[HugoXK]

Written-by: HugoXK
Author: Fledge Platform Dev-3

Investigates: #708

Follow-up on this branch (reviewer's blocking finding)

The classifier treated the workspace proxy as ordinary. It is registered with app.all on /repos/:id/workspace/app and /repos/:id/workspace/app/*, so it answers every method and its mutating forms forward a body to the per-repo workspace app; they are now classified expensive and named route by route. The sweep reader also refuses an unknown registration form loudly instead of skipping it, so a future app.all cannot silently escape classification. ADR 0022 gains the "classification is not enforcement" paragraph with the real counts.

Commit 28b8f0cd on top of 0b39c76c; tree 91a0df79. Red at 0b39c76c was 4 pass / 2 fail (the two new reader tests), green at the tip is npm run check 2119/2119, lint at the 11-warning baseline, risk-tier: T2; basis: src/app.ts. The PR is now 7 files, +433/−14.

Follow-up on this branch (review 5910392614)

Commit on top of the reviewed tip moves every route that starts work out of the ordinary class: POST /repos, POST /repos/app and POST /repos/:id/instance are now expensive, and POST /repos/:id/rules is now destructive because its handler already takes the destructive window. The sweep gained a second direction: a handler that takes a budget heavier than its class fails the test and names the route. ADR 0022 now states the numbers computed from this tree instead of a ratio that read as "18 of 31 classified": of 31 destructive routes 13 carry a budget (18 unpaced), of 48 expensive 4 carry one (44 unpaced). Class totals here: destructive 31, expensive 48, ordinary 16 = 95 (87 app.post + 2 app.all × 4).

What

src/lib/routeClasses.ts declares every mutating route as destructive (31), expensive (48) or ordinary (16) — ordinary listed route by route, never implied. test/routeClassSweep.test.ts reads the registrations out of src/app.ts and compares in both directions, reporting unclassified: METHOD /path or stale classification: METHOD /path, with no count and no pinned route list.

This slice adds the first privileged limits: POST /repos/:id/role and POST /settings/providers/:id/delete on the destructive budget through config: { rateLimit } (analyzer-visible), POST /repos/:id/team/stop and POST /repos/:id/jobs/:jobId/merge on the expensive limiter with their own buckets. The behavioural test grows the same four, using a provider id and a job id that do not exist, so a paced route refuses before it looks anything up.

ADR 0022 records the rule, the ordinary decision and its re-review condition, what this slice paces, and what stays classified but unpaced. #708 closes when the remaining destructive and expensive routes are paced.

Red first

At base b4e18195: with the policy present and no route classified, 3 pass / 1 fail, the failure naming all 87 mutating routes; with only the test file, ERR_MODULE_NOT_FOUND.

At the classifier tip, the privileged-limit case fails with repository role: attempt 3 was not refused, so POST /repos/:id/role carries no class limit; green after.

Ran:

• npm run check at the tip — exit 0, 2117/2117, lint on the 11-warning baseline, typecheck and build clean.
• node scripts/changelog.mjs check — 54 fragments ok; node scripts/version.mjs check — 0.3.6 ok.
• node scripts/risk-gate.mjs — risk-tier: T2; basis: src/app.ts.

Not run: Docker, a browser pass, production.

Commits

The branch carries one commit. Card #708 lists three stages in order (ADR, classifier sweep, privileged limits); the tree contains all three and they are described above and in ADR 0022, but the Lead publishes a handed-over payload as a single commit, so the commit count is one. No gate keys on commit count — ci-ok, pr-lint, risk and review-gate all read the tree at the tip.

Risk

risk-tier: T2; basis: src/app.ts. Behaviour is stricter only: the four routes refuse above their limit and nothing else changes.

Docs

docs/security.md (the rule beside the budgets), docs/decisions/0022-route-classes.md, changelog.d/708-route-classes.security.md.

Docs-not-needed: src/app.ts owns docs/architecture.md, and this PR changes no route shape there — the policy, the sweep and the limits are documented in docs/security.md and ADR 0022, both in this PR.

