fix(model-apps): never execute a mutating probe as a read

Caught by Copilot in review. `executeProbes` called `readOne` for every planned
probe without consulting `probe.mutating`, and `readOne` is the only operation it
performs. So with `--allow-mutations`, a `write`/`create`/`delete` probe was
exercised as a GET, the 200 came back, and `interpretOutcome` reported PASS.

That is a false pass on the privilege that matters most, on the exact path a
maker opts into specifically to test it -- and it contradicted what the script
header, AGENTS.md and the CHANGELOG all already claimed, which is that
`--allow-mutations` PLANS mutating probes without executing them. The docs were
right; the code was wrong.

Mutating probes now short-circuit before any IO and are reported `inconclusive`
with the reason, so they can never be counted as passes and never add round
trips. `planProbes` still includes them, because showing what WOULD be exercised
is the point of the flag; actually exercising them needs fixture creation and
cleanup, which is a separate design.

Three regression tests, red-green verified: disabling the guard fails all three,
including one asserting an all-mutating run reports zero passes so it cannot look
like success. 34 probe tests, 1514 total.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 42626da2-b66f-4162-acaa-b1127ef23d89

Author: akshay-viz

plugins/model-apps/scripts/lib/persona-probe.js

@@ -212,6 +212,21 @@ async function executeProbes(probes, io) {
   const principalCache = new Map();
 
   for (const probe of probes) {
+    // A mutating privilege cannot be proven by a read, and `readOne` is the only operation this
+    // executor performs. Running one anyway would report `write`/`create`/`delete` as PASS on the
+    // strength of a successful GET — a false pass on the privilege that matters most, and on the
+    // exact path a maker opts into with --allow-mutations. `planProbes` includes them so the report
+    // shows what WOULD be exercised; executing them needs fixture creation and cleanup, which is a
+    // separate design. Until then they are reported as proved-nothing, never as passes.
+    if (probe.mutating) {
+      findings.push({
+        probe,
+        result: 'inconclusive',
+        detail: `planned only — a ${probe.access} privilege cannot be proven by a read, and mutating probes are not executed`,
+      });
+      continue;
+    }
+
     if (!principalCache.has(probe.persona)) {
       principalCache.set(probe.persona, io.principalFor(probe.persona));
     }

plugins/model-apps/scripts/tests/persona-probe.test.js

@@ -322,3 +322,44 @@ test('principal resolver returns null when the persona declares no test user', a
   assert.strictEqual(resolve('Tech'), null);
   assert.strictEqual(resolve('Nobody'), null);
 });
+
+test('a mutating probe is NEVER executed as a read', async () => {
+  // Regression guard for a real review finding: executeProbes called readOne for every planned
+  // probe, so with --allow-mutations a `write` probe was exercised as a GET and a 200 was reported
+  // as PASS — a false pass on the privilege the maker specifically opted in to test.
+  const calls = [];
+  const probes = [
+    { persona: 'P', entity: 'co_workorder', access: 'write', expect: 'allow', mutating: true },
+    { persona: 'P', entity: 'co_workorder', access: 'read', expect: 'allow', mutating: false },
+  ];
+  const f = await executeProbes(probes, io({ readOne: async (set) => { calls.push(set); return { status: 200, rowCount: 1 }; } }));
+
+  assert.strictEqual(calls.length, 1, 'only the read probe may reach the wire');
+  assert.strictEqual(f[0].result, 'inconclusive', 'the write probe must not be a pass');
+  assert.match(f[0].detail, /cannot be proven by a read/);
+  assert.strictEqual(f[1].result, 'pass');
+});
+
+test('a mutating probe does not even resolve a principal or entity set', async () => {
+  // It short-circuits before any IO, so --allow-mutations cannot add round trips either.
+  let touched = 0;
+  const probes = [{ persona: 'P', entity: 'e', access: 'delete', expect: 'allow', mutating: true }];
+  const f = await executeProbes(probes, io({
+    principalFor: () => { touched++; return { header: 'MSCRMCallerID', value: 'u' }; },
+    entitySetName: async () => { touched++; return 'es'; },
+    readOne: async () => { touched++; return { status: 200, rowCount: 1 }; },
+  }));
+  assert.strictEqual(touched, 0, 'no IO for a probe that will not be executed');
+  assert.strictEqual(f[0].result, 'inconclusive');
+});
+
+test('summarize: an all-mutating run reports zero passes, not success', async () => {
+  const probes = [
+    { persona: 'P', entity: 'a', access: 'create', expect: 'allow', mutating: true },
+    { persona: 'P', entity: 'b', access: 'delete', expect: 'allow', mutating: true },
+  ];
+  const s = summarize(await executeProbes(probes, io()));
+  assert.strictEqual(s.counts.pass, 0);
+  assert.strictEqual(s.counts.inconclusive, 2);
+  assert.strictEqual(s.ok, true, 'still not a failure — but the caller can see nothing was proven');
+});