finding(settings): permissions.deny omits mcp__github__update_pull_request — an MCP content write (title/body/draft) the charter now declares closed, and the seat's ready-flip fallback names the same tool

Filed by the domain:skills execution seat (session session_01DAcomhvR9kKizeYgg89Vo8) from the os-dev report 5667412043 on #18205 (PR #18216), 2026-09-14T16:45Z. Bare finding — grading is the skills lane's own, deferred until PR #18216 lands (the declared side lives in it).

The gap

.claude/settings.json permissions.deny (lock 1, PR #18072 7ef05f9973) lists 14 mcp__github__* tools and omits mcp__github__update_pull_request, which edits a PR's title and body (content) and flips its draft state through MCP — i.e. a user-to-server write under the bound account's name. PR #18216 declares at SKILL.md :98 「内容写只走 REST 代理,⛔ 无 MCP 写」 and names the tool explicitly in the ACCEPT refusal at :602; the deny list does not enforce that for the dev container.

The tension to grade

The charter also keeps MCP update_pull_request as the SEAT's fallback for the ready flip (SKILL.md :621 「MCP 兜底显式带 draft: true」; rest-channel.md :53 「备用通道 MCP update_pull_request」). Adding it to permissions.deny closes the dev-side content-write gap and removes the seat-side fallback in the same stroke; the CCR route POST …/pulls/{n}/ccr/ready_for_review is the REST-only path the seats already use. Class (b) candidate: declared (:98) vs enforced (deny list) — with the fallback line to reconcile in the same PR if the deny is added.

Not this card

#18205 / PR #18216 (the declaration), #18181 (os-dev.md :287 label write), the propagation gap (a deny entry reaches only sessions cloned after it lands — #18205 (c)).

Dedupe keywords: update_pull_request, permissions.deny, MCP content write, lock 1, ready fallback.

Generated by Claude Code

Triage (stand-in routing for the VACANT triage seat #6015, noted on #7623; grade by the lane's self-triage): lands in domain:skills (.claude/settings.json + SKILL.md :622 + references/rest-channel.md :53); rationale: class (b) — SKILL.md :98 declares 「内容写只走 REST 代理,⛔ 无 MCP 写」 and :602 names update_pull_request in the ACCEPT refusal, while permissions.deny on b3b43b6 (14 entries) omits mcp__github__update_pull_request, and the seat-side fallback still names the tool (SKILL.md :622 「MCP 兜底显式带 draft: true」, rest-channel :53). finding dropped; pm:queue · Task · priority:p3 — a gate strengthening (one deny entry) plus two lines that route the fallback to the CCR routes the seats already use (POST …/pulls/{n}/ccr/ready_for_review, PUT …/ccr/auto_merge); ⛔ not the propagation gap (#18205 (c), landed as the harness reading). Clause-②: no. Dedupe: #18130 (the CCR route family as a facts card; rest-channel :48 / :51 already carry the two routes) is the neighbour, not a twin (control ready_for_review lit on it). Landing: rules layer (settings + SKILL.md) ⇒ four-piece and an authorized approval; build tier per --tier (SKILL.md ⇒ the contract-review tier); serial on the SKILL.md chain behind #17374 (second half) → #17497 → #18181. Skills seat, session session_01HZfg2AwVX191qCizp88gQr, 2026-09-15T02:12Z.

Generated by Claude Code

Claim: PM loop round 1
Session: session_01HZfg2AwVX191qCizp88gQr (skills seat; claimed at 2026-09-15T06:39Z)
Branch: claude/issue-18218-deny-update-pull-request
Worktree: objectstack-issue-18218
Domain: domain:skills
File surface: .claude/settings.json (one permissions.deny entry), .claude/skills/pm-dispatch/SKILL.md :622 (one line rewritten in place; ratchet 812/812), .claude/skills/pm-dispatch/references/rest-channel.md :53 (one line rewritten in place; ratchet 82/82) (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: CONTRACT_REVIEW_TIER — MANDATORY by dispatch-gates.mjs --tier for the SKILL.md line; no exit taken (the :622 rewrite changes the seat's fallback route, a protocol-semantics line, not a mechanical one-liner)
Clause-②: no
Thread-read: 5673622104
Serial constraints cleared: the SKILL.md chain has landed — PR #18242 1a02ef17 at 2026-09-15T06:20Z, PR #18244 1297178e and PR #18250 41ff021c at 2026-09-15T06:32Z, PR #18256 681317c3 at 2026-09-15T06:35Z (all merged_at); rest-channel :53 free since PR #18259 c053f748 at 2026-09-15T05:48Z; no open PR holds any of the three regions; batch 2/3 (the platform-readings fold in flight)

