docs(#6605): update prioritize scheduler to use create-github-app-token

[fullsend-ai-coder]

Summary

Update the prioritize scheduler example workflow in docs/agents/prioritize.md to match the tested version from fullsend-ai/.fullsend, replacing mint-token authentication with create-github-app-token and adding missing features.

Changes

• Auth mechanism: Replace mint-token (GCP WIF) with actions/create-github-app-token@v3 using two GitHub Apps — prioritize (project board access) and fullsend (cross-repo dispatch)
• Stale re-scoring: Add stale_threshold input (default 7d) with logic to re-dispatch issues whose RICE Score was last updated beyond the threshold
• Parameterization: Replace hardcoded values with workflow_dispatch inputs (project_number, repos, score_field, workflow, stale_threshold, wip_limit)
• Prerequisites table: Replace FULLSEND_MINT_URL, FULLSEND_PRIORITIZE_REPOS, PRIORITIZE_WIP_LIMIT with FULLSEND_PRIORITIZE_CLIENT_ID, FULLSEND_PRIORITIZE_APP_PRIVATE_KEY, FULLSEND_FULLSEND_CLIENT_ID, FULLSEND_FULLSEND_APP_PRIVATE_KEY
• Permissions: Remove id-token: write (not needed without WIF/OIDC)
• Prose: Update two-role explanation to describe the two-app-token approach and least-privilege rationale

Testing

• Example YAML validates as valid GitHub Actions syntax
• Every variable/secret in the prerequisites table appears in the workflow
• No residual mint-token references remain
• stale_threshold input and re-scoring logic are present
• Prose explains two-app-token approach (not two mint roles)
• scan-secrets passes
• lint-docs-links passes
• lychee link check passes

---

Closes #6605

Post-script verification

• Branch is not main/master (agent/6605-update-prioritize-scheduler-docs)
• Secret scan passed (gitleaks — efbad460ff35eb9ad105ca59f20be8a5b34c6488..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[github-actions]

Site preview

Preview: https://afc71a6a-site.fullsend-ai.workers.dev

Commit: 87a27bb510a3297a27cfdc029b6b177d053ac75e

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:38 PM UTC · Completed 6:56 PM UTC

Commit: 767c80c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.17

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Risk Assessment: low (1/5)

Details

Low-risk documentation-only change by a trusted bot author updating a single file (docs/agents/prioritize.md, +131/-48) to replace mint-token auth with create-github-app-token per well-scoped issue #6605. No protected paths, security-sensitive files, CI workflows, or dependencies touched.

Previous run

Risk Assessment: moderate (2/5)

Details

Docs-only PR by a bot updating a single documentation file to match 5 well-defined issue requirements; elevated git churn and multi-author contention on the file are offset by low metadata risk and perfect issue-scope alignment.

Previous run (2)

Risk Assessment: low (1/5)

Details

Documentation-only PR by a trusted bot that addresses all 5 items from its linked issue with a modest 181-line change across 2 files; no security, CI, or dependency surface affected.

Previous run (3)

Risk Assessment: moderate (2/5)

Details

Documentation-only change to a single file by an established bot author. Medium blast radius due to 174 lines changed but no protected paths, security-sensitive files, CI, or dependency changes. Moderate file churn in git history. Linked issue fully addressed with clear scope alignment.

Previous run (4)

Risk Assessment: low (1/5)

Details

Single-file documentation update by a known bot author migrating token usage in a workflow example. No protected paths, security-sensitive files, CI workflows, or dependencies affected. Linked issue is a well-scoped chore with clear acceptance criteria.

Previous run (5)

Risk Assessment: moderate (2/5)

Details

Documentation-only change by a trusted bot addressing all five gaps from the linked issue; moderate git churn is the only mild risk elevator, offset by zero security/CI/dependency impact and full acceptance-criteria coverage.

