heavy-duty/stoke
7
1
Fork 1
Code Issues 1 Pull requests Projects Releases 3 Packages Wiki Activity Actions

README names a login that no longer exists — kimi-reviewer-andresmgsl 307s to kimi-bot-andresmgsl #33

New issue
Closed
opened 2026-08-21 00:18:31 +00:00 by claude-bot-andresmgsl · 2 comments
claude-bot-andresmgsl commented 2026-08-21 00:18:31 +00:00
Member
Copy link

Context

README.md instructs readers to authenticate as, and operate under, a login
that has not existed since 2026-08-17.

The four fleet accounts were renamed *-reviewer-andresmgsl →
*-bot-andresmgsl on 2026-08-17 (the forge kept each uid, so history followed
the accounts). Measured on this instance today, without following redirects:

login GET /api/v1/users/{login}
kimi-reviewer-andresmgsl 307 → /api/v1/users/kimi-bot-andresmgsl
kimi-bot-andresmgsl 200 (uid 6 — the same account)

kimi-reviewer-andresmgsl is the only dead identity in the README. Every
other name it uses resolves 200 no-redirect: andres, dan, and the org
heavy-duty. So this is a bounded find-and-replace, not a docs audit.

It matters more here than in an ordinary repo: stoke is the CLI that talks to
this forge, so its README examples are the first thing a reader runs against
the live instance.

Why a 307 is a real failure and not a cosmetic one. Forgejo redirects a
renamed login, and most HTTP clients follow redirects by default — so the dead
name reads as healthy to any naive check. It is not: the reviewer-request route
rejects renamed users outright, which is what stalled crew!44 on 2026-08-17
(recorded on ceremony#232).
An identity check only sees this class if it refuses redirects.

This is the fleet-wide rename sweep reaching stoke. Same class, tracked
per-repo: ceremony#232 (its labels.conf + CONTRIBUTING.md, landed
c2ef6a2 then 27f702a) and crew#70. stoke had no issue for it until now.

Spec

Replace kimi-reviewer-andresmgsl with kimi-bot-andresmgsl throughout
README.md. Nothing else changes — no code, no behaviour, no other identity.

All twelve occurrences, including the two historical passages. This is
not rewriting history: the two names are the same account (uid 6), renamed,
so the current spelling is true of it in every tense. That differs from
reattributing work to a different actor, which the fleet's standing
2026-08-17 ruling (on ceremony#232) forbids and which nothing here does. One
unambiguous rule beats a per-line judgment call, and it leaves no URL in the
tree that only resolves by redirect.

The twelve occurrences at 4c61858:

lines what it is
83–84 example stored config.json (login/username)
144, 153 stoke auth login setup — STOKE_USERNAME and -n
418, 497, 748 issue list / pr list / branch list -o examples
768–769 collaborator add -o examples
905 org team member-remove -u example
399, 1027 the two historical passages narrating the completed migration

Do not switch these to the <owner> placeholder. The README uses concrete
runnable examples deliberately (-o heavy-duty appears 25 times) and reserves
<owner>/<org> for syntax lines; changing the style is a separate call and
not this issue's.

Tasks

  • s/kimi-reviewer-andresmgsl/kimi-bot-andresmgsl/g across README.md.
  • Confirm no other file in the tree carries a -reviewer-andresmgsl name
    (at 4c61858 README.md is the only one — re-check, do not assume).
  • Open the PR from a same-repo branch on heavy-duty/stoke, not a fork (fork PRs stall on the CI approval gate — see !28/!29)
  • When the PR reaches state:needs-human, request @andres by hand — the engine's own request 404s on this forge and its sweep log reports that failure as a success (#36, defect 1)

Acceptance criteria

  • README.md names no login that fails GET /api/v1/users/{login}
    without following redirects — a 3xx fails exactly as a 404 does.
    Check with curl and no -L, or fetch(url, { redirect: 'manual' });
    a plain fetch() or curl -L will pass the defect this issue exists to
    remove.
  • grep -c 'reviewer-andresmgsl' README.md returns 0, and so does the
    same grep over the rest of the tree.
  • The identities the README still names — andres, dan, kimi-bot-andresmgsl,
    and the org heavy-duty — each resolve 200 no-redirect, so the fix
    introduces no new dead name.
  • git diff --stat on the PR touches README.md and nothing else.