Generated by Claude Code

os-dev-report

{
  "issue": 18218,
  "status": "done",
  "branch": "claude/issue-18218-deny-update-pull-request",
  "worktree": "objectstack-issue-18218 — cut from origin/main 681317c3 (BASE); removed after the PR opened (node_modules deleted, git worktree remove exit 0; the local branch ref remains)",
  "pr": "#18276 https://github.com/objectstack-ai/objectstack/pull/18276 (draft, base main, labels documentation · size/xs · skip-changeset)",
  "head_sha": "79ee821ec7ae478207782787169a47482d2634b4",
  "premise_still_valid": true,
  "files_changed": [
    {
      "path": ".claude/settings.json",
      "lines": ":55 — one deny entry inserted directly after mcp__github__create_pull_request (the list is grouped, not alphabetical: content writes lead)",
      "bytes": "41 B + LF = 42 B added; file 5309 → 5351 B; permissions.deny 14 → 15 entries; JSON parses; every other byte identical"
    },
    {
      "path": ".claude/skills/pm-dispatch/SKILL.md",
      "lines": ":622 rewritten in place; 812 → 812 lines; frame block :734-:755 md5 3327d02c56f8a0eca88569dad2270f32 unchanged",
      "bytes": "119 → 117 B (cap 120); zero /#[0-9]{3,}/ hits"
    },
    {
      "path": ".claude/skills/pm-dispatch/references/rest-channel.md",
      "lines": ":53 rewritten in place; 82 → 82 lines",
      "bytes": "70 → 117 B (cap 120); zero /#[0-9]{3,}/ hits; same house form as :39 (⛔ 永不 MCP … (锁 1 已拒))"
    }
  ],
  "summary": "Added mcp__github__update_pull_request to permissions.deny so the enforced side matches the declared side (SKILL.md :98 内容写只走 REST 代理,⛔ 无 MCP 写; :602 names the tool in the ACCEPT refusal). Rewrote the two fallback lines that named the tool in the same stroke: SKILL.md :622 now routes review requests through the REST endpoint that leaves the draft bit alone and ready/draft flips through the ccr routes with no MCP fallback (端点见 platform-readings); rest-channel :53 now says ⛔ 永不 MCP update_pull_request(锁 1 已拒), ready/draft 翻转只走 ccr 路, and — precisely — auto-merge 备用 MCP 未拒, because mcp__github__enable_pr_auto_merge is not denied (it is hook-guarded by guard-governed-enqueue.sh, settings.json :82). Card assignee was already set (os-zhuang) by the dispatch; not touched. Governed rules layer: PR left draft, no reviewer request, no ccr probe, no auto-merge.",
  "tests": "Tree: 79ee821e (the PR's only commit; the working tree at gate time was byte-identical to it). Derived: node scripts/pm/dispatch-gates.mjs --commands on the three paths = 17 commands, all run via eval with status captured before any pipe; 16 exit 0 on first pass, check:doc-formula-expressions exit 3 (PREREQUISITE NOT MET: unbuilt @objectstack/formula + @objectstack/lint) → built under bash scripts/pm/os-verify-lock.sh -c (OS_VERIFY_LOCK_SLOT=issue-18218; VERDICT command-exit 0 · held the lock 1s · waited 0s; 4 turbo tasks, 4 cached) → re-run exit 0 (58 self-test cases; 22 record-scoped formula examples across 438 files / 1377 TS blocks clean). Reconciliation: node scripts/pm/dispatch-gates.mjs --ran ran.list → exit 0, ✓ 17 derived famil(ies) accounted for — 17 run, 0 NOT-MEASURED (the record corrected to the single measured reading after the tool flagged the 3-then-0 pair). Extras: six .claude/hooks/*.selftest.sh all exit 0 (55/130/120/69/53/38 passed, 0 failed); pnpm check:pm-dispatch-gates exit 0 (1730 cases); ESLint --format json over the three files exit 0 with all three File ignored because no matching configuration was supplied, errorCount 0 (eslint.config.mjs populates only **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}: JSON/MD are outside its population — ESLint/format not applicable, measured); node scripts/pm/label-write.mjs --self-test exit 0 (64 cases). Not run: repo-wide pnpm lint (CI-owned; the population probe proves the narrowing excludes nothing); package build/test/typecheck (no package touched). Ablation: not staged — no gate reads the deny roster membership (census: permissions.deny under scripts/ only in comments of check-skill-line-ratchet.mjs :883 and label-write.mjs :18, and the HANDOFF string :666), so reverting the entry moves zero diagnostics by construction; recorded as such, not as a green ablation.",
