Complete pull request route authority

Complete pull request route authority

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified lib/openagents_web/route_authority.ex
modified priv/migration_lineages/prior-2026-08-19.json

Diff

2 files changed, +15 -1

          false
        )

      pull_request_browser_path?(path) and verb in [:get, :head] ->
        declaration(
          :public_read,
          "anonymous visitor or signed-in person",
          "forge:pull-requests:web",
          false
        )

      repository_browser_path?(path) and verb in [:get, :head] ->
        declaration(
          :public_read,

      String.match?(path, ~r{\A/:owner/:repo/issues/:number\z})
  end

  defp pull_request_browser_path?(path) do
    path == "/:owner/:repo/pulls" or
      String.match?(path, ~r{\A/:owner/:repo/pulls/:number\z})
  end

  defp repository_browser_path?(path) do
    path == "/:owner/:repo" or
      String.starts_with?(path, [

232	232		`20260822153929,`
233	233		`20260822234211,`
234	234		`20260823000143,`
235		-	`20260823010819`
	235	+	`20260823010819,`
	236	+	`20260823013135`
236	237		`],`
237	238		`"required_tables": [`
238	239		`"users",`

270	270		`false`
271	271		`)`
272	272
	273	+	`pull_request_browser_path?(path) and verb in [:get, :head] ->`
	274	+	`declaration(`
	275	+	`:public_read,`
	276	+	`"anonymous visitor or signed-in person",`
	277	+	`"forge:pull-requests:web",`
	278	+	`false`
	279	+	`)`
	280	+
273	281		`repository_browser_path?(path) and verb in [:get, :head] ->`
274	282		`declaration(`
275	283		`:public_read,`

318	326		`String.match?(path, ~r{\A/:owner/:repo/issues/:number\z})`
319	327		`end`
320	328
	329	+	`defp pull_request_browser_path?(path) do`
	330	+	`path == "/:owner/:repo/pulls" or`
	331	+	`String.match?(path, ~r{\A/:owner/:repo/pulls/:number\z})`
	332	+	`end`
	333	+
321	334		`defp repository_browser_path?(path) do`
322	335		`path == "/:owner/:repo" or`
323	336		`String.starts_with?(path, [`