Merge pull request 'Create and self-assign issues from mobile My Work' (#160) from timmy/159-mobile-issue-capture into main

README.md

@@ -14,12 +14,19 @@ python3 -m pip install -r requirements.txt
 ```
 
 Point the dashboard at the Gitea server root (without `/api/v1`) and provide a
-token that can read dashboard data and update the authenticated user's
-notification threads, then start the API and bundled frontend:
+token that can read dashboard data, update the authenticated user's notification
+threads, create and self-assign issues, create issue comments, close assigned
+issues, and submit pull-request reviews. Pull-request replies and mobile My Work
+issue comments use Gitea's issue-comment API; mobile issue capture requires issue
+creation and assignment permission, while closing an assigned issue and native
+Comment, Approve, and Request changes reviews require repository write permission.
+Serve the dashboard
+only to trusted users on its own origin; cross-origin API
+access is intentionally disabled. Then start the API and bundled frontend:
 
 ```bash
 export GITEA_URL='https://forge.example.com'
-export GITEA_TOKEN='<read-scoped-token>'
+export GITEA_TOKEN='<read-notification-and-issue-write-token>'
 uvicorn src.main:app --host 127.0.0.1 --port 8000
 ```
 

frontend/create-issue-sheet.js

@@ -0,0 +1,53 @@
+function createIssueCapture({ fetchJson, storage }) {
+  const storageKey = 'stackchain.issue-capture.v1';
+  let pending = null;
+  const emptyDraft = () => ({ repository: '', title: '', body: '' });
+
+  function saveDraft(draft) {
+    const safe = {
+      repository: String(draft?.repository || ''),
+      title: String(draft?.title || ''),
+      body: String(draft?.body || ''),
+    };
+    try { storage.setItem(storageKey, JSON.stringify(safe)); }
+    catch (_error) { /* Keep the form as the in-memory fallback. */ }
+    return safe;
+  }
+
+  function loadDraft() {
+    try {
+      const parsed = JSON.parse(storage.getItem(storageKey) || 'null');
+      return parsed && typeof parsed === 'object' ? {
+        repository: String(parsed.repository || ''),
+        title: String(parsed.title || ''),
+        body: String(parsed.body || ''),
+      } : emptyDraft();
+    } catch (_error) {
+      return emptyDraft();
+    }
+  }
+
+  function clearDraft() {
+    try { storage.removeItem(storageKey); }
+    catch (_error) { /* Confirmed creation remains authoritative. */ }
+  }
+
+  function submit(draft) {
+    if (pending) return pending;
+    const saved = saveDraft(draft);
+    const repository = saved.repository.split('/').map(encodeURIComponent).join('/');
+    pending = fetchJson('api/v1/repos/' + repository + '/issues', {
+      method: 'POST',
+      headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ title: saved.title, body: saved.body }),
+    }).then(issue => {
+      clearDraft();
+      return issue;
+    }).finally(() => { pending = null; });
+    return pending;
+  }
+
+  return { saveDraft, loadDraft, submit };
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createIssueCapture;

frontend/index.html

@@ -88,7 +88,7 @@ textarea { resize: vertical; min-height: 120px; }
 .review-feedback { display:grid; gap:8px; }
 .review-feedback label { display:grid; gap:6px; }
 .review-feedback select { min-height:44px; padding:8px; border-radius:8px; border:1px solid #1f3a5f; background:#0b1526; color:#e5e7eb; }
-.review-handoff { position:sticky; bottom:0; z-index:3; display:grid; gap:8px; padding:10px 4px; background:rgba(11,21,38,.98); border-top:1px solid #2a496e; }
+.review-handoff { position:sticky; bottom:0; z-index:3; display:grid; gap:8px; padding:10px 4px; padding-bottom:calc(10px + env(safe-area-inset-bottom)); background:rgba(11,21,38,.98); border-top:1px solid #2a496e; }
 .review-handoff button { min-height:44px; }
 .review-handoff-link { min-height:44px; display:flex; align-items:center; justify-content:center; border:1px solid #60a5fa; border-radius:8px; color:#bfdbfe; font-weight:700; text-decoration:none; }
 .review-handoff-link[hidden] { display:none; }
@@ -107,11 +107,38 @@ textarea { resize: vertical; min-height: 120px; }
 .update-sheet.open { display:flex; }
 .update-sheet-panel { width:min(560px,100%); height:100%; overflow:auto; padding:18px; background:#0b1526; border-left:1px solid #2a496e; }
 .update-sheet-header { display:flex; align-items:center; justify-content:space-between; gap:10px; }
+.update-sheet-header button { min-height:44px; }
 .update-sheet-content { overflow-wrap:anywhere; white-space:pre-wrap; }
+.update-reply { display:grid; gap:8px; margin-top:16px; }
+.update-reply textarea { width:100%; min-height:112px; resize:vertical; }
+.update-reply button { min-height:44px; width:100%; }
 .update-sheet-actions { position:sticky; bottom:0; z-index:3; display:grid; gap:8px; margin-top:14px; padding:10px 4px; padding-bottom:calc(10px + env(safe-area-inset-bottom)); background:rgba(11,21,38,.98); border-top:1px solid #2a496e; }
 .update-sheet-actions button, .update-sheet-actions a { min-height:44px; display:flex; align-items:center; justify-content:center; }
 .update-sheet-actions a { border:1px solid #60a5fa; border-radius:10px; font-weight:700; }
 .update-retry { min-height:44px; width:100%; margin-top:10px; }
+.issue-sheet { position:fixed; inset:0; z-index:56; display:none; justify-content:flex-end; background:rgba(5,12,21,.72); backdrop-filter:blur(4px); }
+.issue-sheet.open { display:flex; }
+.issue-sheet-panel { width:min(560px,100%); height:100%; overflow:auto; padding:18px; background:#0b1526; border-left:1px solid #2a496e; }
+.issue-sheet-header { display:flex; align-items:center; justify-content:space-between; gap:10px; }
+.issue-sheet-header button { min-height:44px; }
+.issue-sheet-content { overflow-wrap:anywhere; white-space:pre-wrap; }
+.issue-comment { padding:10px 0; border-bottom:1px solid #1b2d45; }
+.issue-comment-composer { display:grid; gap:8px; margin-top:16px; }
+.issue-comment-composer button { min-height:44px; width:100%; }
+.issue-sheet-actions { position:sticky; bottom:0; z-index:3; display:grid; gap:8px; margin-top:14px; padding:10px 4px; padding-bottom:calc(10px + env(safe-area-inset-bottom)); background:rgba(11,21,38,.98); border-top:1px solid #2a496e; }
+.issue-sheet-actions button, .issue-sheet-actions a { min-height:44px; display:flex; align-items:center; justify-content:center; }
+.issue-sheet-actions a { border:1px solid #60a5fa; border-radius:10px; font-weight:700; }
+.issue-retry { min-height:44px; width:100%; margin-top:10px; }
+.new-issue { min-height:44px; }
+.create-issue-sheet { position:fixed; inset:0; z-index:57; display:none; justify-content:flex-end; background:rgba(5,12,21,.72); backdrop-filter:blur(4px); }
+.create-issue-sheet.open { display:flex; }
+.create-issue-panel { width:min(560px,100%); height:100dvh; overflow:auto; display:grid; align-content:start; gap:12px; padding:18px; padding-bottom:calc(18px + env(safe-area-inset-bottom)); background:#0b1526; border-left:1px solid #2a496e; }
+.create-issue-header { display:flex; align-items:center; justify-content:space-between; gap:10px; }
+.create-issue-header button, .create-issue-actions button { min-height:44px; }
+.create-issue-form { display:grid; gap:12px; }
+.create-issue-form label { display:grid; gap:6px; }
+.create-issue-form select { min-height:44px; padding:8px; border-radius:8px; border:1px solid #1f3a5f; background:#0b1526; color:#e5e7eb; }
+.create-issue-actions { position:sticky; bottom:0; display:grid; gap:8px; padding:10px 0; padding-bottom:calc(10px + env(safe-area-inset-bottom)); background:#0b1526; }
 @media (max-width: 600px) {
   header { align-items:flex-start; }
   .my-work { margin:0; }
@@ -120,6 +147,8 @@ textarea { resize: vertical; min-height: 120px; }
   .work-filter { flex:1 1 calc(50% - 8px); }
   .review-sheet-panel { width:100%; border-left:0; padding:14px; }
   .update-sheet-panel { width:100%; border-left:0; padding:14px; }
+  .issue-sheet-panel { width:100%; border-left:0; padding:14px; }
+  .create-issue-panel { width:100%; border-left:0; padding:14px; }
 }
 .obi { width:14px; height:14px; background: url('data:image/svg+xml;utf8,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 24 24%22><rect width=%2224%22 height=%2224%22 rx=%226%22 fill=%22%230b1526%22/><circle cx=%2212%22 cy=%2212%22 r=%226%22 fill=%22%2360a5fa%22/></svg>') center/contain no-repeat; display:inline-block; }
 .footer { padding: 12px; text-align: center; color:#4e6b8a; font-size:12px; }
@@ -145,6 +174,7 @@ textarea { resize: vertical; min-height: 120px; }
         <h2>My Work</h2>
         <div class="small" id="my-work-status" aria-live="polite">Loading assigned work…</div>
       </div>
+      <button class="new-issue" id="new-issue" type="button">New issue</button>
       <div class="work-filters" aria-label="Filter My Work">
         <button class="work-filter" data-work-filter="all" aria-pressed="true">All <span data-work-count="all">0</span></button>
         <button class="work-filter" data-work-filter="issue" aria-pressed="false">Issues <span data-work-count="issue">0</span></button>
@@ -246,6 +276,59 @@ textarea { resize: vertical; min-height: 120px; }
   </div>
 </div>
 
+<div class="issue-sheet" id="issue-sheet" role="dialog" aria-modal="true" aria-labelledby="issue-sheet-title">
+  <section class="issue-sheet-panel">
+    <div class="issue-sheet-header">
+      <div>
+        <div class="small" id="issue-sheet-key"></div>
+        <h3 id="issue-sheet-title">Assigned issue</h3>
+      </div>
+      <button id="close-issue-sheet" type="button">Close sheet</button>
+    </div>
+    <div id="issue-sheet-status" class="small" aria-live="polite">Choose an issue.</div>
+    <button class="issue-retry" id="retry-issue-load" type="button" hidden>Retry loading issue</button>
+    <div class="row"><span id="issue-labels"></span><span class="small" id="issue-assignees"></span></div>
+    <p class="issue-sheet-content" id="issue-sheet-body"></p>
+    <h2>Recent discussion</h2>
+    <div id="issue-comments"></div>
+    <section class="issue-comment-composer" aria-labelledby="issue-comment-title">
+      <h2 id="issue-comment-title">Add comment</h2>
