memory: claude-bot issue-scope token (id 16) minted for worldtree-dev self-serve

persistent-memory.md

@@ -291,6 +291,18 @@ _As of 2026-06-20:_
 
 ## Recent decisions
 
+- `[2026-06-20]` **claude-bot issue-scope token minted for worldtree-dev self-serve**
+  (closes their last `tea`-as-vh fallback — issues; they already self-serve Actions +
+  deploys). Gitea PAT scopes are IMMUTABLE → minted a NEW claude-bot PAT
+  `worldtree-dev-actions-issues-20260621` (id 16) with `write:repository`+`write:issue`
+  via basic-auth (`claude-bot:gitea-password`, POST `/users/claude-bot/tokens`); dropped
+  mode-600 `~/.claude-bot-token-issues` → worldtree-dev swaps. **Gitea COLLAPSES
+  `read:issue` into `write:issue`** (write implies read) so the granted set shows
+  write-only but read IS satisfied (GET issues → 200). Revoke the old
+  write:repository-only token once they confirm swap. Advances the credential-migration
+  directive. ALSO this session: re-staged cb2a79a `policies.yaml` (readonly-admin allow
+  rules) to demo+personal (see Current-state ratatoskr entry).
+
 - `[2026-06-20]` **rest-server-ana recovered + backup prevention shipped + worldtree-dev
   admin keys provisioned** (operator-directed). rest-server-ana fixed (mount-a +
   force-recreate via `infra-ops@ana-docker`); freshness alert + fstab hardening landed