launch-agent: default stateless LLM auth, App-naming interview

[bborbe]

Aligns the /launch-agent scaffolder with the fleet auth norms (Agent Design Guide §7.2a/§7.2c) so new agents don't inherit stale defaults.

• config-crd-template.yaml: stateless ANTHROPIC_AUTH_TOKEN + BASE_URL/MODEL is the default env block; OAuth PVC demoted to a commented opt-in exception with its cost noted
• interview.md Part 2: runtime tier defaults to MiniMax/stateless; Max tier flagged as the OAuth-PVC exception
• interview.md Part 7: security question now renders the §7.2c Secret (inline MOPmQL) and, when the agent touches GitHub, drives the §7.2a App pair (Ben's / Ben's Dev, least-privilege, PEM→TeamVault)
• SKILL.md: related section points at §7.2a/§7.2c anchors

Motivated by github-update-go-agent shipping the stale OAuth-PVC default → same-day reversal PR bborbe/quant#76.

[ben-s-pull-request-reviewer]

{
  "verdict": "request-changes",
  "summary": "PR introduces the stateless LLM auth default correctly, but two correctness issues require fixes: (1) the OAuth PVC volumeClaim/volumeMountPath are two independent commented lines — uncommenting one alone produces invalid YAML; (2) SKILL.md uses hardcoded section numbers (§7.2a, §7.2c) that will silently break if the Agent Design Guide is reorganized.",
  "comments": [
    {
      "file": "skills/launch-agent/references/config-crd-template.yaml",
      "line": 51,
      "severity": "major",
      "message": "correctness: volumeClaim and volumeMountPath are two independent comment lines. A user who uncomments only one (the common case — they only need one or the other) produces invalid YAML and a silent Config CR rejection. Anchor the pairing explicitly: either merge into a single multi-line comment block with a clear 'both or neither' notice, or restructure so uncommenting one always requires the other."
    },
    {
      "file": "skills/launch-agent/SKILL.md",
      "line": 279,
      "severity": "major",
      "message": "correctness: the reference 'esp. §7.2a (GitHub App naming...) + §7.2c (fleet LLM auth...)' hardcodes section numbers. If the Agent Design Guide is ever reorganized these anchors break silently. Prefer loose references like '§7.2 auth conventions' or document the section titles as anchors so reorganization is detectable at review time."
    }
  ],
  "concerns_addressed": [
    "security: OAuth PVC correctly demoted to opt-in commented block per §7.2c — ANTHROPIC_BASE_URL/MODEL env vars are the fleet default",
    "security: ANTHROPIC_AUTH_TOKEN inline TeamVault ID MOPmQL confirmed intentional per interview.md:94 (same token across stages, no env-indirection needed)",
    "security: GitHub App naming convention confirmed as \"Ben's <Role>\" / \"Ben's <Role> Dev\" with plain ' Dev' suffix per §7.2a",
    "correctness: volumeClaim/volumeMountPath pairing is a latent bug — flagged as Should Fix above",
    "correctness: MiniMax 'Tier-D quality' characterization is a reasonable marketing tier label, not a defect",
    "correctness: SKILL.md §7.2a/§7.2c anchor fragility — flagged as Should Fix above"
  ]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

Based on my review of the 4 changed files, here is my assessment:

Files Changed:

• CHANGELOG.md — release note entry
• skills/launch-agent/SKILL.md — role description updated to reference §7.2c stateless token norm
• skills/launch-agent/references/config-crd-template.yaml — OAuth PVC demoted to commented opt-in; MiniMax stateless defaults
• skills/launch-agent/references/interview.md — Part 2 runtime tier defaults to MiniMax; Part 7 security covers GitHub App naming and per-stage pairs

---

Must Fix (Critical)

None.