+      <textarea id="issue-comment" maxlength="10000" placeholder="Write a comment"></textarea>
+      <button id="send-issue-comment" type="button">Post comment</button>
+      <div id="issue-comment-status" class="small" aria-live="assertive"></div>
+    </section>
+    <div class="issue-sheet-actions">
+      <button id="close-issue" type="button">Close issue</button>
+      <a id="open-issue-gitea" href="#" target="_blank" rel="noopener noreferrer">Open in Gitea</a>
+    </div>
+  </section>
+</div>
+
+<div class="create-issue-sheet" id="create-issue-sheet" role="dialog" aria-modal="true" aria-labelledby="create-issue-heading">
+  <section class="create-issue-panel">
+    <div class="create-issue-header">
+      <h3 id="create-issue-heading">New issue</h3>
+      <button id="cancel-new-issue" type="button">Cancel</button>
+    </div>
+    <form class="create-issue-form" id="create-issue-form">
+      <label for="create-issue-repository">Repository
+        <select id="create-issue-repository" required></select>
+      </label>
+      <label for="create-issue-title">Title
+        <input id="create-issue-title" type="text" maxlength="255" required autocomplete="off" />
+      </label>
+      <label for="create-issue-body">Description <span class="small">Optional</span>
+        <textarea id="create-issue-body" maxlength="10000"></textarea>
+      </label>
+      <div class="small">The issue will be assigned to you.</div>
+      <div class="create-issue-actions">
+        <button id="submit-new-issue" type="submit">Create &amp; assign to me</button>
+        <div id="create-issue-status" class="small" aria-live="assertive"></div>
+      </div>
+    </form>
+  </section>
+</div>
+
 <div class="update-sheet" id="update-sheet" role="dialog" aria-modal="true" aria-labelledby="update-sheet-title">
   <section class="update-sheet-panel">
     <div class="update-sheet-header">
@@ -268,6 +351,13 @@ textarea { resize: vertical; min-height: 120px; }
       <summary><h2>Subject context</h2></summary>
       <p class="update-sheet-content muted" id="update-subject-body"></p>
     </details>
+    <section class="update-reply" aria-labelledby="update-reply-title">
+      <h2 id="update-reply-title">Reply</h2>
+      <label for="update-reply" class="small">Continue this issue or pull-request conversation</label>
+      <textarea id="update-reply" maxlength="10000" placeholder="Write a reply"></textarea>
+      <button id="send-update-reply" type="button">Send reply</button>
+      <div id="update-reply-status" class="small" aria-live="assertive"></div>
+    </section>
     <div class="update-sheet-actions">
       <button id="mark-update-read-next" type="button">Mark read &amp; next</button>
       <a id="open-update-gitea" href="#" target="_blank" rel="noopener noreferrer">Open in Gitea</a>
@@ -307,6 +397,8 @@ textarea { resize: vertical; min-height: 120px; }
         <textarea id="review-summary" placeholder="Summarize your review"></textarea>
       </label>
       <div class="review-handoff">
+        <button id="submit-review">Submit review</button>
+        <span class="small" id="review-submit-status" aria-live="assertive"></span>
         <button id="copy-review-feedback">Copy feedback &amp; continue in Gitea</button>
         <span class="small" id="review-handoff-status" aria-live="polite"></span>
         <textarea class="review-copy-fallback" id="review-copy-fallback" readonly hidden aria-label="Feedback to copy manually"></textarea>
@@ -324,6 +416,8 @@ textarea { resize: vertical; min-height: 120px; }
 <script src="static/commands.js"></script>
 <script src="static/widgets.js"></script>
 <script src="static/my-work.js"></script>
+<script src="static/issue-sheet.js"></script>
+<script src="static/create-issue-sheet.js"></script>
 <script src="static/review-sheet.js"></script>
 <script src="static/context-poller.js"></script>
 <script>
@@ -369,9 +463,13 @@ textarea { resize: vertical; min-height: 120px; }
   let reviewTrigger = null;
   let selectedUpdate = null;
   let updateTrigger = null;
+  let selectedIssue = null;
+  let issueTrigger = null;
+  let creatingIssue = false;
   let progress = null;
   let draft = null;
   let reviewFiles = [];
+  let selectedReviewHead = '';
   let bulkConfirmationPending = false;
   let bulkMarkPending = false;
   let reviewHandoffPending = false;
@@ -383,6 +481,8 @@ textarea { resize: vertical; min-height: 120px; }
     return payload;
   }
   const reviewController = createReviewController({ fetchJson: fetchReviewJson });
+  const issueController = createIssueSheet({ fetchJson: fetchReviewJson, storage: localStorage });
+  const issueCapture = createIssueCapture({ fetchJson: fetchReviewJson, storage: localStorage });
 
   function setStatus(msg) { qs('#status').textContent = msg || 'Live'; }
   function setClock() { qs('#clock').textContent = fmt(new Date()); }
@@ -433,6 +533,17 @@ textarea { resize: vertical; min-height: 120px; }
     return payload;
   }
 
+  async function postNotificationReply(notificationId, body) {
+    const response = await fetch('api/v1/notifications/' + encodeURIComponent(notificationId) + '/reply', {
+      method: 'POST',
+      headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ body }),
+    });
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) throw new Error(payload.error || 'Posting the reply failed.');
+    return payload;
+  }
+
   const notificationAcknowledger = createNotificationAcknowledger({
     markRead: markNotificationRead,
     onItems: items => {
@@ -468,6 +579,11 @@ textarea { resize: vertical; min-height: 120px; }
     },
     onStatus: message => { qs('#my-work-action-status').textContent = message; },
   });
+  const notificationReplier = createNotificationReplier({
+    post: postNotificationReply,
+    storage: localStorage,
+    onStatus: message => { qs('#update-reply-status').textContent = message; },
+  });
   const notificationReader = createNotificationReader({
     load: fetchNotificationDetail,
     markRead: markNotificationRead,
@@ -482,6 +598,9 @@ textarea { resize: vertical; min-height: 120px; }
       qs('#update-subject-type').textContent = item.subject_type || 'Update';
       qs('#update-subject-state').textContent = item.state || '';
       qs('#open-update-gitea').href = item.url || '#';
+      qs('#update-reply').value = notificationReplier.loadDraft(item);
+      qs('#update-reply-status').textContent = '';
+      qs('#send-update-reply').disabled = false;
       qs('#retry-update-load').hidden = true;
       qs('#keep-update-unread').focus();
     },
@@ -591,11 +710,17 @@ textarea { resize: vertical; min-height: 120px; }
       if (item.is_review) {
         return '<article class="my-work-card"><button class="my-work-card-main review-trigger" data-review-index="' + index + '">' + contents + '</button>' + readUpdate + markRead + '</article>';
       }
+      if (item.kind === 'issue') {
+        return '<article class="my-work-card"><button class="my-work-card-main issue-trigger" data-issue-index="' + index + '">' + contents + '</button>' + readUpdate + markRead + '</article>';
+      }
       return '<article class="my-work-card"><a class="my-work-card-main" href="' + escAttr(item.url) + '" target="_blank" rel="noopener noreferrer">' + contents + '</a>' + readUpdate + markRead + '</article>';
     }).join('') : '<div class="muted">No ' + (selectedWorkFilter === 'review' ? 'reviews' : (selectedWorkFilter === 'update' ? 'unread updates' : (selectedWorkFilter === 'all' ? 'work' : selectedWorkFilter + ' items'))) + '.</div>';
     document.querySelectorAll('[data-review-index]').forEach(button => {
       button.addEventListener('click', () => openReviewSheet(lastMyWork[Number(button.dataset.reviewIndex)], button));
     });
+    document.querySelectorAll('[data-issue-index]').forEach(button => {
+      button.addEventListener('click', () => openIssueSheet(lastMyWork[Number(button.dataset.issueIndex)], button));
+    });
     document.querySelectorAll('[data-update-index]').forEach(button => {
       button.addEventListener('click', () => {
         const item = lastMyWork[Number(button.dataset.updateIndex)];
@@ -666,6 +791,93 @@ textarea { resize: vertical; min-height: 120px; }
     toggle?.focus();
   }
 
+  function renderIssueComment(comment) {
+    return '<div class="issue-comment"><div class="small">' +
+      escapeHtml(comment.author || 'Unknown author') +
+      (comment.created_at ? ' · ' + escapeHtml(fmt(comment.created_at)) : '') +
+      '</div><div class="issue-sheet-content">' +
+      escapeHtml(comment.body || 'No comment body provided.') + '</div></div>';
+  }
+
+  async function openIssueSheet(item, trigger) {
+    if (!item) return;
+    selectedIssue = item;
+    issueTrigger = trigger;
+    qs('#issue-sheet').classList.add('open');
+    qs('#issue-sheet-key').textContent = item.key || '';
+    qs('#issue-sheet-title').textContent = item.title || 'Assigned issue';
+    qs('#issue-sheet-status').textContent = 'Loading issue…';
+    qs('#issue-sheet-body').textContent = '';
+    qs('#issue-labels').textContent = '';
+    qs('#issue-assignees').textContent = '';
+    qs('#issue-comments').textContent = '';
+    qs('#issue-comment').value = issueController.loadDraft(item);
+    qs('#issue-comment-status').textContent = '';
+    qs('#retry-issue-load').hidden = true;
+    qs('#open-issue-gitea').href = item.url || '#';
+    qs('#send-issue-comment').disabled = false;
+    qs('#close-issue').disabled = false;
+    qs('#close-issue-sheet').focus();
+    try {
+      const detail = await issueController.load(item);
+      if (selectedIssue !== item) return;
+      qs('#issue-sheet-title').textContent = detail.title || 'Assigned issue';
+      qs('#issue-sheet-body').textContent = detail.body || 'No description provided.';
+      qs('#issue-labels').innerHTML = (detail.labels || []).map(label =>
+        '<span class="pill">' + escapeHtml(label) + '</span>'
+      ).join(' ');
+      qs('#issue-assignees').textContent = (detail.assignees || []).length ?
+        'Assigned to ' + detail.assignees.join(', ') : 'No assignee reported';
+      qs('#issue-comments').innerHTML = (detail.comments || []).length ?
