The label taxonomy is correct in git and stale in every org: the converge needs a token no agent has, and its own drift detector is wired into nothing #983

New issue

Open

opened 2026-08-29 05:27:39 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-29 05:27:39 +00:00

Owner

Filed by Portia (director seat), 2026-08-29, after Kai observed that the role slugs on the labels are wrong again. The "again" is the important word: this is a recurrence, and the mechanism that makes it recur is visible in this repository.

The declared file is correct

config/forgejo-label-taxonomy.yaml declares exactly the Core Roster v2 seats, verified against the roster:

role/advocate   role/science    role/frontend   role/gamedev
role/platform   role/sysadmin   role/director   role/human

Seven seats plus role/human. Nothing missing, nothing extra. The file is not the problem.

Live is stale, observed rather than inferred

From issue payloads read in the coilyco-flight-deck org today:

role/eval on agent-proxy #111, #125, #128, #129, #131. Retired. renames maps it to role/science.
role/qa on agent-proxy #107. Retired, and absent from labels: on purpose.
role/platform id 382, live description "requires work from the Developer Platform Engineer seat". Declared description is "requires work from the Platform Engineer seat".
role/platform id 373 in coilyco-bridge, same wrong description.

So at least two retired slugs are still live and being applied, and at least one declared description has never been driven onto the live label.

Why it recurs, which is the actual defect

Two independent breaks, and either alone would cause this.

1. Nothing can apply the converge. The sync's own docstring:

REQUIRES AN ORG OWNER TOKEN to write. Forgejo answers every /orgs/{org}/labels write with 403 "Must be an organization owner", and the coilyco-ops bot is a member rather than an owner on all three orgs, so it cannot run an apply.

Kai's 2026-08-29 grant moved coilyco-ops to repository admin, which does not help: org label writes need org ownership. So no agent seat can converge the taxonomy, ever, and the file advances in git while the world does not.

2. Nothing detects that it has not been applied. just forgejo-label-taxonomy-check exists, exits non-zero on divergence, and is read-only. The justfile comment says so plainly: "Exit non-zero when any org diverges from the declared Forgejo label taxonomy. Reads only."

It is wired into nothing. Not .forgejo/workflows/ (seven workflows, none calls it), not .pre-commit-config.yaml. Grepped both.

The detector for this exact condition is already written and not connected. That is why it is "again" rather than "still": the file gets corrected, the correction never lands, nothing goes red, and agents keep labelling from the stale live vocabulary until a human notices by eye.

The class

This belongs in coilysiren/inbox#484. It is a control that is present, correct, reviewed, version-controlled, and binds nothing — with its own conformance check sitting one line of CI away from working. Every property that makes a control trustworthy is satisfied except the one that matters.

It is also the second half of a pattern this repository already fixed once. The sync exists precisely because "a label change was an API call with no diff, no review, and no commit," which is how role/* drifted last time. Authority moved into git and the drift moved with it: now the declared value is right and unenforced instead of wrong and enforced.

Fix, two separable pieces

Immediate, and it needs Kai because it needs an org owner token:

just forgejo-label-taxonomy-dry-run     # read-only, safe, shows the plan
just forgejo-label-taxonomy             # applies

Renames are edits in place, so role/eval → role/science carries every issue currently holding it and costs no per-issue work. role/qa and role/exec will be reported undeclared, left alone and need their issues rehomed before an operator removes them, per agent-compose#342.

Durable, and it is the half that stops the recurrence: wire just forgejo-label-taxonomy-check into CI in this repository. It reads only, needs no owner token, and already exits non-zero. A scheduled run catches drift introduced outside this repo; a run on pull requests catches a taxonomy edit that has not been applied.

Without the second piece the first one buys a few weeks and then this issue gets filed a third time.

Not in scope

coilysiren/inbox's 19 repository-level labels. It is a user account, absent from orgs:, and the sync touches no user or repo endpoint. Tracked at agentic-os#1377.
state/ambient, minted imperatively and undeclared. Tracked at agentic-os#1380, and it should be added to this taxonomy in the same pass that runs the converge.

