True, though that wouldn't restrict malicious actors from being able to edit via the API if they wanted to (as documented e.g. at https://we.phorge.it/book/phorge/article/forms/#use-case-security-issues:~:text=regardless%20of,Conduit%20API).

Another idea might be to restrict what forms you can use to edit. I think you could allow claiming a task that way while disallowing some other edits.

note to self: one thing is that this would appear to prevent non-members of Task-Editors from claiming tasks as well (which might in turn mean that new developers then couldn’t assign a task to themselves)

(this _test2 account is not currently in the #pseudo-trusted-contributors project)

this is a test batch edit for no reason in particular

(that move was a test of https://phabricator.wikimedia.org/T393268)

(added that subtask to match https://phabricator.wikimedia.org/T404570#11200732

so it seems like creating a subtask with the 'open' status doesn't send a notification/transaction to the parent task, but any other status might do? T193#1801

huh, so if i set the status to stalled when creating the task, *then* it generates the notif in the parent task? T193#1786

.....no, it doesn't :(