# 002: Fix Agent Workflow Push Permission (Resolved)

## Problem

The fix agent's GitHub App token lacked the `workflows` write permission, causing `git push` to fail silently when commits included `.github/workflows/` changes. The agent reported success but no commit appeared on the PR.

## Resolution

Granted `workflows` write permission on the `fullsend-agent[bot]` GitHub App. CODEOWNERS rule on `.github/workflows/` ensures human approval is still required at merge time — the agent can push workflow changes, but they can't be merged without owner review.

## Guardrails

- CODEOWNERS: `.github/workflows/` requires owner group approval
- The fix agent can iterate on workflow files during the review/fix loop
- Final merge is gated on human approval for any PR touching workflows