gh shim: operator bypass keeps its audited path in bot-provisioned head shells

Merged
AF
2d ago
+145-17

Regression from #1095, live since the 20:33Z card: in a head shell provisioned for bot speech, every gh call was routed to the captured start-authority path before the shim looked at GH_SHIM_BYPASS=operator, so operator administration (pr merge, run rerun, merge-queue mutations) was refused with task_gh_policy_denied (not_governed). That blocked every head's merges until they prefixed env -u AFT_GH_SPEECH_PROVISIONED.

Both captured-path checks in gh_shim.rs (~827 and the post-probe recheck ~864) now skip an explicit operator bypass, which takes the existing audited administration dispatch. Worker shells are still refused earlier, with or without bypass. Bot speech without bypass keeps its captured start authority.

Tests: gh_shim_provisioned_head_operator_admin_bypass_is_audited (real shim process with a signed start view: run rerun and pr merge refuse without bypass, and with bypass are audited, then delegated) fails without the fix with the reported not_governed refusal. The worker audit test now covers eight write forms, including rerun and merge, with and without bypass, and checks there's no delegation or relay traffic. The library test that asserted blanket bypass denial now asserts no-bypass denial. That denial was the regression, not an approved contract. 535 gh_shim library tests, 94 gh_shim integration tests and the Windows target check pass.

Summary by cubic

Restores GH_SHIM_BYPASS=operator in bot-provisioned head shells so operator administration keeps its audited path. After #1095, every gh call was routed to the captured start-authority path before the bypass was checked, so pr merge, run rerun, and merge-queue mutations were refused with not_governed.

Both captured-path checks now skip the explicit operator bypass and take the existing audited administration dispatch. Worker shells are still refused earlier with or without bypass, and bot speech without bypass keeps its captured start authority.

Tests

  • Adds a real-CLI regression test covering provisioned run rerun and pr merge refusing without bypass and audit-then-delegate with it.
  • Expands the worker write audit to eight forms in both bypass states; the prior blanket-bypass-denial test now asserts no-bypass denial, which enshrined the regression.