Operator closeout: GH_TOKEN probe, conditional bot-PAT rollout, 10-account stub sweep

[kyle-sexton]

Final three operator-only steps of the cloud-env-fleet effort (everything else is done and merged: 12-target sync fleet converged, attest green at run 32294218834). All three need account-owner UI access, so this issue is portable to any machine.

Protocol: work the checklist here, then report results back in the driving Claude Code session — it records the probe verdict in the knowledge corpus and closes this issue. Autonomous sessions: needs-human — do not resolve.

Step 1 — GH_TOKEN live probe (~10 min, one account)

Decides whether Step 2 happens. Question: does a custom GH_TOKEN get cross-repo REST in a cloud session, or does the GitHub proxy still pin it?

• Mint test PAT at https://github.com/settings/personal-access-tokens/new: name gh-token-probe-temp · resource owner melodic-software · expiry 7 days · Only select repositories → standards only · Repository permissions: Contents: Read-only (Metadata auto). Approve at https://github.com/organizations/melodic-software/settings/personal-access-token-requests if prompted.

• In ONE claude.ai account: https://claude.ai/code → environment selector → create new environment gh-token-probe (do NOT touch Default) → Environment variables → GH_TOKEN = the test PAT → save. (No secrets store: any session in this env can read it — that is why it is throwaway.)

• Start a session in that env on claude-code-plugins; first message:

  Run these and show raw output:
  gh api user -q .login
  gh api repos/melodic-software/standards -q .full_name
  gh api graphql -f query='{viewer{login}}'
  

• Read the verdict:

  • Line 1 → your GitHub login = token reaches GitHub as itself; a proxy identity/error = proxy swallowed it.
  • Line 2 is the verdict (standards is NOT attached to the session): melodic-software/standards = cross-repo REST works → do Step 2. HTTP 403/blocked = proxy pins REST → skip Step 2 entirely, fleet keeps the proxy default.
  • Line 3 → expect 403 (documented pinned-GraphQL allowlist). If it succeeds, note it — that contradicts the docs and the corpus wants to know.

• Cleanup (regardless of outcome): delete the gh-token-probe environment; revoke the PAT at https://github.com/settings/tokens?type=beta.

• Record the three raw outputs below in a comment (or bring them back to the session).

Step 2 — bot-PAT rollout (ONLY if Step 1 line 2 succeeded, ~15 min)

• Mint the real PAT at https://github.com/settings/personal-access-tokens/new: name claude-cloud-autonomy-bot · resource owner melodic-software · expiry 90 days (calendar the rotation) · Only select repositories → the 12 sync-fleet repos · Repository permissions: Contents: R/W · Pull requests: R/W · Issues: R/W (Metadata auto) · zero organization permissions (hard rule from the ratified decision).
• In each autonomy account only: https://claude.ai/code → environment selector → edit Default → Environment variables → GH_TOKEN = the PAT → save. Non-autonomy accounts get NO variable (they stay on the proxy default).
• Accepted trade-offs (already ratified, restated so nobody re-litigates mid-rollout): env values readable by any session in the env; permission prompts are governed by auto-mode/permissions, not the PAT.

Step 3 — stub sweep, all 10 accounts (~2 min each)

Per prompts/cloud-bootstrap-rollout.md Part 2 in this repo. Per account: https://claude.ai/code → environment selector → edit Default:

• Setup script byte-identical to the canonical stub — when in doubt select-all and paste over (saving forces a cache rebuild, harmless, and picks up the latest standards component):

  #!/bin/bash
  curl -fsSL https://raw.githubusercontent.com/melodic-software/standards/main/components/cloud-environment/setup.sh \
    -o /tmp/melodic-env-setup.sh && bash /tmp/melodic-env-setup.sh
  exit 0

• Network access: All (operator decision 2026-08-22, supersedes the Custom + 4-host recipe). Rationale: the allowlist is an exfiltration control whose Custom default already opens publish-capable package registries; the GitHub proxy, MCP connector traffic, and the Anthropic API bypass the access level at every setting; and a blocked host mid-session kills the session until an env edit + cache rebuild. "All" removes that failure class, including the dot.net special case (Melodic cloud environment verification results (2026-08-14) #2654 Blocker 1 is moot under All). If an account ever handles sensitive material, drop that one account back to Custom.

