coilyco-ops-summon

name

coilyco-ops-summon

description

Operate the @coilyco-ops summon bot - a Forgejo poller that turns `@coilyco-ops <request>` on an issue or PR into a Goose advisory reply. Use when summoning Goose for an advisory pass, gating who may drive the bot, dry-running the poll, installing its timer, or explaining how it differs from claude-dispatch. Default-deny and advisory only, never pushes main. Aliases - coilyco-ops, @coilyco-ops, summon Goose, ops summon, advisory bot, coilyco_ops_summon.

coilyco-ops summon

Status: 🛠 Runbook | Last updated: 2026-07-03

@coilyco-ops <request> in any Forgejo issue or PR comment summons Goose for an advisory pass. A poller (not a webhook, no inbound port) reads the bot's unread notifications every 30s, gates the author, dispatches Goose in a throwaway clone, and posts the answer back as a reply. Full walkthrough -> references/coilyco-ops-summon.md. Entrypoint -> scripts/coilyco_ops_summon.py.

What she is

She services free-form @-summons as the #374 pre-flight asked for. She acts, replies, and marks read - she never opens a port and never mutates main.

Security posture (read before enabling)

• Default-deny auth. A mention acts only if its author has write access (collaborator admin/write) or sits on COILYCO_OPS_SUMMON_ALLOW. Everyone else is logged and ignored. A drive-by commenter cannot drive her.
• Advisory only. The request becomes a Goose task in a disposable checkout and the answer is posted for a human. The path never pushes, merges, or mutates main. Blast radius is one throwaway clone.
• No loops, once each. She skips her own comments and handles each comment id at most once via a state-file high-water mark.
• Bounded fan-out. At most --max-runs (default 3) summons per poll.

Advisory vs claude-dispatch

Do not confuse the two. This bot is advisory - Goose replies and stops. The claude-dispatch path implements and lands on main (pre-commit + tests green, then push). Reach for coilyco-ops when you want a second opinion, not a landed change.

Operate

# dry-run: gate + log, post nothing (read-only, reach for this first)
ward exec coilyco-ops-summon dry_run=1 verbose=1
# live poll
ward exec coilyco-ops-summon
# install the timer on the host (idempotent), then check it
bash scripts/install-coilyco-ops-summon.sh
journalctl -u coilyco-ops-summon.service -n 50 --no-pager

Always confirm the gate with dry_run=1 before a live poll on a new host or allowlist. The bot token is SSM /forgejo/coilyco-ops/api-token (minted by scripts/provision-coilyco-ops-bot.sh, see the token-minting skill), resolved via host AWS creds. Set COILYCO_OPS_TOKEN for a local dry-run. Pure logic is covered by scripts/coilyco_ops_summon_test.py.

Tuning

• COILYCO_OPS_SUMMON_ALLOW - comma-separated extra logins beyond write-access.
• --max-runs N - per-poll fan-out cap.
• Timer cadence lives in the .timer (OnUnitActiveSec).