gitea_admin_list_workflow_jobs`, `gitea_admin_list_workflow_runs`, `gitea_admin_rename_user`, `gitea_admin_search_emails`, `gitea_admin_search_users`, `gitea_admin_unadopted_list`
+
+Tools with a documented non-2xx status (4):
+
+| Tool | Status |
+| --- | --- |
+| `gitea_admin_adopt_repository` | 404 |
+| `gitea_admin_delete_runner` | 404 |
+| `gitea_admin_get_runner` | 404 |
+| `gitea_admin_update_runner` | 404 |
+
+Allowances (2):
+
+| Tool | Status | Reason |
+| --- | --- | --- |
+| `gitea_admin_add_user_badges` | 500 | Gitea answers 500 for an unknown badge slug and the API cannot create badges |
+| `gitea_admin_delete_unadopted_repository` | 404 | no unadopted repository exists on the instance; Gitea answers 404 although the swagger lists only 204 and 403 |
+
+## hook
+
+Tools with a 2xx (20):
+
+`gitea_hook_org_create_hook`, `gitea_hook_org_delete_hook`, `gitea_hook_org_edit_hook`, `gitea_hook_org_get_hook`, `gitea_hook_org_list_hooks`, `gitea_hook_repo_create_hook`, `gitea_hook_repo_delete_git_hook`, `gitea_hook_repo_delete_hook`, `gitea_hook_repo_edit_git_hook`, `gitea_hook_repo_edit_hook`, `gitea_hook_repo_get_git_hook`, `gitea_hook_repo_get_hook`, `gitea_hook_repo_list_git_hooks`, `gitea_hook_repo_list_hooks`, `gitea_hook_repo_test_hook`, `gitea_hook_user_create_hook`, `gitea_hook_user_delete_hook`, `gitea_hook_user_edit_hook`, `gitea_hook_user_get_hook`, `gitea_hook_user_list_hooks`
+
+Tools with a documented non-2xx status (0):
+
+none
+
+Allowances (0):
+
+none
+
+## issue
+
+Tools with a 2xx (73):
+
+`gitea_issue_add_assignees`, `gitea_issue_add_label`, `gitea_issue_add_subscription`, `gitea_issue_add_time`, `gitea_issue_check_assignee`, `gitea_issue_check_subscription`, `gitea_issue_clear_labels`, `gitea_issue_create_comment`, `gitea_issue_create_issue`, `gitea_issue_create_issue_attachment`, `gitea_issue_create_issue_blocking`, `gitea_issue_create_issue_comment_attachment`, `gitea_issue_create_issue_dependencies`, `gitea_issue_create_label`, `gitea_issue_create_milestone`, `gitea_issue_delete`, `gitea_issue_delete_comment`, `gitea_issue_delete_comment_deprecated`, `gitea_issue_delete_comment_reaction`, `gitea_issue_delete_issue_attachment`, `gitea_issue_delete_issue_comment_attachment`, `gitea_issue_delete_issue_reaction`, `gitea_issue_delete_label`, `gitea_issue_delete_milestone`, `gitea_issue_delete_stopwatch`, `gitea_issue_delete_subscription`, `gitea_issue_delete_time`, `gitea_issue_edit_comment`, `gitea_issue_edit_comment_deprecated`, `gitea_issue_edit_issue`, `gitea_issue_edit_issue_attachment`, `gitea_issue_edit_issue_comment_attachment`, `gitea_issue_edit_issue_deadline`, `gitea_issue_edit_label`, `gitea_issue_edit_milestone`, `gitea_issue_get_comment`, `gitea_issue_get_comment_reactions`, `gitea_issue_get_comments`, `gitea_issue_get_comments_and_timeline`, `gitea_issue_get_issue`, `gitea_issue_get_issue_attachment`, `gitea_issue_get_issue_comment_attachment`, `gitea_issue_get_issue_reactions`, `gitea_issue_get_label`, `gitea_issue_get_labels`, `gitea_issue_get_milestone`, `gitea_issue_get_milestones_list`, `gitea_issue_get_repo_comments`, `gitea_issue_list_blocks`, `gitea_issue_list_issue_attachments`, `gitea_issue_list_issue_comment_attachments`, `gitea_issue_list_issue_dependencies`, `gitea_issue_list_issues`, `gitea_issue_list_labels`, `gitea_issue_list_pinned_issues`, `gitea_issue_lock_issue`, `gitea_issue_move_issue_pin`, `gitea_issue_pin_issue`, `gitea_issue_post_comment_reaction`, `gitea_issue_post_issue_reaction`, `gitea_issue_remove_assignees`, `gitea_issue_remove_issue_blocking`, `gitea_issue_remove_issue_dependencies`, `gitea_issue_remove_label`, `gitea_issue_replace_labels`, `gitea_issue_reset_time`, `gitea_issue_search_issues`, `gitea_issue_start_stopwatch`, `gitea_issue_stop_stopwatch`, `gitea_issue_subscriptions`, `gitea_issue_tracked_times`, `gitea_issue_unlock_issue`, `gitea_issue_unpin_issue`
