jonah-fleet 1.0.0

package/templates/workflows/autowork-cron.yml

@@ -0,0 +1,154 @@
+name: Autowork Scheduled Cron (agy)
+
+# Scheduled execution of the Autowork routine using Antigravity CLI on Gemini 3.7 Flash.
+
+on:
+  schedule:
+    # Runs every 6 hours by default (00:15, 06:15, 12:15, 18:15 UTC)
+    - cron: '15 */6 * * *'
+  workflow_dispatch:
+    inputs:
+      target_issue:
+        description: 'Optional issue number to work in Targeted mode (leave blank for Scan mode)'
+        required: false
+        type: string
+
+concurrency:
+  group: autowork-agent-scan
+  cancel-in-progress: false
+
+jobs:
+  run-autowork:
+    runs-on: ubuntu-latest
+    timeout-minutes: 65
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      statuses: write
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Configure Git author identity
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Cache Antigravity CLI
+        id: cache-agy
+        uses: actions/cache@v4
+        with:
+          path: ~/.local/bin/agy
+          key: agy-cli-linux-amd64-v1
+
+      - name: Install Antigravity CLI
+        if: steps.cache-agy.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL https://antigravity.google/cli/install.sh | bash
+
+      - name: Add Antigravity CLI to PATH
+        run: echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Write Antigravity OAuth Token
+        env:
+          ANTIGRAVITY_OAUTH_TOKEN: ${{ secrets.ANTIGRAVITY_OAUTH_TOKEN || secrets.GEMINI_API_KEY }}
+        run: |
+          if [ -z "$ANTIGRAVITY_OAUTH_TOKEN" ]; then
+            echo "::error::Neither ANTIGRAVITY_OAUTH_TOKEN nor GEMINI_API_KEY secret is set; cannot authenticate Antigravity CLI." >&2
+            exit 1
+          fi
+          mkdir -p "$HOME/.gemini/antigravity-cli"
+          chmod 700 "$HOME/.gemini/antigravity-cli"
+          printf '%s' "$ANTIGRAVITY_OAUTH_TOKEN" > "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
+          chmod 600 "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
+
+      - name: Preflight validation
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [ ! -s "$HOME/.gemini/antigravity-cli/antigravity-oauth-token" ]; then
+            echo "::error::Preflight check failed: Antigravity OAuth token file is missing or empty." >&2
+            exit 1
+          fi
+          if ! gh auth status >/dev/null 2>&1; then
+            echo "::error::GitHub CLI authentication check failed with GITHUB_TOKEN." >&2
+            exit 1
+          fi
+          echo "✓ Preflight credential and GitHub CLI validation passed."
+
+      - name: Discover domain skills
+        id: skills
+        run: |
+          SKILLS_PROMPT=""
+          if [ -d ".agents/skills" ]; then
+            for skill_path in .agents/skills/*/SKILL.md; do
+              if [ -f "$skill_path" ]; then
+                SKILLS_PROMPT="${SKILLS_PROMPT}Read and follow ${skill_path}. "
+              fi
+            done
+          fi
+          echo "skills_prompt=$SKILLS_PROMPT" >> "$GITHUB_OUTPUT"
+
+      - name: Run Autowork
+        timeout-minutes: 60
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GOOGLE_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          ANTIGRAVITY_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          TARGET_ISSUE: ${{ inputs.target_issue }}
+          SKILLS_PROMPT: ${{ steps.skills.outputs.skills_prompt }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+        run: |
+          if [ -n "$TARGET_ISSUE" ]; then
+            PROMPT="You are the Autowork routine for this repository. Read and follow the instructions in .github/prompts/autowork.md exactly. ${SKILLS_PROMPT} Your target is issue #${TARGET_ISSUE}. You are in Targeted mode: work issue #${TARGET_ISSUE} directly, ahead of Phase 1 convergence and priority scan."
+          else
+            PROMPT="You are the Autowork routine for this repository. Read and follow the instructions in .github/prompts/autowork.md exactly. ${SKILLS_PROMPT} You are in Scan mode: check open PRs for review comments to fix, close merged issues, then pick the highest-priority unclaimed issue."
+          fi
+
+          agy -p "$PROMPT" \
+            --model gemini-3.7-flash-high \
+            --output-format text \
+            --print-timeout 60m \
+            --dangerously-skip-permissions
+
+      - name: Emit run summary
+        if: always()
+        run: |
+          LATEST_LOG=$(ls -t .github/prompts/logs/autowork/*.md 2>/dev/null | head -n 1)
+          if [ -n "$LATEST_LOG" ] && [ -n "$GITHUB_STEP_SUMMARY" ]; then
+            cat "$LATEST_LOG" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Verify Atomic Handoff Invariant (PR Existence Guard)
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          LATEST_LOG=$(ls -t .github/prompts/logs/autowork/*.md 2>/dev/null | head -n 1)
+          if [ -n "$LATEST_LOG" ]; then
+            if grep -q "Result.*SUCCESS" "$LATEST_LOG"; then
+              WORKED_BRANCH=$(grep -E '^\s*-\s*(Pushed branch|Branch):' "$LATEST_LOG" | head -n 1 | sed -E 's/.*`([^`]+)`.*/\1/')
+              if [ -n "$WORKED_BRANCH" ] && [[ "$WORKED_BRANCH" =~ (feat|fix)/ ]]; then
+                echo "Verifying PR existence for branch: $WORKED_BRANCH"
+                PR_COUNT=$(gh pr list --head "$WORKED_BRANCH" --state all --json number --jq 'length' 2>/dev/null || echo "0")
+                if [ "$PR_COUNT" -eq 0 ]; then
+                  echo "::error::Atomic Handoff Invariant Violated: Branch '$WORKED_BRANCH' was implemented and pushed, but no pull request exists on GitHub!" >&2
+                  exit 1
+                fi
+                echo "✓ Verified pull request exists on GitHub for branch: $WORKED_BRANCH"
+              fi
+            fi
+          fi