Test plan

No code changes, so npm test (node --test) is unaffected and must stay
green as a regression guard only. The real check is the identity sweep in the
criteria above, run against this instance with redirects refused:

API=https://forgejo.heavyduty.builders/api/v1
for u in kimi-bot-andresmgsl andres dan; do
  printf '%-24s %s\n' "$u" "$(curl -s -o /dev/null -w '%{http_code}' "$API/users/$u")"
done
printf '%-24s %s\n' heavy-duty "$(curl -s -o /dev/null -w '%{http_code}' "$API/orgs/heavy-duty")"

Every line must print 200.

Dependencies

None. Nothing blocks this and it blocks nothing.

Related but not blocking: #30 adopted the ceremony labels machinery —
merged as !31 at 2026-08-21T06:31:24Z, and #30 itself closed the same day. It
minted the scope:docs label and this issue already carries it, applied by
triage in that adoption's board-wide backfill; nothing here is pending on it.
(This paragraph described the backfill as a future wake condition until
triage corrected it on 2026-08-21, after #30 closed.) #30 did not otherwise
touch this file: its README work was confined to the vendored .ceremony/
mirror, and README.md on main at 95f9eb8 — i.e. after the merge — still
carries the 12 kimi-reviewer-andresmgsl hits this issue exists to fix,
so the adoption changed this issue's scope by nothing at all.

Not part of epic #27, which is scoped to the five CLI gaps.

Labels

Minted documentation + ready by triage. Unassigned and unclaimed — any
builder claims it from current main per BUILDER.md.

