Repository navigation
spec(claw): github_surface -- every GitHub API surface, its .t27 value, the narrow token it mints (Closes #10277) - #10280
Merged
Merged
Conversation
…e, and the narrow token it mints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gHashTag
enabled auto-merge (squash)
October 18, 2026 07:24
Contributor
gHashTag
added a commit
that referenced
this pull request
Oct 18, 2026
…requests:read, contents:read (Refs #10268) The App holds write on about 40 permissions across every gHashTag installation; an unscoped token minted from a t27 branch would carry secrets, workflows and administration write. The three scopes are the check-run, pr-files and spec-read rows of specs/claw/github_surface.t27 (#10280). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 18, 2026
Merged
gHashTag
added a commit
that referenced
this pull request
Oct 18, 2026
… request through the TRI CLAW App (Closes #10268) (#10283) * feat(claw): claw/t27f -- the seal-gated T27F check on every .t27 pull request through the TRI CLAW App (Closes #10268) - specs/claw/t27f_gate.t27 (+ zig-only pins): scope = changed .t27 plus direct importers, judged by `t27c seal --verify`, decision reuses hot.t27; unsealed neutral, stale/vacuous/unreadable failure, malformed input fails closed. MODE_T27F in specs/claw/service.t27. - gen/c/claw/t27f_gate.c: its gen-c lowering; spec-guards.yml now regenerates both claw C files and diffs them. - gate-topology.yml: a claw-t27f job on a new 10-minute schedule and on workflow_dispatch; the existing job skips the schedule; concurrency keyed by event. The job mints the App token (secret CLAW_APP_PRIVATE_KEY, variable CLAW_APP_ID) and exits 0 with a notice when either is absent. It only fetches, runs the cosign-verified t27o-v0.1.0 t27c and posts what the law prints. - specs/claw/gates.t27: gate-topology events gain schedule (67 workflows, 62/3/2 unchanged); gen/c/claw/gates.c regenerated. - docs/claw/README.md: the owner checklist. AGENTS.md section 8: pointers to what landed. - Own-language offset: scripts/gen_w389.py deleted (spent generator, no runtime refs). MAX_DEAD_TRI unchanged at 140. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * seals(claw): reseal gates/gates_pins/service and seal t27f_gate/t27f_gate_pins after #10250 (Refs #10268) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(claw): mint the claw/t27f App token scoped to checks:write, pull_requests:read, contents:read (Refs #10268) The App holds write on about 40 permissions across every gHashTag installation; an unscoped token minted from a t27 branch would carry secrets, workflows and administration write. The three scopes are the check-run, pr-files and spec-read rows of specs/claw/github_surface.t27 (#10280). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #10277
TRI CLAW now holds write on 40 repository permissions across every gHashTag repository (GET /apps/tri-claw, 2026-10-18T06:59:05Z). This spec records what each GitHub API surface is worth to
.t27, and the narrow token a job serving it may mint. The grant can stay wide; every token stays narrow.What lands:
specs/claw/github_surface.t27, 22 rows: surface, permission, level, status, endpoint, value.The law, as asserts:
over_grantedcounts the permissions no token will ever use: 9 without the owner's yes, 8 with it. That is exactly how far the owner can narrow the App.Railway lab: spec-status IMPLEMENTED; the per-spec report shows 10/10 pass, 0 FAIL, and none passing with zero runtime asserts. Lab file sha256
3eec162c...matches the branch.str_eqis reused fromclaw::recipes, anddupe_scan --likereports nothing new.Honest limit: the table says what each surface is for. It does not prove that a workflow passes the scope it names. Each planned row's own lane carries that.
🤖 Generated with Claude Code