Commit Graph

2 Commits

Author SHA1 Message Date
Paul O'Reilly
ea7c11265b fix(repo-readonly): own read-only deploy key; workflow-script drops write-capable gitea-ssh/v1
repo-readonly/v1 now declares write_targets: [], an ssh_hosts alias and its
own secrets_required (account platform-readonly.space:platform, a read-only
Gitea deploy key), and stages the key before cloning. workflow-script/v1 no
longer layers gitea-ssh/v1, so script nodes cannot push. Invariants updated:
credential layers in the composite must declare write_targets: [].

Bug 45a48685-23e9-4605-af1f-d93306108cef

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF
2026-10-02 20:09:30 +13:00
Paul O'Reilly
4b41236e26 feat(harness): repo-readonly/v1 + gitea-ssh layer in workflow-script/v1; agent_repo on test-validate/frozen-fixture-emit (WF-COMP-34, bug 3bee78fa/a3ba44bc) 2026-10-02 16:18:21 +13:00