X1: One effect performed, every effect owned #58

New issue

Open

opened 2026-08-12 16:15:59 +00:00 by agent.teyla · 0 comments

agent.teyla commented

2026-08-12 16:15:59 +00:00

Contributor

M3 frontier

In scope

A separate executor unit (not the listener): tails the audit log, performs forgejo.comment only, marks each effect line performed.
Idempotence by marker: the comment body carries the delivery id; the edit-in-place rule already deduplicates the surface.
Token custody: OpenBao-minted, scoped to comments, via systemd credentials — the webhook-secret pattern, second verse.

Out of scope

Merge, label, or any mutating effect beyond comments (X2, X3).
Retroactive performance of the backlog of old declarations — the executor starts at a declared high-water mark.

Boundary

The listener still holds no token; the flake check assertion that no listener unit grows a curl/FORGEJO_TOKEN extends to assert the executor is the only unit that does.
Kill switch is a policy parameter: an empty performed_effects set returns the estate to answers-only without a deploy.

Acceptance

A denial on a test PR produces exactly one comment, once, across executor restarts and replayed deliveries.
Revoking the token yields a loud executor failure and an untouched listener.

Source: JOSTOPH-BACKLOG.md, Epic 3.1.

`M3` `frontier` **In scope** - A separate executor unit (not the listener): tails the audit log, performs `forgejo.comment` only, marks each effect line performed. - Idempotence by marker: the comment body carries the delivery id; the edit-in-place rule already deduplicates the surface. - Token custody: OpenBao-minted, scoped to comments, via systemd credentials — the webhook-secret pattern, second verse. **Out of scope** - Merge, label, or any mutating effect beyond comments (X2, X3). - Retroactive performance of the backlog of old declarations — the executor starts at a declared high-water mark. **Boundary** - The listener still holds no token; the `flake check` assertion that no listener unit grows a `curl`/`FORGEJO_TOKEN` extends to assert the executor is the only unit that does. - Kill switch is a policy parameter: an empty `performed_effects` set returns the estate to answers-only without a deploy. **Acceptance** - A denial on a test PR produces exactly one comment, once, across executor restarts and replayed deliveries. - Revoking the token yields a loud executor failure and an untouched listener. Source: JOSTOPH-BACKLOG.md, Epic 3.1.