syntaqxA session g1t starts on Claude Managed Agents acts as g1t for the person who started it: on flagon-io/demo #1 the session closed the issue and the timeline said "syntaqx closed this as completed", because its token was a plain personal access token for @syntaqx (create_access_token, scoped to the repository), so every comment, close, review and pull request it made read as theirs. It now holds a run credential of a new kind, session (credentials::RunCredentialKind::Session, made by identity's create_run_credential, up to 12 hours, revoked when the session ends as before): it resolves to g1t on behalf of the person, may use every API and MCP operation credentials::SESSION_SCOPES allow (the scopes the old token had) and never one in NEVER, in its repository only, with the person's role there capped at Write, and pushes with git to that repository (any branch, so a new repository's first version still goes to its default branch) and to the working copies of its pull requests (decide_git_at, resolved by repos from the fork's source). Past the API and git it is the person with acting kept (as_person), so the session, its claims, its pull requests' forks and its pushes stay theirs and their role decides, while what it writes is recorded as g1t's for them: issues and pull requests it opens are g1t's, requested by them (work::authorship), and its comments, reviews and the events it notes (close, reopen, labels, assignees, milestones, blocked-by, ready, draft) are written as g1t with acting_for the person (work rows::By, into the acting_for columns of migration 0033), shown as "g1t ... on behalf of @syntaqx" on the issue and pull request pages; the person can still edit them, and a session's approval counts only where agents' approvals do. The system prompt says the token is g1t's for that person. The sessions guide and the identity architecture page say what a session acts as. Deploy order: every Worker that reads a viewer (api, repos, work, packages, events, identity and the rest) before integrations, which is the only one that makes the new kind; no migration. Checked: cargo test -p g1t-contracts (316) -p g1t-work (201) -p g1t-identity (183) -p g1t-integrations (76) -p g1t-repos (363) -p g1t-api (209) -p g1t-packages (112); cargo check --target wasm32-unknown-unknown of g1t-work, g1t-identity, g1t-integrations, g1t-repos, g1t-api, g1t-packages; apps/web tsc -b shows no errors in components/work.tsx (the rest need typegen).c678dcaHistory
README.md
g1t/workflows
g1t's own reusable workflows, published from this folder of g1t's
repository to g1t/workflows on g1t.sh by .g1t/workflows/actions-release.yml.
| Workflow | What it does |
|---|---|
.g1t/workflows/deploy.yml | Builds the commit onto g1t.page with g1t/deploy. The deploy workflow g1t manages for a project calls it. |
jobs:
g1t:
uses: g1t/workflows/.g1t/workflows/deploy.yml@v1
with:
project: web
secrets: inherityaml