From af0c1cc05004e2b2e847a8dd2a5683f5957edcac Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 21 May 2026 20:31:18 +0000
Subject: [PATCH 01/15] Initial plan


From b2015ccfae47c9edc533644c6aecb5215b1b9472 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 21 May 2026 20:33:42 +0000
Subject: [PATCH 02/15] Improve PR review workflow failure diagnosability

Agent-Logs-Url: https://github.com/petry-projects/.github-private/sessions/094dbf6b-80e1-4bd8-b49f-331751289cd7

Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>
---
 .github/workflows/pr-review.yml | 42 +++++++++++++++++++++++++++++----
 1 file changed, 37 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 8ca3a92cd..e04f24594 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -186,10 +186,12 @@ jobs:
           path: ~/.npm-global
           key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
 
+      - name: Verify auth scopes
+        run: gh auth status
+
       - name: Install review engine CLIs
         run: |
           set -euo pipefail
-          gh auth status
 
           # Use a per-user prefix so actions/cache (above) can persist the
           # install across runs without needing root. Add the bin dir to PATH
@@ -199,19 +201,37 @@ jobs:
           echo "$HOME/.npm-global/bin" >> "$GITHUB_PATH"
           export PATH="$HOME/.npm-global/bin:$PATH"
 
+          npm_install_retry() {
+            local package="$1"
+            local attempts="${2:-3}"
+            local delay="${3:-15}"
+            local attempt=1
+            while [ "$attempt" -le "$attempts" ]; do
+              if npm install -g "$package"; then
+                return 0
+              fi
+              if [ "$attempt" -lt "$attempts" ]; then
+                echo "::warning::npm install failed for $package (attempt $attempt/$attempts); retrying in ${delay}s"
+                sleep "$delay"
+              fi
+              attempt=$((attempt + 1))
+            done
+            return 1
+          }
+
           install_claude() {
             if command -v claude >/dev/null 2>&1; then
               echo "claude-code cache hit: $(claude --version)"
               return 0
             fi
-            npm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}"
+            npm_install_retry "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}"
           }
 
           case "$REVIEW_ENGINE" in
             claude)
               install_claude
               # Best-effort install of fallbacks for duck/fallback support
-              npm install -g @google/gemini-cli || true
+              npm_install_retry "@google/gemini-cli" || true
               if ! command -v gemini >/dev/null 2>&1; then
                 echo "::warning::gemini CLI unavailable — Gemini rate-limit fallback will be unavailable"
               fi
@@ -220,7 +240,7 @@ jobs:
               fi
               ;;
             gemini)
-              npm install -g @google/gemini-cli
+              npm_install_retry "@google/gemini-cli"
               install_claude || true
               ;;
             copilot)
@@ -229,7 +249,7 @@ jobs:
                 gh extension install github/gh-copilot || true
               fi
               install_claude || true
-              npm install -g @google/gemini-cli || true
+              npm_install_retry "@google/gemini-cli" || true
               if ! command -v gemini >/dev/null 2>&1; then
                 echo "::warning::gemini CLI unavailable — Gemini duck review will be skipped"
               fi
@@ -267,6 +287,18 @@ jobs:
       - name: Review each PR (cascade)
         run: bash scripts/review-batch.sh
 
+      - name: Upload debug log on failure
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: pr-review-debug-${{ github.run_number }}
+          path: |
+            prs.txt
+            /tmp/cascade/**
+            /tmp/review-*.log
+          if-no-files-found: ignore
+          retention-days: 14
+
       - name: Upload token usage log
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

From 5901f99cfa676bde9b6e9dc2e281e3f6d7705948 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 21 May 2026 20:36:44 +0000
Subject: [PATCH 03/15] Harden auth scope check and debug artifact paths

Agent-Logs-Url: https://github.com/petry-projects/.github-private/sessions/094dbf6b-80e1-4bd8-b49f-331751289cd7

Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>
---
 .github/workflows/pr-review.yml | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index e04f24594..07054efe7 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -187,7 +187,19 @@ jobs:
           key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
 
       - name: Verify auth scopes
-        run: gh auth status
+        run: |
+          set -euo pipefail
+          auth_status="$(gh auth status 2>&1)"
+          echo "$auth_status"
+          scopes_line="$(printf '%s\n' "$auth_status" | grep 'Token scopes:' || true)"
+          normalized_scopes="$(printf '%s' "$scopes_line" | sed "s/[',]/ /g")"
+          required_scopes=(repo read:org)
+          for required_scope in "${required_scopes[@]}"; do
+            if ! grep -qE "(^|[[:space:]])${required_scope}([[:space:]]|$)" <<< "$normalized_scopes"; then
+              echo "::error::GH_TOKEN is missing required scope: ${required_scope}"
+              exit 1
+            fi
+          done
 
       - name: Install review engine CLIs
         run: |
@@ -202,6 +214,7 @@ jobs:
           export PATH="$HOME/.npm-global/bin:$PATH"
 
           npm_install_retry() {
+            # npm_install_retry <package> [attempts=3] [delay_seconds=15]
             local package="$1"
             local attempts="${2:-3}"
             local delay="${3:-15}"
@@ -293,9 +306,14 @@ jobs:
         with:
           name: pr-review-debug-${{ github.run_number }}
           path: |
+            # Current scripts emit diagnostics under /tmp/cascade.
             prs.txt
             /tmp/cascade/**
+            # Legacy/supplemental review logs from earlier review scripts.
             /tmp/review-*.log
+            # Keep runner.temp paths too for cross-runner compatibility.
+            ${{ runner.temp }}/cascade/**
+            ${{ runner.temp }}/review-*.log
           if-no-files-found: ignore
           retention-days: 14
 

From 48a460c472eab34150f2729b9aee01174e040dc3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 21 May 2026 22:44:35 +0000
Subject: [PATCH 04/15] Fix auth-status capture and artifact path YAML entries

Agent-Logs-Url: https://github.com/petry-projects/.github-private/sessions/221ebbfd-c18a-4562-9682-d96e35858b60

Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>
---
 .github/workflows/pr-review.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 07054efe7..28aa3fb94 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -189,8 +189,15 @@ jobs:
       - name: Verify auth scopes
         run: |
           set -euo pipefail
+          set +e
           auth_status="$(gh auth status 2>&1)"
+          auth_rc=$?
+          set -e
           echo "$auth_status"
+          if [ "$auth_rc" -ne 0 ]; then
+            echo "::error::gh auth status failed"
+            exit "$auth_rc"
+          fi
           scopes_line="$(printf '%s\n' "$auth_status" | grep 'Token scopes:' || true)"
           normalized_scopes="$(printf '%s' "$scopes_line" | sed "s/[',]/ /g")"
           required_scopes=(repo read:org)
@@ -303,15 +310,13 @@ jobs:
       - name: Upload debug log on failure
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        # Collect both current cascade logs and legacy/supplemental log paths.
         with:
           name: pr-review-debug-${{ github.run_number }}
           path: |
-            # Current scripts emit diagnostics under /tmp/cascade.
             prs.txt
             /tmp/cascade/**
-            # Legacy/supplemental review logs from earlier review scripts.
             /tmp/review-*.log
-            # Keep runner.temp paths too for cross-runner compatibility.
             ${{ runner.temp }}/cascade/**
             ${{ runner.temp }}/review-*.log
           if-no-files-found: ignore

From d45328a38d6926c31de99abec97b59465f504523 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 21 May 2026 22:46:11 +0000
Subject: [PATCH 05/15] Address PR feedback on auth capture and artifact paths

Agent-Logs-Url: https://github.com/petry-projects/.github-private/sessions/221ebbfd-c18a-4562-9682-d96e35858b60

Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>
---
 .github/workflows/pr-review.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 28aa3fb94..bc1614ec4 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -189,15 +189,15 @@ jobs:
       - name: Verify auth scopes
         run: |
           set -euo pipefail
-          set +e
-          auth_status="$(gh auth status 2>&1)"
-          auth_rc=$?
-          set -e
-          echo "$auth_status"
-          if [ "$auth_rc" -ne 0 ]; then
+          if auth_status="$(gh auth status 2>&1)"; then
+            :
+          else
+            auth_rc=$?
+            echo "$auth_status"
             echo "::error::gh auth status failed"
             exit "$auth_rc"
           fi
+          echo "$auth_status"
           scopes_line="$(printf '%s\n' "$auth_status" | grep 'Token scopes:' || true)"
           normalized_scopes="$(printf '%s' "$scopes_line" | sed "s/[',]/ /g")"
           required_scopes=(repo read:org)

From f220d250a2de7ebc84189bc00f7efb18d973addc Mon Sep 17 00:00:00 2001
From: donpetry-bot <donpetry-bot@users.noreply.github.com>
Date: Fri, 22 May 2026 13:13:00 +0000
Subject: [PATCH 06/15] chore: apply manual instructions [skip ci-relay]

---
 .github/workflows/pr-review.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index bc1614ec4..ee4e41d2d 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -312,7 +312,7 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         # Collect both current cascade logs and legacy/supplemental log paths.
         with:
-          name: pr-review-debug-${{ github.run_number }}
+          name: pr-review-debug-${{ github.run_number }}-${{ github.run_attempt }}
           path: |
             prs.txt
             /tmp/cascade/**

From 07e2d2d7e311867d8e88de5fb596bccee33ad160 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Sat, 23 May 2026 18:09:03 -0500
Subject: [PATCH 07/15] ci: Add fallback-model opus to CI Failure Analyst
 (#378)

Enables automatic fallback to Opus when Sonnet is rate-limited,
ensuring analyst continues functioning across rate limit boundaries.
---
 .github/workflows/ci-failure-analyst-reusable.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci-failure-analyst-reusable.yml b/.github/workflows/ci-failure-analyst-reusable.yml
index e9b71f799..f19ec7768 100644
--- a/.github/workflows/ci-failure-analyst-reusable.yml
+++ b/.github/workflows/ci-failure-analyst-reusable.yml
@@ -149,4 +149,5 @@ jobs:
           claude --print \
             --permission-mode bypassPermissions \
             --allowedTools Bash \
+            --fallback-model opus \
             -p "$PROMPT"

From 36b1237c4a0e89ec2c49df1abeb8f3bbfeb7104f Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Sat, 23 May 2026 18:11:07 -0500
Subject: [PATCH 08/15] test(dev-lead): runtime-build PEM markers in writer
 redaction test (#377)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* test(dev-lead): runtime-build PEM markers in writer redaction test

The previous form embedded the literal `-----BEGIN RSA PRIVATE KEY-----`
and `-----END RSA PRIVATE KEY-----` directly in the stub script body, which
trips gitleaks's `private-key` rule on any PR that re-touches the surrounding
lines. Build the markers from a `dashes="-----"` variable inside a non-quoted
heredoc so the source no longer contains the matching literal, matching the
pattern already used by the post_no_changes PEM tests in
test_fix_reviews.bats.

