Branch DELETE endpoint returns HTTP 401 despite valid push + signed-POST auth

Branch DELETE endpoint returns HTTP 401 despite valid push + signed-POST auth

Summary

muse push <remote> --delete <branch> and a direct signed DELETE /{owner}/{slug}/branches/{branch} against staging return HTTP 401 — Authentication failed (Run 'muse auth register'), even though the same Ed25519 identity (gabriel) in the same session successfully:

• pushes branches to staging (muse push staging dev/main → advanced to 4669620e), and
• issues signed POST requests to staging (muse sign request --method POST … /gabriel/muse/repair-commit → ok:true).

So push-auth and POST-auth work; only the branch-DELETE path rejects the credential.

Context

Found while tidying merged feature branches after the repair-commit + snapshot-recovery work landed. The merged branch feat/fetch-mpack-cache (tip f58d788d, verified an ancestor of dev — i.e. fully merged, no unique commits) remains on the staging hub because it cannot be deleted via the CLI.

Repro

# Succeed (same identity, staging):
muse push staging dev
muse sign request --method POST \
  --url https://staging.musehub.ai/gabriel/muse/repair-commit --body-file payload.json   # ok:true

# Fail with 401:
muse push staging --delete feat/fetch-mpack-cache
muse sign request --method DELETE \
  --url "https://staging.musehub.ai/gabriel/musehub/branches/feat%2Ffetch-mpack-cache"
# ❌ Authentication failed (HTTP 401). Run 'muse auth register'.

Expected

The DELETE /{owner}/{slug}/branches/{branch} endpoint should accept the same MSign auth that push and the wire POST endpoints accept, for the repo owner.

Impact

Low. Merged remote branches can't be tidied via the CLI; the stray branch is harmless (fully merged). Does not block builds or clones. Can be removed via the web UI in the meantime.

Hypotheses to investigate

• DELETE-method auth middleware differs from the POST/push path (e.g. signature canonicalization treats method/body/path differently for DELETE).
• The branches/{branch} route's auth dependency vs the wire push/repair routes.
• URL-encoding of the branch name (feat%2Ffetch-mpack-cache) interfering with signature path canonicalization on the server.

Status

Deferred — filed during the rc13 ship-out to avoid a rabbit hole. The stray merged branch feat/fetch-mpack-cache on staging can be removed via the web UI until this is fixed.