+        detail.comments.map(renderIssueComment).join('') : '<div class="muted">No comments yet.</div>';
+      qs('#open-issue-gitea').href = detail.url || item.url || '#';
+      qs('#issue-sheet-status').textContent = 'Issue ready · ' + (detail.state || 'open');
+    } catch (error) {
+      if (selectedIssue !== item) return;
+      qs('#issue-sheet-status').textContent = error.message + ' Retry here or open it in Gitea.';
+      qs('#retry-issue-load').hidden = false;
+      qs('#retry-issue-load').focus();
+    }
+  }
+
+  function closeIssueSheet() {
+    qs('#issue-sheet').classList.remove('open');
+    selectedIssue = null;
+    if (issueTrigger?.isConnected) issueTrigger.focus();
+  }
+
+  function saveIssueCaptureDraft() {
+    issueCapture.saveDraft({
+      repository: qs('#create-issue-repository').value,
+      title: qs('#create-issue-title').value,
+      body: qs('#create-issue-body').value,
+    });
+  }
+
+  function openCreateIssueSheet() {
+    const captureDraft = issueCapture.loadDraft();
+    const repositories = lastContextSnapshot?.repos || [];
+    qs('#create-issue-repository').innerHTML = repositories.map(repository =>
+      '<option value="' + escAttr(repository.full_name) + '">' + escapeHtml(repository.full_name) + '</option>'
+    ).join('');
+    if (repositories.some(repository => repository.full_name === captureDraft.repository)) {
+      qs('#create-issue-repository').value = captureDraft.repository;
+    }
+    qs('#create-issue-title').value = captureDraft.title;
+    qs('#create-issue-body').value = captureDraft.body;
+    qs('#create-issue-status').textContent = repositories.length ? '' : 'No accessible repositories are available.';
+    qs('#submit-new-issue').disabled = !repositories.length;
+    qs('#create-issue-sheet').classList.add('open');
+    creatingIssue = true;
+    qs('#create-issue-title').focus();
+  }
+
+  function closeCreateIssueSheet() {
+    qs('#create-issue-sheet').classList.remove('open');
+    creatingIssue = false;
+    qs('#new-issue').focus();
+  }
+
   async function openReviewSheet(item, trigger) {
     selectedReview = item;
     reviewTrigger = trigger;
@@ -687,8 +899,11 @@ textarea { resize: vertical; min-height: 120px; }
     qs('#review-handoff-link').hidden = true;
     qs('#review-handoff-link').href = item.url;
     qs('#review-handoff-status').textContent = '';
+    qs('#review-submit-status').textContent = '';
+    qs('#submit-review').disabled = true;
     draft = null;
     reviewFiles = [];
+    selectedReviewHead = '';
     qs('#close-review-sheet').focus();
     try {
       const detail = await reviewController.load(selectedReview);
@@ -712,6 +927,7 @@ textarea { resize: vertical; min-height: 120px; }
         files: detail.files || [],
       });
       reviewFiles = detail.files || [];
+      selectedReviewHead = detail.head_sha || '';
       draft = createReviewController.createDraft({
         storage: localStorage,
         repository: item.repository,
@@ -741,6 +957,7 @@ textarea { resize: vertical; min-height: 120px; }
         escapeHtml(review.state || 'commented') + (review.body ? '<div class="small">' + escapeHtml(review.body) + '</div>' : '') + '</div>'
       ).join('') : '<div>No prior reviews.</div>';
       qs('#review-sheet-status').textContent = 'Ready to review · by ' + (detail.author || 'unknown author');
+      qs('#submit-review').disabled = false;
     } catch (error) {
       if (selectedReview !== item) return;
       qs('#review-sheet-status').textContent = error.message + ' Retry here or use Open in Gitea.';
@@ -755,6 +972,7 @@ textarea { resize: vertical; min-height: 120px; }
     progress = null;
     draft = null;
     reviewFiles = [];
+    selectedReviewHead = '';
     if (reviewTrigger?.isConnected) reviewTrigger.focus();
   }
 
@@ -904,12 +1122,145 @@ textarea { resize: vertical; min-height: 120px; }
   }
   qs('#open-palette').addEventListener('click', () => { qs('#cmd-palette').classList.add('open'); qs('#cmd-input').focus(); renderCommands(''); });
   qs('#cmd-input').addEventListener('input', (e) => renderCommands(e.target.value));
-  document.addEventListener('keydown', (e) => { if ((e.metaKey||e.ctrlKey) && e.key==='k') { e.preventDefault(); qs('#cmd-palette').classList.toggle('open'); if(qs('#cmd-palette').classList.contains('open')){ qs('#cmd-input').focus(); renderCommands(''); } } });
+  document.addEventListener('keydown', (e) => {
+    if (e.key === 'Escape' && creatingIssue) {
+      e.preventDefault();
+      saveIssueCaptureDraft();
+      closeCreateIssueSheet();
+      return;
+    }
+    if (e.key === 'Escape' && selectedIssue) {
+      e.preventDefault();
+      closeIssueSheet();
+      return;
+    }
+    if ((e.metaKey||e.ctrlKey) && e.key==='k') {
+      e.preventDefault();
+      qs('#cmd-palette').classList.toggle('open');
+      if (qs('#cmd-palette').classList.contains('open')) {
+        qs('#cmd-input').focus();
+        renderCommands('');
+      }
+    }
+  });
   qs('#close-whiteboard').addEventListener('click', () => closeModal('whiteboard-modal'));
+  qs('#new-issue').addEventListener('click', openCreateIssueSheet);
+  qs('#cancel-new-issue').addEventListener('click', () => {
+    saveIssueCaptureDraft();
+    closeCreateIssueSheet();
+  });
+  ['#create-issue-repository', '#create-issue-title', '#create-issue-body'].forEach(selector =>
+    qs(selector).addEventListener('input', saveIssueCaptureDraft)
+  );
+  qs('#create-issue-form').addEventListener('submit', async event => {
+    event.preventDefault();
+    const captureDraft = {
+      repository: qs('#create-issue-repository').value,
+      title: qs('#create-issue-title').value.trim(),
+      body: qs('#create-issue-body').value.trim(),
+    };
+    if (!captureDraft.repository || !captureDraft.title) {
+      qs('#create-issue-status').textContent = 'Choose a repository and add a title.';
+      qs('#create-issue-title').focus();
+      return;
+    }
+    const button = qs('#submit-new-issue');
+    button.disabled = true;
+    qs('#create-issue-status').textContent = 'Creating issue…';
+    try {
+      const confirmed = await issueCapture.submit(captureDraft);
+      lastContextSnapshot.issues = [confirmed].concat(lastContextSnapshot.issues || []);
+      lastMyWork = buildMyWork(lastContextSnapshot);
+      const created = lastMyWork.find(item =>
+        item.kind === 'issue' && item.repository === confirmed.repository && item.number === confirmed.number
+      );
+      closeCreateIssueSheet();
+      refreshMyWorkView();
+      qs('#my-work-action-status').textContent = created.key + ' created and assigned to you.';
+      openIssueSheet(created, qs('#new-issue'));
+    } catch (error) {
+      qs('#create-issue-status').textContent = error.message + ' Your draft is safe; retry.';
+      button.disabled = false;
+      qs('#create-issue-title').focus();
+    }
+  });
+  qs('#close-issue-sheet').addEventListener('click', closeIssueSheet);
+  qs('#retry-issue-load').addEventListener('click', () => {
+    if (selectedIssue) openIssueSheet(selectedIssue, issueTrigger);
+  });
+  qs('#issue-comment').addEventListener('input', event => {
+    if (selectedIssue) issueController.saveDraft(selectedIssue, event.target.value);
+  });
+  qs('#send-issue-comment').addEventListener('click', async () => {
+    if (!selectedIssue) return;
+    const body = qs('#issue-comment').value.trim();
+    if (!body) {
+      qs('#issue-comment-status').textContent = 'Write a comment before posting.';
+      qs('#issue-comment').focus();
+      return;
+    }
+    const button = qs('#send-issue-comment');
+    button.disabled = true;
+    qs('#issue-comment-status').textContent = 'Posting comment…';
+    try {
+      const comment = await issueController.comment(selectedIssue, body);
+      const empty = qs('#issue-comments .muted');
+      if (empty) empty.remove();
+      qs('#issue-comments').insertAdjacentHTML('beforeend', renderIssueComment(comment));
+      qs('#issue-comment').value = '';
+      qs('#issue-comment-status').textContent = 'Comment posted.';
+    } catch (error) {
+      qs('#issue-comment-status').textContent = error.message + ' Your draft is safe; retry.';
+      qs('#issue-comment').focus();
+    } finally {
+      button.disabled = false;
+    }
+  });
+  qs('#close-issue').addEventListener('click', async () => {
+    if (!selectedIssue || !window.confirm('Close ' + selectedIssue.key + '?')) return;
+    const closing = selectedIssue;
+    const button = qs('#close-issue');
+    button.disabled = true;
+    qs('#issue-sheet-status').textContent = 'Closing issue…';
+    try {
+      await issueController.close(selectedIssue);
+      lastMyWork = lastMyWork.filter(item =>
+        !(item.kind === 'issue' && item.repository === closing.repository && item.number === closing.number)
+      );
+      closeIssueSheet();
+      refreshMyWorkView();
+      qs('#my-work-action-status').textContent = closing.key + ' closed.';
+    } catch (error) {
+      qs('#issue-sheet-status').textContent = error.message + ' The issue remains in My Work; retry.';
+      button.disabled = false;
+      button.focus();
+    }
+  });
   qs('#keep-update-unread').addEventListener('click', () => closeUpdateSheet(true));
   qs('#retry-update-load').addEventListener('click', () => {
     if (selectedUpdate) notificationReader.open(selectedUpdate, lastMyWork);
   });
+  qs('#update-reply').addEventListener('input', event => {
+    if (selectedUpdate) notificationReplier.saveDraft(selectedUpdate, event.target.value);
+  });
+  qs('#send-update-reply').addEventListener('click', async () => {
+    if (!selectedUpdate) return;
+    const body = qs('#update-reply').value.trim();
+    if (!body) {
+      qs('#update-reply-status').textContent = 'Write a reply before sending.';
+      qs('#update-reply').focus();
+      return;
+    }
+    qs('#send-update-reply').disabled = true;
+    const result = await notificationReplier.submit(selectedUpdate, body);
+    qs('#send-update-reply').disabled = false;
+    if (result) {
+      qs('#update-reply').value = '';
+      qs('#mark-update-read-next').focus();
+    } else {
+      qs('#update-reply').focus();
+    }
+  });
   qs('#mark-update-read-next').addEventListener('click', async () => {
     qs('#mark-update-read-next').disabled = true;
     try {
@@ -927,6 +1278,37 @@ textarea { resize: vertical; min-height: 120px; }
   });
   qs('#review-summary').addEventListener('input', event => draft?.setSummary(event.target.value));
   qs('#review-decision').addEventListener('change', event => draft?.setDecision(event.target.value));
+  qs('#submit-review').addEventListener('click', async () => {
+    if (!draft || !selectedReview || !selectedReviewHead) return;
+    const snapshot = draft.snapshot();
+    const labels = { approve: 'Approve', request_changes: 'Request changes' };
+    if (labels[snapshot.decision] && !window.confirm(
+      labels[snapshot.decision] + ' ' + selectedReview.repository + '#' + selectedReview.number + '?'
+    )) return;
+    const button = qs('#submit-review');
+    button.disabled = true;
+    qs('#review-submit-status').textContent = 'Submitting review…';
+    try {
+      const result = await reviewController.submit(selectedReview, {
+        decision: snapshot.decision,
+        body: createReviewController.formatFeedback(snapshot, reviewFiles),
+        expected_head_sha: selectedReviewHead,
+      });
+      draft.clear();
+      progress?.clear();
+      qs('#review-decision').value = 'comment';
+      qs('#review-summary').value = '';
+      document.querySelectorAll('.review-note').forEach(note => { note.value = ''; });
+      if (progress) showReviewProgress(progress.snapshot());
+      qs('#review-submit-status').textContent = 'Review submitted · ' + (result.state || 'complete') + '.';
+      await load();
+      button.focus();
+    } catch (error) {
+      qs('#review-submit-status').textContent = error.message + ' Your draft is safe; retry or open in Gitea.';
+      button.disabled = false;
+      button.focus();
+    }
+  });
   qs('#copy-review-feedback').addEventListener('click', async () => {
     if (!draft || !selectedReview || reviewHandoffPending) return;
     reviewHandoffPending = true;

frontend/issue-sheet.js

@@ -0,0 +1,50 @@
+function createIssueSheet({ fetchJson, storage }) {
+  let commentRequest = null;
+  let closeRequest = null;
+  const issuePath = item => 'api/v1/repos/' + item.repository.split('/').map(encodeURIComponent).join('/') +
+    '/issues/' + encodeURIComponent(item.number);
+  const draftKey = item => 'stackchain.issue-comment.v1:' + item.repository + '#' + item.number;
+
+  return {
+    load(item) {
+      return fetchJson(issuePath(item) + '/detail', {
+        headers: { Accept: 'application/json' },
+      });
+    },
+    loadDraft(item) {
+      try { return storage?.getItem(draftKey(item)) || ''; }
+      catch (_error) { return ''; }
+    },
+    saveDraft(item, body) {
+      try { storage?.setItem(draftKey(item), body); }
+      catch (_error) { /* The textarea remains the fallback. */ }
+    },
+    close(item) {
+      if (closeRequest) return closeRequest;
+      closeRequest = fetchJson(issuePath(item) + '/close', {
+        method: 'PATCH',
+        headers: { Accept: 'application/json' },
+      }).then(result => {
+        if (result?.state !== 'closed') throw new Error('Issue closure was not confirmed.');
+        return result;
+      }).finally(() => { closeRequest = null; });
+      return closeRequest;
+    },
+    comment(item, body) {
+      if (commentRequest) return commentRequest;
+      this.saveDraft(item, body);
+      commentRequest = fetchJson(issuePath(item) + '/comments', {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+        body: JSON.stringify({ body }),
+      }).then(result => {
+        try { storage?.removeItem(draftKey(item)); }
+        catch (_error) { /* The upstream comment is authoritative. */ }
+        return result;
+      }).finally(() => { commentRequest = null; });
+      return commentRequest;
+    },
+  };
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createIssueSheet;

frontend/my-work.js

@@ -226,6 +226,39 @@ function createNotificationReader({ load, markRead, onOpen, onDetail, onItems, o
   };
 }
 
+function createNotificationReplier({ post, storage, onStatus }) {
+  let pending = false;
+  const keyFor = item => 'stackchain.update-reply.v1.' + item.notification_id;
+  return {
+    loadDraft(item) {
+      try { return storage.getItem(keyFor(item)) || ''; }
+      catch (_error) { return ''; }
+    },
+    saveDraft(item, body) {
+      try { storage.setItem(keyFor(item), body); }
+      catch (_error) { /* Keep the editable textarea as the fallback. */ }
+    },
+    async submit(item, body) {
+      if (pending) return false;
+      pending = true;
+      this.saveDraft(item, body);
+      onStatus('Sending reply…');
+      try {
+        const result = await post(item.notification_id, body);
+        try { storage.removeItem(keyFor(item)); }
+        catch (_error) { /* The posted reply is still authoritative. */ }
+        onStatus('Reply posted. You can mark this update read when ready.');
+        return result;
+      } catch (_error) {
+        onStatus('Could not send reply. Your draft is safe; retry.');
+        return false;
+      } finally {
+        pending = false;
+      }
+    },
+  };
+}
+
 function filterMyWork(items, selectedFilter) {
   if (selectedFilter === 'all') return items;
   if (selectedFilter === 'review') return items.filter((item) => item.is_review);
@@ -263,5 +296,6 @@ if (typeof module !== 'undefined' && module.exports) {
   buildMyWork.createBulkNotificationAcknowledger = createBulkNotificationAcknowledger;
   buildMyWork.createNotificationPager = createNotificationPager;
   buildMyWork.createNotificationReader = createNotificationReader;
+  buildMyWork.createNotificationReplier = createNotificationReplier;
   module.exports = buildMyWork;
 }

frontend/review-sheet.js

@@ -1,4 +1,6 @@
 function createReviewController({ fetchJson }) {
+  let pendingSubmission = null;
+
   function endpoint(item) {
     const [owner, repo] = String(item.repository || '').split('/');
     if (!owner || !repo || !Number.isInteger(Number(item.number))) {
@@ -12,7 +14,17 @@ function createReviewController({ fetchJson }) {
     return fetchJson(endpoint(item), { headers: { Accept: 'application/json' } });
   }
 
-  return { load };
+  function submit(item, payload) {
+    if (pendingSubmission) return pendingSubmission;
+    pendingSubmission = fetchJson(endpoint(item), {
+      method: 'POST',
+      headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+    }).finally(() => { pendingSubmission = null; });
+    return pendingSubmission;
+  }
+
+  return { load, submit };
 }
 
 function diffLineClass(line) {
@@ -90,7 +102,14 @@ function createProgress({ storage, repository, number, headSha, files }) {
     return snapshot();
   }
 
-  return { snapshot, markReviewed };
+  function clear() {
+    reviewed = [];
+    newHead = false;
+    try { storage.removeItem(key); } catch (error) { /* cleared in memory */ }
+    return snapshot();
+  }
+
+  return { snapshot, markReviewed, clear };
 }
 
 function createDraft({ storage, repository, number, headSha, files }) {
@@ -140,7 +159,13 @@ function createDraft({ storage, repository, number, headSha, files }) {
     return snapshot();
   }
 
-  return { snapshot, setNote, setSummary, setDecision };
+  function clear() {
+    draft = { notes: {}, summary: '', decision: 'comment' };
+    try { storage.removeItem(key); } catch (error) { /* cleared in memory */ }
+    return snapshot();
+  }
+
+  return { snapshot, setNote, setSummary, setDecision, clear };
 }
 
 function formatFeedback(draft, files) {

src/gitea_proxy.py

@@ -1,5 +1,6 @@
 import asyncio
 import os
+import re
 import shlex
 from typing import Any
 from urllib.parse import urlsplit
@@ -13,6 +14,10 @@ REVIEW_DIFF_MAX_LINES = 400
 _client: httpx.AsyncClient | None = None
 
 
+class StaleReviewError(ValueError):
+    """Raised before mutation when a pull request head changed during review."""
