announce-ceremony: the proxy-injected credential lacks actions: write — establish whether that grant is ours to make

[bdelanghe]

Follow-up to #394, which fixed a different defect and is now closed. Split out because #394's title named the 401, and that is no longer what fails.

Where it stands

#395 (merged, eccc232) stopped claim-ceremony.mjs sending the proxy-injected sentinel and routed its dispatch through HTTPS_PROXY. The 401 is gone. What is left is a permission, measured on the merged script at 2026-09-10 01:25 UTC in a session with .github attached:

probe	answer
announceCeremony(...), live env	{"announced":false,"reason":"dispatch answered HTTP 403"}
POST .../announce-ceremony.yml/dispatches through the proxy, no Authorization header	HTTP 403
X-Accepted-Github-Permissions on that 403	actions=write
JSON message	Resource not accessible by integration

The proxy tunnels the request (200 Connection Established) and GitHub refuses it. This reproduces the 2026-08-31 reading on the fixed script.

What the credential is, as far as a session can tell

probe	answer
GET /user	200, login bdelanghe
X-Oauth-Scopes	empty
X-Accepted-Github-Permissions on /user	allows_permissionless_access=true
X-Ratelimit-Limit	15000
GET /repos/bounded-systems/.github/installation	401, needs an App JWT
GET /user/installations, GET /orgs/bounded-systems/installations	403 from the proxy: sessions are bound to their configured repositories
GET .../actions/workflows	200, so actions: read is granted

Reading: a GitHub App user-to-server token, repo-scoped and issued by the Claude Code egress proxy. The app cannot be named from inside a session, because the proxy blocks every installation-listing path.

The open question

Whether actions: write for that credential is grantable by an org admin, or whether it sits in a permission set the org does not control. An App's installation can only grant permissions the App requests, so this turns on which App the proxy issues for and what it asks for. That is answerable from outside a session (org settings, the installed-Apps list) and not from inside one.

Contrast that fixes the shape: the credential behind a session's GitHub MCP tool dispatched the same workflow with the same inputs and got 204 (run 34421913810). Two credentials, two grants.

Until then

A session announces by hand: dispatch announce-ceremony.yml with its GitHub tool, using the title/body/url the script prints on refusal. The script prints those only when its own dispatch was refused, so the hand-off text is correct as merged. No code change is pending on this.

Unclaimed. Refs #305, #394, #395.