  "gates": [
    {
      "command": "node scripts/check-closing-keyword-parity.mjs",
      "exit": 0,
      "note": "derived"
    },
    {
      "command": "node scripts/check-closing-keyword-parity.mjs --self-test",
      "exit": 0,
      "note": "derived"
    },
    {
      "command": "node scripts/check-comment-mask-corpus.mjs",
      "exit": 0,
      "note": "derived"
    },
    {
      "command": "node scripts/pm/check-governed-queue-guard.mjs --self-test",
      "exit": 0,
      "note": "derived; 238 cases"
    },
    {
      "command": "pnpm --filter @objectstack/lint run check:doc-formula-expressions",
      "exit": 0,
      "note": "derived; first pass exit 3 PREREQUISITE NOT MET on the fresh worktree; formula+lint built under os-verify-lock.sh (VERDICT command-exit 0), re-run exit 0 (58 self-test cases, 22 examples clean)"
    },
    {
      "command": "pnpm check:agent-test-spelling",
      "exit": 0,
      "note": "derived"
    },
    {
      "command": "pnpm check:doc-authoring",
      "exit": 0,
      "note": "derived; 401 files clean, 44 published skill files clean; .claude/settings.json is an explicit exemption in its self-test"
    },
    {
      "command": "pnpm check:driver-memory-census",
      "exit": 0,
      "note": "derived"
    },
    {
      "command": "pnpm check:nul-bytes",
      "exit": 0,
      "note": "derived; 8684 text files scanned, no raw control bytes"
    },
    {
      "command": "pnpm check:pm-governed-merges",
      "exit": 0,
      "note": "derived; script is check-governed-merges.mjs --self-test (328 assertions); the dispatch spelled it --test"
    },
    {
      "command": "pnpm check:pm-governed-prose",
      "exit": 0,
      "note": "derived; 28 self-test cases; 2 surfaces name all 5 governed surfaces"
    },
    {
      "command": "pnpm check:pm-half-states",
      "exit": 0,
      "note": "derived; 4113 cases"
    },
    {
      "command": "pnpm check:pm-skill-id-lint",
      "exit": 0,
      "note": "derived; 27 files clean, pattern /#[0-9]{3,}/"
    },
    {
      "command": "pnpm check:pm-skill-ratchet",
      "exit": 0,
      "note": "derived; the dispatch spelled it check:pm-skill-line-ratchet; SKILL.md 812/812, rest-channel 82/82, 120-byte line cap held"
    },
    {
      "command": "pnpm check:refd-timer-probe",
      "exit": 0,
      "note": "derived"
    },
    {
      "command": "pnpm check:skill-frame-sync",
      "exit": 0,
      "note": "derived; 14 self-test cases; the one declared frame copy coherent; 74 markdown files scanned"
    },
    {
      "command": "pnpm check:watch-hint-literal",
      "exit": 0,
      "note": "derived"
    },
    {
      "command": ".claude/hooks/guard-governed-enqueue.selftest.sh",
      "exit": 0,
      "note": "parses settings.json; 55 passed 0 failed incl. settings registers the hook and the matcher covers enable_pr_auto_merge + merge_pull_request"
    },
    {
      "command": ".claude/hooks/guard-main-checkout-bash.selftest.sh",
      "exit": 0,
      "note": "130 passed 0 failed"
    },
    {
      "command": ".claude/hooks/guard-main-checkout.selftest.sh",
      "exit": 0,
      "note": "parses settings.json; 120 passed 0 failed"
    },
    {
      "command": ".claude/hooks/guard-process-kill.selftest.sh",
      "exit": 0,
      "note": "69 passed 0 failed"
    },
    {
      "command": ".claude/hooks/guard-shared-stash.selftest.sh",
      "exit": 0,
      "note": "53 passed 0 failed"
    },
    {
      "command": ".claude/hooks/guard-tree-enum.selftest.sh",
      "exit": 0,
      "note": "38 passed 0 failed"
    },
    {
      "command": "pnpm check:pm-dispatch-gates",
      "exit": 0,
      "note": "extra; 1730 cases"
    },
    {
      "command": "node --stack-size=4000 node_modules/eslint/bin/eslint.js --no-inline-config --no-error-on-unmatched-pattern --format json .claude/settings.json .claude/skills/pm-dispatch/SKILL.md .claude/skills/pm-dispatch/references/rest-channel.md",
      "exit": 0,
      "note": "population probe: 3 files ignored (no matching configuration), errorCount 0 — ESLint/format not applicable to JSON/MD"
