# PR check-run permission reproduction

Use the same synthetic GitHub HTTP fixture on both revisions. It answers PR metadata,
aggregate SUCCESS status, and empty review/comment connections, while returning HTTP 200
with a FORBIDDEN GraphQL error at the individual check-context node. It removes contexts
when the query requests detailedChecks=false. No real GitHub credential is used.

1. Install each checkout with `vp i`.
2. Start the real web/server stack on fresh, isolated state with `T3CODE_DEV_SEED=0`,
   `GH_TOKEN=scenario-placeholder`, and `NODE_OPTIONS=--import=<github-fixture.mjs>`.
3. Create an empty git repository with origin `https://github.com/scenario/check-access.git`
   and register it through `node apps/server/src/bin.ts project add <repository> --title
   'Check access demo' --base-dir <isolated-home>`.
4. Pair the browser, wait for the app shell, and open `/pull-requests`.
5. Select PR 7, Restricted check-run access. On head expand Checks.
6. Capture the loaded result at 1280×800, light theme. Check two captures 500 ms apart
   for identical pixels before retaining each still.

The fixture replaces only server-side fetch requests to api.github.com. Server decoding,
permission-error handling, RPC, and web rendering execute normally. This establishes
behavior with a simulated upstream refusal, not actual fine-grained-PAT provisioning.

AI-assisted; verified with the tests and tools listed above.