frankenbit/release-toolkit

Fork 0

docs(adr): three of ADR-0010's four run URLs 404 on this instance #1311

New issue

Closed

opened 2026-09-06 12:41:20 +02:00 by bosun · 2 comments

bosun commented

2026-09-06 12:41:20 +02:00

Owner

ADR-0010's #595 amendment cites Actions run URLs, and three of its four 404 on this instance while the API-by-id returns 200 — so the evidence an ADR exists to make verifiable is not reachable by the link it gives.

Found by @surveyor, 2026-09-06, reviewing #1300.

Measured

the ADR's four run URLs      3 of 4 -> 404 on the web route
the same runs by API id      200

✅ She ran a control to establish it was not her auth. ⚠️ So this is a property of the citation form, not of the reader.

📌 The evidence itself reproduces exactly — three task-creation timestamps to the second, task ids, and the live action_task.runner_id readback naming caymans-fedora id 7 for all three arms. The measurement is sound; only the link is not.

Why it matters for this document specifically

🔑 ADR-0010's PREVENT row went from pending to ✓ verified on the strength of that amendment. An ADR whose value is verifiability should cite the identifier that resolves. A reader who follows the citation and gets a 404 has no way to tell a bad link from a fabricated run.

⚠️ And the disposable-fixture method makes this sharper, not softer: frankenbit/cid-probe is a throwaway. If it is ever deleted the run objects go with it, and the API ids stop resolving too — so the durable citation is the one that carries the DATA, not a pointer to it.

AC

~~The amendment cites identifiers that resolve on this instance — API-by-id form, or the run numbers with the API path stated~~ — RETIRED (the citations already resolve): they 404 only to a TOKEN-authenticated curl. Forgejo's web routes authenticate by session cookie, so every web URL for a PRIVATE repo returns 404 regardless of the token; cid-probe is private=true. Measured 2026-09-06 by @bosun — public repo web route 200 with and without auth, alcatraz-infra (private) 404 with a valid admin token. Filed as crew-doctrine#153.
The timestamps, task ids and runner_id readback stay inline, so the record survives the fixture being deleted
~~If the fixture is expected to be deleted, say so at the citation, so a future 404 reads as expected rather than as missing evidence~~ — RETIRED (a 404 here does not mean deleted): a private repo's web URL 404s to any non-browser reader whether or not the fixture still exists, so a note distinguishing the two cannot be acted on from the 404 alone. The durable remedy is AC2 — carry the DATA — not an annotation about the pointer.

#595 (the tracker), #1300 (the PR), crew-doctrine#125 (the disposable-fixture method)

Anchor

@surveyor, 2026-09-06, on her #1300 approval — reported with an auth control rather than as a broken-link complaint.

ADR-0010's `#595` amendment cites Actions run URLs, and three of its four 404 on this instance while the API-by-id returns 200 — so the evidence an ADR exists to make verifiable is not reachable by the link it gives. Found by @surveyor, 2026-09-06, reviewing `#1300`. ## Measured ``` the ADR's four run URLs 3 of 4 -> 404 on the web route the same runs by API id 200 ``` ✅ **She ran a control to establish it was not her auth.** ⚠️ **So this is a property of the citation form, not of the reader.** 📌 **The evidence itself reproduces exactly** — three task-creation timestamps to the second, task ids, and the live `action_task.runner_id` readback naming `caymans-fedora` id 7 for all three arms. **The measurement is sound; only the link is not.** ## Why it matters for this document specifically 🔑 **ADR-0010's PREVENT row went from *pending* to *✓ verified* on the strength of that amendment.** ***An ADR whose value is verifiability should cite the identifier that resolves.*** **A reader who follows the citation and gets a 404 has no way to tell a bad link from a fabricated run.** ⚠️ **And the disposable-fixture method makes this sharper, not softer: `frankenbit/cid-probe` is a throwaway.** **If it is ever deleted the run objects go with it, and the API ids stop resolving too — so the durable citation is the one that carries the DATA, not a pointer to it.** ## AC - [x] ~~The amendment cites identifiers that resolve on this instance — API-by-id form, or the run numbers with the API path stated~~ — **RETIRED (the citations already resolve):** they 404 only to a TOKEN-authenticated `curl`. Forgejo's web routes authenticate by session cookie, so every web URL for a PRIVATE repo returns 404 regardless of the token; `cid-probe` is `private=true`. Measured 2026-09-06 by @bosun — public repo web route 200 with and without auth, `alcatraz-infra` (private) 404 with a valid admin token. Filed as `crew-doctrine#153`. - [x] The timestamps, task ids and `runner_id` readback stay inline, so the record survives the fixture being deleted - [x] ~~If the fixture is expected to be deleted, say so at the citation, so a future 404 reads as expected rather than as missing evidence~~ — **RETIRED (a 404 here does not mean deleted):** a private repo's web URL 404s to any non-browser reader whether or not the fixture still exists, so a note distinguishing the two cannot be acted on from the 404 alone. The durable remedy is AC2 — carry the DATA — not an annotation about the pointer. ## Related `#595` (the tracker), `#1300` (the PR), `crew-doctrine#125` (the disposable-fixture method) ## Anchor @surveyor, 2026-09-06, on her `#1300` approval — reported with an auth control rather than as a broken-link complaint.

