paperclipai/paperclip · error

Task-watchdog runs can only mutate the watched issue subtree

Error message

Task-watchdog runs can only mutate the watched issue subtree.

What it means

resolveTaskWatchdogMutationScope classified the run as a task-watchdog, and the target issue falls outside the watched subtree the watchdog run is confined to; watchdog runs may only mutate their watched subtree.

Source

Thrown at server/src/routes/issues.ts:4116

      },
      scope: {
        issueId: issue.id,
        projectId: issue.projectId,
        parentIssueId: issue.parentId,
        assigneeAgentId: issue.assigneeAgentId,
        assigneeUserId: issue.assigneeUserId,
      },
    });
  }

  /**
   * Map an authorization denial onto the issue-write copy contract (plan §6).
   *
   * The two responsible-user ceiling codes are the most specific signal, so they
   * win. Actor-class walls (low-trust, skill-test, task-bridge scopes) stay shut
   * by design and get their own copy. Everything else reaching a write channel is
   * a visibility denial, because the default-open rule puts `issue:read` structurally
   * upstream of every standard-trust write.
   */
  function issueWriteDenialCodeForDecision(
    decision: Awaited<ReturnType<typeof decideIssueAccess>>,
  ): IssueWriteDenialCode {
    if (decision.code) return issueWriteDenialCodeForResponsibleUserDenial(decision.code);
    if (decision.reason === "deny_low_trust_boundary" || decision.reason === "deny_policy_restricted") {
      return "issue_write_actor_class_excluded";
    }
    return "issue_write_not_visible";
  }

  /**
   * Best-effort display names for denial copy. Denials are rare, so one extra
   * query buys an error that names who can act instead of printing raw uuids.
   * Any failure degrades to the copy contract's generic nouns.
   */
  async function issueWriteDenialLabels(
    req: Request,

View on GitHub (pinned to 01ad858492)

Solutions

1. This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).
2. If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying.

When it happens

Trigger: Thrown at server/src/routes/issues.ts:3952 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/4e2bbc278bff5b3e. Report an issue: GitHub.