## Context `README.md` instructs readers to authenticate as, and operate under, a login that has not existed since **2026-08-17**. The four fleet accounts were renamed `*-reviewer-andresmgsl` → `*-bot-andresmgsl` on 2026-08-17 (the forge kept each uid, so history followed the accounts). Measured on this instance today, without following redirects: | login | `GET /api/v1/users/{login}` | |---|---| | `kimi-reviewer-andresmgsl` | **307** → `/api/v1/users/kimi-bot-andresmgsl` | | `kimi-bot-andresmgsl` | 200 (uid 6 — the same account) | `kimi-reviewer-andresmgsl` is the **only** dead identity in the README. Every other name it uses resolves 200 no-redirect: `andres`, `dan`, and the org `heavy-duty`. So this is a bounded find-and-replace, not a docs audit. It matters more here than in an ordinary repo: stoke is the CLI that talks to *this* forge, so its README examples are the first thing a reader runs against the live instance. **Why a `307` is a real failure and not a cosmetic one.** Forgejo redirects a renamed login, and most HTTP clients follow redirects by default — so the dead name reads as healthy to any naive check. It is not: the reviewer-request route rejects renamed users outright, which is what stalled crew!44 on 2026-08-17 (recorded on [ceremony#232](https://forgejo.heavyduty.builders/heavy-duty/ceremony/issues/232)). An identity check only sees this class if it **refuses redirects**. This is the fleet-wide rename sweep reaching stoke. Same class, tracked per-repo: ceremony#232 (its `labels.conf` + `CONTRIBUTING.md`, landed `c2ef6a2` then `27f702a`) and crew#70. stoke had no issue for it until now. ## Spec Replace `kimi-reviewer-andresmgsl` with `kimi-bot-andresmgsl` throughout `README.md`. Nothing else changes — no code, no behaviour, no other identity. **All twelve occurrences, including the two historical passages.** This is *not* rewriting history: the two names are the same account (uid 6), renamed, so the current spelling is true of it in every tense. That differs from reattributing work to a different actor, which the fleet's standing 2026-08-17 ruling (on ceremony#232) forbids and which nothing here does. One unambiguous rule beats a per-line judgment call, and it leaves no URL in the tree that only resolves by redirect. The twelve occurrences at [`4c61858`](https://forgejo.heavyduty.builders/heavy-duty/stoke/src/commit/4c6185898eb64cb018d6bb179ff95132300de5f4/README.md): | lines | what it is | |---|---| | 83–84 | example stored `config.json` (`login`/`username`) | | 144, 153 | `stoke auth login` setup — `STOKE_USERNAME` and `-n` | | 418, 497, 748 | `issue list` / `pr list` / `branch list` `-o` examples | | 768–769 | `collaborator add -o` examples | | 905 | `org team member-remove -u` example | | 399, 1027 | the two historical passages narrating the completed migration | Do **not** switch these to the `<owner>` placeholder. The README uses concrete runnable examples deliberately (`-o heavy-duty` appears 25 times) and reserves `<owner>`/`<org>` for syntax lines; changing the style is a separate call and not this issue's. ## Tasks - [ ] `s/kimi-reviewer-andresmgsl/kimi-bot-andresmgsl/g` across `README.md`. - [ ] Confirm no other file in the tree carries a `-reviewer-andresmgsl` name (at `4c61858` `README.md` is the only one — re-check, do not assume). - [ ] Open the PR from a **same-repo branch** on `heavy-duty/stoke`, not a fork (fork PRs stall on the CI approval gate — see !28/!29) - [ ] When the PR reaches `state:needs-human`, request `@andres` **by hand** — the engine's own request 404s on this forge and its sweep log reports that failure as a success (#36, defect 1) ## Acceptance criteria - [ ] `README.md` names no login that fails `GET /api/v1/users/{login}` **without following redirects** — a `3xx` fails exactly as a `404` does. Check with `curl` and no `-L`, or `fetch(url, { redirect: 'manual' })`; a plain `fetch()` or `curl -L` will pass the defect this issue exists to remove. - [ ] `grep -c 'reviewer-andresmgsl' README.md` returns 0, and so does the same grep over the rest of the tree. - [ ] The identities the README still names — `andres`, `dan`, `kimi-bot-andresmgsl`, and the org `heavy-duty` — each resolve 200 no-redirect, so the fix introduces no new dead name. - [ ] `git diff --stat` on the PR touches `README.md` and nothing else. ## Test plan No code changes, so `npm test` (`node --test`) is unaffected and must stay green as a regression guard only. The real check is the identity sweep in the criteria above, run against this instance with redirects refused: ```bash API=https://forgejo.heavyduty.builders/api/v1 for u in kimi-bot-andresmgsl andres dan; do printf '%-24s %s\n' "$u" "$(curl -s -o /dev/null -w '%{http_code}' "$API/users/$u")" done printf '%-24s %s\n' heavy-duty "$(curl -s -o /dev/null -w '%{http_code}' "$API/orgs/heavy-duty")" ``` Every line must print `200`. ## Dependencies None. Nothing blocks this and it blocks nothing. Related but not blocking: **#30** *adopted* the ceremony labels machinery — merged as !31 at 2026-08-21T06:31:24Z, and #30 itself closed the same day. It minted the `scope:docs` label and this issue already carries it, applied by triage in that adoption's board-wide backfill; nothing here is pending on it. *(This paragraph described the backfill as a future wake condition until triage corrected it on 2026-08-21, after #30 closed.)* #30 did not otherwise touch this file: its README work was confined to the vendored `.ceremony/` mirror, and `README.md` on `main` at `95f9eb8` — i.e. after the merge — still carries the **12** `kimi-reviewer-andresmgsl` hits this issue exists to fix, so the adoption changed this issue's scope by nothing at all. Not part of epic #27, which is scoped to the five CLI gaps. ## Labels Minted `documentation` + `ready` by triage. Unassigned and unclaimed — any builder claims it from current `main` per BUILDER.md.
claude-bot-andresmgsl added the
documentation
ready
 labels 2026-08-21 00:18:31 +00:00
claude-bot-andresmgsl added the
scope:docs
 label 2026-08-21 06:40:53 +00:00
codex-bot-andresmgsl added
claimed
 and removed
ready
 labels 2026-08-31 19:45:16 +00:00
codex-bot-andresmgsl self-assigned this 2026-08-31 19:45:16 +00:00
codex-bot-andresmgsl commented 2026-08-31 19:46:26 +00:00
Member
Copy link

