[mrizzi]

Summary

• Document the Jira project permissions the fullsend Jira Service Account needs on TC — Browse Projects, Add Comments, Edit Own Comments and Edit Issues — what each is used for, and which TC roles grant them (Users + Developers), in fullsend.md → Jira through the API gateway, with a cross-reference from the variables-and-secrets section.
• Edit Issues is needed because fullsend v0.52.0 re-writes the fullsend.sticky-marker comment property before every sticky-comment update, and Jira Cloud requires Edit Issues for comment-property writes. Without it every verify-pr re-run on a task with an existing report comment fails the post_script with 403 You do not have permission to edit issues in this project.
• Document the permission check against an issue (mypermissions?issueKey=…): project-level results report true when the permission is held on any issue, which hid the missing Edit Issues.
• Stop naming the Service Account explicitly in fullsend.md.

Docs-only; fullsend.md is not pinned content, so no re-pin/re-lock. Live proof (edit in place after the grant): verify-pr run 41420531188 attempt 3 on #363, evidence on the Jira task.

Implements TC-7313

🤖 Generated with Claude Code

Summary by Sourcery

Document the fullsend Jira Service Account’s required project permissions and the checks needed to verify them reliably.

Enhancements:

• Document the Jira project permissions required by the fullsend Service Account and how each permission supports verification and comment updates.
• Clarify issue-level Jira permission checks and explain the limitation of project-level checks for detecting Edit Issues access.
• Use generic Service Account references instead of exposing the account name in the documentation.

Documentation:

• Add cross-referenced documentation covering required Jira permissions, role assignments, permission verification, and credential guidance.

[sourcery-ai]

Reviewer's Guide

This docs-only change records the Jira permissions needed by tpa-fullsend-jira-sa, explains how they support initial and repeat verify-pr runs, adds a gateway permission-check command, and cross-references the requirements from the credential documentation.

Sequence diagram for Fullsend Jira sticky comment lifecycle

sequenceDiagram
    participant VerifyPR
    participant Gateway
    participant Jira

    VerifyPR->>Gateway: verify_project_access
    Gateway->>Jira: GET task, comments, and links
    Jira-->>Gateway: Browse Projects permitted
    Gateway-->>VerifyPR: Access check passes
    alt First verify-pr run
        VerifyPR->>Gateway: fullsend issues post-comment
        Gateway->>Jira: Add sticky report comment
        Jira-->>Gateway: Comment created
    else Later verify-pr run
        VerifyPR->>Gateway: Edit sticky comment
        Gateway->>Jira: Edit own comment
        Jira-->>Gateway: Comment updated
        VerifyPR->>Gateway: Set fullsend.sticky-marker
        Gateway->>Jira: Update comment property
        Jira-->>Gateway: Property updated
    end

Loading

Flow diagram for verifying Fullsend Jira project permissions

flowchart LR
    Token[Bearer JIRA_TOKEN] --> Check[mypermissions gateway check]
    Check --> Browse{BROWSE_PROJECTS}
    Check --> Add{ADD_COMMENTS}
    Check --> Edit{EDIT_OWN_COMMENTS}
    Browse --> Result[havePermission true]
    Add --> Result
    Edit --> Result

Loading

File-Level Changes

Change	Details	Files
Document the Jira project permissions required by the Fullsend service account and how to verify its effective access.	List Browse Projects, Add Comments, and Edit Own Comments with their Fullsend workflow usage. Add a Bearer-authenticated mypermissions curl check for the TC project. Clarify that triage-security mutations require additional permissions and that the listed permissions apply to the service account. Cross-reference the permission requirements from the credential and variables section.	fullsend.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Approved.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[fullsend-ai-review]

🤖 Verify Pr · ⚠️ Cancelled · Started 12:11 PM UTC · Ended 12:12 PM UTC

Commit: 96feaf8 · View workflow run →

[fullsend-ai-review]

🤖 Finished Verify Pr · ✅ Success · Started 12:14 PM UTC · Completed 12:21 PM UTC

Commit: b1ffd26 · View workflow run →

Runtime: claude · Model: claude-opus-4-8 · Effort: high · Cost: $2.77

[fullsend-ai-review]

Verification Report for TC-7313 (commit b1ffd26)

Check	Result	Details
Review Feedback	N/A	No inline comments and no substantive review-body feedback; Sourcery approved with no change requests.
Root-Cause Investigation	N/A	No sub-tasks created, so no root-cause investigation was needed.
Scope Containment	PASS	Only the task-specified file fullsend.md was changed.
Diff Size	PASS	26 insertions / 1 deletion across 1 file — proportionate for a docs task.
Commit Traceability	PASS	Both commits reference TC-7313.
Sensitive Patterns	PASS	No secrets in added lines; only env-var references and Jira permission-key docs.
CI Status	PASS	All 7 head-SHA check-runs completed with success; no commit statuses.
Acceptance Criteria	WARN	1 of 5 met from the diff (AC4 docs); AC1-3 & AC5 need live run / Jira-task evidence.
Test Quality	N/A	No test files or eval results in the PR.
Test Change Classification	N/A	No test files changed.
Verification Commands	N/A	No Verification Commands section; no eval-infrastructure changes.

Overall: WARN

Docs-only change to fullsend.md documenting the Jira Service Account (tpa-fullsend-jira-sa) required project permissions — Browse Projects, Add Comments, Edit Own Comments — each with its purpose, plus a gateway mypermissions check and a cross-reference from the credential-rotation section. All scope, size, traceability, security, and CI checks pass and Sourcery approved.

