From 7f61bfea39f14464204f328cfea92450e0617e6b Mon Sep 17 00:00:00 2001 From: Trecek Date: Tue, 7 Jul 2026 03:32:08 -0700 Subject: [PATCH 1/7] fix: apply_config_authoritative_overrides uses SERVER_AUTHORITATIVE_INGREDIENTS discriminator MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fleet dispatch path (apply_config_authoritative_overrides) was using `ing.authority == "config"` as its discriminator — the same as the recipe schema annotation — which is too broad. This caused source_dir to be silently replaced with the git remote URL from resolve_ingredient_defaults, killing bootstrap_clone within 90 seconds of any fleet dispatch on a recipe that declared source_dir with authority: config. - Change A2: Import BACKEND_CAPABILITY_INGREDIENTS from autoskillit.core - Change A1: Replace the monolithic overwrite loop with a three-branch structure using the correct discriminator for each key class: SERVER_AUTHORITATIVE_INGREDIENTS (server-owned), BACKEND_CAPABILITY_INGREDIENTS (backend-owned), and the implicit caller-sovereign branch (no-op for source_dir) - Change A3 + T1-T3: Add three new tests exposing the bug (source_dir preservation, no URL injection when absent, only-mutates-enforcement-keys contract), and update the existing masking test to assert the corrected behavior instead of validating the injection bug Co-Authored-By: Claude Sonnet 4.6 --- src/autoskillit/config/ingredient_defaults.py | 32 ++-- .../test_dispatch_ingredient_validation.py | 155 +++++++++++++++++- 2 files changed, 172 insertions(+), 15 deletions(-) diff --git a/src/autoskillit/config/ingredient_defaults.py b/src/autoskillit/config/ingredient_defaults.py index f18e75a22..8590097e0 100644 --- a/src/autoskillit/config/ingredient_defaults.py +++ b/src/autoskillit/config/ingredient_defaults.py @@ -9,6 +9,7 @@ from typing import Protocol from autoskillit.core import ( + BACKEND_CAPABILITY_INGREDIENTS, CONFIG_AUTHORITY_KEYS, DISPATCH_ID_ENV_VAR, FLEET_MENU_TOOLS, @@ -205,18 +206,25 @@ def apply_config_authoritative_overrides( resolved = resolve_ingredient_defaults(project_dir) result = dict(effective_ingredients) for key in config_keys: - if key in resolved: - result[key] = resolved[key] - elif capability_overrides and key in capability_overrides: - # Fallback: only reached when resolve_ingredient_defaults() has no value for - # this key. Adding a key to resolve_ingredient_defaults shadows this branch. - result[key] = capability_overrides[key] - else: - logger.warning( - "config-authority key %r not found in resolved defaults — " - "caller-supplied value retained (config-authoritative contract not enforced)", - key, - ) + if key in SERVER_AUTHORITATIVE_INGREDIENTS: + if key in resolved: + result[key] = resolved[key] + else: + logger.warning( + "config-authority key %r not found in resolved defaults — " + "caller-supplied value retained (config-authoritative contract not enforced)", + key, + ) + elif key in BACKEND_CAPABILITY_INGREDIENTS: + if capability_overrides and key in capability_overrides: + result[key] = capability_overrides[key] + else: + logger.warning( + "config-authority key %r not found in resolved defaults — " + "caller-supplied value retained (config-authoritative contract not enforced)", + key, + ) + # else: key is caller-sovereign (e.g., source_dir) — leave result unchanged return result diff --git a/tests/fleet/test_dispatch_ingredient_validation.py b/tests/fleet/test_dispatch_ingredient_validation.py index a5e60230f..45a8c6ff3 100644 --- a/tests/fleet/test_dispatch_ingredient_validation.py +++ b/tests/fleet/test_dispatch_ingredient_validation.py @@ -319,8 +319,9 @@ def _capture_prompt_builder(**kwargs): @pytest.mark.anyio async def test_config_authoritative_ingredients_injected_for_all_resolved_keys(self, tool_ctx): - """All ingredients declared authority='config' receive config values, - not just base_branch.""" + """SERVER_AUTHORITATIVE_INGREDIENTS