Summary

I reproduced two failing tests in src/gateway/openresponses-http.test.ts on origin/main.

Reproduction

pnpm test -- src/gateway/openresponses-http.test.ts src/gateway/server-chat.agent-events.test.ts

Failures

1. Unauthenticated POST to /v1/responses returns 200 instead of 403

   • src/gateway/openresponses-http.test.ts:241

2. Requested HTTP scopes appear to imply owner identity

   • senderIsOwner is true when the test expects false
   • src/gateway/openresponses-http.test.ts:747

Expected behavior

• HTTP requests without auth should be rejected with 403
• Requested HTTP scopes should not, by themselves, prove owner identity for owner-only tool access

Notes

Reproduced on origin/main.