Refs coilysiren/inbox#484, agent-compose#342, agentic-os#1377, #1380

Filed by Portia (director seat), 2026-08-29, after Kai observed that the role slugs on the labels are wrong **again**. The "again" is the important word: this is a recurrence, and the mechanism that makes it recur is visible in this repository. ## The declared file is correct `config/forgejo-label-taxonomy.yaml` declares exactly the Core Roster v2 seats, verified against the roster: ``` role/advocate role/science role/frontend role/gamedev role/platform role/sysadmin role/director role/human ``` Seven seats plus `role/human`. Nothing missing, nothing extra. **The file is not the problem.** ## Live is stale, observed rather than inferred From issue payloads read in the `coilyco-flight-deck` org today: * **`role/eval`** on `agent-proxy` #111, #125, #128, #129, #131. Retired. `renames` maps it to `role/science`. * **`role/qa`** on `agent-proxy` #107. Retired, and absent from `labels:` on purpose. * **`role/platform`** id 382, live description *"requires work from the Developer Platform Engineer seat"*. Declared description is *"requires work from the Platform Engineer seat"*. * **`role/platform`** id 373 in `coilyco-bridge`, same wrong description. So at least two retired slugs are still live and being applied, and at least one declared description has never been driven onto the live label. ## Why it recurs, which is the actual defect **Two independent breaks, and either alone would cause this.** **1. Nothing can apply the converge.** The sync's own docstring: > REQUIRES AN ORG OWNER TOKEN to write. Forgejo answers every `/orgs/{org}/labels` write with 403 "Must be an organization owner", and the coilyco-ops bot is a member rather than an owner on all three orgs, so it cannot run an apply. Kai's 2026-08-29 grant moved `coilyco-ops` to **repository** admin, which does not help: org label writes need org **ownership**. So no agent seat can converge the taxonomy, ever, and the file advances in git while the world does not. **2. Nothing detects that it has not been applied.** `just forgejo-label-taxonomy-check` exists, exits non-zero on divergence, and is read-only. The justfile comment says so plainly: *"Exit non-zero when any org diverges from the declared Forgejo label taxonomy. Reads only."* It is wired into **nothing**. Not `.forgejo/workflows/` (seven workflows, none calls it), not `.pre-commit-config.yaml`. Grepped both. **The detector for this exact condition is already written and not connected.** That is why it is "again" rather than "still": the file gets corrected, the correction never lands, nothing goes red, and agents keep labelling from the stale live vocabulary until a human notices by eye. ## The class This belongs in `coilysiren/inbox#484`. It is a control that is **present, correct, reviewed, version-controlled, and binds nothing** — with its own conformance check sitting one line of CI away from working. Every property that makes a control trustworthy is satisfied except the one that matters. It is also the second half of a pattern this repository already fixed once. The sync exists precisely because *"a label change was an API call with no diff, no review, and no commit,"* which is how `role/*` drifted last time. Authority moved into git and the drift moved with it: now the declared value is right and unenforced instead of wrong and enforced. ## Fix, two separable pieces **Immediate, and it needs Kai** because it needs an org owner token: ``` just forgejo-label-taxonomy-dry-run # read-only, safe, shows the plan just forgejo-label-taxonomy # applies ``` Renames are edits in place, so `role/eval` → `role/science` carries every issue currently holding it and costs no per-issue work. `role/qa` and `role/exec` will be reported `undeclared, left alone` and need their issues rehomed before an operator removes them, per `agent-compose#342`. **Durable, and it is the half that stops the recurrence:** wire `just forgejo-label-taxonomy-check` into CI in this repository. It reads only, needs no owner token, and already exits non-zero. A scheduled run catches drift introduced outside this repo; a run on pull requests catches a taxonomy edit that has not been applied. Without the second piece the first one buys a few weeks and then this issue gets filed a third time. ## Not in scope * `coilysiren/inbox`'s 19 repository-level labels. It is a user account, absent from `orgs:`, and the sync touches no user or repo endpoint. Tracked at `agentic-os#1377`. * `state/ambient`, minted imperatively and undeclared. Tracked at `agentic-os#1380`, and it should be added to this taxonomy in the same pass that runs the converge. Refs `coilysiren/inbox#484`, `agent-compose#342`, `agentic-os#1377`, `#1380`

coilyco-ops added the

labels

2026-08-29 05:27:39 +00:00

coilyco-ops added this to the Credentials and access milestone

2026-08-29 06:09:50 +00:00