+
+
 def _auth() -> dict[str, str]:
     headers: dict[str, str] = {"Accept": "application/json"}
     if GITEA_TOKEN:
@@ -279,6 +284,171 @@ async def notification_detail(thread_id: int) -> dict:
     }
 
 
+async def reply_to_notification(thread_id: int, body: str) -> dict:
+    thread = await fetch(f"notifications/threads/{thread_id}")
+    if not isinstance(thread, dict):
+        raise ValueError("Gitea notification thread response was not an object")
+    repository = thread.get("repository")
+    subject = thread.get("subject")
+    if not isinstance(repository, dict) or not isinstance(subject, dict):
+        raise ValueError("Notification does not identify a conversation")
+    repository_name = repository.get("full_name")
+    subject_path = _gitea_api_path(subject.get("url"))
+    match = re.fullmatch(
+        r"repos/([^/]+/[^/]+)/(issues|pulls)/(\d+)", subject_path
+    )
+    if (
+        not match
+        or match.group(1) != repository_name
+        or subject.get("type") not in {"Issue", "Pull"}
+    ):
+        raise ValueError("Notification subject is not a supported conversation")
+    response = await _get_client().post(
+        f"/api/v1/repos/{match.group(1)}/issues/{match.group(3)}/comments",
+        headers=_auth(),
+        json={"body": body},
+    )
+    response.raise_for_status()
+    comment = response.json()
+    if not isinstance(comment, dict):
+        raise ValueError("Gitea comment response was not an object")
+    return {
+        "id": comment.get("id"),
+        "url": _safe_web_url(comment.get("html_url")),
+    }
+
+
+async def close_issue(repository: str, number: int) -> dict:
+    response = await _get_client().patch(
+        f"/api/v1/repos/{repository}/issues/{number}",
+        headers=_auth(),
+        json={"state": "closed"},
+    )
+    response.raise_for_status()
+    issue = response.json()
+    if not isinstance(issue, dict) or issue.get("state") != "closed":
+        raise ValueError("Gitea did not confirm issue closure")
+    return {
+        "number": issue.get("number"),
+        "state": "closed",
+        "closed_at": issue.get("closed_at", "")
+        if isinstance(issue.get("closed_at"), str)
+        else "",
+    }
+
+
+def _normalize_issue_comment(comment: dict) -> dict:
+    user_value = comment.get("user")
+    user: dict = user_value if isinstance(user_value, dict) else {}
+    return {
+        "id": comment.get("id"),
+        "author": user.get("login", "") if isinstance(user.get("login"), str) else "",
+        "body": comment.get("body", "") if isinstance(comment.get("body"), str) else "",
+        "created_at": comment.get("created_at", "")
+        if isinstance(comment.get("created_at"), str)
+        else "",
+        "url": _safe_web_url(comment.get("html_url")),
+    }
+
+
+async def comment_on_issue(repository: str, number: int, body: str) -> dict:
+    response = await _get_client().post(
+        f"/api/v1/repos/{repository}/issues/{number}/comments",
+        headers=_auth(),
+        json={"body": body},
+    )
+    response.raise_for_status()
+    comment = response.json()
+    if not isinstance(comment, dict):
+        raise ValueError("Gitea comment response was not an object")
+    return _normalize_issue_comment(comment)
+
+
+async def create_issue(repository: str, title: str, body: str, assignee: str) -> dict:
+    response = await _get_client().post(
+        f"/api/v1/repos/{repository}/issues",
+        headers=_auth(),
+        json={"title": title, "body": body, "assignee": assignee},
+    )
+    response.raise_for_status()
+    issue = response.json()
+    if not isinstance(issue, dict) or not isinstance(issue.get("number"), int):
+        raise ValueError("Gitea did not confirm issue creation")
+    assignees_value = issue.get("assignees")
+    assignees = assignees_value if isinstance(assignees_value, list) else []
+    confirmed_assignees = [
+        item["login"]
+        for item in assignees
+        if isinstance(item, dict) and isinstance(item.get("login"), str)
+    ]
+    if assignee not in confirmed_assignees:
+        raise ValueError("Gitea did not confirm issue self-assignment")
+    return {
+        "id": issue.get("id"),
+        "number": issue["number"],
+        "title": issue.get("title", "")
+        if isinstance(issue.get("title"), str)
+        else "",
+        "state": issue.get("state", "")
+        if isinstance(issue.get("state"), str)
+        else "",
+        "repository": repository,
+        "labels": [],
+        "assignees": confirmed_assignees,
+        "updated_at": issue.get("updated_at", "")
+        if isinstance(issue.get("updated_at"), str)
+        else "",
+        "url": _safe_web_url(issue.get("html_url")),
+    }
+
+
+async def issue_detail(repository: str, number: int) -> dict:
+    base = f"repos/{repository}/issues/{number}"
+    issue, comments = await asyncio.gather(
+        fetch(base), fetch(f"{base}/comments?limit=20&page=1")
+    )
+    if not isinstance(issue, dict):
+        raise ValueError("Gitea issue response was not an object")
+    labels_value = issue.get("labels")
+    labels: list = labels_value if isinstance(labels_value, list) else []
+    assignees_value = issue.get("assignees")
+    assignees: list = assignees_value if isinstance(assignees_value, list) else []
+    comments_value: list = comments if isinstance(comments, list) else []
+    normalized_comments = [
+        _normalize_issue_comment(comment)
+        for comment in comments_value
+        if isinstance(comment, dict)
+    ]
+    return {
+        "repository": repository,
+        "number": number,
+        "title": issue.get("title", "") if isinstance(issue.get("title"), str) else "",
+        "state": issue.get("state", "") if isinstance(issue.get("state"), str) else "",
+        "body": issue.get("body", "") if isinstance(issue.get("body"), str) else "",
+        "url": _safe_web_url(issue.get("html_url")),
+        "labels": [
+            label["name"] for label in labels
+            if isinstance(label, dict) and isinstance(label.get("name"), str)
+        ],
+        "assignees": [
+            assignee["login"] for assignee in assignees
+            if isinstance(assignee, dict) and isinstance(assignee.get("login"), str)
+        ],
+        "comments": normalized_comments,
+    }
+
+
+async def is_assigned_issue(repository: str, number: int) -> bool:
+    assigned = await issues()
+    return any(
+        isinstance(issue, dict)
+        and issue.get("number") == number
+        and isinstance(issue.get("repository"), dict)
+        and issue["repository"].get("full_name") == repository
+        for issue in (assigned or [])
+    )
+
+
 async def pull_requests() -> list[dict]:
     assigned, review_requested = await asyncio.gather(
         fetch("repos/issues/search?state=open&assigned=true&type=pulls&limit=50"),
@@ -381,6 +551,43 @@ async def pull_review_detail(repository: str, number: int) -> dict:
     }
 
 
+async def submit_pull_review(
+    repository: str,
+    number: int,
+    expected_head_sha: str,
+    decision: str,
+    body: str,
+) -> dict:
+    base = f"repos/{repository}/pulls/{number}"
+    pull = await fetch(base)
+    head = pull.get("head") if isinstance(pull, dict) else None
+    current_sha = head.get("sha") if isinstance(head, dict) else None
+    if current_sha != expected_head_sha:
+        raise StaleReviewError("Pull request changed while it was being reviewed")
+    response = await _get_client().post(
+        f"/api/v1/{base}/reviews",
+        headers=_auth(),
+        json={
+            "body": body,
+            "event": {
+                "comment": "COMMENT",
+                "approve": "APPROVE",
+                "request_changes": "REQUEST_CHANGES",
+            }[decision],
+            "commit_id": current_sha,
+        },
+    )
+    response.raise_for_status()
+    review = response.json()
+    if not isinstance(review, dict):
+        raise ValueError("Gitea review response was not an object")
+    return {
+        "id": review.get("id"),
+        "state": review.get("state") or "COMMENT",
+        "url": _safe_web_url(review.get("html_url")),
+    }
+
+
 async def activity_events(user: dict | None = None) -> list[dict]:
     if user is None:
         user = await current_user()

src/main.py

@@ -5,10 +5,9 @@ from contextlib import asynccontextmanager
 from pathlib import Path
 
 from fastapi import FastAPI, HTTPException, Path as PathParam, Query
-from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 from fastapi.staticfiles import StaticFiles
-from pydantic import BaseModel, Field, PositiveInt
+from pydantic import BaseModel, Field, PositiveInt, field_validator
 
 from src import gitea_proxy
 from src.gitea_proxy import (
@@ -53,6 +52,7 @@ CONTEXT_TIMEOUT_SECONDS = 5.0
 EVENT_STREAM_TIMEOUT_SECONDS = 5.0
 READINESS_TIMEOUT_SECONDS = 5.0
 REVIEW_DETAIL_TIMEOUT_SECONDS = 5.0
+ISSUE_ACTION_TIMEOUT_SECONDS = 5.0
 NOTIFICATION_MUTATION_TIMEOUT_SECONDS = 5.0
 NOTIFICATION_PAGE_TIMEOUT_SECONDS = 5.0
 NOTIFICATION_DETAIL_TIMEOUT_SECONDS = 5.0
@@ -82,6 +82,61 @@ class NotificationReadBatch(BaseModel):
     ids: list[PositiveInt] = Field(min_length=1, max_length=50)
 
 
+class NotificationReply(BaseModel):
+    body: str = Field(min_length=1, max_length=10_000)
+
+    @field_validator("body")
+    @classmethod
+    def strip_body(cls, value: str) -> str:
+        value = value.strip()
+        if not value:
+            raise ValueError("reply must not be blank")
+        return value
+
+
+class IssueComment(BaseModel):
+    body: str = Field(min_length=1, max_length=10_000)
+
+    @field_validator("body")
+    @classmethod
+    def strip_body(cls, value: str) -> str:
+        value = value.strip()
+        if not value:
+            raise ValueError("comment must not be blank")
+        return value
+
+
+class IssueCreation(BaseModel):
+    title: str = Field(min_length=1, max_length=255)
