PR Custody

PRPR Custody

fix: align Dart action scopes with verified QA docs

@surajmarkupchecks n/achecks…fix/dart-scope-qa-mismatches → master14 files · +14 −4updated 1mo ago

GitHub

▸Description· 1 comment

Summary

Audited only the VERIFIED Dart worksheet in /Users/suraj.markupgmail.com/Desktop/[QA TESTING] Action To Scope Mapping.xlsx.
This workbook revision has no literal need review rows on VERIFIED Dart; the actionable set was the 14 rows currently marked FAILED in Mercury vs Official doc status (all missing/empty Mercury scopes).
Verified each action against the real action code first, then Dart's canonical public API docs and OAuth guide as ground truth.

Per-action changes

Action	Old	New	Reason	Source
`add_task_comment`	`[]`	`{"all_of": ["write"]}`	Action code makes a single `POST /public/comments` call; the official operation requires OAuth scope `write`.	addTaskComment docs, OAuth guide
`create_doc`	`[]`	`{"all_of": ["write"]}`	Action code makes a single `POST /public/docs` call; the official operation requires `write`.	createDoc docs, OAuth guide
`create_task`	missing	`{"all_of": ["write"]}`	Action code makes a single `POST /public/tasks` call; the official operation requires `write`.	createTask docs, OAuth guide
`dart_add_task_time_tracking`	missing	`{"all_of": ["write"]}`	Action code makes a single `POST /public/tasks/{id}/time-tracking` call; the official operation requires `write`.	addTaskTimeTracking docs, OAuth guide
`dart_delete_doc`	missing	`{"all_of": ["write"]}`	Action code makes a single `DELETE /public/docs/{id}` call; the official operation requires `write`.	deleteDoc docs, OAuth guide
`dart_delete_task`	missing	`{"all_of": ["write"]}`	Action code makes a single `DELETE /public/tasks/{id}` call; the official operation requires `write`.	deleteTask docs, OAuth guide
`dart_list_help_center_articles`	missing	`{"all_of": ["read"]}`	Action code makes a single `GET /public/help-center-articles/list` call; the official operation requires `read`.	listHelpCenterArticles docs, OAuth guide
`dart_move_task`	missing	`{"all_of": ["write"]}`	Action code makes a single `POST /public/tasks/{id}/move` call; the official operation requires `write`.	moveTask docs, OAuth guide
`dart_retrieve_skill_by_title`	`[]`	`{"all_of": ["read"]}`	Action code makes a single `GET /public/skills/by-title` call; the official operation requires `read`.	retrieveSkillByTitle docs, OAuth guide
`get_config`	missing	`{"all_of": ["read"]}`	Action code makes a single `GET /public/config` call; the official operation requires `read`.	getConfig docs, OAuth guide
`get_doc`	missing	`{"all_of": ["read"]}`	Action code makes a single `GET /public/docs/{id}` call; the official operation requires `read`.	getDoc docs, OAuth guide
`list_comments`	missing	`{"all_of": ["read"]}`	Action code makes a single `GET /public/comments/list` call; the official operation requires `read`.	listComments docs, OAuth guide
`list_tasks`	missing	`{"all_of": ["read"]}`	Action code makes a single `GET /public/tasks/list` call; the official operation requires `read`.	listTasks docs, OAuth guide
`update_doc`	`[]`	`{"all_of": ["write"]}`	Action code makes a single `PUT /public/docs/{id}` call; the official operation requires `write`.	updateDoc docs, OAuth guide

Coverage matrix

All 14 Dart edits were single-endpoint / single-scope fixes, so there were no non-trivial multi-endpoint CNF intersections to preserve. For completeness, here is the endpoint coverage used to derive each final CNF:

Action	Actual HTTP call(s) in action code	Endpoint doc scope(s)	Final CNF
`add_task_comment`	`POST /public/comments`	`write`	`{"all_of": ["write"]}`
`create_doc`	`POST /public/docs`	`write`	`{"all_of": ["write"]}`
`create_task`	`POST /public/tasks`	`write`	`{"all_of": ["write"]}`
`dart_add_task_time_tracking`	`POST /public/tasks/{id}/time-tracking`	`write`	`{"all_of": ["write"]}`
`dart_delete_doc`	`DELETE /public/docs/{id}`	`write`	`{"all_of": ["write"]}`
`dart_delete_task`	`DELETE /public/tasks/{id}`	`write`	`{"all_of": ["write"]}`
`dart_list_help_center_articles`	`GET /public/help-center-articles/list`	`read`	`{"all_of": ["read"]}`
`dart_move_task`	`POST /public/tasks/{id}/move`	`write`	`{"all_of": ["write"]}`
`dart_retrieve_skill_by_title`	`GET /public/skills/by-title`	`read`	`{"all_of": ["read"]}`
`get_config`	`GET /public/config`	`read`	`{"all_of": ["read"]}`
`get_doc`	`GET /public/docs/{id}`	`read`	`{"all_of": ["read"]}`
`list_comments`	`GET /public/comments/list`	`read`	`{"all_of": ["read"]}`

Reviewed but not changed

No literal need review rows exist on the current VERIFIED Dart sheet revision.
No FAILED / mismatch-equivalent Dart rows turned out to be QA false positives; every flagged row corresponded to a real missing or empty _scopes definition in code.

Validation

./.nox/fmt_app/bin/ruff format <edited files> ✅
./.nox/chk_app/bin/ruff check <edited files> ✅
AST-verified every edited _scopes block with ast.literal_eval against the {"all_of": [<clause>, ...]} CNF shape ✅

Notes

I had to bootstrap .nox/fmt_app with uvx --from nox nox -s fmt_app -- apps/dart/actions.
uvx --from nox nox -s chk_app -- apps/dart/actions currently fails in this repo under Python 3.14 while building psycopg2-binary, so I installed ruff into .nox/chk_app and then ran the exact requested ./.nox/chk_app/bin/ruff check ... command successfully.

Bugbot pass

Fetched review comments with gh api repos/ComposioHQ/mercury/pulls/23390/comments after opening the PR.
Result at fetch time: [] (no Bugbot or reviewer comments yet), so no follow-up code changes or reverts were needed.

@surajmarkup1mo ago

Addressed Bugbot review: removed the repo-root scope_audit_dart.md working document from the branch and kept the audit details in the PR context instead.

loading diff…