From 97a4eafbd0e7e414c6a65d0708a61e5664302f64 Mon Sep 17 00:00:00 2001
From: Danil Pismenny <dapi@users.noreply.github.com>
Date: Mon, 27 Jul 2026 13:34:59 +0300
Subject: [PATCH 1/3] fix: isolate Symphony GitHub token

---
 docs/symphony-github-issues.md | 14 ++++++++------
 template/.envrc                |  6 +++++-
 template/WORKFLOW.md           |  2 ++
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/docs/symphony-github-issues.md b/docs/symphony-github-issues.md
index 9a84f64..7a5b43f 100644
--- a/docs/symphony-github-issues.md
+++ b/docs/symphony-github-issues.md
@@ -31,9 +31,10 @@ explicitly request rework after review.
 - Install Git, and configure SSH access that can push to
   `git@github.com:dapi/memory-bank.git`.
 - Install and authorize `direnv` for this repository's `.envrc`.
-- Create a GitHub token with access to this repository's issues and pull
-  requests. Symphony uses it to poll the tracker; the agent uses its authenticated
-  `gh` CLI for GitHub reads and updates.
+- Provide a GitHub token for Symphony's tracker as `SYMPHONY_GITHUB_TOKEN`.
+  If it is absent, `.envrc` uses `gh auth token` for the tracker. The agent
+  continues to use its authenticated `gh` CLI for GitHub reads and updates;
+  Symphony never exports its tracker token as `GITHUB_TOKEN`.
 - Install `mise`; the bootstrap script installs the required Elixir/Erlang
   versions.
 
@@ -45,9 +46,10 @@ cp .env.local.example .env.local
 direnv allow
 ```
 
-It expects the GitHub token at `pass:github/homebrew-token`. If the local
-password-store layout differs, change only the ignored `.env.local`; never add
-the literal token to a tracked file.
+For a dedicated token, set `SYMPHONY_GITHUB_TOKEN` in `.env.local`, for example
+from `pass:github/homebrew-token`. If the local password-store layout differs,
+change only the ignored `.env.local`; never add the literal token to a tracked
+file.
 
 ## Run
 
diff --git a/template/.envrc b/template/.envrc
index 624fe03..ac56526 100644
--- a/template/.envrc
+++ b/template/.envrc
@@ -2,7 +2,11 @@ set -a
 test -f .env.local && . .env.local
 set +a
 
-export GITHUB_TOKEN="$(gh auth token)"
+if [[ -z "${SYMPHONY_GITHUB_TOKEN:-}" ]]; then
+  SYMPHONY_GITHUB_TOKEN="$(gh auth token)"
+fi
+
+export SYMPHONY_GITHUB_TOKEN
 
 symphony_origin_url="$(git config --get remote.origin.url)"
 
diff --git a/template/WORKFLOW.md b/template/WORKFLOW.md
index 54aca7c..86a3ac9 100644
--- a/template/WORKFLOW.md
+++ b/template/WORKFLOW.md
@@ -1,6 +1,8 @@
 ---
 tracker:
   kind: github
+  provider:
+    token: $SYMPHONY_GITHUB_TOKEN
   active_states:
     - open
   terminal_states:

From ac60c2db9f3a782176fcd96214d2e3e8e6698f83 Mon Sep 17 00:00:00 2001
From: Danil Pismenny <dapi@users.noreply.github.com>
Date: Mon, 27 Jul 2026 13:36:11 +0300
Subject: [PATCH 2/3] docs: simplify Symphony token guidance

---
 docs/symphony-github-issues.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/docs/symphony-github-issues.md b/docs/symphony-github-issues.md
index 7a5b43f..716015a 100644
--- a/docs/symphony-github-issues.md
+++ b/docs/symphony-github-issues.md
@@ -33,8 +33,7 @@ explicitly request rework after review.
 - Install and authorize `direnv` for this repository's `.envrc`.
 - Provide a GitHub token for Symphony's tracker as `SYMPHONY_GITHUB_TOKEN`.
   If it is absent, `.envrc` uses `gh auth token` for the tracker. The agent
-  continues to use its authenticated `gh` CLI for GitHub reads and updates;
-  Symphony never exports its tracker token as `GITHUB_TOKEN`.
+  continues to use its authenticated `gh` CLI for GitHub reads and updates.
 - Install `mise`; the bootstrap script installs the required Elixir/Erlang
   versions.
 

From e991ded849e3e0105f6e11d4e3a8203e3b109f5f Mon Sep 17 00:00:00 2001
From: Danil Pismenny <dapi@users.noreply.github.com>
Date: Mon, 27 Jul 2026 13:36:40 +0300
Subject: [PATCH 3/3] docs: remove local token storage details

---
 docs/symphony-github-issues.md | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/docs/symphony-github-issues.md b/docs/symphony-github-issues.md
index 716015a..8d50966 100644
--- a/docs/symphony-github-issues.md
+++ b/docs/symphony-github-issues.md
@@ -45,10 +45,8 @@ cp .env.local.example .env.local
 direnv allow
 ```
 
-For a dedicated token, set `SYMPHONY_GITHUB_TOKEN` in `.env.local`, for example
-from `pass:github/homebrew-token`. If the local password-store layout differs,
-change only the ignored `.env.local`; never add the literal token to a tracked
-file.
+Set `SYMPHONY_GITHUB_TOKEN` in the ignored `.env.local`; never add the literal
+token to a tracked file.
 
 ## Run