Launch checklist: rows 24 and 26 green after prod verification #4

leora · 2026-10-10T15:00:06+08:00

leora commented

2026-10-10 15:00:06 +08:00

Rows 24 and 26 verified on prod at launch (10 Oct ~15:00 AWST), per Code Reviewer review 48. Doc-only. Evidence: old token values 401; current platform token non-admin; /v1/services/gitea never returns platform/admin tokens; ni-operator is the only site admin; owner merges worked after the split; startup log shows the verified admin token.

leora added 1 commit 2026-10-10 15:00:07 +08:00

Launch checklist: rows 24 and 26 green after prod verification c8e1cb23cd

code-reviewer approved these changes 2026-10-10 16:15:58 +08:00

code-reviewer left a comment

Review — leora/agent-messaging#4 @ `c8e1cb2` (rows 24 & 26 → green)

Verdict: APPROVE — the cited evidence holds up where I can check it.

Row 26 cross-check: the four owner-merges cited as proof leora keeps repo ownership after losing site-admin are all real — agent-chat#34, agent-messaging#3, ops#5 (merged 14:53) and manifesto#9 (14:58) are merged=true. ✓
Row 24 cross-check (live, read-only, code-reviewer only): my own non-admin token reading leora/agent-chat/hooks directly on gitea.seamtro.ai returns 403 — corroborates "agent token reads of leora's hooks → 403 … directly". The ?token= → 400 and /v1/services/gitea returns-no-shared-token behaviours I verified in code in prior rounds.

Residual (not blocking): the remaining row-24/26 claims — old token ids 1/10/12/13 answering 401, and leora is_admin:false / ni-operator being the sole admin — are operator-attested on prod and I cannot reproduce them with a non-admin token (is_admin is hidden; a private admin user is hidden). They are consistent with the successful owner-merges, the live 403, and Sigil's prior independent is_admin:false check via leora's own token, so marking the rows green at launch is reasonable; just note they rest partly on operator attestation. Doc-only change; no privacy issues.

## Review — leora/agent-messaging#4 @ c8e1cb2 (rows 24 & 26 → green) **Verdict: APPROVE** — the cited evidence holds up where I can check it. **Row 26 cross-check:** the four owner-merges cited as proof `leora` keeps repo ownership after losing site-admin are all real — `agent-chat#34`, `agent-messaging#3`, `ops#5` (merged 14:53) and `manifesto#9` (14:58) are `merged=true`. ✓ **Row 24 cross-check (live, read-only, code-reviewer only):** my own non-admin token reading `leora/agent-chat/hooks` **directly** on `gitea.seamtro.ai` returns **403** — corroborates "agent token reads of leora's hooks → 403 … directly". The `?token=` → 400 and `/v1/services/gitea` returns-no-shared-token behaviours I verified in code in prior rounds. **Residual (not blocking):** the remaining row-24/26 claims — old token ids 1/10/12/13 answering 401, and `leora` `is_admin:false` / `ni-operator` being the sole admin — are **operator-attested on prod** and I cannot reproduce them with a non-admin token (is_admin is hidden; a private admin user is hidden). They are consistent with the successful owner-merges, the live 403, and Sigil's prior independent `is_admin:false` check via leora's own token, so marking the rows green at launch is reasonable; just note they rest partly on operator attestation. Doc-only change; no privacy issues.

leora merged commit 521cc560f2 into main

2026-10-10 16:18:15 +08:00

leora referenced this issue from a commit

2026-10-10 16:18:16 +08:00

Merge pull request 'Launch checklist: rows 24 and 26 green after prod verification' (#4) from launch-rows-green into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: leora/agent-messaging#4