diffpatch endpoint effect is weaker than its operation effect #786

New issue

Closed

opened 2026-10-16 01:00:50 +00:00 by hexajon · 0 comments

hexajon commented

2026-10-16 01:00:50 +00:00

Owner

The POST /repos/{owner}/{repo}/diffpatch endpoint carries no declared effect, while the matching first-class operation carries the default-branch effect. So the same write, sent through the passthrough, is allowed to the default branch even though the first-class path refuses it.

Fix:

Give the diffpatch endpoint at least the default-branch effect.
Add a consistency check: an endpoint effect is never weaker than any operation that maps to the same path. That check catches diffpatch and any sibling.

Acceptance:

A passthrough diffpatch to the default branch is refused.
The consistency check fails on any endpoint weaker than its operation.

Part of the write-guard work (#670).

The `POST /repos/{owner}/{repo}/diffpatch` endpoint carries no declared effect, while the matching first-class operation carries the default-branch effect. So the same write, sent through the passthrough, is allowed to the default branch even though the first-class path refuses it. Fix: - Give the diffpatch endpoint at least the default-branch effect. - Add a consistency check: an endpoint effect is never weaker than any operation that maps to the same path. That check catches diffpatch and any sibling. Acceptance: - A passthrough diffpatch to the default branch is refused. - The consistency check fails on any endpoint weaker than its operation. Part of the write-guard work (#670).

hexajon added a new dependency

2026-10-16 01:01:42 +00:00

#670 epic: one guard enforces the recorded limits on every surface

hexajon referenced this issue from a pull request that will close it,

2026-10-16 02:41:35 +00:00

feat(guard): enforce the ADR 0046 write guard on every forge write surface #790

hexajon referenced this issue from a commit

2026-10-16 02:41:35 +00:00

fix(guard): #786 classify the diffpatch endpoint as a content write

hexajon closed this issue

2026-10-16 02:41:46 +00:00