Artifact [80923cf46f]

Artifact 80923cf46f5b629b03f54405e02592ee40d21401c8c788e3ac1a7951004323c9:

• File conformance/rfcs/erratum/sync-protocol-01-s6.6-refusal-text-suffix.md — part of check-in [f61c8174a8] at 2026-10-17 20:27:53 on branch main — test(conformance): re-pin the -01 drafts with the 2026-10-14/16 errata (#436)

  zit check-in 3f86ff4261 applies six more errata to the -01 drafts. Copy the three drafts and the five new -01 errata files, re-pin their SHA-256 in the requirements tables, and record the check-in in the README.

  The draft text changes add six requirements and reword two:

  - AF-4.7.3-2: a named delta's delete markers are filtered out of a delta-of-delta's file set and lookups. - AF-4.7.8-1: an absent and a present empty J value decode alike. - AF-6.2-7: the Z verification state is read from the bytes at n-35 and n-34, not from card lines. - RS-5.3-3: a cancel keeps its card's value on the row it writes. - RS-5.3-6: the event table and propagation treat that value as null. - RS-5.3-7: an artifact's tag cards apply in card order. - RS-6.2-4: a branch root carrying *sym-NAME and -sym-NAME keeps the tag. - SP-6.6-4: a client recognizes a refusal by its leading text.

  go-libfossil already behaves this way. Each row has a case, checked against fossil 2.28 where the harness does: 421 requirements, 420 covered, 1 partial (SP-9.5-7, as before).

  The repo-state §5.3 step 3 change is filed in zit as a -00 erratum and is not pinned, like the other -00 errata; the -01 draft carries its text. (user: [email protected], size: 2959) [annotate] [blame] [check-ins using]

# Erratum: draft-fossil-sync-protocol-01 §6.6

| | |
|---|---|
| **Document** | `draft-fossil-sync-protocol-01` |
| **Section** | 6.6, Capability Model (the text of a refusal) |
| **Type** | Technical (a refusal can carry more text than the draft gives) |
| **Status** | Applied in `draft-fossil-sync-protocol-01` (2026-10-16) |
| **Reported** | 2026-10-16 |
| **Submitter** | Dan Mestas |
| **Found via** | Rechecking the §6.6 refusal forms against Fossil's source; confirmed by running Fossil 2.28 |

## 1. Summary

§6.6 and the sections it points to give each refusal as an exact card:
`error not authorized to write`, `message pull only - not authorized to
push`, `error not authorized to push configuration`, `error not authorized
to sync private content`. Fossil appends ` because the 'localauth' setting
is enabled` to every one of them when it refuses a loopback request that
its `localauth` setting requires to log in. A client that matches the whole
text misses the refusal. Only §10.1's autopush rule, which matches
`%not authorized to write%`, already allows for it.

## 2. The text in error

Page 22 (§6.6):

> Otherwise the server resets accumulated output and emits error not
> authorized to write.

The draft says nothing about further text after any refusal.

## 3. What Fossil implements

`src/xfer.c`:

```
static char *whyNotAuth(void){
  if( g.useLocalauth && db_get_boolean("localauth",0)!=0 ){
    return "\\sbecause\\sthe\\s'localauth'\\ssetting\\sis\\senabled";
  }
  return "";
}
```

Every refusal in `page_xfer()` is written as, for example,

```
@ error not\sauthorized\sto\swrite%s(whyNotAuth())
```

and the same call follows the `pull only` message and the read, clone,
configuration and private-content refusals.

Checked with Fossil 2.28 [52445a27f1]: a repository with `localauth` set to
1, served by `fossil server --localauth`, and an anonymous `push` card sent
from 127.0.0.1. The reply is

```
error not\sauthorized\sto\swrite\sbecause\sthe\s'localauth'\ssetting\sis\senabled
```

## 4. Corrected text

Add to §6.6, after its last paragraph:

> A server MAY append further words to the text of any refusal this
> document gives in the form "not authorized to ...", including the
> message form above. Fossil appends " because the 'localauth' setting is
> enabled" when it refuses a request from the loopback address because
> that setting requires such requests to log in. A client MUST recognize a
> refusal by the text this document gives at the start of the decoded
> text, not by the whole text.

## 5. Observable consequence of the uncorrected text

A client that compares the whole decoded text treats a refused push from a
local `fossil server --localauth` as an unknown error, or does not
recognize the `pull only` message, and reports or continues differently
from Fossil's client.

## 6. Implementations

zit's client does not match refusal text, and its server never appends to
it. No change is needed.