chore(routines): daily-upstream-check cannot push — write access missing from session

[NativeTeachingAidsB]

Problem

The daily-upstream-check routine ran successfully on 2026-08-09 (first run, baseline established) but could not commit or push the results (docs/upstream-log/state.json, docs/upstream-log/2026-08.md) because the remote session lacks GitHub write access.

What was attempted

1. git push -u origin chore/routines-daily-2026-08-09 → 403 (no push credentials configured in the session)
2. mcp__github__create_branch → 403 Resource not accessible by integration
3. mcp__github__push_files → 403 Resource not accessible by integration

Root cause

The scheduled Claude Code session has read-only access to the repo. Neither the HTTPS git credentials nor the GitHub MCP integration token have the contents: write permission required to create branches and push files.

What was completed

8 of 15 upstream sources were fetched and checked successfully:

Source	Version recorded
claude-code-cli	2.1.226
claude-agent-sdk	0.3.226
claude-agent-sdk-py	0.2.134
codex-cli	0.147.0
aider	0.86.2
goose	0.1.0
mcp-python	2.0.0
mcp-ts	1.30.0

Fetch failures (7 sources)

Source	Reason
cursor	Network egress blocked (cursor.com)
cline	Network egress blocked (marketplace.visualstudio.com)
continue	Network egress blocked (marketplace.visualstudio.com)
windsurf	Network egress blocked (windsurf.com)
zed	GitHub API 403 (unauthenticated); MCP scoped to this repo only
mcp-spec	GitHub API 403 (unauthenticated); MCP scoped to this repo only
claude-plugins-official	MCP scoped to this repo only; no unauthenticated fallback

Fix needed

To make the routine work end-to-end:

1. Git push credentials: Grant the scheduled session contents: write on this repo (via a GitHub App permission or a GITHUB_TOKEN env var with write scope).
2. Egress allowlist: Allow outbound access to cursor.com, marketplace.visualstudio.com, and windsurf.com.
3. GitHub API access: Either add a read-only GitHub PAT to the session environment, or expand the MCP session scope to include zed-industries/zed, modelcontextprotocol/specification, and anthropics/claude-plugins-official.

Since this is the first run, there is no stale state — once write access is granted, re-running the routine will create the state.json baseline correctly.