skill-gitea-api.sh now introspects each agent's own PAT (AGENT_TOKEN +
TOKEN_PM/SENIOR/JUNIOR/LEAD/QA) via GET /api/v1/token — a Gitea 1.27+
self-introspection endpoint (token-in, scopes-out, no password) — and bakes a
live, always-accurate 'who can do what' matrix into SKILL.md. Every agent that
loads gitea-api sees every teammate's real scopes; no hand-maintained table to
drift when scopes rotate. Falls back to a static note on <1.27 or unset tokens.
agent.yml passes GITHUB_SERVER_URL + the per-agent TOKEN_* secrets into the
gitea-api skill step so the script can introspect them. run-agent.sh adds a
roster note pointing agents to the matrix for capability-based routing.
Least-privilege gating (plan point #3) was already done in issue #22 via
agents.json skills arrays + install-opencode.sh permission.skill scoping, so
no redundant case gates are added here.
senior
a885142e30