Skip to content
PETROVA

IR-017 — IRINA secret-scope review + cycle-artifact/history retention policy

Date: 2026-09-15 Status: closed Supersedes: none Superseded-by: none — current

Context

Section titled “Context”

irina/tickets/IR-017-secret-scope-and-audit-retention.xml (split from IR-011) asks for a deliberate review of what irina-cycle.yml’s two secrets actually grant beyond its own use, and a retention decision for cycle artifacts and the trend history IR-013 added. Both are explicitly human-ruling-required — this doc is a proposal for countersign, same pattern as every other human-ruling-required decision this session, not a self-ratification.

Secret scope — what’s verifiable from this repo, and what isn’t

Section titled “Secret scope — what’s verifiable from this repo, and what isn’t”

PETROVA_APP_ID / PETROVA_APP_PRIVATE_KEY. Verifiable facts:

  • This is not a credential minted for IRINA. It’s the same petrova-act GitHub App every other workflow in this repo already uses (state-sweep.yml, sync-docs.yml, wip-cap-e2e.yml, multi-owner-app-auth-e2e.yml) — irina-cycle.yml adds a caller, it does not widen what the credential itself can do.
  • Per docs/decisions/2026-05-13-petrova-baseline-v1.md, the App was installed on 29 installations across multiple GitHub orgs as of 2026-05-13 (the fleet has grown since), and explicitly lacks workflows:write — confirmed the one standing platform-level PREVENT primitive irina/SYNTHESIS.md §1.2 names. Its repository permissions (contents, pull-requests) let it read and open PRs on every repo it’s installed on — verified live this session (irina/tickets/IR-010-cross-repo-app-auth-load-test.xml, host/tests-e2e/multi-owner-app-auth.test.ts): a single devarno-cloud installation token reads hermes, airlock, and hatch — repos registry.yaml doesn’t even list.
  • What this means for irina-cycle.yml specifically: the App’s own blast radius is fleet-wide by design (every installed repo), but irina-cycle.yml’s own usage of it is narrower than the credential itself allows — reads limited to resolve-target-repos.mjs’s registry-derived list, real writes limited to hermes only (IR-004). A leaked copy of this secret from irina-cycle.yml’s logs/environment would not grant anything beyond what every other workflow already exposes it to — this is a pre-existing fleet-wide exposure, not a new one IRINA introduces.

ANTHROPIC_API_KEY. Verifiable facts: used only by irina-cycle.yml in this repo (grep confirms no other workflow references it). Not verifiable from this repo: the key’s actual account-level scope, whether it’s shared with any other workflow/service outside this repo’s .github/workflows/, and whether spend/rate limits are configured on the Anthropic account side. IR-016’s per-cycle $2.00 cost ceiling (docs/decisions/ — merged, .github/workflows/irina-cycle.yml) is an in-workflow mitigation for one specific failure mode (a runaway single cycle), not a substitute for an account-level spend cap, which this repo has no visibility into and cannot verify.

Recommendation (not ratified by this doc alone — needs your determination): no App-permission change proposed (the App’s own scope is fleet-wide by design, already reviewed and accepted per the baseline decision cited above). For ANTHROPIC_API_KEY, recommend confirming directly in the Anthropic console (outside this repo’s visibility) that an account-level spend limit exists independent of IR-016’s in-workflow ceiling — this doc cannot confirm that from here.

Retention

Section titled “Retention”

Cycle artifacts (diagnose.json, diagnose-findings.json, drain-time.json, per matrix leg): already retention-days: 90 via actions/upload-artifact, set when irina-cycle.yml first shipped. Proposed: keep as-is. 90 days covers debugging any specific run without needing to go further back — the durable trend (IR-013) doesn’t depend on artifact retention at all.

irina/history/drain-time-history.jsonl (IR-013, committed to git, appended weekly per qualifying repo): currently has no retention policy — it grows forever, by construction, since it’s a git-tracked file. At today’s ~5 repos × weekly cadence, that’s roughly 260 lines/year — small for years. Proposed: no active pruning now (the data is cheap and the whole point of IR-013 was durability past artifact expiry); revisit if the file exceeds roughly 5,000 lines or becomes large enough that git history/clone cost is worth naming as a tradeoff — not scheduled or automated by this doc, a future decision if that threshold is actually reached.

Audit trail (job logs, the generic scheduled-workflow-digest.yml scan’s own visibility window): unchanged — GitHub’s own default Actions log retention (typically 90 days) applies; not something this repo configures per-workflow today, and this doc does not propose changing that default.

What this does NOT do

Section titled “What this does NOT do”
  • Does not request or make any GitHub App permission change.
  • Does not configure an Anthropic account-level spend cap — outside this repo’s reach; named as a recommendation only.
  • Does not implement IR-013’s storage mechanism (already shipped) — only states the retention policy it should be read as honoring.

References

Section titled “References”
  • irina/tickets/IR-017-secret-scope-and-audit-retention.xml
  • docs/decisions/2026-05-13-petrova-baseline-v1.md (App installation count, missing workflows:write)
  • irina/tickets/IR-010-cross-repo-app-auth-load-test.xml, host/tests-e2e/multi-owner-app-auth.test.ts (live multi-owner App-auth proof this session)
  • irina/tickets/IR-016-cycle-cost-ceiling.xml, .github/workflows/irina-cycle.yml (per-cycle cost ceiling)
  • irina/history/drain-time-history.jsonl, .github/workflows/irina-cycle.yml

Sign-off

Section titled “Sign-off”

Countersigned by human:alex@devarno.com on 2026-09-15 — commit 612737cd (this file’s creation commit) is authored by the human directly, per docs/decisions/2026-09-05-proxy-countersign-retired.md’s post-retirement definition. Line added retroactively by the agent as scribe.