Summary
On GitHub, hive's agents never hold a credential: a wrapper ahead of gh on
PATH and a git credential helper inject short-lived GitHub App installation
tokens, minted per agent and scoped to that agent's ACMM tier (the
capability-maturity level that decides whether an agent may only advise, open
issues, or open and merge PRs). Gitea has no App or installation-token
concept, so before any Gitea write path can be built, the series needs a
decided, written-down answer to "what is the credential, who holds it, and
how does it reach a request". This task produces that answer as an ADR.
Part of #6167 (Gitea forge support series).
Proposal to evaluate (from the tracker)
One dedicated bot account per Gitea instance, plus a small set of
operator-created scoped access tokens (Gitea ≥1.20) mapped to ACMM tiers:
| ACMM mode |
Token scopes |
| advisory |
read-only |
| issues-only |
+ write:issue |
| PR-capable / merge |
+ write:repository |
The hive selects the tier token per agent mode and injects it server-side —
agents still never see a credential. Two injection candidates to decide
between: the existing MITM egress proxy (register the Gitea host the way GHE
hosts are registered, add Gitea-shaped rules) versus request-path-only
injection (watchers + credential helper), leaving agent-side reads to a
separate decision.
Evidence to gather before deciding
- What the egress gate actually does today with agent-UID traffic to a
non-allowlisted host: tunnel, block, or MITM-without-rules. Empirical, from
an agent UID inside a live container — not from the container's default
user, whose path differs.
- Whether the MITM CA trust chain covers a non-GitHub host cleanly for every
agent CLI in use.
- What
git push needs: confirm git-credential-hive.sh can serve a static
tier token for a configured Gitea host without disturbing the GitHub path.
- Agent read access: proxy-injected plain HTTPS, a minimal read CLI, or
tea — pick one and say why the others lose.
Deliverable / definition of done
An ADR under src/docs/adr/ (PR), stating the decided model, the tier→scope
table, the injection mechanism, token rotation/storage expectations for
operators, and explicitly what is out of scope (no minted short-lived tokens,
no per-agent bot accounts unless the evidence forces them). No behavior
change in the PR itself.
Model / effort
Planned execution: Claude Fable 5 at max effort for the design decision
and ADR; the empirical probing sub-steps (egress-gate behavior from an agent
UID, CA-trust checks) run as Opus 5 / xhigh steps or low-effort subagent
sweeps feeding the max-effort synthesis.
Summary
On GitHub, hive's agents never hold a credential: a wrapper ahead of
ghonPATH and a git credential helper inject short-lived GitHub App installation
tokens, minted per agent and scoped to that agent's ACMM tier (the
capability-maturity level that decides whether an agent may only advise, open
issues, or open and merge PRs). Gitea has no App or installation-token
concept, so before any Gitea write path can be built, the series needs a
decided, written-down answer to "what is the credential, who holds it, and
how does it reach a request". This task produces that answer as an ADR.
Part of #6167 (Gitea forge support series).
Proposal to evaluate (from the tracker)
One dedicated bot account per Gitea instance, plus a small set of
operator-created scoped access tokens (Gitea ≥1.20) mapped to ACMM tiers:
write:issuewrite:repositoryThe hive selects the tier token per agent mode and injects it server-side —
agents still never see a credential. Two injection candidates to decide
between: the existing MITM egress proxy (register the Gitea host the way GHE
hosts are registered, add Gitea-shaped rules) versus request-path-only
injection (watchers + credential helper), leaving agent-side reads to a
separate decision.
Evidence to gather before deciding
non-allowlisted host: tunnel, block, or MITM-without-rules. Empirical, from
an agent UID inside a live container — not from the container's default
user, whose path differs.
agent CLI in use.
git pushneeds: confirmgit-credential-hive.shcan serve a statictier token for a configured Gitea host without disturbing the GitHub path.
tea— pick one and say why the others lose.Deliverable / definition of done
An ADR under
src/docs/adr/(PR), stating the decided model, the tier→scopetable, the injection mechanism, token rotation/storage expectations for
operators, and explicitly what is out of scope (no minted short-lived tokens,
no per-agent bot accounts unless the evidence forces them). No behavior
change in the PR itself.
Model / effort
Planned execution: Claude Fable 5 at max effort for the design decision
and ADR; the empirical probing sub-steps (egress-gate behavior from an agent
UID, CA-trust checks) run as Opus 5 / xhigh steps or low-effort subagent
sweeps feeding the max-effort synthesis.