arizuko › products › Repo worker (Atlas) › setup

Repo worker setup

Steps 4 and 6 need gitd, which is not built yet. Everything up to step 3 works today and gives the agent its gh tools behind the hold gate. Repo events — pushes, issues, review requests — have nothing to deliver them until gitd ships (specs/6/27).

1. Install the GitHub App

Install a GitHub App on the repositories the agent should watch. An App, not a personal access token: a PAT stamps your identity on everything the agent does, so its comments and commits become indistinguishable from yours. The App posts as <app>[bot].

2. Set the environment

Variable	Required	What it is
`GITHUB_APP_ID`	yes	the App id
`GITHUB_PRIVATE_KEY`	yes	App private key (PEM); mints the short-lived installation token
`GITHUB_WEBHOOK_SECRET`	yes	shared secret the inbound webhook HMAC is verified against
`WEB_HOST`	no	set it and every held-call notice carries a link straight to the approval page

3. Enable the github connector

cp template/connectors/github.toml <data-dir>/connectors/

This is what gives the agent its gh tools. The connector holds the credential; the agent never sees it.

4. Route the repository

One row per level. ** is not a subtree glob here and a ** row silently matches nothing (specs/6/27):

arizuko route <inst> add "chat_jid=git:me/proj/pr/* verb=reply"    dev
arizuko route <inst> add "chat_jid=git:me/proj/pr/* verb=message"  dev
arizuko route <inst> add "chat_jid=git:me/proj/pr/*"    dev#observe -s 100
arizuko route <inst> add "chat_jid=git:me/proj/issue/*" dev#observe -s 100
arizuko route <inst> add "chat_jid=git:me/proj"         dev#observe -s 100

The #observe rows at a low score are what make the agent quiet: a push or a label lands as context it reads and does not answer. The two verb= rows are the ones that let it speak.

5. Hold what you want to sign off

Merge is the one that matters. A hold grant stops the call and asks you:

arizuko group <inst> grant dev "hold:mcp:github_merge_pull_request" dev
arizuko group <inst> grant dev "hold:mcp:github_create_pull_request" dev

Approvals reach you two ways with no chat platform running: /approve <id> wherever you talk to it, and the link the held notice carries to /dash/approvals/.

6. Seed the group and run

arizuko group <instance> add telegram:group/-100123 dev --product github
arizuko run <instance>

7. Fill in the facts

facts/repo.md ships as a placeholder and must be replaced. Put the exact build, test and lint commands in it, name the generated directories that must never be hand-edited, and write down what “done” means for a change.

A wrong fact is worse than a missing one, because the agent cites it. Treat a stale line in facts/ as a bug with a filename.

8. Verify

arizuko send <instance> dev "what are the build and test commands here?" --wait

A correct answer quotes facts/repo.md. If it guesses from the source tree instead, the product seed did not land in that folder.

Then run its own case suite against the live agent:

anteval run <host> --cases <data-dir>/groups/dev/eval