chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• autofix.yml: Autofix workflow - repairs failed/timed-out checks; cancellations do not trigger repairs
• agents-issue-intake.yml: Issue intake - processes new issues for agent assignment
• agents-80-pr-event-hub.yml: PR event hub - consolidates PR meta, bot comments, and verify-to-issue handlers
• agents-81-gate-followups.yml: Gate followups hub - keepalive and autofix; budgets count Gate failures with failed jobs
• agents-keepalive-sweep.yml: Keepalive sweep - periodic level-based resync; dispatches the loop for open agent PRs so silent zero-commit stalls resurface
• agents-keepalive-loop-reporter.yml: Keepalive reporter - posts summary when keepalive run fails or cancels
• agents-71-codex-belt-dispatcher.yml: Codex belt dispatcher - selects issues and creates agent branches for work
• agents-72-codex-belt-worker.yml: Codex belt worker - executes agent on issues with full prompt and context
• agents-73-codex-belt-conveyor.yml: Codex belt conveyor - orchestrates belt worker execution and handles completion
• agents-autofix-dispatcher.yml: Autofix dispatch bridge - acknowledges legacy Gate repository_dispatch events; agents-81-gate-followups handles repair work
• agents-verifier.yml: Verifier - validates agent work meets acceptance criteria
• agents-issue-optimizer.yml: Issue optimizer - LangChain-based issue formatting and optimization (Phase 1)
• agents-issue-format-guard.yml: Issue format guard - validates issues on open/edit/reopen/closed, hold/exemption-label changes, and manual dispatch against AGENT_ISSUE_FORMAT, while durable/wontfix, automated, and bot issues remain exempt and have stale agents:format leases cleared. Closed issues also clear agents:auto-pilot-pause only after a fresh state read confirms they remain closed. Pause and needs-human labels hold dispatch. Any invalid non-exempt issue change on those triggers clears stale agents:formatted state, and hold removal revalidates on resume. Non-conforming unheld work gets agents:format so the optimizer repairs it. Requires .github/scripts/issue_format.py.
• agents-verify-to-new-pr.yml: Verify to new PR - creates follow-up issue and immediately dispatches auto-pilot to prepare a replacement PR (bridge inlined)
• agents-auto-label.yml: Auto-label - suggests/applies labels based on semantic matching (Phase 5A)
• agents-capability-check.yml: Capability check - pre-flight agent feasibility gate (Phase 3A)
• agents-decompose.yml: Task decomposition - breaks large issues into sub-tasks (Phase 3B)
• agents-dedup.yml: Duplicate detection - flags similar open issues (Phase 3C)
• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• agents-auto-pilot.yml: Auto-pilot - end-to-end automation orchestrator (format → optimize → agent → verify)
• agents-weekly-metrics.yml: Weekly metrics - aggregates auto-pilot, keepalive, autofix and verifier metrics into summary reports
• maint-coverage-guard.yml: Coverage guard - daily baseline monitoring with automatic issue creation. Intentional full-workflow sync exception: ships the complete guard implementation to consumers instead of a thin reusable caller because the workflow embeds repo-specific artifact discovery and download logic tied to tools/coverage_guard.py.
• maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch
• maint-87-docs-drift-fix-agent.yml: Docs drift fix agent - reports deterministic documentation drift weekly and creates idempotent repair issues only on an explicit apply dispatch
• reusable-pr-context.yml: Reusable PR context workflow - centralized PR data fetching via GraphQL
• backplane-conformance.yml: Backplane conformance caller stub - calls reusable-backplane-conformance.yml@main to validate a repo's emitted run-contract/v1 envelope (producer) or ingested object (consumer). No-op for non-participants (opt-in). Template lives under templates/consumer-repo/.github/workflows/.
• check_docs_drift.py: Detects workflow-inventory and repository-path documentation drift for the docs drift fix agent
• docs_drift_fix_agent.py: Builds bounded deterministic documentation-drift repair plans and idempotent issue batches
