App `claude-action-runner` not installed on `glitchwerks/claude-configs` — blocks Task 6.5 freshness alarm

[cbeaulieu-gt]

Summary

Task 6.5 of the Phase 6 plan (docs/superpowers/plans/phase-6-promotion.md) authors runtime-check-private-freshness.yml — a workflow that computes a path-scoped commit-count denominator across glitchwerks/claude-configs (per spec §13 Q7). To do this, the workflow needs an authenticated read on claude-configs.

The intended auth path was the existing claude-action-runner App. As surfaced by verify-app-secrets.yml run 25411149108:

=== /installation/repositories (installation scope) ===
glitchwerks/github-actions
installation token works on 1 repo(s)

The App is only installed on glitchwerks/github-actions, not on glitchwerks/claude-configs. Task 6.5 will fail at the cross-repo git log <pinned-sha>..<main-head> -- <paths> step.

Three resolution paths

	Approach	Trade-off
A	Install claude-action-runner on glitchwerks/claude-configs	Cleanest; reuses existing App. One admin click
B	Use GITHUB_TOKEN — works for public repos via cross-repo read	Only works if claude-configs is public AND read access is sufficient; doesn't scale to writing
C	Add a separate PAT secret (CLAUDE_CONFIGS_READ_PAT)	Adds rotation surface

Recommendation: A if claude-configs is private, B if public and read-only suffices.

Acceptance criteria

• Verify whether glitchwerks/claude-configs is public or private
• If private: install claude-action-runner on claude-configs with at minimum contents: read and metadata: read
• If public: confirm GITHUB_TOKEN is sufficient for the path-scoped git log Task 6.5 needs (no auth required for public-repo clones)
• Update Task 6.5 step in the plan to reflect the chosen auth path (token vs App)
• Re-run verify-app-secrets.yml after install to confirm claude-configs appears in /installation/repositories

Blocks

This blocks Task 6.5 only. Tasks 6.1-6.4 (STAGE 5, rollback workflow, dry-runs) and Tasks 6.6-6.10 (prune, §13 Q5/Q4, PR opening) are independent.

Plan reference

• docs/superpowers/plans/phase-6-promotion.md Task 6.5
• Pre-execution check PE-6 (deferred — App-JWT required to verify from CLI)

🤖 Generated by Claude Code on behalf of @cbeaulieu-gt