No behaviour change — `bats tests/dev-lead/unit/test_engine_writer.bats`
still 33/33 green.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* test(dev-lead): loosen negative greps to catch dash-trimmed PEM leaks

Per Copilot review on #377: the previous revision tightened the negative
assertions to `grep -F "$begin"` (full `-----BEGIN/END RSA PRIVATE KEY-----`
form). That misses leaks where the wrapping dashes are altered or stripped
but the key body / phrase still slips through.

Revert the assertions to substring-only (`BEGIN RSA PRIVATE KEY` /
`END RSA PRIVATE KEY`). The runtime-built stub markers stay — they're what
keeps gitleaks happy. The substring on its own does not satisfy gitleaks's
`private-key` rule (`-----BEGIN ... -----` is required), so this stays
green on the secret scan while making the leak detection stricter.

`bats tests/dev-lead/unit/test_engine_writer.bats` — 33/33 pass.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Gemini CLI <gemini-cli@example.com>
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
---
 tests/dev-lead/unit/test_engine_writer.bats | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/tests/dev-lead/unit/test_engine_writer.bats b/tests/dev-lead/unit/test_engine_writer.bats
index 941d0721a..b36c91607 100644
--- a/tests/dev-lead/unit/test_engine_writer.bats
+++ b/tests/dev-lead/unit/test_engine_writer.bats
@@ -576,12 +576,19 @@ STUB
 @test "writer: PEM private key block fully redacted in /tmp persistence" {
   _source_engine "claude"
   export DEV_LEAD_DRY_RUN=false
-  cat > "$STUB_BIN_DIR/claude" << 'STUB'
+  # Build PEM markers at runtime so the literal "-----BEGIN/END RSA PRIVATE
+  # KEY-----" never appears in this source file (avoids tripping gitleaks on
+  # a test fixture). Same pattern as the post_no_changes PEM tests in
+  # test_fix_reviews.bats.
+  local dashes="-----"
+  local begin="${dashes}BEGIN RSA PRIVATE KEY${dashes}"
+  local end="${dashes}END RSA PRIVATE KEY${dashes}"
+  cat > "$STUB_BIN_DIR/claude" << STUB
 #!/usr/bin/env bash
-echo "-----BEGIN RSA PRIVATE KEY-----"
+echo "$begin"
 echo "MIIEowIBAAKCAQEAuVERYSENSITIVEKEYBODYWITHTONSOFCHARSANDMOREDATAHERE"
 echo "ENDOFBODYDATAGOESHEREMOREMOREMOREMOREMOREMORE"
-echo "-----END RSA PRIVATE KEY-----"
+echo "$end"
 echo "after-key"
 STUB
   chmod +x "$STUB_BIN_DIR/claude"
@@ -590,7 +597,11 @@ STUB
   run run_writer "$TEST_PROMPT"
 
   [ "$status" -eq 0 ]
-  # Neither header, body, nor footer of the PEM block may survive
+  # Neither header, body, nor footer of the PEM block may survive. Substring
+  # match (without the surrounding dashes) so a partial leak that trims the
+  # delimiters still fails the assertion. Safe vs. gitleaks: the substring
+  # alone does not satisfy the private-key rule's `-----BEGIN ... -----`
+  # regex.
   ! grep -F "BEGIN RSA PRIVATE KEY" /tmp/dev-lead-session-output.txt
   ! grep -F "uVERYSENSITIVEKEYBODY" /tmp/dev-lead-session-output.txt
   ! grep -F "END RSA PRIVATE KEY" /tmp/dev-lead-session-output.txt

From 1a52bd2ac7f0afe224df649bd89ff9b9ac57e307 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Sat, 23 May 2026 19:19:28 -0500
Subject: [PATCH 09/15] fix(dev-lead): centralize git identity setup; apply to
 fix-ci & fix-reviews (#379)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`dev-lead-fix-issue.sh` defined a `setup_git_identity` helper locally and
called it before `git commit`. The sibling scripts `dev-lead-fix-ci.sh` and
`dev-lead-fix-reviews.sh` did not — so when triggered by `check_run` /
`pull_request_review` / `issue_comment` events, they hit:

    fatal: empty ident name (for <(null)>) not allowed
    ##[error]git commit failed — check git identity configuration on the runner

Observed in bmad-bgreat-suite#203 dev-lead runs (2026-05-23). The earlier
fix in petry-projects/.github-private PR #326 only addressed the issue
intent path; the review and CI intents kept silently failing.

Refactor:
  - Move `setup_git_identity` to a shared lib at `scripts/lib/git-identity.sh`.
  - Source it from all three dev-lead entry-point scripts.
  - Call it before any `git commit` (was previously missing in fix-ci &
    fix-reviews).
  - Drop the inline duplicate in fix-issue.

The helper itself is unchanged in behaviour.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 scripts/dev-lead-fix-ci.sh      |  4 ++++
 scripts/dev-lead-fix-issue.sh   | 13 +------------
 scripts/dev-lead-fix-reviews.sh |  4 ++++
 scripts/lib/git-identity.sh     | 32 ++++++++++++++++++++++++++++++++
 4 files changed, 41 insertions(+), 12 deletions(-)
 create mode 100644 scripts/lib/git-identity.sh

diff --git a/scripts/dev-lead-fix-ci.sh b/scripts/dev-lead-fix-ci.sh
index 9e807a9f0..bd9391785 100755
--- a/scripts/dev-lead-fix-ci.sh
+++ b/scripts/dev-lead-fix-ci.sh
@@ -8,6 +8,7 @@ set -euo pipefail
 # Optional: MAX_FAIL_ATTEMPTS — consecutive engine failures before exhaustion (default: 2)
 
 source "$(dirname "$0")/engine.sh"
+source "$(dirname "$0")/lib/git-identity.sh"
 
 PR_NUMBER="${PR_NUMBER:-}"
 HEAD_SHA="${HEAD_SHA:-}"
@@ -254,6 +255,9 @@ main() {
     fi
 
     if $has_uncommitted; then
+      # GitHub-hosted runners have no default git identity; configure it
+      # before committing or commit fails with "fatal: empty ident name".
+      setup_git_identity
       git add -A
       git commit -m "fix(ci): auto-fix for $(echo "$CHECKS_JSON" | jq -r '.[0].name // "CI failure"') [skip ci-relay]"
     fi
diff --git a/scripts/dev-lead-fix-issue.sh b/scripts/dev-lead-fix-issue.sh
index af0e62c33..02a4d026f 100755
--- a/scripts/dev-lead-fix-issue.sh
+++ b/scripts/dev-lead-fix-issue.sh
@@ -4,6 +4,7 @@ set -euo pipefail
 # Optional: PROMPTS_DIR (defaults to prompts/dev-lead relative to CWD)
 
 source "$(dirname "$0")/engine.sh"
+source "$(dirname "$0")/lib/git-identity.sh"
 
 ISSUE_NUMBER="${ISSUE_NUMBER:-}"
 REPO="${REPO:-${GITHUB_REPOSITORY:-}}"
@@ -17,18 +18,6 @@ check_existing_pr() {
   [ "$existing" -gt 0 ]
 }
 
-setup_git_identity() {
-  local bot="${BOT_USER:-donpetry-bot}"
-  local bot_id
-  bot_id=$(gh api "users/${bot}" --jq '.id' 2>/dev/null || echo "")
-  if [ -n "$bot_id" ]; then
-    git config user.email "${bot_id}+${bot}@users.noreply.github.com"
-  else
-    git config user.email "${bot}@users.noreply.github.com"
-  fi
-  git config user.name "$bot"
-}
-
 main() {
   if [ -z "$ISSUE_NUMBER" ]; then
     echo "::error::ISSUE_NUMBER is required"
diff --git a/scripts/dev-lead-fix-reviews.sh b/scripts/dev-lead-fix-reviews.sh
index e96054226..a3d6f38c8 100755
--- a/scripts/dev-lead-fix-reviews.sh
+++ b/scripts/dev-lead-fix-reviews.sh
@@ -4,6 +4,7 @@ set -euo pipefail
 # Optional: PROMPTS_DIR (defaults to prompts/dev-lead relative to CWD)
 
 source "$(dirname "$0")/engine.sh"
+source "$(dirname "$0")/lib/git-identity.sh"
 
