fix: remove credential mode model, separate mint mode from inference requirements

[ggallen]

Problem

PR #6224 (issue #6222) introduced a credential mode model (wif/oidc/token) to the repos management commands that conflates mint authentication with inference WIF requirements. The core bug: needsWIF in install.go:219 is now gated on credMode == CredModeWIF, which means GitHub repos using the default oidc mode skip writing FULLSEND_GCP_PROJECT_ID and FULLSEND_GCP_WIF_PROVIDER secrets. Those secrets are required for Vertex AI inference and have nothing to do with the mint.

PR #6241 (open) extends this further by stripping WIF secret references from the per-repo workflow shim when credential mode is oidc — but reusable-dispatch.yml unconditionally calls setup-gcp, so inference would break.

The terminology is also wrong: WIF is the general mechanism, OIDC is the token format. They aren't alternatives — both the "oidc" and "wif" credential modes use OIDC tokens exchanged via WIF. The real distinction is how the mint validates tokens (public JWKS vs private STS/WIF), which is a mint configuration detail, not a repo-level credential choice.

See Slack discussion with @bkorren (2026-08-16) for the full architectural critique.

Key Principles

1. Inference WIF is always required. Agents cannot work without LLM inference (Vertex AI). Every repo — GitHub and GitLab — needs FULLSEND_GCP_PROJECT_ID and FULLSEND_GCP_WIF_PROVIDER. No mode or flag should gate these.

2. Mint and inference are separate systems. Different WIF pools (fullsend-pool vs fullsend-inference), different purposes, different administrators. Repos commands should not conflate them.

3. The mint has two modes: public and private. Public (mint.fullsend.sh, ALLOWED_ORGS=*) vs private (self-managed, restricted orgs). This only affects FULLSEND_MINT_URL and whether mint enroll is needed. Public should be the default.

4. GitLab bot tokens use CI/CD variables. Per the original GitLab design doc (ADR-0028), bot PATs are stored as protected+masked CI/CD variables. No Secret Manager for bot token retrieval — that adds unnecessary complexity. WIF is still required for inference, just not for getting the bot token.

Changes Required

Code (internal/repos/)

manifest.go

• Remove CredModeOIDC, CredModeWIF, CredModeToken constants
• Remove CredentialMode field from GitHubForgeInfra, GitLabForgeInfra, RepoEntry, ResolvedConfig
• Remove validCredentialModes map, IsValidCredentialMode(), ValidCredentialModesFor()
• Add mint mode concept (e.g., MintMode field — public or private, default public)

install.go

• Remove resolveCredentialMode() function
• Restore needsWIF to always be true — inference secrets are unconditionally written for both forges
• Remove FULLSEND_CREDENTIAL_MODE variable from GitHub installs (nothing reads it at runtime)
• Remove credential mode from installVarsForForge() and installSecretsForForge()
• Add mint mode handling that only affects FULLSEND_MINT_URL

batch_install.go

• Remove credential mode gating on inference flag validation
• Remove credential mode discovery reads

migrate.go

• Default region to "global" when not discovered (not warning with no value, not us-central1)

status.go

• Remove credential mode drift detection

uninstall.go

• Remove credential mode reference in cleanup variable list

discover.go

• Remove credential mode from DiscoveredRepo if referenced

Scaffold (internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/)

fullsend-agent.yml

• Remove the WIF/token branching for bot token retrieval
• Always use FULLSEND_FORGE_TOKEN CI/CD variable for the bot PAT
• Keep WIF setup for inference (unconditional)

fullsend-poll.yml

• Same: remove credential mode branching, always use CI/CD variable for bot PAT

CLI (internal/cli/)

repos.go

• Add --mint-mode public|private flag (default: public) if needed
• Remove --credential-mode flag if it exists

repos_gitlab.go

• Remove Secret Manager bot token storage path (setupGitLabBotToken WIF branch)
• Always store bot PAT as protected+masked CI/CD variable (FULLSEND_FORGE_TOKEN)
• Remove FULLSEND_BOT_TOKEN_SECRET variable setup
• Remove cleanupGitLabBotTokenSecret() if it only handles Secret Manager cleanup

