molecule-ai/molecule-core
44
0
Fork 2
Code Issues 134 Pull Requests 156 Actions Packages Projects Releases Wiki Activity

Mint ops-automation persona + PAT, re-point operator-host GITEA_TOKEN away from hongming-ceo-delegated #667

New Issue
Open
opened 2026-05-12 04:44:53 +00:00 by hongming · 2 comments
hongming commented 2026-05-12 04:44:53 +00:00
Owner
Copy Link
Copy Source

Context

Followup from #657 cleanup. The operator-host /etc/molecule-bootstrap/all-credentials.env GITEA_TOKEN was a claude-ceo-assistant token that got revoked on 2026-05-12, breaking 5+ cron-driven scripts. As a stopgap, GITEA_TOKEN now points at the hongming-ceo-delegated token — but that's a founder-delegate, not a per-persona ops-automation identity. Persona-drift root cause is not actually fixed yet.

What "proper" looks like (per feedback_per_agent_gitea_identity_default)

  1. Create a Gitea user named ops-automation (or similar — bike-shed) under the molecule-ai org.
  2. Mint a PAT for it with minimum scope: read:organization, read:notification, read:user, write:repository (need write for git push during r2-gitea-backup tar fetch; can verify if read-only suffices).
  3. Store the new PAT in /etc/molecule-bootstrap/personas/ops-automation/token (mode 600).
  4. Rewrite GITEA_TOKEN= in /etc/molecule-bootstrap/all-credentials.env to source from the persona dir.
  5. Verify all 5 consuming crons still succeed:
    • /etc/cron.d/molecule-deploy-poll → operator-deploy-poll.sh
    • /etc/cron.d/molecule-gitea-actions-auto-heal
    • /etc/cron.d/molecule-persona-rotate → rotate-personas.py
    • /etc/cron.d/molecule-r2-gitea-backup
    • /etc/cron.d/sop6-drift-check
  6. After 24h burn-in with no failures, revoke the founder-delegate fallback.

Files involved

  • /etc/molecule-bootstrap/all-credentials.env (line GITEA_TOKEN=...)
  • /etc/molecule-bootstrap/personas/ (new dir)
  • /opt/operator-config/ops/*.sh (consumers — no code change needed, just env var swap)

Acceptance

  • curl -H "Authorization: token $GITEA_TOKEN" /api/v1/user returns ops-automation, not hongming.
  • All 5 crons green on next scheduled fire.
  • feedback_per_agent_gitea_identity_default boundary respected — no founder-PAT used in ops cron.

Tier

medium — ops cron failures are silent and degrade over time; not urgent.

## Context Followup from #657 cleanup. The operator-host `/etc/molecule-bootstrap/all-credentials.env` `GITEA_TOKEN` was a claude-ceo-assistant token that got revoked on 2026-05-12, breaking 5+ cron-driven scripts. As a stopgap, GITEA_TOKEN now points at the **hongming-ceo-delegated** token — but that's a founder-delegate, not a per-persona ops-automation identity. Persona-drift root cause is not actually fixed yet. ## What "proper" looks like (per `feedback_per_agent_gitea_identity_default`) 1. Create a Gitea user named `ops-automation` (or similar — bike-shed) under the molecule-ai org. 2. Mint a PAT for it with minimum scope: `read:organization`, `read:notification`, `read:user`, `write:repository` (need write for git push during r2-gitea-backup tar fetch; can verify if read-only suffices). 3. Store the new PAT in `/etc/molecule-bootstrap/personas/ops-automation/token` (mode 600). 4. Rewrite `GITEA_TOKEN=` in `/etc/molecule-bootstrap/all-credentials.env` to source from the persona dir. 5. Verify all 5 consuming crons still succeed: - `/etc/cron.d/molecule-deploy-poll` → operator-deploy-poll.sh - `/etc/cron.d/molecule-gitea-actions-auto-heal` - `/etc/cron.d/molecule-persona-rotate` → rotate-personas.py - `/etc/cron.d/molecule-r2-gitea-backup` - `/etc/cron.d/sop6-drift-check` 6. After 24h burn-in with no failures, revoke the founder-delegate fallback. ## Files involved - `/etc/molecule-bootstrap/all-credentials.env` (line `GITEA_TOKEN=...`) - `/etc/molecule-bootstrap/personas/` (new dir) - `/opt/operator-config/ops/*.sh` (consumers — no code change needed, just env var swap) ## Acceptance - `curl -H "Authorization: token $GITEA_TOKEN" /api/v1/user` returns `ops-automation`, not `hongming`. - All 5 crons green on next scheduled fire. - `feedback_per_agent_gitea_identity_default` boundary respected — no founder-PAT used in ops cron. ## Tier medium — ops cron failures are silent and degrade over time; not urgent.
hongming added the tier:medium label 2026-05-12 04:45:08 +00:00
core-devops was assigned by hongming 2026-05-12 04:45:10 +00:00
core-lead commented 2026-05-14 21:48:00 +00:00
Member
Copy Link
Copy Source

[core-lead-agent] Linking #981 HTTP 405 merge gap. This issue (#667) is the PERMANENT FIX for the merge gap — creating an ops-automation persona with admin:repository scope. Currently assigned to core-devops but un-actioned.

Dev Lead + PM aware. Org Owner action required.

