rig/docs at build/112-ceremony-uses-absolute - heavy-duty/rig

History

cluade-reviewer-andresmgsl fbdce5284e fix: the ci-box token guidance says what a Forgejo token actually is Round finding from @codex-reviewer-andresmgsl, elevated to blocking by @grok-reviewer-andresmgsl and @kimi-reviewer-andresmgsl. Unanimous, and right. creds.md called the registration token "short-lived" and said it was "consumed at registration". Both are GitHub's facts, copied across the forge boundary with the rest of the sibling's shape. Forgejo's primary source, read rather than inferred: models/actions/runner_token.go — ActionRunnerToken has NO expiry field. Only IsActive, Created, Updated. NewRunnerToken flips IsActive false on prior tokens at the same scope and only there, so a token dies when somebody mints its replacement, never on a clock. routers/api/actions/runner/runner.go — Register reads the token, refuses it when !IsActive ("please use the latest one"), and returns WITHOUT setting IsActive = false. Registration does not spend it. One token registers as many runners as it is shown to. So it is long-lived and reusable — the precise opposite of the adjective, and GitHub's really does expire in about an hour, which is why runner-install.sh is correct to use it. This is not a wording nit because of where the wording lives. creds.md is spliced into the ci-box's own CONTEXT.md: it is the paragraph an agent INSIDE the box reads about its own credentials. Telling that reader the token self-expires is telling it a leaked one stops mattering on its own, while it is still registering runners. Pinned, not merely fixed, per codex's ask — the phrase arrived by copying from the GitHub sibling, so the same copy can bring it back. Four rows: absence from both files, and presence of the true claim, so the pin cannot be satisfied by deleting the sentence instead of correcting it. The first draft of the CIBOX pin was a phrase match and passed against the exact text it was written to catch — the old wording wrapped across two comment lines. It is a plain absence check now, and the file explains the ban without spelling the word. Mutation-checked: all four go red against the old wording, green after.	2026-07-28 16:18:33 +00:00
..
plans	docs: B1 is cleared — the mint-time Forgejo fetch is proven live	2026-07-27 21:30:18 +00:00
templates	fix: the ci-box token guidance says what a Forgejo token actually is	2026-07-28 16:18:33 +00:00

cluade-reviewer-andresmgsl fbdce5284e fix: the ci-box token guidance says what a Forgejo token actually is

Round finding from @codex-reviewer-andresmgsl, elevated to blocking by
@grok-reviewer-andresmgsl and @kimi-reviewer-andresmgsl. Unanimous, and right.

creds.md called the registration token "short-lived" and said it was "consumed
at registration". Both are GitHub's facts, copied across the forge boundary
with the rest of the sibling's shape. Forgejo's primary source, read rather
than inferred:

  models/actions/runner_token.go — ActionRunnerToken has NO expiry field. Only
  IsActive, Created, Updated. NewRunnerToken flips IsActive false on prior
  tokens at the same scope and only there, so a token dies when somebody mints
  its replacement, never on a clock.

  routers/api/actions/runner/runner.go — Register reads the token, refuses it
  when !IsActive ("please use the latest one"), and returns WITHOUT setting
  IsActive = false. Registration does not spend it. One token registers as many
  runners as it is shown to.

So it is long-lived and reusable — the precise opposite of the adjective, and
GitHub's really does expire in about an hour, which is why runner-install.sh is
correct to use it.

This is not a wording nit because of where the wording lives. creds.md is
spliced into the ci-box's own CONTEXT.md: it is the paragraph an agent INSIDE
the box reads about its own credentials. Telling that reader the token
self-expires is telling it a leaked one stops mattering on its own, while it is
still registering runners.

Pinned, not merely fixed, per codex's ask — the phrase arrived by copying from
the GitHub sibling, so the same copy can bring it back. Four rows: absence from
both files, and presence of the true claim, so the pin cannot be satisfied by
deleting the sentence instead of correcting it. The first draft of the CIBOX
pin was a phrase match and passed against the exact text it was written to
catch — the old wording wrapped across two comment lines. It is a plain absence
check now, and the file explains the ban without spelling the word.

Mutation-checked: all four go red against the old wording, green after.

2026-07-28 16:18:33 +00:00

plans

docs: B1 is cleared — the mint-time Forgejo fetch is proven live

2026-07-27 21:30:18 +00:00

templates

fix: the ci-box token guidance says what a Forgejo token actually is

2026-07-28 16:18:33 +00:00