+
+Tools with a documented non-2xx status (0):
+
+none
+
+Allowances (0):
+
+none
+
+## misc
+
+Tools with a 2xx (18):
+
+`gitea_api_request`, `gitea_misc_delete_current_token`, `gitea_misc_get_current_token`, `gitea_misc_get_general_api_settings`, `gitea_misc_get_general_attachment_settings`, `gitea_misc_get_general_repository_settings`, `gitea_misc_get_general_ui_settings`, `gitea_misc_get_gitignore_template_info`, `gitea_misc_get_label_template_info`, `gitea_misc_get_license_template_info`, `gitea_misc_get_version`, `gitea_misc_list_gitignores_templates`, `gitea_misc_list_label_templates`, `gitea_misc_list_license_templates`, `gitea_misc_render_markdown`, `gitea_misc_render_markdown_raw`, `gitea_misc_render_markup`, `gitea_misc_topic_search`
+
+Tools with a documented non-2xx status (0):
+
+none
+
+Allowances (2):
+
+| Tool | Status | Reason |
+| --- | --- | --- |
+| `gitea_misc_get_signing_key` | 404 | the throwaway instance has no commit signing key; Gitea answers 404 although the swagger lists no 404 for this operation |
+| `gitea_misc_get_signing_key_ssh` | 404 | the throwaway instance has no commit signing key; Gitea answers 404 although the swagger lists no 404 for this operation |
+
+## notification
+
+Tools with a 2xx (7):
+
+`gitea_notification_get_list`, `gitea_notification_get_repo_list`, `gitea_notification_get_thread`, `gitea_notification_new_available`, `gitea_notification_read_list`, `gitea_notification_read_repo_list`, `gitea_notification_read_thread`
+
+Tools with a documented non-2xx status (0):
+
+none
+
+Allowances (0):
+
+none
+
+## org
+
+Tools with a 2xx (45):
+
+`gitea_org_add_issue_to_project_column`, `gitea_org_block_user`, `gitea_org_check_user_block`, `gitea_org_conceal_member`, `gitea_org_create`, `gitea_org_create_label`, `gitea_org_create_org_repo`, `gitea_org_create_org_repo_deprecated`, `gitea_org_create_project`, `gitea_org_create_project_column`, `gitea_org_delete`, `gitea_org_delete_avatar`, `gitea_org_delete_label`, `gitea_org_delete_member`, `gitea_org_delete_project`, `gitea_org_delete_project_column`, `gitea_org_delete_repos`, `gitea_org_edit`, `gitea_org_edit_label`, `gitea_org_edit_project`, `gitea_org_edit_project_column`, `gitea_org_get`, `gitea_org_get_all`, `gitea_org_get_label`, `gitea_org_get_project`, `gitea_org_get_project_column`, `gitea_org_is_member`, `gitea_org_is_public_member`, `gitea_org_list_activity_feeds`, `gitea_org_list_blocks`, `gitea_org_list_labels`, `gitea_org_list_members`, `gitea_org_list_project_column_issues`, `gitea_org_list_project_columns`, `gitea_org_list_projects`, `gitea_org_list_public_members`, `gitea_org_list_repos`, `gitea_org_move_project_columns`, `gitea_org_move_project_issue`, `gitea_org_publicize_member`, `gitea_org_remove_issue_from_project_column`, `gitea_org_rename`, `gitea_org_set_default_project_column`, `gitea_org_unblock_user`, `gitea_org_update_avatar`
+
+Tools with a documented non-2xx status (0):
+
+none
+
+Allowances (0):
+
+none
+
+## package
+
+Tools with a 2xx (9):
+
