2 Commits

Author	SHA1	Message	Date
Paul O'Reilly	ea7c11265b	fix(repo-readonly): own read-only deploy key; workflow-script drops write-capable gitea-ssh/v1 ... repo-readonly/v1 now declares write_targets: [], an ssh_hosts alias and its own secrets_required (account platform-readonly.space:platform, a read-only Gitea deploy key), and stages the key before cloning. workflow-script/v1 no longer layers gitea-ssh/v1, so script nodes cannot push. Invariants updated: credential layers in the composite must declare write_targets: []. Bug 45a48685-23e9-4605-af1f-d93306108cef Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF	2026-10-02 20:09:30 +13:00
Paul O'Reilly	782eadb615	feat: STATE_TX_FROM_STATES on state-tx nodes; workflow-script composite invariant; refresh legacy-mount NOTE ... Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF	2026-10-01 17:02:29 +13:00