 INTENT_TYPE="${INTENT_TYPE:-fix-reviews}"
 PR_NUMBER="${PR_NUMBER:-}"
@@ -370,6 +371,9 @@ commit_and_push() {
     fi
   else
     if $has_uncommitted; then
+      # GitHub-hosted runners have no default git identity; configure it
+      # before committing or commit fails with "fatal: empty ident name".
+      setup_git_identity
       git add -A
       # Explicit exit on failure: set -e is suspended when commit_and_push is called from
       # an if-statement condition, so git commit failures would be silently swallowed
diff --git a/scripts/lib/git-identity.sh b/scripts/lib/git-identity.sh
new file mode 100644
index 000000000..a8f985711
--- /dev/null
+++ b/scripts/lib/git-identity.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# git-identity.sh — shared helper for dev-lead scripts.
+#
+# All dev-lead entry points (fix-issue, fix-ci, fix-reviews) must call
+# setup_git_identity before any git commit. Without it, the runner has
+# no user.name/user.email and `git commit` aborts with:
+#   fatal: empty ident name (for <(null)>) not allowed
+#
+# Background: prior to centralizing this helper, only dev-lead-fix-issue.sh
+# called the local setup_git_identity defined inline. fix-ci and fix-reviews
+# silently committed under runner-default identity, which on GitHub-hosted
+# runners is unset — causing the commit step to error and the agent run to
+# fail. See bmad-bgreat-suite PR #203 dev-lead failures (2026-05-23) for the
+# observed symptom.
+
+# setup_git_identity — configure git user.name/user.email for the bot user.
+#
+# BOT_USER env var (default: donpetry-bot) determines the identity. The
+# canonical noreply form (<id>+<login>@users.noreply.github.com) is preferred
+# because it links commits to the bot's GitHub profile; fall back to the
+# legacy form when the GitHub user API is unreachable.
+setup_git_identity() {
+  local bot="${BOT_USER:-donpetry-bot}"
+  local bot_id
+  bot_id=$(gh api "users/${bot}" --jq '.id' 2>/dev/null || echo "")
+  if [ -n "$bot_id" ]; then
+    git config user.email "${bot_id}+${bot}@users.noreply.github.com"
+  else
+    git config user.email "${bot}@users.noreply.github.com"
+  fi
+  git config user.name "$bot"
+}

From accde9ea0d5e325ecf40934e203c8aba319f5e24 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Sat, 23 May 2026 19:40:49 -0500
Subject: [PATCH 10/15] fix(dev-lead): expose GEMINI_API_KEY so gemini fallback
 actually works (#381)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When Claude is rate-limited (e.g. monthly cap exhausted), engine.sh falls
back to invoking the gemini CLI. The CLI fails immediately:

  Please set an Auth method in your /home/runner/.gemini/settings.json or
  specify one of the following environment variables before running:
  GEMINI_API_KEY, GOOGLE_GENAI_USE_VERTEXAI, GOOGLE_GENAI_USE_GCA

The workflow already exposes `GOOGLE_API_KEY` (the org secret) but the
gemini CLI specifically looks for `GEMINI_API_KEY`. Alias one to the other
in every env: block that calls a dev-lead script, so the fallback path
actually has credentials when invoked.

Observed during 2026-05-23 compliance blitz: Claude monthly limit hit
(resets May 26), gemini fallback errored with the message above, every
queued dev-lead run failed → no PRs created for ~33 cycled compliance
issues.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/dev-lead-reusable.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/dev-lead-reusable.yml b/.github/workflows/dev-lead-reusable.yml
index 63ed444d2..8e4675441 100644
--- a/.github/workflows/dev-lead-reusable.yml
+++ b/.github/workflows/dev-lead-reusable.yml
@@ -85,6 +85,7 @@ jobs:
           GITHUB_EVENT_NAME: ${{ github.event_name }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
         run: bash .dev-lead/scripts/dev-lead-intent.sh
 
@@ -112,6 +113,7 @@ jobs:
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           GH_PAT: ${{ secrets.GH_PAT }}
         run: bash .dev-lead/scripts/dev-lead-preflight.sh
 
@@ -164,6 +166,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-ci.sh
@@ -179,6 +182,7 @@ jobs:
           TRIGGERING_REVIEWER: ${{ env.INTENT_ACTOR }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh
@@ -193,6 +197,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh
@@ -207,6 +212,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh
@@ -221,6 +227,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh
@@ -234,6 +241,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-issue.sh
@@ -247,6 +255,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh

From 514744f46663326e4044aca85633408d4a766507 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Sat, 23 May 2026 19:46:07 -0500
Subject: [PATCH 11/15] feat(engine): in-Claude model fallback before
 cross-provider switch (#380)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(engine): in-Claude model fallback before cross-provider switch

When a Claude model hits a per-model rate limit, walk an in-engine model
chain (e.g. sonnet → opus) before failing over to gemini/copilot. Each
Claude model has its own TPM/RPM bucket, so swapping models within Claude
often recovers without leaving the provider. Addresses the rate-limit
gap referenced in issues #195 and #206.

- Adds CLAUDE_TRIAGE/DEEP/AUDIT/ACTION/SINGLE_MODEL_CHAIN env vars,
  defaulted in engine.sh's claude branch (sonnet→opus for write/deep,
  opus→sonnet for audit/single, haiku→sonnet for triage; haiku is
  intentionally excluded from the write tier).
- New _claude_chain_invoke helper walks the chain, detects rate-limit on
  each attempt, propagates non-rate-limit failures immediately, and
  returns 2 only when every model in the chain is rate-limited.
- run_writer / run_agentic / run_triage (claude branches only) now route
  through the helper. Gemini and Copilot paths are unchanged.
- Note: in-engine fallback only helps with per-model bucket limits;
  the shared daily subscription cap still requires the proactive guard
  tracked in issue #206.

Tests: 11 new bats cases covering success-on-first, fallback-on-rl,
exhaustion-on-all-rl, non-rl propagation, whitespace tolerance, per-tier
chain selection, env override, and gemini-unchanged. All 191 existing
unit tests still pass (the 2 pre-existing fix-issue rate-limit
failures are unrelated to this change).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(reviews): address review comments [skip ci-relay]

* fix(review-comments): file-based RL detection, mktemp leak, workflow gate

Addresses three gemini-code-assist findings on scripts/engine.sh and one
pre-existing dev-lead.yml gating bug that surfaced as a failing dispatch
job on this PR.

engine.sh:
- Split is_rate_limited into a regex helper (_rate_limit_pattern) plus
  two callers: the existing text-based is_rate_limited and a new
  is_rate_limited_files that runs grep directly on tmp files. Avoids
  loading multi-MB agent output into $(cat ...) shell substitutions.
- Same treatment for parse_reset_time: extracted _emit_reset_iso and
  added parse_reset_time_files.
- _claude_chain_invoke now uses both file-aware variants and cleans up
  partial mktemp output before degrading to passthrough on mktemp
  failure (previous code could leak stdout_tmp if stderr_tmp failed).

dev-lead.yml:
- The enable-auto-merge step's own env block sets INTENT_TYPE, which
  was in scope for the step's `if:` gate and made the gate always true
  whenever the step was reached, regardless of the upstream intent.
  Switched the gate to steps.intent.outputs.intent_type (step outputs
  are not shadowed by step env) and added the INTENT_PR_NUMBER guard
  already present in dev-lead-reusable.yml. This was the cause of the
  "PR_NUMBER is required" failures appearing under "Enable auto-merge
  on bot approval" on bot-approval events.

tests:
- test_fix_issue.bats: rewrote the gh stubs in the two rate-limit
  scenarios to dispatch on the gh subcommand ($1) instead of pattern
  matching against $*. The prompt body contains literal "gh api
  .../issues/..." example text from the prompt template, which made
  the api branch match before the copilot branch and masked the
  rate-limit path. Both tests were pre-existing failures on main.
- test_engine_chain.bats: 5 new cases covering the file-aware
  helpers.

Test plan:
- bats tests/dev-lead/unit/*.bats tests/test_batch_fallback.bats
  tests/test_validate_engines.bats tests/fleet_report.bats → 241/241
- shellcheck scripts/engine.sh → no new findings
- yamllint .github/workflows/dev-lead.yml → no new findings

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(engine): address Codex review findings on chain semantics

Codex flagged five behavioral bugs in the in-Claude chain logic. All addressed
with regression tests (test_engine_chain.bats now at 22/22).

P1 — Throttled-warning text triggered false rate-limit classification:
The chain emitted `::warning::[claude] model X rate-limited (rc=N) ...` to
stderr after each rate-limited attempt. Downstream callers that scan our
stderr/stdout with is_rate_limited (e.g. review-one-pr.sh:346–350 on triage
stderr; run_writer via `2>&1 | tee _tmp` then is_rate_limited_files _tmp)
would then misclassify a SUCCESSFUL chain fallback as a provider rate-limit
and force cross-provider switch (or, worse, remap a non-RL hard failure in a
later attempt to exit 2). Reworded the warning to "throttled (rc=N) — trying
next in chain" — none of the words match _rate_limit_pattern. Added a unit
test asserting the warning string does not match is_rate_limited.

P2 — Empty/whitespace-only chain was returning rate-limited exit code:
`final_rc` was initialized to 2; if `chain_csv` parsed to zero valid models,
the function returned 2, indistinguishable from a true rate-limit. Switched
init to 0, and added an explicit "no valid model entries" guard that returns
1 (config error) when `attempted == 0`.

P2 — run_agentic / run_writer ignored caller's explicit `model` argument:
Previously the chain unconditionally replaced the caller-supplied model for
any recognized tier, breaking the documented `[model]` parameter and any
emergency model-pin use case. Now: if the caller passes the tier's default
ENGINE_*_MODEL, the chain expands as before; if the caller passes any other
model, treat it as an explicit pin (single-element chain). Verified with two
new tests (one per function) plus a regression guard that confirms default
behavior still expands the chain on rate-limit.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
---
 .github/workflows/dev-lead.yml              |  11 +-
 scripts/engine.sh                           | 339 +++++++++++++++++---
 tests/dev-lead/fixtures/engines/stub-claude |  49 ++-
 tests/dev-lead/unit/test_engine_chain.bats  | 325 +++++++++++++++++++
 tests/dev-lead/unit/test_fix_issue.bats     |  47 ++-
 5 files changed, 706 insertions(+), 65 deletions(-)
 create mode 100644 tests/dev-lead/unit/test_engine_chain.bats

