chore: sync 4 org-standard workflow stub(s) from petry-projects/.github

.github/workflows/auto-rebase.yml

@@ -22,14 +22,12 @@
 # To adopt: copy this file to .github/workflows/auto-rebase.yml in your repo.
 # No secrets required — uses GITHUB_TOKEN only.
 #
-# By default the reusable only updates *review-ready* PRs: non-draft AND
-# (carrying a current APPROVED review OR the `auto-rebase:ready` label). This
-# keeps the workflow from fanning out branch-update CI runs to every behind PR.
-# To tune it, pass inputs to the reusable, e.g.:
+# By default the reusable updates *every* behind PR (`eligibility: all`). The
+# `eligibility` input is a tunable extension point for future modes; to select
+# one, pass it to the reusable, e.g.:
 #
 #   with:
-#     eligibility: review-ready      # default; or `all` to update every behind PR
-#     ready_label: auto-rebase:ready # label that opts a non-draft PR in
+#     eligibility: all  # default — update every behind PR
 #
 name: Auto-rebase non-Dependabot PRs
 

.github/workflows/dependabot-automerge.yml

@@ -35,5 +35,5 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/v2-next
+    uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/v2-next  # NOSONAR(githubactions:S7637) first-party channel ref
     secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable

.github/workflows/dev-lead.yml

@@ -61,9 +61,9 @@ jobs:
     # dependency). Promotion is done by moving the dev-lead/v1-stable tag centrally; this
     # caller is never edited on release. agent_ref threads the same channel into
     # dev-lead's own scripts/prompts checkout. See https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#dev-lead-agent.
-    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v1-stable  # NOSONAR(githubactions:S7637) first-party channel ref
     with:
-      agent_ref: dev-lead/stable
+      agent_ref: dev-lead/v1-stable
     secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable
     permissions:
       contents: write

.github/workflows/pr-review.yml

@@ -419,6 +419,81 @@ jobs:
             fi
           fi
 
+      - name: Cache claude-code CLI
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.npm-global
+          key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
+
+      - name: Verify auth scopes
+        # Inlined from scripts/verify-auth-scopes.sh so this step is self-contained
+        # when pr-review.yml is deployed to target repos that do not have the scripts/ dir.
+        run: |
+          set -euo pipefail
+
+          if auth_status="$(gh auth status 2>&1)"; then
+            :
+          else
+            auth_rc=$?
+            printf '%s\n' "$auth_status"
+            echo "::error::gh auth status failed"
+            exit "$auth_rc"
+          fi
+          printf '%s\n' "$auth_status"
+
+          # Fine-grained PATs are NOT supported — they fail at addPullRequestReview.
+          # Two detection methods: (1) prefix in auth status output; (2) gh auth token
+          # for gh versions that mask the prefix in status output (token never logged).
+          _fgpat=0
+          if grep -qi 'Token:.*github_pat_' <<< "$auth_status"; then
+            _fgpat=1
+          else
+            _tok="$(gh auth token 2>/dev/null || true)"
+            if [[ "${_tok:-}" == github_pat_* ]]; then
+              _fgpat=1
+            fi
+            unset _tok
+          fi
+          if [[ "$_fgpat" -eq 1 ]]; then
+            unset _fgpat
+            echo "::error::Fine-grained PAT detected — fine-grained PATs are not supported by this workflow."
+            echo "::error::Fine-grained PATs fail at addPullRequestReview (GraphQL: Resource not accessible by personal access token)."
+            echo "::error::Replace DON_PETRY_BOT_GH_PAT with a classic PAT that has repo, workflow, and read:org scopes."
+            echo "::error::See docs/pr-review-agent/setup.md → Troubleshooting for details."
+            exit 1
+          fi
+          unset _fgpat
+
+          scopes_line="$(grep 'Token scopes:' <<< "$auth_status" || true)"
+          normalized_scopes="${scopes_line//,/ }"
+          normalized_scopes="${normalized_scopes//$'\''/ }"
+
+          if [ -z "$normalized_scopes" ] || grep -qiE '(cannot determine|fine.grained)' <<< "$auth_status"; then
+            echo "::warning::Token scopes could not be determined. Skipping scope validation."
+            echo "::warning::Ensure the token has: repo + read:org (classic PAT) or contents + pull_requests:write."
+            exit 0
+          fi
+
+          if grep -qE "(^|[[:space:]])repo([[:space:]]|$)" <<< "$normalized_scopes"; then
+            if ! grep -qE "(^|[[:space:]])read:org([[:space:]]|$)" <<< "$normalized_scopes"; then
+              echo "::error::GH_TOKEN has 'repo' scope but is missing 'read:org'."
+              echo "::error::PRs with team-based reviewers will fail at 'gh pr view --json reviewRequests'."
+              echo "::error::Edit the classic PAT and check the 'read:org' box (no regeneration needed)."
+              exit 1
+            fi
+          else
+            if ! grep -qE "(^|[[:space:]])contents(:[^[:space:]]+)?([[:space:]]|$)" <<< "$normalized_scopes"; then
+              echo "::error::GH_TOKEN is missing required scope: contents"
+              echo "::error::Token must have either 'repo' + 'read:org' (classic) or 'contents' + 'pull_requests:write'"
+              exit 1
+            fi
+            if ! grep -qE "(^|[[:space:]])pull_requests(:write)?([[:space:]]|$)" <<< "$normalized_scopes"; then
+              echo "::error::GH_TOKEN is missing required scope: pull_requests with write access"
+              echo "::error::Token must have either 'repo' + 'read:org' (classic) or 'contents' + 'pull_requests:write'"
+              exit 1
+            fi
+          fi
+
       - name: Install review engine CLIs
         run: |
           set -euo pipefail

