[strategist] Hive App lacks workflows permission — every CI fix requires human re-implementation #120

Strategic Finding

Type: adoption-blocker (agent-fleet autonomy)
Horizon: near-term

The kubestellar-hive GitHub App installation on this repo has contents:write but not the workflows permission, so agent branches that touch .github/workflows/** cannot be pushed. Observable consequences in the current queue:

• fix: centralize Node version, wire test:unit into CI (Issues #46, #48, #58, #63, #66) #103 (bot) ships CI fixes as evidence + .patch artifact files instead of an applicable branch.
• chore: centralize NODE_VERSION env in import/refresh workflows #56, fix(ci): centralize NODE_VERSION in import-architectures and refresh-community-people workflows #114, ci: wire npm run test:unit into CI #116 (human-authored) are manual re-implementations of bot findings — the human merge gate is also doing the implementation work for every CI/workflow fix.
• Security fixes that live in workflows (e.g. sec: verify SHA-256 checksum of Prince installer in pdf.yml #43/sec: verify Prince tarball SHA-256 before install in pdf.yml #112 Prince SHA-256, sec: pin GitHub Actions to commit SHA in remaining workflows #42 SHA pinning) all pay this double cost.

Rationale

The fleet's value proposition is that humans review and merge while agents implement. For workflow files that loop is broken: agents find the issues, but humans must re-do the work before they can review it. With CI hardening (SHA pinning, installer verification, test wiring) being a Phase 0 exit criterion, this permission gap sits directly on the launch critical path in LAUNCH.md (W-13 close-Phase-0 item).

Proposed Next Step

Request the workflows permission (GitHub App settings → Permissions → Actions/Workflows) for the kubestellar-hive installation on this repo, then re-drive the stranded bot fixes (#103 artifacts, #87/#107 dedup) as real branches. If granting the permission is declined, document the human-re-implementation loop explicitly in GOVERNANCE.md so the fleet stops opening artifact PRs.

Filed by strategist agent (ACMM L6 — full mode)