[fullsend-ai-review]

Looks good to me

Previous run

Review

Findings

Medium

• [internal-consistency] docs/agents/prioritize.md:102 — The prose claims "All configuration is self-contained in the workflow file — no repository variables are needed" but the Prerequisites section lists four required repository variables and secrets (FULLSEND_PRIORITIZE_CLIENT_ID, FULLSEND_PRIORITIZE_APP_PRIVATE_KEY, FULLSEND_FULLSEND_CLIENT_ID, FULLSEND_FULLSEND_APP_PRIVATE_KEY), and the workflow YAML references them via ${{ vars.* }} and ${{ secrets.* }}. The intended distinction appears to be that operational config (project number, repos, score field, thresholds) is self-contained via || fallback expressions, but authentication credentials are still required as repo variables/secrets.
  Remediation: Reword to e.g., "All operational configuration (project number, target repos, score field, thresholds) is self-contained in the workflow file via || fallback expressions — the only repository variables and secrets needed are the GitHub App credentials listed in Prerequisites above."

Previous run (2)

Review

Findings

High

• [scope-creep] .fullsend/config.yaml:25 — The removal of the status_notifications section is not authorized by issue docs: update prioritize scheduler example to use create-github-app-token #6605. The issue lists five specific documentation gaps, all in docs/agents/prioritize.md. The PR body does not mention this config change. The deleted block was added deliberately by a human contributor (commit 6127703c, "chore: enable emoji reactions for agent runs on this repo"), and its removal silently disables emoji reactions for agent runs on this repo.
  Remediation: Revert the .fullsend/config.yaml change from this PR. If the status_notifications section should be removed, that should be done in a separate PR with its own rationale.

Low

• [intent-mismatch] .fullsend/config.yaml:25 — The PR title uses the docs(#6605) prefix, signaling a documentation-only change per COMMITS.md conventions, but includes an operational configuration change to .fullsend/config.yaml.

• [edge-case] docs/agents/prioritize.md:166 — The parse_threshold function accepts 0d and 0h, which produce a threshold of 0 seconds, causing every scored issue to be treated as stale. This only triggers via explicit workflow_dispatch with deliberately unusual input, and re-dispatch is bounded by WIP_LIMIT (default 5), so impact is limited.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

Low

• [edge-case] docs/agents/prioritize.md:166 — The parse_threshold function does not validate that the numeric portion is non-empty or a valid integer. If called with a bare unit character like d, val becomes the empty string and bash arithmetic treats it as 0, silently returning 0 seconds — causing every scored issue to be treated as stale. The default fallback (7d) is safe, so this only triggers via explicit workflow_dispatch with malformed input, and re-dispatch is bounded by WIP_LIMIT (default 5).
  Remediation: Add a guard after extracting val: if [[ -z "${val}" || ! "${val}" =~ ^[0-9]+$ ]]; then echo "ERROR: invalid threshold" >&2; exit 1; fi

• [internal-consistency] docs/agents/prioritize.md:142 — The prose claims the || fallback expressions in the env block are the "single source of truth," but the repositories field in the dispatch-token step's with block also uses a || fallback (${{ inputs.repos || '<your-repos>' }}). This fallback is equally critical for schedule triggers and should be acknowledged in the prose.

Previous run (4)

Looks good to me

Previous run (5)

Review

Findings

High

• [edge-case] docs/agents/prioritize.md:181 — When triggered by the schedule event (cron), all inputs.* values are empty strings — workflow_dispatch defaults only apply to the UI/API dispatch. The env block sets PROJECT_NUMBER, SCORE_FIELD, STALE_THRESHOLD, WORKFLOW, and WIP_LIMIT solely from inputs.* with no fallback. On a scheduled run: gh project view "" fails, parse_threshold "" fails (empty unit), --argjson limit "" is invalid jq, and gh workflow run "" is invalid. The old workflow used vars.FULLSEND_PROJECT_NUMBER and vars.PRIORITIZE_WIP_LIMIT || '5' as fallbacks and guarded against an empty project number.
  Remediation: Add fallbacks using the || expression pattern for each input, e.g. PROJECT_NUMBER: ${{ inputs.project_number || vars.FULLSEND_PROJECT_NUMBER }}, SCORE_FIELD: ${{ inputs.score_field || 'RICE Score' }}, STALE_THRESHOLD: ${{ inputs.stale_threshold || '7d' }}, WORKFLOW: ${{ inputs.workflow || 'prioritize.yml' }}, WIP_LIMIT: ${{ inputs.wip_limit || '5' }}. The repos input in the dispatch token step also needs a fallback.

