registry-graph: give it a pinned identity too, and honour the assertion (#92) - #100
Merged
Merged
Conversation
…on (#92) The other half of what #87 fixed, on the job #92 predicted would fail. registry-graph's `sync` had all three defects org-defaults' `pin` had, still armed and untouched by #99: app: front-desk # carries no `contents` require: contents, pull_requests # asserts it... GH_TOKEN: steps.app-token.outputs.token || … # ...then ignores the verdict git push origin "$b" # 403 It has not fired only because it early-exits on "in sync". #92's words: it "reported success weekly for over a month without once exercising the grant", and "will fail the first time the registry actually changes". That is a green job that did nothing, which is the absence of evidence reported in the colour of evidence. Not shareable with `front-desk-pin`: a workflowRef pins ONE workflow, so each privileged caller needs its own entry. bounded-systems/infra adds `front-desk-registry`, pinned to this workflow. The token is now used only when the mint step actually succeeded. github.token holds contents:write here, so a scope gap still pushes the branch and only loses the PR — which this job already handles with a named annotation. Refs #92, #87
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The other half of what #87/#99 fixed — on the job #92 predicted would fail. Broker half: infra#176.
It has all three defects, still armed
#99 fixed
org-defaults.yml'spinjob and left this one exactly as it was:It hasn't fired only because it early-exits on
"in sync". That is #92's exact thesis, and it is worth quoting because it turned out to be right on the sibling job four times over:A green job that did nothing is the absence of evidence, reported in the colour of evidence.
Changes
app: front-desk-registry— its own pinned entry (infra#176). Not shareable withfront-desk-pin: aworkflowRefpins exactly one workflow, so each privileged caller needs its own entry. That constraint is worth noting for I2: exercise privileged identities on a schedule — a green job that did nothing is not evidence #92 itself — see below.github.tokenholdscontents: writein this job, so a scope gap still pushes the branch and loses only the PR — which this job already handles with a named annotation.A finding that bears on #92
Building this surfaced something about the probe's shape. Since a
workflowRefpins one workflow, a central probe workflow cannot mint any pinned identity — it would be a different ref, and the broker would refuse it. So "one scheduled probe per privileged identity" can't be a separate workflow that exercises them all; the exercise has to run from each pinned workflow itself (a scheduled no-op mode), or each identity needs a second entry pinned to the probe.I've written that up on #92 rather than building the version that cannot work.
Verification
workflows.test.mjs: 27 pass, including the column-0 block-scalar check. The YAML parses and the step wiring is confirmed (app: front-desk-registry, guardedGH_TOKEN).Not exercised end-to-end: this job only does real work when the registry changes. Same honest caveat as #99 — the mint is testable, the push is not, until it fires.
Generated by Claude Code