Jenkins executes its runs in lsst-devl:/project/jenkins/prod/agent-ldfc-ws-*, and it is sometimes useful to inspect these directories for files that aren't worth storing as CI artifacts.

However, the Gen 3 repository from these runs cannot be read; it has permissions (for example):

$ ls -ld /project/jenkins/prod/agent-ldfc-ws-0/ws/scipipe/ap_verify/cosmos_pdr2-main^gen3^ap_verify-installed/run/ap_verify_ci_cosmos_pdr2/repo/

drwxr-Sr-- 6 jhoblitt grp_202 4.0K Jan 28 10:04

and trying to read or even ls any file inside repo is blocked.

These permissions are set in ap_verify, specifically in the Workspace class; adjust them so that any AP developer has full read access to the repository. This should only require expanding Group permissions, not Other.