• Environment variables: none — for every account (the Step-2 GH_TOKEN exception died with the probe verdict).

• Verify: fresh session on claude-code-plugins in that account, FIRST message exactly /claude-config:audit. Resolves = plugins live at turn one = account green.

• Failure triage, in order: ls /opt/melodic-env-setup.done missing → interrupted cache build (Melodic cloud environment verification results (2026-08-14) #2654 Blocker 2) → trivial script edit + save → rebuild → retry · cat /var/log/melodic-env-setup.log shows what the build did · "Unknown command" with populated ~/.claude/plugins/installed_plugins.json → known harness residual cloud sessions: slash commands for bootstrap-installed plugins unresolved at session start ("Unknown command") #2733 → resume the session (not a config error).

Account checklist:

• account 1
• account 2
• account 3
• account 4
• account 5
• account 6
• account 7
• account 8
• account 9
• account 10

Context

• Decision provenance: cloud-fleet-knowledge-graduation interview + adversarial audit, 2026-08-19 (operator machine, .work/cloud-fleet-knowledge-graduation/shared-understanding.md).
• Related: knowledge plugin: publisher-profile amendment bundle from the 9-slice cloud-fleet corpus run #3014, knowledge plugin: docpage-digest pipeline hardening (fence mandate, standing gates, freeze/pin rules, fallback ladder) #3015 (same batch, agent lanes), feat(distribution): Phase 4 fleet expansion — three new sync targets standards#428 / source-control: no read/consume-only posture — "safe" babysit tier and pull-request monitor write to GitHub autonomously #440, melodic-software/github-iac#337 / feat(naming): research-backed criteria, structured briefs, rejection protocol (0.2.0) #341.

[kyle-sexton]

Step 1 probe results — 2026-08-20

Probe ran in a cloud session on claude-code-plugins (session's GitHub scope at probe time: melodic-software/codex-plugins only; standards deliberately NOT attached).

Environment note that affects reading line 1: gh is not preinstalled in cloud sessions — the probe session downloaded the gh v2.86.0 release binary mid-session (works fine, no root needed). A GH_TOKEN env var was present in the session environment.

Raw outputs

Line 1 — gh api user -q .login:

kyle-sexton

Line 2 — gh api repos/melodic-software/standards -q .full_name:

{"message":"GitHub access to this repository is not enabled for this session. Use add_repo to request access. If add_repo answers that read access is already available and you need GitHub API or write access, call add_repo again with access:\"push\" to attach the repository with credentials.","documentation_url":"https://docs.anthropic.com/en/docs/claude-code/github-actions"}
gh: ... (HTTP 403)

Line 3 — gh api graphql -f query='{viewer{login}}':

{"message":"This GraphQL query is not enabled for this session — only the pinned set of PR-review operations is served. Use REST via `gh api repos/{owner}/{repo}/...` instead.","documentation_url":"https://docs.anthropic.com/en/docs/claude-code/github-actions"}
gh: ... (HTTP 403)

Verdict

• Line 2 = HTTP 403 from the proxy → cross-repo REST is pinned → SKIP Step 2 entirely. The fleet keeps the proxy default; no bot-PAT rollout. The 403 body is proxy-authored (it references the session-side add_repo tool), i.e. the proxy enforces the session's repo attachment set regardless of what credential is in GH_TOKEN.
• Line 1 returned the real login kyle-sexton, so identity//user requests do resolve as the user rather than a proxy identity — but that did not extend to cross-repo REST (see line 2), so it changes nothing about the verdict.
• Line 3 = 403 with the documented pinned-GraphQL-allowlist message — matches the docs, nothing to flag for the corpus.

Corroborating observation

Immediately after the probe, melodic-software/claude-code-plugins was attached to the same session via add_repo with access: "push" — and REST against it (issue read, this comment) then worked. Access is granted per-session by proxy attachment, not by the token, which is consistent with the line 2 verdict.

