Issue 344: gap 9 narrowed by mesh-host #61; the tools' sudo and the forge's rule precedence

04-ISSUES/344-known-gaps-in-the-agents-boundary-accepted-for-now/00-report.md

@@ -62,9 +62,11 @@ note. Each gap says what is open, why it matters, and what would close it.
    router itself enforces the hour, but its record is only as safe as the controller.
    *Closes with:* the router's state in a bucket only the router may write.
 
-9. **The root search's two bounds disagree.** The node-engine's search for programs that run as root stops itself
-   after two minutes, while the record allows it fifteen. On a large disk the verdict stays "not judged".
-   *Closes with:* one bound, settled in the node-engine with ADR 0266.
+9. **On a large data pool the root search may never finish.** The node-engine's search for programs that run as
+   root now has one bound of fifteen minutes (mesh-host #61; the inner two-minute limit is gone). On a machine with
+   a very large data pool the walk can still run past it, and the verdict then stays "not judged". That is loud,
+   not silent.
+   *Closes with:* setuid turned off on the data datasets, so the walk skips them.
 
 10. **An agent can merge its own pull request.** No mesh repository's main requires an approval on the forge
    (`required_approvals: 0`), and the forge tool merges as the forge's administrator once the required checks are
@@ -72,7 +74,8 @@ note. Each gap says what is open, why it matters, and what would close it.
    checks and merge it, and the controller walks the change out. The checks judge whether every machine still
    composes, not what the change is for. The operator's yes in a session is a convention, and nothing checks it.
    *Closes with:* a merge that needs the operator's own approval: a required approval on the forge from the
-   operator's personal account only, or an approval through ADR 0259's asks.
+   operator's personal account only, or an approval through ADR 0259's asks. That holds only when the forge's
+   tools cannot act as another user (gap 12) and cannot post an approving review themselves.
 
 11. **Any caller of the mesh's tools can see the operator's screen.** The display server module's tools answer every
    window's title, which can hold a mail subject or a chat's name, and can return a screenshot as data over the bus
@@ -80,6 +83,21 @@ note. Each gap says what is open, why it matters, and what would close it.
    *Closes with:* the approval mark of research 039 for screenshot and window-listing tools, or limiting them to
    the operator's own sessions.
 
+12. **The forge's tools can act as any forge user.** The tools' token belongs to a site administrator, and the
+   forge lets an administrator act as another user by adding `sudo=<user>` to a call. The generic API tool passed
+   that query on unchanged. Measured on 2026-10-09: a read through the tool with `sudo` set to the operator's
+   account answered as the operator. An agent could therefore post comments, pull requests and approving reviews
+   as the operator. The operator's own forge account is also a site administrator, so acting as it is acting as
+   an administrator.
+   *Closes with:* the tool sending only a known list of query keys and never `sudo` (being fixed in
+   mesh-catalog #153); later, a non-administrator account for the tools (gap 7).
+
+13. **The forge applies only the first protection rule that matches a branch.** A rule named for the branch comes
+   before a glob rule. A weak rule named for a branch next to a strong glob would leave the branch weakly protected,
+   while a reader that asks "does any rule protect it" sees it as protected. No repository has such a pair today
+   (every rule is named `main`), and the tools refuse to create one.
+   *Closes with:* every reader judging the first matching rule, as the forge does.
+
 ## Why it is an issue
 
 Each gap is a known way around a rule the mesh states. A gap that is written down can be weighed and closed. A