I2964 — Every step that reads a surface into the published snapshot can ask the forge
Give every Pages workflow step that reads the UI or the Cockpit into a snapshot (`web report`) the workflow's token, so that a page which asks GitHub through gh while it is rendered publishes what the forge says instead of the failure to ask, and hold that with a case that reads the workflow.
DONE wave 0 · p0 · implementation profile · parallel safe
Part of development-runtime — The runtime has a development surface.
Objective
Give every Pages workflow step that reads the UI or the Cockpit into a snapshot (`web report`) the workflow's token, so that a page which asks GitHub through gh while it is rendered publishes what the forge says instead of the failure to ask, and hold that with a case that reads the workflow.
Why
Truth sweep 2026-10-18 (f6, S3, verified): the published https://majordomus.dev/cockpit/monitor/ read 'Nothing happened in the last six hours.' beside its own source error 'gh pr failed: ... set the GH_TOKEN environment variable', while PR #1340 and #1356 merged and Pages deployed three times in that window. In .github/workflows/pages.yml the steps 'the forge, observed' and 'the evidence CI recorded' carry GH_TOKEN; 'the UI, read once at this commit' and 'the Cockpit, read once at this commit' carry none.
Current state
The two snapshot read steps run without GH_TOKEN; every page that asks gh while it is read publishes an empty or failed source.
Desired state
Both read steps carry GH_TOKEN; case 3362 refuses a pages.yml in which any step running `web report` lacks it, and proves its own parse by finding a mutated step.
Scope
- .github/workflows/pages.yml
- test/cases/3362_every_snapshot_read_can_ask_the_forge.sh
Dependencies
None. This issue is a root of the graph.
Acceptance criteria
- Every pages.yml step that runs web report carries GH_TOKEN
- Case 3362 fails on a workflow where a snapshot read step lacks it, naming the step
Validation
- majordomus plan validate
Evidence required
- case_every_snapshot_read_can_ask_the_forge
Evidence
| covers | type | command | result | at commit |
|---|---|---|---|---|
| case_every_snapshot_read_can_ask_the_forge | ci | bash test/run.sh 3362_every_snapshot_read_can_ask_the_forge | ok in validate run 39192952944, job suite-shard (1) 117890213706, every job green at master dd4c0a87cba, which contains the fix 3aa828e5bf7 | 9a5a9b7 |
Timeline
- started
- 2026-10-20T15:42:48Z
- verified
- —
- completed
- 2026-10-20T15:43:50Z
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I2964.yaml. Read it back with majordomus plan show I2964.