GitHub

3 organizations, 98 repos, runners, GitHub Apps, and Dependabot.

Organizations

Stig-Johnny (67 repos) — Primary

App Repos (1): | Repo | Description | |------|------------| | cutie | Cuti-E platform — character-driven feedback |

The 6 consumer iOS apps (nutri-e, fast-e, count-e, drink-e, heart-e, star-rewards) were archived 2026-06-09 — see Legacy/Inactive below.

MCP Server Repos (12): | Repo | Description | |------|------------| | appstoreconnect-mcp | App Store Connect API | | claude-memory-mcp | Persistent memory for Claude | | context-layer-mcp | Codebase context and search | | cutie-mcp | Cuti-E platform MCP | | deadline-tracker-mcp | Deadline tracking | | infra-health-mcp | Infrastructure health checks | | pushbullet-sms-mcp | SMS forwarding / 2FA codes | | slack-notifications-mcp | Slack notifications | | submission-checklist-mcp | App submission tracking | | telegram-notifications-mcp | Telegram notifications (legacy) | | totp-mcp | TOTP 2FA codes | | telegram-mcp-server | Telegram MCP (older version) |

Agent/Infra Repos: | Repo | Description | |------|------------| | agent-runner | Discord-to-Claude-Code bridge for remote agents (Pi-E, Volt-E, Review-E, iBuild-E); systemd-managed | | mac-executor | iBuild-E autonomous iOS agent (legacy bash deployment — torn down 2026-04-18, superseded by agent-runner) | | pi-e-config | Pi-E agent configuration | | volt-e-config | Volt-E agent configuration | | review-e-config | Review-E agent configuration | | atl-agent | ATL-E config — retired 2026-05-20, replaced by rig-conductor + rig-planner | | claude-3 | Orchestrator workspace (this repo) | | cluster-gitops | k3s cluster GitOps — archived 2026-05-04, succeeded by dashecorp/rig-gitops | | infra-config | Infrastructure configuration | | dashecorp-skills | Shared agent skills | | mcp-open-core | MCP open core framework |

Website/Content Repos: | Repo | Description | |------|------------| | dashecorp | Dashecorp website | | private-sites | Private websites | | cv | CV/resume | | invotek-no-2023 | Invotek website |

Archived consumer apps (migrated to dashecorp 2026-06-09, now read-only): nutri-e (was App Store live), fast-e (was App Store live), count-e (was App Store live), drink-e (was TestFlight), heart-e (was not yet in ASC), star-rewards (was App Store in review)

Legacy/Inactive (can be archived or deleted): CryptoSkatt, ProgrammingCompApplication, ProgrammingCompApplicationCore, Stig-Johnny (profile), TerminalFlow, azure-cli-with-docker, biohacking-ai, chicken-derby-enter-race, chicken-derby-viewer, cline-3, docker-swarm-pi3-cluster, docker.github.io, inlets, loki, mcp-server-cloudflare, mcp-server-dotnet, nutri-track, smartadmin, sup-track-ai, terminal-flow, testing-github-packages

Stig-Johnny (this org) ≠ stigjohnny (rig tenant org)

They differ only by a hyphen and are constantly conflated. They are two different GitHub orgs with separate OpenTofu modules and state:

• Stig-Johnny — the legacy user-account org (github_owner Stig-Johnny, module github/stig-johnny, GCS state prefix github-stig-johnny). Home of claude-3 and the MCP/agent repos. Outside the rig tenant surface: no CODEOWNERS, required_approving_review_count=0, and conductor webhooks inert (conductor_webhook_repos=[]; the CI token historically lacked admin:repo_hook, infra#328).
• stigjohnny — a separate rig-tenant org (github_owner stigjohnny, module github/stigjohnny, state prefix github-stigjohnny). Its governance.tf provisions * @review-e-bot CODEOWNERS + 1-code-owner branch protection + conductor webhooks — but is inert until the tenant is onboarded (managed_repos=[]).

claude-3 review/merge model: claude-3 is reviewed by Review-E only via the Discord-@mention advisory path in .github/workflows/request-review.yml (it @mentions the Review-E Discord user; the agent reviews as review-e-bot). Review is advisory, not a gate — main needs 0 approvals and merges are manual squash (gh pr merge N --squash --delete-branch after Copilot). The rig conductor does not — and must not — govern claude-3: it is dashecorp-tenant-scoped, and the review-e-bot installation does not include claude-3, so any conductor-dispatched review of a claude-3 PR 404s and (absent a pre-check) re-dispatches forever. Conductor↔claude-3 integration is NOT_PLANNED (claude-3#814 / infra#379); the dispatch-side guard is tracked in rig-conductor#1893.

