Adam Moussa b51cb94bae fix: carry workflows:write on the standing proxy token ... Complete the half-ported upstream 216cf181 cascade. The port dropped _run_with_workflow_token from the guard but missed the paired github_app change, so an approved .github/workflows push ran with the base token (no workflows:write) and GitHub 403'd it. Add workflows:write to BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS and delete the now-orphaned WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant; update the github_app and proxy_auth tests to match. The HITL approval gate in workflow_push_guard.py is unchanged — this only lets the standing token push once a human approves.		2026-07-09 14:39:21 -04:00
..
repo-conventions	docs: add per-repo AGENTS.md templates for stack-specific conventions (#126)	2026-07-08 16:29:35 -04:00
upstream-sync	fix: carry workflows:write on the standing proxy token	2026-07-09 14:39:21 -04:00