Skip to content
PETROVA

IRINA runs under its own GitHub App, petrova-irina; the WIP cap lists the repos it cannot read

rank: decision outranks: []

Section titled “rank: decision outranks: []”

IRINA runs under its own GitHub App, petrova-irina; the WIP cap lists the repos it cannot read

Section titled “IRINA runs under its own GitHub App, petrova-irina; the WIP cap lists the repos it cannot read”

Date: 2026-11-06 Status: closed Supersedes: docs/decisions/2026-09-15-ir-017-irina-secret-scope-and-retention.md (partial: only its “Secret scope” finding that irina-cycle.yml uses the petrova-act App through PETROVA_APP_ID / PETROVA_APP_PRIVATE_KEY. The ANTHROPIC_API_KEY review and the retention policy stand.) Superseded-by: none — current MR-compliance: MR-4, MR-7

Context

Section titled “Context”

FT-TL-010 (RS-DL-003 Phase B, R-04) asks that IRINA’s writes be told apart from act-verb writes. Decision 2026-09-15 (IR-017) records that irina-cycle.yml reuses petrova-act, “not a credential minted for IRINA”. That stopped being true when the petrova-irina App (id 5213498) was created and its secrets IRINA_APP_ID and IRINA_APP_PRIVATE_KEY were set on this repo on 2026-11-06, and irina-cycle.yml was switched to them (petrova-codes/petrova#614). The two-class landing decision (2026-10-10) that gated the change is closed.

petrova-irina is installed on selected repos only: abacus, fathom, hermes (devarno-cloud), mary (mary-wiki), yao-agent (asgard-codes), kahn (kahn-tools), arno-host (arno-host), petrova (petrova-codes). Permissions: contents, issues, pull_requests write; actions, checks, statuses read; metadata read. No workflows. Of the 44 entries in registry.yaml, 8 are readable by that App and 36 are not (32 on other repos or orgs, 4 with no url).

The fleet WIP cap (IR-001) counts open PETROVA-authored PRs by reading every registry repo with the Apply credential, and skips a repo that errors. Under petrova-act (about 29 installations) that was close to complete. Under petrova-irina it covers 8 of 44, so the count is a floor.

Decision

Section titled “Decision”
  1. irina-cycle.yml authenticates only as petrova-irina. No petrova-act secret is referenced in it, the Apply step sets no PAT, installation-id or key-path variable, and a pin test fails if one returns. A write the App may not make fails and names the permission (IRINA_APP_PERMISSION_MISSING); there is no fallback to petrova-act.
  2. The WIP cap does not fail closed on unreadable repos, because IRINA cannot read every registry repo by design. It makes them visible: the count returns the list of repos it could not read, apply-result.json records it as wip_cap_unread, and the cycle summary prints it with a warning when it is not empty.
  3. petrova-act keeps its grants. No App permission is widened by this change.

Alternatives considered

Section titled “Alternatives considered”
  • Fail the cap closed when any repo is unreadable — it would refuse every apply, since 36 of 44 repos are unreadable by design.
  • Install petrova-irina on every registry repo — widens a write-capable App to the whole fleet to serve a count; not chosen here, and open to the operator.
  • Keep IRINA on petrova-act — leaves IRINA’s writes indistinguishable from act-verb writes, which R-04 exists to end.

Consequences

Section titled “Consequences”

For code:

  • .github/workflows/irina-cycle.yml, host/scripts/irina-apply.mjs, host/scripts/irina-permission-error.mjs, host/src/sources/acts.ts (recentWithUnread), host/src/tools/wip-cap.ts (getWipCapUnread).

For docs:

  • docs/runbooks/secrets-inventory.yaml carries the two IRINA rows.
  • Decision 2026-09-15 is not edited. Read its “Secret scope” section as superseded by this one for the credential identity.

For in-flight phases:

  • RS-DL-003 R-04 closes only after a dispatched run shows petrova-irina as the actor (A1) and the induction fails by name (A2).

For invariants:

  • MR-7: the old decision is superseded forward, not rewritten.

References

Section titled “References”
  • docs/decisions/2026-09-15-ir-017-irina-secret-scope-and-retention.md
  • docs/decisions/2026-10-10-two-class-landing-authority.md
  • devarno-cloud:docs/fleet/FT-TL-010-irina-own-app-identity.ticket.xml
  • petrova-codes/petrova#614

Sign-off

Section titled “Sign-off”
  • Subagent: tl-builder (FT-TL-010 fix round 1, 2026-11-06)
  • Human countersign — IRINA moving to petrova-irina, and the WIP cap listing unread repos rather than failing closed

Countersigned by human:flight@arno.host on 2026-11-06 — box ticked in commit c6cfcce, authored by the human: IRINA moving to petrova-irina, and the WIP cap listing unread repos rather than failing closed. Status flipped open→closed on 2026-11-06 by an agent as scribe (MR-7).