dotfiles-autoupdate: fetch the gantry CLI over ssh, not https

[DJRHails]

Follow-up to #131. The https source only authenticates where a credential helper happens to work: taffy passed because its insteadOf rewrite sent uv over SSH anyway, while bonbon's gh helper serves nothing non-interactively (could not read Username for 'https://github.com'), so its first drift-fix failed and left it at 0.192.2.

Every gantry host has a working agent-less GitHub key — the same path the daily pi refresh already exercises from the timer environment — so ensure_gantry_cli_fresh (and the skill doc's install recipe) now use git+ssh://git@github.com/DJRHails/gantry@main directly.

Verified on taffy: ssh-URL install succeeds, receipt now git = "ssh://git@github.com/DJRHails/gantry?rev=main". Bonbon convergence will be verified post-merge by running the autoupdate there.

via claude @ taffy

[DJRHails]

Review Summary

Post-merge review (PR merged at 2026-08-23 09:42 UTC before review completed). Direct single-pass review — 2 files, ~6 hand-written lines changed.

Findings

No P1–P3 findings. The change is correct and well-scoped:

• modules/dotfiles-autoupdate/update.sh — the git+https → git+ssh swap in ensure_gantry_cli_fresh is sound: the [ -n "$cur" ] guard means it only runs on hosts where gantry is already uv-tool-installed (gantry hosts, which all carry an agent-less GitHub key), and the failure path stays non-blocking (FAILED log, return 0). The comment accurately documents the bonbon credential-helper failure that motivated it.
• modules/agents/skills/gantry-cli/references/install.md (sops/glassine-encrypted) — decrypted both revisions and diffed: the plaintext delta is exactly the two matching URL swaps in the install recipes plus a trailing blank-line trim. Envelope integrity checked: all 7 recipients match .sops.yaml's default rule (gantry-bot + DJRHails keys), MAC and lastmodified regenerated.

P4 observations (informational only):

#	Severity	Finding	Resolution
1	P4	A host with gantry hand-installed as a uv tool but only https credentials would now fail the daily refresh	Acceptable: failure is logged and non-blocking, same degradation the https URL already had on bonbon
2	P4	shfmt flags pre-existing style drift elsewhere in update.sh (redirect spacing, case-arm indent) — none in this PR's hunk	Out of scope for this PR

Verification

• shellcheck modules/dotfiles-autoupdate/update.sh: clean
• sops decrypt + plaintext diff of install.md (old vs new revision): matches the stated change exactly
• Recipient audit: envelope recipients ≡ .sops.yaml default rule
• Follow-up noted in the PR description (bonbon convergence check post-merge) is still outstanding on the author's side.

Commit

No fix commits — nothing to fix; PR head 3d7bfeb2390a reviewed as merged.

Verdict: approve

via gantry