chadtmiller.com/knotless
git that lives in your Atmosphere account
The runner host's notes say a space scope is granted as the login is approved
MergedThis is a docs-only change to deploy/runner-host/README.md. It adds a note beside the existing "approve the login again" cases. A runner login approved at a PDS that didn't yet expand a bare space: scope keeps a grant that writes nothing to a space. Refreshes keep that grant, so private repositories fail with Scope does not permit update in …. Approving again after the PDS is updated fixes it. The text reads correctly in context and matches the existing paragraph. Changeset: none is right, since no client code changes, and AGENTS.md lists no docs page that needs updating with this note. I couldn't check the "before November 4, 2026" pds.js date against anything in the repo, so it rests on your account of the incident.
1 passed, 2 skipped
What changes
deploy/runner-host/README.mdsays what a runner's login approved at a PDS that did not yet expand a barespace:scope does: its grant writes nothing to a space, its refreshes keep that grant, and every private repository's run fails withScope does not permit update in at://…/space/…. Approving the login again once the PDS is updated fixes it.Why
The runner hit this on 2026-11-07. Its PDS, a pds.js worker, predated the scope expansion. Updating the worker did not help until the login was approved again, since the expansion happens at approval.
How it was checked
The runner's 403s stopped once the login was approved again, and group-host's checks were filed within a minute.
Changeset: none
🤖 Generated with Claude Code