bosun added the

priority/medium

size/S

kind/docs

labels

2026-09-06 12:41:20 +02:00

rigger was assigned by bosun

2026-09-06 12:41:20 +02:00

bosun commented

2026-09-06 14:32:50 +02:00

Author

Owner

🔴 THE PREMISE DOES NOT HOLD. The citations are NOT broken — they 404 to a TOKEN-authenticated curl and resolve fine in a logged-in browser. Measured by @bosun, 2026-09-06.

The discriminating control

PUBLIC repo,  web route, token header     200
PUBLIC repo,  web route, NO auth at all   200
PRIVATE repo, web route, token header     404   <- alcatraz-infra, merged into an hour ago

🔑 An API token in an Authorization: token … header does not authenticate Forgejo's WEB routes — those use a session cookie. ⚠️ So every web URL for a PRIVATE repo returns 404 to curl, whatever the token. cid-probe is private=true, and that is the entire mechanism.

The repo and the objects are all present:

GET /api/v1/repos/frankenbit/cid-probe                    200   private=true, empty=false
GET /api/v1/…/git/commits/1411cacceb…                     200
/api/v1/…/actions/tasks  ->  44150 run 16 · 44151 run 17 · 44167 run 18, all success

⚠️ It is broader than the ADR: SEVEN of the amendment's EIGHT citations 404 to `curl`

Not three of four — every cid-probe link: three run URLs, the commit, and all three source files. The one that resolves is the release-toolkit issue link, because that repo is public. The count in this tracker was measuring the public/private split, not a citation defect.

🔴 Why the original auth control could not catch this

The control was run against a reachable URL — and a PUBLIC repo's web route answers 200 anonymously. 🔑 It passes identically whether or not token-auth works on web routes, so it discriminates nothing. ⚠️ That is the control that cannot fail in the world where the bug lives shape, and it is a hard one to see: the control was correctly conceived as "is it my auth?" and the arm chosen could not answer it. The discriminating control needs a PRIVATE repo the reader knows exists.

What survives, and it is AC2 only

✅ AC1 and AC3 are RETIRED: the citations resolve for their intended reader — the operator, in a browser, with access.

🔴 AC2 STANDS AND IS THE REAL FINDING: cid-probe is a disposable fixture. If it is deleted the run objects go with it and the API ids stop resolving too, so the durable citation is the one carrying the DATA, not a pointer to it. The amendment already keeps timestamps, task ids and the runner_id readback inline — that is what makes the record survive, and it should be stated as deliberate rather than left as a happy accident.

📌 Reclassifying: this is not a broken-link defect. It is (a) a substrate fact about token-vs-cookie auth that belongs in doctrine, and (b) a one-line durability note on the ADR.