+    body: str = Field(default="", max_length=10_000)
+
+    @field_validator("title")
+    @classmethod
+    def strip_title(cls, value: str) -> str:
+        value = value.strip()
+        if not value:
+            raise ValueError("title must not be blank")
+        return value
+
+    @field_validator("body")
+    @classmethod
+    def strip_issue_body(cls, value: str) -> str:
+        return value.strip()
+
+
+class PullReviewSubmission(BaseModel):
+    decision: str
+    body: str = Field(max_length=10_000)
+    expected_head_sha: str
+
+    @field_validator("decision")
+    @classmethod
+    def validate_decision(cls, value: str) -> str:
+        if value not in {"comment", "approve", "request_changes"}:
+            raise ValueError("unsupported review decision")
+        return value
+
+
 def _context_payload(user_data, repo_data, issues_data, prs_data) -> dict:
     user_model = User(
         id=user_data["id"],
@@ -127,14 +182,6 @@ def _context_payload(user_data, repo_data, issues_data, prs_data) -> dict:
     ]
     return compute(user_model, repo_models, issue_models, pr_models).model_dump()
 
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=["*"],
-    allow_credentials=False,
-    allow_methods=["*"],
-    allow_headers=["*"],
-)
-
 app.mount("/static", StaticFiles(directory=FRONTEND_DIR), name="static")
 app.include_router(frontend_router)
 
@@ -145,7 +192,13 @@ async def prevent_live_api_caching(request, call_next):
     if request.url.path in {"/api/v1/context", "/api/v1/events", "/api/v1/live"} or (
         request.url.path.startswith("/api/v1/repos/")
         and request.url.path.endswith("/review")
-    ) or request.url.path.startswith("/api/v1/notifications"):
+    ) or request.url.path.startswith("/api/v1/notifications") or (
+        request.url.path.startswith("/api/v1/repos/")
+        and "/issues/" in request.url.path
+    ) or (
+        request.url.path.startswith("/api/v1/repos/")
+        and request.url.path.endswith("/issues")
+    ):
         response.headers["Cache-Control"] = "no-store"
     return response
 
@@ -626,6 +679,135 @@ async def read_notification(thread_id: int = PathParam(gt=0)) -> JSONResponse:
     return JSONResponse({"id": thread_id, "status": "read"})
 
 
+@app.post("/api/v1/notifications/{thread_id}/reply", status_code=201)
+async def reply_to_notification(
+    reply: NotificationReply, thread_id: int = PathParam(gt=0)
+) -> JSONResponse:
+    try:
+        result = await asyncio.wait_for(
+            gitea_proxy.reply_to_notification(thread_id, reply.body),
+            timeout=NOTIFICATION_MUTATION_TIMEOUT_SECONDS,
+        )
+    except Exception:
+        return JSONResponse(
+            {
+                "error": (
+                    "The reply could not be posted. Your draft is safe; please retry."
+                )
+            },
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+    return JSONResponse(result, status_code=201)
+
+
+@app.get("/api/v1/repos/{owner}/{repo}/issues/{number}/detail")
+async def assigned_issue_detail(owner: str, repo: str, number: int = PathParam(gt=0)):
+    repository = f"{owner}/{repo}"
+
+    async def load_assigned_issue():
+        if not await gitea_proxy.is_assigned_issue(repository, number):
+            raise HTTPException(status_code=404, detail="Assigned issue not found")
+        return await gitea_proxy.issue_detail(repository, number)
+
+    try:
+        return await asyncio.wait_for(
+            load_assigned_issue(), timeout=ISSUE_ACTION_TIMEOUT_SECONDS
+        )
+    except HTTPException:
+        raise
+    except TimeoutError:
+        return JSONResponse(
+            {"error": "Loading the issue timed out. Please retry."},
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+    except Exception:
+        return JSONResponse(
+            {"error": "The issue is temporarily unavailable. Please retry."},
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+
+
+@app.post("/api/v1/repos/{owner}/{repo}/issues", status_code=201)
+async def create_assigned_issue(creation: IssueCreation, owner: str, repo: str):
+    repository = f"{owner}/{repo}"
+
+    async def create_issue():
+        user, available = await asyncio.gather(
+            gitea_proxy.current_user(), gitea_proxy.repos()
+        )
+        login = user.get("login") if isinstance(user, dict) else None
+        accessible = {
+            item.get("full_name")
+            for item in (available if isinstance(available, list) else [])
+            if isinstance(item, dict)
+        }
+        if not login or repository not in accessible:
+            raise HTTPException(status_code=404, detail="Repository not found")
+        return await gitea_proxy.create_issue(
+            repository, creation.title, creation.body, login
+        )
+
+    try:
+        result = await asyncio.wait_for(create_issue(), timeout=ISSUE_ACTION_TIMEOUT_SECONDS)
+    except HTTPException:
+        raise
+    except Exception:
+        return JSONResponse(
+            {"error": "The issue could not be created. Your draft is safe; please retry."},
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+    return JSONResponse(result, status_code=201)
+
+
+@app.post("/api/v1/repos/{owner}/{repo}/issues/{number}/comments", status_code=201)
+async def comment_on_assigned_issue(
+    comment: IssueComment, owner: str, repo: str, number: int = PathParam(gt=0)
+):
+    repository = f"{owner}/{repo}"
+
+    async def post_comment():
+        if not await gitea_proxy.is_assigned_issue(repository, number):
+            raise HTTPException(status_code=404, detail="Assigned issue not found")
+        return await gitea_proxy.comment_on_issue(repository, number, comment.body)
+
+    try:
+        result = await asyncio.wait_for(post_comment(), timeout=ISSUE_ACTION_TIMEOUT_SECONDS)
+    except HTTPException:
+        raise
+    except Exception:
+        return JSONResponse(
+            {"error": "The comment could not be posted. Your draft is safe; please retry."},
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+    return JSONResponse(result, status_code=201)
+
+
+@app.patch("/api/v1/repos/{owner}/{repo}/issues/{number}/close")
+async def close_assigned_issue(owner: str, repo: str, number: int = PathParam(gt=0)):
+    repository = f"{owner}/{repo}"
+
+    async def close_issue():
+        if not await gitea_proxy.is_assigned_issue(repository, number):
+            raise HTTPException(status_code=404, detail="Assigned issue not found")
+        return await gitea_proxy.close_issue(repository, number)
+
+    try:
+        return await asyncio.wait_for(close_issue(), timeout=ISSUE_ACTION_TIMEOUT_SECONDS)
+    except HTTPException:
+        raise
+    except Exception:
+        return JSONResponse(
+            {"error": "The issue could not be closed. It remains in My Work; please retry."},
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+
+
 @app.get("/api/v1/repos/{owner}/{repo}/pulls/{number}/review")
 async def review_detail(owner: str, repo: str, number: int):
     async def load_requested_review():
@@ -655,3 +837,40 @@ async def review_detail(owner: str, repo: str, number: int):
             {"error": "Pull request review details are temporarily unavailable"},
             status_code=503,
         )
+
+
+@app.post("/api/v1/repos/{owner}/{repo}/pulls/{number}/review", status_code=201)
+async def submit_review(
+    submission: PullReviewSubmission, owner: str, repo: str, number: int
+):
+    repository = f"{owner}/{repo}"
+
+    async def submit_requested_review():
+        if not await is_requested_review(repository, number):
+            raise HTTPException(status_code=404, detail="Review request not found")
+        return await gitea_proxy.submit_pull_review(
+            repository,
+            number,
+            submission.expected_head_sha,
+            submission.decision,
+            submission.body,
+        )
+
+    try:
+        result = await asyncio.wait_for(
+            submit_requested_review(), timeout=REVIEW_DETAIL_TIMEOUT_SECONDS
+        )
+    except HTTPException:
+        raise
+    except gitea_proxy.StaleReviewError:
+        return JSONResponse(
+            {"error": "New commits were pushed. Refresh the review before submitting."},
+            status_code=409,
+        )
+    except Exception:
+        return JSONResponse(
+            {"error": "The review could not be submitted. Your draft is safe; please retry."},
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+    return JSONResponse(result, status_code=201)

tests/test_gitea_notifications.py

@@ -200,3 +200,51 @@ async def test_notification_detail_never_follows_foreign_api_urls():
     assert result["url"] == ""
     assert result["subject_body"] == ""
     assert result["latest_comment"]["body"] == ""
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize("subject_kind", ["issues", "pulls"])
+async def test_reply_to_notification_posts_to_its_issue_conversation(subject_kind):
+    requests = []
+
+    def upstream(request):
+        requests.append((request.method, str(request.url), request.content))
+        if request.method == "GET":
+            return httpx.Response(200, json={
+                "id": 42,
+                "repository": {"full_name": "stackchain/api"},
+                "subject": {
+                    "type": "Pull" if subject_kind == "pulls" else "Issue",
+                    "url": (
+                        "http://127.0.0.1:3000/api/v1/repos/stackchain/api/"
+                        f"{subject_kind}/7"
+                    ),
+                },
+            })
+        return httpx.Response(201, json={
+            "id": 91,
+            "html_url": "https://forge.example/stackchain/api/issues/7#issuecomment-91",
+        })
+
+    gitea_proxy.start_client(transport=httpx.MockTransport(upstream))
+    try:
+        result = await gitea_proxy.reply_to_notification(42, "Please retry the worker.")
