Merge pull request 'docs/RUNNER-PROBES.md — record the venue's first delivered drills (#202)' (#216) from build/202-first-drills into main

Reviewed-on: #216
Reviewed-by: codex-reviewer-andresmgsl <andres+2@heavyduty.builders>
Reviewed-by: kimi-reviewer-andresmgsl <andres+4@heavyduty.builders>

changelog.d/202.md

@@ -62,3 +62,15 @@
 - Probe results are written to an issue in the probe repo and carried to the
   ceremony issue by a human, so the probe holds no path that can write to the
   live board (#202).
+
+### Changed
+
+- `docs/RUNNER-PROBES.md` records the venue's first delivered drills — the
+  #192 asymmetry re-observed on demand under the workflow token, the dispatch
+  route's 204 under both identities, and #215's boundary finding — each with
+  the probe-issue URL it is recorded in (#202).
+
+- Two venue lessons join the runbook where the next probe author will look:
+  findings must be written to issues because the venue's log route 404s for
+  non-admin reads, and report content sent to the forge must never contain a
+  credential expression or value (#202).

docs/RUNNER-PROBES.md

@@ -333,13 +333,55 @@ No probe touches `heavy-duty/ceremony`'s board. No labels, no comments, no
 runs attributable to a probe. The venue exists so that the live board does not
 have to be the test fixture.
 
-## The probes this venue owes
+## The probes this venue owes — and the records of those delivered
 
-- **ceremony#192** — that the repaired sweep actually lifts a label under the
-  workflow token, which is the half its acceptance criteria cannot get from
-  the hermetic contract tests.
-- **ceremony#205** — whether `POST /actions/workflows/{file}/dispatches`
-  works on this instance with a valid ref and inputs. Measured so far:
-  `GET /actions/workflows` 404s and the dispatch route answers 500 rather than
-  a 4xx, which is not enough to port against.
-- A 0.6.0 consumer exercise once ceremony#198 has merged.
+Delivered probes stay listed with their record: the venue's value is that a
+claim like "the asymmetry reproduces" carries a URL a reader can open, not a
+memory.
+
+- **ceremony#192** — DELIVERED, first drill (2026-08-05). Under
+  `${{ github.token }}` in the venue:
+  `DELETE /issues/{n}/labels/{id}` → **500**, the label still on the issue
+  afterward — the failure observable in the set, not merely a status — then
+  `PUT` full-set clear → **200**, set actually empty. Record:
+  [probe issue #1](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/1)
+  (run 1) and
+  [probe issue #2](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/2)
+  (run 4 — the clean independent repeat after the redaction incident below).
+- **ceremony#205** — DELIVERED with a correction to the line above's
+  premise. The dispatch route answers **204** to a valid body carrying the
+  bare resolvable ref `main` — under the workflow token
+  ([ceremony#205 comment #6262](https://forgejo.heavyduty.builders/heavy-duty/ceremony/issues/205#issuecomment-6262),
+  run 504, and again as
+  [probe issue #4](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/4),
+  run 6) and under a PAT
+  ([probe issue #5](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/5),
+  run 7, and ceremony run 459). The earlier opaque `500` came from a bare
+  UNRESOLVABLE ref or an unknown/unparseable workflow — the diagnostic !213
+  ships now names this; a fully-qualified bad ref gets a clean 404 instead.
+  The `GET /actions/workflows` listing still 404s. Claims here are limited to
+  what those runs measured.
+- **ceremony#215** — the discriminator drill: REST-body `inputs` DO reach a
+  top-level dispatched workflow, both contexts
+  (`inputs.*` and `github.event.inputs.*`), both identities. What loses the
+  value is the `workflow_call` boundary — a called workflow does not see the
+  caller's `event.inputs` on this instance. Records:
+  [probe issues #4 and #5](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/4)
+  (runs 6 and 7).
+- A 0.6.0 consumer exercise once ceremony#198 has merged. (#198 merged
+  2026-08-05; this probe remains open.)
+
+Two venue lessons from the first drills, kept where the next probe author will
+look:
+
+- **Rule 4 is load-bearing on this instance**: the probe repo's web log route
+  404s for non-admin reads, and a log-only observation (run 2) was lost where
+  issue-written ones were not.
+- **Report content sent to the forge must never contain a credential
+  expression OR a credential value** — moving a secret from `${{ … }}` syntax
+  into a shell variable does not make it safe to emit. Name identities in
+  literal prose ("the workflow token"), allowlist the fields a report emits,
+  and treat anything else as unsendable. The incident this teaches from: an
+  escaped `${{ github.token }}` in a comment template was expanded by the
+  runner into the recorded text (the run's ephemeral token); it was redacted
+  in place and the drill repeated clean (probe issue #2, run 4).