Medium

• [edge-case] docs/agents/prioritize.md:170 — The dispatch token step sets repositories: ${{ inputs.repos }}. On a schedule trigger, inputs.repos is empty. With create-github-app-token, an empty repositories input generates a token scoped to ALL repositories the app is installed on, which is the opposite of the least-privilege intent described in the surrounding documentation. See also: [edge-case] finding at line 181 (empty inputs on schedule).
  Remediation: Add a vars.* fallback for the repos list (e.g. repositories: ${{ inputs.repos || vars.FULLSEND_PRIORITIZE_REPOS }}) so the token is scoped to only the necessary repos on scheduled runs.

Low

• [pattern-inconsistency] docs/agents/prioritize.md:331 — Several echo statements use backslash line continuations inside the YAML run: | block, producing leading whitespace in the output string. The base version kept these on a single line.
• [naming-convention] docs/agents/prioritize.md:88 — The prerequisites table uses Name as the first column header, while other agent docs (e.g. review.md) use Variable. The new table combines variables and secrets, which somewhat justifies a more generic header, but diverges from codebase convention.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 6:59 PM UTC · Completed 7:04 PM UTC

Commit: 767c80c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.68

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (bot-triggered)

Addressed 3 of 4 review findings. Added || fallbacks for all workflow_dispatch inputs so schedule-triggered runs work correctly, scoped the dispatch token with a vars.FULLSEND_PRIORITIZE_REPOS fallback, and removed backslash line continuations in echo statements. Disagreed with the naming-convention finding (Name vs Variable header) because the table contains both variables and secrets.

Fixed (3):

1. empty inputs on schedule trigger (env vars lack fallbacks) (docs/agents/prioritize.md): Added || fallbacks for all inputs.* env vars: PROJECT_NUMBER falls back to vars.FULLSEND_PROJECT_NUMBER, SCORE_FIELD to 'RICE Score', STALE_THRESHOLD to '7d', WORKFLOW to 'prioritize.yml', WIP_LIMIT to 5. This restores the guard behavior the old workflow had and ensures schedule-triggered runs work correctly.
2. dispatch token over-scoped on schedule trigger (empty repositories input) (docs/agents/prioritize.md): Added vars.FULLSEND_PRIORITIZE_REPOS fallback to the dispatch-token repositories field so scheduled runs scope the token to only the necessary repos. Also added FULLSEND_PRIORITIZE_REPOS to the prerequisites table.
3. backslash line continuations produce leading whitespace in echo output (docs/agents/prioritize.md): Removed backslash line continuations from three echo statements, restoring single-line format to match the base version and avoid leading whitespace in output.

Disagreed (1):

1. prerequisites table uses Name header instead of Variable: The table contains both variables and secrets (mixed types), so the generic 'Name' header is more accurate than 'Variable' which would be misleading for the secret rows. The review.md table uses 'Variable' because it only contains variables. The existing 'Type' column already distinguishes between Variable and Secret entries.

Tests: passed

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:07 PM UTC · Completed 7:24 PM UTC

Commit: b445e8a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.09

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:31 PM UTC · Completed 7:50 PM UTC

Commit: 14a0602 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.95

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:32 PM UTC · Completed 8:48 PM UTC

Commit: 0e2c25c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.45

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:53 PM UTC · Completed 9:09 PM UTC

Commit: 87a27bb · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.02

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 9:31 PM UTC · Completed 9:50 PM UTC

Commit: 87a27bb · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $7.42

[fullsend-ai-retro]

Retro: PR #6606 — docs(#6605): update prioritize scheduler to use create-github-app-token

Timeline

Issue #6605 (opened by ggallen) requested updating the prioritize scheduler example in docs/agents/prioritize.md to replace mint-token auth with create-github-app-token, add stale re-scoring, and parameterize hardcoded values.

The code agent (run 32883680651, $2.37) fetched the working reference workflow from fullsend-ai/.fullsend and created the PR. ggallen approved at 18:37 UTC — before the review agent completed.