+`gitea_package_delete_package`, `gitea_package_delete_package_version`, `gitea_package_get_latest_package_version`, `gitea_package_get_package`, `gitea_package_link_package`, `gitea_package_list_package_files`, `gitea_package_list_package_versions`, `gitea_package_list_packages`, `gitea_package_unlink_package`
+
+Tools with a documented non-2xx status (0):
+
+none
+
+Allowances (0):
+
+none
+
+## pull
+
+Tools with a 2xx (25):
+
+`gitea_pull_create_pull_request`, `gitea_pull_create_pull_review`, `gitea_pull_create_pull_review_comment_reply`, `gitea_pull_create_pull_review_requests`, `gitea_pull_delete_pull_review`, `gitea_pull_delete_pull_review_requests`, `gitea_pull_dismiss_pull_review`, `gitea_pull_download_pull_diff_or_patch`, `gitea_pull_edit_pull_request`, `gitea_pull_get_pull_request`, `gitea_pull_get_pull_request_by_base_head`, `gitea_pull_get_pull_request_commits`, `gitea_pull_get_pull_request_files`, `gitea_pull_get_pull_review`, `gitea_pull_get_pull_review_comments`, `gitea_pull_list_pinned_pull_requests`, `gitea_pull_list_pull_requests`, `gitea_pull_list_pull_reviews`, `gitea_pull_merge_pull_request`, `gitea_pull_pull_request_is_merged`, `gitea_pull_resolve_pull_review_comment`, `gitea_pull_submit_pull_review`, `gitea_pull_undismiss_pull_review`, `gitea_pull_unresolve_pull_review_comment`, `gitea_pull_update_pull_request`
+
+Tools with a documented non-2xx status (1):
+
+| Tool | Status |
+| --- | --- |
+| `gitea_pull_cancel_scheduled_auto_merge` | 404 |
+
+Allowances (0):
+
+none
+
+## release
+
+Tools with a 2xx (13):
+
+`gitea_release_create_release`, `gitea_release_create_release_attachment`, `gitea_release_delete_release`, `gitea_release_delete_release_attachment`, `gitea_release_delete_release_by_tag`, `gitea_release_edit_release`, `gitea_release_edit_release_attachment`, `gitea_release_get_latest_release`, `gitea_release_get_release`, `gitea_release_get_release_attachment`, `gitea_release_get_release_by_tag`, `gitea_release_list_release_attachments`, `gitea_release_list_releases`
+
+Tools with a documented non-2xx status (0):
+
+none
+
+Allowances (0):
+
+none
+
+## repo
+
+Tools with a 2xx (118):
+
+`gitea_repo_add_collaborator`, `gitea_repo_add_issue_to_project_column`, `gitea_repo_add_push_mirror`, `gitea_repo_add_team`, `gitea_repo_add_topic`, `gitea_repo_apply_diff_patch`, `gitea_repo_change_files`, `gitea_repo_check_assignee`, `gitea_repo_check_collaborator`, `gitea_repo_check_subscription`, `gitea_repo_check_team`, `gitea_repo_compare_diff`, `gitea_repo_create_branch`, `gitea_repo_create_branch_protection`, `gitea_repo_create_deploy_token`, `gitea_repo_create_file`, `gitea_repo_create_fork`, `gitea_repo_create_key`, `gitea_repo_create_project`, `gitea_repo_create_project_column`, `gitea_repo_create_status`, `gitea_repo_create_tag`, `gitea_repo_create_tag_protection`, `gitea_repo_delete`, `gitea_repo_delete_avatar`, `gitea_repo_delete_branch`, `gitea_repo_delete_branch_protection`, `gitea_repo_delete_collaborator`, `gitea_repo_delete_file`, `gitea_repo_delete_key`, `gitea_repo_delete_project`, `gitea_repo_delete_project_column`, `gitea_repo_delete_push_mirror`, `gitea_repo_delete_subscription`, `gitea_repo_delete_tag`, `gitea_repo_delete_tag_protection`, `gitea_repo_delete_team`, `gitea_repo_delete_topic`, `gitea_repo_download_commit_diff_or_patch`, `gitea_repo_edit`, `gitea_repo_edit_branch_protection`, `gitea_repo_edit_project`, `gitea_repo_edit_project_column`, `gitea_repo_edit_tag_protection`, `gitea_repo_generate_repo`, `gitea_repo_get`, `gitea_repo_get_all_commits`, `gitea_repo_get_annotated_tag`, `gitea_repo_get_archive`, `gitea_repo_get_assignees`, `gitea_repo_get_blob`, `gitea_repo_get_branch`, `gitea_repo_get_branch_protection`, `gitea_repo_get_by_id`, `gitea_repo_get_combined_status_by_ref`, `gitea_repo_get_contents`, `gitea_repo_get_contents_ext`, `gitea_repo_get_contents_list`, `gitea_repo_get_editor_config`, `gitea_repo_get_file_contents`, `gitea_repo_get_file_contents_post`, `gitea_repo_get_issue_config`, `gitea_repo_get_issue_templates`, `gitea_repo_get_key`, `gitea_repo_get_languages`, `gitea_repo_get_licenses`, `gitea_repo_get_project`, `gitea_repo_get_project_column`, `gitea_repo_get_push_mirror_by_remote_name`, `gitea_repo_get_raw_file`, `gitea_repo_get_raw_file_or_lfs`, `gitea_repo_get_repo_permissions`, `gitea_repo_get_reviewers`, `gitea_repo_get_single_commit`, `gitea_repo_get_tag`, `gitea_repo_get_tag_protection`, `gitea_repo_get_tree`, `gitea_repo_list_activity_feeds`, `gitea_repo_list_all_git_refs`, `gitea_repo_list_branch_protection`, `gitea_repo_list_branches`, `gitea_repo_list_collaborators`, `gitea_repo_list_forks`, `gitea_repo_list_git_refs`, `gitea_repo_list_keys`, `gitea_repo_list_project_column_issues`, `gitea_repo_list_project_columns`, `gitea_repo_list_projects`, `gitea_repo_list_push_mirrors`, `gitea_repo_list_stargazers`, `gitea_repo_list_statuses`, `gitea_repo_list_statuses_by_ref`, `gitea_repo_list_subscribers`, `gitea_repo_list_tag_protection`, `gitea_repo_list_tags`, `gitea_repo_list_teams`, `gitea_repo_list_topics`, `gitea_repo_list_user_tracked_times`, `gitea_repo_merge_upstream`, `gitea_repo_migrate`, `gitea_repo_mirror_sync`, `gitea_repo_move_project_columns`, `gitea_repo_move_project_issue`, `gitea_repo_new_pin_allowed`, `gitea_repo_push_mirror_sync`, `gitea_repo_put_subscription`, `gitea_repo_remove_issue_from_project_column`, `gitea_repo_rename_branch`, `gitea_repo_search`, `gitea_repo_set_default_project_column`, `gitea_repo_tracked_times`, `gitea_repo_transfer`, `gitea_repo_update_avatar`, `gitea_repo_update_branch`, `gitea_repo_update_branch_protection_priorities`, `gitea_repo_update_file`, `gitea_repo_update_topics`, `gitea_repo_validate_issue_config`
+
+Tools with a documented non-2xx status (4):
+
+| Tool | Status |
+| --- | --- |
+| `gitea_repo_accept_repo_transfer` | 404 |
+| `gitea_repo_get_commit_pull_request` | 404 |
+| `gitea_repo_get_note` | 404 |
+| `gitea_repo_reject_repo_transfer` | 404 |
+
+Allowances (2):
+
+| Tool | Status | Reason |
+| --- | --- | --- |
+| `gitea_repo_signing_key` | 404 | the throwaway instance has no commit signing key; Gitea answers 404 although the swagger lists no 404 for this operation |
+| `gitea_repo_signing_key_ssh` | 404 | the throwaway instance has no commit signing key; Gitea answers 404 although the swagger lists no 404 for this operation |
+
+## team
+
+Tools with a 2xx (15):
+
+`gitea_team_add_team_member`, `gitea_team_add_team_repository`, `gitea_team_create_team`, `gitea_team_delete_team`, `gitea_team_edit_team`, `gitea_team_get_team`, `gitea_team_list_team_activity_feeds`, `gitea_team_list_team_member`, `gitea_team_list_team_members`, `gitea_team_list_team_repo`, `gitea_team_list_team_repos`, `gitea_team_list_teams`, `gitea_team_remove_team_member`, `gitea_team_remove_team_repository`, `gitea_team_search`
+
+Tools with a documented non-2xx status (0):
+
+none
+
+Allowances (0):
+
+none
