Description
The repository already carries a docs/ surface with frontmatter and a link gate, but nothing publishes it. Onboarding is not one change in one repo: it needs a JWT role under the shared docs-sync permission set, an edit in another repository, a project-owned docs.toml, and a workflow.
Deliberately deferred out of wave 1 by Rob on 2026-09-22. Wave 1’s lane 11 creates the release-please OpenBao objects only, and states this task as the reason it stops there.
Acceptance Criteria
- #1 docs.toml exists with the site name, description, keywords and an explicit nav covering every page in docs/
- #2 trigger-docs-sync.yml is copied in, firing on pushes to main touching docs/** or docs.toml, with permissions contents:read and id-token:write
- #3 The workflow passes role: docs-sync-codingagent2otel explicitly; docs-sync is one shared permission set serving many repos, so the action’s default of role = permission-set resolves to a role that does not exist and auth/gha/login answers 400
- #4 A docs-sync-codingagent2otel JWT role exists under the shared docs-sync permission set, pinning this repo’s numeric id 1381225038; the shared permission set and its policy are read, never edited
- #5 codingagent2otel is added to docs-repos.json in m7kni/m7kni-net-site, which is the live consumer roster
- #6 The required permission is Contents: write, not actions:write - POST /repos/m7kni/m7kni-net-site/dispatches returns x-accepted-github-permissions: contents=write, and a default GITHUB_TOKEN cannot create a repository_dispatch in another repo
- #7 The gitignored hub-injected artifacts stay gitignored: zensical.toml, docs/overrides/, docs/stylesheets/brand.css, docs/assets/*, docs/fonts/
- #8 A push touching docs/ produces a dispatch whose mint step succeeded, and the page is live on m7kni.io
Definition of Done
- #1 just check passes: fmt-check, lint, build, test-short, probe-ci, dashboard-check and docs-links all clean