    },
    {
      "command": "node scripts/pm/label-write.mjs --self-test",
      "exit": 0,
      "note": "64 cases; the live run on #18276 then wrote skip-changeset (POST 200) and its four-step read-back MATCHED"
    },
    {
      "command": "node scripts/pm/dispatch-gates.mjs --ran ran.list",
      "exit": 0,
      "note": "RECONCILIATION VERDICT: ✓ 17 derived famil(ies) accounted for — 17 run, 0 NOT-MEASURED"
    }
  ],
  "assumptions_verified": [
    {
      "assumption": "(1) mcp__github__update_pull_request is the only MCP tool that edits PR title/body/draft",
      "verdict": true,
      "evidence": "this session's mcp__github__* roster (63 names): update_pull_request is the only title/body/draft editor; update_pull_request_branch merges base into head (a branch update, REST twin PUT .../update-branch at rest-channel :44, not a content write); create_pull_request and pull_request_review_write are already denied. grep -rn update_pull_request scripts/ .claude/ AGENTS.md = 8 hits, none naming a second editor"
    },
    {
      "assumption": "(2) some gate or prose may state the deny count (14) or enumerate the list",
      "verdict": false,
      "evidence": "no census surface: permissions.deny under scripts/ appears only in comments (check-skill-line-ratchet.mjs :883, label-write.mjs :18) and the label-write HANDOFF string (:666); hook self-tests grep settings.json only for hook registration and the two enqueue matchers (guard-governed-enqueue.selftest.sh :393-:402); check-governed-merges.mjs :3228 classifies the path only; check-doc-authoring.mjs :1567 exempts the file. No counting gate went red — no file-surface breach"
    },
    {
      "assumption": "(3) enable_pr_auto_merge is out of scope and keeps an MCP alternative unless shown denied",
      "verdict": true,
      "evidence": "not in permissions.deny (15 entries after this PR); matched by the PreToolUse hook guard-governed-enqueue.sh (settings.json :82; hook header :5) which blocks only governed-PR enqueues lacking a pinned approval; rest-channel :53 says auto-merge 备用 MCP 未拒 — nothing declared closed that the deny list does not enforce"
    },
    {
      "assumption": "route (a) ordering convention of the deny list",
      "verdict": true,
      "evidence": "grouped, not alphabetical (content writes → file writes → sub_issue/merge/repo); entry inserted after create_pull_request; file otherwise byte-identical (diff = one added line)"
    },
    {
      "assumption": "route (b)/(c) one line each, in place, ≤120 B, no issue numbers, ratchet 812/812 and 82/82, frame md5 intact",
      "verdict": true,
      "evidence": "117 B and 117 B; 0 id-lint hits; wc -l 812 / 82; md5 3327d02c56f8a0eca88569dad2270f32; check:pm-skill-ratchet, check:pm-skill-id-lint, check:skill-frame-sync all exit 0"
    },
    {
      "assumption": "pnpm may be missing from PATH in the worktree; node_modules may need symlinking",
      "verdict": false,
      "evidence": "/opt/node22/bin/pnpm present; plain pnpm install finished in 7s (store-cached); node_modules is a real directory"
    }
  ],
  "deviations": [
    "Gate names: the dispatch wrote check:pm-skill-line-ratchet and check-governed-merges.mjs --test; package.json spells them check:pm-skill-ratchet and check:pm-governed-merges (= --self-test). Ran as package.json spells them.",
    "check:doc-formula-expressions exited 3 on the fresh worktree (prerequisite: unbuilt @objectstack/formula + @objectstack/lint); built under the shared verify lock (waited 0s, held 1s, all 4 tasks cached) and re-run to exit 0; the --ran record was corrected to that single measured reading after the tool flagged the 3-then-0 pair and read it as 3.",
    "Commit trailer: the harness attribution line names a model; AGENTS.md binds the commit trailer pair model-free and the pre-push hook refuses a model identifier there, so the model-free pair (Claude-Session + Co-authored-by: Claude) was written; pre-push confirmed 1 commit message carries no card relation and no model identifier in the trailer pair.",
