The Boundary That Finally Spawned Something

Timeline

1. 1

   Start

   M4 Charge: build the smallest ForgeKit-owned fresh-execution boundary

   Prior same-day sessions had already found RemoteTrigger (session_config_rejected, no informative schema) and claude --cloud (hard interactive-TTY requirement) both blocked

2. 2

   15m

   Found a real, unblocked third path: GitHub Actions workflow_dispatch + the official anthropics/claude-code-action

   Repo already had gh CLI with workflow scope, an existing CI workflow, and CI secrets precedent — no TTY problem, no claude.ai Environment concept

3. 3

   25m

   Built the two-file boundary: spawn-fresh-actor.mjs (provider-neutral caller) + actor-spawn.yml (the one Claude runtime implementation)

   Caller only knows a workflow name and a plain charge_path string — no environment_id, no session schema, no TTY handling

4. 4

   35m

   Zeb registered FORGEKIT_ACTOR_ANTHROPIC_API_KEY as a one-time setup step

   Could not be done by Smith — no access to Anthropic account credentials, and secret values must never be pasted into chat

5. 5

   45m

   First 3 real dispatches each failed for a different, informative reason

   Missing id-token:write → then a genuinely empty API key balance (billing_error, not architecture) → then a real success that never committed (missing --allowedTools, denied by the action's own Bash-deny-by-default)

6. 6

   55m

   4th dispatch succeeded completely: fresh Actor, independent session id, committed durable acknowledgement to master, single consumer, hard stop

   Cost: $1.76. M4 declared DEMONSTRATED; cost flagged as the open concern, not glossed over

7. 7

   M4.1 start

   Follow-up Charge: don't optimize the first working path — check whether OAuth/subscription auth is a cheaper adequate alternative before touching the model

   Explicitly rejected 'just switch to Haiku' as premature optimization ahead of the real question

8. 8

   +20m

   3 independent official sources all confirmed claude setup-token 'requires Claude subscription' — no API key mentioned anywhere

   docs/setup.md, claude-code-base-action README, and claude --help all agreed

9. 9

   +30m

   Investigated Workload Identity Federation and rejected it on mechanism, not by running it

   svac_/wrkspc_ constructs are Anthropic Console API-billing primitives — very likely still metered spend, just without a static key. Assessed as solving credential lifecycle, not cost.

10. 10

    +45m

    Zeb ran claude setup-token locally, registered the OAuth token; one verification probe dispatched

    Swapped only the auth input in actor-spawn.yml — spawn-fresh-actor.mjs was never touched

11. 11

    +55m

    Probe succeeded again (2nd fresh Actor this session) — then the Console itself settled the billing question

    Team/spend view showed exactly ONE billed identity (forgekit-actor-spawn [API KEY], $3.39, matching the two API-key runs to the cent) — the OAuth run's self-reported $1.20 never appeared as added spend anywhere

What shipped

• forgekit-os/scripts/spawn-fresh-actor.mjs — ForgeKit-owned provider-neutral caller. spawnFreshExecution({chargePath}) dispatches via `gh workflow run`; pollRunHandle()/--poll never dispatches. No Claude-specific concept anywhere in this file.

• .github/workflows/actor-spawn.yml — the one Claude runtime implementation. workflow_dispatch → anthropics/claude-code-action@v1, now authenticated via claude_code_oauth_token (swapped from anthropic_api_key mid-session, evidence-driven).

• forgekit-os/observations/ — new directory, now holding 2 real fresh-Actor acknowledgement files, each independently committed by claude[bot] from GitHub's own infrastructure.