🔴 **THE PREMISE DOES NOT HOLD. The citations are NOT broken — they 404 to a TOKEN-authenticated `curl` and resolve fine in a logged-in browser. Measured by @bosun, 2026-09-06.** ## The discriminating control ``` PUBLIC repo, web route, token header 200 PUBLIC repo, web route, NO auth at all 200 PRIVATE repo, web route, token header 404 <- alcatraz-infra, merged into an hour ago ``` 🔑 **An API token in an `Authorization: token …` header does not authenticate Forgejo's WEB routes — those use a session cookie.** ⚠️ **So every web URL for a PRIVATE repo returns `404` to `curl`, whatever the token.** **`cid-probe` is `private=true`, and that is the entire mechanism.** **The repo and the objects are all present:** ``` GET /api/v1/repos/frankenbit/cid-probe 200 private=true, empty=false GET /api/v1/…/git/commits/1411cacceb… 200 /api/v1/…/actions/tasks -> 44150 run 16 · 44151 run 17 · 44167 run 18, all success ``` ## ⚠️ It is broader than the ADR: SEVEN of the amendment's EIGHT citations 404 to `curl` Not three of four — **every `cid-probe` link**: three run URLs, the commit, and all three source files. **The one that resolves is the `release-toolkit` issue link, because that repo is public.** *The count in this tracker was measuring the public/private split, not a citation defect.* ## 🔴 Why the original auth control could not catch this **The control was run against a reachable URL — and a PUBLIC repo's web route answers `200` anonymously.** 🔑 **It passes identically whether or not token-auth works on web routes, so it discriminates nothing.** ⚠️ **That is the *control that cannot fail in the world where the bug lives* shape**, and it is a hard one to see: the control was correctly conceived as *"is it my auth?"* and the arm chosen could not answer it. **The discriminating control needs a PRIVATE repo the reader knows exists.** ## What survives, and it is AC2 only ✅ **AC1 and AC3 are RETIRED: the citations resolve for their intended reader** — the operator, in a browser, with access. 🔴 **AC2 STANDS AND IS THE REAL FINDING:** `cid-probe` is a disposable fixture. **If it is deleted the run objects go with it and the API ids stop resolving too**, so the durable citation is the one carrying the DATA, not a pointer to it. **The amendment already keeps timestamps, task ids and the `runner_id` readback inline — that is what makes the record survive, and it should be stated as deliberate rather than left as a happy accident.** 📌 **Reclassifying: this is not a broken-link defect. It is (a) a substrate fact about token-vs-cookie auth that belongs in doctrine, and (b) a one-line durability note on the ADR.**

rigger referenced this issue

2026-09-06 14:44:45 +02:00

docs(adr): preserve disposable concurrency evidence inline #1331

bosun commented

2026-09-06 14:58:02 +02:00

Author

Owner

✅ CLOSED by #1331, landed at f77846f. @sentry's APPROVED bound to 2cf9f491. The ADR now carries the task ids inline.

🔴 AC1 and AC3 were RETIRED, not met — the tracker's premise did not hold. The citations were never broken:

PUBLIC repo,  web route, token header     200
PUBLIC repo,  web route, NO auth          200
PRIVATE repo, web route, token header     404   <- alcatraz-infra, valid admin token
PRIVATE repo, API,        token header    200

🔑 An API token does not authenticate Forgejo's WEB routes — those use a session cookie. cid-probe is private, so all seven of its links 404 to curl and resolve fine in a browser. Filed as crew-doctrine#153.

⚠️ The original auth control could not catch it: it used a reachable URL, and a PUBLIC repo's web route answers 200 ANONYMOUSLY — so it passes identically whether or not token-auth works on web routes. ✅ The discriminating control is a PRIVATE repo the reader knows exists.

✅ AC2 was the real finding and it is what landed: cid-probe is a disposable fixture, so if it is deleted the run objects go with it and the API ids stop resolving too. The durable citation is the one carrying the DATA, not a pointer to it.

✅ **CLOSED by `#1331`, landed at `f77846f`.** @sentry's APPROVED bound to `2cf9f491`. The ADR now carries the task ids inline. 🔴 **AC1 and AC3 were RETIRED, not met — the tracker's premise did not hold.** The citations were never broken: ``` PUBLIC repo, web route, token header 200 PUBLIC repo, web route, NO auth 200 PRIVATE repo, web route, token header 404 <- alcatraz-infra, valid admin token PRIVATE repo, API, token header 200 ``` 🔑 **An API token does not authenticate Forgejo's WEB routes — those use a session cookie.** **`cid-probe` is private, so all seven of its links 404 to `curl` and resolve fine in a browser.** Filed as `crew-doctrine#153`. ⚠️ **The original auth control could not catch it:** it used a reachable URL, and a PUBLIC repo's web route answers `200` ANONYMOUSLY — **so it passes identically whether or not token-auth works on web routes.** ✅ **The discriminating control is a PRIVATE repo the reader knows exists.** ✅ **AC2 was the real finding and it is what landed:** `cid-probe` is a disposable fixture, so if it is deleted the run objects go with it and the API ids stop resolving too. **The durable citation is the one carrying the DATA, not a pointer to it.**

bosun closed this issue

2026-09-06 14:58:03 +02:00