Problem
In Codex Desktop, an independent review workflow needs to verify a repository protection policy without making any GitHub changes. The required read-only evidence is:
- branch-protection details and the full ruleset body;
- bypass actors;
- the selected ref, commit and tree identity in the same review session.
The repository administrator can read basic repository/ref/tree metadata, but the independent-review connection receives 403 Resource not accessible by integration for protection-detail endpoints. This prevents a reviewer from independently confirming the policy and therefore blocks a safety-sensitive, append-only materials-registry workflow.
Expected behavior
Expose documented, read-only access to the above protection/ruleset/bypass/ref/commit/tree evidence for an authorized repository reviewer, or document the supported Codex Desktop/GitHub App permission model and a supported alternative evidence path.
Actual behavior
Protection-detail readback returns 403 in the independent review connection. No repository mutation, upload, permission change, or protected-ref change was attempted.
Environment
- Codex Desktop on Windows native
- Private GitHub repository
- Read-only review workflow
No repository name, source files, credentials, or customer data are included in this report.
Problem
In Codex Desktop, an independent review workflow needs to verify a repository protection policy without making any GitHub changes. The required read-only evidence is:
The repository administrator can read basic repository/ref/tree metadata, but the independent-review connection receives
403 Resource not accessible by integrationfor protection-detail endpoints. This prevents a reviewer from independently confirming the policy and therefore blocks a safety-sensitive, append-only materials-registry workflow.Expected behavior
Expose documented, read-only access to the above protection/ruleset/bypass/ref/commit/tree evidence for an authorized repository reviewer, or document the supported Codex Desktop/GitHub App permission model and a supported alternative evidence path.
Actual behavior
Protection-detail readback returns 403 in the independent review connection. No repository mutation, upload, permission change, or protected-ref change was attempted.
Environment
No repository name, source files, credentials, or customer data are included in this report.