kyaulabs-bot · Sep 10, 2026 · Sep 10, 2026
@@ -3,11 +3,11 @@
 Read `packages/prism-core/AGENTS.md` for the shared engineering defaults.
 This checkout develops and dogfoods the harness itself.
 
-## Active refactor
+## Lean Prism 1.0
 
-`docs/specs/lean-prism.md` records the approved breaking redesign and execution
-checklist. The local replacement is implemented and verified; replacement
-publication precedes hosted catalogue deletion. See `docs/catalogue-retirement.md`.
+`docs/specs/lean-prism.md` records the completed breaking redesign and verification.
+Both 1.0.0 packages are published, release/back-merge automation is restored, and
+the obsolete hosted catalogue is deleted. See `docs/catalogue-retirement.md`.
 Historical ADRs document old designs, not current workflow requirements.
 
 ## Packages
@@ -80,9 +80,8 @@ consumer setup defaults. Downstream users authorize their own GitHub operations.
 - `npm publish` requires manual intervention by the user. Prepare and verify
   packages and GitHub releases automatically, but leave registry publication to
   the user; never request registry tokens in chat or attempt login on their behalf.
-- For catalogue retirement, verify both replacement packages are published before
-  deleting `kyaulabs/prism-adapters`. Retire only dedicated catalogue infrastructure
-  and preserve shared credentials/integrations.
+- Catalogue retirement is complete. Preserve shared credentials/integrations;
+  deleting stored secrets or a repository does not prove underlying token revocation.
 
 ## References
 

@@ -9,10 +9,14 @@ user and independently confirmed through public registry metadata.
 
 PRs #539, #540 and #541 delivered the replacement to main and develop. GitHub
 release `v1.0.0` exists at `198dc104c00ddd60216b53bfb724cd6e66b39fcf`.
-Deletion is authorized, but both logged-in accounts lack the `delete_repo` token
-scope. GitHub rejected deletion with HTTP 403; the repository still exists.
-The owner can grant that scope through native `gh auth refresh` or delete the
-repository in GitHub's UI. No authentication configuration was changed.
+The owner deleted `kyaulabs/prism-adapters` after publication. Subsequent GitHub
+API inspection returned HTTP 404, consistent with that confirmation. Retirement
+is complete. Earlier agent attempts lacked `delete_repo` scope; no authentication
+configuration was changed to bypass that limit.
+
+PRs #542–#543 restored workflow-only release-on-merge and automatic back-merge.
+Both hosted workflows succeeded, and all three 1.0.0 release/package tags resolve
+to the release commit above. Published package contents were unchanged.
 
 ## Automation retired
 
@@ -32,8 +36,8 @@ infrastructure was not changed.
 
 ## Credential inventory for the owner
 
-Only secret **names**, not values, were inspected. The catalogue's
-`catalogue-signing` environment contains:
+Only secret **names**, not values, were inspected. Before repository deletion,
+the catalogue's `catalogue-signing` environment contained:
 
 - `CATALOGUE_COMMIT_SIGNING_PASSPHRASE`
 - `CATALOGUE_COMMIT_SIGNING_PRIVATE_KEY`
@@ -44,7 +48,7 @@ Only secret **names**, not values, were inspected. The catalogue's
 Prism's `catalogue-dispatch` environment formerly contained
 `CATALOGUE_DISPATCH_TOKEN`. That dedicated environment has been deleted and its
 absence verified; the unrelated `copilot` environment was preserved.
-The catalogue also has the `CATALOGUE_SIGNING_ENABLED` variable. These names
+The catalogue also held the `CATALOGUE_SIGNING_ENABLED` variable. These names
 identify dedicated storage and workflows; they do not establish whether an
 underlying account token or signing identity is shared elsewhere.
 
@@ -60,11 +64,10 @@ The user selected replacement delivery first and authorized automatic push,
 PR, review, merge and publication. Push as `kyau`; create and merge PRs and
 delete merged task branches as `kyaulabs-bot`. Run every PR Test Plan item after
 PR creation before approving as `kyau`. Preserve `main`, `develop` and release
-branches. Repository deletion has not occurred.
-
-The user completed manual npm publication. Catalogue deletion now waits only
-for adequate repository-deletion permission or owner deletion, not another scope
-approval. Do not request credential values or attempt interactive login.
+branches. The user completed manual npm publication, then deleted the catalogue.
+No repository-deletion action remains. The credential inventory above remains
+for owner-side review of underlying token/signing identities; deletion is not
+proof of account-level revocation.
 
 The Prism release/back-merge workflows are retained: GitHub Actions may use its
 own identity. Coding-agent account roles are scoped to agent operations in the

@@ -1,7 +1,7 @@
 # Lean Prism
 
 Status: 1.0.0 delivered through PRs #539–#541 and manually published to npm.
-Release branch `release/1.0.0` is preserved. Hosted deletion lacks token permission.
+Release branch `release/1.0.0` is preserved. Hosted catalogue retirement is complete.
 
 ## Approved design
 
@@ -95,8 +95,10 @@ compatibility shims. Both 1.0.0 packages are published.
 - [x] Resolve delivery ordering and merge implementation through tested PR #539.
 - [x] Complete GitHub release delivery and verify both manual npm publications.
 - [x] Remove the dedicated Prism catalogue-dispatch environment.
-- [ ] Delete the hosted catalogue repository (GitHub rejected both tokens for
-  missing `delete_repo` scope; owner action required).
+- [x] Delete the hosted catalogue repository (owner confirmed deletion; subsequent
+  GitHub API inspection returned HTTP 404).
+- [x] Restore workflow-only release-on-merge and automatic back-merge through
+  PRs #542–#543; actual hosted runs succeeded.
 
 ## Verification and implementation evidence
 
@@ -134,8 +136,8 @@ compatibility shims. Both 1.0.0 packages are published.
 PRs #539–#541 delivered the replacement to main and develop. GitHub release
 `v1.0.0` exists, and both npm 1.0.0 packages were independently verified after
 manual publication by the user. The obsolete catalogue-dispatch environment is
-removed. Repository deletion is authorized but blocked by missing `delete_repo`
-token scope for both logged-in accounts; no credentials were read or changed.
+removed. The owner subsequently deleted the catalogue; GitHub API inspection
+returned HTTP 404. No credentials were read or authentication settings changed.
 
 Four dedicated workflows were disabled and their disabled state verified. No
 queued/in-progress catalogue runs were returned. Secret names were inventoried;
@@ -145,7 +147,10 @@ See `docs/catalogue-retirement.md` for exact workflow IDs and credential names.
 The user authorized replacement delivery first. Push as `kyau`, create/merge PRs
 and delete merged task branches as `kyaulabs-bot`, and run every Test Plan item
 after PR creation before approving as `kyau`. Preserve main/develop/release
-branches. npm publication remains manual and is complete for 1.0.0. Restore and
-preserve unattended release-on-merge and back-merge GitHub Actions; the account
-instructions govern the coding agent, not Actions identities. The restoration is
-workflow-only and does not change the published package contents.
+branches. npm publication remains manual and is complete for 1.0.0. PRs #542–#543
+restored unattended release-on-merge and back-merge GitHub Actions; account
+instructions govern the coding agent, not Actions identities. Hosted recovery run
+34430482078 and back-merge run 34430480923 succeeded. The workflow-only repair
+left published package contents unchanged. The approved refactor is complete;
+underlying credential revocation remains an owner-side check, not a claim made
+from deleting stored secrets or the repository.