docs(agents): the mirror block is live, and yesterday's clearance was wrong #17

Merged

jlxq0 merged 1 commit from docs/mirror-block-is-live into main

2026-08-27 03:12:37 +00:00

jlxq0 commented

2026-08-27 03:03:22 +00:00

Owner

The forge→GitHub push mirror is rejecting every push right now, and the AGENTS.md entry currently tells the next reader the opposite.

859399b (PR #16) edited .github/workflows/release.yml. push_mirrors at 2026-08-27T03:00:34Z:

! [remote rejected] main -> main (refusing to allow a Personal Access Token to
create or update workflow `.github/workflows/release.yml` without `workflow` scope)

	forge	github
`main`	`236f9a6`	`0e73d2f1`
tags	22	14

Four commits stranded. Only 859399b touches a workflow file; it takes main and every tag down with it, which is the documented behaviour.

The inference that was wrong was mine

Yesterday I recorded the block as "Observed clear on 2026-08-26" on three checks: matching shas, last_error empty, and 2023000 returning 200 from GitHub despite modifying .github/workflows/ci.yml. I wrote that a workflow-carrying push had therefore succeeded, so the scope was granted rather than the block dodged.

2023000 really does modify a workflow file and really is on GitHub. The conclusion still does not follow: a commit reaching GitHub says nothing about which credential put it there, or what scope that credential holds today. The three checks agreed with each other while answering a different question from the one asked.

last_error after your own workflow-touching push is the only thing that answers it, and it has to be read every time rather than concluded once. This change says that instead.

Not fixed here

Unblocking needs either the workflow scope granted to the mirror PAT, or the release.yml change removed from main. The first is a credential I do not hold; the second trades the GHCR-side ancestry gate away to unblock a mirror. Raised with Alan rather than decided here.

Docs only.

The forge→GitHub push mirror is **rejecting every push right now**, and the `AGENTS.md` entry currently tells the next reader the opposite. `859399b` (PR #16) edited `.github/workflows/release.yml`. `push_mirrors` at 2026-08-27T03:00:34Z: ``` ! [remote rejected] main -> main (refusing to allow a Personal Access Token to create or update workflow `.github/workflows/release.yml` without `workflow` scope) ``` | | forge | github | |---|---|---| | `main` | `236f9a6` | `0e73d2f1` | | tags | 22 | 14 | Four commits stranded. Only `859399b` touches a workflow file; it takes `main` and every tag down with it, which is the documented behaviour. ## The inference that was wrong was mine Yesterday I recorded the block as **"Observed clear on 2026-08-26"** on three checks: matching shas, `last_error` empty, and `2023000` returning 200 from GitHub despite modifying `.github/workflows/ci.yml`. I wrote that a workflow-carrying push had therefore succeeded, so the scope was granted rather than the block dodged. `2023000` really does modify a workflow file and really is on GitHub. The conclusion still does not follow: a commit reaching GitHub says nothing about which credential put it there, or what scope that credential holds today. The three checks agreed with each other while answering a different question from the one asked. `last_error` after your own workflow-touching push is the only thing that answers it, and it has to be read every time rather than concluded once. This change says that instead. ## Not fixed here Unblocking needs either the `workflow` scope granted to the mirror PAT, or the `release.yml` change removed from `main`. The first is a credential I do not hold; the second trades the GHCR-side ancestry gate away to unblock a mirror. Raised with Alan rather than decided here. Docs only.

jlxq0 added 1 commit

2026-08-27 03:03:22 +00:00

docs(agents): the mirror block is live, and yesterday's clearance was wrong

CI / tag-ancestry (pull_request) Successful in 5s

Details

CI / cargo (pull_request) Successful in 1m5s

Details

CI / docker (pull_request) Successful in 18s

Details

06d3e86652

859399b edited .github/workflows/release.yml and the mirror rejected the whole
push at 2026-08-27T03:00:34Z. Forge main is 236f9a6, GitHub main is 0e73d2f1,
four commits behind, 14 tags against 22.

Yesterday's note concluded the scope had been granted because 2023000 modifies
a workflow file and returns 200 from GitHub. That does not follow: a commit
reaching GitHub says nothing about which credential put it there or what scope
that credential holds today. Only last_error after your own workflow-touching
push answers it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>