package/templates/workflows/dependency-check-cron.yml

@@ -0,0 +1,85 @@
+name: Dependency Check Cron
+
+on:
+  schedule:
+    # Runs weekly on Mondays at 08:00 UTC
+    - cron: '0 8 * * 1'
+  workflow_dispatch:
+
+concurrency:
+  group: dependency-check
+  cancel-in-progress: false
+
+jobs:
+  run-dependency-check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      statuses: write
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Configure Git author identity
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Cache Antigravity CLI
+        id: cache-agy
+        uses: actions/cache@v4
+        with:
+          path: ~/.local/bin/agy
+          key: agy-cli-linux-amd64-v1
+
+      - name: Install Antigravity CLI
+        if: steps.cache-agy.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL https://antigravity.google/cli/install.sh | bash
+
+      - name: Add Antigravity CLI to PATH
+        run: echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Write Antigravity OAuth Token
+        env:
+          ANTIGRAVITY_OAUTH_TOKEN: ${{ secrets.ANTIGRAVITY_OAUTH_TOKEN || secrets.GEMINI_API_KEY }}
+        run: |
+          if [ -z "$ANTIGRAVITY_OAUTH_TOKEN" ]; then
+            echo "::error::Neither ANTIGRAVITY_OAUTH_TOKEN nor GEMINI_API_KEY secret is set; cannot authenticate Antigravity CLI." >&2
+            exit 1
+          fi
+          mkdir -p "$HOME/.gemini/antigravity-cli"
+          chmod 700 "$HOME/.gemini/antigravity-cli"
+          printf '%s' "$ANTIGRAVITY_OAUTH_TOKEN" > "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
+          chmod 600 "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
+
+      - name: Run Dependency Update Check
+        timeout-minutes: 25
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GOOGLE_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          ANTIGRAVITY_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+        run: |
+          PROMPT="You are the Dependency Update & Security Check routine. Read and follow .github/prompts/dependency-update-security-check.md exactly. Check dependencies for updates and vulnerabilities, and create or update tracking issues."
+
+          agy -p "$PROMPT" \
+            --model gemini-3.7-flash-high \
+            --output-format text \
+            --print-timeout 25m \
+            --dangerously-skip-permissions