+
+## user
+
+Tools with a 2xx (71):
+
+`gitea_user_add_email`, `gitea_user_block_user`, `gitea_user_check_following`, `gitea_user_check_user_block`, `gitea_user_create_oauth2_application`, `gitea_user_current_add_issue_to_project_column`, `gitea_user_current_check_following`, `gitea_user_current_check_starring`, `gitea_user_current_create_project`, `gitea_user_current_create_project_column`, `gitea_user_current_create_repo`, `gitea_user_current_delete_follow`, `gitea_user_current_delete_gpg_key`, `gitea_user_current_delete_key`, `gitea_user_current_delete_project`, `gitea_user_current_delete_project_column`, `gitea_user_current_delete_star`, `gitea_user_current_edit_project`, `gitea_user_current_edit_project_column`, `gitea_user_current_get_key`, `gitea_user_current_get_project`, `gitea_user_current_get_project_column`, `gitea_user_current_list_followers`, `gitea_user_current_list_following`, `gitea_user_current_list_gpg_keys`, `gitea_user_current_list_keys`, `gitea_user_current_list_orgs`, `gitea_user_current_list_project_column_issues`, `gitea_user_current_list_project_columns`, `gitea_user_current_list_projects`, `gitea_user_current_list_repos`, `gitea_user_current_list_starred`, `gitea_user_current_list_subscriptions`, `gitea_user_current_move_project_columns`, `gitea_user_current_move_project_issue`, `gitea_user_current_post_key`, `gitea_user_current_put_follow`, `gitea_user_current_put_star`, `gitea_user_current_remove_issue_from_project_column`, `gitea_user_current_set_default_project_column`, `gitea_user_current_tracked_times`, `gitea_user_delete_avatar`, `gitea_user_delete_email`, `gitea_user_delete_oauth2_application`, `gitea_user_get`, `gitea_user_get_current`, `gitea_user_get_heatmap_data`, `gitea_user_get_oauth2_application`, `gitea_user_get_org_permissions`, `gitea_user_get_settings`, `gitea_user_get_stopwatches`, `gitea_user_get_verification_token`, `gitea_user_list_activity_feeds`, `gitea_user_list_blocks`, `gitea_user_list_emails`, `gitea_user_list_followers`, `gitea_user_list_following`, `gitea_user_list_gpg_keys`, `gitea_user_list_keys`, `gitea_user_list_oauth2_applications`, `gitea_user_list_orgs`, `gitea_user_list_projects`, `gitea_user_list_repos`, `gitea_user_list_starred`, `gitea_user_list_subscriptions`, `gitea_user_list_teams`, `gitea_user_search`, `gitea_user_unblock_user`, `gitea_user_update_avatar`, `gitea_user_update_oauth2_application`, `gitea_user_update_settings`
+
+Tools with a documented non-2xx status (3):
+
+| Tool | Status |
+| --- | --- |
+| `gitea_user_current_get_gpg_key` | 404 |
+| `gitea_user_current_post_gpg_key` | 422 |
+| `gitea_user_verify_gpg_key` | 422 |
+
+Allowances (3):
+
+| Tool | Status | Reason |
+| --- | --- | --- |
+| `gitea_user_create_token` | 401 | Gitea only accepts basic auth here; the server always sends token authentication |
+| `gitea_user_delete_access_token` | 401 | Gitea only accepts basic auth here; the server always sends token authentication |
+| `gitea_user_get_tokens` | 401 | Gitea only accepts basic auth here; the server always sends token authentication |
+
+## wiki
+
+Tools with a 2xx (6):
+
+`gitea_wiki_create_wiki_page`, `gitea_wiki_delete_wiki_page`, `gitea_wiki_edit_wiki_page`, `gitea_wiki_get_wiki_page`, `gitea_wiki_get_wiki_page_revisions`, `gitea_wiki_get_wiki_pages`
+
+Tools with a documented non-2xx status (0):
+
+none
+
+Allowances (0):
+
+none

tests/integration/README.md

@@ -21,7 +21,8 @@ message instead of skipping.
