[Bug/write-safety]: command authority conflates org MEMBER with repo maintainer (P1, agent-layer prereq)

[JSONbored]

Problem

src/settings/command-authorization.ts:138 maps commenter author_association === OWNER || MEMBER → maintainer role. MEMBER is org membership, not maintainer-of-this-repo. The HTTP write path (requireRepoWriteAccess) deliberately avoids trusting association for exactly this reason.

Why this is a hard agent-layer prerequisite

Acceptable while commands are read-only — becomes a privilege-escalation bug the moment @gittensory commands gain write power (merge/close/review) in Phase 1 (#778). Must be fixed before N6.

Fix

When commands become write-capable, resolve real repo permission via the installation (getRepositoryCollaboratorPermission) instead of author_association.

Acceptance

• Write-capable commands require verified repo write permission, not org membership. Blocks feat(agent): maintainer write-actions layer (request-changes/approve/merge/close/label) #778.

[JSONbored]

Triage (2026-06-17): this is not a current bug — it is a write-action prerequisite. Today author_association-based maintainer authorization (command-authorization.ts:138) only gates read-only command summaries, so trusting an org MEMBER cannot escalate anything. Forcing a live getRepositoryCollaboratorPermission call now would add latency to every command for zero current security benefit. The correct place to harden this is #778 (the maintainer write-action layer) — when @gittensory commands can merge/close/review, that's when the live permission check must be required. Keeping this OPEN as a tracked blocker on #778 (it must be done before write-capable commands ship), not fixed prematurely.

[JSONbored]

Update (2026-06-17): #538 hardened the gate-override action command path — it uses real repo permission via the new resolveRealRepoPermissionAssociation (getRepositoryCollaboratorPermission), never author_association. The existing read-only @gittensory Q&A maintainer commands still trust payload.comment.author_association (low-stakes while read-only, but this issue should harden them too before #778 adds more action commands). The shared helper resolveRealRepoPermissionAssociation now exists to reuse.