fix(capture): require write access for board attachment

[Chris0Jeky]

Summary

Aligns capture creation with the existing triage authorization boundary:

• attaching a capture directly to a board now requires CanWriteBoardAsync rather than readable Viewer access;
• authorization lookup failures are propagated before any queue or durable-capture persistence;
• boardless capture behavior is unchanged;
• Owner/Admin/Editor semantics continue to come from the central authorization service.

A board-scoped capture can later enter that board's proposal queue, so this closes the create-time path that previously admitted a Viewer even though the equivalent triage-time link already required write access.

Tests

Adds focused Application coverage for:

1. readable-but-non-writable Viewer denial with no persistence;
2. write-authorization failure propagation with no persistence;
3. writable-board success without consulting the read predicate.

Adds authenticated SQLite/HTTP coverage proving:

4. a real Viewer receives the public 403 Forbidden contract and gets no capture row;
5. a real Editor can create the same board-scoped capture.

Verification

• Test-first Application commit: d9e791bb29694914a00e1631c86f069f2bd9abdf
• Test-first API commit: c31abe7d5ec3c8c726d711c07ba5eef66706cbbc
• Exact implementation head: a9ae7bb0f4fa17707d7af5ab10762da3ff4017cf
• Source diff is 7 additions / 2 deletions in CaptureService; no migration, DTO, route, proposal, or control-plane changes.
• Hosted exact-head CI and independent review are pending on this draft.

Closes #3291

[Chris0Jeky]

@codex address the exact-head CI failures without weakening the production write-authorization rule. The required corrections are bounded:

1. In CaptureServiceTests.cs, the three CreateAsync fixtures still configure CanReadBoardAsync; change only those setups to CanWriteBoardAsync (two true, one false). Leave the later triage test that deliberately configures read=true/write=false intact.
2. In CaptureServiceDualWriteTests.cs, the board-context fixture must configure CanWriteBoardAsync (already corrected at current branch head).
3. In CaptureBoardAttachmentAuthorizationApiTests.cs, keep auth stems within the username contract (already corrected at current branch head).
4. Rewrite CaptureApiTests.Triage_ShouldReturnForbidden_WhenAlreadyLinkedBoardIsReadOnlyForCaller: grant Editor, create the linked capture successfully, downgrade that access record to Viewer through PUT /api/boards/{boardId}/access/{accessId}, then assert bodyless triage returns 403 and persists no proposal. A Viewer creating an already-linked capture is no longer a valid setup after this PR.

Run the focused Application/API tests, then the exact-head matrix. Do not add compatibility fallbacks in production, skip tests, or restore read-only board attachment.

[chatgpt-codex-connector]

Summary

• Updated the three legacy CreateAsync test fixtures to configure CanWriteBoardAsync: two successful write authorizations and one denied authorization. The later intentional read=true/write=false triage fixture remains unchanged. backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL124-L135 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL176-L187 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL241-L259
• Reworked the already-linked read-only triage test to grant Editor access, successfully create the linked capture, downgrade the same access record to Viewer through the board-access API, and then verify bodyless triage returns 403 Forbidden. backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL889-L921
• Preserved the no-write behavior by verifying the capture stays pending and no automation proposal is persisted after forbidden triage. backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL923-L928
• Made no production-code changes or compatibility fallbacks. Committed the changes as 76f6e8a8 (test(capture): align authorization fixtures) and prepared the requested follow-up PR metadata.
• No canonical documentation was changed. The open maintainer-only and decision items in OUTSTANDING_TASKS.md remain outstanding.

Testing

• ✅ PATH=/tmp/dotnet:$PATH dotnet test backend/tests/Taskdeck.Application.Tests/Taskdeck.Application.Tests.csproj -c Release -m:1 --filter "FullyQualifiedName~CaptureServiceTests|FullyQualifiedName~CaptureServiceDualWriteTests" — 89 passed.
• ✅ PATH=/tmp/dotnet:$PATH dotnet test backend/tests/Taskdeck.Api.Tests/Taskdeck.Api.Tests.csproj -c Release -m:1 --filter "FullyQualifiedName~CaptureApiTests|FullyQualifiedName~CaptureBoardAttachmentAuthorizationApiTests" — 44 passed.
• ✅ PATH=/tmp/dotnet:$PATH dotnet test backend/Taskdeck.sln -c Release -m:1 — 10,165 passed and 34 environment-gated tests skipped; zero failures.
• ✅ git diff --check
• ✅ git status --short --branch — clean working tree on work.

View task →

[Chris0Jeky]

@codex publish the already-verified 76f6e8a8 changes directly onto this PR's existing head branch codex/3291-capture-board-write-auth. Do not open a separate PR or leave the commit only in the task worktree. After pushing, confirm the new GitHub head SHA so hosted exact-head CI can qualify it. Preserve the verified patch exactly: three CanWriteBoardAsync fixture updates plus the Editor-create/Viewer-downgrade triage regression, with no production fallback.

