decisions: Time is a Gitea user (time, TIME_TOKEN); Astra; time#49 findings

docs/decisions.md

@@ -34,3 +34,4 @@ Format: date · decision · why. Add at the bottom. Never edit an old entry; sup
 - 2026-10-14 · **One venture ledger, at yolopreneur.lol.** Time's ventures and notplanned's are one list (`ventures.json` + `backlog.json` on time's `gh-pages`, with a `source` field); `teahubxyz/notplanned` is on prod with its 4 issues; the index is hand-authored (neo-brutalist) and renders the JSON, so the generator writes data only. Supersedes the "notplanned merges into Time on GitHub" entry. Why: two listings drift, and the operator wanted one.
 - 2026-10-14 · **Every venture is static, on Teahub pages, at `<slug>.yolopreneur.lol`. No Cloudflare.** `*.yolopreneur.lol` → `green-tea-pages` (wildcard cert); the apex `/<slug>/` redirects to the subdomain; a venture ships as `ventures/<slug>/` on `gh-pages` and nothing else is provisioned. The nine Workers (`time-<slug>`) and their custom domains were deleted with the Workers token on hb-5; `backend` is gone from `ventures.json`; `time.js` degrades without `/api/`. `cloudflare.py`/`worker.js` leave with the venture.py port (time#48). Kept for now: `time-aicharts` (the lab, no static twin — rebuilds on prod per #5) and `jev-prefab-decider` (not Time's). D1 databases could not be deleted with that token (no D1 scope); the Workers that used them are gone, so they cost nothing but still exist. Why: one format for all sixteen, and no Cloudflare spend.
 - 2026-10-14 · **Second product secret on prod: `ANTHROPIC_API_KEY`, user-level on `teahubxyz`** (Actions secret shared by every repo teahubxyz owns; taken from Boring's delivery on hb-5, never printed; the Gitea token used to set it was minted on the Fly box with `write:user` and revoked within minutes). With it: Time gets Claude seats (`haiku`, `sonnet`, `opus`, `fable`) through the Claude API's OpenAI-compatible layer, `TIME_WORKER=claude:sonnet`, and a **spend governor**: a ledger in the repo (`time/ledger/<month>.jsonl`, one line per model call with tokens and USD), `TIME_DAILY_USD=5` and `TIME_MONTHLY_USD=100` as user-level variables; a daily breach opens an `andon` issue and waits for midnight, a monthly breach also flips `TIME_MODE` to `dry-run`. Venice stays wired but is no longer the worker. Why: the operator's Max plan outruns manual use and the factory should run on API credits unattended; Venice burned $20 of $75 before anyone noticed, so the cap is counted in dollars by code, not in launches, and no model decides whether to spend.
+- 2026-10-14 · **Time is a Gitea user: `time`, with its own token.** Gitea 1.24 lets the Actions identity (`gitea-actions`) comment and label, and git-push with the task token, but never open or merge a pull request ("user must be a collaborator") or write through the contents/branches API (pre-receive denies it). So Time's writes go over `git push`, and the two PR calls (open, merge) go out as `time`: a bot user, collaborator (write) on `teahubxyz/time`, token scoped `write:repository,write:issue`, stored as the repo secret `TIME_TOKEN`, minted on the Fly box, never printed. Operator approved. Reading of the standing rule: Time is an agent and this is Time acting as itself, not a shared service token; nothing else uses `TIME_TOKEN`. Also today: the daily planner `astra.py`/`astra.yml` (one Opus call a day, queues ≤2 cards, writes to the "Astra log" issue; off until `TIME_ASTRA=on`), and the first Claude-seat card, time#49, is the one that found all three Gitea walls. Why: without an identity that can hold a PR the council has nothing to review and nothing ever lands.