feat: organism board reads with the pyautolabs-bot App, no fallback (token phase 2a)

.github/workflows/organism_board.yml

@@ -60,12 +60,25 @@ jobs:
             if [ "$status" -ne 2 ]; then exit "$status"; fi
           fi
 
+      # Cross-repo activity reads (issues, issue comments, PR details) use an
+      # owner-wide read-only App token. No fallback to the workflow token: a
+      # failed mint fails the run rather than silently shrinking coverage.
+      - name: Mint App token (read-only, owner-wide)
+        id: app_token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: PyAutoLabs
+          permission-issues: read
+          permission-pull-requests: read
+          permission-metadata: read
+
       - name: Collect public development activity
         env:
-          GH_TOKEN: ${{ secrets.PAT_PYAUTOLABS || github.token }}
-          ACTIVITY_BUDGET: ${{ secrets.PAT_PYAUTOLABS && '180' || '60' }}
+          GH_TOKEN: ${{ steps.app_token.outputs.token }}
         run: |
-          python scripts/activity_feed.py --repos PyAutoMind/repos.yaml --cache _activity/cache.json --output _site/activity.json --budget "$ACTIVITY_BUDGET"
+          python scripts/activity_feed.py --repos PyAutoMind/repos.yaml --cache _activity/cache.json --output _site/activity.json --budget 180
 
       - name: Preserve bounded derived index
         if: github.ref == 'refs/heads/main'

REPORTING.md

@@ -124,8 +124,9 @@ mark it stale and leave the cursor unchanged. Losing the cache starts a disclose
 seven-day backfill; successful collection retains up to 30 days, 1500 events per
 repository, 200 published task rows and 20 displayed events per task.
 
-The collector uses `PAT_PYAUTOLABS` when available (180 requests per cycle), or
-the workflow token (60). It rotates repositories when the request budget is
+The collector reads with a read-only token minted from the organisation's GitHub
+App and spends at most 180 requests per cycle; if the token cannot be minted the
+run fails rather than collecting with less. It rotates repositories when the request budget is
 exhausted; a busy source or pagination cap is reported in coverage rather than
 claimed complete. The issue and comment endpoints paginate up to three pages
 of 100 each. Partial batches retain verified events and reuse already normalized PR

scripts/activity_feed.py

@@ -363,7 +363,7 @@ def main():
     ap.add_argument('--budget', type=int, default=60)
     ap.add_argument('--config', type=Path, default=Path(__file__).resolve().parents[1] / 'config' / 'activity_sources.json')
     args = ap.parse_args()
-    # 180 calls / 5min fits a 5000/hour PAT. Default GITHUB_TOKEN uses 60/cycle.
+    # The board workflow passes 180 calls / 5min, which fits the App token's 5000/hour.
     previous = json.loads(args.cache.read_text()) if args.cache.exists() else {}
     import yaml
     config = json.loads(args.config.read_text())