cuti-e (5 repos) — Public SDKs & MCP

Repo	Description
ios-sdk	CutiE iOS SDK (public, SPM)
ios-link-sdk	CutiELink iOS SDK (archived, public, SPM)
android-sdk	CutiE Android SDK (public, JitPack)
admin-mcp	Cuti-E admin MCP server
cutie	Cuti-E platform (archived, migrated to dashecorp/dashe-cutie 2026-06-10)

dashecorp (27 repos) — Engineering Rig + Product Platform

Rig core & infra: | Repo | Description | |------|------------| | rig-conductor | Engineering rig orchestrator (renamed from conductor-e 2026-04-19) | | rig-gitops | GitOps manifests for the rig | | rig-agent-runtime | AI agent framework (shared runtime for rig agents) | | rig-memory-mcp | Persistent agent memory (Postgres + pgvector) | | rig-docs | Research, proposals, diagrams, wiki | | rig-tools | Hooks, scripts, workflow sync | | infra | OpenTofu — GitHub, Cloudflare, GCP, Tailscale IaC | | .github | Org-level shared config + reusable workflows |

Mobile cockpit: | Repo | Description | |------|------------| | rig-cockpit-worker | Cloudflare Worker broker (Access-token proxy + APNs push) | | rig-cockpit-ios | Native iOS app to monitor/control the rig | | rig-dashboard | Read-only public rig dashboard (SvelteKit + CF Pages) |

iOS apps (migrated from Stig-Johnny): | Repo | Description | |------|------------| | dashe-nutri-e | Nutri-E — supplement tracking | | dashe-fast-e | Fast-E — intermittent fasting | | dashe-count-e | Count-E — daily counter & date tracker | | dashe-drink-e | Drink-E — water intake | | dashe-heart-e | Heart-E — blood pressure & vitals | | dashe-reward-e | Reward-E — star rewards for kids | | dashe-cutie | Cuti-E platform (migrated from Stig-Johnny/cutie 2026-06-12) |

Websites, docs & infra services: | Repo | Description | |------|------------| | dashe-website | dashecorp.com landing site | | coffee | coffee.dashecorp.com | | carrots | carrots.dashecorp.com | | potatoes | potatoes.dashecorp.com | | dashe-docs | iOS app portfolio brain (→ BRAIN.md) | | tablez-docs | Tablez portfolio brain (scaffold) | | dashe-email-worker | Cloudflare Email Worker → per-agent D1 inboxes | | ios-certs | fastlane match — encrypted iOS dist certs | | invotek-no | invotek.no consultancy site (Cloudflare Pages, tenant: invotek) |

Self-Hosted Runners

macOS CI — GitHub-hosted (no self-hosted macOS runner)

There is no self-hosted macOS runner anywhere. The last one was decommissioned 2026-06-29; all macOS CI now runs on GitHub-hosted macos-26, the org-standard label (same as the dashe-* app builds in build-and-upload.yml). This removes the self-hosted-runner maintenance burden that caused a 24h-queue-cancel outage.

Repo	Workflow	Runs on
cuti-e/ios-sdk	CI (build/test)	GitHub-hosted macos-26
cuti-e/ios-sdk	release-please, pin-expiry-check	GitHub-hosted ubuntu-latest
cuti-e/android-sdk	publish	GitHub-hosted ubuntu-latest

The Mac Mini M4 (Tailscale 100.92.170.124, user claude) hosts iBuild-E only (iClaw-E's LaunchAgent was retired 2026-09-25, see hosts.md) — no CI runner. The MacBook Air M4 is the dev machine + Claude Code orchestrator host only — no runner. iOS apps build via GitHub Actions (build-and-upload.yml on macos-26) or iBuild-E (system LaunchDaemon ai.invotek.ibuild-e, rig-agent-runtime).

Linux Self-Hosted Runners (Dell)

Removed 2026-10-02. The 2 systemd runners at /home/ubuntu/actions-runner-{1,2}/ on the Dell were repo-scoped to Stig-Johnny/mcp-server-dotnet and orphaned: that repo had no workflow runs, and its last push was 2025-06-17. The operator approved removing them, settling the open infra#389 decision. They were deregistered through the API, so no registration token touched the host, and their services and directories, credentials included, were deleted. mcp-server-dotnet stays PRIVATE (infra#390).

