feat: implement issue #640 — [Phase 4] Wire the gate into the PR/agent-dispatch workflows

.github/workflows/agent-rate-limits-tests.yml

@@ -41,21 +41,25 @@ on:
     paths:
       - 'standards/agent-rate-limits.json'
       - 'scripts/lib/agent-rate-limit.sh'
+      - 'scripts/agent-rate-limit-gate.sh'
       - 'tests/test_agent_rate_limits_config.bats'
       - 'tests/test_agent_rate_limit.bats'
       - 'tests/test_agent_rate_limit_token_budget.bats'
       - 'tests/test_agent_rate_limit_weekly_glide.bats'
+      - 'tests/test_agent_rate_limit_gate.bats'
       - '.github/workflows/agent-rate-limits-tests.yml'
   push:
     branches:
       - main
     paths:
       - 'standards/agent-rate-limits.json'
       - 'scripts/lib/agent-rate-limit.sh'
+      - 'scripts/agent-rate-limit-gate.sh'
       - 'tests/test_agent_rate_limits_config.bats'
       - 'tests/test_agent_rate_limit.bats'
       - 'tests/test_agent_rate_limit_token_budget.bats'
       - 'tests/test_agent_rate_limit_weekly_glide.bats'
+      - 'tests/test_agent_rate_limit_gate.bats'
       - '.github/workflows/agent-rate-limits-tests.yml'
 
 permissions:
@@ -90,4 +94,5 @@ jobs:
             tests/test_agent_rate_limits_config.bats \
             tests/test_agent_rate_limit.bats \
             tests/test_agent_rate_limit_token_budget.bats \
-            tests/test_agent_rate_limit_weekly_glide.bats
+            tests/test_agent_rate_limit_weekly_glide.bats \
+            tests/test_agent_rate_limit_gate.bats

.github/workflows/feature-ideation-reusable.yml

@@ -184,6 +184,7 @@ jobs:
       contents: read
       discussions: write
       id-token: write
+      actions: read  # agent-rate-limit gate reads this workflow's run history (log-only, #640)
     steps:
       - name: Checkout calling repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -226,6 +227,24 @@ jobs:
             exit 1
           fi
 
+      - name: Agent rate-limit admission gate (log-only canary)
+        # Phase-4 wiring of the source-side gate (scripts/lib/agent-rate-limit.sh)
+        # before the ideate dispatch (#640, AC #1/#5). feature-ideation runs the gate
+        # in LOG-ONLY mode: the admission + consecutive-failure-breaker decision is
+        # DERIVED from this workflow's run history (no state backend — AC #3) and
+        # logged, but never acted on. Only initiative-driver enforces in this story
+        # (AC #5). Promotion path: change `--mode log-only` to `--mode enforce` here
+        # in a discrete follow-up (see standards/agent-rate-limits.md). Fail-safe: the
+        # step can never fail the ideation run.
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          bash .feature-ideation-tooling/scripts/agent-rate-limit-gate.sh feature-ideation \
+            --mode log-only \
+            --workflow "${{ github.workflow }}" \
+            --actor "${{ github.actor }}" || true
+
       - name: Run Claude Code — BMAD Analyst
         id: claude
         env:

.github/workflows/initiative-driver.yml

@@ -27,6 +27,16 @@
 # sub-issues to dev-lead — so the central driver does not have to watch every
 # enrolled repo's events.
 #
+# Rate-limit gate (#640): before dispatching, this stub asks the source-side
+# agent-rate-limit gate (petry-projects/.github/scripts/agent-rate-limit-gate.sh)
+# whether `initiative-driver` may dispatch right now. initiative-driver is the
+# canary that ENFORCES: the gate derives concurrency / cooldown / daily-budget /
+# consecutive-failure counters from this stub's own run history (no state
+# backend), reads every threshold from standards/agent-rate-limits.json, and
+# serializes a close-event + schedule burst AHEAD of the cancel-in-progress
+# concurrency group so two dispatches cannot race into cancellation (#443/#402).
+# A `defer` simply skips the dispatch step — never a cancel, never a job failure.
+#
 # To adopt:
 #   1. Copy this file verbatim to .github/workflows/initiative-driver.yml in your repo.
 #   2. Ensure the `initiative:auto` label exists on the repo.
@@ -80,7 +90,49 @@ jobs:
             exit 1
           fi
 
+      - name: Checkout agent-rate-limit gate tooling
+        # Phase-4 wiring (#640): the gate library + orchestrator live in
+        # petry-projects/.github; an enrolled caller stub does not carry them, so
+        # fetch them read-only into a scratch path. Uses the same PAT as the
+        # dispatch — the workflow's GITHUB_TOKEN cannot read another repo — so the
+        # stub's `permissions:` block is unchanged.
+        # continue-on-error: a tooling-checkout outage must not stop the fleet —
+        # the gate step then finds no script, emits no decision, and the dispatch
+        # step's `!= 'defer'` guard falls through to dispatching (fail-open).
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: petry-projects/.github
+          path: .arl-gate-tooling
+          fetch-depth: 1
+          persist-credentials: false
+          token: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}
+
+      - name: Agent rate-limit admission gate (enforcing)
+        # initiative-driver is the ONE canary agent type that ENFORCES (pure bash,
+        # no model spend, the direct #443 target — AC #5). Reads run history with
+        # the PAT (independent of the `permissions:` block) and emits
+        # decision=allow|defer to $GITHUB_OUTPUT; a defer is honoured by the `if:`
+        # on the dispatch step below. Fail-safe: the step can never fail the job.
+        continue-on-error: true
+        id: arl_gate
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}
+        run: |
+          set -euo pipefail
+          bash .arl-gate-tooling/scripts/agent-rate-limit-gate.sh initiative-driver \
+            --mode enforce \
+            --workflow initiative-driver.yml \
+            --actor "${{ github.actor }}" \
+            --tracking-repo "${{ github.repository }}" \
+            --tracking-issue "${{ github.event.issue.number }}" || true
+
       - name: Dispatch central initiative-driver
+        # Skipped (clean no-op) ONLY on an explicit `defer` — never a cancel, never
+        # a job failure (#640, AC #1/#2). Fail-OPEN: an empty/missing decision (the
+        # gate step or its tooling checkout failed) still dispatches, because an
+        # outage of the gate must never stop the fleet (ADR §7 fail-safe direction).
+        if: steps.arl_gate.outputs.decision != 'defer'
         env:
           GH_TOKEN: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}
         run: |