infra: DEV_MESH_PAT repo secret still not configured — 15 spec:draft/discussing issues blocked on HTTP 403 spec-push

[github-actions]

Observation

#508 ("infra: spec-push circuit-breaker + DEV_MESH_PAT preflight (#431 spec) was never implemented") was closed approved after PR #550 merged. PR #550 implemented Option A from #508 (the circuit-breaker + preflight mechanism in the intake workflow), but Option B — actually configuring the DEV_MESH_PAT repository secret with contents:write — was never done. #508's closure removed the only open tracker for that outstanding manual step, so the gap is currently invisible.

Effect

Every dev-mesh-intake run since (including today, 2026-07-02) still authenticates as the GitHub App installation token (integration/15368), not a PAT — git push, GitHub API ref-creation, and the Contents API all return HTTP 403 "Resource not accessible by integration". The workflow's token: ${{ secrets.DEV_MESH_PAT || secrets.GITHUB_TOKEN }} fallback is silent, so there is no signal other than the eventual 403.

15 open issues are currently blocked on this single secret (spec fully authored and stable in each issue's comment history, unable to push to a spec/issue-<N> branch):

#463, #509, #516, #523, #527, #547, #568, #597, #598, #610, #654, #655, #688, #689, and #690.

Each has independently re-confirmed the same 403 across dozens of workflow runs (#463 alone is on re-authoring attempt 20+) — none of this further probing is adding new information; it is pure waste until the secret exists.

What needs to happen (human action, repo settings — not code)

1. Create a fine-grained PAT scoped to danabaxia/agent_mesh with Contents: Read and write (consider Workflows: Read and write too, since dev-mesh-backlog.yml's Coder role also needs to push under .github/workflows/**).
2. Add it as the DEV_MESH_PAT repository secret: Settings → Secrets and variables → Actions → New repository secret.
3. Re-run one blocked intake workflow (e.g. against [mesh-scan] perf-regression: quality_per_1k_tokens regressed (-17.2%) #463) to confirm the push succeeds and the issue advances to spec:in-review.

Deduplication

• idea: intake workflow needs contents:write for spec file commits — Analyst can't land specs without human handoff #227 — original ask for contents:write, closed.
• intake runtime reliability: spec-push circuit breaker + DEV_MESH_PAT preflight + 529 retry #431 — spec for the circuit-breaker + preflight mechanism, closed done.
• infra: spec-push circuit-breaker + DEV_MESH_PAT preflight (#431 spec) was never implemented — #463 and #498 remain blocked #508 — re-raised the still-blocked state, closed approved after PR fix(intake): circuit breaker, DEV_MESH_PAT preflight, and 529 soft-exit (#508) #550 shipped the mechanism only; Option B (secret configuration) was left undone and untracked.

This issue exists solely to keep Option B visible until it's done — no code or spec follow-up is needed once the secret is configured.

[github-actions]

Analyst sweep (2026-07-02): re-confirmed push: false via gh api repos/danabaxia/agent_mesh --jq '.permissions' — still authenticating as the integration/15368 app install token, not DEV_MESH_PAT. No change since this issue was filed.

Also: #658 and #676 are in the identical tripped-circuit-breaker / HTTP-403 state as the 15 issues listed above but were omitted from that list (they were missing the blocked label, now added). Full affected set is 17: #463, #509, #516, #523, #527, #547, #568, #597, #598, #610, #654, #655, #658, #676, #688, #689, #690.

No further spec-push attempts made this run on any of these — per this issue's own note, repeated probing adds no new information until the secret is configured. Skipping straight to label accuracy only.

[github-actions]

Analyst sweep (2026-07-03): reconfirmed no change — gh api repos/danabaxia/agent_mesh --jq '.permissions' still returns push: false, and gh auth status / git remote -v still show the active token as the integration/15368 GitHub App installation token, not a PAT. Identical to every prior check on this thread.

Checked this run's FIFO top-3 pre-approval candidates (#509, #516, #523) — all still correctly blocked+needs-human, circuit breaker already tripped on each with an escalation comment in place. No re-authoring or re-push attempted (would only reproduce the same 403), and skipped adding redundant per-issue "still blocked" comments since each was already reconfirmed as recently as 2026-07-02. No label changes anywhere. Still waiting on the human step: add a fine-grained PAT (Contents: Read/write, scoped to this repo) as the DEV_MESH_PAT repo secret.

[github-actions]

Analyst sweep (2026-07-03, second pass): drafted and attempted to push a new spec for #783 (web egress audit guard, filed by the analyst-daily-review this morning — not part of the original 17). Push failed with the identical HTTP 403 (push: false, integration/15368 token). #783 now carries blocked + needs-human with its full spec content posted inline, joining the affected set — now 18 issues total: #463, #509, #516, #523, #527, #547, #568, #597, #598, #610, #654, #655, #658, #676, #688, #689, #690, #783.

No change to #509/#516/#523 this pass (already reconfirmed earlier today, see prior comment) — avoiding redundant re-checks on issues where nothing changed.

[github-actions]

Analyst sweep (2026-07-03, third pass): #783 attempt 2 also failed — identical HTTP 403 (push: false, integration/15368 token). Still below the 3-attempt circuit-breaker threshold, so no breaker trip yet on #783; comment posted there with the reconfirmation. No change to the other 17 tracked issues this pass (#463, #509, #516, #523, #527, #547, #568, #597, #598, #610, #654, #655, #658, #676, #688, #689, #690) — all already circuit-broken and correctly parked at needs-human, so skipped re-probing them (no new information to gain until the secret exists).