diff --git a/.github/workflows/dev-lead.yml b/.github/workflows/dev-lead.yml
index fafa29a3e..37d9a34d5 100644
--- a/.github/workflows/dev-lead.yml
+++ b/.github/workflows/dev-lead.yml
@@ -260,8 +260,17 @@ jobs:
       # ── enable-auto-merge ─────────────────────────────────────────────────
       # Triggered when a trusted bot approves a PR. Skips engine install and
       # pre-flight — just checks reviewDecision and enables auto-merge if APPROVED.
+      #
+      # Gate on the step output of `intent` (not env.INTENT_TYPE): a step's own
+      # env block is in scope when evaluating its `if:`, so the literal
+      # `INTENT_TYPE: enable-auto-merge` we set below would make env.INTENT_TYPE
+      # always equal 'enable-auto-merge' at gate-evaluation time, defeating the
+      # check. Step outputs are not shadowed. Also require a non-empty PR number
+      # to mirror the guard already present in dev-lead-reusable.yml.
       - name: Enable auto-merge on bot approval
-        if: env.INTENT_TYPE == 'enable-auto-merge'
+        if: >-
+          steps.intent.outputs.intent_type == 'enable-auto-merge'
+          && env.INTENT_PR_NUMBER != ''
         env:
           INTENT_TYPE: enable-auto-merge
           PR_NUMBER: ${{ env.INTENT_PR_NUMBER }}
diff --git a/scripts/engine.sh b/scripts/engine.sh
index 75342c2cd..07c9290ea 100644
--- a/scripts/engine.sh
+++ b/scripts/engine.sh
@@ -10,6 +10,17 @@ set -euo pipefail
 #   ENGINE_* env vars for model names and labels
 #   DUCK_ENGINE / DUCK_MODEL for rubber-duck cross-engine review
 #
+# Rate-limit fallback (two layers, applied in order):
+#   1. In-Claude model fallback — per-tier CLAUDE_*_MODEL_CHAIN walks alternate
+#      Claude models (e.g. sonnet → opus) before declaring the provider
+#      rate-limited. Each Claude model has its own TPM/RPM bucket, so swapping
+#      models often recovers without leaving the provider. Does NOT help when
+#      the daily subscription cap is exhausted (cap is shared across all Claude
+#      models — see issue #206 for the proactive headroom guard).
+#   2. Cross-provider fallback — run_writer_with_fallback / review-batch.sh
+#      walk claude → gemini → copilot only after the in-engine chain is fully
+#      rate-limited (exit code 2 from the engine-layer call).
+#
 # Token logging (opt-in):
 #   Set TOKEN_LOG_FILE=<path> to capture per-call JSONL token records.
 #   TOKEN_WORKFLOW — workflow label for records (default: "unknown").
@@ -48,6 +59,17 @@ set_engine_config() {
       # Cross-engine rubber duck: use Copilot when Claude is primary
       DUCK_ENGINE="copilot"
       DUCK_MODEL="o4-mini"
+      # Per-tier in-Claude model fallback chains (comma-separated).
+      # On rate-limit, the chain is walked left-to-right before the cross-provider
+      # fallback (claude → gemini → copilot) kicks in. Per-model TPM/RPM buckets
+      # are independent, so swapping models within Claude often recovers without
+      # leaving the provider. (Daily subscription cap is shared — see issue #206.)
+      # Override per workflow via env to tune cost/capability trade-offs.
+      CLAUDE_TRIAGE_MODEL_CHAIN="${CLAUDE_TRIAGE_MODEL_CHAIN:-claude-haiku-4-5-20251001,claude-sonnet-4-6}"
+      CLAUDE_DEEP_MODEL_CHAIN="${CLAUDE_DEEP_MODEL_CHAIN:-claude-sonnet-4-6,claude-opus-4-7}"
+      CLAUDE_AUDIT_MODEL_CHAIN="${CLAUDE_AUDIT_MODEL_CHAIN:-claude-opus-4-7,claude-sonnet-4-6}"
+      CLAUDE_ACTION_MODEL_CHAIN="${CLAUDE_ACTION_MODEL_CHAIN:-claude-sonnet-4-6,claude-opus-4-7}"
+      CLAUDE_SINGLE_MODEL_CHAIN="${CLAUDE_SINGLE_MODEL_CHAIN:-claude-opus-4-7,claude-sonnet-4-6}"
       ;;
     gemini)
       ENGINE_TRIAGE_MODEL="gemini-2.0-flash"
@@ -60,6 +82,12 @@ set_engine_config() {
       # Cross-engine rubber duck: use Claude for diversity
       DUCK_ENGINE="claude"
       DUCK_MODEL="claude-sonnet-4-6"
+      # No in-engine chain for Gemini — only one production model in use today.
+      CLAUDE_TRIAGE_MODEL_CHAIN=""
+      CLAUDE_DEEP_MODEL_CHAIN=""
+      CLAUDE_AUDIT_MODEL_CHAIN=""
+      CLAUDE_ACTION_MODEL_CHAIN=""
+      CLAUDE_SINGLE_MODEL_CHAIN=""
       ;;
     copilot)
       ENGINE_TRIAGE_MODEL="o4-mini"
@@ -79,6 +107,12 @@ set_engine_config() {
       # Cross-engine rubber duck: use Gemini when Copilot is primary
       DUCK_ENGINE="gemini"
       DUCK_MODEL="gemini-2.0-flash"
+      # No in-engine chain for Copilot — single GitHub Models endpoint.
+      CLAUDE_TRIAGE_MODEL_CHAIN=""
+      CLAUDE_DEEP_MODEL_CHAIN=""
+      CLAUDE_AUDIT_MODEL_CHAIN=""
+      CLAUDE_ACTION_MODEL_CHAIN=""
+      CLAUDE_SINGLE_MODEL_CHAIN=""
       ;;
     *)
       echo "::error::Unknown REVIEW_ENGINE='$REVIEW_ENGINE' (expected: claude, gemini, or copilot)"
@@ -90,6 +124,9 @@ set_engine_config() {
   export ENGINE_ACTION_MODEL ENGINE_SINGLE_MODEL
   export ENGINE_LABEL ENGINE_SINGLE_LABEL
   export DUCK_ENGINE DUCK_MODEL COPILOT_API_MODEL
+  export CLAUDE_TRIAGE_MODEL_CHAIN CLAUDE_DEEP_MODEL_CHAIN
+  export CLAUDE_AUDIT_MODEL_CHAIN CLAUDE_ACTION_MODEL_CHAIN
+  export CLAUDE_SINGLE_MODEL_CHAIN
 }
 
 # Initial config
@@ -103,19 +140,14 @@ _TOKEN_LIB="$(dirname "${BASH_SOURCE[0]}")/lib/token-metrics.sh"
 [ -f "$_TOKEN_LIB" ] && source "$_TOKEN_LIB" 2>/dev/null || true
 unset _TOKEN_LIB
 
-# is_rate_limited <text>
-# Returns 0 (true) if the text looks like a provider usage/rate-limit block —
-# API-level (429), subscription/billing caps (plan limit, out of tokens, HTTP 402),
-# or service overload acting as a hard block (529).
-# review-one-pr.sh exits with code 2 when this fires so the caller can switch engines.
-#
-# Patterns intentionally excluded to prevent false positives:
+# _rate_limit_pattern
+# Single source of truth for the rate-limit regex used by both is_rate_limited
+# (text) and is_rate_limited_files (paths). Patterns intentionally excluded to
+# prevent false positives:
 #   - bare "exhausted" (too broad: matches "retry attempts exhausted", OS errors, etc.)
 #     Retained as "token.*exhaust" / "out of.*token" for the specific token-depletion case.
 #   - CLI syntax errors ("Invalid command format", "unknown flag", etc.) — see is_cli_error.
-is_rate_limited() {
-  local text="$1"
-  # Build pattern in segments for readability — one category per line.
+_rate_limit_pattern() {
   local _pat
   _pat="hit your limit|rate[ -]?limit|resets [0-9]+(am|pm)|reached.*limit" # soft cap / throttle
   _pat="$_pat|usage limit|quota exceeded|too many requests|exceeded.*quota"
@@ -127,7 +159,35 @@ is_rate_limited() {
   _pat="$_pat|plan.*limit|subscription.*limit|billing.*limit|daily.*limit|monthly.*limit|weekly.*limit"
   _pat="$_pat|([^0-9]|^)402([^0-9]|$)"                               # HTTP 402 (payment)
   _pat="$_pat|tokens_limit_reached|body too large|([^0-9]|^)413([^0-9]|$)" # Context / Request size
-  printf '%s\n' "$text" | grep -qiE "($_pat)"
+  printf '%s' "($_pat)"
+}
+
+# is_rate_limited <text>
+# Returns 0 (true) if the text looks like a provider usage/rate-limit block —
+# API-level (429), subscription/billing caps (plan limit, out of tokens, HTTP 402),
+# or service overload acting as a hard block (529).
+# review-one-pr.sh exits with code 2 when this fires so the caller can switch engines.
+#
+# Prefer is_rate_limited_files for large LLM-output captures — it scans files
+# directly with grep instead of materializing the contents in a shell variable,
+# which avoids OOM and shell-substitution length limits on big payloads.
+is_rate_limited() {
+  local text="$1"
+  printf '%s\n' "$text" | grep -qiE "$(_rate_limit_pattern)"
+}
+
+# is_rate_limited_files <file>...
+# File-aware variant of is_rate_limited. Returns 0 if any of the given files
+# matches the rate-limit pattern. Empty paths are skipped silently so callers
+# can pass optional tmp files without pre-checks.
+is_rate_limited_files() {
+  local files=()
+  local f
+  for f in "$@"; do
+    [ -n "$f" ] && [ -f "$f" ] && files+=("$f")
+  done
+  [ "${#files[@]}" -eq 0 ] && return 1
+  grep -qiE "$(_rate_limit_pattern)" "${files[@]}"
 }
 
