Verified current defect
- Organization secrets (
/orgs/ContextualWisdomLab/actions/secrets): BYTEZ_API_KEY, CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN, CODECOV_TOKEN, NOEMA_GITHUB_APP_PRIVATE_KEY, NVIDIA_NIM_API_KEY, NVIDIA_NIM_API_KEY_SUB, OPENAI_API_KEY, OPENROUTER_API_KEY, PIPY_TOKEN, PIPY_USERNAME. Both PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN are absent.
- Repository secrets on
ContextualWisdomLab/.github: empty list.
- Live failure evidence: run
32931633195 (2026-08-26T04:49Z, schedule event) failed in ~19 seconds with
##[error]PR_REVIEW_MERGE_TOKEN is required; neither the reviewer credential nor repository-scoped GITHUB_TOKEN is accepted.
in job coordinate / step Coordinate one bounded fleet pass.
- Identical fast failures appear across schedule-triggered fleet passes on 2026-08-26 between 02:39Z and 04:49Z.
Impact
Every scheduled organization fleet pass fails closed before performing any review/merge coordination, so only event-driven scheduler runs work, and those rely on the OIDC OpenCode app-token exchange fallback. This concentrates all review throughput on one path and contributes to the central Actions backlog observed on 2026-08-26 (02:44Z-05:20Z), which in turn delays every current-head AI review and ruleset-gated merge in consumer repositories such as OriginWeave.
Required remediation (owner action)
- Create a fine-grained PAT (or GitHub App installation token broker) with
contents:write, pull_requests:write, checks:read, and actions:write limited to the consumer repositories.
- Register it as an organization secret named
PR_REVIEW_MERGE_TOKEN (or as a repository secret on .github).
- Re-run a scheduled fleet pass and verify it completes past the credential gate; keep fail-closed behavior for genuinely absent credentials.
No workflow weakening is requested: the credential requirement itself is correct; the missing secret is the defect.
Verified current defect
/orgs/ContextualWisdomLab/actions/secrets):BYTEZ_API_KEY,CLOUDFLARE_ACCOUNT_ID,CLOUDFLARE_API_TOKEN,CODECOV_TOKEN,NOEMA_GITHUB_APP_PRIVATE_KEY,NVIDIA_NIM_API_KEY,NVIDIA_NIM_API_KEY_SUB,OPENAI_API_KEY,OPENROUTER_API_KEY,PIPY_TOKEN,PIPY_USERNAME. BothPR_REVIEW_MERGE_TOKENandOPENCODE_APPROVE_TOKENare absent.ContextualWisdomLab/.github: empty list.32931633195(2026-08-26T04:49Z, schedule event) failed in ~19 seconds with##[error]PR_REVIEW_MERGE_TOKEN is required; neither the reviewer credential nor repository-scoped GITHUB_TOKEN is accepted.in job
coordinate/ stepCoordinate one bounded fleet pass.Impact
Every scheduled organization fleet pass fails closed before performing any review/merge coordination, so only event-driven scheduler runs work, and those rely on the OIDC OpenCode app-token exchange fallback. This concentrates all review throughput on one path and contributes to the central Actions backlog observed on 2026-08-26 (02:44Z-05:20Z), which in turn delays every current-head AI review and ruleset-gated merge in consumer repositories such as OriginWeave.
Required remediation (owner action)
contents:write,pull_requests:write,checks:read, andactions:writelimited to the consumer repositories.PR_REVIEW_MERGE_TOKEN(or as a repository secret on.github).No workflow weakening is requested: the credential requirement itself is correct; the missing secret is the defect.