Summary

• use the effective GITHUB_TOKEN supplied to native runner tools for same-repository publication readiness
• require an explicit ACCESS_TOKEN only for authorized cross-repository targets, retaining both repository allowlists and publication API validation
• remove the redundant require_access_token interface input and document the exact token semantics
• run the reusable-workflow contract regression in bounded PR and push CI

Fixes #1757.

Regression coverage models hosted run 29293335972: caller-scoped github.token is available with write permissions while no named ACCESS_TOKEN is configured. The Agent Task Contracts workflow executes this regression automatically for relevant pull requests and pushes.

How to test

1. Run npm ci.
2. Run npm run build.
3. Run npm run test:agent-task-contracts. This includes tests/agent-task-reusable-workflow.test.ts and the hosted-run regression.
4. Run npm run test:redaction && npm run test:production-boundary-enforcement && npm run test:runtime-tool-policy.
5. Run actionlint .github/workflows/run-agent-task.yml .github/workflows/agent-task-contracts.yml.

Compatibility impact

The reusable workflow no longer accepts the redundant require_access_token input. Same-repository callers can omit ACCESS_TOKEN; cross-repository callers must continue to supply an explicit token and list the target in both access_token_repos and allowed_repos. No token scope is inferred beyond those explicit policies.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI GPT-5.6 Terra via OpenCode
• Used for: Investigated the hosted-run token readiness mismatch, implemented the workflow/helper/interface changes, and added deterministic coverage.