skill-gitea-api.sh now introspects each agent's own PAT (AGENT_TOKEN +
TOKEN_PM/SENIOR/JUNIOR/LEAD/QA) via GET /api/v1/token — a Gitea 1.27+
self-introspection endpoint (token-in, scopes-out, no password) — and bakes a
live, always-accurate 'who can do what' matrix into SKILL.md. Every agent that
loads gitea-api sees every teammate's real scopes; no hand-maintained table to
drift when scopes rotate. Falls back to a static note on <1.27 or unset tokens.
agent.yml passes GITHUB_SERVER_URL + the per-agent TOKEN_* secrets into the
gitea-api skill step so the script can introspect them. run-agent.sh adds a
roster note pointing agents to the matrix for capability-based routing.
Least-privilege gating (plan point #3) was already done in issue #22 via
agents.json skills arrays + install-opencode.sh permission.skill scoping, so
no redundant case gates are added here.
The homelab health-check test mis-routed a node1 inspection to @junior (skills: []), which cannot
reach node1 — only @senior/@lead hold node1-ssh. Root cause: the roster shown to agents listed
desc + vision but not skills, so @pm had no way to route by capability (despite a comment claiming
it could). Add each teammate's skill names to the roster line. Names only; the scoped how-to detail
stays hidden via permission.skill.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merge the activity-log comment into the main reply comment and merge the
sub-issues-created comment into the pm reply, so each agent run posts
exactly one comment (reply + tool calls & reasoning inline).
Stage the shared scripts into $RUNNER_TEMP and point $SCRIPTS there for every
step, so an agent that commits/deletes the in-tree .agents-workflow checkout no
longer destroys the scripts the post-agent steps run (issue #33). Scrub any
in-tree .agents-workflow artifact before publishing, and add a failure-safe
rescue step that opens a PR for pushed work when a run fails.
Extract the agent registry to a shared agents.json and have both
route.sh (agent → model) and install-opencode.sh (ollama-cloud provider
models map) derive from it, so the two lists can no longer drift.
route.sh now copies agents.json to /tmp/agents.json instead of an inline
heredoc. install-opencode.sh builds the ollama-cloud map by
collecting every registry model with the prefix and
stripping it — non-ollama-cloud models (e.g. @lead's anthropic/claude-opus,
the local ornith:35b) are excluded by construction.
Resolves#31.
The shared agent.yml is a reusable (workflow_call) workflow, so on Gitea
github.event_name evaluates to 'workflow_call' — not the original 'issues'/
'issue_comment'. route.sh branched on EVENT == "issues", so issue-opened runs
scanned the empty comment body and skipped the @pm fallback, exiting 1 with
"no known agent mentioned" (runs #393/#394). Comment runs were unaffected
because the @mention lives in $BODY.
Discriminate on the comment id (CID) instead, which IS reliably forwarded in
the event payload: empty => issue-opened (scan issue body, default @pm), set
=> comment (scan comment body). Also add .gitignore for .env.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rebased onto the per-agent skill-scoping change so PR #25 carries both:
- route.sh keeps the registry 'skills' allow-list and emits skills as a step output
- install-opencode.sh writes the permission.skill block (deny-all + allow listed)
Pure refactor otherwise: each step's shell moves to its own file, called via
bash "$SCRIPTS/<name>.sh". The two extracted SKILL.md bodies are byte-identical to
main; routing/config/publish behavior is unchanged. Because this is a reusable
workflow (workflow_call) the runtime checkout is the caller's repo, so agent.yml now
checks THIS repo out into .agents-workflow/ (pinned @main) and points $SCRIPTS there.
senior
ffaerber
lead