fix(binjovi): grant the legacy read for hermes #590

Merged

binjovi-bot merged 1 commit from fix/hermes-legacy-read into trunk

2026-09-10 18:19:17 +00:00

sean commented

2026-09-10 18:18:33 +00:00

Owner

The forgejorepositories grant listed 40 names against 41 ForgejoRepositoryBindings, and hermes was the missing one.

Measured, not guessed — the binding legacy names and the grant were compared directly:

rbac: 40 | bindings: 41
in bindings, MISSING from rbac: ['hermes']
in rbac, not in bindings: []

Why it matters

The grant is resourceNames-scoped, so a missing name does not read as "no legacy controller present" — it reads as denied. Adoption then fails looking like a permission fault rather than a live CR, which is precisely the distinction legacy_absent exists to make.

This is the same defect that stopped every Codeberg mirror create until the forgejopushmirrors rule landed in #588. That one I caused; this one was already latent and would have surfaced the next time anyone tried to adopt hermes.

Guard

Now asserts 41, and names the four legacy aliases that differ from their repository name — ibmi-examples, platform-seanfarm-gitops, seanfarm-gitops, zerotierone — plus hermes. A typo in an alias now fails as loudly as a missing entry, which a bare count would not catch.

The list cannot be derived from repository-bootstrap.json here: those are repository names, these are CR names, and the binding list lives in sean/binjovi.

Both controls confirmed red before this landed:

hermes removed again -> fails on the count
one alias renamed to zerotierone-typo -> fails on the alias assertion

Passing: binjovi-repository-bootstrap, binjovi-service-handoff, binjovi-collaborator-bootstrap, binjovi.

https://claude.ai/code/session_01TdW5FSvRJW8CtGnpd29Xp8

The `forgejorepositories` grant listed **40 names against 41 `ForgejoRepositoryBindings`**, and `hermes` was the missing one. Measured, not guessed — the binding legacy names and the grant were compared directly: ``` rbac: 40 | bindings: 41 in bindings, MISSING from rbac: ['hermes'] in rbac, not in bindings: [] ``` ## Why it matters The grant is `resourceNames`-scoped, so a missing name does **not** read as "no legacy controller present" — it reads as **denied**. Adoption then fails looking like a permission fault rather than a live CR, which is precisely the distinction `legacy_absent` exists to make. This is the same defect that stopped every Codeberg mirror create until the `forgejopushmirrors` rule landed in #588. That one I caused; this one was already latent and would have surfaced the next time anyone tried to adopt `hermes`. ## Guard Now asserts 41, and names the four legacy aliases that differ from their repository name — `ibmi-examples`, `platform-seanfarm-gitops`, `seanfarm-gitops`, `zerotierone` — plus `hermes`. A typo in an alias now fails as loudly as a missing entry, which a bare count would not catch. The list cannot be derived from `repository-bootstrap.json` here: those are repository names, these are CR names, and the binding list lives in `sean/binjovi`. Both controls confirmed red before this landed: - `hermes` removed again -> fails on the count - one alias renamed to `zerotierone-typo` -> fails on the alias assertion Passing: `binjovi-repository-bootstrap`, `binjovi-service-handoff`, `binjovi-collaborator-bootstrap`, `binjovi`. https://claude.ai/code/session_01TdW5FSvRJW8CtGnpd29Xp8

sean added 1 commit

2026-09-10 18:18:33 +00:00

fix(binjovi): grant the legacy read for hermes

binjovi/ci Binjovi completed the frozen plan

Details

234306137f

The `forgejorepositories` grant listed 40 names against 41
`ForgejoRepositoryBindings`, and `hermes` was the missing one. Measured, not
guessed: the binding legacy names and the grant were compared directly, and the
difference is exactly `['hermes']` in one direction and empty in the other.

WHY IT MATTERS. The grant is resourceNames-scoped, so a missing name does not
read as "no legacy controller present". It reads as DENIED. Adoption then fails
looking like a permission fault rather than a live CR, which is the one
distinction `legacy_absent` exists to make. This is the same defect that stopped
every codeberg mirror create until the `forgejopushmirrors` rule landed; this one
was already latent.

The guard now asserts 41 and names the four legacy aliases that differ from their
repository name (`ibmi-examples`, `platform-seanfarm-gitops`, `seanfarm-gitops`,
`zerotierone`) plus `hermes`, so a typo in an alias fails as loudly as a missing
entry. The list cannot be derived from `repository-bootstrap.json` here because
these are CR names, not repository names, and the binding list lives in
`sean/binjovi`.

Both controls confirmed red: hermes removed again, and one alias renamed.

Claude-Session: https://claude.ai/code/session_01TdW5FSvRJW8CtGnpd29Xp8

binjovi-bot merged commit 234306137f into trunk

2026-09-10 18:19:17 +00:00

binjovi-bot deleted branch fix/hermes-legacy-read

2026-09-10 18:19:17 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!590

No description provided.

Rows
Columns