keys with authority='config' receive config values; + source_dir with authority='config' is caller-sovereign and is NOT overridden from + resolved defaults.""" from unittest.mock import patch from autoskillit.recipe.schema import Recipe, RecipeIngredient, RecipeKind @@ -373,7 +374,9 @@ def _capture_prompt_builder(**kwargs): ) assert captured["ingredients"]["base_branch"] == "develop" - assert captured["ingredients"]["source_dir"] == "/repo/src" + # source_dir is caller-sovereign — the URL from resolve_ingredient_defaults must NOT + # be injected even when the recipe declares authority="config". + assert captured["ingredients"].get("source_dir") != "/repo/src" assert captured["ingredients"]["local_review_rounds"] == "3" @pytest.mark.anyio @@ -537,6 +540,152 @@ def _capture_prompt_builder(**kwargs): assert captured["ingredients"]["backend_supports_git_write"] == "false" + @pytest.mark.anyio + async def test_apply_config_authoritative_overrides_source_dir_preserves_caller_local_path( + self, tool_ctx + ): + """When the recipe declares source_dir with authority='config' and the caller + supplies a local path, apply_config_authoritative_overrides must preserve the + caller's value — source_dir is caller-sovereign project identity.""" + from unittest.mock import patch + + from autoskillit.recipe.schema import Recipe, RecipeIngredient, RecipeKind + + _setup_config_authority_recipe( + tool_ctx, + Recipe( + name="test-recipe", + description="test", + kind=RecipeKind.STANDARD, + ingredients={ + "source_dir": RecipeIngredient( + description="Source directory", default="", authority="config" + ), + }, + ), + ) + captured: dict = {} + + def _capture_prompt_builder(**kwargs): + captured.update(kwargs) + return "prompt" + + from autoskillit.fleet._api import execute_dispatch + + with patch( + "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", + return_value={ + "source_dir": "https://github.com/TalonT-Org/AutoSkillit", + "base_branch": "main", + }, + ): + await execute_dispatch( + tool_ctx=tool_ctx, + recipe="test-recipe", + task="t", + ingredients={"source_dir": "/home/user/myproject"}, + dispatch_name=None, + timeout_sec=None, + prompt_builder=_capture_prompt_builder, + quota_checker=_no_sleep_quota_checker, + quota_refresher=_noop_quota_refresher, + ) + + assert captured["ingredients"]["source_dir"] == "/home/user/myproject" + + @pytest.mark.anyio + async def test_apply_config_authoritative_overrides_source_dir_not_injected_when_absent( + self, tool_ctx + ): + """When the recipe declares source_dir with authority='config' but the caller + does not supply source_dir, the URL from resolve_ingredient_defaults must NOT + be injected — source_dir is caller-sovereign and must not be auto-populated.""" + from unittest.mock import patch + + from autoskillit.recipe.schema import Recipe, RecipeIngredient, RecipeKind + + _setup_config_authority_recipe( + tool_ctx, + Recipe( + name="test-recipe", + description="test", + kind=RecipeKind.STANDARD, + ingredients={ + "source_dir": RecipeIngredient( + description="Source directory", default="", authority="config" + ), + }, + ), + ) + captured: dict = {} + + def _capture_prompt_builder(**kwargs): + captured.update(kwargs) + return "prompt" + + from autoskillit.fleet._api import execute_dispatch + + with patch( + "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", + return_value={"source_dir": "https://github.com/TalonT-Org/AutoSkillit"}, + ): + await execute_dispatch( + tool_ctx=tool_ctx, + recipe="test-recipe", + task="t", + ingredients={}, + dispatch_name=None, + timeout_sec=None, + prompt_builder=_capture_prompt_builder, + quota_checker=_no_sleep_quota_checker, + quota_refresher=_noop_quota_refresher, + ) + + assert ( + captured["ingredients"].get("source_dir") + != "https://github.com/TalonT-Org/AutoSkillit" + ) + + def test_apply_config_authoritative_overrides_only_mutates_enforcement_keys(self, tmp_path): + """For