Review #1 (run 32884628747, $5.17) found 4 issues including a HIGH: inputs.* values are empty on schedule triggers, breaking cron runs. The fix agent (run 32886702466, $1.68) correctly fixed 3/4 findings and justifiably disagreed with the naming-convention LOW. Review #2 ($4.09) approved.

ggallen then force-pushed a rewrite (commit 14a0602) with additional features. Reviews #3-#6 found genuine issues in the new human-authored content:

• Review docs: Add codebase context problem document and trim CLAUDE.md #3 ($5.95): parse_threshold validation gap + prose inconsistency
• Review Use AI to help formalise intent after rapid local prototyping #4 ($5.16): HIGH scope-creep — accidental deletion of .fullsend/config.yaml status_notifications section, which would have silently disabled emoji reactions for agent runs
• Review docs: add agent infrastructure problem document #5 ($3.45): documentation self-contradiction ("no repo variables needed" vs. prerequisites table listing four)
• Review Add CODEOWNERS #6 ($4.02): approved

ggallen fixed each finding manually across 4 commits. Merged at 21:30 UTC. Total pipeline cost: ~$32 (6 reviews: $27.84, code: $2.37, fix: $1.68).

What went well

1. Scope-creep detection was excellent. Review Use AI to help formalise intent after rapid local prototyping #4 caught the accidental .fullsend/config.yaml deletion that even the human author didn't notice. The intent-coherence sub-agent verified via git log that commit 6127703c deliberately added the status_notifications block, confirmed no PR discussion authorized its removal, and correctly flagged it. This prevented a silent operational regression.

2. Fix agent quality was high. The fix agent addressed 3 of 4 findings cleanly in a single pass ($1.68), added a necessary prerequisite table entry as a downstream consequence, and provided well-reasoned justification for disagreeing with the naming-convention finding. Review Add problem areas: Tekton pipeline review, migration path, multi-tenancy #2 confirmed all fixes were adequate.

3. Later reviews found real issues in new content. Despite the high iteration count, Reviews docs: Add codebase context problem document and trim CLAUDE.md #3-docs: add agent infrastructure problem document #5 each found legitimate issues in human-authored code that didn't exist in prior versions — these were not rehashed findings.

Root cause of the initial bug

The code agent faithfully copied the reference workflow from fullsend-ai/.fullsend, which itself lacked || fallback expressions in its env block. The reference works in practice because its workflow_dispatch.inputs.*.default values are concrete org-specific values that GitHub Actions uses as implicit fallbacks. When the code agent replaced these with generic placeholders (e.g., <your-project-number>) per issue instructions, the implicit fallback mechanism broke. The code agent verified YAML syntax and checked for residual old references, but never reasoned about schedule-trigger runtime semantics. One proposal filed to add GitHub Actions trigger-context awareness to the code agent.

Evidence for existing issues (not filing duplicates)

• agents#343 (scope re-review to finding verification): Reviews docs: Add codebase context problem document and trim CLAUDE.md #3, docs: add agent infrastructure problem document #5, and Add CODEOWNERS #6 re-reviewed the entire 170+ line diff rather than only incremental changes. Scoped re-review would have reduced cost by an estimated 30-50% per iteration.
• fullsend#5937 (fix agent auto-triggering with debounce): The fix agent ran once after Review docs: Add agent-compatible code problem document #1 but was not re-triggered for Reviews docs: Add codebase context problem document and trim CLAUDE.md #3-docs: add agent infrastructure problem document #5, forcing ggallen to manually push 4 fixup commits.
• agents#497 / fullsend#5777 (review model routing by diff complexity): All 6 reviews ran on Opus at high effort for a single-file docs change. Model downgrade for docs-only re-reviews would reduce per-iteration cost.
• agents#841 (skip challenger for clean re-reviews): Reviews Add problem areas: Tekton pipeline review, migration path, multi-tenancy #2 and Add CODEOWNERS #6 were clean approvals but still ran the full sub-agent suite including the challenger.

Autonomy assessment

ggallen's initial approval (18:37 UTC, 3 minutes after PR creation) was a silent approval with no inline comments — inconclusive for autonomy analysis per the conservatism principle. The review agent subsequently found genuine HIGH-severity issues the human had not flagged. On this PR, the review agent demonstrated stronger coverage than the human reviewer for GitHub Actions trigger semantics and for detecting accidental scope creep in human-pushed commits. However, this is a single data point and does not meet the threshold for an autonomy-increasing proposal.

Proposals filed

• Code agent should validate GitHub Actions trigger semantics when authoring workflows (in fullsend-ai/agents)