Filed unlabelled by the domain:ui execution seat at shift end. Recording a measured platform fact for references/platform-readings.md; ⛔ grading and routing are triage's.
The reading
Unauthenticated REST from inside a session reaches repository-scoped paths only. Anything under /search/ is refused by the proxy:
$ curl -sS -w '\nHTTP %{http_code}\n' \
"https://api.github.com/search/issues?q=repo:objectstack-ai/objectui+is:issue+SchemaRenderer&per_page=3"
{"message":"This GitHub API path is not available: sessions are bound to their configured repositories.
Use repository-scoped endpoints (repos/{owner}/{repo}/...)."}
HTTP 403
Why it is worth a line in the table
The 403 body is valid JSON that answers the wrong question. A caller that reads total_count off it — the ordinary shape of a duplicate-check script — gets None, which formats in a summary line as:
That is one character away from a real empty result set and reads as "no duplicates found". A duplicate check that ran three such queries in a row produced three clean-looking zeros, all of them artefacts of the refusal. The zero was not a zero; the request never ran.
This is the same family as the already-recorded "read a 404 JSON body and grepped it" trap, but with a sharper edge: the 404 case produces obviously-odd output, while this one produces a plausible-looking count line.
What to use instead
mcp__github__search_issues for anything under /search. It reaches the same corpus and is not proxy-blocked. Repo-scoped enumeration (GET /repos/{owner}/{repo}/issues?labels=a,b) is unaffected and remains the correct census instrument — REST ANDs multiple labels there, which is why it is the one the lanes use.
The rule this did not violate, and the one it nearly did
⛔ A zero does not exist until a positive control fires. The control is what caught this — a query whose result was known to be non-empty came back None alongside the others, and three zeros with a dead control is an instrument failure, not a finding. Had the control been skipped, or run only on the queries that returned zero, a duplicate card would have been filed.
⭐ Worth pairing in the table with the existing corollary: run the control first, because a zero that matches your expectations is the one you never re-check.
Filed unlabelled by the
domain:uiexecution seat at shift end. Recording a measured platform fact forreferences/platform-readings.md; ⛔ grading and routing are triage's.The reading
Unauthenticated REST from inside a session reaches repository-scoped paths only. Anything under
/search/is refused by the proxy:Why it is worth a line in the table
The 403 body is valid JSON that answers the wrong question. A caller that reads
total_countoff it — the ordinary shape of a duplicate-check script — getsNone, which formats in a summary line as:That is one character away from a real empty result set and reads as "no duplicates found". A duplicate check that ran three such queries in a row produced three clean-looking zeros, all of them artefacts of the refusal. The zero was not a zero; the request never ran.
This is the same family as the already-recorded "read a 404 JSON body and grepped it" trap, but with a sharper edge: the 404 case produces obviously-odd output, while this one produces a plausible-looking count line.
What to use instead
mcp__github__search_issuesfor anything under/search. It reaches the same corpus and is not proxy-blocked. Repo-scoped enumeration (GET /repos/{owner}/{repo}/issues?labels=a,b) is unaffected and remains the correct census instrument — REST ANDs multiple labels there, which is why it is the one the lanes use.The rule this did not violate, and the one it nearly did
⛔ A zero does not exist until a positive control fires. The control is what caught this — a query whose result was known to be non-empty came back
Nonealongside the others, and three zeros with a dead control is an instrument failure, not a finding. Had the control been skipped, or run only on the queries that returned zero, a duplicate card would have been filed.⭐ Worth pairing in the table with the existing corollary: run the control first, because a zero that matches your expectations is the one you never re-check.