agents: per-agent Gitea identity — each agent uses its own token #59

2026-07-05T15:21:15+02:00

ffaerber commented

2026-07-05 15:21:15 +02:00

Drop the shared AGENT_TOKEN as the primary credential. Each agent now acts as its own Gitea user (TOKEN_PM for @pm, TOKEN_OPS for @ops, …) for API calls, delegation/autopilot trigger comments, and PR merges.

What changed

agent.yml — the Run-agent step injects SELF_TOKEN, a ternary selecting the running agent's own token by name, falling back to AGENT_TOKEN for repos not yet migrated (e.g. homelab). Only that one token enters the agent process, so no agent can act as another. Skill-setup steps no longer carry a token (they only write docs).
Trigger gate — now trusts the agent roster (pm/junior/senior/lead/qa/ops) as comment authors, so an agent's own delegation/autopilot trigger comment (posted with its PAT, no 🤖 prefix) fires the next run. @ops added to the mention set.
publish.sh — TOK = agent identity (comments/replies); new TTOK = trigger/merge token (agent PAT, else AGENT_TOKEN fallback) for delegation, autopilot @qa triggers, and merges that must fire downstream deploys.
skill-gitea-api.sh / skill-gitea-admin.sh / run-agent.sh — token env → SELF_TOKEN.

Follow-ups (runtime, not in this PR)

Re-mint TOKEN_QA with write:repository so @qa autopilot can merge.
Add the agent bot users to the gitea org (write) + as homelab collaborators.
Keep AGENT_TOKEN as the fallback until homelab is migrated to per-agent tokens.

Drop the shared `AGENT_TOKEN` as the primary credential. Each agent now acts as **its own Gitea user** (`TOKEN_PM` for @pm, `TOKEN_OPS` for @ops, …) for API calls, delegation/autopilot trigger comments, and PR merges. ## What changed - **agent.yml** — the Run-agent step injects `SELF_TOKEN`, a ternary selecting the running agent's own token by name, falling back to `AGENT_TOKEN` for repos not yet migrated (e.g. homelab). Only that one token enters the agent process, so **no agent can act as another**. Skill-setup steps no longer carry a token (they only write docs). - **Trigger gate** — now trusts the agent roster (pm/junior/senior/lead/qa/ops) as comment authors, so an agent's own delegation/autopilot trigger comment (posted with its PAT, no 🤖 prefix) fires the next run. `@ops` added to the mention set. - **publish.sh** — `TOK` = agent identity (comments/replies); new `TTOK` = trigger/merge token (agent PAT, else `AGENT_TOKEN` fallback) for delegation, autopilot `@qa` triggers, and merges that must fire downstream deploys. - **skill-gitea-api.sh / skill-gitea-admin.sh / run-agent.sh** — token env → `SELF_TOKEN`. ## Follow-ups (runtime, not in this PR) - Re-mint `TOKEN_QA` with `write:repository` so @qa autopilot can merge. - Add the agent bot users to the `gitea` org (write) + as `homelab` collaborators. - Keep `AGENT_TOKEN` as the fallback until homelab is migrated to per-agent tokens.

ffaerber added 1 commit 2026-07-05 15:21:16 +02:00

agents: per-agent Gitea identity — each agent uses its own token 06f1924441

Drop the shared AGENT_TOKEN as the primary credential; every agent now acts
as its own Gitea user (TOKEN_PM for @pm, TOKEN_OPS for @ops, …) for API
calls, delegation/autopilot trigger comments, and PR merges.

- agent.yml: Run-agent step injects SELF_TOKEN — a ternary selecting the
  running agent's own token by name, falling back to AGENT_TOKEN for repos
  not yet migrated to per-agent tokens (e.g. homelab). Only that one token
  enters the agent process, so no agent can act as another. The gitea-api /
  gitea-admin skill-setup steps no longer carry a token (they only write docs).
- Gate: trust the agent roster (pm/junior/senior/lead/qa/ops) as comment
  authors so an agent's own delegation/autopilot trigger comment (posted with
  its PAT, no 🤖 prefix) fires the next run. @ops added to the mention set.
- publish.sh: TOK = agent identity (comments/replies); new TTOK = trigger/merge
  token (agent PAT, else AGENT_TOKEN fallback) for delegation, autopilot @qa
  triggers, and PR merges that must fire downstream workflows.
- skill-gitea-api.sh / skill-gitea-admin.sh / run-agent.sh: AGENT_TOKEN/
  TOKEN_OPS → SELF_TOKEN in the emitted skill docs and env contract.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ffaerber merged commit 738848304e into main

2026-07-05 15:33:55 +02:00

ffaerber deleted branch feat/per-agent-tokens

2026-07-05 15:33:55 +02:00

ffaerber referenced this pull request

2026-07-05 15:40:15 +02:00

docs: README reflects per-agent SELF_TOKEN model #62

ffaerber referenced this pull request

2026-07-05 15:51:23 +02:00

agents: remove shared AGENT_TOKEN — per-agent tokens only #63

Sign in to join this conversation.