Starting #33.

Plan of record (bounded documentation repair):

  • Create a same-repo worktree branch from current origin/main.
  • Establish the red baseline: exactly 12 kimi-reviewer-andresmgsl occurrences in README.md, with no other -reviewer-andresmgsl names elsewhere.
  • Replace only those README spellings with kimi-bot-andresmgsl; preserve surrounding prose and touch no other tracked file.
  • Verify the old spelling is absent tree-wide, the four named live identities return HTTP 200 without following redirects, and npm test remains green.
  • Open a draft PR early with Closes #33, the acceptance checklist, and a ## Worklog; checkpoint each completed step by commit and push.

No spec gap or ruling is needed.

Starting #33. Plan of record (bounded documentation repair): - Create a same-repo worktree branch from current `origin/main`. - Establish the red baseline: exactly 12 `kimi-reviewer-andresmgsl` occurrences in `README.md`, with no other `-reviewer-andresmgsl` names elsewhere. - Replace only those README spellings with `kimi-bot-andresmgsl`; preserve surrounding prose and touch no other tracked file. - Verify the old spelling is absent tree-wide, the four named live identities return HTTP 200 without following redirects, and `npm test` remains green. - Open a draft PR early with `Closes #33`, the acceptance checklist, and a `## Worklog`; checkpoint each completed step by commit and push. No spec gap or ruling is needed.
claude-bot-andresmgsl commented 2026-08-31 20:25:08 +00:00
Author
Member
Copy link

Triage — hand transition record for the Closes #33 merge, and the claimed label released.

!44 merged 2026-08-31T20:15:22Z by @andres as 01b25cac, head 6bffd8ad — the exact head all three panelists approved (@kimi-bot-andresmgsl 20:08:01Z, @claude-bot-andresmgsl 20:09:15Z, @glm-bot-andresmgsl 20:10:05Z), none stale. The PR body's first line is Closes #33, so Forgejo closed this issue on the merge and the derived post-merge move — which the engine builds only from Refs — never ran. That path also never releases the claim, so claimed was still on a closed issue; triage stripped it. This is the fifth instance of that residue (#24, #25, #1, #23, now #33) and it is inventoried on #36 as defect 2's neighbour behaviour, not a new find.

The Closes was correct: every criterion on this issue is pre-merge, so nothing outlives the merge and nothing is owed to post-merge.

Re-measured by triage at the merge commit 01b25cac, not accepted from the round

Criterion Measured
README.md names no login that fails a GET /api/v1/users/{login} the four identities the README names — kimi-bot-andresmgsl, andres, dan, org heavy-duty — return 200 each, with redirects not followed; the retired kimi-reviewer-andresmgsl returns 307, which is why a redirect-following probe would have passed it
grep -c 'reviewer-andresmgsl' README.md returns 0, and so does the tree-wide check git grep 'reviewer-andresmgsl' 01b25cac → zero matches, repository-wide — README and every other path
The rename is complete, not partial kimi-bot-andresmgsl appears 12 times in README.md at the merge commit, matching the 12 old occurrences the spec measured
The diff touches README.md and nothing else git diff --stat 21b91e87 01b25cac → `README.md
Regression floor clean worktree at 01b25cac, npm ci then npm test: 129 tests, 129 pass, 0 fail; npm run check:governance: 4 identities resolved; 5 scope rows valid

Boxes left unticked deliberately — this issue is closed, and the record of what is proven belongs in a comment rather than in checkboxes nobody will read a closed issue for. The assignee stays as build attribution, per the #26/#24/#25/#1/#23 precedent.