 # is_cli_error <text>
@@ -189,6 +249,122 @@ copilot_chat() {
     -s "$@" < /dev/null
 }
 
+# _claude_chain_invoke <chain_csv> <prompt_file> <timeout_sec> [extra_args...]
+# Walks a comma-separated list of Claude models, invoking `claude --print --model X`
+# with the given extra arguments. The first model whose run does NOT trigger
+# is_rate_limited() wins: its captured stdout is written to fd1, stderr to fd2,
+# and its exit code is returned. Rate-limited attempts are discarded and the
+# next model is tried. If every model in the chain rate-limits, returns 2 and
+# writes the parsed reset time to /tmp/dev-lead-rate-limit-reset.
+#
+# Empty chain → no-op return 0 (callers should fall back to the single-model
+# legacy path; this is only used when CLAUDE_*_MODEL_CHAIN is set).
+#
+# Sets _CLAUDE_CHAIN_MODEL_USED to the model that produced the final output
+# (success or last attempt) so callers can log which model actually ran.
+_claude_chain_invoke() {
+  local chain_csv="$1" prompt_file="$2" timeout_sec="$3"
+  shift 3
+  local extra_args=("$@")
+
+  if [ -z "$chain_csv" ]; then
+    echo "::error::_claude_chain_invoke called with empty chain" >&2
+    return 1
+  fi
+
+  local saved_ifs="$IFS"
+  IFS=',' read -ra models <<< "$chain_csv"
+  IFS="$saved_ifs"
+
+  local stdout_tmp="" stderr_tmp=""
+  local final_stdout="" final_stderr="" final_model="" final_rc=0
+  local rc=0 attempted=0 all_rl=1
+  local model
+
+  for model in "${models[@]}"; do
+    # Trim whitespace
+    model="${model#"${model%%[![:space:]]*}"}"
+    model="${model%"${model##*[![:space:]]}"}"
+    [ -z "$model" ] && continue
+
+    attempted=$((attempted + 1))
+    stdout_tmp="$(mktemp 2>/dev/null)" || stdout_tmp=""
+    stderr_tmp="$(mktemp 2>/dev/null)" || stderr_tmp=""
+    rc=0
+
+    if [ -n "$stdout_tmp" ] && [ -n "$stderr_tmp" ]; then
+      timeout "$timeout_sec" claude --print --model "$model" "${extra_args[@]}" \
+        < "$prompt_file" > "$stdout_tmp" 2> "$stderr_tmp" || rc=$?
+    else
+      # mktemp failure (one or both) — clean up the partial tmp before degrading
+      # to direct stdout/stderr passthrough so we don't leak a half-allocated fd.
+      [ -n "$stdout_tmp" ] && rm -f "$stdout_tmp"
+      [ -n "$stderr_tmp" ] && rm -f "$stderr_tmp"
+      [ -n "$final_stdout" ] && rm -f "$final_stdout"
+      [ -n "$final_stderr" ] && rm -f "$final_stderr"
+      timeout "$timeout_sec" claude --print --model "$model" "${extra_args[@]}" \
+        < "$prompt_file" || rc=$?
+      _CLAUDE_CHAIN_MODEL_USED="$model"
+      export _CLAUDE_CHAIN_MODEL_USED
+      return "$rc"
+    fi
+
+    # Drop any previous final-attempt buffers (we keep only the latest)
+    [ -n "$final_stdout" ] && rm -f "$final_stdout"
+    [ -n "$final_stderr" ] && rm -f "$final_stderr"
+    final_stdout="$stdout_tmp"
+    final_stderr="$stderr_tmp"
+    final_model="$model"
+
+    if [ "$rc" -eq 0 ]; then
+      final_rc=0
+      all_rl=0
+      break
+    fi
+    # File-based rate-limit detection — avoids loading large agent output into
+    # a shell variable via $(cat ...) (OOM risk on big captures).
+    if ! is_rate_limited_files "$stdout_tmp" "$stderr_tmp"; then
+      # Non-rate-limit failure — propagate immediately, do not try next model.
+      final_rc="$rc"
+      all_rl=0
+      break
+    fi
+    # Rate-limited; record diagnosis and try the next model.
+    # Phrasing intentionally avoids "rate-limit"/"429"/"quota" etc. — those
+    # tokens match is_rate_limited()/_rate_limit_pattern, and downstream
+    # callers (e.g. review-one-pr.sh) that scan our stderr would then
+    # misclassify a successful chain fallback as a provider rate-limit.
+    echo "::warning::[claude] model $model throttled (rc=$rc) — trying next in chain" >&2
+  done
+
+  # Empty/whitespace-only chain → configuration error, not a rate-limit. Returning
+  # 2 here would trigger the cross-provider fallback as if quotas were exhausted.
+  if [ "$attempted" -eq 0 ]; then
+    echo "::error::_claude_chain_invoke: chain '$chain_csv' had no valid model entries" >&2
+    return 1
+  fi
+
+  # If every attempt was rate-limited, parse the last reset time and return 2.
+  if [ "$all_rl" -eq 1 ]; then
+    parse_reset_time_files "$final_stdout" "$final_stderr"
+    final_rc=2
+  fi
+
+  # Emit the final attempt's captured output to the caller.
+  if [ -n "$final_stdout" ]; then
+    cat "$final_stdout"
+    rm -f "$final_stdout"
+  fi
+  if [ -n "$final_stderr" ]; then
+    cat "$final_stderr" >&2
+    rm -f "$final_stderr"
+  fi
+
+  _CLAUDE_CHAIN_MODEL_USED="$final_model"
+  export _CLAUDE_CHAIN_MODEL_USED
+  return "$final_rc"
+}
+
 # _record_engine_tokens <tier> <engine> <model> <prompt_file> [output_file]
 # Writes one token record to TOKEN_LOG_FILE using estimate_tokens_from_file.
 # No-op when TOKEN_LOG_FILE is unset or the token-metrics library is not loaded.
@@ -229,16 +405,15 @@ run_triage() {
     [ -n "$_tok_tmp" ] && : > "$_tok_tmp"
     case "$REVIEW_ENGINE" in
       claude)
+        local _triage_chain="${CLAUDE_TRIAGE_MODEL_CHAIN:-$ENGINE_TRIAGE_MODEL}"
         if [ -n "$_tok_tmp" ]; then
-          timeout "$TRIAGE_TIMEOUT_SEC" claude --print \
-            --model "$ENGINE_TRIAGE_MODEL" \
+          _claude_chain_invoke "$_triage_chain" "$prompt_file" "$TRIAGE_TIMEOUT_SEC" \
             --disallowed-tools "Bash,Read,Write,Edit,Grep,Glob,WebFetch,WebSearch,Task,TodoWrite,NotebookEdit" \
-            < "$prompt_file" | tee "$_tok_tmp" || rc=${PIPESTATUS[0]}
+            | tee "$_tok_tmp" || rc=${PIPESTATUS[0]}
         else
-          timeout "$TRIAGE_TIMEOUT_SEC" claude --print \
-            --model "$ENGINE_TRIAGE_MODEL" \
+          _claude_chain_invoke "$_triage_chain" "$prompt_file" "$TRIAGE_TIMEOUT_SEC" \
             --disallowed-tools "Bash,Read,Write,Edit,Grep,Glob,WebFetch,WebSearch,Task,TodoWrite,NotebookEdit" \
-            < "$prompt_file" || rc=$?
+            || rc=$?
         fi
         ;;
       gemini)
@@ -266,7 +441,8 @@ run_triage() {
         ;;
     esac
     if [ "$rc" -eq 0 ]; then
-      _record_engine_tokens "triage" "$REVIEW_ENGINE" "$ENGINE_TRIAGE_MODEL" "$prompt_file" "$_tok_tmp"
+      local _triage_used="${_CLAUDE_CHAIN_MODEL_USED:-$ENGINE_TRIAGE_MODEL}"
+      _record_engine_tokens "triage" "$REVIEW_ENGINE" "$_triage_used" "$prompt_file" "$_tok_tmp"
       [ -n "$_tok_tmp" ] && rm -f "$_tok_tmp"
       return 0
     fi
@@ -303,18 +479,38 @@ run_agentic() {
   fi
   case "$REVIEW_ENGINE" in
     claude)
+      # Resolve the in-Claude model chain for this tier. The chain is the
+      # cascade tried on rate-limit (e.g. sonnet → opus). If the caller
+      # passed a model that does NOT match the tier's default ENGINE_*_MODEL,
+      # treat it as an explicit pin: honor it as a single-element chain so
+      # callers can still force a specific model when they need to (the
+      # documented `[model]` parameter on this function). The chain is only
+      # applied when the caller used the default model for the tier.
+      local _agentic_chain _tier_default=""
+      case "$tier" in
+        deep)   _tier_default="${ENGINE_DEEP_MODEL:-}"
+                _agentic_chain="${CLAUDE_DEEP_MODEL_CHAIN:-$model}"   ;;
+        audit)  _tier_default="${ENGINE_AUDIT_MODEL:-}"
+                _agentic_chain="${CLAUDE_AUDIT_MODEL_CHAIN:-$model}"  ;;
+        action) _tier_default="${ENGINE_ACTION_MODEL:-}"
+                _agentic_chain="${CLAUDE_ACTION_MODEL_CHAIN:-$model}" ;;
+        single) _tier_default="${ENGINE_SINGLE_MODEL:-}"
+                _agentic_chain="${CLAUDE_SINGLE_MODEL_CHAIN:-$model}" ;;
+        *)      _agentic_chain="$model" ;;
+      esac
+      if [ -n "$_tier_default" ] && [ "$model" != "$_tier_default" ]; then
+        _agentic_chain="$model"
+      fi
       if [ -n "$_tok_tmp" ]; then
-        timeout "$DEEP_TIMEOUT_SEC" claude --print \
-          --model "$model" \
+        _claude_chain_invoke "$_agentic_chain" "$prompt_file" "$DEEP_TIMEOUT_SEC" \
           --permission-mode acceptEdits \
           --allowed-tools "Bash,Read,Grep,Glob" \
-          < "$prompt_file" | tee "$_tok_tmp" || rc=${PIPESTATUS[0]}
+          | tee "$_tok_tmp" || rc=${PIPESTATUS[0]}
       else
-        timeout "$DEEP_TIMEOUT_SEC" claude --print \
-          --model "$model" \
+        _claude_chain_invoke "$_agentic_chain" "$prompt_file" "$DEEP_TIMEOUT_SEC" \
           --permission-mode acceptEdits \
           --allowed-tools "Bash,Read,Grep,Glob" \
-          < "$prompt_file" || rc=$?
+          || rc=$?
       fi
       ;;
     gemini)
@@ -351,7 +547,11 @@ run_agentic() {
       ;;
   esac
   if [ "$rc" -eq 0 ]; then
-    _record_engine_tokens "$tier" "$REVIEW_ENGINE" "$model" "$prompt_file" "$_tok_tmp"
+    local _agentic_used="$model"
+    if [ "$REVIEW_ENGINE" = "claude" ] && [ -n "${_CLAUDE_CHAIN_MODEL_USED:-}" ]; then
+      _agentic_used="$_CLAUDE_CHAIN_MODEL_USED"
+    fi
+    _record_engine_tokens "$tier" "$REVIEW_ENGINE" "$_agentic_used" "$prompt_file" "$_tok_tmp"
   fi
   [ -n "$_tok_tmp" ] && rm -f "$_tok_tmp"
   return "$rc"
@@ -471,12 +671,36 @@ run_duck() {
   return "$rc"
 }
 
