---
name: traceable-reqs-ci-install-cache
description: "CI's traceability gate has always passed on a cache hit, never the clone — TRACEABLE_REQS_TOKEN is dead code, and a pin bump is a two-place change (runner box + tracked WANT)"
metadata: 
  node_type: memory
  type: project
  originSessionId: 698e20b9-a0cd-4e59-bbe3-dc521afcfb25
  modified: 2026-07-30T02:21:41.324Z
---

# The `TRACEABLE_REQS_TOKEN` was never load-bearing (measured 2026-07-30)

`traceable-reqs` lives in its own **private** repo `BigscreenVR/traceable-reqs`, not in `spt-bs-core`. The traceability job installs it like this (`ci.yml` / `golden.yml`, one `WANT=` line each):

1. if `~/.local/bin/traceable-reqs --version` matches `WANT` → symlink it, **done**;
2. else clone the private repo with `https://x-access-token:${GH_TOKEN}@…` and `cargo build --release`.

GitHub's automatic per-run token only opens the repo the run is in, so step 2 needs a PAT in the `TRACEABLE_REQS_TOKEN` repo secret. **That secret has never been provisioned.**

⭐⭐ **So step 2 is dead code, and every green traceability run in this repo's history has been a cache hit.** kitsubito had 0.1.2 hand-installed 2026-07-09 and every branch pinned 0.1.2. #122 was not special — it is simply the first branch to ask for a different version (0.1.4), fell into the dead branch, and got `fatal: Authentication failed` / **exit 128**. Same box, same job, same missing secret; the only variable was the version number.

⚖ **Only kitsubito matters** — the traceability job is `runs-on: [self-hosted, Linux, kitsubito]`. hfenduleam's copy (at `AppData\Local\Programs\traceable-reqs\`, *not* `~/.local/bin`) is the local gate tool and is irrelevant to CI.

## Upgrade path (operator-authorized 2026-07-30: "everything should be running v0.2.0")
`ssh reavus@kitsubito`, then `gh repo clone BigscreenVR/traceable-reqs "$SRC" -- --depth 1 --branch vX.Y.Z` → `~/.cargo/bin/cargo build --release --manifest-path "$SRC/rust/Cargo.toml"` → copy to `~/.local/bin/traceable-reqs`. **16 seconds.** kitsubito's `gh` is authenticated (SaberMage) but `cargo` is NOT on the non-interactive ssh PATH — use `~/.cargo/bin/cargo`. Assert the cloned sha against `refs/tags/vX.Y.Z^{}`, not the tag ref (v0.2.0 = `f13a3c6…`, annotated).

## ⚠ BINDING: a pin bump is a TWO-PLACE change, and order matters
The tracked `WANT=` and the binary on kitsubito must agree, and **nothing enforces it**. Upgrading the box while the pin is stale is an instant guaranteed cache miss — I did exactly that and red'd CI for everyone until PR #126 landed.
**Box first, pin second.** `git grep 'WANT='` (two files) and the runner's `--version` change together. The failure mode is nasty: an **authentication error that names nothing about versions**, so the next person debugs credentials instead of the pin.

## Measured before changing the tree (the discriminating probe)
On kitsubito, against the runner's own workspace at `8f3e10b`:

| probe | result |
|---|---|
| `traceable-reqs 0.2.0 check` | **exit 0** — coverage gate passes under the new version |
| `--version \| grep -q " 0.1.2$"` | MISS → clone → auth fail |
| `--version \| grep -q " 0.2.0$"` | **HIT** → no clone, no token |

PR #126 (`WANT` 0.1.2→0.2.0, both workflows) proved itself: its own `traceability` job passed **in 9s** — too fast to have built anything, which is the cache hit observed rather than argued.

## Open, banked for the v0.46.1 grill
Whether to provision the PAT at all. **We do not need it**: hand-installing on two long-lived self-hosted runners costs one 16s build. A PAT buys CI the ability to self-serve future bumps and costs a credential to store and rotate. Operator's call. #122 stays parked until #126 lands, then rebases onto a main pinned at 0.2.0 and its own 0.1.4 line disappears.

Related: [[audit-the-boring-claims]] · [[a-predicate-without-its-tool-is-not-evidence]] · [[tla-spec-pilot-progress]] · [[golden-ci-strategy]] · [[kitsubito-linux-rig]]