• sync_status_file_ignores.py: Validates and updates the managed consumer .gitignore status-file block, including legacy conflict cleanup
• issue_format.py: Pure-stdlib validator for AGENT_ISSUE_FORMAT compliance. Single fleet definition of agent-processable; used by agents-issue-format-guard.yml and callable directly by local filers to pre-flight before gh issue create (non-zero exit = unfit). Do not fork per repo.
• coverage_trend.py: Generates coverage trend summaries - required by reusable CI workflow
• coverage_guard.py: Checks coverage guard artifacts - required by maint-coverage-guard.yml
• check_deliberate_break.py: Opt-in Gate helper that proves named deliberate-break acceptance tests fail against the base implementation
• runner_lib/ (2 files): Shared runner prompt assembly, output parsing, and dispatch debounce helpers
• sync_test_dependencies.py: Syncs test dependency pins - required by reusable CI workflow
• agent_delegation_policy.js: Agent delegation policy - system-driven routing for agent:auto label
• source_context.js: Classifies PR workflow source context for issue, local, automation, sync, Dependabot, review follow-up, and direct GitHub work
• issue_scope_parser.js: Parses issue scope and requirements
• keepalive_loop.js: Core keepalive loop logic
• token_load_balancer.js: Dynamic token load balancer for API rate limit management
• keepalive_post_work.js: Post-work handling for keepalive rounds
• github-api-with-retry.js: GitHub API retry wrapper with exponential backoff and pagination support - required by agents-auto-pilot.yml
• sync_tracker_state/ (1 files): Shared durable tracker and open PR state helpers for consumer sync workflows
• bot-comment-handler.js: Bot comment handler logic - processes bot review comments for dispatch
• agents_orchestrator_resolve.js: Resolves agent orchestrator state
• agents_pr_meta_update_body.js: Updates PR body with stable completed dependency-provenance results, observer exclusion, and exact-head Gate visibility
• agents_verifier_context.js: Verifier context with exact PR-head identity for replayable corpus evidence
• issue_dedup.py: Issue deduplication - finds similar open issues
• progress_reviewer.py: Progress reviewer - evaluates agent progress for keepalive rounds
• capability_check.py: Capability check - pre-flight agent feasibility assessment
• label_matcher.py: Label matcher - suggests labels based on semantic matching
• discover_model_catalog.py: Advisory provider-catalog discovery - proposes new model candidates without changing reviewed selections
• validate_run_contract.py: Validates a repo's emitted run-contract/v1 run envelope (producer/bridge) or ingested satellite object (consumer) against the canonical Workflows schemas + opt-in participant registry. Offline/deterministic; opt-in skip for non-participants. Synced so participants can validate locally and the reusable conformance gate can invoke it.
• source_of_truth_docs.yml: Defines consumer-local documentation paths without distributing the Workflows fleet registry
• MODEL_SELECTION_POLICY.md: Auditable auxiliary-model evaluation, selection, and refresh policy
• CI_SYSTEM_GUIDE.md: Guide to the CI system for agents
• AGENTS.md: Context file for agents and coding assistants
• CLAUDE.md: Context file for Claude/AI assistants
• agent-runner-output.md: Agent runner output contract specification - required for implementing new agent runners
• tracked-variable-v1.md: Tracked-variable/v1 specification and clause-variable alias for backplane consumers
• tracked-variable-v1.schema.json: Tracked-variable/v1 schema with embedded evidence and document/mirror provenance
• SETUP_CHECKLIST.md: Consumer repo setup checklist. Includes the default_workflow_permissions=write step in section 3.3.1 that prevents a Gate startup_failure on fresh consumers (resolved: #2157). Synced so it no longer drifts across the fleet.
• model_registry.json: Model registry - available LLM models and their capabilities
• WORKFLOW_USER_GUIDE.md: Workflow user guide - explains the CI/agent system for repo consumers
• .gitignore (managed block appended)

