[0.12] Give every agent full workspace and GitHub maintainer access

[adrian-lorenzo]

Goal

Give every configured agent full access to its workspace and full maintainer access to the repositories in its project.

Workspace access

All agents can use the shell, read and write the whole workspace volume, start processes, use network access, run Docker or Docker Compose, open the browser, and call installed development tools.

There are no analysis and builder sandbox variants. The runtime does not build command allowlists from the agent name or trigger. A scheduled audit and an interactive builder receive the same workspace capabilities.

GitHub access

The project's GitHub connection must support maintainer work across every connected repository. Agents can clone, create and update branches, commit, push, manage issues and comments, inspect or rerun checks, edit workflows, and open or update pull requests.

A credential helper issues short-lived tokens. Those tokens carry the full project capability. The helper must not reduce access according to agent name, model, prompt, or current action.

Branch protection and required checks remain GitHub controls. Facility does not add a receipt or delivery broker in front of normal git and gh use.

Boundaries that remain

An authorized user chooses which repositories belong to a project. A workspace cannot request credentials for another project or tenant. Credentials cannot be written to the durable volume, conversation, command output, or logs. Revocation should take effect without deleting the workspace.

These boundaries apply to the project connection. They do not create different permissions among agents in that project.

Acceptance criteria

• Every standard and custom agent receives the same runtime capabilities.
• The GitHub helper issues the same maintainer capability for every agent in a project.
• An agent can perform branch, commit, push, issue, comment, check, workflow, and pull request operations against a deterministic GitHub fake.
• The agent uses ordinary git and gh commands from the worktree.
• Expired and revoked credentials can be replaced without restarting the story.
• Credentials never appear in persisted files, messages, events, or logs.
• A request for another tenant, project, installation, or repository is denied.
• Malformed, expired, revoked, replayed, and cross-tenant requests have unit and integration coverage.
• A regression test fails if per-agent permission calculation returns.

Documentation

The setup guide must state plainly that connecting a repository gives every Facility agent maintainer-level control of that repository. It should also explain the remaining role of branch protection, review, and CI.