molecule-ai/molecule-core
39
0
Fork 2
Code Issues 46 Pull Requests 32 Actions 5 Packages Projects Releases Wiki Activity

Mint ops-automation persona + PAT, re-point operator-host GITEA_TOKEN away from hongming-ceo-delegated #667

New Issue
Open
opened 2026-05-12 04:44:53 +00:00 by hongming · 0 comments
hongming commented 2026-05-12 04:44:53 +00:00
Owner
Copy Link

Context

Followup from #657 cleanup. The operator-host /etc/molecule-bootstrap/all-credentials.env GITEA_TOKEN was a claude-ceo-assistant token that got revoked on 2026-05-12, breaking 5+ cron-driven scripts. As a stopgap, GITEA_TOKEN now points at the hongming-ceo-delegated token — but that's a founder-delegate, not a per-persona ops-automation identity. Persona-drift root cause is not actually fixed yet.

What "proper" looks like (per feedback_per_agent_gitea_identity_default)

  1. Create a Gitea user named ops-automation (or similar — bike-shed) under the molecule-ai org.
  2. Mint a PAT for it with minimum scope: read:organization, read:notification, read:user, write:repository (need write for git push during r2-gitea-backup tar fetch; can verify if read-only suffices).
  3. Store the new PAT in /etc/molecule-bootstrap/personas/ops-automation/token (mode 600).
  4. Rewrite GITEA_TOKEN= in /etc/molecule-bootstrap/all-credentials.env to source from the persona dir.
  5. Verify all 5 consuming crons still succeed:
    • /etc/cron.d/molecule-deploy-poll → operator-deploy-poll.sh
    • /etc/cron.d/molecule-gitea-actions-auto-heal
    • /etc/cron.d/molecule-persona-rotate → rotate-personas.py
    • /etc/cron.d/molecule-r2-gitea-backup
    • /etc/cron.d/sop6-drift-check
  6. After 24h burn-in with no failures, revoke the founder-delegate fallback.

Files involved

  • /etc/molecule-bootstrap/all-credentials.env (line GITEA_TOKEN=...)
  • /etc/molecule-bootstrap/personas/ (new dir)
  • /opt/operator-config/ops/*.sh (consumers — no code change needed, just env var swap)

Acceptance

  • curl -H "Authorization: token $GITEA_TOKEN" /api/v1/user returns ops-automation, not hongming.
  • All 5 crons green on next scheduled fire.
  • feedback_per_agent_gitea_identity_default boundary respected — no founder-PAT used in ops cron.

Tier

medium — ops cron failures are silent and degrade over time; not urgent.

## Context Followup from #657 cleanup. The operator-host `/etc/molecule-bootstrap/all-credentials.env` `GITEA_TOKEN` was a claude-ceo-assistant token that got revoked on 2026-05-12, breaking 5+ cron-driven scripts. As a stopgap, GITEA_TOKEN now points at the **hongming-ceo-delegated** token — but that's a founder-delegate, not a per-persona ops-automation identity. Persona-drift root cause is not actually fixed yet. ## What "proper" looks like (per `feedback_per_agent_gitea_identity_default`) 1. Create a Gitea user named `ops-automation` (or similar — bike-shed) under the molecule-ai org. 2. Mint a PAT for it with minimum scope: `read:organization`, `read:notification`, `read:user`, `write:repository` (need write for git push during r2-gitea-backup tar fetch; can verify if read-only suffices). 3. Store the new PAT in `/etc/molecule-bootstrap/personas/ops-automation/token` (mode 600). 4. Rewrite `GITEA_TOKEN=` in `/etc/molecule-bootstrap/all-credentials.env` to source from the persona dir. 5. Verify all 5 consuming crons still succeed: - `/etc/cron.d/molecule-deploy-poll` → operator-deploy-poll.sh - `/etc/cron.d/molecule-gitea-actions-auto-heal` - `/etc/cron.d/molecule-persona-rotate` → rotate-personas.py - `/etc/cron.d/molecule-r2-gitea-backup` - `/etc/cron.d/sop6-drift-check` 6. After 24h burn-in with no failures, revoke the founder-delegate fallback. ## Files involved - `/etc/molecule-bootstrap/all-credentials.env` (line `GITEA_TOKEN=...`) - `/etc/molecule-bootstrap/personas/` (new dir) - `/opt/operator-config/ops/*.sh` (consumers — no code change needed, just env var swap) ## Acceptance - `curl -H "Authorization: token $GITEA_TOKEN" /api/v1/user` returns `ops-automation`, not `hongming`. - All 5 crons green on next scheduled fire. - `feedback_per_agent_gitea_identity_default` boundary respected — no founder-PAT used in ops cron. ## Tier medium — ops cron failures are silent and degrade over time; not urgent.
hongming added the
tier:medium
 label 2026-05-12 04:45:08 +00:00
core-devops was assigned by hongming 2026-05-12 04:45:10 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
release-blocker

Blocks the staging→main promotion / a release

  
security

   
test-label-sre

   
tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

  
tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

  
tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

  
triage-test

test

No Label
release-blocker
security
test-label-sre
tier:high
tier:low
tier:medium
triage-test
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
core-devops
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#667
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?