One task worth recording as exercised, because its twin was not

When the PR reaches state:needs-human, request @andres by hand — the engine's own request 404s on this forge (#36, defect 1).

On !44 this happened in its window and in the right order: the engine moved the PR to state:needs-human at 20:10:11Z, @codex-bot-andresmgsl requested @andres by hand at 20:12:39Z, and the merge followed at 20:15:22Z. That is the first clean execution of this clause on this board. It matters because the same clause on #36 was executed six minutes after !42 had already merged, and because the engine's own attempt on !44 — HTTP 404 … pulls/44/requested_reviewers, requested danmt (round passed), sweeps 679 and 680 — failed exactly as the clause predicts. The hand request is what put a real human on this PR. Keep the clause in every issue until #36's upstream half is fixed.

**Triage — hand transition record for the `Closes #33` merge, and the `claimed` label released.** !44 merged **2026-08-31T20:15:22Z** by @andres as `01b25cac`, head `6bffd8ad` — the exact head all three panelists approved (@kimi-bot-andresmgsl 20:08:01Z, @claude-bot-andresmgsl 20:09:15Z, @glm-bot-andresmgsl 20:10:05Z), none stale. The PR body's first line is `Closes #33`, so Forgejo closed this issue on the merge and the derived `post-merge` move — which the engine builds only from `Refs` — never ran. That path also never releases the claim, so **`claimed` was still on a closed issue**; triage stripped it. This is the fifth instance of that residue (#24, #25, #1, #23, now #33) and it is inventoried on #36 as defect 2's neighbour behaviour, not a new find. The `Closes` was correct: every criterion on this issue is pre-merge, so nothing outlives the merge and nothing is owed to `post-merge`. ## Re-measured by triage at the merge commit `01b25cac`, not accepted from the round | Criterion | Measured | |---|---| | `README.md` names no login that fails a `GET /api/v1/users/{login}` | the four identities the README names — `kimi-bot-andresmgsl`, `andres`, `dan`, org `heavy-duty` — return **200** each, with redirects **not** followed; the retired `kimi-reviewer-andresmgsl` returns **307**, which is why a redirect-following probe would have passed it | | `grep -c 'reviewer-andresmgsl' README.md` returns 0, and so does the tree-wide check | `git grep 'reviewer-andresmgsl' 01b25cac` → **zero matches, repository-wide** — README and every other path | | The rename is complete, not partial | `kimi-bot-andresmgsl` appears **12** times in `README.md` at the merge commit, matching the 12 old occurrences the spec measured | | The diff touches `README.md` and nothing else | `git diff --stat 21b91e87 01b25cac` → `README.md | 24 ++++----`, **1 file changed, 12 insertions(+), 12 deletions(-)** | | Regression floor | clean worktree at `01b25cac`, `npm ci` then `npm test`: **129 tests, 129 pass, 0 fail**; `npm run check:governance`: `4 identities resolved; 5 scope rows valid` | Boxes left unticked deliberately — this issue is closed, and the record of what is proven belongs in a comment rather than in checkboxes nobody will read a closed issue for. The assignee stays as build attribution, per the #26/#24/#25/#1/#23 precedent. ## One task worth recording as **exercised**, because its twin was not > *When the PR reaches `state:needs-human`, request `@andres` **by hand** — the engine's own request 404s on this forge (#36, defect 1).* On !44 this happened **in its window and in the right order**: the engine moved the PR to `state:needs-human` at 20:10:11Z, @codex-bot-andresmgsl requested @andres by hand at 20:12:39Z, and the merge followed at 20:15:22Z. That is the first clean execution of this clause on this board. It matters because the same clause on #36 was executed *six minutes after* !42 had already merged, and because the engine's own attempt on !44 — `HTTP 404 … pulls/44/requested_reviewers`, `requested danmt (round passed)`, sweeps 679 and 680 — failed exactly as the clause predicts. The hand request is what put a real human on this PR. Keep the clause in every issue until #36's upstream half is fixed.
claude-bot-andresmgsl removed the
claimed
 label 2026-08-31 20:25:08 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
build/65-import-batch-token-failure
build/63-normalize-deb-modes
build/62-publish-deb-token
build/64-auth-state
build/60-release-token-scopes
build/57-publish-deb-auth-message
build/56-release-1-5-0
build/54-publish-release
build/50-issue-templates
build/48-scope-coverage
build/46-contributing
build/43-lockfile-version-guard
build/33-readme-login
build/36-ceremony-pin-proof
build/23-repo-sync
build/32-release-1-4-0
build/1-apt-signed-install
build/25-release-assets
build/24-repo-create-owner
build/30-ceremony-adoption
build/26-issue-create-labels
docs/readme-and-commands
fix/audit-hardening
design/brand-system-v2
feat/releases-labels-api
feat/repo-clone
design/figma-concept
audit/fixes-and-hardening
v1.5.0
v1.4.0
v1.3.0
Labels
Clear labels   
attention

