dan-claude-bot 44717863a1 fix: the merge door rides pushes to main — fork PR tokens are read-only ... Round-1 blocker (grok, claude on box#97's twin): a pull_request run from a public fork gets a read-only GITHUB_TOKEN — permissions: cannot raise it — and every ceremony PR this org merges is cross-repo from the bot fork, so the tag create would 403 after green asserts, red on main per release. The door now triggers on push to main (in-repo event, full token): the decide step reads the version transition from event.before (first-parent fallback for the all-zeros edge), and the release label — still the operator's declared intent — is read via the API off the merge commit's PR. A transition with no labeled PR behind it refuses. The two doors now split on the pushed ref: tags to the tag door, main to this one. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-19 15:44:52 +00:00
..
cli.sh	fix: headless credential prompts refuse loudly, naming their variable (#42)	2026-07-19 12:15:08 +00:00
db-integration.sh	test(db): add real dump/restore round-trip probe + CI job + manual proof docs	2026-07-17 15:48:51 +00:00
labels-reconcile.sh	fix: base the human auto-request on THIS handoff, not review history	2026-07-18 20:16:57 +00:00
release.sh	fix: the merge door rides pushes to main — fork PR tokens are read-only	2026-07-19 15:44:52 +00:00