fix: preserve capability preflight across safe reads (Closes #469) #502

Merged

sysadmin merged 2 commits from fix/issue-469-preflight-read-survival into master

2026-07-08 03:01:49 -05:00

Author	SHA1	Message	Date
sysadminandClaude Opus 4.8	3bce0a55fb	test: reset preflight globals in read-survival setUp (#469 ) Prevents cross-test leakage that masked the missing-capability fail-closed case. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-07-08 03:23:12 -04:00
sysadminandClaude Opus 4.8	afb4ba563c	fix: preserve capability preflight across interleaved read-only whoami (#469 ) Read-only gitea_whoami calls no longer clear a valid capability proof when whoami was already verified clean. Capability is consumed on mutation (one resolve per mutation), and verify_preflight_purity rejects task mismatches. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-07-08 03:23:12 -04:00

Author

SHA1

Message

Date

sysadminandClaude Opus 4.8

3bce0a55fb

test: reset preflight globals in read-survival setUp (#469 )

Prevents cross-test leakage that masked the missing-capability fail-closed case.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-07-08 03:23:12 -04:00

sysadminandClaude Opus 4.8

afb4ba563c

fix: preserve capability preflight across interleaved read-only whoami (#469 )

Read-only gitea_whoami calls no longer clear a valid capability proof when
whoami was already verified clean. Capability is consumed on mutation (one
resolve per mutation), and verify_preflight_purity rejects task mismatches.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-07-08 03:23:12 -04:00