Start
M4 Charge: build the smallest ForgeKit-owned fresh-execution boundary
Prior same-day sessions had already found RemoteTrigger (session_config_rejected, no informative schema) and claude --cloud (hard interactive-TTY requirement) both blocked
15m
Found a real, unblocked third path: GitHub Actions workflow_dispatch + the official anthropics/claude-code-action
Repo already had gh CLI with workflow scope, an existing CI workflow, and CI secrets precedent — no TTY problem, no claude.ai Environment concept
25m
Built the two-file boundary: spawn-fresh-actor.mjs (provider-neutral caller) + actor-spawn.yml (the one Claude runtime implementation)
Caller only knows a workflow name and a plain charge_path string — no environment_id, no session schema, no TTY handling
35m
Zeb registered FORGEKIT_ACTOR_ANTHROPIC_API_KEY as a one-time setup step
Could not be done by Smith — no access to Anthropic account credentials, and secret values must never be pasted into chat
45m
First 3 real dispatches each failed for a different, informative reason
Missing id-token:write → then a genuinely empty API key balance (billing_error, not architecture) → then a real success that never committed (missing --allowedTools, denied by the action's own Bash-deny-by-default)
55m
4th dispatch succeeded completely: fresh Actor, independent session id, committed durable acknowledgement to master, single consumer, hard stop
Cost: $1.76. M4 declared DEMONSTRATED; cost flagged as the open concern, not glossed over
M4.1 start
Follow-up Charge: don't optimize the first working path — check whether OAuth/subscription auth is a cheaper adequate alternative before touching the model
Explicitly rejected 'just switch to Haiku' as premature optimization ahead of the real question
+20m
3 independent official sources all confirmed claude setup-token 'requires Claude subscription' — no API key mentioned anywhere
docs/setup.md, claude-code-base-action README, and claude --help all agreed
+30m
Investigated Workload Identity Federation and rejected it on mechanism, not by running it
svac_/wrkspc_ constructs are Anthropic Console API-billing primitives — very likely still metered spend, just without a static key. Assessed as solving credential lifecycle, not cost.
+45m
Zeb ran claude setup-token locally, registered the OAuth token; one verification probe dispatched
Swapped only the auth input in actor-spawn.yml — spawn-fresh-actor.mjs was never touched
+55m
Probe succeeded again (2nd fresh Actor this session) — then the Console itself settled the billing question
Team/spend view showed exactly ONE billed identity (forgekit-actor-spawn [API KEY], $3.39, matching the two API-key runs to the cent) — the OAuth run's self-reported $1.20 never appeared as added spend anywhere
