Third defect in the robot stack (#213 auth, #214 checkout, this one): verify_identity built a repo-scoped URL (…/repos/o/r/user → 404 plain-text) which crashed json.loads before MergeRefused could fire. Red-first: 2 tests added first (frozen green), full suite 615+84.
Third defect in the robot stack (#213 auth, #214 checkout, this one): verify_identity built a repo-scoped URL (…/repos/o/r/user → 404 plain-text) which crashed json.loads before MergeRefused could fire. Red-first: 2 tests added first (frozen green), full suite 615+84.
Red-first discharge (#214 follow-up): verify_identity built a repo-scoped URL
(.../repos/o/r/user -> 404 plain-text body) which crashed json.loads before
MergeRefused could fire — the robot never ran successfully since #211. Three
stacked defects: missing checkout (#214), reserved-secret auth (#213), and
repo-scoped identity URL (this commit).
- verify_identity now derives the instance root itself (defense in depth:
never trust caller scope)
- _api converts non-JSON error bodies into MergeRefused instead of an
unhandled JSONDecodeError
- 2 red tests added first, frozen green; suite 615+84
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Third defect in the robot stack (#213 auth, #214 checkout, this one): verify_identity built a repo-scoped URL (…/repos/o/r/user → 404 plain-text) which crashed json.loads before MergeRefused could fire. Red-first: 2 tests added first (frozen green), full suite 615+84.