chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-81-gate-followups.yml: Gate followups hub - keepalive and autofix; budgets count Gate failures with failed jobs
• registry.yml: Agent registry - source of truth for agent keys and runner workflow mapping
• agent_registry.js: Agent registry helper - loads registry and resolves agent key from labels
• llm_registry.py: LLM model registry helper - shared slot/model selection and blocked-model enforcement
• MODEL_SELECTION_POLICY.md: Auditable auxiliary-model evaluation, selection, and refresh policy
• model_registry.json: Model registry - available LLM models and their capabilities

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: 11300195bb4e7cf3135d1211a11a850efac10dba
Template hash: 06a120993a95
Consumer-sync plan ID: sha256:06a120993a957a893fe17371c60d54d88847c55ae27664e8bfd99515e0855596
Plan scope: source-delta
Scope base SHA: 3ed8bc0a6dbe41d961ba28cf15bf94a54f4679d1
Sync phase: promote
Sync branch: sync/workflows-delivery
Consumer repo: stranske/Doc-Lineage
Manifest: .github/sync-manifest.yml

autofix: false

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (7)

• sync
• workflow:source-sync
• workflow:source-maintenance
• consumer-sync
• integration-sync
• workflows-sync
• template-sync

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: stranske/Doc-Lineage/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Essentials

Run ID: 761be5a2-1536-4374-a027-f385dad6ff13

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[stranske-keepalive]

Automated Status Summary

Head SHA: 4086442
Latest Runs: ⏳ pending — Gate
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 1

Coverage Trend

Metric	Value
Current	90.45%
Baseline	⚠️ not configured (absent)
Delta	n/a — nothing to compare against
Minimum	70.00%
Status	✅ Pass

No baseline was read (absent), so the delta above is not a measurement. Status reflects only the --minimum floor. Write config/coverage-baseline.json with a line or coverage percentage to enable the comparison; that file is deliberately not synced from Workflows, so each repo owns its own.

Top Coverage Hotspots (lowest coverage)

File	Coverage	Missing
src/doc_lineage/extract/ocr.py	57.4%	16
src/doc_lineage/extract/__init__.py	73.1%	9
src/doc_lineage/extract/cache.py	74.2%	16
src/doc_lineage/harvest/edgar_ex10.py	74.5%	37
src/doc_lineage/schema/_finite.py	77.8%	4
src/doc_lineage/emit/evidence.py	86.7%	3
src/doc_lineage/extract/pdf.py	86.7%	9
src/doc_lineage/extract/office.py	87.3%	3
src/doc_lineage/schema/change_ledger.py	89.1%	16
src/doc_lineage/mutations/detect.py	90.9%	1
src/doc_lineage/adapters/docling_segmenter.py	91.2%	16
src/doc_lineage/schema/validation.py	93.3%	4
src/doc_lineage/compare/classify.py	95.5%	3
src/doc_lineage/render/links.py	96.0%	2
src/doc_lineage/manifest.py	97.1%	3

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[Copilot]

🟡 Changes recommended

Review found a critical fallback-reservation loop and moderate persistence and rate-limit handling issues.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Synchronizes shared workflow templates and runner utilities from Workflows into Doc-Lineage.

Changes:

• Extends run-contract and capability-bundle validation.
• Updates runner dispatch, attempt tracking, and completion persistence.
• Refines deliberate-break parsing.
• Updates cross-repository wakeup handling.

File summaries

File	Summary
scripts/validate_run_contract.py	Validates run-contract envelopes and capability-bundle schemas.
scripts/runner_lib/core.py	Updates dispatch and completion persistence; contains critical fallback-reservation and moderate completion-reporting issues.
scripts/check_deliberate_break.py	Refines deliberate-break marker parsing.
.github/workflows/agents-81-gate-followups.yml	Updates wakeup handling; 403 responses may incorrectly bypass retries.

Review details

Suppressed comments (4)

.github/workflows/agents-81-gate-followups.yml:2248

• GitHub also uses HTTP 403 for secondary/rate-limit responses, not only missing authorization. Treating every 403 as skipped-unauthorized bypasses the retry path and silently drops the generated-delivery wakeup during throttling. Distinguish permission/not-found failures from rate-limited 403s (for example by honoring rate-limit headers) before returning this sentinel.

                  if ([403, 404].includes(status)) {
                    core.warning(
                      `Generated-delivery wakeup skipped: repository_dispatch to stranske/Workflows ` +
                        `returned ${status} (token: WRITE_TOKEN fallback chain). ` +
                        `Error: ${error?.message || error}`,
                    );
                    return SKIPPED_UNAUTHORIZED;

scripts/runner_lib/core.py:1300

• The ownership check above is not atomic with this write. If a newer workflow attempt reserves the same PR after the read at line 1245 but before this write, this unconditional update can overwrite its workflow_attempt_id and pending reservation with the stale completion, defeating the new stale-attempt fence. Use a compare-and-set/conditional update (or re-read and abort under a storage-level lock/ETag) before committing the completion.

    try:
        completion_storage.write_record(pr_number, provider, record)
    except Exception as exc:

scripts/runner_lib/core.py:1444

• This new output reports recorded=true for every normal return, but RepoVariableRunnerStorage.write_record treats 401/403 as a skipped write and returns normally (lines 943-948). Thus record-completion --storage repo-variable can claim the completion was persisted when it was not; propagate the backend's write outcome or raise on the skipped write before setting this flag.

        "recorded": "false" if record.get("completion_recorded") is False else "true",

scripts/runner_lib/core.py:1252

• The verified due-authority-challenge path in agents-81-gate-followups.yml bypasses should-dispatch and launches the runner without creating a reservation. With this guard, the subsequent completion sees no primary record and returns completion_recorded=false, so every authority-challenge run is silently dropped and cannot update the debounce/productivity state. Reserve that forced run before launching it, or carry an explicit challenge/force mode through completion so it can be recorded safely.

    if uses_fallback and prior_record is None:
        return _unrecorded_completion({}, key, "authoritative-reservation-missing")

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.