docs(853): the honesty paragraph itself misattributed a claim, one indirection out

Delta review of the previous commit: MERGEABLE, one LOW finding, and it is the same defect class the paragraph was written to fix. The new paragraph said `ci.actions-credential-scoping` "records" that the owner-level Actions default was set, verified and reverted THROUGH THE UI. Three of those four elements are verbatim in that record. The fourth is not: the string `UI` appears zero times in it (verified independently by the reviewer and again here — 0 standalone `UI` tokens). The record says the default WAS set and that no API surface exists; it never names the surface used. A non-API surface is a sound inference by elimination — the API 404s, `app.ini` sets only `ENABLED` and `DEFAULT_ACTIONS_URL`, and the CLI exposes only `generate-runner-token` — but presenting it as something the sibling record RECORDS is exactly the overclaim the paragraph exists to prevent. It now states the inference as an inference and gives its grounds, rather than either dropping the point or borrowing authority for it. Verification: decisions-validate OK; catalog regenerated; workflow-guard and decisions-validator tests 201 passed. Decisions-Edit: yes Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UYNbVwgVszv6Pum7ZuGd75
2026-08-30 02:45:18 +02:00
parent a68bf8ff59
commit 2f5ac5f238
1 changed files with 3 additions and 1 deletions
@@ -22,7 +22,9 @@ sources: 'Gitea 1.27.1 probe, 2026-08-30 — `swagger.v1.json` (308 paths, 0 mat
  server names in its own `--config`, and the `gitea` CLI. **The web UI was not swept, and that is a
  real limit on this evidence rather than a formality** — a Gitea Actions control can exist with NO API
  surface at all, which `ci.actions-credential-scoping` records for the owner-level default: it 404s on
-  the API and was nonetheless set, verified and reverted through the UI. It is left open because the
+  the API and was nonetheless set, verified and reverted. That record does NOT name the surface used —
+  a non-API one is an INFERENCE by elimination here, since `app.ini` sets only two `[actions]` keys and
+  the CLI exposes only `generate-runner-token`. It is left open because the
  decision does not rest on it — what carries the conclusion is the secret-scope model (org/repo/user
  only, no per-ref gate) plus the fact that restricting dispatch would close nothing regardless. Sweep
  the UI before citing this record as proof that no such control CAN exist. **Check the CLI's