    "PR body footer: sent the session-URL footer with no preceding rule line (platform-readings :336); the stored body is the sent body verbatim plus a platform-appended block (blank line, ---, session-URL footer): two footers. Left as is — no body PATCH in the write budget and AGENTS.md forbids re-sending a body that already carries an appended footer.",
    "A labeler bot wrote documentation and size/xs on #18276 before the skip-changeset write; label-write.mjs read the union back and it matched (all three present).",
    "Battery ran detached (setsid nohup, PID 12399); waiting used timeout 480 tail --pid, which bounds only the waiting tail, never the battery — no timeout -s TERM on any gate.",
    "Reverse verification/ablation not staged (no gate reads the deny roster membership); stated in the PR body and here rather than presented as a green ablation.",
    "platform-readings.md carries four lines that still describe MCP update_pull_request as a live channel (:43, :46, :47, :338); outside the three-file surface and the fold on that file is in flight, so NOT edited — reported under out_of_scope_findings for the seat's fold decision. The three-file fix is coherent without it (SKILL.md :622 points to platform-readings for endpoint facts, and the REST facts there stay correct)."
  ],
  "out_of_scope_findings": [
    "noted, not filed (seat decides fold vs card): references/platform-readings.md :43/:46/:47/:338 still describe MCP update_pull_request as a live channel (:46 MCP-only 席才用 update 加显式 draft: true; :47 MCP 传 draft: false; :43 any call must carry draft: true; :338 the wrapper deletes the body footer) — facts about a now-denied tool; the platform-readings fold is in flight on that file. 承接者:skills seat (#18195 fold). Dedupe words: update_pull_request, platform-readings, MCP-only, draft: true, denied tool.",
    "noted, not filed: no gate pins permissions.deny against the roster SKILL.md :602 names in the ACCEPT refusal; declared vs enforced is reconciled by hand (this PR is one such reconciliation). 承接者:skills seat, next settings-lock card; no open PR touches it.",
    "noted, not filed: SKILL.md :602 keeps the spelling settings.json deny 清单 + update_pull_request — redundant now (the tool is inside the list) but still true; one line outside this card's surface. 承接者:none.",
    "reading, not a card (for the platform-readings fold): REST POST /pulls in this session appended a rule + session-URL footer block under an existing rule-less session-URL footer (stored = sent + 91 B) — :336 says the rule-less footer survives verbatim; it did, and a second block landed under it. Dedupe words: PR body footer, POST /pulls, appended footer, session-URL.",
    "enable_pr_auto_merge question (assumption 3): not denied, hook-guarded only (guard-governed-enqueue.sh blocks the governed unapproved case); it is an enqueue write, not a content write, and REST PUT .../ccr/auto_merge exists. Whether declared = enforced should extend to the enqueue class (deny it too) is a separate decision; a card only if the seat wants it. Dedupe words: enable_pr_auto_merge, permissions.deny, guard-governed-enqueue, lock 1, ccr/auto_merge."
  ],
  "mcp_calls": "0 — no MCP GitHub tool called, read or write; every GitHub read and write went through the REST proxy (curl with GITHUB_TOKEN) or scripts/pm/label-write.mjs",
  "api_writes": "5 — git push x2 (empty-branch probe at 681317c3, then commit 79ee821e); POST /repos/objectstack-ai/objectstack/pulls (201 → #18276); POST /repos/objectstack-ai/objectstack/issues/18276/labels via label-write.mjs (200, skip-changeset); POST /repos/objectstack-ai/objectstack/issues/18218/comments (this report). No PATCH, no DELETE, no ready/draft/auto-merge/reviewer write.",
  "open_questions": [],
  "session": "no own session_01… id — this dev ran as mode:subagent under the dispatching seat's session session_01HZfg2AwVX191qCizp88gQr (the id the harness stamped on the commit trailer and the PR footer)",
  "timings": {
    "start": "2026-09-15T06:43:04Z",
    "pr_opened": "2026-09-15T07:05:15Z",
    "report_posted": "2026-09-15T07:09:53Z (composed; POSTed immediately after)"
  }
}

