/goal /ultracode-workflows [SPINE-3] land credential-boundary germinate provisioning (rebase PR #18) + reconcile branch-protect divergence #23

New issue

Closed

opened 2026-07-01 02:03:41 +00:00 by plat · 1 comment

plat commented

2026-07-01 02:03:41 +00:00

Owner

Track/Wave: SPINE-3 · Wave M2 · Size M
Repos: mitosis, gitops
Depends on: SPINE-2

Why

Every germination TODAY provisions daughters WITHOUT the non-admin agent boundary (#16) — a client deploying now gets an admin-scoped agent by default. PR #18 wires it into germinate but is unmerged with a conflict.

Scope

Rebase PR #18 onto main; wire deploy-key + scoped MCP token + .forgejo/workflows/** branch-protection into germinate's post-Forgejo secrets phase (fork_postforgejo_secrets area of bin/lib.sh) so every germination provisions a non-admin builder agent by default. Reconcile the known divergence: germinate emits inert rule_name:"no-agent-workflows" while the dispatcher enforces rule_name:"**" — germinate must emit the ENFORCING rule.

Acceptance

A germinated (not hand-built) platform passes the #16 red-team checks: no PAT in the agent env, cross-tenant calls 403, and an agent push to .forgejo/workflows/** is rejected.

Notes

Seam A — after SPINE-2.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `SPINE-3` · Wave **M2** · Size **M** **Repos:** `mitosis`, `gitops` **Depends on:** SPINE-2 ## Why Every germination TODAY provisions daughters WITHOUT the non-admin agent boundary (#16) — a client deploying now gets an admin-scoped agent by default. PR #18 wires it into germinate but is unmerged with a conflict. ## Scope Rebase PR #18 onto `main`; wire deploy-key + scoped MCP token + `.forgejo/workflows/**` branch-protection into germinate's post-Forgejo secrets phase (`fork_postforgejo_secrets` area of bin/lib.sh) so every germination provisions a non-admin builder agent by default. Reconcile the known divergence: germinate emits inert `rule_name:"no-agent-workflows"` while the dispatcher enforces `rule_name:"**"` — germinate must emit the ENFORCING rule. ## Acceptance A germinated (not hand-built) platform passes the #16 red-team checks: no PAT in the agent env, cross-tenant calls 403, and an agent push to `.forgejo/workflows/**` is rejected. ## Notes **Seam A — after SPINE-2.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:41 +00:00

plat added the

roadmap

goal

horizon:mvp

labels

2026-07-01 02:03:41 +00:00

plat added a new dependency

2026-07-01 02:04:41 +00:00

#22 /goal /ultracode-workflows [SPINE-2] fix ci-builder cold-start KEDA/runner stall (#19) + validate seed refresh (#14 / PR #20)

plat added a new dependency

2026-07-01 02:04:42 +00:00

#27 /goal /ultracode-workflows [SPINE-4] re-establish a known-good baseline — germinate a fresh long-lived reference/staging platform from post-SPINE-2/3 main

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat commented

2026-07-01 04:22:37 +00:00

Author

Owner

DONE — merged + validated live. PR #18 rebased onto main (python3 #50 + refreshed seed #20 reconciled; seed blob took main) and merged. Verified on a fresh germination (valid8c, current stack): (1) protect_workflows is called from germinate:402 and emits the ENFORCING rule rule_name:"**" + protected_file_patterns:.forgejo/workflows/**;.gitea/...;.github/... — the inert no-agent-workflows divergence is reconciled with a documented rationale (Forgejo Actions can run a pull_request workflow from a feature branch, so main-only is insufficient). (2) germinate wires config.forgejoSsh→FORGEJO_SSH=forgejo-ssh.forgejo.svc.cluster.local:22 into the agents deploy (confirmed live) — the per-run deploy-key clone path; admin PLAT_TOKEN stays with the DISPATCHER only (the spawned build subprocess boundary is agents 0.7.3, already red-team GO). Germination healthy (mcp+agents Available, sovereign-sealed). Every germination now provisions a non-admin builder agent by default.

**DONE — merged + validated live.** PR #18 rebased onto main (python3 #50 + refreshed seed #20 reconciled; seed blob took main) and merged. Verified on a fresh germination (valid8c, current stack): (1) `protect_workflows` is called from germinate:402 and emits the ENFORCING rule `rule_name:"**"` + `protected_file_patterns:.forgejo/workflows/**;.gitea/...;.github/...` — the inert `no-agent-workflows` divergence is reconciled with a documented rationale (Forgejo Actions can run a pull_request workflow from a feature branch, so main-only is insufficient). (2) germinate wires `config.forgejoSsh`→`FORGEJO_SSH=forgejo-ssh.forgejo.svc.cluster.local:22` into the agents deploy (confirmed live) — the per-run deploy-key clone path; admin PLAT_TOKEN stays with the DISPATCHER only (the spawned build subprocess boundary is agents 0.7.3, already red-team GO). Germination healthy (mcp+agents Available, sovereign-sealed). Every germination now provisions a non-admin builder agent by default.

plat removed a dependency

2026-07-01 04:23:17 +00:00

#22 /goal /ultracode-workflows [SPINE-2] fix ci-builder cold-start KEDA/runner stall (#19) + validate seed refresh (#14 / PR #20)

plat closed this issue

2026-07-01 04:23:17 +00:00

plat referenced this issue

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47