{"record":{"id":"4e2bbc278bff5b3e","repo":"paperclipai/paperclip","slug":"task-watchdog-runs-can-only-mutate-the-watched-iss","errorCode":null,"errorMessage":"Task-watchdog runs can only mutate the watched issue subtree.","messagePattern":"Task-watchdog runs can only mutate the watched issue subtree\\.","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/issues.ts","lineNumber":4116,"sourceCode":"      },\n      scope: {\n        issueId: issue.id,\n        projectId: issue.projectId,\n        parentIssueId: issue.parentId,\n        assigneeAgentId: issue.assigneeAgentId,\n        assigneeUserId: issue.assigneeUserId,\n      },\n    });\n  }\n\n  /**\n   * Map an authorization denial onto the issue-write copy contract (plan §6).\n   *\n   * The two responsible-user ceiling codes are the most specific signal, so they\n   * win. Actor-class walls (low-trust, skill-test, task-bridge scopes) stay shut\n   * by design and get their own copy. Everything else reaching a write channel is\n   * a visibility denial, because the default-open rule puts `issue:read` structurally\n   * upstream of every standard-trust write.\n   */\n  function issueWriteDenialCodeForDecision(\n    decision: Awaited<ReturnType<typeof decideIssueAccess>>,\n  ): IssueWriteDenialCode {\n    if (decision.code) return issueWriteDenialCodeForResponsibleUserDenial(decision.code);\n    if (decision.reason === \"deny_low_trust_boundary\" || decision.reason === \"deny_policy_restricted\") {\n      return \"issue_write_actor_class_excluded\";\n    }\n    return \"issue_write_not_visible\";\n  }\n\n  /**\n   * Best-effort display names for denial copy. Denials are rare, so one extra\n   * query buys an error that names who can act instead of printing raw uuids.\n   * Any failure degrades to the copy contract's generic nouns.\n   */\n  async function issueWriteDenialLabels(\n    req: Request,","sourceCodeStart":4098,"sourceCodeEnd":4134,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/routes/issues.ts#L4098-L4134","documentation":"resolveTaskWatchdogMutationScope classified the run as a task-watchdog, and the target issue falls outside the watched subtree the watchdog run is confined to; watchdog runs may only mutate their watched subtree.","triggerScenarios":"Thrown at server/src/routes/issues.ts:3952 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}