A read:repository-only PAT gets HTTP 403 on GET /orgs/coulomb/repos (needs
read:organization). The 2026-10-03 attended run failed there and rolled back
(PAT deleted, nothing written to OpenBao). The source token is still verified
against the probe exactly as before: branch, archive, /admin/users and Actions
secrets denials. Also records the delegated metadata apply evidence.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3