coilyco-flight-deck/infrastructure

Watch

Finish coilyco-ops fleet-wide org repo-create grant (403 persisted) #382

New issue

Closed

opened 2026-06-19 08:34:14 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-06-19 08:34:14 +00:00

Owner

What

scripts/grant-coilyco-ops-org-repo-create.sh (committed locally as b481334, not pushed) was meant to grant the coilyco-ops bot repo-create rights fleet-wide so it can use the landed ward ops forgejo org-repo create verb (ward#218). When run, the bot still got 403 "Given user is not allowed to create repository in organization", and the run produced no visible output, so the grant did not take.

The two target repos (coilyco-flight-deck/agent-proxy, coilyco-bridge/agentic-os-hardware) were created in the UI as a workaround, so this is not blocking - it is the bot-self-service capability left to finish.

Why it matters

The org-repo verb is landed and correct (dry-run resolves to POST /orgs/{org}/repos). The only missing piece is the bot's org-level permission, so automated repo creation works without a human in the loop.

To do

Re-run capturing output: bash scripts/grant-coilyco-ops-org-repo-create.sh 2>&1 | tee /tmp/grant.log and inspect where it fails.
Likely suspects: the coily ops aws ssm admin-PAT read not resolving in the run env, or a Forgejo nuance where can_create_org_repo on a permission: read team does not grant creation (may need permission: write, or the org-level member-repo-creation setting, or the bot added to Owners).
Confirm the fix by creating a throwaway repo with the verb (no admin needed), then delete it.
Push b481334 (or the fixed version) to canonical once validated.

Context

Verb: coilyco-flight-deck/ward#218 (landed, commit 2e450af).
Mission tracking: coilysiren/inbox#118.
The script is least-trust by design (a dedicated automation-repo-create team, can_create_org_repo + read on existing repos).

## What `scripts/grant-coilyco-ops-org-repo-create.sh` (committed locally as b481334, not pushed) was meant to grant the `coilyco-ops` bot repo-create rights fleet-wide so it can use the landed `ward ops forgejo org-repo create` verb (ward#218). When run, the bot still got `403 "Given user is not allowed to create repository in organization"`, and the run produced no visible output, so the grant did not take. The two target repos (`coilyco-flight-deck/agent-proxy`, `coilyco-bridge/agentic-os-hardware`) were created in the UI as a workaround, so this is not blocking - it is the bot-self-service capability left to finish. ## Why it matters The org-repo verb is landed and correct (dry-run resolves to `POST /orgs/{org}/repos`). The only missing piece is the bot's org-level permission, so automated repo creation works without a human in the loop. ## To do - Re-run capturing output: `bash scripts/grant-coilyco-ops-org-repo-create.sh 2>&1 | tee /tmp/grant.log` and inspect where it fails. - Likely suspects: the `coily ops aws ssm` admin-PAT read not resolving in the run env, or a Forgejo nuance where `can_create_org_repo` on a `permission: read` team does not grant creation (may need `permission: write`, or the org-level member-repo-creation setting, or the bot added to Owners). - Confirm the fix by creating a throwaway repo with the verb (no admin needed), then delete it. - Push b481334 (or the fixed version) to canonical once validated. ## Context - Verb: coilyco-flight-deck/ward#218 (landed, commit 2e450af). - Mission tracking: coilysiren/inbox#118. - The script is least-trust by design (a dedicated `automation-repo-create` team, `can_create_org_repo` + read on existing repos).

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-06-24 05:38:25 +00:00

coilyco-ops commented

2026-06-24 05:38:26 +00:00

Author

Owner

Triage: P2 / interactive - coilyco-ops org repo-create 403; needs an admin grant a human controls.

(goose-style pass; claude as the judgment engine, applied 2026-06-23)

**Triage:** `P2` / `interactive` - coilyco-ops org repo-create 403; needs an admin grant a human controls. (goose-style pass; claude as the judgment engine, applied 2026-06-23)

coilyco-ops added

and removed

labels

2026-07-10 09:00:05 +00:00

coilyco-ops removed the

autonomy

async-consult

label

2026-07-16 01:08:11 +00:00

coilyco-ops added the

autonomy

live-collab

label

2026-07-29 03:45:49 +00:00

coilyco-ops added the

role/sysadmin

label

2026-08-25 08:02:34 +00:00

coilyco-ops commented

2026-08-27 03:19:34 +00:00

Author

Owner

Closed in the 2026-08-26 backlog burn-down (coilyco-bridge/agentic-os-kai#901).

Closing. The issue records its own workaround, repos get created in the UI when needed, and no automated flow has been blocked on bot repo-create since this was filed.

This was priority/P3, the default tier that unsure and unscored issues land in, so it had never been positively judged worth keeping. The 2026-08-26 burn-down ranked the whole P3 pool and cut the bottom. Closed here means not on the list, not wrong or worthless.

If this is live work, reopen it. The whole set is recoverable with state:closed label:burndown-2026-08.

Closed in the 2026-08-26 backlog burn-down (coilyco-bridge/agentic-os-kai#901). Closing. The issue records its own workaround, repos get created in the UI when needed, and no automated flow has been blocked on bot repo-create since this was filed. This was `priority/P3`, the default tier that unsure and unscored issues land in, so it had never been positively judged worth keeping. The 2026-08-26 burn-down ranked the whole P3 pool and cut the bottom. Closed here means not on the list, not wrong or worthless. If this is live work, reopen it. The whole set is recoverable with `state:closed label:burndown-2026-08`.

coilyco-ops

2026-08-27 03:19:36 +00:00

closed this issue
added the
burndown-2026-08
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#382

No description provided.

Rows
Columns