package/templates/workflows/issues-housekeeping-cron.yml

@@ -0,0 +1,85 @@
+name: Issues Housekeeping Cron
+
+on:
+  schedule:
+    # Runs weekly on Sundays at 04:00 UTC
+    - cron: '0 4 * * 0'
+  workflow_dispatch:
+
+concurrency:
+  group: issues-housekeeping
+  cancel-in-progress: false
+
+jobs:
+  run-housekeeping:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      statuses: write
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Configure Git author identity
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Cache Antigravity CLI
+        id: cache-agy
+        uses: actions/cache@v4
+        with:
+          path: ~/.local/bin/agy
+          key: agy-cli-linux-amd64-v1
+
+      - name: Install Antigravity CLI
+        if: steps.cache-agy.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL https://antigravity.google/cli/install.sh | bash
+
+      - name: Add Antigravity CLI to PATH
+        run: echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Write Antigravity OAuth Token
+        env:
+          ANTIGRAVITY_OAUTH_TOKEN: ${{ secrets.ANTIGRAVITY_OAUTH_TOKEN || secrets.GEMINI_API_KEY }}
+        run: |
+          if [ -z "$ANTIGRAVITY_OAUTH_TOKEN" ]; then
+            echo "::error::Neither ANTIGRAVITY_OAUTH_TOKEN nor GEMINI_API_KEY secret is set; cannot authenticate Antigravity CLI." >&2
+            exit 1
+          fi
+          mkdir -p "$HOME/.gemini/antigravity-cli"
+          chmod 700 "$HOME/.gemini/antigravity-cli"
+          printf '%s' "$ANTIGRAVITY_OAUTH_TOKEN" > "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
+          chmod 600 "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
+
+      - name: Run Issues Housekeeping
+        timeout-minutes: 40
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GOOGLE_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          ANTIGRAVITY_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+        run: |
+          PROMPT="You are the Issues Housekeeping routine for this repository. Read and follow .github/prompts/issues-housekeeping.md exactly. Sweep open issues for staleness, duplicates, priority accuracy, and orphaned claims."
+
+          agy -p "$PROMPT" \
+            --model gemini-3.7-flash-high \
+            --output-format text \
+            --print-timeout 40m \
+            --dangerously-skip-permissions

package/templates/workflows/prompt-optimizer-cron.yml

@@ -0,0 +1,85 @@
+name: Prompt Optimizer Cron
+
+on:
+  schedule:
+    # Runs weekly on Sundays at 10:00 UTC
+    - cron: '0 10 * * 0'
+  workflow_dispatch:
+
+concurrency:
+  group: prompt-optimizer
+  cancel-in-progress: false
+
+jobs:
+  run-optimizer:
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      statuses: write
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Configure Git author identity
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Cache Antigravity CLI
+        id: cache-agy
+        uses: actions/cache@v4
+        with:
+          path: ~/.local/bin/agy
+          key: agy-cli-linux-amd64-v1
+
+      - name: Install Antigravity CLI
+        if: steps.cache-agy.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL https://antigravity.google/cli/install.sh | bash
+
+      - name: Add Antigravity CLI to PATH
+        run: echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Write Antigravity OAuth Token
+        env:
+          ANTIGRAVITY_OAUTH_TOKEN: ${{ secrets.ANTIGRAVITY_OAUTH_TOKEN || secrets.GEMINI_API_KEY }}
+        run: |
+          if [ -z "$ANTIGRAVITY_OAUTH_TOKEN" ]; then
+            echo "::error::Neither ANTIGRAVITY_OAUTH_TOKEN nor GEMINI_API_KEY secret is set; cannot authenticate Antigravity CLI." >&2
+            exit 1
+          fi
+          mkdir -p "$HOME/.gemini/antigravity-cli"
+          chmod 700 "$HOME/.gemini/antigravity-cli"
+          printf '%s' "$ANTIGRAVITY_OAUTH_TOKEN" > "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
+          chmod 600 "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
+
+      - name: Run Prompt Optimizer
+        timeout-minutes: 35
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GOOGLE_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          ANTIGRAVITY_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+        run: |
+          PROMPT="You are the Prompt Optimizer routine for this repository. Read and follow .github/prompts/optimizer.md exactly. Diagnose failures, token anomalies, and review loops, and propose preventative prompt and test fixes."
+
+          agy -p "$PROMPT" \
+            --model gemini-3.7-flash-high \
+            --output-format text \
+            --print-timeout 35m \
+            --dangerously-skip-permissions

package/templates/workflows/sync-fleet.yml

@@ -0,0 +1,63 @@
+name: Sync Jonah Fleet
+
+on:
+  schedule:
+    # Check for fleet updates weekly on Mondays at 06:00 UTC
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+  repository_dispatch:
+    types: [fleet-release]
+
+jobs:
+  sync-fleet:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Configure Git author identity
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Run jonah-fleet sync
+        id: sync
+        run: |
+          npx jonah-fleet sync --check || true
+          npx jonah-fleet sync --force
+
+      - name: Check for changes
+        id: git-check
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create Pull Request for Fleet Updates
+        if: steps.git-check.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+        run: |
+          BRANCH_NAME="chore/sync-jonah-fleet-$(date +%Y%m%d)"
+          git checkout -B "$BRANCH_NAME"
+          git add .
+          git commit -m "chore(fleet): sync prompt routines and workflows from jonah-fleet"
+          git push -u origin "$BRANCH_NAME" --force
+
+          gh pr create \
+            --head "$BRANCH_NAME" \
+            --base main \
+            --title "chore(fleet): sync prompt routines and workflows from jonah-fleet" \
+            --body "Automated update from \`jonah-fleet\`. Synchronizes latest prompt invariants, claim protocols, and workflow fixes."

package/templates/workflows/trigger-autowork-on-bug.yml

@@ -0,0 +1,101 @@
+name: Trigger Autowork on Bug
+
+on:
+  issues:
+    types: [labeled, opened]
+
+concurrency:
+  group: autowork-bug-${{ github.event.issue.number }}
+  cancel-in-progress: true
+
+jobs:
+  fire-autowork:
+    if: >-
+      (github.event.action == 'opened' && contains(github.event.issue.labels.*.name, 'bug') && contains(github.event.issue.labels.*.name, 'priority/P1')) ||
+      (github.event.action == 'labeled' && (github.event.label.name == 'bug' || github.event.label.name == 'priority/P1'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 65
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      statuses: write
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Configure Git author identity
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Cache Antigravity CLI
+        id: cache-agy
+        uses: actions/cache@v4
+        with:
+          path: ~/.local/bin/agy
+          key: agy-cli-linux-amd64-v1
+
+      - name: Install Antigravity CLI
+        if: steps.cache-agy.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL https://antigravity.google/cli/install.sh | bash
+
+      - name: Add Antigravity CLI to PATH
+        run: echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Write Antigravity OAuth Token
+        env:
+          ANTIGRAVITY_OAUTH_TOKEN: ${{ secrets.ANTIGRAVITY_OAUTH_TOKEN || secrets.GEMINI_API_KEY }}
+        run: |
+          if [ -z "$ANTIGRAVITY_OAUTH_TOKEN" ]; then
+            echo "::error::Neither ANTIGRAVITY_OAUTH_TOKEN nor GEMINI_API_KEY secret is set; cannot authenticate Antigravity CLI." >&2
+            exit 1
+          fi
+          mkdir -p "$HOME/.gemini/antigravity-cli"
+          chmod 700 "$HOME/.gemini/antigravity-cli"
+          printf '%s' "$ANTIGRAVITY_OAUTH_TOKEN" > "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
+          chmod 600 "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
+
+      - name: Discover domain skills
+        id: skills
+        run: |
+          SKILLS_PROMPT=""
+          if [ -d ".agents/skills" ]; then
+            for skill_path in .agents/skills/*/SKILL.md; do
+              if [ -f "$skill_path" ]; then
+                SKILLS_PROMPT="${SKILLS_PROMPT}Read and follow ${skill_path}. "
+              fi
+            done
+          fi
+          echo "skills_prompt=$SKILLS_PROMPT" >> "$GITHUB_OUTPUT"
+
+      - name: Run Autowork
+        timeout-minutes: 60
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GOOGLE_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          ANTIGRAVITY_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          TARGET_ISSUE: ${{ github.event.issue.number }}
+          SKILLS_PROMPT: ${{ steps.skills.outputs.skills_prompt }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+        run: |
+          PROMPT="You are the Autowork routine for this repository. A high-priority bug was filed. Read and follow .github/prompts/autowork.md. ${SKILLS_PROMPT} Your target is issue #${TARGET_ISSUE}. You are in Targeted mode: work issue #${TARGET_ISSUE} directly."
+
+          agy -p "$PROMPT" \
+            --model gemini-3.7-flash-high \
+            --output-format text \
+            --print-timeout 60m \
+            --dangerously-skip-permissions