a recipe that declares ALL CONFIG_AUTHORITY_KEYS as authority='config', + the function must only mutate keys in SERVER_AUTHORITATIVE_INGREDIENTS | + BACKEND_CAPABILITY_INGREDIENTS. source_dir is caller-sovereign and must not + appear in the changed-key set.""" + from types import SimpleNamespace + from unittest.mock import patch + + from autoskillit.config import apply_config_authoritative_overrides + from autoskillit.config.ingredient_defaults import ( + BACKEND_CAPABILITY_INGREDIENTS, + SERVER_AUTHORITATIVE_INGREDIENTS, + ) + from autoskillit.core import CONFIG_AUTHORITY_KEYS + + recipe_ingredients = { + key: SimpleNamespace(authority="config") for key in CONFIG_AUTHORITY_KEYS + } + resolved_values = {key: f"resolved-{key}" for key in CONFIG_AUTHORITY_KEYS} + capability_values = {key: f"cap-{key}" for key in BACKEND_CAPABILITY_INGREDIENTS} + + with patch( + "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", + return_value=resolved_values, + ): + result = apply_config_authoritative_overrides( + {}, + recipe_ingredients, + tmp_path, + capability_overrides=capability_values, + ) + + changed_keys = set(result.keys()) + assert changed_keys <= ( + SERVER_AUTHORITATIVE_INGREDIENTS | BACKEND_CAPABILITY_INGREDIENTS + ), ( + f"apply_config_authoritative_overrides mutated caller-sovereign keys: " + f"{changed_keys - (SERVER_AUTHORITATIVE_INGREDIENTS | BACKEND_CAPABILITY_INGREDIENTS)}" + ) + def test_capability_overrides_dict_covers_registry_keys(): """Structural test: every key in BACKEND_CAPABILITY_INGREDIENTS must appear in the From b90f80d6901a01388a2f96c0050e000f9e6f64b0 Mon Sep 17 00:00:00 2001 From: Trecek Date: Tue, 7 Jul 2026 03:37:59 -0700 Subject: [PATCH 2/7] fix: emit warning for unknown config-authority keys in apply_config_authoritative_overrides --- src/autoskillit/config/ingredient_defaults.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/autoskillit/config/ingredient_defaults.py b/src/autoskillit/config/ingredient_defaults.py index 8590097e0..ecab5e5b7 100644 --- a/src/autoskillit/config/ingredient_defaults.py +++ b/src/autoskillit/config/ingredient_defaults.py @@ -224,6 +224,12 @@ def apply_config_authoritative_overrides( "caller-supplied value retained (config-authoritative contract not enforced)", key, ) + elif key not in CONFIG_AUTHORITY_KEYS: + logger.warning( + "config-authority key %r is not a recognized enforcement key — " + "caller-supplied value retained", + key, + ) # else: key is caller-sovereign (e.g., source_dir) — leave result unchanged return result From 3471db3c09ee972c9e3255a0a88b7c101b5dfc1f Mon Sep 17 00:00:00 2001 From: Trecek Date: Tue, 7 Jul 2026 04:04:08 -0700 Subject: [PATCH 3/7] fix: restore three-branch structure in apply_config_authoritative_overrides and strengthen T2 assertion --- src/autoskillit/config/ingredient_defaults.py | 6 -- .../test_dispatch_ingredient_validation.py | 57 +++++-------------- 2 files changed, 15 insertions(+), 48 deletions(-) diff --git a/src/autoskillit/config/ingredient_defaults.py b/src/autoskillit/config/ingredient_defaults.py index ecab5e5b7..8590097e0 100644 --- a/src/autoskillit/config/ingredient_defaults.py +++ b/src/autoskillit/config/ingredient_defaults.py @@ -224,12 +224,6 @@ def apply_config_authoritative_overrides( "caller-supplied value retained (config-authoritative contract not enforced)", key, ) - elif key not in CONFIG_AUTHORITY_KEYS: - logger.warning( - "config-authority key %r is not a recognized enforcement key — " - "caller-supplied value retained", - key, - ) # else: key is caller-sovereign (e.g., source_dir) — leave result unchanged return result diff --git a/tests/fleet/test_dispatch_ingredient_validation.py b/tests/fleet/test_dispatch_ingredient_validation.py index 45a8c6ff3..57a96478e 100644 --- a/tests/fleet/test_dispatch_ingredient_validation.py +++ b/tests/fleet/test_dispatch_ingredient_validation.py @@ -593,58 +593,31 @@ def _capture_prompt_builder(**kwargs): assert captured["ingredients"]["source_dir"] == "/home/user/myproject" - @pytest.mark.anyio - async def test_apply_config_authoritative_overrides_source_dir_not_injected_when_absent( - self, tool_ctx + def test_apply_config_authoritative_overrides_source_dir_not_injected_when_absent( + self, tmp_path ): - """When the recipe declares source_dir with authority='config' but the caller - does not supply source_dir, the URL from resolve_ingredient_defaults must NOT - be injected — source_dir is caller-sovereign and must not be auto-populated.""" + """When the caller does not supply source_dir, apply_config_authoritative_overrides + must not inject the URL returned by resolve_ingredient_defaults — source_dir is + caller-sovereign and must remain absent from the result.""" + from types import SimpleNamespace from unittest.mock import patch - from autoskillit.recipe.schema import Recipe, RecipeIngredient, RecipeKind - - _setup_config_authority_recipe( - tool_ctx, - Recipe( - name="test-recipe", - description="test", - kind=RecipeKind.STANDARD, - ingredients={ - "source_dir": RecipeIngredient( - description="Source directory", default="", authority="config" - ), - }, - ), - ) - captured: dict = {} - - def _capture_prompt_builder(**kwargs): - captured.update(kwargs) - return "prompt" - - from autoskillit.fleet._api import execute_dispatch + from autoskillit.config import apply_config_authoritative_overrides + recipe_ingredients = { + "source_dir": SimpleNamespace(authority="config"), + } with patch( "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", return_value={"source_dir": "https://github.com/TalonT-Org/AutoSkillit"}, ): - await execute_dispatch( - tool_ctx=tool_ctx, - recipe="test-recipe", - task="t", - ingredients={}, - dispatch_name=None, - timeout_sec=None, - prompt_builder=_capture_prompt_builder, - quota_checker=_no_sleep_quota_checker, - quota_refresher=_noop_quota_refresher, + result = apply_config_authoritative_overrides( + {}, + recipe_ingredients, + tmp_path, ) - assert ( - captured["ingredients"].get("source_dir") - != "https://github.com/TalonT-Org/AutoSkillit" - ) + assert "source_dir" not in result def test_apply_config_authoritative_overrides_only_mutates_enforcement_keys(self, tmp_path): """For a recipe that declares ALL CONFIG_AUTHORITY_KEYS as authority='config', From 61ef55f643d0bab965a9783e911abdf37c1afabe Mon Sep 17 00:00:00 2001 From: Trecek Date: Tue, 7 Jul 2026 04:10:48 -0700 Subject: [PATCH 4/7] fix: update tests that asserted unauthorized fourth-branch warning behavior MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fourth elif branch (key not in CONFIG_AUTHORITY_KEYS → warning) was removed in the prior commit restoring the three-branch structure. Two tests verified that warning behavior and now fail. Update them to assert only the correct three-branch behavior: unknown caller-sovereign keys are retained silently without a warning. --- tests/config/test_helpers.py | 19 ++++----- .../test_dispatch_ingredient_validation.py | 41 ++++++++----------- 2 files changed, 24 insertions(+), 36 deletions(-) diff --git a/tests/config/test_helpers.py b/tests/config/test_helpers.py index 8b6cb825f..1520ab948 100644 --- a/tests/config/test_helpers.py +++ b/tests/config/test_helpers.py @@ -247,25 +247,21 @@ def test_apply_config_authoritative_overrides_capability_key_overrides_caller(tm assert result["backend_supports_git_write"] == "false" -def test_apply_config_authoritative_overrides_unknown_key_warns_and_retains(tmp_path): - """A config-authority key not in any registry (truly unknown) must trigger the - warning-and-retain path, not the capability override path.""" +def test_apply_config_authoritative_overrides_unknown_key_retains_caller_value(tmp_path): + """A config-authority key not in SERVER_AUTHORITATIVE_INGREDIENTS or + BACKEND_CAPABILITY_INGREDIENTS is caller-sovereign — the caller-supplied value + is retained silently (no warning).""" from types import SimpleNamespace - import structlog.testing - from autoskillit.config import apply_config_authoritative_overrides recipe_ingredients = { "totally_unknown_key": SimpleNamespace(authority="config"), } - with ( - patch( - "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", - return_value={}, - ), - structlog.testing.capture_logs() as cap_logs, + with patch( + "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", + return_value={}, ): result = apply_config_authoritative_overrides( {"totally_unknown_key": "caller-value"}, @@ -275,7 +271,6 @@ def test_apply_config_authoritative_overrides_unknown_key_warns_and_retains(tmp_ ) assert result["totally_unknown_key"] == "caller-value" - assert any("config-authority key" in e.get("event", "") for e in cap_logs) # T4: REQ-ING-003 diff --git a/tests/fleet/test_dispatch_ingredient_validation.py b/tests/fleet/test_dispatch_ingredient_validation.py index 57a96478e..0b216a7ad 100644 --- a/tests/fleet/test_dispatch_ingredient_validation.py +++ b/tests/fleet/test_dispatch_ingredient_validation.py @@ -434,12 +434,10 @@ async def test_config_authoritative_key_absent_from_defaults_retains_caller_valu self, tool_ctx ): """When a config-authority key is absent from resolved defaults AND not in - BACKEND_CAPABILITY_INGREDIENTS, the caller-supplied value is retained and a - warning is logged.""" + BACKEND_CAPABILITY_INGREDIENTS, the caller-supplied value is retained silently + (caller-sovereign path — no warning).""" from unittest.mock import patch - import structlog.testing - from autoskillit.recipe.schema import Recipe, RecipeIngredient, RecipeKind _setup_config_authority_recipe( @@ -463,28 +461,23 @@ def _capture_prompt_builder(**kwargs): from autoskillit.fleet._api import execute_dispatch - with structlog.testing.capture_logs() as cap_logs: - with patch( - "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", - return_value={}, # key absent from all registries - ): - await execute_dispatch( - tool_ctx=tool_ctx, - recipe="test-recipe", - task="t", - ingredients={"truly_unknown_key": "caller-supplied"}, - dispatch_name=None, - timeout_sec=None, - prompt_builder=_capture_prompt_builder, - quota_checker=_no_sleep_quota_checker, - quota_refresher=_noop_quota_refresher, - ) + with patch( + "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", + return_value={}, # key absent from all registries + ): + await execute_dispatch( + tool_ctx=tool_ctx, + recipe="test-recipe", + task="t", + ingredients={"truly_unknown_key": "caller-supplied"}, + dispatch_name=None, + timeout_sec=None, + prompt_builder=_capture_prompt_builder, + quota_checker=_no_sleep_quota_checker, + quota_refresher=_noop_quota_refresher, + ) assert captured["ingredients"]["truly_unknown_key"] == "caller-supplied" - assert any( - e.get("log_level") == "warning" and "config-authority key" in e.get("event", "") - for e in cap_logs - ) @pytest.mark.anyio async def test_non_writable_backend_forces_git_write_false_at_dispatch(self, tool_ctx): From 84e73645126e61111b9f108a363a311e8d1e6112 Mon Sep 17 00:00:00 2001 From: Trecek Date: Tue, 7 Jul 2026 04:45:08 -0700 Subject: [PATCH 5/7] fix(review): use distinct warning message for capability-based ingredient branch The BACKEND_CAPABILITY_INGREDIENTS warning log was identical to the SERVER_AUTHORITATIVE_INGREDIENTS warning, making it impossible for log consumers to distinguish which branch fired. Use a branch-specific message. Co-Authored-By: Claude Sonnet 4.6 --- src/autoskillit/config/ingredient_defaults.