Parked by Patrick's word 2026-08-16 ("we deal with later") - tracking issue, not urgent.
WHAT: The host API's drone-routed read lanes (/v1/git-changes, /v1/diff) resolve a foreign project's branch root correctly, then cannot measure it: drone verifies its caller by finding a .trinity/passport.json in the directory hierarchy, and external projects (e.g. vera) have none.
MEASURED (@api, 2026-08-16, run in-place rather than reasoned about): exit 1, 'No .trinity/passport.json found in directory hierarchy - cannot verify caller.' Both routes answer 503 read_unavailable carrying drone's sentence verbatim - deliberately honest, because an empty change list would paint a foreign tree as clean when nothing was ever measured.
SCOPE: any drone-routed lane pointed outside the AIPass passport tree. Tenant projects carrying passports (projects/baud) are unaffected. /v1/diff has carried this limit since project= shipped on it; /v1/git-changes inherited it at birth (2026-08-16). Not introduced by either route - it is drone's caller model meeting the one-terminal ruling (any agent, any project, external included).
DECISION NEEDED (fleet ruling): whether and how drone's caller verification should serve external projects. Candidate shapes: a verified host-level caller assertion; a registered-external-projects lane in drone; or keeping the boundary and documenting it. Security posture matters - the passport check is drone's trust anchor, not an accident.
UNTIL RULED: faces render the 503 as unavailable, never as clean/zero.
Refs: devpulse docs/phone_punch_list_20260816.md; @api session 84, FPLAN-0434.
Parked by Patrick's word 2026-08-16 ("we deal with later") - tracking issue, not urgent.
WHAT: The host API's drone-routed read lanes (/v1/git-changes, /v1/diff) resolve a foreign project's branch root correctly, then cannot measure it: drone verifies its caller by finding a .trinity/passport.json in the directory hierarchy, and external projects (e.g. vera) have none.
MEASURED (@api, 2026-08-16, run in-place rather than reasoned about): exit 1, 'No .trinity/passport.json found in directory hierarchy - cannot verify caller.' Both routes answer 503 read_unavailable carrying drone's sentence verbatim - deliberately honest, because an empty change list would paint a foreign tree as clean when nothing was ever measured.
SCOPE: any drone-routed lane pointed outside the AIPass passport tree. Tenant projects carrying passports (projects/baud) are unaffected. /v1/diff has carried this limit since project= shipped on it; /v1/git-changes inherited it at birth (2026-08-16). Not introduced by either route - it is drone's caller model meeting the one-terminal ruling (any agent, any project, external included).
DECISION NEEDED (fleet ruling): whether and how drone's caller verification should serve external projects. Candidate shapes: a verified host-level caller assertion; a registered-external-projects lane in drone; or keeping the boundary and documenting it. Security posture matters - the passport check is drone's trust anchor, not an accident.
UNTIL RULED: faces render the 503 as unavailable, never as clean/zero.
Refs: devpulse docs/phone_punch_list_20260816.md; @api session 84, FPLAN-0434.