---

Published tip (2026-11-15): 12098cbf21612079160c97a09faa2d813e8d55b7, tree 1d3a5e2a551f85710c2fbe034d83cde3b7ccc39e, parents ede54fee + 7d1e3ef1. The merge brought one new mutating route, so the resolution classifies it: POST /repos/:id/gate/sessions/:sessionId/create is expensive and unpaced. Recomputed on this tree: 96 routes = 31 destructive / 49 expensive / 16 ordinary, with 13 of 31 and 4 of 49 paced, so 18 destructive and 45 expensive stay unpaced. The changelog file is changelog.d/708-route-classes.security.md (an earlier body said .added.md). The sweep now also refuses a double-quoted registration instead of silently treating it as not-a-route.

[HugoXK]

Written-by: Fledge Platform Lead

Verdict request — T2 at 0b39c76cecbbb43e00bf0efe19966b08811abcf0 (risk-tier: T2; basis: src/app.ts).

#708 slice 1: an explicit route-class policy declares all 87 mutating routes as destructive / expensive / ordinary (ordinary listed route by route), a sweep test reads the registrations out of src/app.ts and compares both directions, and the first four privileged routes get a class limit through config: { rateLimit }. 7 files +363/−14, red at base is the sweep naming all 87 routes, tip npm run check 2117/2117. ADR 0022 records the rule and re-review condition; #708 closes only when the remaining routes are paced.

[HugoXK-bot]

Verdict: REQUEST_CHANGES at 0b39c76
Written-by: HugoXK-bot
Posted-by: HugoXK-bot
PR: #832 — #708 route classes. Tier computed at this tip: T2, basis src/app.ts.

One blocking finding. The sweep promises "every mutating route names a class" and its own reader cannot see one whole registration form, so the guarantee the card asks for is not enforced.

BLOCKING — test/routeClassSweep.test.ts:34 (used by registeredMutations, :37-46). The pattern /app\.(get|post|put|patch|delete)\(\s*'([^']+)'/g only matches verb-named registrations. src/app.ts registers two routes with app.all(...), and all accepts every method, POST included:

• src/app.ts:3587 — app.all('/repos/:id/workspace/app', ...)
• src/app.ts:3602 — app.all('/repos/:id/workspace/app/*', ...)

Both proxy a request body to the per-repo workspace app (proxyWorkspaceHttp), so POST /repos/:id/workspace/app/* changes state and belongs in the table. Neither appears in src/lib/routeClasses.ts, and the sweep cannot notice: it reports 87 routes and the 30/37/20 partition happens to add to 87, so the count proves the reader ran, not that it read every registration. This is exactly the failure mode the test exists to prevent — a route nobody classified passing a green sweep.

Fix, either way:

1. Expand the reader: match app.all( and treat it as POST/PUT/PATCH/DELETE, then classify POST /repos/:id/workspace/app and POST /repos/:id/workspace/app/* (and the other verbs, if you keep them in the same key space).
2. Or make the reader refuse what it cannot read: assert.equal(/^\s*app\.all\(/m.test(text), false, 'the sweep cannot read app.all; classify it or teach the reader') plus the table entries.

Either fix keeps the sweep honest for the next app.all too; option 2 is the smaller change.

What held at this tip:

• Behavioural red half at base b4e18195 with only test/routeRateLimit.test.ts copied in — 2 pass / 1 fail, failing with repository role: attempt 3 was not refused, so POST /repos/repo_limited/role carries no class limit. The four new cases each refuse before the lookup (src/app.ts:2809-2812, :3333-3336, :3786, :4118), which is what the test asserts.
• The classifier sweep's own red comes from an emptied table, not from the base tree: with only src/lib/routeClasses.ts copied into base it is 4/4 green, because the table already matches the 87 visible registrations. That is expected for a coverage test, but it is why the reader gap above matters.
• npm run check — exit 0, tests 2117/2117 pass, lint, typecheck and build clean.
• node scripts/version.mjs check — 0.3.6 ok; node scripts/changelog.mjs check — 54 fragments ok.
• node scripts/risk-gate.mjs — risk-tier: T2; basis: src/app.ts.
• ADR docs/decisions/0022-mutation-route-classes.md records the rule, the ordinary decision and its re-review condition, and docs/security.md carries the rule beside the budgets.

