2026-10-02 — Ruling H2 of the person (2026-09-29, same interview and local-tier file as the DR3 entry above; recorded by lane rd2), verbatim: "dependency-update key: a GITHUB APP created and installed on the repo; the landed update's AUTHOR is the person (App pushes; human authorship kept so the attribution gate passes). Creating/installing the App and storing its secret is the person's act (owed)." Built: `.github/workflows/dependency-reauthor.yml` re-authors an in-bound bump with the owner named in `.abcd/config/dependency-reauthor.conf` as author and committer and pushes it with the App's token, minted in the shell under ruling CG1 (adr-2609292116133348). Not done: creating and installing the App and storing its two secrets is the person's act and stays owed (iss-2609292030070275).

Frontmatter

.abcd/work/decisions/dcn-2610020000000008-ruling-h2-of-the-person-2026-09-29-same.md
open on GitHub ↗ · commit history ↗

mentions2

• adr-2609292116133348A dependency bump inside the bound is re-authored as the owner and only pushed by an App
• iss-2609292030070275The dependency-bump re-authoring (itd-2609221842494980, spc-2609221843355061) has never run against the live forge, so its first acceptance criterion is proven only offline, against a stand-in App API and a local remote. The person's steps are owed: create a GitHub App with Contents read and write, install it on this repository, store its id and private key as the Dependabot secrets DEPENDENCY_REAUTHOR_APP_ID and DEPENDENCY_REAUTHOR_APP_KEY, and set owner_name and owner_email in .abcd/config/dependency-reauthor.conf. Until then every in-bound bump is refused by name and stays a person's to land. Done when one real dependabot go_modules or pip bump is watched re-authored as the owner, re-checked green by the attribution gate and merged; then the spec closes and the intent ships (Refs: iss-2609221820487644).