All six HTTP-status error arms captured the provider's response body in a
mktemp file and then discarded it unread, so a caller got a status code and
no cause. The review-submit arm additionally hardcoded "(#865: no durable
review created)" onto EVERY non-2xx — including 401/403/404/409/422, where
the server had given a definite, correct, machine-readable refusal that is
categorically not #865 (the silent-no-op defect).
Measured case: `pr-review.sh -n 1001 -a approve` reported
Error: Gitea review submit failed with HTTP 422 (#865: no durable review created)
when the real cause was that the acting credential authored the PR and Gitea
correctly refuses self-approval. Gitea said so plainly in the discarded body.
This matters beyond error aesthetics: withholding the cause pushes the caller
toward re-issuing the request by hand to see what the server says, and a
diagnostic that uses the real verb against the real object is not a
diagnostic, it is the operation.
Changes:
- New gitea_error_detail() renders the provider's own explanation (JSON
message/error/errors, else the first body line), truncated to 300 chars.
It always returns 0 so it can never abort a caller under `set -e`, and
prints nothing when there is nothing to add.
- All six arms append it. The review-submit arm no longer cites #865; that
reference now appears only on the check that actually diagnoses it — a 2xx
yielding no id, immediately below.
No control flow changes: every arm still returns 1 and still fails closed.
Test hermeticity (required, or the new cases cannot run on any agent seat):
get_gitea_token()'s per-agent identity step reads `git config --get
mosaic.gitIdentity`, which on a provisioned seat is set GLOBALLY and leaks
into the harness's fresh `git init` repo. It then returns a REAL per-slot
token from $HOME without ever consulting MOSAIC_CREDENTIALS_FILE, so the
fixture placeholder was silently ignored and the suite ran against production
credentials, failing 401. The harness now pins an empty repo-local
mosaic.gitIdentity (an empty local value shadows the global and reads back
empty at rc=0) and runs under a sandboxed HOME. Filed separately: the
per-slot token store has no override hook, so no harness can sandbox it.
Verification matrix (all three run locally):
- base suite + hermeticity fix, unmodified wrapper -> PASS (fix is
sufficient and breaks no existing case)
- new cases 19/20, unmodified wrapper -> FAIL at case 19, reproducing the
exact misattribution above (negative control)
- new cases 19/20, fixed wrapper -> PASS
Cases 19 (422 JSON refusal) and 20 (502 HTML body) assert the status is
present, the provider's reason is present, and "#865: no durable review
created" is ABSENT. shellcheck is not installed on this host, so the lint
gate is unverified locally.
Co-authored-by: mos-dt-0 <[email protected]>
Jason Woltjeandmos-dt-0