fix: enforce VIP content boundary and PATCH updates

automation/anwarpy/runtime.py

@@ -126,7 +126,7 @@ class AgentApi:
         except HTTPError as error:
             return error.code, error.read(), error.headers.get("content-type", "")
         except (TimeoutError, URLError) as error:
-            if method in ("POST", "PUT"):
+            if method in ("POST", "PATCH"):
                 raise AmbiguousWrite(f"agent API {method} outcome is unknown") from error
             raise
 
@@ -176,7 +176,7 @@ class AgentApi:
         probe = self._probe(body)
         if probe:
             self.body_probes[slug] = probe
-        status, raw, _ = self._request("PUT", f"/api/agent/posts/{quote(slug)}", body)
+        status, raw, _ = self._request("PATCH", f"/api/agent/posts/{quote(slug)}", body)
         if status != 200:
             raise RuntimeError(f"agent API update failed ({status})")
         return self._decode(status, raw)

automation/anwarpy/test_publish_one.py

@@ -193,7 +193,7 @@ class PublisherTests(unittest.TestCase):
         self.assertEqual(api.create_calls, [])
         self.assertEqual(len(api.update_calls), 1)
 
-    def test_republish_puts_existing_slug_and_never_posts(self):
+    def test_republish_updates_existing_slug_and_never_posts(self):
         record = {
             "id": 7, "title": "Old", "slug": "existing-guide", "status": "published",
             "access": "vip", "category": "أدوات", "publishedAt": "2026-10-09T09:00:00Z",

automation/anwarpy/test_runtime.py

@@ -42,10 +42,12 @@ class FakeAgentApi(AgentApi):
     def __init__(self):
         super().__init__("test-key")
         self.responses = []
+        self.requests = []
         self.public = (200, b"page")
         self.rsc = (200, b"rsc")
 
     def _request(self, method, path, body=None, *, anonymous=False):
+        self.requests.append((method, path, body, anonymous))
         if self.responses:
             return self.responses.pop(0)
         return 200, b"{}", "application/json"
@@ -80,6 +82,12 @@ class RuntimeTests(unittest.TestCase):
         self.assertEqual(api.create(body)["slug"], "guide")
         self.assertEqual(api.body_probes["guide"], "distinctive protected body sentence")
 
+    def test_agent_api_updates_with_patch(self):
+        api = FakeAgentApi()
+        api.responses = [(200, json.dumps({"slug": "guide"}).encode(), "application/json")]
+        self.assertEqual(api.update("guide", {"publish": True})["slug"], "guide")
+        self.assertEqual(api.requests[0][0:2], ("PATCH", "/api/agent/posts/guide"))
+
     @patch("runtime.time.sleep", return_value=None)
     def test_vip_verification_rejects_body_leak(self, _sleep):
         api = FakeAgentApi()