[immakermatty]

Status: ready for review. Docs only. Release 0.1.91-lazurio.1 is published, so merging no longer affects it.

Why

This PR records three decisions and facts from 2026-09-30 in the fork docs.

• Headless approval level for unattended Steward bot teams #3 approval level. Matěj, the Organization Admin, decided that unattended Steward teams run on Auto. Imported bots start on Ask and would wait for approvals nobody gives.
• GitHub intake: first enable in organization scope reviews every open ready PR once #5 first enable. Also Matěj's decision: a new Environment starts the GitHub intake on the default requested scope. The organization scope is a later, deliberate switch, because its first poll queues a review for every open ready pull request.
• Upstream tag/release-triggered workflows register only on their first event (before the first release) #6 upstream workflows. The first release showed that the App-created tag registers npm-package.yml and also starts it. Its build job had already built and saved the npm tarball as an Actions artifact when the cancellation took effect. The npm publish and GitHub release update jobs were cancelled before they started, and the workflow is now disabled.

What changes

• LAZURIO.md, docs/lazurio-github-intake.md and the release runbook say the operator sets all four bots to Auto after the import. Full and Custom stay desktop-only.
• The intake example uses the requested scope. The organization scope, with its exclusions, is described as a later switch.
• The runbook says to cancel the first npm-package.yml run before disabling the workflow, and records that this was done.

What does not change

There is no code change, and nothing lets a bot go above Auto.

Verification

• The release contract test passes (6/6).
• Release v0.1.91-lazurio.1:
  • it is immutable and latest, and its tag is e115bdda;
  • SHA256SUMS passes, and the attestation is signed by lazurio-release.yml@refs/heads/main;
  • release-evidence.json names upstream v0.1.91 (10786818).
• npm-package.yml run 36685771083: build job steps through "Save the proven tarball" succeeded (artifact npm-package); publish to npm and update GitHub release were cancelled before starting. The release still has only its three assets.

Follow-ups

The pilot checks how Codex's sandbox treats git and gh in worktrees on Auto (#3).

🤖 Generated with Claude Code

[agentrozjedemeai]

Blocking factual correction in docs/operations/lazurio-fork-release.md:390-392: run 36685771083 was not cancelled before it built anything. The GitHub job list shows pnpm install --frozen-lockfile succeeded at 07:48:15Z, pnpm build:server && pnpm exec vite build && node scripts/build-npm-package.mjs succeeded at 07:48:55Z, the packed-tarball smoke succeeded at 07:49:00Z, and Save the proven tarball succeeded at 07:49:02Z. The run has an npm-package artifact. The publish to npm and update GitHub release jobs were cancelled with no steps, so the accurate statement is that cancellation happened after build/artifact upload but before those publish jobs. Please correct this sentence (and the corresponding issue #6 record if maintained) rather than recording the inaccurate operational evidence.

The other requested checks passed at exact head 4a20866: intake defaults to requested in server/github-intake.ts:87 and its test; the four-agent team package has no approval field, and server/package-import.ts:389-391 starts imported bots on Ask. Release v0.1.91-lazurio.1 exists with the archive, evidence JSON, and SHA256SUMS; npm-package.yml is disabled, while only the three lazurio-* workflows are active. Exact-head Fork CI passed all six jobs; review threads and pending review requests are zero. No merge.

[agentrozjedemeai]

@immakermatty Re-review of exact head 41ed008: approved. Compared with 4a20866: only docs/operations/lazurio-fork-release.md changed, correcting the earlier factual blocker. In run 36685771083 the build, packed-tarball smoke, and "Save the proven tarball" steps succeeded; the npm-package artifact exists. The "publish to npm" and "update GitHub release" jobs were cancelled with no steps. Issue #6 comment and PR body now agree; the release still has three assets. Exact-head Fork CI: 6/6 jobs passed; zero review threads and no pending review requests. Local diff --check passed. No merge.