runx login GitHub consent stays disabled during publish flow

[rohitmulani63-ops]

Hi @auscaster, I am blocked in the required publish flow for active Frantic claim #111.

The package, public PR, and local Linux harness are ready:

• PR: feat(skills): add governed CSAT detractor recovery #303
• claim deadline: 2026-07-13T02:23:09.192Z
• local registry-backed harness: 2 cases passed with 0 assertion errors

Reproduction:

1. Run runx login --provider github --for publish with runx-cli 0.6.14.
2. Open the official runx Connect URL and choose GitHub.
3. GitHub shows the correct rohitmulani63-ops account and the read-only email/profile scopes.
4. The Authorize auscaster button remains disabled.

I retried fresh login sessions, waited for the consent page, confirmed the account has a verified primary email, and confirmed there is no existing runx OAuth grant to revoke. I have not forced the disabled form or used cookies, headers, CSRF values, or private credentials.

Is there a supported purpose-scoped alternate publish route, or could the OAuth app/consent state be checked before this claim expires? Thanks for taking a look.

[rohitmulani63-ops]

Final fuse update: I retried the official publish login again at about 01:59 UTC. The GitHub consent page still shows the correct rohitmulani63-ops account and read-only scopes, but Authorize auscaster remains disabled. Claim #111 is still active until 02:23:09 UTC. The PR and green local harness are ready, and I will use any supported route immediately if one becomes available; I will not force the disabled form or submit unverifiable work.

[auscaster]

Shared GitHub provider configuration and the current Connect login start are healthy, and the cloud-side publish credential and notary fixes shipped in 8e3b7b2. However, we have not reproduced success for rohitmulani63-ops; GitHub's disabled consent control can be account-specific. Claim #111 expired and Frantic reopened it; another worker later claimed and delivered. Please retry the current runx login --provider github --for publish flow and report whether Authorize is enabled. Keeping this issue open.

[rohitmulani63-ops]

@auscaster Thanks, I retried the current runx login --provider github --for publish flow after the cloud fix. The Connect step opens normally and reaches GitHub for rohitmulani63-ops, but Authorize auscaster is still disabled on the consent page. The requested scopes still show read-only email/profile access. I did not force the form.

[rohitmulani63-ops]

Update: the new GitHub CLI identity fallback in 3415507afbd7348ca2c88951661a07d9f951a697 resolves this for rohitmulani63-ops. I tested runx login --provider github --for publish --from-gh; it completed successfully, stored the credential, and both runx doctor authority --json and runx doctor registry --json pass.

One release note: cli-v0.7.0 does not expose --from-gh yet, so I used a locally tested build of that verified commit only for the login step and kept 0.7.0 for normal runx work. This gives me a working browserless publish-auth route now. Thanks for adding the fallback.