Repository navigation
Model auth and apply reality for labels, protection, and preservation #17
Description
Goal
Model auth and apply behavior for labels, branch protection, and preservation using a sandbox baseline and approved mixed fixture states.
Observations
- No assertion is made about production protection; discoveries are limited to the sandbox baseline and approved mixed fixture states.
- Known capability limitations warn or skip only where the contract allows; unexpected API errors fail structured and non-zero rather than being silently ignored or retried.
- This depends on B01-03 (immutable published candidate and readiness) and B02-01, not on actual production resources.
Decision gate
Approve the observed apply and failure matrix before implementing any fallback.
Acceptance criteria
- Supported, limited, and unsupported operations are each reported with their real status.
- Known capability limits warn or skip only where the contract allows.
- Unexpected API errors fail non-zero and structured, with no silent ignore and no permission retry.
- Existing labels and settings are preserved.
Verification
- Sandbox apply -> each operation reports supported, limited, or unsupported; existing objects remain.
- Unexpected-error injection -> non-zero structured failure.
Release checkpoint
Remaining risk: real statuses depend on live sandbox API behavior. No governance weakening.
Tracking
Roadmap item: B02-02. All acceptance criteria remain pending; publication does not grant approval or release authority.
Dependencies
- Depends on Verify package completeness, migration, and release readiness #15 (B01-03).
- Depends on Define an isolated sandbox protocol for real GitHub applies #16 (B02-01).
Activity
egdev6 commentedon Oct 10, 2026
ODD review: live sandbox validation after offline delivery
Issue: #17, dependencies #15 and #16.
Clarifies the original issue body without removing its goal or acceptance criteria. The current #15 review owns branch-protection contract, implementation and simulated/offline tests. #17 verifies actual auth/apply behavior for labels, branch protection and preservation against an approved sandbox baseline and mixed fixture states.
Full scope and acceptance
No assertion concerns production protection. Sandbox identity, target, permissions and fixture mutations must be approved explicitly under #16.
Approve the observed apply/failure matrix before implementing any fallback. Preserve stronger protection; no governance weakening, automatic rollback or cleanup.
ODD and checks
#17's live checks are not a prerequisite for closing #15/B01; dependencies continue to run from #17 to #15/#16, not backwards.
This review does not authorize sandbox provisioning, credential/secret creation, live mutations, implementation, assignment, closure, release or cleanup.