+# _emit_reset_iso <hhmm_with_meridiem>
+# Shared helper: converts e.g. "11:20pm" into an ISO-8601 UTC timestamp
+# (writing to /tmp/dev-lead-rate-limit-reset), advancing to tomorrow if the
+# computed time is already in the past for today.
+_emit_reset_iso() {
+  local hhmm="$1"
+  if [ -z "$hhmm" ]; then
+    printf '' > /tmp/dev-lead-rate-limit-reset
+    return 0
+  fi
+  local today iso
+  today=$(date -u +%Y-%m-%d)
+  iso=$(date -u -d "${today} ${hhmm} UTC" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || true)
+  if [ -n "$iso" ] && [ "$(date -u +%s)" -gt "$(date -u -d "$iso" +%s 2>/dev/null || echo 0)" ]; then
+    local tomorrow
+    tomorrow=$(date -u -d "tomorrow" +%Y-%m-%d)
+    iso=$(date -u -d "${tomorrow} ${hhmm} UTC" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || true)
+  fi
+  printf '%s' "${iso:-}" > /tmp/dev-lead-rate-limit-reset
+}
+
 # parse_reset_time <text>
 # Extracts the rate-limit reset time from engine output and writes an ISO-8601
 # UTC timestamp to /tmp/dev-lead-rate-limit-reset for callers to embed in
 # status=rate-limited markers. Pattern: "resets H:MMam/pm (UTC)" or
 # "resets H:MM(am|pm) UTC".
 # Writes empty string if no reset time is found (caller treats as unknown).
+#
+# Prefer parse_reset_time_files for large captures — same OOM rationale as
+# is_rate_limited / is_rate_limited_files above.
 parse_reset_time() {
   local text="$1"
   # Match "resets 11:20pm (UTC)" or "resets 11:20pm UTC"
@@ -489,22 +713,33 @@ parse_reset_time() {
   # Extract H:MM(am|pm) part
   local hhmm
   hhmm=$(printf '%s' "$time_str" | grep -oiE '[0-9]{1,2}:[0-9]{2}(am|pm)$' || true)
-  if [ -z "$hhmm" ]; then
+  _emit_reset_iso "$hhmm"
+}
+
+# parse_reset_time_files <file>...
+# File-aware variant of parse_reset_time. Scans each non-empty existing file
+# for the first "resets H:MMam/pm" match and writes the ISO timestamp via
+# _emit_reset_iso. Uses grep directly on files to avoid loading large LLM
+# outputs into a shell variable.
+parse_reset_time_files() {
+  local files=()
+  local f
+  for f in "$@"; do
+    [ -n "$f" ] && [ -f "$f" ] && files+=("$f")
+  done
+  if [ "${#files[@]}" -eq 0 ]; then
     printf '' > /tmp/dev-lead-rate-limit-reset
     return 0
   fi
-  # Convert to ISO-8601 UTC using today's date (rate limits reset within 24h)
-  local today
-  today=$(date -u +%Y-%m-%d)
-  local iso
-  iso=$(date -u -d "${today} ${hhmm} UTC" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || true)
-  # If reset time is in the past (already reset today), it means tomorrow
-  if [ -n "$iso" ] && [ "$(date -u +%s)" -gt "$(date -u -d "$iso" +%s 2>/dev/null || echo 0)" ]; then
-    local tomorrow
-    tomorrow=$(date -u -d "tomorrow" +%Y-%m-%d)
-    iso=$(date -u -d "${tomorrow} ${hhmm} UTC" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || true)
+  local time_str
+  time_str=$(grep -hoiE 'resets [0-9]{1,2}:[0-9]{2}(am|pm)' "${files[@]}" 2>/dev/null | head -1 || true)
+  if [ -z "$time_str" ]; then
+    printf '' > /tmp/dev-lead-rate-limit-reset
+    return 0
   fi
-  printf '%s' "${iso:-}" > /tmp/dev-lead-rate-limit-reset
+  local hhmm
+  hhmm=$(printf '%s' "$time_str" | grep -oiE '[0-9]{1,2}:[0-9]{2}(am|pm)$' || true)
+  _emit_reset_iso "$hhmm"
 }
 
 # run_writer <prompt_file> [model]
@@ -531,18 +766,23 @@ run_writer() {
 
   case "$REVIEW_ENGINE" in
     claude)
+      # See run_agentic — honor caller's explicit model pin when it differs
+      # from the tier default. Chain only applies when the caller used the
+      # default action model for this engine.
+      local _writer_chain="${CLAUDE_ACTION_MODEL_CHAIN:-$model}"
+      if [ -n "${ENGINE_ACTION_MODEL:-}" ] && [ "$model" != "$ENGINE_ACTION_MODEL" ]; then
+        _writer_chain="$model"
+      fi
       if [ -n "$_tmp" ]; then
-        timeout "$ACTION_TIMEOUT_SEC" claude --print \
-          --model "$model" \
+        _claude_chain_invoke "$_writer_chain" "$prompt_file" "$ACTION_TIMEOUT_SEC" \
           --permission-mode acceptEdits \
           --allowed-tools "Bash,Read,Write,Edit,Grep,Glob,WebFetch" \
-          < "$prompt_file" 2>&1 | tee "$_tmp" || rc=${PIPESTATUS[0]}
+          2>&1 | tee "$_tmp" || rc=${PIPESTATUS[0]}
       else
-        timeout "$ACTION_TIMEOUT_SEC" claude --print \
-          --model "$model" \
+        _claude_chain_invoke "$_writer_chain" "$prompt_file" "$ACTION_TIMEOUT_SEC" \
           --permission-mode acceptEdits \
           --allowed-tools "Bash,Read,Write,Edit,Grep,Glob,WebFetch" \
-          < "$prompt_file" || rc=$?
+          || rc=$?
       fi
       ;;
     gemini)
@@ -570,14 +810,19 @@ run_writer() {
       ;;
   esac
 
