REQ 096

REQ-096: Separate requester and reviewer identities

Requirement

The requester shall submit with an identity that is not an eligible reviewer, to an approval environment that requires reviewers, prevents self-review, and disallows administrator bypass.

Rationale

GitHub's pending-deployments API accepts any required reviewer's token, prevent-self-review blocks only the user who started the run, and administrators can bypass protection rules unless the environment disallows it, so a requester holding a reviewer's credential could approve its own request. The requester authenticates as a GitHub App installation with a token minted per session (decision D1 in VITechnologies/projectbuddy#177); a GitHub App can never be a required reviewer.

Fit Criterion

The submission tool refuses to submit when its own authenticated identity is an eligible reviewer of the target environment. The environments API reports required_reviewers with prevent_self_review: true and can_admins_bypass: false. The readiness check reports the gate as enforcing only when the requester identity is not a reviewer and has no direct write permission on any target of its action classes, and as advisory otherwise.

Verification

Planned, TEST-098; not yet performed live. Offline fixture tests refuse submission when the requester could approve, report each missing environment protection, and report a class as advisory when the requester can write to a target and as enforcing only when fully separated. Live verification waits for Phase 3 of VITechnologies/projectbuddy#179.

Source

Software-Requirements-Specification

Priority

High

TestID

TEST-098

TestArtifact

scripts/tests/test_approval_gate_record.py readiness and authentication cases and scripts/tests/test_approval_gate_cli.py submission cases

CodeRef

scripts/approval_gate/readiness.py, scripts/approval_gate/auth.py, scripts/approval_gate/submit.py, scripts/approval_gate/cli.py

Status

Planned; offline fixture tests pass, no live proof yet