{"record":{"id":"4e2bbc278bff5b3e","repo":"paperclipai/paperclip","slug":"task-watchdog-runs-can-only-mutate-the-watched-iss","errorCode":null,"errorMessage":"Task-watchdog runs can only mutate the watched issue subtree.","messagePattern":"Task-watchdog runs can only mutate the watched issue subtree\\.","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/issues.ts","lineNumber":5037,"sourceCode":"      },\n      scope: {\n        issueId: issue.id,\n        projectId: issue.projectId,\n        parentIssueId: issue.parentId,\n        assigneeAgentId: issue.assigneeAgentId,\n        assigneeUserId: issue.assigneeUserId,\n      },\n    });\n  }\n\n  /**\n   * Map an authorization denial onto the issue-write copy contract (plan §6).\n   *\n   * The two responsible-user ceiling codes are the most specific signal, so they\n   * win. Actor-class walls (low-trust, skill-test, task-bridge scopes) stay shut\n   * by design and get their own copy. Everything else reaching a write channel is\n   * a visibility denial, because the default-open rule puts `issue:read` structurally\n   * upstream of every standard-trust write.\n   */\n  function issueWriteDenialCodeForDecision(\n    decision: Awaited<ReturnType<typeof decideIssueAccess>>,\n  ): IssueWriteDenialCode {\n    if (decision.code)\n      return issueWriteDenialCodeForResponsibleUserDenial(decision.code);\n    if (\n      decision.reason === \"deny_low_trust_boundary\" ||\n      decision.reason === \"deny_policy_restricted\"\n    ) {\n      return \"issue_write_actor_class_excluded\";\n    }\n    return \"issue_write_not_visible\";\n  }\n\n  /**\n   * Best-effort display names for denial copy. Denials are rare, so one extra\n   * query buys an error that names who can act instead of printing raw uuids.","sourceCodeStart":5019,"sourceCodeEnd":5055,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/server/src/routes/issues.ts#L5019-L5055","documentation":"resolveTaskWatchdogMutationScope classified the run as a task-watchdog, and the target issue falls outside the watched subtree the watchdog run is confined to; watchdog runs may only mutate their watched subtree.","triggerScenarios":"Thrown at server/src/routes/issues.ts:3952 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}