-  # Map rate-limit to exit code 2 for caller to detect; parse reset time for marker embedding
-  if [ "$rc" -ne 0 ] && [ -n "$_tmp" ] && is_rate_limited "$(cat "$_tmp")"; then
-    parse_reset_time "$(cat "$_tmp")"
+  # Map rate-limit to exit code 2 for caller to detect; parse reset time for
+  # marker embedding. Use the file-based helpers to avoid OOM on large captures.
+  if [ "$rc" -ne 0 ] && [ -n "$_tmp" ] && is_rate_limited_files "$_tmp"; then
+    parse_reset_time_files "$_tmp"
     [ -n "$_tmp" ] && rm -f "$_tmp"
     return 2
   fi
   if [ "$rc" -eq 0 ]; then
-    _record_engine_tokens "writer" "$REVIEW_ENGINE" "$model" "$prompt_file" "$_tmp"
+    local _writer_used="$model"
+    if [ "$REVIEW_ENGINE" = "claude" ] && [ -n "${_CLAUDE_CHAIN_MODEL_USED:-}" ]; then
+      _writer_used="$_CLAUDE_CHAIN_MODEL_USED"
+    fi
+    _record_engine_tokens "writer" "$REVIEW_ENGINE" "$_writer_used" "$prompt_file" "$_tmp"
   fi
   if [ -n "$_tmp" ]; then
     # Redact once: write secret-scrubbed content to the persisted path, then
diff --git a/tests/dev-lead/fixtures/engines/stub-claude b/tests/dev-lead/fixtures/engines/stub-claude
index fed411c11..017f89edb 100755
--- a/tests/dev-lead/fixtures/engines/stub-claude
+++ b/tests/dev-lead/fixtures/engines/stub-claude
@@ -1,12 +1,53 @@
 #!/usr/bin/env bash
-# Configurable via: STUB_ENGINE_RESPONSE, STUB_ENGINE_EXIT, STUB_ENGINE_DELAY
+# Configurable via:
+#   STUB_ENGINE_RESPONSE, STUB_ENGINE_EXIT, STUB_ENGINE_DELAY
+#   STUB_ENGINE_EXIT_BY_MODEL  — pipe-delimited list of "model=exit_code" pairs.
+#                                If set and a pair matches --model, that exit
+#                                code overrides STUB_ENGINE_EXIT. Models not in
+#                                the map fall back to STUB_ENGINE_EXIT.
+#   STUB_ENGINE_RESPONSE_BY_MODEL  — pipe-delimited "model=response" pairs,
+#                                    same lookup as EXIT_BY_MODEL.
+#   STUB_ENGINE_RECORD_MODELS  — if set to a writable path, every --model value
+#                                seen is appended as a new line for inspection.
+model=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --print|--model|--permission-mode|--allowed-tools|--disallowed-tools|--max-turns)
+    --print)
+      shift ;;
+    --permission-mode|--allowed-tools|--disallowed-tools|--max-turns)
       shift; shift ;;
+    --model)
+      model="$2"; shift; shift ;;
     *) shift ;;
   esac
 done
+
+if [ -n "${STUB_ENGINE_RECORD_MODELS:-}" ]; then
+  printf '%s\n' "$model" >> "$STUB_ENGINE_RECORD_MODELS" 2>/dev/null || true
+fi
+
 sleep "${STUB_ENGINE_DELAY:-0}"
-printf '%s\n' "${STUB_ENGINE_RESPONSE:-stub engine response}"
-exit "${STUB_ENGINE_EXIT:-0}"
+
+# Resolve response: per-model override → default.
+response="${STUB_ENGINE_RESPONSE:-stub engine response}"
+if [ -n "${STUB_ENGINE_RESPONSE_BY_MODEL:-}" ] && [ -n "$model" ]; then
+  IFS='|' read -ra _pairs <<< "$STUB_ENGINE_RESPONSE_BY_MODEL"
+  for _p in "${_pairs[@]}"; do
+    case "$_p" in
+      "$model="*) response="${_p#"$model="}"; break ;;
+    esac
+  done
+fi
+printf '%s\n' "$response"
+
+# Resolve exit code: per-model override → default.
+exit_code="${STUB_ENGINE_EXIT:-0}"
+if [ -n "${STUB_ENGINE_EXIT_BY_MODEL:-}" ] && [ -n "$model" ]; then
+  IFS='|' read -ra _epairs <<< "$STUB_ENGINE_EXIT_BY_MODEL"
+  for _ep in "${_epairs[@]}"; do
+    case "$_ep" in
+      "$model="*) exit_code="${_ep#"$model="}"; break ;;
+    esac
+  done
+fi
+exit "$exit_code"
diff --git a/tests/dev-lead/unit/test_engine_chain.bats b/tests/dev-lead/unit/test_engine_chain.bats
new file mode 100644
index 000000000..578daa1bb
--- /dev/null
+++ b/tests/dev-lead/unit/test_engine_chain.bats
@@ -0,0 +1,325 @@
+#!/usr/bin/env bats
+# Unit tests for engine.sh — in-Claude model-tier fallback chain.
+#
+# Verifies that when the first model in a CLAUDE_*_MODEL_CHAIN hits a
+# rate-limit, the next model is tried before the call gives up with exit 2
+# (which triggers the outer cross-provider fallback).
+
+SCRIPT_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../.." && pwd)"
+ENGINE_SCRIPT="$SCRIPT_DIR/scripts/engine.sh"
+STUB_ENGINES_DIR="$SCRIPT_DIR/tests/dev-lead/fixtures/engines"
+
+setup() {
+  export GITHUB_ENV="$(mktemp)"
+  export GITHUB_OUTPUT="$(mktemp)"
+
+  STUB_BIN_DIR="$(mktemp -d)"
+  cp "$STUB_ENGINES_DIR/stub-claude" "$STUB_BIN_DIR/claude"
+  cp "$STUB_ENGINES_DIR/stub-gemini" "$STUB_BIN_DIR/gemini"
+  chmod +x "$STUB_BIN_DIR/claude" "$STUB_BIN_DIR/gemini"
+  export PATH="$STUB_BIN_DIR:$PATH"
+  export STUB_BIN_DIR
+
+  TEST_PROMPT="$(mktemp)"
+  echo "test prompt content" > "$TEST_PROMPT"
+  export TEST_PROMPT
+
+  MODEL_RECORD="$(mktemp)"
+  export STUB_ENGINE_RECORD_MODELS="$MODEL_RECORD"
+
+  export DEV_LEAD_DRY_RUN="false"
+}
+
+teardown() {
+  rm -f "$GITHUB_ENV" "$GITHUB_OUTPUT" "$TEST_PROMPT" "$MODEL_RECORD"
+  rm -rf "$STUB_BIN_DIR"
+  unset STUB_ENGINE_EXIT_BY_MODEL STUB_ENGINE_RESPONSE_BY_MODEL
+  unset STUB_ENGINE_RECORD_MODELS STUB_ENGINE_EXIT STUB_ENGINE_RESPONSE
+  unset CLAUDE_ACTION_MODEL_CHAIN CLAUDE_DEEP_MODEL_CHAIN
+  unset CLAUDE_TRIAGE_MODEL_CHAIN CLAUDE_AUDIT_MODEL_CHAIN
+}
+
+_source_engine() {
+  local engine="${1:-claude}"
+  export REVIEW_ENGINE="$engine"
+  source "$ENGINE_SCRIPT" 2>/dev/null || true
+}
+
+# ── _claude_chain_invoke unit tests ───────────────────────────────────────────
+
+@test "chain: first model succeeds → no fallback attempted" {
+  _source_engine "claude"
+  export STUB_ENGINE_EXIT=0
+
+  run _claude_chain_invoke "claude-sonnet-4-6,claude-opus-4-7" \
+    "$TEST_PROMPT" 30 --allowed-tools Read
+
+  [ "$status" -eq 0 ]
+  # Only one model invocation recorded
+  [ "$(wc -l < "$MODEL_RECORD")" -eq 1 ]
+  grep -q "claude-sonnet-4-6" "$MODEL_RECORD"
+  ! grep -q "claude-opus-4-7" "$MODEL_RECORD"
+}
+
+@test "chain: first model rate-limited → falls through to second" {
+  _source_engine "claude"
+  # sonnet returns a rate-limit message with non-zero exit; opus succeeds.
+  export STUB_ENGINE_EXIT_BY_MODEL="claude-sonnet-4-6=1|claude-opus-4-7=0"
+  export STUB_ENGINE_RESPONSE_BY_MODEL="claude-sonnet-4-6=You've hit your limit · resets 5pm (UTC)|claude-opus-4-7=opus response"
+
+  run _claude_chain_invoke "claude-sonnet-4-6,claude-opus-4-7" \
+    "$TEST_PROMPT" 30 --allowed-tools Read
+
+  [ "$status" -eq 0 ]
+  # Both models were invoked
+  grep -q "claude-sonnet-4-6" "$MODEL_RECORD"
+  grep -q "claude-opus-4-7" "$MODEL_RECORD"
+  # Final output is the opus response, not the rate-limit text
+  [[ "$output" == *"opus response"* ]]
+  [[ "$output" != *"hit your limit"* ]]
+}
+
+@test "chain: all models rate-limited → returns exit 2" {
+  _source_engine "claude"
+  export STUB_ENGINE_EXIT_BY_MODEL="claude-sonnet-4-6=1|claude-opus-4-7=1"
+  export STUB_ENGINE_RESPONSE_BY_MODEL="claude-sonnet-4-6=429 too many requests|claude-opus-4-7=429 too many requests"
+
+  run _claude_chain_invoke "claude-sonnet-4-6,claude-opus-4-7" \
+    "$TEST_PROMPT" 30 --allowed-tools Read
+
+  [ "$status" -eq 2 ]
+  grep -q "claude-sonnet-4-6" "$MODEL_RECORD"
+  grep -q "claude-opus-4-7" "$MODEL_RECORD"
+}
+
+@test "chain: non-rate-limit failure → propagates immediately without trying next" {
+  _source_engine "claude"
+  # sonnet fails with a non-rate-limit error; chain must NOT advance
+  export STUB_ENGINE_EXIT_BY_MODEL="claude-sonnet-4-6=1|claude-opus-4-7=0"
+  export STUB_ENGINE_RESPONSE_BY_MODEL="claude-sonnet-4-6=unexpected internal error|claude-opus-4-7=should not run"
+
+  run _claude_chain_invoke "claude-sonnet-4-6,claude-opus-4-7" \
+    "$TEST_PROMPT" 30 --allowed-tools Read
+
+  [ "$status" -eq 1 ]
+  grep -q "claude-sonnet-4-6" "$MODEL_RECORD"
+  ! grep -q "claude-opus-4-7" "$MODEL_RECORD"
+}
+
+@test "chain: whitespace and empty entries are tolerated" {
+  _source_engine "claude"
+  export STUB_ENGINE_EXIT_BY_MODEL="claude-sonnet-4-6=1|claude-opus-4-7=0"
+  export STUB_ENGINE_RESPONSE_BY_MODEL="claude-sonnet-4-6=rate limit exceeded|claude-opus-4-7=ok"
+
+  run _claude_chain_invoke "  claude-sonnet-4-6 , , claude-opus-4-7 " \
+    "$TEST_PROMPT" 30 --allowed-tools Read
+
+  [ "$status" -eq 0 ]
+  [ "$(wc -l < "$MODEL_RECORD")" -eq 2 ]
+}
+
+# ── End-to-end: writer uses the chain via CLAUDE_ACTION_MODEL_CHAIN ────────────
+
+@test "writer: sonnet rate-limited → opus tried via CLAUDE_ACTION_MODEL_CHAIN" {
+  _source_engine "claude"
+  # Defaults from set_engine_config: CLAUDE_ACTION_MODEL_CHAIN=sonnet,opus
+  export STUB_ENGINE_EXIT_BY_MODEL="claude-sonnet-4-6=1|claude-opus-4-7=0"
+  export STUB_ENGINE_RESPONSE_BY_MODEL="claude-sonnet-4-6=too many requests (429)|claude-opus-4-7=opus did the work"
