{
  "type": "abp/mandate/v1",
  "id": "ci-job",
  "label": "A CI job on a hosted runner",
  "surface": [
    "ci"
  ],
  "applies_to": [
    "github/actions-runner/ci"
  ],
  "status": "starting-point",
  "authored": "2026-09-09",
  "authored_by": "the site, as a starting point — not measured, not surveyed; the first thing to argue with",
  "description": "Check out the code, build it, run the tests, fetch what it needs, and — when a release is cut — push the tag. I did not want it reading credentials beyond its own token.",
  "want": [
    "read.file.project",
    "write.file.project",
    "execute.process.host",
    "send.endpoint.world",
    "write.repository.tenant"
  ],
  "do_not_want": [
    "read.credential.host"
  ],
  "unstated": [
    "authenticate-as.credential.signing",
    "authenticate-as.credential.tenant",
    "create.record.world",
    "create.schedule.host",
    "create.schedule.tenant",
    "delete.file.host",
    "execute.process.self",
    "grant.credential.self",
    "read.file.host",
    "read.message.tenant",
    "read.record.browsing",
    "read.record.history",
    "send.endpoint.allowed",
    "send.message.world",
    "write.budget.tenant",
    "write.file.host",
    "write.repository.project"
  ],
  "notes": {
    "write.repository.tenant": "deliberately in the mandate: most release workflows push a tag, and this profile's token is contents:read — so this row is a shortfall, and the kind the game calls ‘a gap you were counting on’",
    "delete.file.host": "unstated: the runner is destroyed after the job"
  },
  "provenance": {
    "source": "https://what-can-it-do.games.sgit.ai/data/",
    "source_page": "https://what-can-it-do.games.sgit.ai/map/index.html",
    "retrieved": "2026-09-11T13:00:37Z",
    "pack_version": "v0.8.0",
    "content_hash": "sha256:d6d4ba40f1fb1f93f660687e4787ac10c2e1835efeb3929a4c8ad62cee8897ef",
    "verbatim_bytes": "upstream/",
    "note": "Promoted from mandates/ci-job.json. `unstated` is computed here as the primitives the mandate names neither way; the pack leaves it implicit. A mandate is elicited, not measured: these are first drafts written to be argued with.",
    "licence": "CC BY 4.0"
  }
}