feat(binjovi): track binjovi-claude-code as a GitOps registrar Job #699

Merged

binjovi-bot merged 1 commit from feat/claude-code-oauth-registrar into trunk

2026-09-13 12:21:34 +00:00

sean commented

2026-09-13 12:09:49 +00:00

Owner

Summary

binjovi-claude-code (this session's own MCP OAuth client: authorization_code + refresh_token, public, loopback redirect) was registered by hand directly against Hydra's admin API and had no manifest anywhere in this repo, unlike every other Hydra client in the fleet (argocd, forgejo, the release CLI, the companion agents), each a tracked idempotent registrar Job.

Its live scope was also missing binjovi.repository.create, even though the BINJOVI_MCP_POLICY binding for identity {namespace: ory, name: sean} already grants it (sean/binjovi manifests/workload.yaml) — a client's registered scope is the ceiling on what any token it issues can ever carry, independent of what the policy grants. Patched the live client directly to add the scope and unblock the current session, then wrote this Job so the registration itself stops being untracked and self-heals on the daily Job re-converge.

Test plan

bash tests/binjovi.sh — green
tests/run-all.sh (full local run) — the only failures are pre-existing/environmental (no local docker, no direct network path to cluster hostnames, a stale GITHUB_TOKEN), none touch the changed files

https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

## Summary `binjovi-claude-code` (this session's own MCP OAuth client: `authorization_code` + `refresh_token`, public, loopback redirect) was registered by hand directly against Hydra's admin API and had no manifest anywhere in this repo, unlike every other Hydra client in the fleet (argocd, forgejo, the release CLI, the companion agents), each a tracked idempotent registrar Job. Its live scope was also missing `binjovi.repository.create`, even though the `BINJOVI_MCP_POLICY` binding for identity `{namespace: ory, name: sean}` already grants it (`sean/binjovi` `manifests/workload.yaml`) — a client's registered scope is the ceiling on what any token it issues can ever carry, independent of what the policy grants. Patched the live client directly to add the scope and unblock the current session, then wrote this Job so the registration itself stops being untracked and self-heals on the daily Job re-converge. ## Test plan - [x] `bash tests/binjovi.sh` — green - [x] `tests/run-all.sh` (full local run) — the only failures are pre-existing/environmental (no local `docker`, no direct network path to cluster hostnames, a stale `GITHUB_TOKEN`), none touch the changed files https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

sean added 1 commit

2026-09-13 12:09:49 +00:00

feat(binjovi): track binjovi-claude-code as a GitOps registrar Job

binjovi/ci Binjovi completed the frozen plan

Details

bc826be55f

binjovi-claude-code (this session's own MCP OAuth client: authorization_code
+ refresh_token, public, loopback redirect) was registered by hand directly
against Hydra's admin API and had no manifest anywhere in this repo, unlike
every other Hydra client in the fleet (argocd, forgejo, the release CLI, the
companion agents), each a tracked idempotent registrar Job.

Its live scope was also missing binjovi.repository.create, even though the
BINJOVI_MCP_POLICY binding for identity {namespace: ory, name: sean} already
grants it (sean/binjovi manifests/workload.yaml) — a client's registered
scope is the ceiling on what any token it issues can ever carry, independent
of what the policy grants. Patched the live client directly to add the scope
and unblock the current session, then wrote this Job so the registration
itself stops being untracked and self-heals on the daily Job re-converge.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

sean changed target branch from main to trunk

2026-09-13 12:16:34 +00:00