 - Gitea is configured through `GITEA__section__KEY` env vars (sqlite3,
   `INSTALL_LOCK`, random `SECRET_KEY`/`INTERNAL_TOKEN`/OAuth2 JWT secret,
   Actions, packages and OAuth2 enabled, mailer off, webhook allowed host list
-  `*`, `MAX_RESPONSE_ITEMS=50`).
+  `*`, local network migrations allowed so the instance can mirror itself, repository
+  hook scripts editable, `MAX_RESPONSE_ITEMS=50`).
 - Readiness: polls `GET /api/v1/version` for up to 90 s. On failure the last 100
   log lines of the container are written to stderr.
 - Seeding: admin `aegis-admin` (random password) via `gitea admin user create`,
@@ -50,3 +51,40 @@ message instead of skipping.
   `create_org`, `create_repo`, `unique`.
 - `regular_user` (session): non-admin user with its own full-scope token.
 - `unique_name` (function): a unique name derived from the test name.
+
+## The suite
+
+Tests call tools through the MCP server (an in-memory `Client` on `build_server`, run as
+the admin of the throwaway instance), so schema validation, the result envelope, the audit
+log and the executor are all exercised. State lives in `tmp_path`.
+
+- `test_scenario_*.py`: happy paths with real state changes (org and team, repository
+  files, branches and tags, issues, pull requests and reviews, releases and attachments,
+  secrets and variables, webhooks, admin and sudo, notifications, current-user features,
+  generic packages, and a workflow run on an `act_runner` container).
+- `test_sweep.py`: every one of the 538 tools is called once against a seeded instance
+  (`sweep_seed.py` creates the data, `sweep_plan.py` builds arguments and expectations).
+  Order: read-only first, then creates, updates and deletes (leaf resources first). A call
+  passes with a 2xx, a status the swagger documents for that operation, or an entry of
+  `ALLOWANCES` (each with a reason). All failing tools are listed at once.
+  `test_sweep_isolated.py` covers the tools the sweep must not call.
+- `test_per_user_oauth.py`: the HTTP app with per-user OAuth, driven in process with a
+  seeded OAuth store; calls run as the signed-in user, admin tools and private repositories
+  of others are refused by Gitea, the static bearer still runs as admin.
+- `test_setup_live.py`: `aegis-gitea-mcp setup` against the instance (OAuth app, env file
+  mode, idempotence, non-admin token).
+- `tests/test_sweep_plan.py` (no Docker) keeps the sweep plan consistent with the catalog.
+
+`AEGIS_IT_WRITE_REPORT=1` makes the session write `docs/integration-coverage.md` (per
+domain: tools with a 2xx, documented non-2xx statuses, allowances).
