Auto-review can lose saved task authorisation when shortening reviewer context
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 125k
- Forks
- 19.4k
- PR merge metrics
- PR metrics pending
Description
Summary
Auto-review can deny a scheduled task for missing user authorisation when the compact reviewer transcript has omitted the paragraph granting that authorisation.
Observed behaviour
A saved task explicitly permitted a narrowly scoped publication step after validation. The working agent received the full instruction and completed validation. The reviewer received a shortened version in which the permission paragraph was missing, then denied the action for lack of authorisation. The action did not execute.
The saved task instruction was also presented in reviewer history as a tool result. This may affect whether its user-configured authority is recognised; its contribution to the denial is not established.
Suggested reproduction
Create a synthetic scheduled task with harmless test content and place its explicit publication permission in the middle of a long prompt. Compare the original prompt with the shortened reviewer input at the publication step. Check whether the authority paragraph and its provenance survive.
This suggested minimal reproduction has not been run separately.
Expected behaviour
Preserve explicit, user-configured task authorisation and its provenance when shortening reviewer context. If that context cannot be verified, explain the missing authorisation context clearly. Arbitrary tool output should not acquire user authority.
Scope
This report intentionally omits local runtime, model, permission configuration, account and project details, task identifiers, source content, transcript excerpts and attachments. Only the generic failure mechanism is reported.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how reviewer context is shortened and how saved task instructions are presented in reviewer history. Run the suggested synthetic scheduled-task reproduction with publication permission in the middle of a long prompt. Done means explicit task authorisation and its provenance survive shortening, while arbitrary tool output does not gain user authority.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authorization, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100