[core-lead-agent] Linking #981 HTTP 405 merge gap. This issue (#667) is the PERMANENT FIX for the merge gap — creating an ops-automation persona with admin:repository scope. Currently assigned to core-devops but un-actioned. Dev Lead + PM aware. Org Owner action required.
devops-engineer commented 2026-05-19 03:51:54 +00:00
Member
Copy Link
Copy Source

2026-05-19 — applied (deploy-poll 401 storm fix)

Re-pointed operator-host GITEA_TOKEN from the (now-revoked) hongming-ceo-delegated token (last8 3560785f) to the existing devops-engineer dev-tree persona (last8 687797fc, scopes per reference_persona_token_v2_scope). Used existing persona vs minting a new ops-automation — dev-tree taxonomy supersedes the leadership-5 set per AGENTS.md, satisfies feedback_per_agent_gitea_identity_default.

Root cause confirmed

  • 46dbf7c6…3560785f was deleted from gitea.access_token (likely 2026-05-18/19 scrub wave — see reference_operator_host_git_token_bakein_scrub_2026_05_19). 401 storm started 2026-05-19T00:30Z, not 2026-05-16T23:55Z (that was last deploy, the inter-period had zero merges so no 401 surfaced).
  • All 4 scripts sourcing all-credentials.env (operator-deploy-{poll,railway,vercel}.sh, rotate-personas.py) recovered with single-line swap; sop6-drift-check has its own env so untouched.

Verification

  • bash operator-deploy-poll.sh → rc=0, 1 deployed (cp@main e6a67e2d→a3a2ddb7), 5 no-change, 0 failed
  • Railway deploy 1b8f210a-0736-4856-85f9-15c790f5e606 SUCCESS, imageDigest sha256:37baf2f9b27a…
  • Two natural cron fires post-fix (03:45:02Z, 03:50:01Z): 0 deployed, 6 no-change, 0 failed
  • curl https://api.moleculesai.app/health → {"service":"molecule-cp","status":"ok"} HTTP 200
  • Brought live cp#194 (a3a2ddb7) + cp#195 (722d7e5a, parent commit) which had been stranded since 23:32Z

Backup: /etc/molecule-bootstrap/all-credentials.env.bak.deploy-poll-401-fix-20260519T034416Z

Open follow-ups (filing as new issue, not in scope here)

  • 3-day silent-failure detection gap: no last-successful-poll-age alert on /var/log/molecule-deploy-poll.log summary line — relates to #368 ("Verify deployed SHA/digest before advancing deploy state"). Will file a separate monitoring-gap issue.

Recommend closing this issue as DONE if devops-engineer is acceptable in lieu of minting ops-automation; otherwise leave open for the eventual dedicated identity.

## 2026-05-19 — applied (deploy-poll 401 storm fix) Re-pointed operator-host `GITEA_TOKEN` from the (now-revoked) `hongming-ceo-delegated` token (last8 `3560785f`) to the existing **`devops-engineer`** dev-tree persona (last8 `687797fc`, scopes per `reference_persona_token_v2_scope`). Used existing persona vs minting a new `ops-automation` — dev-tree taxonomy supersedes the leadership-5 set per AGENTS.md, satisfies `feedback_per_agent_gitea_identity_default`. ### Root cause confirmed - `46dbf7c6…3560785f` was deleted from `gitea.access_token` (likely 2026-05-18/19 scrub wave — see `reference_operator_host_git_token_bakein_scrub_2026_05_19`). 401 storm started **2026-05-19T00:30Z**, not 2026-05-16T23:55Z (that was last *deploy*, the inter-period had zero merges so no 401 surfaced). - All 4 scripts sourcing `all-credentials.env` (`operator-deploy-{poll,railway,vercel}.sh`, `rotate-personas.py`) recovered with single-line swap; `sop6-drift-check` has its own env so untouched. ### Verification - `bash operator-deploy-poll.sh` → `rc=0, 1 deployed (cp@main e6a67e2d→a3a2ddb7), 5 no-change, 0 failed` - Railway deploy `1b8f210a-0736-4856-85f9-15c790f5e606` SUCCESS, imageDigest `sha256:37baf2f9b27a…` - Two natural cron fires post-fix (`03:45:02Z`, `03:50:01Z`): `0 deployed, 6 no-change, 0 failed` - `curl https://api.moleculesai.app/health` → `{"service":"molecule-cp","status":"ok"}` HTTP 200 - Brought live cp#194 (a3a2ddb7) + cp#195 (722d7e5a, parent commit) which had been stranded since 23:32Z Backup: `/etc/molecule-bootstrap/all-credentials.env.bak.deploy-poll-401-fix-20260519T034416Z` ### Open follow-ups (filing as new issue, not in scope here) - 3-day silent-failure detection gap: no `last-successful-poll-age` alert on `/var/log/molecule-deploy-poll.log` summary line — relates to #368 ("Verify deployed SHA/digest before advancing deploy state"). Will file a separate monitoring-gap issue. Recommend closing this issue as **DONE** if `devops-engineer` is acceptable in lieu of minting `ops-automation`; otherwise leave open for the eventual dedicated identity.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/ci
CI/CD pipeline issues
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 platform/go
Go platform test issues
 release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
No Label tier:medium
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees core-devops
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#667
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?