marmalade: publication is not publicness, and a token tells you by refusing

Jeff's correction breaks published check rather than denting it. homelab-cluster
publishes six documents and is private deliberately; publication.md says others,
not everyone, and I read one word as the other. The tool as logged would have
reported a correct repository as broken, so a superseding entry is added rather
than revising the osprey entry. What survives is that bedrock's public page
promising a private repository as the better answer was a real defect, and it was
never about homelab-cluster.

So published check must not report a verdict. It reports the identity it used, and
warns when that identity is the repository's own owner — publishing is not an act
you can complete alone, and a tool that verifies with your own credential has
helped you complete it alone and told you it was fine.

Also corrects me: I confirmed the specimen's token claim enthusiastically without
testing the case that would show it wrong. A refused write names the token's
scopes in the error body, so a token cannot be asked what it may do but can be
told by being refused. Verified that no other channel exists — the tokens endpoint
rejects token auth, and no scope header comes back on success.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

.loom/cart/current/claude-marmalade.md

@@ -240,3 +240,120 @@ self-hosted gitea or gitlab may not, and **git's fallback is silent** — it war
 **`--depth=1` bounds the damage to one commit**, *which is why both flags are
 there and not just the filter.* **Detect the warning and say so**, rather than
 letting `list` quietly become a full clone of somebody's monorepo.
+
+---
+
+# The token, and `published check` was wrong
+
+**Done with the token — delete it whenever you like.** *It is in no file, no
+commit and no config; it lived in a shell variable in a scratch directory.*
+
+## Three things it settled
+
+**The specimen's assumption holds.** *A read token against **raw** HTTP on a
+private repository:* `404` *anonymous,* **`200` with `Authorization: token`** *(and
+with `Bearer` — both forms work).* **Conditional requests work authenticated:
+`If-None-Match` returned `304`.** *So `add` and `check` work on private
+repositories, which is the whole of `homelab-cluster`.*
+
+**The gitea coincidence holds on private repositories too** — *`ETag`
+`530c5bef…` equals the blob hash.* **Which changes nothing**, *because we do not
+use it.*
+
+**And the specimen's sharpest claim is now measured rather than asserted:**
+
+```
+GET /api/v1/repos/jeffry/homelab-cluster
+    permissions: {admin: true, push: true, pull: true}      ← with a READ token
+```
+
+> **A token cannot be asked what it may do.** *The API reports the **account's**
+> rights.* **Scope is set once at creation and invisible afterwards, so the name
+> is the only record** — *and that is now a thing we have seen rather than a thing
+> we were told.*
+
+## You are right, and it breaks my design rather than dents it
+
+**I built `published check` on "can somebody anonymous fetch this", and
+publication is not the same as being public.** *`homelab-cluster` publishes six
+documents and is private on purpose, and that is not a defect — **it is what
+`publication.md` actually says:***
+
+> **What a repository has handed over for **others** to depend on.**
+
+***Others*, not *everyone*.** *I read one word as the other and built a test on
+it.*
+
+## What the check has to be instead
+
+**The question is not "is this public". It is "can the audience I published for
+fetch it".** *And the audience is not a thing the tool can know.*
+
+**So `published check` must never report success. It reports the identity it
+used:**
+
+```
+gitea.md   200  as anonymous
+gitea.md   200  as reader
+gitea.md   200  as jeffry — OWNER, this proves nothing
+```
+
+**The third line is the one that earns the command.** *`/api/v1/user` gives the
+login; the repository gives its owner; if they match, **the check is vacuous and
+should say so instead of printing something green.***
+
+> **That is `publication.md`'s own sentence, enforced:** *publishing is not an act
+> you can complete alone.* **A tool that verifies your publication using your own
+> credential has helped you complete it alone**, *and told you it was fine.*
+
+**And it ties your `auth` section to something real:** *a kubeconfig-shaped config
+is not only credentials, it is **named identities you can test as**.* **`--as
+<context>` is the whole feature.**
+
+## Affirm: no audience declaration?
+
+**I do not want to add a field where a repository states who it published for.**
+
+*It would let the tool compare intent to result, which sounds good* — **and it
+asserts a category nobody has decided**, *which is the argument that killed
+`init`.* **Report the identity, let the person judge the audience.**
+
+**Fallback if unanswered:** *no declaration; `--as` defaults to anonymous, and the
+owner-identity warning is always on.*
+
+## You were right to make me try it, and it corrects me
+
+**I wrote, one message ago, that the specimen's claim was "now measured rather
+than asserted." I had measured the wrong half.**
+
+```
+POST /api/v1/repos/loom/loom-cli/contents/…      403
+  token does not have at least one of required scope(s),
+  required=[write:repository],
+  token scope=read:activitypub,read:admin,read:misc,read:notification,
+              read:organization,read:package,read:issue,read:repository,read:user
+```
+
+**The refusal names the scope.** *So "a token cannot be asked what it may do" is
+too strong* — **and I confirmed it enthusiastically without testing the one case
+that would have shown it wrong**, which is the failure mode this project keeps
+finding in itself.
+
+**What is actually true, and it is sharper:**
+
+> **A token cannot be asked what it may do. It can only be told, by being
+> refused.**
+
+*Verified: `/api/v1/users/{u}/tokens` rejects token auth entirely (`401 auth
+required` — it wants a password), no scope header comes back on success, and
+`/api/v1/repos/…` reports `admin, push, pull: true` for a token that cannot
+write.* **The only channel is the error body.**
+
+**For us that changes the reason and not the rule.** *`loomctl` never writes, so it
+will never provoke the one response that would tell it anything.* **The name
+remains the only record we will ever see** — *but because we never ask, not
+because nobody answers.*
+
+**One concrete consequence:** *gitea's error bodies carry the useful part.*
+**Surface them rather than mapping a `403` to a sentence of our own** — *we would
+be throwing away the only scope information the host ever emits.*