.github/workflows/test-dev-lead.yml

@@ -137,7 +137,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install PyYAML

.gitignore

@@ -418,3 +418,6 @@ coverage/
 # actionlint scanner binary — downloaded fresh in CI, never committed
 /actionlint
 /actionlint.tar.gz
+
+# Editor/tooling backup artifacts — never committed (see #1378)
+*.backup

.gitleaksignore

@@ -15,10 +15,11 @@ eb7fd4c955378d274794e38ee9b942912ce79c6f:tests/dev-lead/unit/test_engine_fallbac
 # 40-char classic-PAT-length test placeholder verbatim; commit a547c50 rewrote
 # it to avoid the literal. Fingerprint suppresses the historical commit's finding.
 334fac2ca4528d821b7511e1a0f8e5051a2aca65:.gitleaksignore:github-pat:5
-# Framework test fixtures with sample/fake API keys (not real credentials).
-# These are included in the frameworks subtree (git subtree) as test data.
-68ab3109d74633dc4aa4c09ff58d1901795bbd11:frameworks/bmad-method/test/adversarial-review-tests/sample-content.md:generic-api-key:24
-68ab3109d74633dc4aa4c09ff58d1901795bbd11:frameworks/gsd/sdk/src/query/config-query.test.ts:generic-api-key:228
-68ab3109d74633dc4aa4c09ff58d1901795bbd11:frameworks/gsd/sdk/src/query/config-mutation.test.ts:generic-api-key:501
-68ab3109d74633dc4aa4c09ff58d1901795bbd11:frameworks/gsd/tests/security-scan.test.cjs:generic-api-key:300
-68ab3109d74633dc4aa4c09ff58d1901795bbd11:frameworks/gsd/tests/commands.test.cjs:generic-api-key:759
+# commit 95fe0d4 (refactor: migrate to org-wide .github-private convention):
+# framework subtree import introduced test fixture files with dummy API keys used
+# for testing security scanning. These are not real credentials.
+95fe0d46addc83e56a0ba36468583c2970b104e3:frameworks/bmad-method/test/adversarial-review-tests/sample-content.md:generic-api-key:24
+95fe0d46addc83e56a0ba36468583c2970b104e3:frameworks/gsd/sdk/src/query/config-query.test.ts:generic-api-key:228
+95fe0d46addc83e56a0ba36468583c2970b104e3:frameworks/gsd/sdk/src/query/config-mutation.test.ts:generic-api-key:501
+95fe0d46addc83e56a0ba36468583c2970b104e3:frameworks/gsd/tests/commands.test.cjs:generic-api-key:759
+95fe0d46addc83e56a0ba36468583c2970b104e3:frameworks/gsd/tests/security-scan.test.cjs:generic-api-key:300

