From 4c9b3f94b196414e7ff25bb6b5e73d8780df2d0f Mon Sep 17 00:00:00 2001
From: mctl-deploy <ci@mctl.ai>
Date: Thu, 30 Apr 2026 22:20:11 +0200
Subject: [PATCH] fix(agents): keep github-token sourced from
 platform/mctl-agents

Revert the explicit data: block introduced by PR #71. The PAT seeded
at platform/mctl-agents has broader repo scope than the bot-identity
PAT at platform/mctl-agent/tokens, and the implementer/docs scanner
need the wider scope.
---
 .../secrets/mctl-agents-secrets.yaml          | 32 ++++++-------------
 1 file changed, 10 insertions(+), 22 deletions(-)

diff --git a/platform-gitops/argo-workflows/secrets/mctl-agents-secrets.yaml b/platform-gitops/argo-workflows/secrets/mctl-agents-secrets.yaml
index c3779eb8e..014732b5e 100644
--- a/platform-gitops/argo-workflows/secrets/mctl-agents-secrets.yaml
+++ b/platform-gitops/argo-workflows/secrets/mctl-agents-secrets.yaml
@@ -6,10 +6,7 @@
 # subscription quotas, no separate billing. See plan §4.3 for tradeoffs +
 # fallback procedure to API key if OAuth ever breaks.
 #
-# Vault paths:
-#   - secret/platform/mctl-agents          (this workflow's own keys)
-#   - secret/platform/mctl-agent/tokens    (shared bot identity — github-token)
-#
+# Vault path: secret/platform/mctl-agents
 # Keys (all optional individually — workflow degrades gracefully):
 #   - claude-code-oauth-token  → CLAUDE_CODE_OAUTH_TOKEN (sk-ant-oat01-...)
 #                                REQUIRED at runtime — workflow can't auth without it.
@@ -18,20 +15,16 @@
 #                                Optional — without it the agents skip mcp__mctl__*
 #                                tools and rely on WebSearch/WebFetch only.
 #   - github-token             → GITHUB_TOKEN (PAT with repo scope on mctlhq/*)
-#                                REQUIRED for the Tier 2 implementer step
-#                                (`gh repo clone` + `gh pr create` against
-#                                private mctlhq sibling repos). Pulled from
-#                                the same Vault path as mctl-agent's bot
-#                                identity so we keep one canonical token —
-#                                rotating mctl-agent's token automatically
-#                                rotates the implementer's too.
+#                                Used by Tier 2 implementer (`gh repo clone` +
+#                                `gh pr create` against private mctlhq sibling
+#                                repos) and by the mctl-docs sibling-scan skill.
+#                                Kept here (NOT pulled from the bot-identity
+#                                Vault path) because this workflow's PAT carries
+#                                broader repo scope than the bot identity does.
 #
-# `dataFrom: extract` pulls whatever subset of keys exists at
-# platform/mctl-agents (claude-oauth, mctl-token). The explicit `data:`
-# block below pulls github-token from the bot-identity path; ESO's default
-# mergePolicy (Replace) means data: entries override anything dataFrom:
-# might pull with the same secretKey, so we cannot accidentally pick up
-# a stale local copy of github-token if one ever lands at platform/mctl-agents.
+# We use `dataFrom: extract` so the ExternalSecret pulls whatever subset of
+# keys exists at platform/mctl-agents. Adding new keys later requires no
+# manifest change — just a `vault kv patch`.
 #
 # Seed via:
 #   claude setup-token   # local; copy printed token
@@ -59,8 +52,3 @@ spec:
   dataFrom:
     - extract:
         key: platform/mctl-agents
-  data:
-    - secretKey: github-token
-      remoteRef:
-        key: platform/mctl-agent/tokens
-        property: github-token