Generated by Claude Code

ACCEPT — skills seat, session session_01HZfg2AwVX191qCizp88gQr, 2026-09-15T07:18Z. Report 5676241066 on PR #18276 (head 79ee821e) reviewed by the checklist: files changed = the claim's surface exactly (settings.json +1 · SKILL.md :622 · rest-channel :53, one line each in place); Fixes #18218 alone beside a closing keyword; skip-changeset read back; mcp_calls 0 — every write through the REST proxy or label-write.mjs; gates 17 / 17 / 0 / 0 by --ran; the seat's re-run on a detached worktree of the head all exit 0 (record 5676329091 on the PR names each). Spot readings: the deny entry sits at :55 after create_pull_request and the JSON parses; both touched lines 117 B; 812/812, 82/82; frame md5 unchanged; the --tier MANDATORY tier honoured, no exit. Deviations (8) answered one by one in the record; the two gate-name slips were the dispatch's (owned). Out-of-scope findings routed: platform-readings :43 / :46 / :47 / :338 + the second-footer reading → #18280 (behind the fold); the deny-roster gate → #18281; enable_pr_auto_merge in the deny → #18282 (the maintainer's decision, A recommended). Governed rules layer ⇒ four-piece done: record 5676329091, 速读终稿 5676329589, needs-user-decision on the PR, reviews requested from os-zhuang and hotlong at 2026-09-15T07:16Z; the card stays pm:dispatched until the landing.

Generated by Claude Code

Landed — skills seat, session session_01HZfg2AwVX191qCizp88gQr, 2026-09-15T15:16Z. PR #18276 (head 79ee821e) merged by the queue as 53dd5aaaafbe877a1cc72aef26511bd15c927ecf (single-parent squash per git rev-list --parents) at 2026-09-15T15:14Z — the merged_at instant, carried identically by the merged and removed_from_merge_queue timeline events. Readings at 2026-09-15T15:16Z: git log origin/main carries (#18276); the queue ref refs/heads/gh-readonly-queue/main/pr-18276-* is gone from origin; the removed_from_merge_queue event is on the timeline. Governed landing by ruling C: authorized APPROVED review 5211697198 by os-zhuang at 2026-09-15T14:54Z on that head; record 5676329091 PASS, 速读终稿 5676329589, ACCEPT 5676330010 on this card, ruling-C provenance 5682476754 on the PR; the approver flipped the PR ready and enqueued it, the seat cleared needs-user-decision and read the enqueue. Now on origin/main: .claude/settings.json denies mcp__github__update_pull_request beside the other MCP content-write tools (lock 1 complete for the PR title/body channel), SKILL.md :622 and rest-channel :53 name it. Residue (pm:dispatched, assignee) stripped through label-write.mjs and read back; PR #18285 (#18281) now takes origin/main through update-branch for its deny-roster gate, and #18280 is dispatchable once the region claim is placed.

Generated by Claude Code

fix(settings,pm-dispatch): deny mcp__github__update_pull_request and …

fix(settings,pm): deny the MCP enqueue class — enable/disable_pr_auto…

Navigation Menu

Repository navigation

finding(settings): permissions.deny omits mcpgithubupdate_pull_request — an MCP content write (title/body/draft) the charter now declares closed, and the seat's ready-flip fallback names the same tool #18218

The gap

The tension to grade

Not this card

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(settings): permissions.deny omits mcp__github__update_pull_request — an MCP content write (title/body/draft) the charter now declares closed, and the seat's ready-flip fallback names the same tool #18218

Description

The gap

The tension to grade

Not this card

Activity

claude commented on Sep 15, 2026

claude commented on Sep 15, 2026

claude commented on Sep 15, 2026

claude commented on Sep 15, 2026

claude commented on Sep 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

finding(settings): permissions.deny omits mcpgithubupdate_pull_request — an MCP content write (title/body/draft) the charter now declares closed, and the seat's ready-flip fallback names the same tool #18218