Non-blocking, worth saying in the ADR: nothing asserts that a route classified destructive actually carries a destructive-class limiter, so 28 of the 30 destructive routes stay unpaced while classified (ADR 0022 names that as later slices and #708 stays open). Fine for this slice — but write the sentence "classification is not enforcement" where a reader will see it, because the sweep's green will be read as "these are paced".

Not run: Docker, a browser pass, production.

Conclusion: REQUEST_CHANGES at 0b39c76 — teach the sweep to see app.all (or to fail on it) and classify the two workspace proxy paths; the pacing, the red half and the gates are otherwise sound, so this is one small change at the tip, not a redesign.

[HugoXK]

Written-by: Fledge Platform Dev-3
Author: Fledge Platform Dev-3

The blocking finding is fixed locally; the new tip is not pushed yet (publishing is the Lead's), so this comment is the record of what it contains.

Reader — test/routeClassSweep.test.ts now matches every app.<form>('<path>' registration and expands app.all into POST/PUT/PATCH/DELETE (a GET through the same registration is a read and stays out). Any form outside {get, post, put, patch, delete, all} whose first argument is a path now throws the sweep cannot read app.<form>(…); teach registeredMutations or drop the form instead of being skipped, so the next app.all or app.options cannot pass a green sweep. Both halves are pinned by synthetic-source tests, not by a count, so no future registration form can hide behind a green run.

Table — the eight mutating keys for /repos/:id/workspace/app and /repos/:id/workspace/app/* are classified expensive, not ordinary: the proxy forwards the body to the per-repo workspace app, where it can start work inside the instance, and ADR 0022's own re-review condition moves a route out of ordinary the first time its blast radius is not "one record the account owns". None of them is paced yet; that stays the later slice.

ADR 0022 — your non-blocking note is written down where a reader will see it: classification is not enforcement, with the workspace proxy as the worked example.

Ran:

• Red half at this tip 0b39c76cecbbb43e00bf0efe19966b08811abcf0 with only the two new reader tests added — 4 pass / 2 fail, exactly those two cases.
• npm run check on the fixed tree — exit 0, 2119/2119 tests, lint at the existing baseline, typecheck and build clean.
• node scripts/risk-gate.mjs --base b4e1819519010c665955172f27d0e549fc1be1f9 — risk-tier: T2; basis: src/app.ts.
• node scripts/version.mjs check — 0.3.6 ok; node scripts/changelog.mjs check — 54 fragments ok.

Not run: Docker, a browser pass, production.

Publish handoff, so the tip can be reproduced exactly: commit onto 0b39c76c the three files at tree 91a0df7950b6d775bbd913efc8ea37c6eb8b19c2 (its parent tree is the current published tree ee90154fa42481bb0a23c77bf7948527003bedf2, verified by extracting the file set onto a clean worktree at that tree). Blobs: docs/decisions/0022-mutation-route-classes.md 4da21fae5b77b34be7119cc6a510f672dc50b5b9, src/lib/routeClasses.ts 4104516c7584728f3e02b453f5c266e7cb203f79, test/routeClassSweep.test.ts ca96fddb3d605a0c4949361ba9a8541befecd99a. The PR body then reads 7 files, +438/−19 — 457 changed lines.

[HugoXK-bot]

Verdict: REQUEST_CHANGES at 28b8f0c
Written-by: HugoXK-bot
Posted-by: HugoXK-bot
PR: #832 — #708 route classes. Tier computed at this tip: T2, basis src/app.ts (7 files, +433/−14, head tree 91a0df79).

My earlier blocker is fixed and I confirm it at this tip:

• test/routeClassSweep.test.ts:44-51 expands app.all into the four mutating methods, and the two real registrations (src/app.ts:3587, :3602) are in EXPENSIVE_ROUTE_LIST route by route.
• The reader refuses a registration form it does not know (test/routeClassSweep.test.ts:88-96), and src/app.ts carries none today: 87 app.post, 63 app.get, 2 app.all, no app.route( and no app.options(. 30 + 45 + 20 = 95 = 87 + 2×4.
• The four paced routes are real and run before the session or row is read: src/app.ts:2813 and :3337 take the expensive budget, :3786 and :4118 take the destructive one.

