chore(wheelhouse): cascade template@dcd3bac340

Auto-applied by socket-wheelhouse commit-cascade into socket-lib.
9 file(s) touched:
  - .config/fleet/oxlintrc.json
  - .github/actions/fleet/github-pr-branch-app-token/action.yml
  - .github/actions/fleet/github-pr-branch-app-token/mint-app-installation-token.mjs
  - .npmrc
  - AGENTS.md
  - pnpm-workspace.yaml
  - scripts/repo/bootstrap/fleet.mjs
  - .github/actions/fleet/github-pr-branch-app-token
  - scripts/repo/bootstrap

Author: jdalton

.config/fleet/oxlintrc.json

@@ -1,7 +1,7 @@
 name: PR branch app token
 description: >-
-  Mint a short-lived PR App installation token for owned non-default branch
-  writes. Workflow files are outside this profile.
+  Mint a short-lived PR App installation token for release branches and PRs.
+  Workflow files are outside this profile.
 
 inputs:
   client-id:
@@ -36,7 +36,7 @@ runs:
         APP_PRIVATE_KEY: ${{ inputs.private-key }}
         CLIENT_ID: ${{ inputs.client-id }}
         OWNER: ${{ inputs.owner || github.repository_owner }}
-        PERMISSIONS: '{"contents":"write"}'
+        PERMISSIONS: '{"contents":"write","issues":"write","pull_requests":"write"}'
         REPOSITORIES: ${{ inputs.repositories }}
         GITHUB_ACTION_PATH: ${{ github.action_path }}
       run: node "${GITHUB_ACTION_PATH}/mint-app-installation-token.mjs"

.github/actions/fleet/github-pr-branch-app-token/action.yml

@@ -311,10 +311,7 @@ async function main() {
   }
 
   // PREFLIGHT: the installation's own grant must already cover every requested
-  // scope. Runs before the mint and therefore before any publish/promote — the
-  // widened `pull_requests: write` request is only exercised by the promote PR
-  // that follows a successful publish, so without this the shortfall surfaces
-  // as a 403 in the irreversible window.
+  // scope. Runs before the mint and before any branch or pull-request write.
   if (permissions !== undefined) {
     const missing = findMissingAppPermissions({
       granted: installation.permissions,

.github/actions/fleet/github-pr-branch-app-token/mint-app-installation-token.mjs

@@ -27,7 +27,7 @@
 - The `squash-history` opt-in tracks the release boundary: the first release FREEZES history through that commit, and only the unreleased tail squashes. [`squash-until-release`](docs/fleet/agents.md/squash-until-release.md)
 - `fleet-main-protection` blocks force-push, `fleet-tag-protection` blocks `v*` tag deletes. [`history-rewrites`](docs/fleet/agents.md/history-rewrites.md)
 - npm stages burn versions: minor default, odai patch/minor, major needs `X.Y.Z-prerelease`. [`version-bumps`](docs/fleet/agents.md/version-bumps.md)
-- NEVER open a pull request to land a version bump: the bump commit goes DIRECTLY on the default branch via the release App. (`.claude/hooks/fleet/no-version-bump-pr-guard/`) [`version-bumps`](docs/fleet/agents.md/version-bumps.md)
+- Never hand-create a version-bump PR. The npm publish workflow uses the PR App to sign the bump, open its reviewed PR, and resume staging after merge; the Release App handles Actions and release operations. (`.claude/hooks/fleet/no-version-bump-pr-guard/`) [`version-bumps`](docs/fleet/agents.md/version-bumps.md)
 - Dot-naming `@owner/<name>[.<lang>].<target>[-<platform>]`: the `.target` token carries the domain. [`binary-vs-napi-naming`](docs/fleet/agents.md/binary-vs-napi-naming.md)
 - A private package is unscoped `local-<directory>` at version `0.0.0`. [`private-package-identity`](docs/fleet/agents.md/private-package-identity.md)
 - Every `release.publishedPackages` entry is non-private and the set carries ONE version. (`scripts/fleet/check/published-packages-are-release-ready.mts`) [`private-package-identity`](docs/fleet/agents.md/private-package-identity.md)
@@ -158,7 +158,7 @@
 - Validate what SHIPS, not the source tree: the packed tarball's bytes, plus a leak scan of both. [`artifact-hygiene`](docs/fleet/agents.md/artifact-hygiene.md)
 - A `github-action` member ships committed `dist/` at a tag. (`scripts/fleet/check/github-action-aliases-are-not-frozen.mts`) [`github-action-release-contract`](docs/fleet/agents.md/github-action-release-contract.md)
 - GitHub CLI tokens: keychain only; `workflow` scope off by default; 8-hour age cap. [`gh-token-hygiene`](docs/fleet/agents.md/gh-token-hygiene.md)
-- Release App writes default-branch and release content. PR App writes repair branches, issues, and PRs. Both are organization-wide. [`token-hygiene`](docs/fleet/agents.md/token-hygiene.md)
+- Release App manages Actions runs and release content. PR App writes signed branches, issues, and PRs. Both are organization-wide. [`token-hygiene`](docs/fleet/agents.md/token-hygiene.md)
 - Commits on `main`/`master` must be signed. [`commit-signing`](docs/fleet/agents.md/commit-signing.md) [`git-config-write-guard`](docs/fleet/agents.md/git-config-write-guard.md)
 - Keep AI logic canonical; generate client aliases during setup, never commit them. [`release-vs-cascade`](docs/fleet/agents.md/release-vs-cascade.md)
 - Skills, commands, and agent instructions are thin wrappers. [`agents-and-skills`](docs/fleet/agents.md/agents-and-skills.md)