Repository navigation
Re-point approvals.record-page-decisions acceptance[4]: a forged decision by a caller who cannot read the request answers 404 REQUEST_NOT_FOUND, not 403 FORBIDDEN #33060
Description
qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W
QA-source: #33058 · approvals.record-page-decisions · acceptance[4]
Kind: checklist re-point (stale spec), no product change.
Observed at ee9ad83 (reproduced on the approvals route, /reject and the action door)
As a contributor-bound member who can read showcase_project p28JyMGucv-7Y-Yy but is not a participant of its pending exec_review request: POST /api/v1/approvals/requests/<request id>/approve {} → 404 {"code":"REQUEST_NOT_FOUND"}; the request stays pending. The clause expects 403 FORBIDDEN "is not a pending approver".
Why the product is right
ApprovalService.refuseUnreadableRequest (packages/plugins/plugin-approvals/src/approval-service.ts) answers a caller who may not READ the request exactly as a missing id, so the request's existence never leaks; FORBIDDEN is reserved for a caller who can read the request but holds no slot. The rest of acceptance[4] held: the member's approvals read is [], the record page shows no decision buttons, and the admin's override folding is correct.
Proposed clause
"…a forged decision by a non-participant who cannot read the request answers 404 REQUEST_NOT_FOUND and the request stays pending; one by a reader who holds no slot answers 403 FORBIDDEN." Same 404 reading applies to request-page-reply A1, quorum-m-of-n S4 and decision-action-matrix A6/N2 (noted in the browser record). Bump the revision and add a history row.
Activity
objectstack-fleet commentedon Nov 13, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first touch →
domain:devx· p2 ·pm:queue· 2026-11-13T07:48Z⛔ Not a claim. Checklist re-point: the product answers
404 REQUEST_NOT_FOUNDby design to a non-participant, and the clause expects 403. Rule 9 of #32997 fixes these at p2 (「平台测试清单反复变红，肯定要修啊」).Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:devx#2 · sunhaolin · session_017xRBcRZn9wGkMSrznVX4JS
Claim: PM loop round 1 · 2026-11-14T14:48Z · family fold member — the full claim (fold gates, file surface, serial reading) is on the chain head #33032
Session:
session_017xRBcRZn9wGkMSrznVX4JSAccount:
sunhaolinBranch:
claude/issue-33032-checklist-repoint-foldDomain:
domain:devxSeat:
domain:devx#2File surface: this card's checklist item only, inside the fold's surface on #33032
Container & model:
M,mode:subagent,model: opus(default tier, no path-derived mandate),effort: highClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6847277717
Premise: holds — the clause still reads stale on
origin/maine540baf8Serial constraints cleared: see #33032
objectstack-fleet commentedon Nov 14, 2026
domain:devx#2 · sunhaolin · session_017xRBcRZn9wGkMSrznVX4JS
ACCEPT → PR #33273 comment 6879625279 · head
51098eec· landing waits for every check to go green.The sibling half (three approvals clauses) is now sub-issue #33275.
objectstack-fleet commentedon Nov 14, 2026
domain:devx#2 · sunhaolin · session_017xRBcRZn9wGkMSrznVX4JS
Landed · 2026-11-14T15:58Z · PR #33273 merged as
fdb76fb89d(closedcompleted).pm:dispatchedremoved in this stroke. ACCEPT 6879625279, landing 6879756256.The sibling half stays open as #33275 (p2,
pm:queue).