Two blockers, and both are in the class table itself.

1. src/lib/routeClasses.ts:116-118 files POST /repos, POST /repos/app and POST /repos/:id/instance under ordinary. All three start real work, which is ADR 0022's own definition of expensive:

   • src/app.ts:1957-1960 says it in the handler — "adding a repository provisions an instance, so it takes the expensive window" — and takes limits.take('expensive', …) at :1960; the provisioning call is :1946;
   • src/app.ts:3751-3763 (POST /repos/:id/instance) calls instances.provision(repo) at :3763;
   • POST /repos/app provisions every freshly imported repository too (src/app.ts:1889 and the call at :2022).
     Ordinary is defined as unlimited by decision because "the blast radius of an ordinary write is one record the account already owns" (ADR 0022 §"The ordinary class is unrestricted by decision", docs/decisions/0022-mutation-route-classes.md:49-55), and the ADR's re-review condition says a route that starts work moves class "in the same change that grants it that reach". Move the three to EXPENSIVE_ROUTE_LIST.

2. src/lib/routeClasses.ts:120 files POST /repos/:id/rules under ordinary while the handler takes the destructive window (src/app.ts:2596-2598, limits.take('destructive', 'rules-save:…')) because a rule override steers every later job on the repository. Either the class is wrong — move it to DESTRUCTIVE_ROUTE_LIST — or the window is; today the table calls "unlimited by decision" a route the code paces destructively.

One factual error the same fix moves:

• docs/decisions/0022-mutation-route-classes.md:90 says "28 of the 30 destructive routes … are classified and unpaced". At this tip 13 of the 30 carry a budget: eleven handlers name config: { rateLimit: … } (src/app.ts:3767, 3786, 3807, 3966, 4118, 4202, 4245, 4894, 4899, 4904, 4995) and two take it inside the body (:2598, :4939), so 17 are unpaced, not 28. Name the number you mean.

Non-blocking record:

• The PR body still says "expensive (37)"; the table has 45 after the workspace proxy. 30 + 45 + 20 = 95, not 87.
• The reader's refusal only fires on app.<form>('path'. A future app.route({ method: 'POST', url: '/x' }) never matches test/routeClassSweep.test.ts:44 and would be skipped silently — the one remaining gap in "refuse an unknown registration form". Assert that src/app.ts contains no app.route(, or parse it.

Ran at 28b8f0c (tree 91a0df7950b6d775bbd913efc8ea37c6eb8b19c2, reproduced from this sha's tarball; git rev-parse HEAD^{tree} equals it):

• npm run check — exit 0, 2119/2119 tests, lint at the 11-warning baseline, typecheck and build clean
• node scripts/pr-lint.mjs --pr 832 — ok (#832, T2, 7 files)
• node scripts/risk-gate.mjs --base b4e18195 --head HEAD — risk-tier: T2; basis: src/app.ts
• node scripts/version.mjs check — 0.3.6 ok; node scripts/changelog.mjs check — 54 fragments ok
  Not run: Docker, a browser pass, a live release.

Conclusion: CHANGES at 28b8f0c. The sweep and the four paced routes are right, but four routes that start work or change policy are filed under the one class that is unlimited by decision, and the ADR's paced-route count is wrong.

[HugoXK]

Written-by: Fledge Platform Dev-3
Author: Fledge Platform Dev-3

Both blockers are fixed locally and the new tip is ready to publish; it is not pushed yet (publishing is the Lead's), so this comment is the record of what the next tip contains.

1. The class follows the window. POST /repos, POST /repos/app and POST /repos/:id/instance are now expensive: two of the three take the expensive window in the handler itself (src/app.ts:1960), and all three provision an instance, which ADR 0022 calls starting work. POST /repos/:id/rules is now destructive, matching the destructive window the handler already takes (src/app.ts:2598): a rule override steers every later job on the repository.

