Finish coilyco-ops fleet-wide org repo-create grant (403 persisted) #382

New issue

Open

opened 2026-06-19 08:34:14 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-06-19 08:34:14 +00:00

Member

What

scripts/grant-coilyco-ops-org-repo-create.sh (committed locally as b481334, not pushed) was meant to grant the coilyco-ops bot repo-create rights fleet-wide so it can use the landed ward ops forgejo org-repo create verb (ward#218). When run, the bot still got 403 "Given user is not allowed to create repository in organization", and the run produced no visible output, so the grant did not take.

The two target repos (coilyco-flight-deck/agent-proxy, coilyco-bridge/agentic-os-hardware) were created in the UI as a workaround, so this is not blocking - it is the bot-self-service capability left to finish.

Why it matters

The org-repo verb is landed and correct (dry-run resolves to POST /orgs/{org}/repos). The only missing piece is the bot's org-level permission, so automated repo creation works without a human in the loop.

To do

Re-run capturing output: bash scripts/grant-coilyco-ops-org-repo-create.sh 2>&1 | tee /tmp/grant.log and inspect where it fails.
Likely suspects: the coily ops aws ssm admin-PAT read not resolving in the run env, or a Forgejo nuance where can_create_org_repo on a permission: read team does not grant creation (may need permission: write, or the org-level member-repo-creation setting, or the bot added to Owners).
Confirm the fix by creating a throwaway repo with the verb (no admin needed), then delete it.
Push b481334 (or the fixed version) to canonical once validated.

Context

Verb: coilyco-flight-deck/ward#218 (landed, commit 2e450af).
Mission tracking: coilysiren/inbox#118.
The script is least-trust by design (a dedicated automation-repo-create team, can_create_org_repo + read on existing repos).

## What `scripts/grant-coilyco-ops-org-repo-create.sh` (committed locally as b481334, not pushed) was meant to grant the `coilyco-ops` bot repo-create rights fleet-wide so it can use the landed `ward ops forgejo org-repo create` verb (ward#218). When run, the bot still got `403 "Given user is not allowed to create repository in organization"`, and the run produced no visible output, so the grant did not take. The two target repos (`coilyco-flight-deck/agent-proxy`, `coilyco-bridge/agentic-os-hardware`) were created in the UI as a workaround, so this is not blocking - it is the bot-self-service capability left to finish. ## Why it matters The org-repo verb is landed and correct (dry-run resolves to `POST /orgs/{org}/repos`). The only missing piece is the bot's org-level permission, so automated repo creation works without a human in the loop. ## To do - Re-run capturing output: `bash scripts/grant-coilyco-ops-org-repo-create.sh 2>&1 | tee /tmp/grant.log` and inspect where it fails. - Likely suspects: the `coily ops aws ssm` admin-PAT read not resolving in the run env, or a Forgejo nuance where `can_create_org_repo` on a `permission: read` team does not grant creation (may need `permission: write`, or the org-level member-repo-creation setting, or the bot added to Owners). - Confirm the fix by creating a throwaway repo with the verb (no admin needed), then delete it. - Push b481334 (or the fixed version) to canonical once validated. ## Context - Verb: coilyco-flight-deck/ward#218 (landed, commit 2e450af). - Mission tracking: coilysiren/inbox#118. - The script is least-trust by design (a dedicated `automation-repo-create` team, `can_create_org_repo` + read on existing repos).

coilyco-ops added the

interactive

labels

2026-06-24 05:38:25 +00:00

coilyco-ops commented

2026-06-24 05:38:26 +00:00

Author

Member

Triage: P2 / interactive - coilyco-ops org repo-create 403; needs an admin grant a human controls.

(goose-style pass; claude as the judgment engine, applied 2026-06-23)

**Triage:** `P2` / `interactive` - coilyco-ops org repo-create 403; needs an admin grant a human controls. (goose-style pass; claude as the judgment engine, applied 2026-06-23)

coilyco-ops added

consult

and removed

interactive

labels

2026-07-10 09:00:05 +00:00