PR State:
merged
PR:
#50
Commit:
637398f92dc2e343188661eba9f377cfe89606f1
[FIX] viin_ai_ops_brain: sudo Brain reads in approval-rationale evidence write
The 'Generate Approval Rationale' button is callable by any user with write on
the proposal (no group on the view) and writes an internal audit page under sudo.
But the Brain-config reads on that path ran as the calling user: the rationale
template content_html, the evidence vault auto_approve flag, and the originating
viin.ai.trace business id. A non-Brain (or non-author) user hit AccessError on
the vault/template, and the T5 trace attribution silently degraded to the
no-trace sentinel under the trace own-records rule. Read all three under sudo
(consistent with the already-sudo'd page + link create) so evidence is written
with full-fidelity attribution regardless of who triggers it. Adds a red-before-
green test: a non-author non-manager trigger records the REAL trace_id.
Branch:
17.0