2. The mismatch cannot come back quietly. test/routeClassSweep.test.ts reads each handler's own window out of src/app.ts — config: { rateLimit: … } and limits.take('…') — and fails naming the route when the window is heavier than the class, so POST /repos filed ordinary now fails as POST /repos: takes the expensive window but is ordinary. That test is what found both tables worth of drift here, including the two routes whose window is destructiveClassLimit rather than destructiveLimit; my first pass at the count missed those two and the widened matcher catches them.

3. The ADR number. Measured at this tip: 31 destructive routes, 13 paced, 18 unpaced; docs/decisions/0022-mutation-route-classes.md now says 18 of the 31, not 28 of the 30.

4. Your non-blocking gap. The reader now refuses app.route( as well, and the test asserts src/app.ts contains none, so the next registration form that hides its method in an object fails the sweep instead of passing it. src/app.ts has no app.route( today.

Ran at this tree:

• Red half at the published tip 28b8f0cd with only the new tests — 6 pass / 2 fail, naming exactly POST /repos: takes the expensive window but is ordinary and POST /repos/:id/rules: takes the destructive window but is ordinary, plus the missing app.route refusal.
• npm run check on the fixed tree — exit 0, 2121/2121 tests, lint at the 11-warning baseline, typecheck and build clean.
• node scripts/risk-gate.mjs --base b4e1819519010c665955172f27d0e549fc1be1f9 — risk-tier: T2; basis: src/app.ts.
• node scripts/version.mjs check — 0.3.6 ok; node scripts/changelog.mjs check — 54 fragments ok.

Not run: Docker, a browser pass, production.

Publish handoff: commit onto 28b8f0cd these three files at tree 238746b3c52ef4f93a5be7e4f0133f4b454ae892 (parent tree is the published tree 91a0df79, verified by extracting the file set onto a clean worktree at it, and by git apply of the patch). Blobs: docs/decisions/0022-mutation-route-classes.md 442462755c3220a98a2bc49d177e65512f21575b, src/lib/routeClasses.ts 04ba0ac2c5483011ba8363b01808d953f6fe061f, test/routeClassSweep.test.ts 20b7592a31a0baf4cf0f91f8513ffa8d69d76a89. The PR body numbers then read 30 + 48 + 16 = 94 mutating routes across the three classes, plus the 2 app.all registrations expanded to 8 keys.

[HugoXK]

Written-by: Fledge Platform Dev-3

Handoff for the 5910392614 findings — the ready tip is published by the Lead, not by me. Supersedes my earlier handoff at tree 238746b3; the code in it is unchanged, only the ADR sentence is sharpened.

New tip (local, to be pushed onto dev3/708-route-classes): 29beeea770054adeeba1b540642c0515ac44ff2f, tree 352b552e782d989dde9bfbfeb906adc8d78d2e31, parent ad70fc3, base b4e1819519010c665955172f27d0e549fc1be1f9. 7 files, +481/−14.

Both blockers, in this one commit:

1. Four routes moved, table and handler now agree.
   • POST /repos, POST /repos/app, POST /repos/:id/instance → EXPENSIVE_ROUTE_LIST. All three start work; the handler for POST /repos already takes the expensive window itself.
   • POST /repos/:id/rules → DESTRUCTIVE_ROUTE_LIST, following the window the handler takes (limits.take('destructive', 'rules-save:…')).
   • test/routeClassSweep.test.ts now fails when a handler takes a window heavier than the class it is filed under, naming the route: with the table reverted, the sweep is red on exactly those four.
2. ADR 0022 counts, computed from this tree: 13 of the 31 destructive routes carry a budget, so 18 destructive are unpaced, and 4 of the 48 expensive routes carry a budget, so 44 expensive are unpaced. The old "28 of the 30" sentence is gone.

Also in this commit, the two non-blocking notes:

• The sweep refuses app.route( (test/routeClassSweep.test.ts:132-138) and asserts src/app.ts contains none today, so a future object-form registration cannot be skipped silently.
• Class totals from this tree, for the body: destructive 31, expensive 48, ordinary 16 — 95 routes (87 app.post + 2 app.all × 4).

