From 1c4e4ce9506ad787b07d6e52485cacef36b7f92b Mon Sep 17 00:00:00 2001 From: Felix Faerber Date: Sun, 5 Jul 2026 16:40:01 +0300 Subject: [PATCH] docs: README reflects per-agent SELF_TOKEN model The secret table still described AGENT_TOKEN as primary and TOKEN_* as optional "falls back to the bot". The per-agent-token refactor inverted that: each agent's own TOKEN_* is primary (selected into SELF_TOKEN), AGENT_TOKEN is now only the fallback for repos without per-agent tokens. Document TOKEN_OPS, the SELF_TOKEN selection, and that TOKEN_QA needs write:repository to merge. Co-Authored-By: Claude Opus 4.8 (1M context) --- README.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index d361f23..aad52b0 100644 --- a/README.md +++ b/README.md @@ -76,11 +76,15 @@ points `$SCRIPTS` at it. Keep the workflow and its scripts moving together on `m |--------|-----| | `ANTHROPIC_API_KEY` | `@lead` (and `@pm`/`@senior`/`@qa` if on Claude) | | `OLLAMA_URL`, `OLLAMA_CLOUD_API_KEY` | local ornith / Ollama Cloud (gemma4, kimi-k2.7-code, glm-5.2, minimax-m3) | -| `AGENT_TOKEN` | PAT (issue/repository/organization/misc read+write, cross-repo) — posts the delegation comment that fires the next agent **and** powers the `gitea-api` skill (read/write issues, PRs, comments, labels, and Actions runs/logs across any repo). Do not re-narrow its scopes without also removing the `gitea-api` skill. | -| `TOKEN_PM`,`TOKEN_SENIOR`,`TOKEN_JUNIOR`,`TOKEN_LEAD`,`TOKEN_QA` | optional — post/commit as each agent's own Gitea user (falls back to the bot) | +| `TOKEN_PM`,`TOKEN_SENIOR`,`TOKEN_JUNIOR`,`TOKEN_LEAD`,`TOKEN_QA` | **primary** — each agent's own Gitea-user PAT. The running agent gets *only its own* token (as `SELF_TOKEN`) so it posts, commits, comments, and (for `@qa` autopilot) merges as itself, and its `gitea-api` skill acts with its own scopes. `TOKEN_QA` needs `write:repository` to merge. | +| `TOKEN_OPS` | `@ops` only — the admin PAT behind the `gitea-admin` skill (create orgs/users/repos, manage labels & secrets, mint scoped tokens). Injected into the agent process only when the agent is `@ops`. | +| `AGENT_TOKEN` | **fallback** — an admin PAT used only where per-agent `TOKEN_*` aren't configured (e.g. an un-migrated consuming repo). Covers the two things the built-in `GITEA_TOKEN` can't do: post the delegation/autopilot comment that *fires the next run*, and merge a PR so the push *triggers downstream deploys*. Where per-agent tokens exist, each agent uses its own instead. | -`GITEA_TOKEN` is auto-provided. Tip: set these once at the **org** level so every repo inherits -them via `secrets: inherit`. +Each agent authenticates as **itself**: the Run-agent step selects that agent's `TOKEN_*` into +`SELF_TOKEN` (never another agent's), falling back to `AGENT_TOKEN` only when its own token is unset. +`GITEA_TOKEN` is auto-provided (used for reads, and as the reply identity only when an agent has no +`TOKEN_*` of its own). Tip: set these once at the **org** level so every repo inherits them via +`secrets: inherit`. ## Also add to each consuming repo