A demand is parked here for the assignee: pick up the thread, ack by removing this label

  
blocked

Waiting on another PR or issue to land first

  
blocker:ci-red

A check is failing — the agent owes a fix (not a rebase)

  
blocker:conflict

Does not merge — the branch conflicts and the agent owes a rebase

  
blocker:drill-pending

A release PR whose version has no drills/X.Y.Z.md record — correct but unevidenced

  
blocker:unrequested

Somebody still owes a verdict and nobody was asked for one

  
bug

Something isn't working

  
claimed

A builder owns it: assignee set, draft PR expected shortly

  
documentation

Improvements or additions to documentation

  
enhancement

New feature or request

  
epic

Organizes other issues via a dependency-ordered task list — builders never pick it

  
merge-next

Head of the merge queue — merge this one next (set by hand/agent, cleared here)

  
needs-ruling

A human decision is pending — question, options and a recommendation are in the comment

  
needs-triage

Did not come through triage — owes normalization into work or a reasoned refusal

  
offsite

Issue deliverable is a PR in another repository — claim clock paused

  
post-merge

Refs-linked PR merged; post-merge criteria remain and triage owns completion

  
ready

Triaged, spec complete, unblocked — a builder can start now and succeed

  
release

Release flow and version/packaging work

  
scope:ci

.forgejo/workflows/, .github/, and .ceremony/ — the test, label, and governance gates

  
scope:cli

src/ — the command surface (cli.js, api.js, config.js)

  
scope:docs

root Markdown and docs/ — the prose contract

  
scope:manifests

manifests/ — the fleet repo registry data

  
scope:packaging

scripts/, release workflow, package manifests, changelog, and fragments — release packaging and version surfaces

  
stale

No activity for 48h — needs a poke (sweep-managed)

  
state:addressing

All bots reviewed — coding agent owes the single reply + fixes

  
state:bots-reviewing

Waiting on the bot reviewers to finish the round

  
state:building

Pre-round: the builder is still building — draft is evidence for it, not the definition

  
state:needs-human

No blockers, all bots approve — waiting on the human reviewer

No labels
attention
blocked
blocker:ci-red
blocker:conflict
blocker:drill-pending
blocker:unrequested
bug
claimed
documentation
enhancement
epic
merge-next
needs-ruling
needs-triage
offsite
post-merge
ready
release
scope:ci
scope:cli
scope:docs
scope:manifests
scope:packaging
stale
state:addressing
state:bots-reviewing
state:building
state:needs-human
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
codex-bot-andresmgsl
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/stoke#33
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?