Context:
The watchdog is built and pushed (.github/workflows/deploy-watch.yml, a06ae5a). It cannot run until a Railway project token is added as the RAILWAY_TOKEN repo secret — the one step that cannot be done from an agent session, because it mints a long-lived credential.
To finish:
- Railway → the
augment-it project → Settings → Tokens → create a project token scoped to the production environment.
gh secret set RAILWAY_TOKEN --repo lossless-group/augment-it (or Settings → Secrets → Actions).- Run
Deploy watch manually via workflow_dispatch to confirm it goes green.
A project token is deliberate: it is scoped to one environment of one project, where an account token would grant this workflow every project in the workspace. It authenticates with the Project-Access-Token header rather than Authorization: Bearer.
Done when a deliberately failed deploy opens an issue within one poll interval, recovery closes it, and DEPLOYMENT.md documents the token and how to rotate it.
Context:
The watchdog is built and pushed (
.github/workflows/deploy-watch.yml,a06ae5a). It cannot run until a Railway project token is added as theRAILWAY_TOKENrepo secret — the one step that cannot be done from an agent session, because it mints a long-lived credential.To finish:
augment-itproject → Settings → Tokens → create a project token scoped to theproductionenvironment.gh secret set RAILWAY_TOKEN --repo lossless-group/augment-it(or Settings → Secrets → Actions).Deploy watchmanually viaworkflow_dispatchto confirm it goes green.A project token is deliberate: it is scoped to one environment of one project, where an account token would grant this workflow every project in the workspace. It authenticates with the
Project-Access-Tokenheader rather thanAuthorization: Bearer.Done when a deliberately failed deploy opens an issue within one poll interval, recovery closes it, and
DEPLOYMENT.mddocuments the token and how to rotate it.