Documentation

docs/guides/getting-started/operations.md

• Remove "(WIF mode only)" annotations from FULLSEND_WIF_PROVIDER, FULLSEND_BOT_TOKEN_SECRET, FULLSEND_GCP_PROJECT_ID, FULLSEND_GCP_WIF_PROVIDER — inference vars are always required
• Remove FULLSEND_BOT_TOKEN_SECRET row entirely (no longer used)
• Update uninstall instructions to remove Secret Manager cleanup step
• Add sections for both GitHub and GitLab where platform-specific

docs/guides/infrastructure/infrastructure-reference.md

• Remove "WIF mode" / "OIDC mode" / "token mode" terminology
• Replace with "public mint" / "private mint" where referring to mint configuration
• Clarify that inference WIF is always required regardless of mint mode
• Ensure both GitHub and GitLab sections are present and accurate

Any other docs referencing credential modes — update to use correct terminology:

• "public mint" vs "private mint" for mint configuration
• Inference WIF is unconditional
• GitLab uses CI/CD variables for bot PAT (not Secret Manager)

What to Keep from #6224

• variable → token GitLab terminology rename (correct cleanup)
• MintRegistrar removal from migrate (mint calls stay in migrate for user convenience — it's a temporary command)
• discover.go fix reading FULLSEND_GCP_REGION from org variables
• Region fallback fix (but change to default "global" instead of warning with no value)

Related

• Close feat(#6226): gate WIF secrets in per-repo shim by credential mode #6241 — its premise depends on credential mode gating inference secrets
• repos commands: add credential mode model (wif/oidc/token) for public mint compatibility #6222 — the original issue whose premise is incorrect

Architectural Summary

	GitHub	GitLab
Forge tokens	Mint (public or private)	Bot PAT as CI/CD variable
Inference	WIF (always required)	WIF (always required)
Mint mode	Public (default) or private	N/A — no mint
Credential mode	Removed	Removed

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 12:23 PM UTC · Completed 12:27 PM UTC

Commit: 7aa8587 · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: high — repos installed with the default OIDC credential mode silently skip inference secrets, making agents non-functional.

PR #6224 (merged) and issue #6222 (closed) introduced the credential mode model. PR #6241 (closed without merging) would have extended it further. This issue correctly identifies the architectural flaw: inference WIF and mint authentication are independent systems that were incorrectly conflated.

Key Implementation Notes

• Preserve from feat(#6222): add credential mode model (wif/oidc/token) to repos commands #6224: variable→token rename, MintRegistrar removal, discover.go region read fix, region fallback (change to "global").
• Remove from feat(#6222): add credential mode model (wif/oidc/token) to repos commands #6224: All CredentialMode types, fields, validation, and resolution logic; credential mode gating on needsWIF, installSecretsForForge, requiredSecretsForForge.
• Replace with: MintMode (public/private, default public) affecting only FULLSEND_MINT_URL.
• Per the Workflow Contracts, changes to scaffold templates in internal/scaffold/ must maintain secret threading consistency across installation-mode chains.
• When removing CLI flags and credential mode references, per AGENTS.md, grep all docs under docs/ for references to the old terminology.

Proposed Test

func TestInstall_InferenceSecretsUnconditional(t *testing.T) {
    // For each mint mode (public, private) and each forge (GitHub, GitLab):
    // - Run install
    // - Assert FULLSEND_GCP_PROJECT_ID secret is written
    // - Assert FULLSEND_GCP_WIF_PROVIDER secret is written
    // - Assert needsWIF returns true regardless of mint mode
}

func TestMintMode_OnlyAffectsMintURL(t *testing.T) {
    // Public mint mode: FULLSEND_MINT_URL set to public endpoint
    // Private mint mode: FULLSEND_MINT_URL set to private endpoint
    // All other secrets/variables identical between modes
}

---

Labels: This is a bug where the credential mode model breaks inference for OIDC-mode repos. It touches install, CLI, and scaffold code, and reverses incorrect changes from a merged PR. Marking as type/bug and priority/high given that default-mode repos lose inference capability. component/install is already applied.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 12:28 PM UTC · Completed 12:56 PM UTC

Commit: 7aa8587 · View workflow run →