fix(tool): chart only this repo — the workflow token can't read siblings

README.md

@@ -243,7 +243,7 @@ different band is worth a great deal — see
 
 ## Star history
 
-<img src="docs/star-history.svg" alt="Star history for edge, protocol and analytics" width="760">
+<img src="docs/star-history.svg" alt="Star history for OpenStrap/edge" width="760">
 
 That cliff in mid-July is [Hackaday](https://hackaday.com/2026/07/15/making-a-locked-down-wearable-work-without-a-subscription/)
 and [Adafruit](https://blog.adafruit.com/2026/07/15/openstrap-edge-makes-a-whoop-4-0-band-useful-without-a-subscription)
@@ -253,7 +253,9 @@ covering it on the same day.
 ([workflow](.github/workflows/star-history.yml)) rather than embedded from
 star-history.com or starchart.cc — the first refuses these repos outright, the
 second rate-limits, and neither should be making a request from a page about
-keeping your data to yourself.</sub>
+keeping your data to yourself. Charts this repo only: a workflow's built-in token
+can't read sibling repos. Set `STAR_HISTORY_REPOS` with a cross-repo PAT to add
+them.</sub>
 
 ## Support the work
 

docs/index.html

@@ -150,7 +150,7 @@ <h2>How it&rsquo;s put together</h2>
 
     <section class="growth">
       <h2>Where it&rsquo;s got to</h2>
-      <img src="star-history.svg" alt="Star history for edge, protocol and analytics"
+      <img src="star-history.svg" alt="Star history for OpenStrap/edge"
            width="760" loading="lazy">
       <p class="fineprint">
         The cliff in mid-July is Hackaday and Adafruit covering it on the same day.

tool/gen_star_history.py

@@ -25,7 +25,21 @@
 import sys
 from datetime import datetime, timezone
 
-REPOS = ["OpenStrap/edge", "OpenStrap/protocol", "OpenStrap/analytics"]
+# Which repos to plot. Defaults to edge alone, and that default is load-bearing:
+# a workflow's built-in GITHUB_TOKEN is scoped to its OWN repository, so reading
+# OpenStrap/protocol from a job running in OpenStrap/edge returns
+# 403 "Resource not accessible by integration". Charting siblings needs a PAT
+# with read access to them, so it's opt-in rather than a default that fails:
+#
+#   STAR_HISTORY_REPOS="OpenStrap/edge,OpenStrap/protocol" python3 tool/gen_star_history.py
+#
+# Keep whatever CI uses identical to what you run locally. If the repo set
+# differs between the two, the committed SVG flip-flops and the workflow commits
+# a revision every week — the churn the fail-closed/no-change guards exist to
+# prevent.
+REPOS = [r.strip() for r in
+         os.environ.get("STAR_HISTORY_REPOS", "OpenStrap/edge").split(",")
+         if r.strip()]
 OUT = "docs/star-history.svg"
 
 W, H = 760, 300