4 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	71df5dfa4e	The mesh's forge accounts all read every repository, and a build's fetch says the forge's own words ... mesh-catalog #495 gave read on every repository to the tools' account alone. The build modules fetch over ssh as nox-builder (the forge-account provider's builders account, ADR 0466 §3), so ace's and g14's fetch of jschoubben/car-hunter and jschoubben/snake still failed; the machines' agents (nox-agent, ADR 0410 §1) could not read them either. - gitea: readall.ts grants every account of one list, meshAccounts in tools-account.ts (mesh-tools, nox-builder, nox-agent; a Go test holds the two Go names to internal/forgeaccount's constants), on the same start pass, forge events and tools. gitea_unreadable_repos answers per account and names the accounts the forge does not hold yet; gitea_grant_read takes accounts as well as repositories. An absent account is asked nothing; the start pass runs again ten minutes apart until every account was there once. - mesh-build-go, mesh-build-node, mesh-build-image: pin mesh-sdk 84275cfc (fix/fetch-reads-all), whose forgekey.Said keeps git's words past the bare "error:" line: the mirror's line said only "git -C: error:". Their own git reasons (ls-files, ls-remote, rev-parse, repack) go through it too.	2026-10-26 15:21:21 +01:00
jschoubben	68dfca1057	Gate the token mint's main-rule write by keep-main-rules too ... The operator, 2026-10-23: "disable the gitea branch protection reset thing". setUpToolsAccount (run at every token mint) called ensureMainMerges regardless; it now does so only when the setting is true.	2026-10-23 15:57:44 +02:00
fix-forge-awg	7807135a1b	Main takes no push and only mesh-tools merges, set by setup and guarded (issue 948, ADR 0398 §2)	2026-10-16 21:28:43 +02:00
mesh-adminandClaude Opus 5.5	48f0662fde	Make the forge's tools act as an account of their own, not the administrator (issue 469, ADR 0365 clause 2) ... The tools' token reached everything the administrator may do, so their boundary rested on their own guards. The gitea module now makes a plain account, mesh-tools, with the admin login, gives it write on code, issues and pull requests of every novox repository through one team, and mints the tools' token for it; the admin's old token goes only after the new one is kept. The Go forge bundle sends that token, never the admin login. The forge shows protection rules only to a repository administrator, so every check reads a branch's protection from the branch. mesh-admin stays a ready author, so marks made before the move keep counting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 22:28:25 +00:00