Removes the last Anthropic-model usage from the agent registry.
XAI_API_KEY was already provisioned as an org secret; wire it into
the run-agent step and update every doc/comment that referenced
ANTHROPIC_API_KEY or claude-opus-4-8.
- publish.sh: resolve_prs matches ai/issue-N AND ai/issue-N-<slug> split branches
(exact-only silently stalled DELEGATE:@qa and autopilot MERGE_PR on slugged
work); qa hand-off lists all open PRs; autopilot refuses to merge multi-PR
issues (drops the label, hands to the human) — merging one of several open
PRs is half a change deployed. Retro's state=all resolve matches slugs too.
- fetch-thread.sh: paginate and keep the NEWEST 100 comments — a bare limit=100
kept the OLDEST page and dropped recent decisions on long threads.
- route.sh: word-boundary mention matching ("@internal" no longer routes to
@intern); a comment with no real agent mention now SKIPS gracefully
(mode=skip outputs + step guards in agent.yml) instead of a red run.
- run-agent.sh: LEARNINGS.md cap is line-aware and keeps the NEWEST entries
(retros append at the bottom; the old head -c cut the latest lessons first).
- agents.json/README: @pm gemma4 -> minimax-m3 — the retro rule demands an
investigating PM, and gemma4 posted 0 tool calls on every run; minimax is the
model @qa demonstrably uses tools with.
- agent.yml: document the PR-thread concurrency-group caveat.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fixes from a full repo review:
- fetch-thread.sh: attribute every comment to its REAL author (@pm/@qa/… —
agents post as their own users now); the old "🤖 @name line at the top" hint
pointed at headers we removed, leaving every teammate comment anonymous. Also
strip the hidden loop-prevention marker from bodies (prompt noise).
- agent.yml: per-issue concurrency group (queued, no cancel) — two quick
comments on one issue no longer race the same ai/issue-N branch.
- rescue-pr.sh: after opening a rescue PR, hand it back into the flow with an
unmarked @pm trigger (the pm→qa choreography previously stalled silently on
any rescued run); drop the old "🤖 **@name**" header style; add ops to the
token case; mark the status note with the hidden marker.
- README: token table said "@qa merges / TOKEN_QA needs write:repository" —
inverted since the PM-orchestrated flow (@pm merges, autopilot only; @qa is
read-only). Updated the agent table (descs, node1-ssh moved to homelab) and
added a "How a task flows" section.
- agents.json: pm/qa descs now describe the orchestrator/reviewer roles (these
feed the roster prompt agents route by).
- NEW ci.yml: bash -n + shellcheck(-S error) on every script, YAML-parse on
every workflow, agents.json schema check — the ${x:-{}} brace bug would have
been caught here before it shipped.
- install-opencode.sh: pin opencode (default 1.17.13, override via
OPENCODE_VERSION) — a breaking release no longer takes down every agent.
- build-activity-log.sh: ollama/ollama-cloud models are subscription-billed
(no $/token exists) — label the footer "subscription" instead of a
misleading $0.0000; metered (anthropic) models keep the real dollar cost.
- route.sh: document that mention-priority is list-order and load-bearing for
the flow's trigger comments.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A consuming repo can now add repo-specific skills under .gitea/agent-skills/<name>/
(SKILL.md + skill.json + optional setup.sh); the framework installs the ones
allowed for the running agent. This keeps deploy-target / infra specifics in the
repo they belong to instead of hardcoded in the shared workflow.
- install-caller-skills.sh: scans the caller workspace, installs each skill whose
skill.json `agents` list includes the running agent, runs its optional setup.sh
with all inherited secrets available as $SECRETS_JSON (toJSON(secrets) — so a
caller's setup can read repo-specific secret names the framework can't know),
and merges the allowed skills into the permission.skill allow-list.
- agent.yml: replace the hardcoded node1-ssh step with the generic caller-skills
step (passes NAME, WORKSPACE, SECRETS_JSON).
- Remove the built-in node1-ssh skill: delete skill-node1-ssh.sh, drop "node1-ssh"
from agents.json (senior/lead). The homelab repo now owns that skill.
- run-agent.sh: note caller-provided skills aren't in the roster (route them via
the caller's AGENTS.md).
toJSON(secrets) verified supported on this Gitea (1.27) via an isolated probe.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A comment-mode operator agent (opus) for administering Gitea itself from issues in gitea/ops:
create orgs/users/repos, manage labels & Actions secrets, and mint least-privilege per-user tokens.
- agents.json: new @ops role (comment-mode, skill gitea-admin, confirms before destructive ops).
- skill-gitea-admin.sh: SKILL.md documenting org/user/repo/label/secret ops + the create-user →
mint-scoped-token → store-as-secret flow (never printing tokens). Gated on NAME=ops so the admin
how-to is written ONLY for @ops; permission.skill also denies it to other agents.
- agent.yml: wire the skill step (uses AGENT_TOKEN — an admin PAT during bootstrap).
Bootstrap note: AGENT_TOKEN is admin for now, so every agent's process technically holds an admin
credential (skill-scoping hides the doc, not the env var). Once @ops is minting scoped per-user
tokens, narrow AGENT_TOKEN and inject a dedicated admin token only for @ops.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Extract the agent registry to a shared agents.json and have both
route.sh (agent → model) and install-opencode.sh (ollama-cloud provider
models map) derive from it, so the two lists can no longer drift.
route.sh now copies agents.json to /tmp/agents.json instead of an inline
heredoc. install-opencode.sh builds the ollama-cloud map by
collecting every registry model with the prefix and
stripping it — non-ollama-cloud models (e.g. @lead's anthropic/claude-opus,
the local ornith:35b) are excluded by construction.
Resolves#31.
junior
Felix Faerber
senior