🤖 Generated by the Agentic Engineer
Historical evidence
On 2026-08-07, the repository drift check (#140) could not read the settings it compared. Two live runs:
| Run |
Token scope |
Outcome |
| 10:46Z |
metadata: read |
aborted on the first repository — the live repository object has no "allow_auto_merge" field |
| 10:53Z |
metadata: read + administration: read |
token step failed — 422 The permissions requested are not granted to this installation |
The initial diagnosis attributed the missing REST fields to insufficient permission. The first run after the permission grant disproved that explanation: token creation succeeded, but REST still omitted allow_auto_merge. The other affected settings are allow_squash_merge, allow_merge_commit, allow_rebase_merge, allow_update_branch, delete_branch_on_merge, and web_commit_signoff_required. The repaired read path now completes the comparison with a metadata-only App token.
At that time, the workflow App lacked this permission, so requesting it failed before the check ran.
Impact
These seven fields are exactly where the check earned its keep: its first run found that
world-at-ruin allows merge commits and rebase merges though the config declares squash-only
(#141) — a divergence in the merge policy the release pipeline depends on, which nothing else had
surfaced. Before this repair, omitted REST settings prevented a complete observation of that class of drift.
The remaining declared fields (visibility, description, homepageUrl, topics, archived,
hasIssues, …) are readable with metadata alone, so a narrowed check would still catch the drift
#123 was originally opened about. That narrowing is deliberately not what this proposes: silently
checking fewer fields than the config declares is the failure mode the whole check exists to prevent.
Permission granted
The existing workflow App and its installation now have Repository permissions → Administration: Read-only. The workflow can now mint its requested read-only token; the grant does not make REST expose every declared setting. The repaired workflow restricts its token to the repositories declared in deploy/ and requests only metadata read. A complete actual-App run proved that administrative read is unnecessary for this read path. No new App, key, or secret is needed; the existing App and installation grants were not changed by this probe.
Delivered check and separate drift repair
PR #187 merged at a8ccdb3bd1cfd15098d37a4aaa0f84422a3f853a, restoring the full check and its daily schedule. Its actual metadata-only App run completed the comparison and found the two existing World at Ruin merge-policy drifts tracked in #141. The fallback identifies the same repository and visibility, preserves existing REST values, and rejects missing or partial data. The daily 05:17 UTC schedule is restored on main. Repairing the actual drift through its declarative owner is agent-owned work.
Acceptance criteria
Current verification (2026-09-08)
Personal account verification is complete. Fresh GitHub API reads confirm administration: read on the existing botantler-1 App (1025824) and its active devantler-tech installation (62540905). The installation update was accepted during the interactive session; its existing repository selection and other granted permissions are unchanged.
The first dispatch after the grant, run 34209548857, ran the existing main commit as workflow_dispatch. App token creation succeeded, but comparison exited 2 because REST omitted allow_auto_merge. This is an incomplete observation, not a completed drift report. The repaired branch then completed the entire comparison in run 34211600039.
A further metadata-only App run, 34211964769, completed the same whole comparison at commit 6a2927fef59ff091e565c317a54bc71967c76113. Token creation and revocation succeeded; the comparison reached its terminal drift summary with exit 1 and exactly the two known #141 findings, rather than aborting with exit 2. This proves the original personal-grant blocker had an engineering alternative.
The post-merge main run, 34214240250, completed at 10:13:23Z on the exact merged commit. It again created and revoked the metadata-only App token successfully and reached the terminal comparison summary with only the two known #141 findings. The merged tree and workflow match the reviewed source. The daily trigger is restored; the first timer-triggered execution has not yet occurred.
All acceptance criteria for this check are complete. No personal action remains. The separate declarative drift repair stays tracked in #141.
Historical evidence
On 2026-08-07, the repository drift check (#140) could not read the settings it compared. Two live runs:
metadata: readthe live repository object has no "allow_auto_merge" fieldmetadata: read+administration: read422 The permissions requested are not granted to this installationThe initial diagnosis attributed the missing REST fields to insufficient permission. The first run after the permission grant disproved that explanation: token creation succeeded, but REST still omitted
allow_auto_merge. The other affected settings areallow_squash_merge,allow_merge_commit,allow_rebase_merge,allow_update_branch,delete_branch_on_merge, andweb_commit_signoff_required. The repaired read path now completes the comparison with a metadata-only App token.At that time, the workflow App lacked this permission, so requesting it failed before the check ran.
Impact
These seven fields are exactly where the check earned its keep: its first run found that
world-at-ruinallows merge commits and rebase merges though the config declares squash-only(#141) — a divergence in the merge policy the release pipeline depends on, which nothing else had
surfaced. Before this repair, omitted REST settings prevented a complete observation of that class of drift.
The remaining declared fields (
visibility,description,homepageUrl,topics,archived,hasIssues, …) are readable with metadata alone, so a narrowed check would still catch the drift#123 was originally opened about. That narrowing is deliberately not what this proposes: silently
checking fewer fields than the config declares is the failure mode the whole check exists to prevent.
Permission granted
The existing workflow App and its installation now have Repository permissions → Administration: Read-only. The workflow can now mint its requested read-only token; the grant does not make REST expose every declared setting. The repaired workflow restricts its token to the repositories declared in
deploy/and requests only metadata read. A complete actual-App run proved that administrative read is unnecessary for this read path. No new App, key, or secret is needed; the existing App and installation grants were not changed by this probe.Delivered check and separate drift repair
PR #187 merged at
a8ccdb3bd1cfd15098d37a4aaa0f84422a3f853a, restoring the full check and its daily schedule. Its actual metadata-only App run completed the comparison and found the two existing World at Ruin merge-policy drifts tracked in #141. The fallback identifies the same repository and visibility, preserves existing REST values, and rejects missing or partial data. The daily 05:17 UTC schedule is restored on main. Repairing the actual drift through its declarative owner is agent-owned work.Acceptance criteria
Administration: Read-only.workflow_dispatchrun ofrepository-drift-check.yamlcompletes and reportsDRIFTlines(or none) rather than aborting on a missing field.
schedule:trigger is restored.Current verification (2026-09-08)
Personal account verification is complete. Fresh GitHub API reads confirm
administration: readon the existingbotantler-1App (1025824) and its activedevantler-techinstallation (62540905). The installation update was accepted during the interactive session; its existing repository selection and other granted permissions are unchanged.The first dispatch after the grant, run 34209548857, ran the existing main commit as
workflow_dispatch. App token creation succeeded, but comparison exited 2 because REST omittedallow_auto_merge. This is an incomplete observation, not a completed drift report. The repaired branch then completed the entire comparison in run 34211600039.A further metadata-only App run, 34211964769, completed the same whole comparison at commit
6a2927fef59ff091e565c317a54bc71967c76113. Token creation and revocation succeeded; the comparison reached its terminal drift summary with exit 1 and exactly the two known #141 findings, rather than aborting with exit 2. This proves the original personal-grant blocker had an engineering alternative.The post-merge main run, 34214240250, completed at 10:13:23Z on the exact merged commit. It again created and revoked the metadata-only App token successfully and reached the terminal comparison summary with only the two known #141 findings. The merged tree and workflow match the reviewed source. The daily trigger is restored; the first timer-triggered execution has not yet occurred.
All acceptance criteria for this check are complete. No personal action remains. The separate declarative drift repair stays tracked in #141.