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: 5ef1f72907e90b6a838a10b68ac047455ebd3914
Template hash: 1f3f4541b9df
Consumer-sync plan ID: sha256:1f3f4541b9df343e4661e6b4b22ff90043955c6d9382b82eb3fbd4a96fa25c0c
Plan scope: full
Scope base SHA: full
Sync phase: promote
Sync branch: sync/workflows-delivery
Consumer repo: stranske/Collab-Admin
Manifest: .github/sync-manifest.yml

autofix: false

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Excluded labels (none allowed) (7)

• sync
• workflow:source-sync
• workflow:source-maintenance
• consumer-sync
• integration-sync
• workflows-sync
• template-sync

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Essentials

Run ID: 5a8c780d-463a-419e-bbc2-730707c33ea9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

Multiple workflows mint GitHub App tokens using client-id wired to *_APP_ID secrets (App ID vs client ID mismatch), which is likely to break token generation across automation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR syncs a large set of workflow templates, scripts, and documentation from stranske/Workflows into this consumer repository, updating the automation surface (agents, keepalive, coverage guard, docs drift fixes) and aligning local docs/contracts with the upstream fleet standards.

Changes:

• Update GitHub Actions workflows to the latest consolidated “agents” topology and tightened API-client secret handling.
• Improve coverage reporting/guard rails (coverage_trend.py, coverage_guard.py) including baseline semantics and contamination detection.
• Add/extend backplane contract tooling and docs drift automation (tracked-variable schema + validator support, docs drift checker workflow).

