docs: close GitHub credential gate
This commit is contained in:
kiri committed
1 parent
1996411136
commit
de068d173c
1 file changed
+28
-17
@@ -57,9 +57,12 @@ not make it the global next step while another pilot can still progress.
|
||||
checks passed; all test processes and containers were then stopped. The
|
||||
retired workstation tools are absent and `rclone` is live. Herdr preserves
|
||||
its pane across detach and reattach. The data-science contract and a real
|
||||
read-only PR review pilot pass locally.
|
||||
- Next: activate the skill-directory and remote-boundary fix, then continue the
|
||||
independent empirical, credential, hardware, and real-task gates below.
|
||||
read-only PR review pilot pass locally. The broad GitHub credentials are gone;
|
||||
a mode-0600 fine-grained token now passes repository, issue, pull-request,
|
||||
Actions, and organization Project reads with no stored fallback credential.
|
||||
- Next: activate the skill-directory, remote-boundary, and GitHub-token loader
|
||||
changes, then use the first real Monday ticket to test the native
|
||||
Project-to-issue-to-local-branch workflow.
|
||||
|
||||
## Progress
|
||||
|
||||
@@ -69,7 +72,7 @@ not make it the global next step while another pilot can still progress.
|
||||
| Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
|
||||
| Repository contracts and workbench | Waiting externally | Five clean-checkout contracts and read-only Kubernetes pass; API, database, report, S3, and secret inputs remain externally gated |
|
||||
| Desktop navigation and interaction | Active | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; Outlook and two-output checks remain |
|
||||
| Agent workflow | Waiting for user | Herdr and read-only PR review pass; the corrected skill owner is built and awaits user activation, while a real Monday ticket and Project read credential remain external |
|
||||
| Agent workflow | Waiting for user | Herdr, read-only PR review, the fine-grained credential, and organization Projects pass; the corrected skill owner and token loader await user activation, while a real Monday ticket remains external |
|
||||
| Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
|
||||
| PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials |
|
||||
| Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
|
||||
@@ -92,6 +95,7 @@ not make it the global next step while another pilot can still progress.
|
||||
| NixOS configuration | `chore/workflow-system` | `d085512` | Advance from Walker to the agent pilot |
|
||||
| NixOS configuration | `chore/workflow-system` | `ee64a7b` | Retire superseded tools and prepare the S3 pilot |
|
||||
| NixOS configuration | `chore/workflow-system` | `2ef74d4` | Expose the NixOS skill as a supported directory link |
|
||||
| NixOS configuration | `chore/workflow-system` | `1996411` | Load the machine-local read-only GitHub credential |
|
||||
| `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
|
||||
| `yookr-dashboard-new` | `feat/gogv2` | `8e6e4bc` | Establish its project contract and native lifecycle |
|
||||
| `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
|
||||
@@ -108,7 +112,8 @@ step to the user only when it blocks the current task.
|
||||
|
||||
- Activate the latest Zenith build with `cd ~/.config/nixos && nh os switch`.
|
||||
This changes `nixos-maintainer` to a supported directory link and installs the
|
||||
durable remote-read-only agent instruction; only the user may run it.
|
||||
durable remote-read-only agent instruction plus the runtime GitHub token
|
||||
loader; only the user may run it.
|
||||
- Run the bounded Pinta trial using a recent real edit: clipboard/open,
|
||||
selection, crop/resize/canvas, text/drawing/shapes, layers/transparency,
|
||||
basic adjustments, and PNG/JPEG export. Tell the agent whether it fully
|
||||
@@ -132,10 +137,6 @@ step to the user only when it blocks the current task.
|
||||
- Make one Fossify recording on the Pixel and let Syncthing transfer it. Do not
|
||||
rename or move it manually; the agent must first observe the real write and
|
||||
settlement behavior before implementing Orion automation.
|
||||
- Before inspecting organization Project boards, replace the broad classic
|
||||
GitHub token with a fine-grained token limited to required repository reads
|
||||
and organization Projects read. The current credential can write and lacks
|
||||
Project access; do not widen it with `gh auth refresh`.
|
||||
- Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
|
||||
mode-0600 machine-local environment file on each workstation before removing
|
||||
the static user-config header.
|
||||
@@ -169,6 +170,9 @@ Polaris:
|
||||
autoconnect, and add the required legacy cipher:
|
||||
`nmcli connection modify yookr-vpn connection.id "Yookr VPN" connection.autoconnect no +vpn.data data-ciphers=AES-256-CBC`.
|
||||
5. Connect with `nmcli connection up "Yookr VPN"`.
|
||||
6. Create `~/.config/yookr/github-read-only.token` without a trailing newline,
|
||||
containing the fine-grained `yookrdev` token, and set its mode to 0600. Open
|
||||
a new Zsh after activation and verify `gh project list --owner yookrdev`.
|
||||
|
||||
## Decisions and discoveries
|
||||
|
||||
@@ -338,14 +342,21 @@ Polaris:
|
||||
least-privileged credentials exist.
|
||||
- GitHub remote state is absolutely read-only; local files, commits, fetches,
|
||||
clones, and worktrees remain available. The generated global agent guidance
|
||||
records this boundary. The active `jellespr` credential has broad classic
|
||||
`repo` scope and the sampled repositories report admin access, so the boundary
|
||||
is behavioral until it is replaced by a fine-grained read-only token.
|
||||
- The organization exposes 219 open issues and five open pull requests. Recent
|
||||
dashboard user stories and an existing Project-to-issue-to-cross-repository-PR
|
||||
chain show that the intended ticket workflow already has useful raw material;
|
||||
organization Projects remain unreadable because the token lacks
|
||||
`read:project`. Add no dashboard or wrapper before Monday usage exposes a gap.
|
||||
records this boundary. The former broad `jellespr` credential and stale,
|
||||
invalid `kirigar` credential are removed locally. The only working API route
|
||||
is now a fine-grained `github_pat_` token in the mode-0600 machine-local
|
||||
`~/.config/yookr/github-read-only.token`; Zsh loads it as the documented
|
||||
`GH_TOKEN` interface without copying the secret into Nix or a password-manager
|
||||
adapter.
|
||||
- The fine-grained token passes identity, repository contents, issues, pull
|
||||
requests, Actions, and organization Projects reads with no stored fallback.
|
||||
The organization exposes 219 open issues, five open pull requests, and 60
|
||||
Projects. Project 52 is a 38-issue high-level overview; Project 8 is an
|
||||
82-item software backlog with the native ticket fields needed for the planned
|
||||
workflow. Its only three items assigned to `jellespr` are Done, while the two
|
||||
open issues assigned across the organization are not present there. Keep the
|
||||
native `gh` and Git workflow and wait for the first real Monday ticket; add no
|
||||
dashboard or wrapper before usage exposes a concrete gap.
|
||||
- The PR gate used `prediction-api#125`: native `gh pr view`, `checks`, and
|
||||
`diff` reads work, while an isolated exact-base reconstruction passes patch,
|
||||
whitespace, and Rust formatting checks and leaves no durable checkout. The PR
|
||||
|
||||
Reference in new issue
Block a user