From 2642fdb446be65f5ebed16b9f892d6f7bd47715a Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Sun, 13 Sep 2026 19:56:33 +0300
Subject: [PATCH] =?UTF-8?q?=D0=9C=D1=83=D1=82=D0=B0=D0=BD=D1=82:=20=D0=B7?=
 =?UTF-8?q?=D0=B0=D0=BF=D0=B8=D1=81=D1=8C=20=D0=B2=20=D1=80=D0=B5=D0=BF?=
 =?UTF-8?q?=D0=BE=D0=B7=D0=B8=D1=82=D0=BE=D1=80=D0=B8=D0=B9=20=D1=83=20?=
 =?UTF-8?q?=D0=BD=D0=B5=D0=B4=D0=BE=D0=B2=D0=B5=D1=80=D0=B5=D0=BD=D0=BD?=
 =?UTF-8?q?=D0=BE=D0=B9=20=D1=81=D1=82=D0=B0=D0=B4=D0=B8=D0=B8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Issue: #556
User-Visible: no
---
 scripts/mutation-gate.mjs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/scripts/mutation-gate.mjs b/scripts/mutation-gate.mjs
index fddc9860..ca1e490f 100644
--- a/scripts/mutation-gate.mjs
+++ b/scripts/mutation-gate.mjs
@@ -8046,6 +8046,17 @@ const MUTANT_DEFINITIONS = [
       replace: "export const isPinned = (spec) => /^[\\w.-]+\\/[\\w./-]+@\\S+$/.test(spec);",
     }],
   },
+  {
+    id: 'review-model-gets-repository-write',
+    guard: 'node --test --test-name-pattern="по job" test/review-doc-guard.test.mjs',
+    because: '#556: недоверенная стадия с правом записи в репозиторий может положить коммит в '
+      + 'ветку задачи в обход ревью и слияния — потолок прав этой job проверяется дословно',
+    patches: [{
+      file: '.github/workflows/process.yml',
+      find: '    permissions:\n      contents: read\n      issues: write\n    needs: [guard, prepare]\n',
+      replace: '    permissions:\n      contents: write\n      issues: write\n    needs: [guard, prepare]\n',
+    }],
+  },
   {
     id: 'review-job-trusts-the-app-token',
     guard: 'node --test --test-name-pattern="job-scoped" test/review-doc-guard.test.mjs',