Crew runs on a forge admin's org repos use the forge's model account (every child made for an org fails its first run today) #11001

Crew runs on an org's repos now use the forge's model account when a forge admin is on the org's admin team. I have not proven item 4, glint-agency's next run on agency, because I can't reach that child from here. tsc, scripts/gate.ts and three test files all passed. The new test is in test/model-grant.test.ts; the other two I ran were test/crew-nocredential.test.ts and test/subscriptions.test.ts. I did not run the full suite, so the forge's check is the first to run the rest.

What changed

• Admin-owned orgs: ownedByAdmin in src/core/subscriptions.ts replaces the old is_admin lookup in pickSubscription. It is true for a forge admin, or for an org whose admin-permission team (the founder's Owners team) has a forge admin as a member. Agents, removed and suspended people don't count. A child made for an org has its admin founder on that team, so this is the case glint-agency hits.
• Parent's lent credit: it is funded from the same pick (the env result), so the same rule covers it. I added no separate code or test for it.
• Refusal wording: an org owner with no admin and no grant now gets "the account <org> has no model grant; an admin can grant one at /admin/accounts/<org>". It is built in noGrantSaid in src/crew/runner.ts. The run summary is plain text, so the path is not a clickable link there.
• Test: an org founded by the admin runs on subscription: platform (env). An org founded by a non-admin fails with the exact new sentence.

Left alone

• A personal (non-org) owner keeps the old sentence, "This repository has no model account: ask an admin to grant one". Several existing tests assert it, and the issue is about orgs.
• I did not add a model-grant page for orgs; /admin/accounts/<org> is what the issue named.

To try it

• Once this merges and glint-agency runs the new build, start a crew run on agency. It should log subscription: platform (env).

Closes #10991

Crew runs on an org's repos now use the forge's model account when a forge admin is on the org's admin team. I have not proven item 4, glint-agency's next run on agency, because I can't reach that child from here. tsc, scripts/gate.ts and three test files all passed. The new test is in test/model-grant.test.ts; the other two I ran were test/crew-nocredential.test.ts and test/subscriptions.test.ts. I did not run the full suite, so the forge's check is the first to run the rest.

What changed

• Admin-owned orgs: ownedByAdmin in src/core/subscriptions.ts replaces the old is_admin lookup in pickSubscription. It is true for a forge admin, or for an org whose admin-permission team (the founder's Owners team) has a forge admin as a member. Agents, removed and suspended people don't count. A child made for an org has its admin founder on that team, so this is the case glint-agency hits.
• Parent's lent credit: it is funded from the same pick (the env result), so the same rule covers it. I added no separate code or test for it.
• Refusal wording: an org owner with no admin and no grant now gets "the account <org> has no model grant; an admin can grant one at /admin/accounts/<org>". It is built in noGrantSaid in src/crew/runner.ts. The run summary is plain text, so the path is not a clickable link there.
• Test: an org founded by the admin runs on subscription: platform (env). An org founded by a non-admin fails with the exact new sentence.

Left alone

• A personal (non-org) owner keeps the old sentence, "This repository has no model account: ask an admin to grant one". Several existing tests assert it, and the issue is about orgs.
• I did not add a model-grant page for orgs; /admin/accounts/<org> is what the issue named.

To try it

• Once this merges and glint-agency runs the new build, start a crew run on agency. It should log subscription: platform (env).

Nothing in the code needed fixing, so I pushed nothing. The "failed" preview deploy message doesn't show a failure.

• The message itself: it says the app is "running" and that "no tests declared, none run". The log you pasted is only routine forge housekeeping (SQL stats, process counts). It has no error in it.
• The preview: /healthz on lab--11001 returns 200.
• Checks I ran locally on the branch: scripts/gate.ts passes and tsc --noEmit is clean. 100 tests across 20 files pass, covering test/model-grant.test.ts and the other subscription and runner suites. I didn't run scripts/fast.ts's list: it named 1714 of 2630 test files, about 145 minutes, so I chose the relevant ones by hand.
• Why the message may read as a failure: forge.json declares check.run as gate plus tsc only. The tests belong to check.fast and check.verify. So the deploy step has no tests to run, which reads as "no tests declared".

If the forge still marks the pull red, I'd need the actual failing check's log, not this deploy tail.

An org now reaches the forge's model account only through an explicit grant from a forge admin; sitting on its Owners team no longer gives it anything. This answers both of sentinel's points.

What changed

• Escalation fix: I removed ownedByAdmin, so pickSubscription is back to its original rule. Only an admin-owned account falls back to the forge's own credential.
• The explicit route: setAccountGrant now accepts an organization, and only a forge admin can call it. The existing capped monthly model grant covers org repos, and the grant is audited as account.model_granted.
• Where an admin sets it: the org's page at /settings/accounts/<org> now shows the Model budget card (grant plus ceilings), and POST /api/v1/admin/accounts/<org>/model-grant also works. The refusal text now points to /settings/accounts/<org>, which is the real page; before it named /admin/accounts/, which isn't.
• Docblock: noGrantSaid now sits above reviewInputs' docblock, so the docblock describes reviewInputs again.
• Docs: docs/features/org-model-grant.md says how an admin grants an org its account and why membership never does.

Tests

• test/model-grant.test.ts now covers the case sentinel asked for. A non-admin founder adds a forge admin to Owners and the run is still refused with the fix named. After the admin grants the org explicitly, the run goes through on the grant.
• test/grant-amounts.test.ts asserted that an org is "not found" for a grant. That test encoded the old rule, so I changed it: an org takes a grant from an admin but is still not a member.
• tsc, the design lint, test/model-grant.test.ts, test/grant-amounts.test.ts and the 7 related grant/account test files pass. scripts/gate.ts is not in this clone. scripts/fast.ts named 1796 test files, which is too broad, so I picked the tests that cover grants and accounts.

What I chose not to do

• I did not make an admin's own orgs automatically use the uncapped forge credential. That would need a record of who founded the org, which isn't stored today. An admin who wants that can grant a large amount.
• I dropped the claim about the parent lent-credit path. That code (fundedEnv) is untouched by this change, so I left it out rather than add a test for it.

To try it

1. As an admin, open /settings/accounts/<an org> and set its Model budget.
2. A crew run on that org's repo now uses the forge's account, up to the grant.
3. Without a grant, the run fails with a message naming that page.

🤖 Generated with Claude Code