Part of #10365 (the owner's added item): Mason spent a whole run on a 404 that was the private-app door refusing a signed-out probe.
Done:
[ ] A run on a from-app issue in a private app gets a read-only grant scoped to that one app that expires with the run; the brief names how to use it.
[ ] The brief says plainly when the app is private, so a signed-out 404 is never mistaken for the bug.
[ ] Tests: the grant opens the app's pages (GET only) during the run, is refused for another app and for any mutation, and is refused after the run ends.
Part of #10365 (the owner's added item): Mason spent a whole run on a 404 that was the private-app door refusing a signed-out probe.
Done:
from-appissue in a private app gets a read-only grant scoped to that one app that expires with the run; the brief names how to use it.Files: src/crew/brief.ts, src/apps/contain.ts, test/private_app_grant.test.ts