Remaining for operator

• Cleanup: delete the gh-token-probe environment; revoke the gh-token-probe-temp PAT.
• Report back to the driving session to record the verdict in the knowledge corpus and close this issue (labeled needs-human — leaving it open).

---

Generated by Claude Code

[kyle-sexton]

Follow-up: sharpened probe finding — the proxy discards GH_TOKEN entirely (verdict unchanged: skip Step 2, now definitive).

A second run of the probe in the same session produced additional evidence that corrects one reading from the earlier comment.

New evidence. Confirmed the session's GH_TOKEN is the custom fine-grained PAT (verified by github_pat_ prefix match without printing the value), then re-ran the probe plus a contrast call against a repo attached to the session mid-conversation via add_repo:

1. gh api user -q .login                              → kyle-sexton (exit 0)
2. gh api repos/melodic-software/standards            → HTTP 403 proxy error (exit 1)
3. gh api graphql -f query='{viewer{login}}'          → HTTP 403 pinned-GraphQL allowlist (exit 1)
4. gh api repos/melodic-software/claude-code-plugins  → melodic-software/claude-code-plugins (exit 0)

The inversion is the proof. The test PAT is scoped to standards only (Contents: Read). Yet:

• Call 2 failed on standards — the only repo the PAT can access.
• Call 4 succeeded on claude-code-plugins — a repo the PAT has zero permissions on (the PAT also has no Issues access, yet this session posted issue comments).

A PAT actually reaching GitHub would produce exactly the opposite pattern. Conclusion: the TLS-intercepting agent proxy (the custom CA bundle in the env) strips the Authorization header and substitutes its own per-session credential. The env var is delivered to the session intact, but never reaches GitHub.

Correction to the earlier line-1 reading. kyle-sexton on line 1 is the proxy's session credential resolving to the account's GitHub connection identity — not the PAT "reaching GitHub as itself." Line 1 is therefore not diagnostic either way.

Implications for the checklist:

• Step 2 (bot-PAT rollout): skip, definitively. A GH_TOKEN PAT in any cloud environment is dead weight — access is governed purely by per-session repo attachment (add_repo), which sessions can invoke on demand, bounded by the account's GitHub connection authorization.
• Line 3 matches the documented pinned-GraphQL allowlist; no docs contradiction to record.
• Env-var delivery itself works fine — the pattern remains useful for non-GitHub secrets, with the caveat that HTTPS to proxy-intercepted hosts transits the proxy.
• Cleanup as planned: the probe env and PAT serve no further purpose; delete/revoke.

---

Generated by Claude Code

[kyle-sexton]

Verdict accepted and recorded by the driving session (2026-08-20): decision record, fleet handoff, and the cloud-environments corpus slice all updated — the slice's GitHub-proxy row is annotated from token-restriction to token-stripping (Authorization header discarded; per-session add_repo attachment governs access). Step 2 formally SKIPPED — the bot-PAT branch of the ratified GH_TOKEN decision is dead; the fleet keeps the proxy default and no GitHub secret enters any environment's variables. Remaining before close: operator cleanup (delete gh-token-probe env, revoke gh-token-probe-temp PAT) and Step 3, the 10-account stub sweep.

[kyle-sexton]

Step 3 network guidance updated by operator decision (2026-08-22): All network access on every account, superseding Custom + the 4 dotnet hosts. Rationale in the edited body. Env vars: none, all accounts.

[kyle-sexton]

Closed complete (2026-08-23). Step 1: probe run, verdict recorded (proxy strips GH_TOKEN; add_repo attachment governs), cleanup done. Step 2: skipped definitively — no PAT rollout, proxy default fleet-wide. Step 3: all 10 accounts swept under the amended recipe (canonical stub byte-identical, network All per the 2026-08-22 operator decision, env vars none) and verified via first-message plugin slash commands resolving at turn one — pre-launch install confirmed end to end fleet-wide. This closes the last open item of the cloud-env-fleet effort: 12-target sync fleet converged and attested, plugins live at turn one on every account, zero secrets in any environment. Follow-on value work (scheduled routines / cloud-agent lane layout across the 10 accounts) is a separate future effort; privileged-GitHub-autonomy research is archived in the operator's decision records with all options deferred.