+
+### Actions runner
+
+`start_runner` starts `gitea/act_runner` (digest-pinned in `ACT_RUNNER_IMAGE`) on the run's
+network, registered with a token from `gitea_actions_repo_create_runner_registration_token`,
+label `aegis-host:host`. Jobs run inside the runner container itself: no Docker socket, no
+bind mounts. The runner reaches Gitea by container name, so it works in both network modes.
+It is removed with the rest of the run. If it cannot start or come online, the test is
+marked xfail with the reason; a failure after the run completed is a real failure.
+
+Runtime: about two minutes locally (Gitea start 15 s, sweep 40 s, runner 10 s).

tests/integration/test_harness.py

@@ -127,7 +127,10 @@ def test_cleanup_removes_container_and_network() -> None:
     assert run_id not in harness._ACTIVE
 
 
-def test_cleanup_all_handles_registered_runs() -> None:
+def test_cleanup_all_handles_registered_runs(monkeypatch: pytest.MonkeyPatch) -> None:
+    # cleanup_all removes every tracked run, including the session's own Gitea, so this
+    # test works on a private registry instead of the real one.
+    monkeypatch.setattr(harness, "_ACTIVE", {})
     run_id = harness.secrets.token_hex(4)
     name = f"{harness.NAME_PREFIX}{run_id}"
     harness.register_resources(RunResources(run_id=run_id, container=name, network=name))

tests/integration/test_scenario_issue_pull.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import asyncio
 import time
 
 from tests.integration.conftest import McpSession, RegularUser, RepoRef, b64
@@ -109,7 +110,7 @@ async def test_issue_lifecycle(
         found = await mcp.ok("gitea_issue_list_issues", q="widget", **repo)
         hits = [item["number"] for item in found.data]
         if index not in hits:
-            time.sleep(0.5)
+            await asyncio.sleep(0.5)
     assert index in hits
     assert (await mcp.ok("gitea_issue_search_issues", q="Broken widget")).data is not None
 

tests/integration/test_scenario_org_repo.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import asyncio
 import base64
 import time
 from typing import Any
@@ -204,7 +205,7 @@ async def test_repo_collaborators_fork_transfer_archive_search(
         search = await mcp.ok("gitea_repo_search", q=fresh_repo.name)
         found = names(search.data["data"])
         if fresh_repo.name not in found:
-            time.sleep(0.5)
+            await asyncio.sleep(0.5)
     assert fresh_repo.name in found
 
     # Fork as another user (admin sudo), then list forks.

tests/integration/test_sweep.py

@@ -29,7 +29,9 @@ def sweep_context(gitea: GiteaInstance, regular_user: RegularUser) -> Ctx:
     return seed(gitea, regular_user.login, regular_user.token)
 
 
-async def test_every_tool_reaches_gitea(mcp: McpSession, sweep_context: Ctx) -> None:
+async def test_every_tool_reaches_gitea(
+    mcp: McpSession, sweep_context: Ctx, gitea: GiteaInstance, regular_user: RegularUser
+) -> None:
     catalog = load_catalog()
     listed = {tool.name for tool in (await mcp.client.list_tools()).tools}
     expected = {op.tool_name for op in catalog.operations} | {RAW_TOOL}
@@ -52,3 +54,20 @@ async def test_every_tool_reaches_gitea(mcp: McpSession, sweep_context: Ctx) ->
     assert not bad, f"{len(bad)} tool(s) with an unexpected result ({summary}):\n{report}"
     success_share = summary.get("success", 0) / len(records)
     assert success_share >= MIN_SUCCESS_SHARE, f"only {success_share:.0%} of tools got a 2xx"
+
+    # Whatever the 538 calls did, no credential or secret value came back in a result.
+    hidden = [
+        gitea.admin_token,
+        gitea.admin_password,
+        regular_user.token,
+        regular_user.password,
+        "rotated-org-value",
+        "rotated-repo-value",
+        "rotated-user-value",
+        "org-secret-value",
+        "repo-secret-value",
+        "user-secret-value",
+    ]
+    for value in hidden:
+        assert all(value not in text for text in mcp.texts), "a secret leaked into a result"
+        assert value not in mcp.audit_text(), "a secret leaked into the audit log"