Consumer rule: a change the kit needs is a PR or an issue, filed with the organisation's restricted issue token #17

New issue

Open

opened 2026-11-03 11:55:10 +00:00 by seeds-agent · 0 comments

seeds-agent commented

2026-11-03 11:55:10 +00:00

Collaborator

Why

Every infrastructure session that consumes the kit will meet a gap in it. Today the consumer rules give one route only: rule 7 of templates/consumer/AGENTS.naming.md says "propose a PR on infra-conventions". That route fits a ready patch, such as a missing type. It does not fit a convention question, a stale document, or a measurement owed to the kit. Those are issues. Until now, no consumer identity could file one.

seeds-infra has had that identity since 2026-11-03. Measured against Forgejo 15.0.8:

the agent holds a SECOND token, write:issue, restricted to the repositories it depends on (agent_issue_repositories, default shared/infra-conventions);
an invalid issue body answers 422 here, and 404 on a repository outside the list, even one the agent collaborates on;
#13 to #16 were filed with it.

The details are in seeds-infra stacks/forge/agent_token.tf and scripts/seeds help issuetoken.

Proposal

templates/consumer/AGENTS.naming.md, rule 7 or a new rule. A change the kit needs is either a PR (a ready patch: type, case, make check) or an ISSUE (a question, a gap, a measurement owed). An issue is filed with the organisation's issue token, never with a push token. The agent files it and stops: the maintainer triages.
The adoption guide (adoption/HANDOFF.md, and per consumer) gains a step: each consumer organisation provisions an agent issue token restricted to its dependencies, where its own secrets live.
- A token's scopes cannot be edited, so it is a separate token.
- A write:issue token without a repository list reaches everything the account reaches.

Example

The home node session finds that proxmox_virtual_environment_acme_account is not in the registry and cannot write the patch. It files: "type missing: proxmox_virtual_environment_acme_account, used by units/personal/shared/identity". The token cannot push, and cannot reach perso/home-node-infra itself.

Done when

The rule and the adoption step are in a tagged version, and a second consumer (home-node-infra) has filed an issue through its own token.

Filed for a later grouped pass over the kit's open tickets.

## Why Every infrastructure session that consumes the kit will meet a gap in it. Today the consumer rules give one route only: rule 7 of `templates/consumer/AGENTS.naming.md` says "propose a PR on `infra-conventions`". That route fits a ready patch, such as a missing type. It does not fit a convention question, a stale document, or a measurement owed to the kit. Those are issues. Until now, no consumer identity could file one. seeds-infra has had that identity since 2026-11-03. Measured against Forgejo 15.0.8: - the agent holds a SECOND token, `write:issue`, restricted to the repositories it depends on (`agent_issue_repositories`, default `shared/infra-conventions`); - an invalid issue body answers 422 here, and 404 on a repository outside the list, even one the agent collaborates on; - #13 to #16 were filed with it. The details are in seeds-infra `stacks/forge/agent_token.tf` and `scripts/seeds help issuetoken`. ## Proposal 1. **`templates/consumer/AGENTS.naming.md`**, rule 7 or a new rule. A change the kit needs is either a PR (a ready patch: type, case, `make check`) or an ISSUE (a question, a gap, a measurement owed). An issue is filed with the organisation's issue token, never with a push token. The agent files it and stops: the maintainer triages. 2. **The adoption guide** (`adoption/HANDOFF.md`, and per consumer) gains a step: each consumer organisation provisions an agent issue token restricted to its dependencies, where its own secrets live. - A token's scopes cannot be edited, so it is a separate token. - A `write:issue` token without a repository list reaches everything the account reaches. ## Example The home node session finds that `proxmox_virtual_environment_acme_account` is not in the registry and cannot write the patch. It files: "type missing: proxmox_virtual_environment_acme_account, used by units/personal/shared/identity". The token cannot push, and cannot reach `perso/home-node-infra` itself. ## Done when The rule and the adoption step are in a tagged version, and a second consumer (home-node-infra) has filed an issue through its own token. --- Filed for a later grouped pass over the kit's open tickets.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

shared/infra-conventions#17

No description provided.

Rows
Columns