From e55221f7d17ebab4493372845e414fcfc771896f Mon Sep 17 00:00:00 2001 From: "Claude (Pi session)" Date: Fri, 4 Sep 2026 17:59:51 +0200 Subject: [PATCH] tools: a missing collaborator is a failure, not a blank MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --verify's collaborator loop printed ⚪ and continued on 404 without touching `ok`, so the one instrument that checks Phase 1.2 could not report Phase 1.2 being undone. An agent removed from the repository read as "nothing to say" rather than as a gate that is no longer there. It has never fired: Gitea answers that endpoint with permission "read" for a non-collaborator rather than 404, so the case was caught by the role test two lines down. Correct outcome, wrong reason -- the same shape as the check that passed on an instance with no rule at all, and not worth keeping because the luck has held so far. Found by the port agent reading the file rather than running it, which is the only way this one was ever going to surface. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01McNbzUeq1KRBWs4G6X2YVj --- tools/gitea-protect | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/gitea-protect b/tools/gitea-protect index c1ac40e8..8c52efa7 100755 --- a/tools/gitea-protect +++ b/tools/gitea-protect @@ -172,8 +172,20 @@ def verify(tok): # merge, so a green rule proves nothing on its own. for agent in AGENTS: status, perm = api("GET", f"/collaborators/{agent}/permission", tok) + # 🔴 A MISSING COLLABORATOR IS A FAILURE, not a blank. This branch used + # to print ⚪ and `continue`, leaving `ok` untouched -- so the one + # instrument that checks Phase 1.2 could not report Phase 1.2 being + # undone. An agent removed from the repository read as "nothing to say" + # rather than as a gate that is no longer there. + # + # It never actually fired: Gitea answers this endpoint with permission + # "read" for a non-collaborator rather than 404, so the case was caught + # by the role test below -- by luck, not by design. That is the same + # shape as a check that passes on an instance with no rule at all, and + # it is not worth keeping just because the luck has held. if status == 404: - print(f" ⚪ {agent:<42} not a collaborator (yet)") + print(f" 🔴 {agent + ' is not a collaborator':<42} Phase 1.2 is undone") + ok = False continue if status != 200: print(f" 🔴 {agent:<42} permission unreadable ({status})")