dongarandClaude Opus 5
846e5494ca
B2 specified the service account and its scoped token but never said the project repo's default branch must be protected — which turns out to be the load-bearing part of the PR gate. In Gitea, write access includes merging pull requests, and repository ownership does not restrict merging either. So an agent with the access it needs to push branches can also merge its own PR, and the review gate holds only because the agent's code does not call the merge endpoint. That is the advisory guarantee A4 exists to rule out. Verified rather than assumed: before protection was configured, the agent's own token merged its own PR (HTTP 200). With protection it is refused (405), as is a direct push to the default branch. The amendment says to assert both, so relaxing the protection later fails a test instead of silently removing the gate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>