Fly auto-deploy fails on token-verify 'context deadline exceeded' — try org-scoped token

[cipher813]

Auto-deploy on merge intermittently fails at the flyctl deploy step with:

Error: authenticate: token validation error: no verified tokens;
token 715ad2f1-...: verify: context deadline exceeded

Evidence (2026-06-15)

• A workflow_dispatch deploy at 14:40 succeeded with the current FLY_API_TOKEN.
• The next two push-triggered auto-deploys (ci: auto-deploy to Fly on merge to main (fork-safe), keep manual dispatch #225 merge 14:56, ci: retry flyctl deploy with backoff so transient Fly timeouts don't red main #226 merge 15:06) failed, the 15:06 one exhausting all 3 retries (mnemon#226) with the same error each attempt.
• So the token + config are valid; Fly's auth-service token verification is timing out (verify: context deadline exceeded), sustained ~20 min — beyond what an in-job retry/backoff can cover.
• Prod unaffected: 0.7.8 stayed live (the failed runs are pure-workflow merges; nothing rolled back).

Likely cause + fix

App-scoped fly tokens create deploy macaroons carry a third-party caveat that flyctl verifies against Fly's auth service on each deploy; when that service is slow it times out. An org-scoped token (fly tokens create org) verifies without that flaky round-trip and is the common CI fix.

Action

• If it recurs: replace FLY_API_TOKEN with an org-scoped token (fly tokens create org) and re-test via a dispatch run.
• If org token also flakes: it's Fly-side — the in-job retry (mnemon#226) covers brief blips; just re-run the workflow.

Re-exam: next time a merge auto-deploy reds with context deadline exceeded.
Closes-when: an org-scoped token is in FLY_API_TOKEN and a merge auto-deploy goes green (or confirmed Fly-side-only).

---

Migrated from nousergon/mnemon-ops#26 on 2026-06-18 — backlog moved to the public repo.