+    finally:
+        await gitea_proxy.stop_client()
+
+    assert requests == [
+        (
+            "GET",
+            "http://127.0.0.1:3000/api/v1/notifications/threads/42",
+            b"",
+        ),
+        (
+            "POST",
+            "http://127.0.0.1:3000/api/v1/repos/stackchain/api/issues/7/comments",
+            b'{"body":"Please retry the worker."}',
+        ),
+    ]
+    assert result == {
+        "id": 91,
+        "url": "https://forge.example/stackchain/api/issues/7#issuecomment-91",
+    }

tests/test_issue_api.py

@@ -0,0 +1,382 @@
+import asyncio
+
+import httpx
+import pytest
+
+from src import gitea_proxy, main
+
+
+@pytest.mark.anyio
+async def test_create_issue_endpoint_derives_self_assignment_and_returns_confirmed_issue(monkeypatch):
+    calls = []
+
+    async def user():
+        return {"login": "timmy"}
+
+    async def available_repos():
+        return [{"full_name": "stackchain/api"}]
+
+    async def create(repository, title, body, assignee):
+        calls.append((repository, title, body, assignee))
+        return {
+            "id": 81,
+            "number": 17,
+            "title": title,
+            "state": "open",
+            "repository": repository,
+            "labels": [],
+            "assignees": [assignee],
+            "updated_at": "2026-08-07T03:00:00Z",
+            "url": "https://forge.example/stackchain/api/issues/17",
+        }
+
+    monkeypatch.setattr(main.gitea_proxy, "current_user", user)
+    monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(main.gitea_proxy, "create_issue", create, raising=False)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.post(
+            "/api/v1/repos/stackchain/api/issues",
+            json={"title": "  Capture mobile work  ", "body": "  Context  "},
+        )
+
+    assert response.status_code == 201
+    assert response.headers["cache-control"] == "no-store"
+    assert response.json()["number"] == 17
+    assert response.json()["assignees"] == ["timmy"]
+    assert calls == [("stackchain/api", "Capture mobile work", "Context", "timmy")]
+
+
+@pytest.mark.anyio
+async def test_gitea_create_issue_posts_self_assignment_and_normalizes_confirmation():
+    requests = []
+
+    async def handler(request):
+        requests.append(request)
+        return httpx.Response(201, json={
+            "id": 81, "number": 17, "title": "Capture mobile work", "state": "open",
+            "updated_at": "2026-08-07T03:00:00Z",
+            "html_url": "https://forge.example/stackchain/api/issues/17",
+            "assignees": [{"login": "timmy"}],
+        })
+
+    gitea_proxy.start_client(transport=httpx.MockTransport(handler))
+    try:
+        result = await gitea_proxy.create_issue(
+            "stackchain/api", "Capture mobile work", "Context", "timmy"
+        )
+    finally:
+        await gitea_proxy.stop_client()
+
+    assert len(requests) == 1
+    assert requests[0].method == "POST"
+    assert requests[0].url.path == "/api/v1/repos/stackchain/api/issues"
+    assert requests[0].content == (
+        b'{"title":"Capture mobile work","body":"Context","assignee":"timmy"}'
+    )
+    assert result["repository"] == "stackchain/api"
+    assert result["number"] == 17
+    assert result["assignees"] == ["timmy"]
+
+
+@pytest.mark.anyio
+async def test_create_issue_rejects_blank_title_before_upstream(monkeypatch):
+    called = False
+
+    async def user():
+        nonlocal called
+        called = True
+        return {"login": "timmy"}
+
+    monkeypatch.setattr(main.gitea_proxy, "current_user", user)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.post(
+            "/api/v1/repos/stackchain/api/issues", json={"title": "   ", "body": "Context"}
+        )
+
+    assert response.status_code == 422
+    assert response.headers["cache-control"] == "no-store"
+    assert called is False
+
+
+@pytest.mark.anyio
+async def test_gitea_create_issue_requires_confirmed_self_assignment():
+    async def handler(_request):
+        return httpx.Response(201, json={
+            "id": 81, "number": 17, "title": "Capture mobile work", "state": "open",
+            "html_url": "https://forge.example/stackchain/api/issues/17", "assignees": [],
+        })
+
+    gitea_proxy.start_client(transport=httpx.MockTransport(handler))
+    try:
+        with pytest.raises(ValueError, match="self-assignment"):
+            await gitea_proxy.create_issue(
+                "stackchain/api", "Capture mobile work", "", "timmy"
+            )
+    finally:
+        await gitea_proxy.stop_client()
+
+
+@pytest.mark.anyio
+async def test_issue_detail_endpoint_returns_assigned_issue_with_no_store(monkeypatch):
+    async def assigned(repository, number):
+        return (repository, number) == ("stackchain/api", 7)
+
+    async def detail(repository, number):
+        return {"repository": repository, "number": number, "title": "Fix mobile flow"}
+
+    monkeypatch.setattr(main.gitea_proxy, "is_assigned_issue", assigned, raising=False)
+    monkeypatch.setattr(main.gitea_proxy, "issue_detail", detail)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.get("/api/v1/repos/stackchain/api/issues/7/detail")
+
+    assert response.status_code == 200
+    assert response.headers["cache-control"] == "no-store"
+    assert response.json() == {
+        "repository": "stackchain/api", "number": 7, "title": "Fix mobile flow"
+    }
+
+
+@pytest.mark.anyio
+async def test_issue_detail_deadline_is_retryable_sanitized_and_cancels_work(monkeypatch):
+    cancelled = asyncio.Event()
+
+    async def assigned(repository, number):
+        try:
+            await asyncio.Event().wait()
+        finally:
+            cancelled.set()
+
+    monkeypatch.setattr(main.gitea_proxy, "is_assigned_issue", assigned)
+    monkeypatch.setattr(main, "ISSUE_ACTION_TIMEOUT_SECONDS", 0.01)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.get("/api/v1/repos/stackchain/api/issues/7/detail")
+
+    assert response.status_code == 503
+    assert response.headers["cache-control"] == "no-store"
+    assert response.headers["retry-after"] == "1"
+    assert response.json() == {"error": "Loading the issue timed out. Please retry."}
+    assert cancelled.is_set()
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize(
+    ("method", "path", "json_body"),
+    [
+        ("GET", "/api/v1/repos/stackchain/api/issues/7/detail", None),
+        ("POST", "/api/v1/repos/stackchain/api/issues/7/comments", {"body": "Hello"}),
+        ("PATCH", "/api/v1/repos/stackchain/api/issues/7/close", None),
+    ],
+)
+async def test_issue_actions_reject_items_not_assigned_to_service_user(
+    monkeypatch, method, path, json_body
+):
+    async def assigned(repository, number):
+        return False
+
+    monkeypatch.setattr(main.gitea_proxy, "is_assigned_issue", assigned)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.request(method, path, json=json_body)
+
+    assert response.status_code == 404
+    assert response.headers["cache-control"] == "no-store"
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize("body", ["   ", "x" * 10_001])
+async def test_issue_comment_rejects_blank_or_oversized_body_before_upstream(
+    monkeypatch, body
+):
+    called = False
+
+    async def assigned(repository, number):
+        nonlocal called
+        called = True
+        return True
+
+    monkeypatch.setattr(main.gitea_proxy, "is_assigned_issue", assigned)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.post(
+            "/api/v1/repos/stackchain/api/issues/7/comments", json={"body": body}
+        )
+
+    assert response.status_code == 422
+    assert response.headers["cache-control"] == "no-store"
+    assert called is False
+
+
+@pytest.mark.anyio
+async def test_issue_comment_endpoint_posts_only_to_assigned_issue(monkeypatch):
+    calls = []
+
+    async def assigned(repository, number):
+        return True
+
+    async def comment(repository, number, body):
+        calls.append((repository, number, body))
+        return {"id": 82, "author": "timmy", "body": body}
+
+    monkeypatch.setattr(main.gitea_proxy, "is_assigned_issue", assigned)
+    monkeypatch.setattr(main.gitea_proxy, "comment_on_issue", comment)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.post(
+            "/api/v1/repos/stackchain/api/issues/7/comments",
+            json={"body": "  Ready to ship  "},
+        )
+
+    assert response.status_code == 201
+    assert response.headers["cache-control"] == "no-store"
+    assert response.json() == {"id": 82, "author": "timmy", "body": "Ready to ship"}
+    assert calls == [("stackchain/api", 7, "Ready to ship")]
+
+
+@pytest.mark.anyio
+async def test_issue_close_endpoint_mutates_assigned_issue_only_after_confirmation(monkeypatch):
+    calls = []
+
+    async def assigned(repository, number):
+        return True
+
+    async def close(repository, number):
+        calls.append((repository, number))
+        return {"number": number, "state": "closed", "closed_at": "now"}
+
+    monkeypatch.setattr(main.gitea_proxy, "is_assigned_issue", assigned)
+    monkeypatch.setattr(main.gitea_proxy, "close_issue", close)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.patch("/api/v1/repos/stackchain/api/issues/7/close")
+
+    assert response.status_code == 200
+    assert response.headers["cache-control"] == "no-store"
+    assert response.json()["state"] == "closed"
+    assert calls == [("stackchain/api", 7)]
+
+
+@pytest.mark.anyio
+async def test_gitea_close_issue_patches_state_and_confirms_closed_response():
+    requests = []
+
+    async def handler(request):
+        requests.append(request)
+        return httpx.Response(
+            200,
+            json={"number": 7, "state": "closed", "closed_at": "2026-08-07T10:20:00Z"},
+        )
+
+    gitea_proxy.start_client(transport=httpx.MockTransport(handler))
+    try:
+        result = await gitea_proxy.close_issue("stackchain/api", 7)
+    finally:
+        await gitea_proxy.stop_client()
+
+    assert len(requests) == 1
+    assert requests[0].method == "PATCH"
+    assert requests[0].url.path == "/api/v1/repos/stackchain/api/issues/7"
+    assert requests[0].content == b'{"state":"closed"}'
+    assert result == {"number": 7, "state": "closed", "closed_at": "2026-08-07T10:20:00Z"}
+
+
+@pytest.mark.anyio
+async def test_gitea_issue_comment_posts_body_and_returns_safe_identity():
+    requests = []
+
+    async def handler(request):
+        requests.append(request)
+        return httpx.Response(
+            201,
+            json={
+                "id": 82,
+                "body": "Ready to ship",
+                "created_at": "2026-08-07T10:10:00Z",
+                "html_url": "https://forge.example/stackchain/api/issues/7#issuecomment-82",
+                "user": {"login": "timmy"},
+            },
+        )
+
+    gitea_proxy.start_client(transport=httpx.MockTransport(handler))
+    try:
+        result = await gitea_proxy.comment_on_issue("stackchain/api", 7, "Ready to ship")
+    finally:
+        await gitea_proxy.stop_client()
+
+    assert len(requests) == 1
+    assert requests[0].method == "POST"
+    assert requests[0].url.path == "/api/v1/repos/stackchain/api/issues/7/comments"
+    assert requests[0].content == b'{"body":"Ready to ship"}'
+    assert result == {
+        "id": 82,
+        "author": "timmy",
+        "body": "Ready to ship",
+        "created_at": "2026-08-07T10:10:00Z",
+        "url": "https://forge.example/stackchain/api/issues/7#issuecomment-82",
+    }
+
+
+@pytest.mark.anyio
+async def test_gitea_issue_detail_returns_normalized_context_and_recent_comments():
+    requests = []
+
+    async def handler(request):
+        requests.append((request.method, request.url.path, request.url.query.decode()))
+        if request.url.path.endswith("/comments"):
