tend check: configuration drift on max-sixty/tend

[tend-agent]

tend check currently reports one failure on this repo, down from three.

• credential-environments — the release environment has no required reviewers and admits tags, and "no active all-tags ruleset restricting creation and update to admins could be verified". This is a false positive, tracked as secret-environments: false positive when an all-tags ruleset has no bypass actors #824 — see below.

Previously resolved: claude-auth and repo-secret-allowlist both PASS. CLAUDE_CODE_OAUTH_TOKEN now resolves from the tend environment and no longer sits at repo level, which is item 1 of "Finish moving the operational secrets into the tend environment" done for this repo. No bot action was possible on those two — the token can't be read back — so a maintainer moved them.

credential-environments — the #824 false positive, firing on tend itself

Not a config regression. The repo does have the ruleset the check is asking for — Tag operations (16490366), active, ~ALL tags, both creation and update restricted, and no bypass_actors key at all, which is stricter than the admin-only arrangement the remediation text requests:

$ gh api repos/max-sixty/tend/rulesets/16490366 \
    --jq '{name, target, enforcement, current_user_can_bypass, conditions, rules: [.rules[].type], bypass_actors}'
{"bypass_actors":null,"conditions":{"ref_name":{"exclude":[],"include":["~ALL"]}},"current_user_can_bypass":"never","enforcement":"active","name":"Tag operations","rules":["creation","update"],"target":"tag"}

_bypass_actors_above_bot returns None for an absent list ("Returns … None when the list is withheld"), which propagates to "could not be verified" and then to FAIL. Queried with the bot's own token the same ruleset reports "current_user_can_bypass": "never", so the escalation path the check describes is in fact closed. #825 and #826 are both open against exactly this, so this line should clear on its own once one of them lands — no config change wanted here.

Last refreshed: 2026-08-09

[tend-agent]

Both failures still reproduce — tend check on this checkout exits 1 with exactly the two reported, so the item stands as filed and stays maintainer-only: CLAUDE_CODE_OAUTH_TOKEN can't be read back, and the bot has no admin path to a value it never sees.

The run surfaced a third failure worth separating out, since it is not drift here but a bug in the unreleased credential-environments check (#815, not in 0.1.13, which is why the nightly's uvx tend@latest run didn't report it):

FAIL  credential-environments — 'release' has no required reviewers, and admits tags, and no active all-tags ruleset restricting creation and update to admins could be verified

The release environment is correctly gated — this repo carries the Tag operations ruleset the check looks for (target tag, active, ~ALL, creation + update). GitHub just omits bypass_actors from the ruleset response below repo admin, so the bot's write-scoped token cannot decide and the check counted that as ungated. Same configuration, different verdict depending on who runs it — which breaks checks.py's stated invariant that the nightly sees the answers a maintainer does, and would have fired on every adopter's nightly at the next release, on the release-environment shape TODO.md prescribes.

#825 splits "confirmed absent" from "could not see" so the second reports unknown, matching what check_branch_protection already does with the same unreadable field. It doesn't touch this issue's two failures.

How the permission difference was confirmed

Not inferred from the docstring — read from the API both ways. On tend-agent/tend-integration, where the bot is admin, a probe ruleset with no bypass actors returns "bypass_actors": [] (probe deleted afterwards). On this repo, with the same token at write level, the key is absent entirely from all three rulesets (14219339, 16470086, 16490366) — so _bypass_actors_above_bot sees None and _tags_admin_gated returns unresolved.

Live output after the fix, for the record:

PASS  branch-protection:main — Branch 'main' is protected
PASS  bot-permission — Bot 'tend-agent' has 'write' permission
PASS  environment — Environment 'tend' admits only main
SKIP  credential-environments — Could not read the whole credential surface: 'release' … only a repo admin reads a ruleset's bypass list
PASS  secrets — Required secrets present: TEND_BOT_TOKEN
FAIL  claude-auth — …
FAIL  repo-secret-allowlist — …

[tend-agent]

Refreshed for tonight's sweep. One check added to the failure set; the other two are unchanged.

Added: credential-environments — the release environment has no required reviewers and admits tags, and no all-tags ruleset restricting creation/update to admins "could be verified".

This is not a config regression. The check landed under this name in 58c9699 (#815) and first shipped in 0.1.14, released today, so this is the first nightly to run it — and it's the same false positive as #824, now firing on tend itself. Tag operations (16490366) is active over ~ALL tags with both rules and carries no bypass_actors key, which _bypass_actors_above_bot maps to None ("withheld") rather than to the strictest case. #825 and #826 are both open against that, so the line should clear when one of them lands.

Unchanged: claude-auth, repo-secret-allowlist — still the repo-level CLAUDE_CODE_OAUTH_TOKEN, still blocked on a maintainer since the token's value can't be read back.

[tend-agent]

Refreshed: two of the three failures cleared. claude-auth and repo-secret-allowlist now PASS — CLAUDE_CODE_OAUTH_TOKEN resolves from the tend environment and the repo-level copy is gone. credential-environments still FAILs and is still the #824 false positive; #825 and #826 are open against it. Nothing left here that a config change on this repo would fix.

[tend-agent]

Disregard the close/reopen a moment ago — that was me running a snippet extracted from the wrong code block while testing a change to the nightly skill in #898, not a real check result. The issue's state is unchanged and its failure set still stands; I've deleted the "tend check now passes" comment it posted.