AGENTS.md

@@ -230,7 +230,7 @@ breaks post-merge (the #1034 defect). This guard closes that gap.
 The `caller-stub-freeze` job in `lint.yml` (#1255, epic #1052 Part B) is the byte-identity **backstop** to
 `validate-caller-inputs` for the specific **ring-0 / self-host** caller stubs — the ones whose reusable lives
 in **this** repo and is pinned to a canary channel tag (`docs/initiatives/agentic-release-strategy.md` §5):
-`dev-lead.yml` (`@dev-lead/v1-next`), `pr-review-trigger.yml` (`@pr-review/next`), and
+`dev-lead.yml` (`@dev-lead/v1-stable`), `pr-review-trigger.yml` (`@pr-review/next`), and
 `ci-failure-analyst.lock.yml` (`@ci-failure-analyst/v1-stable`). A trigger/`with:` forwarding change to a
 channel-pinned self-host stub is exercised by nothing in PR CI and only breaks post-merge (the #1034 defect
 class), so each stub's `on:` trigger + `uses:`/`with:` forwarding block is frozen byte-for-byte against a

docs/initiatives/idea-to-initiative-pipeline.md

@@ -107,43 +107,6 @@ inputs.
    marker) — the idempotency guarantee that let the standalone `idea-enhancer`
    be retired (#876).
 
-There is exactly **one** Discussion-triggered enhancer. The standalone
-`idea-enhancer.yml` (with its `scripts/idea-enhancer/` tooling) has been
-**removed** (#876) now that its capability is fully folded into the
-`feature-ideation` reusable workflow (epic #872) — so a human-authored idea is
-enhanced **once**, never twice.
-
-For each open, human-authored, not-yet-enhanced **Ideas** Discussion the folded
-enhancer posts **one** comment (sharpened problem/goal, repo + market context,
-impact/effort, suggested acceptance criteria). Bot-authored ideas are skipped —
-they are already AI-generated. It never approves, labels, or promotes — that
-stays with triage and the human gates.
-
-The enhancement logic lives in the **central** reusable `petry-projects/.github`
-(`feature-ideation-reusable.yml`); `.github-private` ships only the thin
-`feature-ideation.yml` caller stub (pinned to the `@feature-ideation/next`
-dogfood ring), which exposes the enhancement modes as `workflow_dispatch`
-inputs.
-
-- **Backfill sweep** — dispatch `feature-ideation` with `enhance_backlog: true`.
-  It sweeps the target repo's open, human-authored, not-yet-enhanced **Ideas**
-  Discussions and posts **exactly one** structured enhancement comment each.
-  Bot-authored and already-enhanced ideas are skipped. This is the safety-net
-  backfill that catches human ideas added before the folded enhancer went live.
-- **Dry-run** — dispatch with `dry_run: true` **and** `enhance_backlog: true`.
-  Every intended per-Discussion enhancement comment is logged to the JSONL
-  artifact and **nothing** is posted (one artifact entry per candidate
-  Discussion). The dry-run is free of model spend beyond candidate gathering.
-- **Marker continuity (cutover-safe).** The idempotency check honors **both**
-  the legacy `<!-- idea-enhancer:enhanced -->` marker and the canonical
-  `<!-- feature-ideation:enhanced -->` marker; new enhancement comments emit the
-  single canonical marker. So **no** idea enhanced by the old `idea-enhancer` is
-  re-enhanced after the cutover, and a repeated backfill is a no-op.
-- **Cost.** Operator-triggered (`workflow_dispatch`), **no new cron** — the
-  backfill reuses `feature-ideation`'s existing model budget and 20-minute
-  timeout, so it is cost-neutral-to-reducing.
-
-### `idea-triage.yml` — weekly ripeness shortlist
 - Scans every open **Ideas** Discussion, scores each **Ripe / Soon / Not yet**
   on evidence, prerequisites, alignment, coverage, and freshness.
 - Rewrites a single **Idea Promotion Queue** tracking issue (label

evals/validate-cases.py

@@ -32,17 +32,6 @@ def fail(msg: str) -> NoReturn:
 
 # ── File mode: schema + id-uniqueness validation ──────────────────────────────
 
-def validate_file(cases_path: Path, schema_path: Path) -> None:
-    try:
-        import jsonschema
-    except ImportError:
-        fail("jsonschema not installed (pip install 'jsonschema>=4')")
-
-    try:
-        schema = json.loads(schema_path.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError) as exc:
-        fail(f"could not read/parse schema {schema_path}: {exc}")
-
 def validate_file(cases_path: Path, schema_path: Path) -> None:
     try:
         import jsonschema
@@ -157,80 +146,6 @@ def validate_directory(eval_root: Path) -> None:
     print(f"OK: {len(skills)} skill(s), {total} case(s) across dev+holdout, "
           f"no cross-split id overlap.")
 