+            return httpx.Response(
+                200,
+                json=[
+                    {
+                        "id": 81,
+                        "body": "Latest update",
+                        "created_at": "2026-08-07T10:00:00Z",
+                        "html_url": "https://forge.example/stackchain/api/issues/7#issuecomment-81",
+                        "user": {"login": "sam"},
+                    }
+                ],
+            )
+        return httpx.Response(
+            200,
+            json={
+                "number": 7,
+                "title": "Fix mobile flow",
+                "state": "open",
+                "body": "Full issue context",
+                "html_url": "https://forge.example/stackchain/api/issues/7",
+                "labels": [{"name": "P1"}],
+                "assignees": [{"login": "timmy"}],
+            },
+        )
+
+    gitea_proxy.start_client(transport=httpx.MockTransport(handler))
+    try:
+        result = await gitea_proxy.issue_detail("stackchain/api", 7)
+    finally:
+        await gitea_proxy.stop_client()
+
+    assert requests == [
+        ("GET", "/api/v1/repos/stackchain/api/issues/7", ""),
+        ("GET", "/api/v1/repos/stackchain/api/issues/7/comments", "limit=20&page=1"),
+    ]
+    assert result == {
+        "repository": "stackchain/api",
+        "number": 7,
+        "title": "Fix mobile flow",
+        "state": "open",
+        "body": "Full issue context",
+        "url": "https://forge.example/stackchain/api/issues/7",
+        "labels": ["P1"],
+        "assignees": ["timmy"],
+        "comments": [
+            {
+                "id": 81,
+                "author": "sam",
+                "body": "Latest update",
+                "created_at": "2026-08-07T10:00:00Z",
+                "url": "https://forge.example/stackchain/api/issues/7#issuecomment-81",
+            }
+        ],
+    }

tests/test_my_work.py

@@ -9,6 +9,8 @@ from src.views import dashboard
 
 MY_WORK = Path(__file__).parents[1] / "frontend" / "my-work.js"
 REVIEW_SHEET = Path(__file__).parents[1] / "frontend" / "review-sheet.js"
+ISSUE_SHEET = Path(__file__).parents[1] / "frontend" / "issue-sheet.js"
+CREATE_ISSUE_SHEET = Path(__file__).parents[1] / "frontend" / "create-issue-sheet.js"
 
 
 def test_my_work_queue_prioritizes_labels_then_reviews_and_keeps_repo_identity():
@@ -116,6 +118,56 @@ process.stdout.write(JSON.stringify(buildMyWork.countMyWork({json.dumps(items)})
     assert json.loads(result.stdout) == {"all": 3, "issue": 1, "pull": 1, "review": 1, "update": 0}
 
 
+def test_issue_capture_is_single_flight_and_keeps_draft_until_confirmed_success():
+    script = f"""
+const createIssueCapture = require({json.dumps(str(CREATE_ISSUE_SHEET))});
+const values = new Map();
+const storage = {{
+  getItem:key => values.get(key) || null,
+  setItem:(key,value) => values.set(key,value),
+  removeItem:key => values.delete(key),
+}};
+let calls = [];
+let release;
+const capture = createIssueCapture({{
+  storage,
+  fetchJson: (url, options) => {{
+    calls.push({{url, options}});
+    return new Promise(resolve => {{ release = () => resolve({{
+      id:81, number:17, title:'Capture work', state:'open', repository:'stackchain/api',
+      labels:[], assignees:['timmy'], url:'https://forge.example/issues/17'
+    }}); }});
+  }},
+}});
+const draft = {{repository:'stackchain/api', title:'Capture work', body:'Context'}};
+capture.saveDraft(draft);
+const first = capture.submit(draft);
+const duplicate = capture.submit(draft);
+const during = capture.loadDraft();
+release();
+Promise.all([first, duplicate]).then(results => process.stdout.write(JSON.stringify({{
+  calls:calls.map(call => ({{url:call.url, method:call.options.method,
+    body:JSON.parse(call.options.body)}})), during, after:capture.loadDraft(), results
+}})));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+    output = json.loads(result.stdout)
+
+    assert output["calls"] == [{
+        "url": "api/v1/repos/stackchain/api/issues",
+        "method": "POST",
+        "body": {"title": "Capture work", "body": "Context"},
+    }]
+    assert output["during"] == {
+        "repository": "stackchain/api", "title": "Capture work", "body": "Context"
+    }
+    assert output["after"] == {"repository": "", "title": "", "body": ""}
+    assert output["results"][0]["number"] == 17
+    assert output["results"][1]["number"] == 17
+
+
 def test_unread_updates_enrich_matching_work_and_keep_unassigned_mentions_actionable():
     payload = {
         "user": {"login": "timmy"},
@@ -543,6 +595,150 @@ reader.open(item, [item]).then(() => {{
     ]
 
 
+def test_issue_sheet_loads_encoded_assigned_issue_detail_path():
+    script = f"""
+const createIssueSheet = require({json.dumps(str(ISSUE_SHEET))});
+let request;
+const controller = createIssueSheet({{ fetchJson: async (url, options) => {{
+  request = {{url, accept:options.headers.Accept}};
+  return {{title:'Fix mobile flow'}};
+}} }});
+controller.load({{repository:'stackchain/api', number:7}}).then(detail =>
+  process.stdout.write(JSON.stringify({{request, title:detail.title}}))
+);
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "request": {
+            "url": "api/v1/repos/stackchain/api/issues/7/detail",
+            "accept": "application/json",
+        },
+        "title": "Fix mobile flow",
+    }
+
+
+def test_issue_sheet_comment_is_single_flight_and_preserves_draft_until_success():
+    script = f"""
+const createIssueSheet = require({json.dumps(str(ISSUE_SHEET))});
+const values = new Map();
+const storage = {{
+  getItem:key => values.get(key) || null,
+  setItem:(key,value) => values.set(key,value),
+  removeItem:key => values.delete(key),
+}};
+let calls = 0;
+let release;
+const controller = createIssueSheet({{
+  storage,
+  fetchJson: (url, options) => {{
+    calls += 1;
+    return new Promise(resolve => {{ release = () => resolve({{id:82, body:'Ready'}}); }});
+  }},
+}});
+const item = {{repository:'stackchain/api', number:7}};
+controller.saveDraft(item, 'Ready');
+const first = controller.comment(item, 'Ready');
+const duplicate = controller.comment(item, 'Ready');
+const during = controller.loadDraft(item);
+release();
+Promise.all([first, duplicate]).then(results => process.stdout.write(JSON.stringify({{
+  calls, during, after:controller.loadDraft(item), results
+}})));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+    output = json.loads(result.stdout)
+
+    assert output["calls"] == 1
+    assert output["during"] == "Ready"
+    assert output["after"] == ""
+    assert output["results"] == [{"id": 82, "body": "Ready"}, {"id": 82, "body": "Ready"}]
+
+
+def test_issue_sheet_close_is_single_flight_and_waits_for_confirmed_closed_state():
+    script = f"""
+const createIssueSheet = require({json.dumps(str(ISSUE_SHEET))});
+let calls = 0;
+let release;
+const controller = createIssueSheet({{
+  fetchJson: (url, options) => {{
+    calls += 1;
+    return new Promise(resolve => {{ release = () => resolve({{number:7, state:'closed'}}); }});
+  }},
+}});
+const item = {{repository:'stackchain/api', number:7}};
+const first = controller.close(item);
+const duplicate = controller.close(item);
+release();
+Promise.all([first, duplicate]).then(results =>
+  process.stdout.write(JSON.stringify({{calls, results}}))
+);
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "calls": 1,
+        "results": [
+            {"number": 7, "state": "closed"},
+            {"number": 7, "state": "closed"},
+        ],
+    }
+
+
+@pytest.mark.anyio
+async def test_assigned_issues_open_accessible_mobile_action_sheet_with_safe_mutations():
+    html = await dashboard()
+
+    assert 'id="issue-sheet"' in html and 'aria-modal="true"' in html
+    assert 'class="my-work-card-main issue-trigger"' in html
+    assert 'id="close-issue-sheet"' in html
+    assert 'id="retry-issue-load"' in html
+    assert 'id="issue-sheet-body"' in html
+    assert 'id="issue-labels"' in html and 'id="issue-assignees"' in html
+    assert 'id="issue-comments"' in html
+    assert 'id="issue-comment"' in html and 'maxlength="10000"' in html
+    assert 'id="send-issue-comment"' in html
+    assert 'id="close-issue"' in html
+    assert 'id="open-issue-gitea"' in html and 'rel="noopener noreferrer"' in html
+    assert '.issue-sheet-panel { width:min(560px,100%);' in html
+    assert '.issue-sheet-content { overflow-wrap:anywhere;' in html
+    assert '.issue-sheet-actions button, .issue-sheet-actions a { min-height:44px;' in html
+    assert 'padding-bottom:calc(10px + env(safe-area-inset-bottom));' in html
+    assert '<script src="static/issue-sheet.js"></script>' in html
+    assert "issueController.load(item)" in html
+    assert "issueController.comment(selectedIssue" in html
+    assert "window.confirm('Close ' + selectedIssue.key + '?')" in html
+    assert "issueController.close(selectedIssue)" in html
+    assert "lastMyWork = lastMyWork.filter" in html
+    assert "if (issueTrigger?.isConnected) issueTrigger.focus()" in html
+    assert "e.key === 'Escape' && selectedIssue" in html
+
+
+@pytest.mark.anyio
+async def test_mobile_my_work_captures_new_issue_in_accessible_draft_safe_sheet():
+    html = await dashboard()
+
+    assert 'id="new-issue"' in html and 'New issue' in html
+    assert 'id="create-issue-sheet"' in html and 'aria-modal="true"' in html
+    assert 'id="create-issue-repository"' in html
+    assert 'id="create-issue-title"' in html and 'maxlength="255"' in html
+    assert 'id="create-issue-body"' in html and 'maxlength="10000"' in html
+    assert 'id="submit-new-issue"' in html
+    assert '.create-issue-sheet.open { display:flex; }' in html
+    assert 'height:100dvh;' in html
+    assert 'env(safe-area-inset-bottom)' in html
+    assert '<script src="static/create-issue-sheet.js"></script>' in html
+    assert 'createIssueCapture({ fetchJson: fetchReviewJson, storage: localStorage })' in html
+    assert 'lastMyWork = buildMyWork(lastContextSnapshot);' in html
+    assert 'openIssueSheet(created' in html
+
+
 @pytest.mark.anyio
 async def test_mobile_dashboard_puts_filterable_my_work_before_auxiliary_panels():
     html = await dashboard()
@@ -596,6 +792,78 @@ async def test_mobile_update_reader_is_in_app_safe_area_aware_and_actionable():
     assert "notificationReader.markReadAndNext(lastMyWork)" in html
 
 
+def test_notification_replier_preserves_failed_draft_and_clears_only_after_success():
+    script = f"""
+const buildMyWork = require({json.dumps(str(MY_WORK))});
+const values = new Map();
+const storage = {{
+  getItem: key => values.has(key) ? values.get(key) : null,
+  setItem: (key, value) => values.set(key, value),
+  removeItem: key => values.delete(key),
+}};
+const statuses = [];
+let calls = 0;
+let fail = true;
+const replier = buildMyWork.createNotificationReplier({{
+  storage,
+  post: async (id, body) => {{
+    calls += 1;
+    await new Promise(resolve => setTimeout(resolve, 5));
+    if (fail) throw new Error('offline');
+    return {{id:91, url:'https://forge.example/comment/91'}};
+  }},
+  onStatus: status => statuses.push(status),
+}});
+const item = {{notification_id:42}};
+replier.saveDraft(item, 'Please retry.');
+Promise.all([replier.submit(item, 'Please retry.'), replier.submit(item, 'Please retry.')])
+  .then(async first => {{
+    const afterFailure = replier.loadDraft(item);
+    fail = false;
+    const success = await replier.submit(item, afterFailure);
+    process.stdout.write(JSON.stringify({{
+      first, afterFailure, success, afterSuccess:replier.loadDraft(item), calls, statuses,
+    }}));
+  }});
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+    output = json.loads(result.stdout)
+
+    assert output["first"] == [False, False]
+    assert output["afterFailure"] == "Please retry."