[chatgpt-codex-connector]

Summary

• Reproduced the verified patch on top of the existing PR head without changing production code:
  • Updated all three affected CreateAsync fixtures to use CanWriteBoardAsync, preserving the two successful authorizations and one denied authorization. backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL124-L129 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL176-L181 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL249-L254
  • Reworked the triage regression to grant Editor access, create the board-linked capture, downgrade the same access record to Viewer through the access endpoint, and then attempt bodyless triage. backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL888-L921
  • Preserved assertions that forbidden triage leaves the capture pending and persists no automation proposal. backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL923-L928
• Committed the patch locally as e88594fef5a8e35b70965f41901f85f79489675f (test(capture): align authorization fixtures).
• Publishing is blocked by missing GitHub credentials in this environment. The push was rejected before updating GitHub, so the existing remote PR head remains 325e1d5d3d0448424a7df042e8b22aaf592166b8; hosted exact-head CI has therefore not started for the follow-up commit.
• No canonical documentation was changed. The maintainer-only and decision items listed as unchecked in OUTSTANDING_TASKS.md remain open.

Testing

• ✅ git diff HEAD^ HEAD --check
• ✅ git show --stat --oneline HEAD
• ⚠️ dotnet test backend/tests/Taskdeck.Application.Tests/Taskdeck.Application.Tests.csproj -c Release -m:1 --filter "FullyQualifiedName~CaptureServiceTests|FullyQualifiedName~CaptureServiceDualWriteTests" — not run because dotnet is unavailable in this container.
• ⚠️ dotnet test backend/tests/Taskdeck.Api.Tests/Taskdeck.Api.Tests.csproj -c Release -m:1 --filter "FullyQualifiedName~CaptureApiTests|FullyQualifiedName~CaptureBoardAttachmentAuthorizationApiTests" — not run because dotnet is unavailable in this container.
• ❌ git push origin HEAD:refs/heads/codex/3291-capture-board-write-auth — failed with could not read Username for 'https://github.com': No such device or address.
• ✅ git ls-remote origin refs/heads/codex/3291-capture-board-write-auth — confirmed the unchanged GitHub head SHA is 325e1d5d3d0448424a7df042e8b22aaf592166b8.
• ✅ git status --short --branch — clean working tree after the local commit.

View task →

[Chris0Jeky]

@codex the verified fixture patch is still not on GitHub: this PR remains at 325e1d5. Apply the exact 76f6e8a8 diff to branch codex/3291-capture-board-write-auth now and push it. Do not create another PR or rerun the investigation. Reply with the published GitHub head SHA.

[chatgpt-codex-connector]

Summary

• Applied the verified fixture patch and committed it locally as 2ea13b272c8e267f7186dcfd765b75230c782407:
  • Updated the three affected CreateAsync fixtures to use CanWriteBoardAsync. backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL124-L129 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL176-L181 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL249-L254
  • Updated the triage regression to grant Editor access, create the linked capture, downgrade the access record to Viewer, and verify bodyless triage returns 403 without persisting a proposal. backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL889-L921 backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL923-L928
• The push could not authenticate because this environment has no GitHub credentials. Therefore, the published GitHub head remains 325e1d5d3d0448424a7df042e8b22aaf592166b8, not the local commit.
• No tests were rerun, as explicitly requested.

Testing / Publication

• ✅ git diff HEAD^ HEAD --check
• ✅ git status --short --branch — clean local branch codex/3291-capture-board-write-auth.
• ❌ git push origin HEAD:refs/heads/codex/3291-capture-board-write-auth — rejected with could not read Username for 'https://github.com': No such device or address.
• ✅ git ls-remote origin refs/heads/codex/3291-capture-board-write-auth — published GitHub head is still 325e1d5d3d0448424a7df042e8b22aaf592166b8.

View task →

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T00:53:29.543816Z	3c37b19	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a0387e8c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review

Please review exact current head 4f5831d against base fb830ed. This is the one current-head review request after the main-base requalification. Focus on the PR's changed ownership and stale-settlement behavior, and report only merge-blocking correctness or security defects.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4f5831d6c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review

Fresh review request for exact current head 00b7489 against base fb830ed. The P1 race is addressed by a production serializable transaction covering write authorization through enqueue/save, and the board capture affordances are gated by server-provided canWrite. Review the final fix diff for merge-blocking correctness or security defects.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 00b74898cf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review Please review the exact current head 95752fb. The new fix gates PaperBoardColumn's per-column capture control on the same server-provided canWrite value; the prior authorization and transaction changes are unchanged. Report only merge-blocking correctness or security defects at this exact head.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 95752fbc11

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fb120c03f8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 682f21159c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 5aab6812e2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 0e978ad5d2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review

Please review exact current head d50931d against base d7a146c. The prior two P2 findings are fixed: scoped Inbox capture now gates only the selected scoped destination and activeBoardCanWrite fails closed while metadata is unknown. Report only merge-blocking correctness or security defects.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: d50931d894

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review

Please review exact current head 0a060b3 against base d7a146c. The follow-up also preserves direct PaperCaptureNib callers by defaulting optional canSubmit to true; the affected frontend proof is 224/224 and typecheck passes. Report only merge-blocking correctness or security defects.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 0a060b3439

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review

Please review exact current head 3c37b19 against base e09f10f after the #3349 merge and rebase. affected frontend proof is 224/224, typecheck passes, and backend proofs are 23/23, 16/16, and 16/16. Report only merge-blocking correctness or security defects.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 3c37b19f2d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".