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/autoskillit/config/ingredient_defaults.py b/src/autoskillit/config/ingredient_defaults.py index 8590097e0..25d8824b8 100644 --- a/src/autoskillit/config/ingredient_defaults.py +++ b/src/autoskillit/config/ingredient_defaults.py @@ -220,8 +220,8 @@ def apply_config_authoritative_overrides( result[key] = capability_overrides[key] else: logger.warning( - "config-authority key %r not found in resolved defaults — " - "caller-supplied value retained (config-authoritative contract not enforced)", + "capability-based key %r not found in capability_overrides — " + "caller-supplied value retained (capability contract not enforced)", key, ) # else: key is caller-sovereign (e.g., source_dir) — leave result unchanged From 4fcabfe99d421a00fd76a89c38e5b803822943a1 Mon Sep 17 00:00:00 2001 From: Trecek Date: Tue, 7 Jul 2026 04:45:20 -0700 Subject: [PATCH 6/7] fix(review): assert no warning emitted for caller-sovereign key in unit test The test docstring stated the key is retained silently (no warning), but no assertion verified this contract. Add structlog.testing.capture_logs() and a negative assertion to guard against regression to warn-on-unknown behavior. Co-Authored-By: Claude Sonnet 4.6 --- tests/config/test_helpers.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/tests/config/test_helpers.py b/tests/config/test_helpers.py index 1520ab948..765dbeb1b 100644 --- a/tests/config/test_helpers.py +++ b/tests/config/test_helpers.py @@ -253,15 +253,20 @@ def test_apply_config_authoritative_overrides_unknown_key_retains_caller_value(t is retained silently (no warning).""" from types import SimpleNamespace + import structlog.testing + from autoskillit.config import apply_config_authoritative_overrides recipe_ingredients = { "totally_unknown_key": SimpleNamespace(authority="config"), } - with patch( - "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", - return_value={}, + with ( + patch( + "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", + return_value={}, + ), + structlog.testing.capture_logs() as cap_logs, ): result = apply_config_authoritative_overrides( {"totally_unknown_key": "caller-value"}, @@ -271,6 +276,7 @@ def test_apply_config_authoritative_overrides_unknown_key_retains_caller_value(t ) assert result["totally_unknown_key"] == "caller-value" + assert not any("config-authority key" in e.get("event", "") for e in cap_logs) # T4: REQ-ING-003 From 929baf0608ed7be5e3988debc195d442586de0da Mon Sep 17 00:00:00 2001 From: Trecek Date: Tue, 7 Jul 2026 04:45:29 -0700 Subject: [PATCH 7/7] fix(review): assert no warning emitted for caller-sovereign key in async integration test The test docstring stated the caller-sovereign path emits no warning, but the test dropped the prior warning assertion without adding an explicit no-warning check. Add structlog.testing.capture_logs() and a negative assertion to prevent regression to the old warn-on-unknown behavior. Co-Authored-By: Claude Sonnet 4.6 --- tests/fleet/test_dispatch_ingredient_validation.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/tests/fleet/test_dispatch_ingredient_validation.py b/tests/fleet/test_dispatch_ingredient_validation.py index 0b216a7ad..27a643a3b 100644 --- a/tests/fleet/test_dispatch_ingredient_validation.py +++ b/tests/fleet/test_dispatch_ingredient_validation.py @@ -459,11 +459,16 @@ def _capture_prompt_builder(**kwargs): captured.update(kwargs) return "prompt" + import structlog.testing + from autoskillit.fleet._api import execute_dispatch - with patch( - "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", - return_value={}, # key absent from all registries + with ( + patch( + "autoskillit.config.ingredient_defaults.resolve_ingredient_defaults", + return_value={}, # key absent from all registries + ), + structlog.testing.capture_logs() as cap_logs, ): await execute_dispatch( tool_ctx=tool_ctx, @@ -478,6 +483,7 @@ def _capture_prompt_builder(**kwargs): ) assert captured["ingredients"]["truly_unknown_key"] == "caller-supplied" + assert not any("config-authority key" in e.get("event", "") for e in cap_logs) @pytest.mark.anyio async def test_non_writable_backend_forces_git_write_false_at_dispatch(self, tool_ctx):