@@ -0,0 +1,71 @@
+# Temporary one-off probe for #29160. Prints HTTP statuses only, never an advisory's id or text. Deleted with its branch.
+name: tmp advisory token probe
+on:
+  push:
+    branches: ['claude/advisory-token-probe']
+permissions: {}
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - id: narrow
+        continue-on-error: true
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OS_FLEET_APP_ID }}
+          private-key: ${{ secrets.OS_FLEET_PRIVATE_KEY }}
+          owner: objectstack-ai
+          repositories: objectstack
+          permission-repository-advisories: write
+          permission-metadata: read
+      - id: control
+        continue-on-error: true
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OS_FLEET_APP_ID }}
+          private-key: ${{ secrets.OS_FLEET_PRIVATE_KEY }}
+          owner: objectstack-ai
+          repositories: objectstack
+          permission-metadata: read
+      - name: Probe (statuses only)
+        env:
+          NARROW: ${{ steps.narrow.outputs.token }}
+          CONTROL: ${{ steps.control.outputs.token }}
+          NARROW_OUTCOME: ${{ steps.narrow.outcome }}
+          CONTROL_OUTCOME: ${{ steps.control.outcome }}
+        run: |
+          cat > probe.mjs <<'EOF'
+          const R = 'repos/objectstack-ai/objectstack', API = 'https://api.github.com/';
+          const call = async (verb, path, t, body) => {
+            const r = await fetch(API + path, { method: verb, headers: { accept: 'application/vnd.github+json', authorization: 'Bearer ' + t, 'x-github-api-version': '2022-11-28', 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body) });
+            let j = null; try { j = await r.json(); } catch {}
+            return { s: r.status, j, h: r.headers.get('x-accepted-github-permissions') ?? '-' };
+          };
+          const generic = (x) => (x.s >= 400 ? String(x.j?.message ?? '').replace(/GHSA-[a-z0-9-]+/gi, 'GHSA').slice(0, 90) : '');
+          const probe = async (label, t) => {
+            const say = (what, x, extra = '') => console.log(`[${label}] ${what}: HTTP ${x.s} ${generic(x)} ${extra} accepted=${x.h}`);
+            if (!t) { console.log(`[${label}] no token`); return; }
+            const list = await call('GET', `${R}/security-advisories?state=draft&per_page=100`, t);
+            const rows = Array.isArray(list.j) ? list.j : [];
+            say('GET list draft', list, `count=${rows.length}`);
+            say('POST reports, empty body on purpose', await call('POST', `${R}/security-advisories/reports`, t, {}));
+            say('POST create, empty body on purpose', await call('POST', `${R}/security-advisories`, t, {}));
+            const target = process.env.TARGET_ID ?? rows[0]?.ghsa_id;
+            if (label === 'narrow' && target) process.env.TARGET_ID = target;
+            if (!target) { console.log(`[${label}] no draft readable, PATCH not sent`); return; }
+            const one = await call('GET', `${R}/security-advisories/${target}`, t);
+            const cu = Array.isArray(one.j?.collaborating_users) ? one.j.collaborating_users.map((u) => u.login) : null;
+            say('GET one draft', one, `state=${one.j?.state ?? '-'} collaborators=${cu ? cu.length : '-'}`);
+            say('PATCH empty body', await call('PATCH', `${R}/security-advisories/${target}`, t, {}));
+            if (cu) {
+              say('PATCH same collaborators', await call('PATCH', `${R}/security-advisories/${target}`, t, { collaborating_users: cu }));
+              const after = await call('GET', `${R}/security-advisories/${target}`, t);
+              console.log(`[${label}] collaborators unchanged=${JSON.stringify(cu) === JSON.stringify((after.j?.collaborating_users ?? []).map((u) => u.login))}`);
+            } else console.log(`[${label}] PATCH same collaborators not sent: draft unread`);
+          };
+          console.log('mint outcome narrow=' + process.env.NARROW_OUTCOME + ' control=' + process.env.CONTROL_OUTCOME);
+          await probe('narrow', process.env.NARROW);
+          await probe('control', process.env.CONTROL);
+          EOF
+          node probe.mjs