ops(codespace): use ARCHWIZ/OPERATOR secret chain (monorepo SSOT)

.github/workflows/codespace-create.yml

@@ -1,9 +1,8 @@
 name: Codespace create (dispatch)
 
-# Creates a Codespace on a ref using a PAT with `codespace` scope.
-# Credential plane: issue #184 (names/scopes). Value lives only in
-# Settings → Secrets → Actions as CODESPACE_CREATE_TOKEN.
-# Never commit or print the token.
+# Creates a Codespace via API using monorepo privileged GH token chain.
+# SSOT: ARCHWIZ_GITHUB_TOKEN || OPERATOR_GITHUB_TOKEN || OPERATOR_TOKEN
+# Optional: CODESPACE_CREATE_TOKEN. Never print values.
 
 on:
   workflow_dispatch:
@@ -12,10 +11,6 @@ on:
         description: Branch or SHA (default master)
         required: false
         default: master
-      machine:
-        description: Machine type (basicLinux32gb | standardLinux32gb | premiumLinux)
-        required: false
-        default: basicLinux32gb
       display_name:
         description: Optional display name
         required: false
@@ -27,58 +22,74 @@ permissions:
 jobs:
   create:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
     steps:
-      - name: Require secret
+      - name: Resolve token presence (names only)
         env:
-          HAS_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN != '' }}
+          HAS_CS: ${{ secrets.CODESPACE_CREATE_TOKEN != '' }}
+          HAS_ARCHWIZ: ${{ secrets.ARCHWIZ_GITHUB_TOKEN != '' }}
+          HAS_OP_GH: ${{ secrets.OPERATOR_GITHUB_TOKEN != '' }}
+          HAS_OP: ${{ secrets.OPERATOR_TOKEN != '' }}
         run: |
-          if [ "$HAS_TOKEN" != "true" ]; then
-            echo "::error::CODESPACE_CREATE_TOKEN secret is empty."
-            echo "Add a classic or fine-grained PAT with codespace scope"
-            echo "(see issue #184 inventory) under Settings → Secrets → Actions."
-            echo "Do not paste the value into issues, PR bodies, or chat."
+          set -euo pipefail
+          echo "CODESPACE_CREATE_TOKEN present: $HAS_CS"
+          echo "ARCHWIZ_GITHUB_TOKEN present: $HAS_ARCHWIZ"
+          echo "OPERATOR_GITHUB_TOKEN present: $HAS_OP_GH"
+          echo "OPERATOR_TOKEN present: $HAS_OP"
+          if [ "$HAS_CS" != "true" ] && [ "$HAS_ARCHWIZ" != "true" ] && [ "$HAS_OP_GH" != "true" ] && [ "$HAS_OP" != "true" ]; then
+            echo "::error::No privileged GH token secret present."
             exit 1
           fi
 
-      - name: Create codespace
+      - name: List allowed machines
+        env:
+          GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN || secrets.ARCHWIZ_GITHUB_TOKEN || secrets.OPERATOR_GITHUB_TOKEN || secrets.OPERATOR_TOKEN }}
+        run: |
+          curl -sS \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${GH_TOKEN}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "https://api.github.com/repos/timerloggedout-spec/termux-monorepo/codespaces/machines?ref=master" \
+            | jq '{machines: [.machines[]? | {name, display_name, prebuild_availability}]}' \
+            || true
+
+      - name: Create codespace (default machine)
         id: create
         env:
-          GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN }}
+          GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN || secrets.ARCHWIZ_GITHUB_TOKEN || secrets.OPERATOR_GITHUB_TOKEN || secrets.OPERATOR_TOKEN }}
           REF: ${{ inputs.ref }}
-          MACHINE: ${{ inputs.machine }}
           DISPLAY: ${{ inputs.display_name }}
         run: |
           set -euo pipefail
-          body=$(jq -n \
-            --arg ref "$REF" \
-            --arg machine "$MACHINE" \
-            --arg name "$DISPLAY" \
-            '{ref: $ref, machine: {name: $machine}, display_name: $name}')
+          # Omit machine → API picks repo default / first allowed
+          body=$(jq -n --arg ref "$REF" --arg name "$DISPLAY" '{ref: $ref, display_name: $name}')
+          echo "request body: $body"
           resp=$(curl -sS -X POST \
             -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${GH_TOKEN}" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
             "https://api.github.com/repos/timerloggedout-spec/termux-monorepo/codespaces" \
             -d "$body")
-          echo "$resp" | jq '{name, id, state, machine: .machine.name, web_url, created_at}' || echo "$resp"
+          echo "$resp" | jq '{name, id, state, machine: .machine.name, web_url, created_at, message}' 2>/dev/null || echo "$resp"
           name=$(echo "$resp" | jq -r '.name // empty')
           web=$(echo "$resp" | jq -r '.web_url // empty')
           if [ -z "$name" ]; then
-            echo "::error::Codespace create failed — check PAT scopes (codespace) and billing."
+            echo "::error::Codespace create failed"
             echo "$resp" | jq . 2>/dev/null || echo "$resp"
             exit 1
           fi
           echo "name=$name" >> "$GITHUB_OUTPUT"
           echo "web_url=$web" >> "$GITHUB_OUTPUT"
-          echo "### Codespace created" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **name:** \`$name\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **url:** $web" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **ref:** \`$REF\`" >> "$GITHUB_STEP_SUMMARY"
+          {
+            echo "### Codespace created"
+            echo "- **name:** \`$name\`"
+            echo "- **url:** $web"
+            echo "- **ref:** \`$REF\`"
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - name: List codespaces (evidence)
         env:
-          GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN }}
+          GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN || secrets.ARCHWIZ_GITHUB_TOKEN || secrets.OPERATOR_GITHUB_TOKEN || secrets.OPERATOR_TOKEN }}
         run: |
           curl -sS \
             -H "Accept: application/vnd.github+json" \