Blobs: docs/decisions/0022-mutation-route-classes.md 3d08810d2a5ace39d384caba649bf1ccc9d7aca0, src/lib/routeClasses.ts 04ba0ac2c5483011ba8363b01808d953f6fe061f, test/routeClassSweep.test.ts 20b7592a31a0baf4cf0f91f8513ffa8d69d76a89.

Gates at 29beeea, all run by me:

• npm run check — exit 0, 2121/2121 tests, lint at the 11-warning baseline, typecheck and build clean
• node scripts/risk-gate.mjs --base b4e18195 --head HEAD — risk-tier: T2; basis: src/app.ts
• node scripts/version.mjs check — 0.3.6 ok; node scripts/changelog.mjs check — 54 fragments ok

Full-tree tar and patch are with the Lead. Nothing pushed, branch ref untouched, no close, no new branch.

[HugoXK-bot]

Verdict: REQUEST_CHANGES at ede54fe
Written-by: HugoXK-bot
Posted-by: HugoXK-bot

Read ede54fee3ad346ed54cc4e5f5faeda0b36bb4ba0 (tree 352b552e782d989dde9bfbfeb906adc8d78d2e31), base b4e18195, 7 files +481/−14, T2 (risk-gate basis src/app.ts). The two findings from review 5910392614 are fixed and I verified them myself; one new blocking defect appears at this tip and it is the test this PR exists to add.

Blocking — the tip is red in its own sweep, and it will still be red after the merge

test (24) at this tip fails (job 132803062183, run 43711213211, 11:55:29Z → 11:56:42Z), and ci-ok fails with it:

✖ #708 every mutating route in src/app.ts names a class
  AssertionError [ERR_ASSERTION]: unclassified: POST /repos/:id/gate/sessions/:sessionId/create
    at test/routeClassSweep.test.ts:142:10

Cause, and why a head-only check cannot see it: that route is on live main (282a1007) at src/app.ts:2620, and it is on neither this PR's base b4e18195 nor its head. github.ref for a pull_request run is GitHub's merge of the head into the current main tip, so CI's src/app.ts carries the route while this branch's src/lib/routeClasses.ts does not. My local run of the head tree alone is green (2121/2121) for exactly that reason — a green head is not evidence here. A squash merge applies this diff to main, keeps that route, and lands the failing test on main.

What to change:

1. Bring the branch to live main (282a1007) — forward-merge it or publish the same patch as a tree on main — so src/app.ts and src/lib/routeClasses.ts are read at the same tip. The two sweeps run in both directions, so adding the key without the route fails as stale classification: (test/routeClassSweep.test.ts:145-149); the branch has to be current, not patched.
2. Classify POST /repos/:id/gate/sessions/:sessionId/create as expensive. Its handler (src/app.ts:2620-2650 on main) claims the confirmed session and creates the branch and pull request in the user's repository — it starts real work, which is ADR 0022's definition of expensive. ordinary is "unlimited by decision", and this route spends a GitHub write.
3. Recompute the ADR and body numbers from the new tree rather than hand-editing the delta. At this tip the lists are 31 destructive / 48 expensive / 16 ordinary = 95; with that route the total becomes 96 and the expensive row becomes 49. The ADR's budget counts must be re-derived the same way — from src/app.ts, not from the old text.

Closed, verified

• The four reclassifications are correct: src/lib/routeClasses.ts:46 (POST /repos/:id/rules → destructive, and its handler takes the destructive window at src/app.ts:2598), :62/:63/:64 (POST /repos, POST /repos/app, POST /repos/:id/instance → expensive).
• The app.all gap is closed and readable: the two workspace registrations expand to eight keys (src/lib/routeClasses.ts:106-113), test/routeClassSweep.test.ts:82-93 pins the expansion, and test 2 of that file is the only place a green sweep could have hidden them.
• The reverse direction exists and fails on the right routes: test/routeClassSweep.test.ts:107-130 matches rateLimit: …destructive|expensive and limits.take('destructive'|'expensive') inside the handler slice and compares it with routeClassOf. Test 4 is the one that would have caught my four findings.
• I counted the table and the budgets from the tree myself, not from the ADR: destructive list 31 entries, expensive 48, ordinary 16; 13 destructive routes carry a window (/repos/:id/rules + 12 rateLimit: destructiveLimit|destructiveClassLimit registrations) and 4 expensive do (src/app.ts:1960, :2813, :3337, :3625). The ADR's "13 of 31 (18 unpaced)" and "4 of 48 (44 unpaced)" match what I counted.
• app.route( is refused (test/routeClassSweep.test.ts:132-138) and src/app.ts uses no such registration. app.get, app.addHook and the two app.all calls are the only shapes present.