ARC k3s Runners — RETIRED

Actions Runner Controller (ARC) was retired 2026-05-20 (operator-confirmed). The arc-runners / arc-systems namespaces, the per-repo HelmReleases in dashecorp/runners/, and the arc-linux-{repo} / arc-linux-docker labels are no longer in use. All Linux CI uses GitHub-hosted ubuntu-latest.

GitHub Apps

5 apps, all installed on Stig-Johnny, cuti-e, and dashecorp orgs:

Note: the Stig-Johnny installations are selected-repos, not all-repos — notably review-e-bot's install does not include claude-3. That's why a conductor-dispatched review of a claude-3 PR 404s (see the claude-3 review model under Organizations → Stig-Johnny).

App	Agent	Status
ibuild-e-bot	iBuild-E	LIVE
review-e-bot	Review-E	LIVE
pie-agent-bot	Pi-E	LIVE
volt-e-agent-bot	Volt-E	LIVE
iclaw-e-bot	iClaw-E	App exists; the agent is not running (retired 2026-09-25)

Token generation: get-token.py from PEM keys. Tokens are short-lived (1 hour), auto-refreshed every 30 min by refresh-github-app-tokens.sh LaunchAgent on M4.

Full details: .claude/skills/github-apps/SKILL.md

Dependabot

Enabled on all active app and MCP repos. Auto-creates PRs for dependency updates. PRs are auto-merged when CI passes + Copilot approves.

Branch Protection

Measured 2026-09-23 — two of the claims that used to be in this section were false. Both are tracked in dashecorp/infra#459.

Seven repos have NO branch protection at all. main there accepts a direct push, a force push, and deletion:

$ for r in dashe-nutri-e dashe-reward-e dashe-fast-e dashe-count-e dashe-drink-e dashe-heart-e dashe-cutie; do
    gh api repos/dashecorp/$r/branches/main/protection
  done
→ 404 "Branch not protected"   (all seven)

These are the repos that ship to the App Store. The cause is a gap in the OpenTofu rather than drift: github_branch_protection.main in github/dashecorp/main.tf is for_each = github_repository.repos, and the app repos live in a separate local.dashe_app_repos set (locals.tf) that dashe-secrets.tf and ibuild-e-bot.tf consume but that resource does not. So the only thing keeping main intact on those seven is the behavioural rule in CLAUDE.md ("NEVER push directly to main, even if bypass is allowed") — there is no technical floor under it.

require_code_owner_reviews: true is vacuous wherever it is set. The OpenTofu writes * @review-e-bot into .github/CODEOWNERS in 8 repos (infra, rig-conductor, rig-gitops, rig-agent-runtime, rig-docs, rig-tools, dashe-website, rig-memory-mcp) and its own comment says this "enforces Review-E specifically — not just 'any reviewer.'" It does the opposite:

$ gh api repos/dashecorp/infra/codeowners/errors
{"errors":[{"line":1,"kind":"Unknown owner",
 "suggestion":"make sure @review-e-bot exists and has write access to the repository"}]}

A GitHub App cannot be a code owner — CODEOWNERS takes users and teams, and an App is neither (nor can it be a team member). With no owners resolvable for *, the code-owner requirement has nothing to require and the gate degrades to exactly "any reviewer". Because TF declares itself authoritative for that file, every apply re-asserts the broken line. GitHub cannot express "require a review from this App" at all — what actually enforces Review-E, for the merges rig-conductor makes, is MergeGate's guard. Since rig-conductor#2350 (2026-09-23) it merges only an open PR whose current head review-e-bot[bot] APPROVED on GitHub, with every check passed. Before that, the unauthenticated POST /api/merge trigger could merge an unapproved PR (rig-conductor#1976). A human merge on GitHub (branch protection needs any one approval) is outside it, and so is the conductor's operator override POST /api/admin/overrides, which is disabled while no allowlist is configured. Note the stigjohnny tenant org's governance.tf provisions the same pattern (see the org list above), so onboarding that tenant inherits it.

What IS true: the repos covered by github_branch_protection.main require a PR with 1 approval, dismiss_stale_reviews, linear history, and no force push or deletion; enforce_admins = false, so an admin can bypass (dashecorp/infra#450 merged with zero standing approvals on 2026-09-11). Required status checks exist for only the two repos in local.required_checks_per_repo — infra is deliberately not one, which is why a red OpenTofu apply on main never blocks a merge there. Copilot review is enabled everywhere (review_on_push: true, review_draft_pull_requests: true).

Repo Settings

delete_branch_on_merge: true enabled on all repos.