[ThomasK33]

Plain problem bodies now carry three of upstream's specific code values, emitted from central helpers. This is PR 2 of the plan in #352 (issuecomment-6143529650).

Code	Status	Where
insufficient_scope	403	requireAuth: "missing required scope X" on plain-body routes, and a fork whose base_repo.auth.token lacks git:read
repository_not_found	404	every repository lookup that answers "repository not found" (v1 handlers, repo-urls, and the alias read flavor), and a missing fork source
repo_name_mismatch	400	the three repoNameMismatchMsg sites (create, fork, sync create)

What stays the same

• error and detail text, status codes, and the application/json content type.
• Every other failure keeps upstream's generic code, for example "token is not repo-scoped" (forbidden). A create that reuses a deleted repository's name keeps not_found: upstream's repository_deleted is a 409, and the status does not change.
• PR 3 maps the call-site codes (branch_not_found, ref_not_found, credential_*, repository_deleted).
• Result-envelope bodies (write routes, {"result":{...}}) do not change. They carry no problem fields (tier 3 in api: problem-details later tiers (specific codes, instance, result envelope, git/LFS writers, problem+json) — held on SDK trigger #352).

How

• writeProblem(w, status, code, msg) is now the only writer of the plain envelope. writeErr calls it with the generic code. writeProblem asserts that code is either the generic code for status or a specific code whose upstream status is status.
• specificProblemCodes lists the emitted codes with their upstream statuses.
• writeRepoNotFound and aliasRepoNotFound replace the repeated "repository not found" writes.
• requireAuthWith passes a code to its failure writer. writeAuthEnvelope (write routes) ignores it.

Tests

• TestSpecificProblemCodesMatchUpstream parses the spec's "Specific codes:" list (22 items, guarded) and checks each emitted code and its status against it.
• assertProblemFields now derives the expected code from the status and the message with a test-side oracle, independent of the implementation. It runs on every full-server plain-error assertion (requireEnvelope) on the pg and sqlite lanes. It catches both a missed site and a specific code in the wrong place.
• TestErrorBodiesCarryProblemFields pins the exact code for each case. New cases: the alias claim lookup (404), repo_name mismatch (400), and an org token on a repo route (403 forbidden, negative control).
• TestWriteProblemCodeAssertions: a specific code with the wrong status and unknown codes panic.

Dogfood

The same requests ran on a real local-mode server (SQLite + files) built from origin/main (c034b20) and from this branch (1a6b1af). The stable Go and TS SDKs (1.17.1) then read the same errors. Only code differs, on the three mapped failures. SDK messages and FindOne on a missing repo (nil / null) are identical. The clips are real-time asciinema replays rendered with agg.

pr2-ab.mp4

Docs: docs/reference/http-api.md (Errors) and the RFC 9457 row of docs/explanation/wire-compatibility.md.

Refs #352

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T12:19:24.669970Z	825b76c	Manual request
🔒 Security Review	✅ Completed 2026-10-13T12:19:40.923399Z	825b76c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 1a6b1afbde

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a6b1afbde

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 825b76ce27

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 825b76ce27

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.