Best possible solution:

Keep the merged Gateway attached-registry authorization fix, preserve Workboard's explicit CLI read/write scope contract, and close this superseded workaround branch.

Do we have a high-confidence way to reproduce the issue?

Yes. The old failure is source-reproducible from Workboard's explicit read/write CLI scopes meeting Gateway's old admin fallback, and current main now has an attached-registry authorization regression test for the same method.

Is this the best way to solve the issue?

No. The merged Gateway attached-registry authorization fix is the owner-boundary solution; this PR is now a narrower workaround that removes a least-privilege Workboard CLI scope contract.

Security review:

Security review needs attention: The diff removes a least-privilege Workboard CLI scope override and can broaden dispatch to the default admin-capable CLI scope set.

• [medium] Broadens Workboard dispatch CLI scopes — extensions/workboard/src/cli.ts:91
  Without the explicit operator.write/operator.read override, Workboard dispatch can request the broad default operator scope set for unclassified CLI plugin methods, including operator.admin.
  Confidence: 0.88

AGENTS.md: found and applied where relevant.

What I checked:

• Repository policy applied: Read the full root AGENTS.md and scoped extensions/AGENTS.md; the review applied the plugin boundary and auth/compatibility merge-risk guidance. (AGENTS.md:1, 07b934901a32)
• PR diff removes least-privilege scope override: The proposed branch deletes the explicit Workboard CLI dispatch scopes and lets callGatewayFromCli choose scopes from its fallback policy. (extensions/workboard/src/cli.ts:91, bbc9c2162d80)
• Current main keeps explicit Workboard scopes: Current main still passes operator.write and operator.read from callWorkboardGateway, preserving the documented Workboard CLI scope contract. (extensions/workboard/src/cli.ts:89, 07b934901a32)
• The Workboard method declares write scope: workboard.cards.dispatch is registered with WRITE_SCOPE, so the server-side method contract is operator.write. (extensions/workboard/src/gateway.ts:384, 07b934901a32)
• Current main fixes authorization at the Gateway owner boundary: Gateway authorization now consults the attached method registry's registered scope before falling back to global method-scope resolution. (src/gateway/server-methods.ts:259, 07b934901a32)
• Regression coverage locks the root fix: The authorization test proves operator.write can dispatch workboard.cards.dispatch from an attached registry and operator.read is rejected with missing operator.write. (src/gateway/server-methods.authorization.test.ts:54, 07b934901a32)

Likely related people:

• steipete: GitHub history shows steipete authored the merged Workboard worker-dispatch CLI PR and merged the canonical Gateway authorization fix that closed the linked bug. (role: merger and original Workboard CLI feature owner; confidence: high; commits: ed46e62bcc5d, 27f702d68fab; files: extensions/workboard/src/cli.ts, docs/cli/workboard.md, src/gateway/server-methods.ts)
• wangmiao0668000666: Authored the merged Gateway authorization repair for the same Workboard dispatch missing-scope bug and supplied the regression path that supersedes this branch. (role: canonical fix author; confidence: high; commits: 27f702d68fab; files: src/gateway/server-methods.ts, src/gateway/server-methods.authorization.test.ts, src/gateway/method-scopes.ts)
• vincentkoc: Recent merged Workboard board-run work and the v2026.6.10 release snapshot touched nearby Workboard and release surfaces, making this a useful secondary routing signal. (role: recent adjacent Workboard contributor; confidence: medium; commits: 82d24b26ea93, aa69b12d0086; files: docs/cli/workboard.md, extensions/workboard/src/dispatcher.ts, extensions/workboard/src/gateway.ts)

Codex review notes: model internal, reasoning high; reviewed against 07b934901a32; fix evidence: release v2026.6.10, commit 27f702d68fab.