feat(paw): wire genesis_token so Paw agents can push to Genesis - #400
Open
rita-aga wants to merge 1 commit into
Open
feat(paw): wire genesis_token so Paw agents can push to Genesis#400rita-aga wants to merge 1 commit into
rita-aga wants to merge 1 commit into
Conversation
Genesis (ADR-0025) requires auth on git push; Paw agents had no Genesis credential (only a github_token pattern), so publishes failed with "could not read Username". Load GENESIS_TOKEN env into the secret vault as genesis_token (mirrors github_token), expose it in the setup secrets schema, and document the Genesis push pattern in the paw-agent skill (token supplied as the Basic-auth username). The broad fleet GitToken (gt-paw-agent) is already minted + verified on Genesis; its secret is the GENESIS_TOKEN env on openpaw. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
rita-aga
marked this pull request as ready for review
June 15, 2026 22:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Wires the Paw agents' Genesis push credential so they can publish/update app bundles to the Genesis registry.
Why
Genesis (ADR-0025) requires auth on
git push— an anonymous push fails withcould not read Username, which is exactly what blocked a Paw agent from publishing to Genesis. Agents had no Genesis credential: the only documented git pattern was the GitHub one (temper.get_secret("github_token")embedded in the URL), with no Genesis equivalent and nogenesis_tokensecret.A broad, revocable fleet
GitToken(gt-paw-agent, scopesrepo:read,repo:write,pr:write,pr:merge,admin:repos— push/edit any repo and create new apps; noforce/admin:tokens) is already minted on Genesis and verified with a real push. Its secret is stored as the openpaw env varGENESIS_TOKEN. This PR makes openpaw seed that into the secret vault and teaches agents to use it.Changes
config.rs— newgenesis_tokenfield, loaded fromGENESIS_TOKENenv (mirrorsgithub_token/GITHUB_TOKEN).startup.rs—seed_secret!(… "genesis_token" …)sotemper.get_secret("genesis_token")resolves the seeded value.setup_api.rs—genesis_tokenadded to the allowed-secret-keys set and the setup secrets schema (Integrations).temperpaw-agent/SKILL.md) — adds the "Pushing app bundles to Genesis" pattern: supply the token as the Basic-auth username (git push https://{genesis_token}@<genesis-host>/<owner>/<repo>.git).genesis_token_is_a_known_integration_secretasserts it's in both the allowed keys and the schema.Verification
cargo test -p temperpaw genesis_token_is_a_known_integration_secret— green.gt-paw-agenttoken was verified end-to-end against prod Genesis (receive-pack 401→200; real push to a throwaway repo succeeded, then archived).GENESIS_TOKENalready set), a Paw agent can publish/update a Genesis app end-to-end.Companion
Genesis bundle-serving fix that unblocked installs: nerdsane/temper#307 + arni-labs/genesis#29 (already deployed + verified).