Non-blocking

The sweep's reader matches single-quoted paths only (test/routeClassSweep.test.ts:52). An app.post("/repos/…") would therefore be read as "not a route" and pass a green sweep instead of being refused the way app.options( and app.route( are. One assertion over src/app.ts — no verb registration with a double quote or a backtick — closes it, or widen the pattern and read the quote. The card's whole premise is that a form the reader does not know must be refused, so this belongs with the next slice even though nothing in the tree trips it today.

Note on the tip

codeql-required at 28b8f0cd timed out (no completed CodeQL analysis … after 600 second(s)); at this tip it succeeded at 11:55:36Z, and I did not treat the timeout as a finding.

Ran:

• npm run check at ede54fee (tree extracted from the API tarball, app.ts sha256 matched the contents API copy) — pass, 2121/2121, lint/typecheck/build clean; the sweep is green here only because the head tree predates the route, which is the point of the first finding
• npx tsx --test test/routeClassSweep.test.ts test/routeRateLimit.test.ts at the tip — 11/11 pass
• curl -L https://api.github.com/repos/HugoXK/fledge/actions/jobs/132803062183/logs and read the failure — unclassified: POST /repos/:id/gate/sessions/:sessionId/create, run 43711213211
• curl https://api.github.com/repos/HugoXK/fledge/contents/src/app.ts?ref=282a10078f085c8e46ee4d52f2b91251d9a1f465 — src/app.ts:2620 is the new route, absent from b4e18195
• counted src/lib/routeClasses.ts and every destructive/expensive window in src/app.ts at the tip — 31/48/16 and 13/4, as recorded above
  Not run: Docker, a browser pass, production; github.com:443 failed for me this turn (GnuTLS recv error), so the tree came from the API tarball and the log from the actions API.

Conclusion: the classification policy and the sweep are what the card asked for, my earlier four-route finding and the app.all gap are fixed, but this tip is red in test (24) because the branch predates POST /repos/:id/gate/sessions/:sessionId/create on main and the merge keeps that route unclassified — bring the branch to live main, file that route as expensive, recompute the ADR counts, and re-request at the new tip.

[HugoXK]

Written-by: Fledge Platform Dev-3

Forward-merge handoff for #708 — the tip is ready; publishing it is the Lead's, not mine.

Tip: 6281eecc8a9d76a2b25eb2d87b8f0b5e563be456, tree 42f1fb95a810d5c92a6b9d7a1674ae045d2ceeac. It carries:

• 4a7420d — merge of the live main tree (main 7d1e3ef1f809286768ace84ec420a1d8d576fa69, tree 24d7a83c7b65c8eac512c597c5355966d6110864), parents 29beeea (the fix2b tip) and a local snapshot commit whose tree is exactly that main tree;
• 6281eec — the one route main added since the branch point.

The failure was a route the sweep had never seen, exactly as the run said: POST /repos/:id/gate/sessions/:sessionId/create (the gate PR that landed at 10:54Z). Its handler writes a branch and opens one gate pull request, which is ADR 0022's expensive — real work started, nothing destroyed. It is classified and stays unpaced, which the ADR now says in the same paragraph. I checked from the tree rather than trusting the count: 31 destructive, 49 expensive, 16 ordinary = 96 mutating routes, and 13 of 31 destructive and 4 of 49 expensive carry a budget, so 18 destructive and 45 expensive are classified and unpaced.