File summaries

File	Description
WORKFLOW_USER_GUIDE.md	Updates user-facing workflow behavior docs (ready PRs, event hub naming, new recovery procedures).
tools/coverage_trend.py	Makes baseline handling explicit (no silent 0.0), adds project-root contamination filtering and richer summaries/outputs.
tools/coverage_guard.py	Adds warn-drop breach semantics and improved recovery messaging/threshold logic.
scripts/validate_run_contract.py	Adds tracked-variable schema validation mode and schema registry handling for tracked-variable refs.
scripts/sync_test_dependencies.py	Updates canonical base module set and broadens local module detection behavior.
scripts/langchain/progress_reviewer.py	Always emits a structured review payload derived from analysis fields.
scripts/langchain/label_matcher.py	Refines keyword matching with explicit aliases, adds diverse match selection and safer auto-apply logic.
scripts/langchain/capability_check.py	Removes deprecated alias export to align callers with classify_capabilities.
scripts/check_docs_drift.py	Adds a deterministic docs drift detector for workflow inventory + dangling inline path references.
scripts/check_deliberate_break.py	Improves fallback test-name extraction and prioritizes explicit markers anywhere in PR body.
docs/contracts/tracked-variable-v1.md	Adds normative spec doc for tracked-variable/v1 contract and validation instructions.
docs/contracts/schemas/tracked-variable-v1.schema.json	Introduces tracked-variable v1 JSON schema referencing embedded evidence schema.
docs/contracts/agent-runner-output.md	Bumps contract to v1.2; adds optional subject-id output documentation.
docs/CI_SYSTEM_GUIDE.md	Updates system guide to current consumer entry points and guarded delivery behavior.
config/source_of_truth_docs.yml	Adds consumer-local source-of-truth doc list for docs-drift agent.
config/model_registry.json	Updates model source references and pricing metadata.
CLAUDE.md	Adds “Pull Request Readiness Invariant” guidance for automation-created PRs.
AGENTS.md	Adds “Pull Request Readiness Invariant” guidance for automation-created PRs.
.gitignore	Appends managed Workflows status-file ignore block to avoid automation artifacts being committed.
.github/workflows/reusable-pr-context.yml	Updates reusable PR-context workflow including App-token minting wiring.
.github/workflows/maint-coverage-guard.yml	Updates coverage guard workflow (artifact discovery, source workflow configurability, clearer outcomes).
.github/workflows/maint-87-docs-drift-fix-agent.yml	Adds weekly docs drift planning workflow with dispatch-only issue creation.
.github/workflows/maint-76-claude-code-review.yml	Updates API client setup inputs and bumps Claude action pin.
.github/workflows/backplane-conformance.yml	Guards editable installs for non-packaged consumer repos.
.github/workflows/agents-weekly-metrics.yml	Updates token minting + API client setup and improves tracker body stamping.
.github/workflows/agents-verify-to-new-pr.yml	Updates API client setup to pass named secret inputs (removes whole-secrets blob).
.github/workflows/agents-verifier.yml	Updates API client setup to pass named secret inputs (removes whole-secrets blob).
.github/workflows/agents-keepalive-sweep.yml	Splits consolidated vs non-consolidated sweep modes; tightens eligibility label requirements.
.github/workflows/agents-keepalive-loop-reporter.yml	Updates reporter token minting and safety checks for failure reporting.
.github/workflows/agents-issue-optimizer.yml	Tightens recursion pause logic, improves failure comments, updates token minting + named secret inputs.
.github/workflows/agents-issue-intake.yml	Removes draft-PR bootstrap toggle to enforce ready-for-review invariant.
.github/workflows/agents-issue-format-guard.yml	Expands triggers, adds stale lease cleanup, and updates exemption/hold logic.
.github/workflows/agents-guard.yml	Updates API client setup inputs; bumps fallback action pin.
.github/workflows/agents-dedup.yml	Guards dependency install for non-packaged repos; updates API client setup inputs.
.github/workflows/agents-decompose.yml	Guards dependency install for non-packaged repos; updates API client setup inputs.
.github/workflows/agents-capability-check.yml	Guards dependency install for non-packaged repos; updates caller import to classify_capabilities.
.github/workflows/agents-autofix-dispatcher.yml	Updates token minting + named secret inputs.
.github/workflows/agents-auto-pilot.yml	Updates token minting + named secret inputs; removes legacy workflow fallbacks for consolidated mode.
.github/workflows/agents-auto-label.yml	Updates dependency install fallback; adopts new matcher auto-apply logic.
.github/workflows/agents-80-pr-event-hub.yml	Tightens bot-comment handler follow-up gating and updates API client setup inputs.
.github/workflows/agents-73-codex-belt-conveyor.yml	Updates token minting + named secret inputs.
.github/workflows/agents-72-codex-belt-worker.yml	Updates token minting + named secret inputs (including belt-tools path).
.github/workflows/agents-71-codex-belt-dispatcher.yml	Refactors helper checkout/staging and adds rate-limit preflight gating.
.github/scripts/token_load_balancer.js	Adds explicit statuses capability handling and correct aliasing for statuses:write.
.github/scripts/sync_tracker_state/index.js	Adds durable/transient tracker support and tightens “open PR” detection to same-repo heads.
.github/scripts/source_context.js	Tightens issue-number inference to avoid ambiguity; adds “closing issue” extraction.
.github/scripts/keepalive_post_work.js	Adds injectable clock for polling and passes it through post-work flows.
.github/scripts/keepalive_loop.js	Expands PR-number resolution, adds delegation-source reporting, and skips when no runner exists for selected agent.
.github/scripts/issue_format.py	Improves task/acceptance concrete-target detection and lint-command recognition; better error previews.
.github/scripts/github-api-with-retry.js	Adds rate-limit incident logging, stronger rate-limit preflight semantics, and clearer status-permission diagnostics.
.github/scripts/bot-comment-handler.js	Adds active-thread collection, payload bounding, and multi-part controller comment generation.
.github/scripts/agents_orchestrator_resolve.js	Forces draft_pr false to enforce ready-for-review PR creation.
.github/scripts/agent_delegation_policy.js	Adds route-weights support, round-kind mapping, runner eligibility checks, and delegation-source surfacing.

Review details

• Files reviewed: 56/57 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.