GitHub

Locked steel hatch in a dark factory floor — the landing gate that will not lift without a receipt

Landing floor without a GitHub App — gates still count

Companion to GitHub tokens for agent fleets and the agent production system series. A lot of people hear “receipt-gated landing” and “GitHub App bot” as one package. They are not. Human mode is the default — and it is enough to stop agents from treating “please review before merge” as optional prose. The instruction that kept not working Every agent setup eventually writes some version of: Before merging, run the review step. ...

A long-lived access key left exposed on an open laptop in a dark ops room

GitHub tokens for agent fleets — safe automation without paste-a-PAT

Most agent demos treat GitHub as “paste a PAT in the env and hope.” That works until the token shows up in a transcript, the rate limit collides with the work you are doing by hand, or the bot opens a PR and GitHub refuses to let it approve its own change. I use two identities on purpose: you for creating the PR, a short-lived App token for approve/merge after the gates. Agents call a broker. They do not each own a secret. ...