PR diff against live main is back to this card only: 7 files, +487/−14, risk-tier: T2; basis: src/app.ts.

At 6281eec, run by me:

• npm run check — exit 0, 2190/2190 tests, lint at the 11-warning baseline, typecheck and build clean
• node scripts/risk-gate.mjs --base cf7fa658 (the live-main tree) — risk-tier: T2; basis: src/app.ts
• version 0.3.6 ok, 63 changelog fragments ok
• test/routeClassSweep.test.ts alone — 8/8, so every route in src/app.ts names a class and the table names no route that no longer exists

Blobs: src/lib/routeClasses.ts 6ba546e4b80a63434d11b15be838c1511cc12115, test/routeClassSweep.test.ts 20b7592a31a0baf4cf0f91f8513ffa8d69d76a89, docs/decisions/0022-mutation-route-classes.md 155c9b01cabfcf38bf8353452b0bc2053b2587c9.

Full-tree tar sha256 73c94231aa72b1cf04eb21794bda3714204c1b0f53dd3c0a0e48b4baf2aac177, patch sha256 5bc12dda918efcf6097f9ee4c301a6aa2871ff0724982ecc1aefdad113d6296f, both with the Lead. Nothing pushed, no new branch, no close, version untouched.

[HugoXK-bot]

Verdict: PASS at 12098cb
Written-by: HugoXK-bot
Posted-by: HugoXK-bot
Replaces: 5910572706

Read the tip 12098cbf21612079160c97a09faa2d813e8d55b7 (tree 1d3a5e2a, 7 files +502/−14, T2; src/lib/routeClasses.ts blob 6ba546e4 matches the contents API).

My blocking finding at ede54fee is fixed, and I re-derived the numbers instead of taking them:

• src/lib/routeClasses.ts:81 — POST /repos/:id/gate/sessions/:sessionId/create is expensive; it is the route live main added and the one test (24) named.
• The table at the tip, imported and counted: 31 destructive, 49 expensive, 16 ordinary = 96.
• Paced vs classified, read off the handlers in src/app.ts: 13 of the 31 destructive and 4 of the 49 expensive take a window; the 8 app.all workspace-proxy keys are among the 45 expensive that stay unpaced.
• test/routeClassSweep.test.ts:140-156 — a double-quoted registration now throws by name, and app.route still does (:147-156); this is the non-blocking note from my previous review, with a case that proves it. :112-133 is the class-lighter-than-the-window direction.
• docs/decisions/0022-mutation-route-classes.md:90 — "13 of the 31 … 4 of the 49" and 96 = 31/49/16 match the tree; the "classification is not enforcement" paragraph is present.

Non-blocking, body text only (the tree is correct, the older sections above the final one still carry the pre-merge numbers):

• The body's earlier section still says "expensive 48 … = 95" and "of 48 expensive 4 carry one (44 unpaced)"; the published-tip section below it says 96 = 31/49/16 and 4 of 49, which is the tree.
• The body's Docs line names docs/decisions/0022-route-classes.md; the file in the tree is docs/decisions/0022-mutation-route-classes.md.

CI at this tip: test (24) success 12:22:42Z; build and therefore ci-ok are red, but not on code — the artifact uploaded (889322 bytes) and the job then died at Failed to FinalizeArtifact: Unable to make request: ECONNRESET (job 132809780686, 12:21:49Z). That is the runner's artifact finalize, not the tree; re-run build before merge. review-gate failure 12:21:35Z is the pre-verdict state this review replaces.

Ran (exact tip tree from the API tarball, blob hash above verified):

• npm run check — lint 11 baseline warnings, typecheck clean, 2191/2191 tests, build ok
• node scripts/pr-lint.mjs --pr 832 — ok (#832, T2, 7 files)
• node scripts/changelog.mjs check — 63 fragments ok
• node scripts/version.mjs check — 0.3.6 ok
• node scripts/secret-scan.mjs — no suspected value in the tracked files
• npx tsx import of src/lib/routeClasses.ts — 31/49/16 = 96, and a handler sweep — 13 of 31 and 4 of 49 paced

Not run: Docker, a browser pass, production.