Should Fix (Important)

1. skills/launch-agent/references/interview.md:94 — Part 7.3 security description says ANTHROPIC_AUTH_TOKEN uses inline TeamVault ID MOPmQL. While the inline value is a TeamVault lookup key (not a raw secret), the interview still says inline TeamVault ID MOPmQL for the shared MiniMax token — inline because it's the same across stages. The inline MOPmQL is a placeholder/example value in the template. The surrounding text could mislead an operator into thinking this exact value should appear in their Secret rather than their own resolved TeamVault key. Recommend: change MOPmQL to <TEAMVAULT_LOOKUP_KEY> to match the placeholder convention used everywhere else in the templates, or add a clarifying note that MOPmQL is an example key and operators must substitute their own.

2. skills/launch-agent/references/interview.md:95 — Part 7.3 GitHub App section says Ben's <Role> / Ben's <Role> Dev naming. The <Role> placeholder is appropriate, but the Ben's prefix is a personal name that may not generalize. The Agent Design Guide §7.2a is referenced as the source of truth, which is correct. No change required if §7.2a endorses this naming, but the skill should not assume personal-name prefix without that guide's backing.

Nice to Have (Optional)

1. skills/launch-agent/references/config-crd-template.yaml:54 — Comment says volumeMountPath: /home/claude/.claude but the template uses sed -i.bak for mechanical renames. If the operator's clone path differs, this hardcoded path may not be portable. Minor: the comment is only relevant when the opt-in block is uncommented.

2. skills/launch-agent/SKILL.md:279 — Related docs line says [[Agent Design Guide]] — ... § 7.2 auth conventions, sections "GitHub App auth..." + "LLM auth..." — the two conventions the scaffold defaults must honor (referenced by section title, not number, so a guide reorg is detectable). Good practice — section-title reference rather than number — but worth verifying the referenced section titles still exist in the guide at the time of merge.

---

Step 7 — Manual Review Summary

All 4 changed files are documentation/templates, no Go code. The changes correctly implement:

• Default to stateless MiniMax token auth (no OAuth PVC) per §7.2c
• OAuth PVC clearly commented as opt-in exception with cost explanation
• MiniMax as Part 2 runtime tier default with clear recommendation text
• GitHub App per-stage naming (Ben's <Role> / Ben's <Role> Dev) referenced from §7.2a
• CHANGELOG entry accurately describes all three changes

No security issues: no hardcoded secrets, no token values, no inline credentials.

---

{
  "verdict": "approve",
  "summary": "PR cleanly implements the three-scope change: (1) defaults new agents to stateless MiniMax token auth instead of OAuth-PVC, (2) demotes PVC to clearly-commented opt-in, and (3) extends the interview to cover GitHub App naming and per-stage pairs per §7.2a. All four changed files are consistent and accurate. One Should-Fix: the literal `MOPmQL` TeamVault key in interview.md Part 7.3 should be replaced with a `<PLACEHOLDER>` token to avoid operator confusion.",
  "comments": [
    {
      "file": "skills/launch-agent/references/interview.md",
      "line": 94,
      "severity": "major",
      "message": "Should Fix: Part 7.3 renders `ANTHROPIC_AUTH_TOKEN` with inline TeamVault ID `MOPmQL`. This literal example value could be copied verbatim by an operator. Replace with `<TEAMVAULT_LOOKUP_KEY>` placeholder to match the project's placeholder convention, or clarify that `MOPmQL` is an example and operators must substitute their own resolved TeamVault key."
    }
  ],
  "concerns_addressed": [
    "security: no hardcoded secrets in config-crd-template.yaml — ANTHROPIC_AUTH_TOKEN uses env indirection via TeamVault lookup key",
    "security: no actual token values in config-crd-template.yaml — template uses placeholder `<NAME>` and plain text defaults only",
    "security: App pair naming (Ben's <Role> / Ben's <Role> Dev) followed per §7.2a — least-privilege principle confirmed via guide reference",
    "correctness: OAuth PVC demoted to commented opt-in — config-crd-template.yaml lines 45-55 clearly note cost implication (interactive claude login, refresh runbook, oauth-probe, node-pinning)",
    "correctness: Part 2 runtime tier defaults to MiniMax/stateless — interview.md line 22 explicitly recommends MiniMax as the fleet standard with stateless token auth"
  ]
}