Finding
forkwright/typikon has zero repository secrets, and the v0.6.0 release path requires two of
them. This is a second, independent blocker from the Actions billing stop, and it will still be
there when billing clears.
$ gh secret list --repo forkwright/typikon -> exit 0, zero bytes
$ gh secret list --repo ardent-tools/ardent-tools-site -> four secrets (control, same auth)
The control matters: an empty listing could be a permissions artifact rather than a real absence, and
the sibling proves both the command and the credential work.
Where the requirement lives
ci/verify-release-lock.py:32-36 maps each cohort member to a token. typikon's own receipt uses the
automatic GITHUB_TOKEN, but the two consumer receipts live in other repositories' Actions
artifacts and need their own:
TOOLS_RECEIPT_TOKENLEATHER_RECEIPT_TOKEN
release-please.yml:130-131,156-157 passes both from secrets.*, and ci/check-release-lock.py:966,970
fails with TOOLS_RECEIPT_TOKEN is required.
Why this matters
The release was being reported as blocked solely on billing. It is not, and the difference is
practical: clearing billing will produce a release attempt that fails for a reason nobody is
expecting, at the point where the cohort lock is checked rather than at the point of build. The two
blockers have to be cleared in either order, but both have to be cleared.
It is also operator-owned — creating repository secrets needs credentials no agent holds — so it
cannot be worked around from inside a lane. That is exactly the class of thing that must be a filed
issue rather than a note on a coordination board, and the board it was on has since been retired.
Desired correction
Create TOOLS_RECEIPT_TOKEN and LEATHER_RECEIPT_TOKEN as repository secrets on
forkwright/typikon, each scoped to read Actions artifacts on the consumer repo it names.
Done when: gh secret list --repo forkwright/typikon lists both, and a release-please run reaches
the cohort-lock check without TOOLS_RECEIPT_TOKEN is required.
Source: the two gh secret list runs above, re-verified first-hand at 2026-08-21 16:0x CDT; the
file/line citations are from the Ardent lane's own investigation, whose seat has ended.
Finding
forkwright/typikonhas zero repository secrets, and the v0.6.0 release path requires two ofthem. This is a second, independent blocker from the Actions billing stop, and it will still be
there when billing clears.
The control matters: an empty listing could be a permissions artifact rather than a real absence, and
the sibling proves both the command and the credential work.
Where the requirement lives
ci/verify-release-lock.py:32-36maps each cohort member to a token. typikon's own receipt uses theautomatic
GITHUB_TOKEN, but the two consumer receipts live in other repositories' Actionsartifacts and need their own:
TOOLS_RECEIPT_TOKENLEATHER_RECEIPT_TOKENrelease-please.yml:130-131,156-157passes both fromsecrets.*, andci/check-release-lock.py:966,970fails with
TOOLS_RECEIPT_TOKEN is required.Why this matters
The release was being reported as blocked solely on billing. It is not, and the difference is
practical: clearing billing will produce a release attempt that fails for a reason nobody is
expecting, at the point where the cohort lock is checked rather than at the point of build. The two
blockers have to be cleared in either order, but both have to be cleared.
It is also operator-owned — creating repository secrets needs credentials no agent holds — so it
cannot be worked around from inside a lane. That is exactly the class of thing that must be a filed
issue rather than a note on a coordination board, and the board it was on has since been retired.
Desired correction
Create
TOOLS_RECEIPT_TOKENandLEATHER_RECEIPT_TOKENas repository secrets onforkwright/typikon, each scoped to read Actions artifacts on the consumer repo it names.Done when:gh secret list --repo forkwright/typikonlists both, and a release-please run reachesthe cohort-lock check without
TOOLS_RECEIPT_TOKEN is required.Source: the two
gh secret listruns above, re-verified first-hand at 2026-08-21 16:0x CDT; thefile/line citations are from the Ardent lane's own investigation, whose seat has ended.