+    assert output["success"]["id"] == 91
+    assert output["afterSuccess"] == ""
+    assert output["calls"] == 2
+    assert output["statuses"] == [
+        "Sending reply…",
+        "Could not send reply. Your draft is safe; retry.",
+        "Sending reply…",
+        "Reply posted. You can mark this update read when ready.",
+    ]
+
+
+@pytest.mark.anyio
+async def test_mobile_update_sheet_has_persistent_accessible_reply_composer():
+    html = await dashboard()
+
+    assert 'id="update-reply"' in html
+    assert 'maxlength="10000"' in html
+    assert 'id="send-update-reply"' in html
+    assert 'id="update-reply-status"' in html
+    assert 'aria-live="assertive"' in html
+    assert '.update-reply textarea { width:100%;' in html
+    assert '.update-reply button { min-height:44px;' in html
+    assert '.update-sheet-header button { min-height:44px;' in html
+    assert 'createNotificationReplier' in html
+    assert "method: 'POST'" in html
+    assert "'/reply'" in html
+    assert "notificationReplier.loadDraft(item)" in html
+    assert "notificationReplier.saveDraft(selectedUpdate" in html
+    assert "notificationReplier.submit(selectedUpdate" in html
+
+
 @pytest.mark.anyio
 async def test_updates_view_offers_confirmed_sticky_mobile_bulk_acknowledgement():
     html = await dashboard()
@@ -902,7 +1170,12 @@ async def test_review_sheet_loads_details_and_preserves_safe_gitea_handoff():
     assert "review-files" in html
     assert "review-history" in html
     assert "open-review-gitea" in html
-    assert "reviewController.submit" not in html
+    assert 'id="submit-review"' in html
+    assert 'id="review-submit-status"' in html and 'aria-live="assertive"' in html
+    assert "reviewController.submit(selectedReview" in html
+    assert "window.confirm" in html
+    assert "expected_head_sha: selectedReviewHead" in html
+    assert "await load()" in html
 
 
 @pytest.mark.anyio
@@ -931,6 +1204,86 @@ async def test_mobile_review_sheet_captures_and_safely_hands_off_feedback():
     assert "handoffWindow.opener = null" in html
 
 
+def test_review_controller_submits_once_while_request_is_in_flight():
+    script = f"""
+const createReviewController = require({json.dumps(str(REVIEW_SHEET))});
+let resolveRequest;
+const calls = [];
+const controller = createReviewController({{ fetchJson: (url, options) => {{
+  calls.push({{url, options}});
+  return new Promise(resolve => {{ resolveRequest = resolve; }});
+}} }});
+const item = {{repository:'stackchain/api', number:7}};
+const payload = {{decision:'approve', body:'Looks good.', expected_head_sha:'abc123'}};
+const first = controller.submit(item, payload);
+const second = controller.submit(item, payload);
+resolveRequest({{id:91, state:'APPROVED'}});
+Promise.all([first, second]).then(results => process.stdout.write(JSON.stringify({{
+  calls, results
+}})));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    payload = json.loads(result.stdout)
+    assert len(payload["calls"]) == 1
+    assert payload["calls"][0] == {
+        "url": "api/v1/repos/stackchain/api/pulls/7/review",
+        "options": {
+            "method": "POST",
+            "headers": {
+                "Accept": "application/json",
+                "Content-Type": "application/json",
+            },
+            "body": json.dumps(
+                {
+                    "decision": "approve",
+                    "body": "Looks good.",
+                    "expected_head_sha": "abc123",
+                },
+                separators=(",", ":"),
+            ),
+        },
+    }
+    assert payload["results"] == [
+        {"id": 91, "state": "APPROVED"},
+        {"id": 91, "state": "APPROVED"},
+    ]
+
+
+def test_successful_review_can_clear_head_scoped_draft_and_progress():
+    script = f"""
+const reviewSheet = require({json.dumps(str(REVIEW_SHEET))});
+const values = new Map();
+const removed = [];
+const storage = {{
+  getItem: key => values.get(key) || null,
+  setItem: (key, value) => values.set(key, value),
+  removeItem: key => {{ removed.push(key); values.delete(key); }},
+}};
+const options = {{storage, repository:'stackchain/api', number:7, headSha:'abc123', files:[{{filename:'a.py'}}]}};
+const draft = reviewSheet.createDraft(options);
+const progress = reviewSheet.createProgress(options);
+draft.setSummary('Looks good.');
+progress.markReviewed('a.py');
+draft.clear();
+progress.clear();
+process.stdout.write(JSON.stringify({{removed, draft:draft.snapshot(), progress:progress.snapshot()}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    payload = json.loads(result.stdout)
+    assert payload["removed"] == [
+        "stackchain.review-draft.v1:stackchain/api#7@abc123",
+        "stackchain.review-progress.v1:stackchain/api#7@abc123",
+    ]
+    assert payload["draft"] == {"notes": {}, "summary": "", "decision": "comment"}
+    assert payload["progress"]["reviewedCount"] == 0
+
+
 @pytest.mark.anyio
 async def test_mobile_review_failure_offers_an_in_place_retry_for_the_same_item():
     html = await dashboard()

tests/test_notification_reply.py

@@ -0,0 +1,90 @@
+import asyncio
+
+import httpx
+import pytest
+
+from src import main
+
+
+@pytest.mark.anyio
+async def test_notification_reply_api_validates_and_posts_without_marking_read(monkeypatch):
+    calls = []
+
+    async def reply(thread_id, body):
+        calls.append((thread_id, body))
+        return {
+            "id": 91,
+            "url": "https://forge.example/stackchain/api/issues/7#issuecomment-91",
+        }
+
+    async def must_not_mark_read(_thread_id):
+        raise AssertionError("replying must not mark the update read")
+
+    monkeypatch.setattr(main.gitea_proxy, "reply_to_notification", reply)
+    monkeypatch.setattr(main, "mark_notification_read", must_not_mark_read)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.post(
+            "/api/v1/notifications/42/reply",
+            json={"body": "  Please retry the worker.  "},
+        )
+        empty = await client.post(
+            "/api/v1/notifications/42/reply", json={"body": "   "}
+        )
+        oversized = await client.post(
+            "/api/v1/notifications/42/reply", json={"body": "x" * 10_001}
+        )
+
+    assert response.status_code == 201
+    assert response.json() == {
+        "id": 91,
+        "url": "https://forge.example/stackchain/api/issues/7#issuecomment-91",
+    }
+    assert response.headers["cache-control"] == "no-store"
+    assert empty.status_code == 422
+    assert oversized.status_code == 422
+    assert calls == [(42, "Please retry the worker.")]
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize("failure", ["timeout", "upstream"])
+async def test_notification_reply_failure_is_sanitized_retryable_and_no_store(
+    monkeypatch, failure
+):
+    async def reply(_thread_id, _body):
+        if failure == "timeout":
+            await asyncio.sleep(0.05)
+        raise httpx.HTTPError("token=secret upstream exploded")
+
+    monkeypatch.setattr(main.gitea_proxy, "reply_to_notification", reply)
+    monkeypatch.setattr(main, "NOTIFICATION_MUTATION_TIMEOUT_SECONDS", 0.01)
+    transport = httpx.ASGITransport(app=main.app, raise_app_exceptions=False)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.post(
+            "/api/v1/notifications/42/reply", json={"body": "Retry it"}
+        )
+
+    assert response.status_code == 503
+    assert response.json() == {
+        "error": "The reply could not be posted. Your draft is safe; please retry."
+    }
+    assert response.headers["retry-after"] == "1"
+    assert response.headers["cache-control"] == "no-store"
+    assert "secret" not in response.text
+
+
+@pytest.mark.anyio
+async def test_notification_reply_cannot_be_invoked_by_a_foreign_browser_origin():
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.options(
+            "/api/v1/notifications/42/reply",
+            headers={
+                "Origin": "https://evil.example",
+                "Access-Control-Request-Method": "POST",
+                "Access-Control-Request-Headers": "content-type",
+            },
+        )
+
+    assert response.status_code != 200
+    assert "access-control-allow-origin" not in response.headers

tests/test_review_api.py

@@ -3,7 +3,7 @@ import asyncio
 import httpx
 import pytest
 
-from src import main
+from src import gitea_proxy, main
 
 
 @pytest.mark.anyio
@@ -76,13 +76,202 @@ async def test_review_detail_has_one_retryable_deadline_and_cancels_pending_work
 
 
 @pytest.mark.anyio
-async def test_public_review_endpoint_does_not_expose_service_token_mutations():
+async def test_review_submission_posts_validated_decision_for_requested_current_head(monkeypatch):
+    calls = []
+
+    async def requested(repository, number):
+        return (repository, number) == ("stackchain/api", 7)
+
+    async def submit(repository, number, expected_head_sha, decision, body):
+        calls.append((repository, number, expected_head_sha, decision, body))
+        return {"id": 91, "state": "APPROVED", "url": "https://forge.example/reviews/91"}
+
+    monkeypatch.setattr(main, "is_requested_review", requested)
+    monkeypatch.setattr(main.gitea_proxy, "submit_pull_review", submit, raising=False)
     transport = httpx.ASGITransport(app=main.app)
     async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
         response = await client.post(
             "/api/v1/repos/stackchain/api/pulls/7/review",
-            json={"action": "approve"},
+            json={
+                "decision": "approve",
+                "body": "Looks good on mobile.",
+                "expected_head_sha": "abc123",
+            },
         )
 
-    assert response.status_code == 405
+    assert response.status_code == 201
+    assert response.headers["cache-control"] == "no-store"
+    assert response.json() == {
+        "id": 91,
+        "state": "APPROVED",
+        "url": "https://forge.example/reviews/91",
+    }
+    assert calls == [
+        ("stackchain/api", 7, "abc123", "approve", "Looks good on mobile.")
+    ]
+
+
+@pytest.mark.anyio
+async def test_gitea_review_submission_checks_head_then_maps_decision_upstream():
+    requests = []
+
+    async def handler(request):
+        requests.append(request)
+        if request.method == "GET":
+            return httpx.Response(200, json={"head": {"sha": "abc123"}})
+        return httpx.Response(
+            200,
+            json={
+                "id": 91,
+                "state": "APPROVED",
+                "html_url": "https://forge.example/reviews/91",
+            },
+        )
+
+    gitea_proxy.start_client(transport=httpx.MockTransport(handler))
+    try:
+        result = await gitea_proxy.submit_pull_review(
+            "stackchain/api", 7, "abc123", "approve", "Looks good."
+        )
+    finally:
+        await gitea_proxy.stop_client()
+
+    assert [(request.method, request.url.path) for request in requests] == [
+        ("GET", "/api/v1/repos/stackchain/api/pulls/7"),
+        ("POST", "/api/v1/repos/stackchain/api/pulls/7/reviews"),
+    ]
+    assert requests[1].content == b'{"body":"Looks good.","event":"APPROVE","commit_id":"abc123"}'
+    assert result == {
+        "id": 91,
+        "state": "APPROVED",
+        "url": "https://forge.example/reviews/91",
+    }
+
+
+@pytest.mark.anyio
+async def test_gitea_review_submission_rejects_changed_head_without_posting():
+    methods = []
+
+    async def handler(request):
+        methods.append(request.method)
+        return httpx.Response(200, json={"head": {"sha": "new456"}})
+
+    gitea_proxy.start_client(transport=httpx.MockTransport(handler))
+    try:
+        with pytest.raises(gitea_proxy.StaleReviewError):
+            await gitea_proxy.submit_pull_review(
+                "stackchain/api", 7, "abc123", "request_changes", "Please revise."
+            )
+    finally:
+        await gitea_proxy.stop_client()
+
+    assert methods == ["GET"]
+
+
+@pytest.mark.anyio
+async def test_review_submission_returns_conflict_when_pull_head_changed(monkeypatch):
+    async def requested(repository, number):
+        return True
+
+    async def submit(*args):
+        raise gitea_proxy.StaleReviewError("changed")
+
+    monkeypatch.setattr(main, "is_requested_review", requested)
+    monkeypatch.setattr(main.gitea_proxy, "submit_pull_review", submit)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.post(
+            "/api/v1/repos/stackchain/api/pulls/7/review",
+            json={
+                "decision": "request_changes",
+                "body": "Please revise.",
+                "expected_head_sha": "abc123",
+            },
+        )
+
+    assert response.status_code == 409
+    assert response.json() == {
+        "error": "New commits were pushed. Refresh the review before submitting."
+    }
+
+
+@pytest.mark.anyio
+async def test_review_submission_rejects_unsupported_decision_before_upstream(monkeypatch):
+    called = False
+
+    async def requested(repository, number):
+        nonlocal called
+        called = True
+        return True
+
+    monkeypatch.setattr(main, "is_requested_review", requested)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.post(
+            "/api/v1/repos/stackchain/api/pulls/7/review",
+            json={
+                "decision": "merge",
+                "body": "Ship it.",
+                "expected_head_sha": "abc123",
+            },
+        )
+
+    assert response.status_code == 422
+    assert called is False
+
+
+@pytest.mark.anyio
+async def test_review_submission_rejects_oversized_feedback_before_upstream(monkeypatch):
+    called = False
+
+    async def requested(repository, number):
+        nonlocal called
+        called = True
+        return True
+
+    monkeypatch.setattr(main, "is_requested_review", requested)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.post(
+            "/api/v1/repos/stackchain/api/pulls/7/review",
+            json={
+                "decision": "comment",
+                "body": "x" * 10_001,
+                "expected_head_sha": "abc123",
+            },
+        )
+
+    assert response.status_code == 422
+    assert called is False
+
+
+@pytest.mark.anyio
+async def test_review_submission_deadline_cancels_request_check(monkeypatch):
+    cancelled = asyncio.Event()
+
+    async def requested(repository, number):
+        try:
+            await asyncio.Event().wait()
+        finally:
+            cancelled.set()
+
+    monkeypatch.setattr(main, "is_requested_review", requested)
+    monkeypatch.setattr(main, "REVIEW_DETAIL_TIMEOUT_SECONDS", 0.01)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await asyncio.wait_for(
+            client.post(
+                "/api/v1/repos/stackchain/api/pulls/7/review",
+                json={
+                    "decision": "comment",
+                    "body": "Review note.",
+                    "expected_head_sha": "abc123",
+                },
+            ),
+            timeout=0.2,
+        )
+
+    assert response.status_code == 503
+    assert response.headers["retry-after"] == "1"
+    assert cancelled.is_set()