-
-# ── Directory mode: dev/holdout split hygiene ─────────────────────────────────
-
-def load_split_ids(cases_path: Path) -> list[str]:
-    try:
-        raw = cases_path.read_text(encoding="utf-8")
-    except OSError as exc:
-        fail(f"could not read {cases_path}: {exc}")
-
-    ids: list[str] = []
-    seen: set[str] = set()
-    for lineno, line in enumerate(raw.splitlines(), start=1):
-        if not line.strip():
-            continue
-        try:
-            case = json.loads(line)
-        except json.JSONDecodeError as exc:
-            fail(f"{cases_path}:{lineno}: invalid JSON: {exc}")
-        if not isinstance(case, dict):
-            fail(f"{cases_path}:{lineno}: each case line must be a JSON object")
-        if "id" not in case:
-            fail(f"{cases_path}:{lineno}: case is missing required field 'id'")
-        cid = case["id"]
-        if not isinstance(cid, str) or not cid.strip():
-            fail(f"{cases_path}:{lineno}: case 'id' must be a non-empty string")
-        if cid in seen:
-            fail(f"{cases_path}:{lineno}: duplicate id '{cid}' within this split")
-        seen.add(cid)
-        ids.append(cid)
-    return ids
-
-
-def validate_skill(skill_dir: Path) -> int:
-    split_ids: dict[str, list[str]] = {}
-    for split in SPLITS:
-        cases_path = skill_dir / split / CASES_FILENAME
-        if not cases_path.is_file():
-            fail(f"skill '{skill_dir.name}' is missing its {split} split "
-                 f"(expected {cases_path})")
-        split_ids[split] = load_split_ids(cases_path)
-
-    overlap = set(split_ids["dev"]) & set(split_ids["holdout"])
-    if overlap:
-        joined = ", ".join(sorted(overlap))
-        fail(f"skill '{skill_dir.name}': id(s) appear in both dev and holdout "
-             f"splits (a case must not be in both): {joined}")
-
-    return sum(len(ids) for ids in split_ids.values())
-
-
-def discover_skills(eval_root: Path) -> list[Path]:
-    skills = []
-    for child in sorted(eval_root.iterdir()):
-        if not child.is_dir():
-            continue
-        if any((child / split).is_dir() for split in SPLITS):
-            skills.append(child)
-    return skills
-
-
-def validate_directory(eval_root: Path) -> None:
-    skills = discover_skills(eval_root)
-    if not skills:
-        fail(f"no skills found under {eval_root} "
-             f"(expected <skill>/dev/ and <skill>/holdout/ subdirectories)")
-
-    total = 0
-    for skill_dir in skills:
-        total += validate_skill(skill_dir)
-
-    print(f"OK: {len(skills)} skill(s), {total} case(s) across dev+holdout, "
-          f"no cross-split id overlap.")
-
-
 # ── Entry point ───────────────────────────────────────────────────────────────
 
 def main() -> None:

package.json

@@ -0,0 +1,8 @@
+{
+  "name": ".github-private",
+  "version": "1.0.0",
+  "private": true,
+  "devDependencies": {
+    "bats": "1.13.0"
+  }
+}

prompts/cascade-action.md

@@ -59,6 +59,12 @@ PLACEHOLDER_SUMMARY
 ### Cross-engine agreement (if deep+duck)
 <If tier is deep+duck and agreement field exists, include this section>
 
+### Cross-engine agreement (if deep+duck)
+<If tier is deep+duck and agreement field exists, include this section>
+
+### Cross-engine agreement (if deep+duck)
+<If tier is deep+duck and agreement field exists, include this section>
+
 ### Findings
 PLACEHOLDER_FINDINGS_LIST