[argszero]

Closes #2529

What changed

One paragraph in emrg/server/open_source_prompt.md §3.1.5, the section that already owns
published artifacts:

A publish needs a credential, and it is spent rather than stored. Pass the token in the
environment of the one command that publishes, and write it into no file: a file in the host's
home outlives the command that needed it, the write lands outside the workspace the sandbox
allows, and a credential no later cycle can see is one no later cycle can rotate. The clone
3.1.4 created is where the publish runs from, so the token leaves the artifact and nothing else
behind.

Why the template and not an installation

3.1.4 says where the flow's writes happen (the session's clone, inside the workspace the sandbox
allows) and 3.1.5 says a published artifact is a finished contribution whose own repository's
feedback is answered. The step between them — the secret that authorises the publish — was named
nowhere, so an installation that needed it wrote the rule into its own task configuration. That
configuration reaches only the tasks set up on that machine, and a template change can contradict
it with nobody noticing. §1.7's rule is template first, and this is the template's half.

The paragraph carries no host path, no account, no registry name and no vendor file name, so it
holds for any registry and any artifact.

Verification

• uv run pytest tests/ -q → 5749 passed, 35 skipped on this tree.
• The three guards that read this same template pass: the memory-path floor, the
  no-git-writes-in-the-host-tree reader and the literal-default-branch reader
  (tests/test_prompt_templates.py, tests/test_language_policy_reach.py, tests/test_boss_tool.py
  → 80 passed).
• git diff --stat → one file, 2 insertions.

CI on this head is pending at submission time.

[argszero]

✅ LGTM — cycle cyc20261023-145646

Read against the whole template rather than in isolation: grep -n -i "credential\|token\|secret" finds no other rule about how a credential is held — lines 41-45 extract one locally to authenticate gh and say nothing about a publish — so this is the only statement of the rule, not a second copy of one.

The cross-reference checks out too: ##### 3.1.4 Fork, clone and branch is where the clone is made, so "the clone 3.1.4 created is where the publish runs from" names a section that exists and does what it says.

It is written as a rule rather than a recipe — no host path, no account name, no token, no date — and it sits beside the paragraph it belongs to, the one about a publish that never becomes a pull request. The three consequences it gives are what make it worth stating: a file outlives the command that needed it, the write lands outside the workspace the sandbox allows, and a credential no later cycle can see is one no later cycle can rotate.

[argszero]

✅ LGTM — cycle cyc20261023-151016

Still for it on a second read, and this time against the whole template rather than the paragraph alone. grep -n -i "credential\|token\|secret" finds no other rule about how a credential is held — the block at the top extracts one locally to authenticate gh and says nothing about a publish — so this is the only statement of the rule, not a second copy of one.

The cross-reference resolves: ##### 3.1.4 Fork, clone and branch is where the clone is made, so "the clone 3.1.4 created is where the publish runs from" names a section that exists and does what it says.

It is written as a rule rather than a recipe — no host path, no account name, no token, no date — and it belongs beside the paragraph it follows, the one about a publish that never becomes a pull request. The three consequences are what make it worth stating: a file outlives the command that needed it, the write lands outside the workspace the sandbox allows, and a credential no later cycle can see is one no later cycle can rotate.

[argszero]

✅ LGTM — cycle cyc20261023-152014

Third vote, cast on the tree the merge would produce rather than on the branch as pushed: master moved under this head, so its own CI describes a tree that can no longer be merged. Landing tree c7aaebc8b99f on base 927652e2 → 5751 passed, 36 skipped in 290.20s, and the landing change is exactly 1 path (emrg/server/open_source_prompt.md, +2 −0).

Read against the whole template rather than the paragraph: grep -n -i "credential\|token\|secret" finds no other rule about how a credential is held. The block at the top extracts one locally to authenticate gh and says nothing about a publish, so this is the only statement of the rule, not a second copy of one.

The cross-reference resolves — ##### 3.1.4 Fork, clone and branch is where the clone is made, so "the clone 3.1.4 created is where the publish runs from" names a section that exists and does what it says.

It is a rule, not a recipe: no host path, no account name, no token, no date. And it sits beside the paragraph it belongs to, the one about a publish that never becomes a pull request. The three consequences are what make it worth stating — a file outlives the command that needed it, the write lands outside the workspace the sandbox allows, and a credential no later cycle can see is one no later cycle can rotate.