The only non-passing check is Acceptance Criteria (WARN): AC4 (fullsend.md lists the three permissions with purpose) is satisfied by the diff, but AC1-3 and AC5 require live operational evidence that a PR diff cannot carry and that a human must confirm on the Jira task before merge: (AC1) the SA-token mypermissions response recorded on the task; (AC2) a green verify-pr re-run whose post-script shows Posted report to Jira <KEY> with no 403; (AC3) that run editing the existing sticky comment in place (same comment ID, updated > created, SA verify-pr comment count stays at 1); and (AC5) the admin permission request linked on the task.

No code change requests, CI failures, or eval failures were found, so no sub-tasks were created. This report is informational — merging remains a human decision.

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.13.10.

[fullsend-ai-review]

🤖 Verify Pr · ⚠️ Cancelled · Started 2:48 PM UTC · Ended 2:49 PM UTC

Commit: 27082d6 · View workflow run →

[fullsend-ai-review]

🤖 Finished Verify Pr · ✅ Success · Started 2:52 PM UTC · Completed 2:59 PM UTC

Commit: f849ab7 · View workflow run →

Runtime: claude · Model: claude-opus-4-8 · Effort: high · Cost: $2.70

[fullsend-ai-review]

Verification Report for TC-7313 (commit f849ab7)

Check	Result	Details
Review Feedback	N/A	No inline comments; only an automated sourcery-ai[bot] approval with no actionable feedback
Root-Cause Investigation	N/A	No sub-tasks created
Scope Containment	PASS	Only fullsend.md changed — matches the task's single Files-to-Modify entry
Diff Size	PASS	+36/−1 in one docs file; proportionate to a documentation task
Commit Traceability	PASS	All 4 commits reference TC-7313
Sensitive Patterns	PASS	No secrets in added lines (only permission-key docs and env-var-name references)
CI Status	PASS	All 7 head-SHA checks pass (success/skipped); no failures or pending
Acceptance Criteria	FAIL	1 of 5 verifiable from the diff (AC4 met); AC1/AC2/AC3/AC5 require live Jira/CI evidence recorded on TC-7313
Test Quality	N/A	No test files changed; Eval Quality: N/A
Test Change Classification	N/A	No test files changed
Verification Commands	N/A	No commands specified; no eval-infrastructure changes

Overall: FAIL

The documentation change itself is clean: scope, diff size, commit traceability, the secret scan, and CI all pass, and there are no test or eval concerns. The FAIL is driven solely by Acceptance Criteria, and reflects the limits of diff-only inspection rather than a defect in the change.

This is a docs-and-permission task. Only AC4 (fullsend.md lists the SA's required Jira permissions — Browse Projects, Add Comments, Edit Own Comments — with their purpose) is satisfiable from the PR diff, and it is met (the PR additionally documents the Edit Issues permission discovered during implementation, needed for the sticky-marker comment-property write under fullsend v0.52.0). The remaining criteria require live evidence attached to TC-7313 that cannot be confirmed from the diff:

• AC1 — the SA mypermissions response recorded on the task
• AC2 — a green verify-pr / Harness run whose log shows Posted report to Jira <KEY>
• AC3 — the sticky comment edited in place (same comment ID, updated > created, SA verify-pr comment count stays at 1)
• AC5 — the admin permission-request linked on the task

Action for the human reviewer: confirm AC1/AC2/AC3/AC5 against the evidence on TC-7313 before merging. No sub-tasks were created (no code change requests, CI failures, or eval regressions), so no root-cause investigation was warranted.

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.13.10.

[fullsend-ai-review]

🤖 Finished Verify Pr · ✅ Success · Started 3:04 PM UTC · Completed 3:11 PM UTC

Commit: 9957057 · View workflow run →

Runtime: claude · Model: claude-opus-4-8 · Effort: high · Cost: $2.78

[fullsend-ai-review]

Verification Report for TC-7313 (commit 9957057)

Check	Result	Details
Review Feedback	N/A	No inline comments and no substantive review-body feedback; Sourcery approved with no change requests.
Root-Cause Investigation	N/A	No sub-tasks created, so no root-cause investigation was needed.
Scope Containment	PASS	Only the task-specified file fullsend.md was changed.
Diff Size	PASS	+38/-3 across 1 file — proportionate for a docs task.
Commit Traceability	PASS	All 5 commits reference TC-7313.
Sensitive Patterns	PASS	No secrets or credentials in added lines.
CI Status	PASS	All 7 head-SHA checks pass (Sourcery review skipped).
Acceptance Criteria	WARN	1 of 5 verifiable from the diff (criterion 4 met); criteria 1, 2, 3, 5 require live Jira/runtime evidence recorded on the task.
Test Quality	N/A	No test files changed; Eval Quality: N/A.
Test Change Classification	N/A	No test files changed.
Verification Commands	N/A	Task specifies none; no eval infrastructure changed.

Overall: WARN

This is a clean, in-scope documentation edit to fullsend.md, and all automated checks pass. The only non-PASS check is Acceptance Criteria (WARN): criterion 4 — fullsend.md lists the Service Account's required Jira permissions (Browse Projects, Add Comments, Edit Own Comments; the diff also documents Edit Issues) with their purpose — is satisfied directly by the diff. Criteria 1, 2, 3 and 5 require live runtime/Jira evidence recorded on TC-7313 (the recorded mypermissions response, a green verify-pr re-run whose job log shows Posted report to Jira, the unchanged sticky-comment ID/timestamps, and the linked admin request). That evidence lives on the Jira task and is outside the PR diff, so it cannot be confirmed from this verification's inputs — a human reviewer should confirm it is attached to TC-7313 before merging. No code change requests were raised and no sub-tasks were created.

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.13.10.