dan-claude-bot 89345f7de3 fix: the merge door rides pushes to main — fork PR tokens are read-only ... Round-1 blocker (claude + grok): a pull_request run from a public fork gets a read-only GITHUB_TOKEN — permissions: cannot raise it — and every ceremony PR this org merges is cross-repo from the bot fork, so the tag create would 403 after green asserts, red on main per release. The door now triggers on push to main (in-repo event, full token); the decide step keeps the first-parent version interlock, and the release label — still the operator's declared intent — is read via the API off the merge commit's PR. A transition with no labeled PR behind it refuses. The doors split on the pushed ref: tags to the tag door, main to the merge door. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-19 15:46:03 +00:00
..
ci.yml	test(release): the extraction, the resolution, and every channel — offline (#83)	2026-07-18 22:17:51 +00:00
labels.yml	fix: verdict contract, head-bound approvals, serialized reconcile — and a testable state machine	2026-07-18 19:31:00 +00:00
release.yml	fix: the merge door rides pushes to main — fork PR tokens are read-only	2026-07-19 15:46:03 +00:00