+
+  run run_writer "$TEST_PROMPT"
+
+  [ "$status" -eq 0 ]
+  grep -q "claude-sonnet-4-6" "$MODEL_RECORD"
+  grep -q "claude-opus-4-7" "$MODEL_RECORD"
+}
+
+@test "writer: sonnet rate-limited and opus rate-limited → exit 2 (cross-provider fallback signal)" {
+  _source_engine "claude"
+  export STUB_ENGINE_EXIT_BY_MODEL="claude-sonnet-4-6=1|claude-opus-4-7=1"
+  export STUB_ENGINE_RESPONSE_BY_MODEL="claude-sonnet-4-6=quota exceeded|claude-opus-4-7=quota exceeded"
+
+  run run_writer "$TEST_PROMPT"
+
+  [ "$status" -eq 2 ]
+}
+
+@test "writer: custom chain via env override is honored" {
+  _source_engine "claude"
+  # Override the chain so opus is tried FIRST
+  export CLAUDE_ACTION_MODEL_CHAIN="claude-opus-4-7,claude-sonnet-4-6"
+  export STUB_ENGINE_EXIT=0
+
+  run run_writer "$TEST_PROMPT"
+
+  [ "$status" -eq 0 ]
+  head -1 "$MODEL_RECORD" | grep -q "claude-opus-4-7"
+}
+
+# ── End-to-end: agentic respects per-tier chain selection ────────────────────
+
+@test "agentic: deep tier sonnet rate-limited → opus tried (CLAUDE_DEEP_MODEL_CHAIN)" {
+  _source_engine "claude"
+  export STUB_ENGINE_EXIT_BY_MODEL="claude-sonnet-4-6=1|claude-opus-4-7=0"
+  export STUB_ENGINE_RESPONSE_BY_MODEL="claude-sonnet-4-6=service overload|claude-opus-4-7=deep result"
+
+  run run_agentic "$TEST_PROMPT" "claude-sonnet-4-6" "deep"
+
+  [ "$status" -eq 0 ]
+  grep -q "claude-opus-4-7" "$MODEL_RECORD"
+}
+
+@test "agentic: audit tier opus rate-limited → sonnet tried (CLAUDE_AUDIT_MODEL_CHAIN)" {
+  _source_engine "claude"
+  # Default CLAUDE_AUDIT_MODEL_CHAIN = opus,sonnet — opus is first
+  export STUB_ENGINE_EXIT_BY_MODEL="claude-opus-4-7=1|claude-sonnet-4-6=0"
+  export STUB_ENGINE_RESPONSE_BY_MODEL="claude-opus-4-7=usage limit reached|claude-sonnet-4-6=audit ok"
+
+  run run_agentic "$TEST_PROMPT" "claude-opus-4-7" "audit"
+
+  [ "$status" -eq 0 ]
+  grep -q "claude-sonnet-4-6" "$MODEL_RECORD"
+}
+
+# ── Gemini/Copilot unchanged: no chain applied ────────────────────────────────
+
+@test "gemini: no in-engine chain; single-model behavior unchanged" {
+  _source_engine "gemini"
+  export STUB_ENGINE_EXIT=0
+
+  run run_writer "$TEST_PROMPT"
+
+  [ "$status" -eq 0 ]
+  # No claude model recorded (we ran gemini)
+  [ ! -s "$MODEL_RECORD" ]
+}
+
+# ── File-based rate-limit + reset-time helpers ─────────────────────────────
+
+@test "is_rate_limited_files: detects rate-limit text across multiple files" {
+  _source_engine "claude"
+  local f1 f2
+  f1="$(mktemp)"; f2="$(mktemp)"
+  echo "all good" > "$f1"
+  echo "Error 429: too many requests" > "$f2"
+  run is_rate_limited_files "$f1" "$f2"
+  rm -f "$f1" "$f2"
+  [ "$status" -eq 0 ]
+}
+
+@test "is_rate_limited_files: returns 1 when nothing matches" {
+  _source_engine "claude"
+  local f1
+  f1="$(mktemp)"
+  echo "completed normally" > "$f1"
+  run is_rate_limited_files "$f1"
+  rm -f "$f1"
+  [ "$status" -ne 0 ]
+}
+
+@test "is_rate_limited_files: tolerates empty/missing paths" {
+  _source_engine "claude"
+  # No files → no match → exit 1
+  run is_rate_limited_files "" "/nonexistent/path/xyz"
+  [ "$status" -ne 0 ]
+}
+
+@test "parse_reset_time_files: writes ISO timestamp from rate-limit message in file" {
+  _source_engine "claude"
+  local f
+  f="$(mktemp)"
+  echo "You've hit your limit · resets 11:20pm (UTC)" > "$f"
+  rm -f /tmp/dev-lead-rate-limit-reset
+  parse_reset_time_files "$f"
+  rm -f "$f"
+  [ -f /tmp/dev-lead-rate-limit-reset ]
+  # Result should look like an ISO-8601 UTC timestamp ending in Z
+  grep -qE '^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$' /tmp/dev-lead-rate-limit-reset
+}
+
+@test "parse_reset_time_files: writes empty when no reset time present" {
+  _source_engine "claude"
+  local f
+  f="$(mktemp)"
+  echo "ordinary failure with no reset hint" > "$f"
+  parse_reset_time_files "$f"
+  rm -f "$f"
+  [ -f /tmp/dev-lead-rate-limit-reset ]
+  [ ! -s /tmp/dev-lead-rate-limit-reset ]
+}
+
+# ── Codex review findings: warning phrasing + config errors + model pin ─────
+
+@test "chain: throttled warning phrase does NOT match is_rate_limited" {
+  # The warning must not contain any token that _rate_limit_pattern matches —
+  # otherwise downstream callers that scan our stderr (e.g. review-one-pr.sh
+  # triage) would misclassify a successful chain fallback as a rate-limit.
+  _source_engine "claude"
+  run is_rate_limited \
+    "::warning::[claude] model claude-sonnet-4-6 throttled (rc=1) — trying next in chain"
+  [ "$status" -ne 0 ]
+}
+
+@test "chain: writer non-RL failure after RL attempt propagates correctly (not remapped to 2)" {
+  # Model A (sonnet) rate-limited → warning emitted → 2>&1 merges into _tmp.
+  # Model B (opus) fails with a non-rate-limit error. run_writer must return
+  # opus's exit code, not 2, even though _tmp contains the throttled warning.
+  _source_engine "claude"
+  export STUB_ENGINE_EXIT_BY_MODEL="claude-sonnet-4-6=1|claude-opus-4-7=1"
+  export STUB_ENGINE_RESPONSE_BY_MODEL="claude-sonnet-4-6=rate limit exceeded|claude-opus-4-7=segfault in agent runtime"
+
+  run run_writer "$TEST_PROMPT"
+
+  # opus's non-RL failure → exit 1 (NOT 2). If the throttled-warning text
+  # matched is_rate_limited, this would incorrectly return 2.
+  [ "$status" -eq 1 ]
+}
+
+@test "chain: empty/whitespace-only chain → config error (rc=1), not rate-limited (rc=2)" {
+  _source_engine "claude"
+  run _claude_chain_invoke "  ,  ,  " "$TEST_PROMPT" 30 --allowed-tools Read
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"no valid model entries"* ]] || [[ "$stderr" == *"no valid model entries"* ]]
+}
+
+@test "agentic: explicit model arg differing from tier default is honored (no chain expansion)" {
+  _source_engine "claude"
+  # Caller pins haiku for deep tier (overriding default sonnet → opus chain).
+  # Chain expansion would record sonnet+opus; pinning must record ONLY haiku.
+  export STUB_ENGINE_EXIT=0
+
+  run run_agentic "$TEST_PROMPT" "claude-haiku-4-5-20251001" "deep"
+
+  [ "$status" -eq 0 ]
+  # Only one invocation, and it's the pinned model — not sonnet or opus.
+  [ "$(wc -l < "$MODEL_RECORD")" -eq 1 ]
+  grep -q "claude-haiku-4-5-20251001" "$MODEL_RECORD"
+  ! grep -q "claude-sonnet-4-6" "$MODEL_RECORD"
+  ! grep -q "claude-opus-4-7" "$MODEL_RECORD"
+}
+
+@test "writer: explicit model arg differing from action default is honored (no chain expansion)" {
+  _source_engine "claude"
+  export STUB_ENGINE_EXIT=0
+
+  run run_writer "$TEST_PROMPT" "claude-haiku-4-5-20251001"
+
+  [ "$status" -eq 0 ]
+  [ "$(wc -l < "$MODEL_RECORD")" -eq 1 ]
+  grep -q "claude-haiku-4-5-20251001" "$MODEL_RECORD"
+  ! grep -q "claude-sonnet-4-6" "$MODEL_RECORD"
+  ! grep -q "claude-opus-4-7" "$MODEL_RECORD"
+}
+
+@test "agentic: passing tier default model still expands to full chain on rate-limit" {
+  # Regression guard for the pin-check above: when caller passes the tier
+  # default (sonnet), chain expansion still works (sonnet → opus fallback).
+  _source_engine "claude"
+  export STUB_ENGINE_EXIT_BY_MODEL="claude-sonnet-4-6=1|claude-opus-4-7=0"
+  export STUB_ENGINE_RESPONSE_BY_MODEL="claude-sonnet-4-6=429 too many|claude-opus-4-7=ok"
+
+  run run_agentic "$TEST_PROMPT" "claude-sonnet-4-6" "deep"
+
+  [ "$status" -eq 0 ]
+  grep -q "claude-sonnet-4-6" "$MODEL_RECORD"
+  grep -q "claude-opus-4-7" "$MODEL_RECORD"
+}
diff --git a/tests/dev-lead/unit/test_fix_issue.bats b/tests/dev-lead/unit/test_fix_issue.bats
index 7160f72b3..fd2563373 100644
--- a/tests/dev-lead/unit/test_fix_issue.bats
+++ b/tests/dev-lead/unit/test_fix_issue.bats
@@ -171,15 +171,26 @@ esac
 GITEOF
   chmod +x "$STUB_BIN_DIR/git"
 
-  # gh stub: no existing PRs, issue API, comment posts ok, copilot rate-limited
+  # gh stub: no existing PRs, issue API, comment posts ok, copilot rate-limited.
+  # Dispatch on the gh subcommand ($1), NOT a pattern match against the full
+  # args string — the prompt body contains literal "gh api .../issues/..."
+  # examples that would otherwise hit the api branch and mask the copilot path.
   cat > "$STUB_BIN_DIR/gh" <<'GHEOF'
 #!/usr/bin/env bash
-case "$*" in
-  *"pulls?state=open"*) echo "0" ;;
-  *"api"*"repos/"*"issues/"*) echo '{"title":"Test Issue","body":"Test body"}' ;;
-  *"api"*"users/"*) echo '{"id":12345}' ;;
-  *"issue comment"*) exit 0 ;;
-  *"copilot"*) echo "rate limit exceeded"; exit 1 ;;
+cmd="$1"; shift || true
+case "$cmd" in
+  copilot) echo "rate limit exceeded"; exit 1 ;;
+  api)
+    case "$*" in
+      *"pulls?state=open"*) echo "0" ;;
+      *"users/"*) echo '{"id":12345}' ;;
+      *) echo '{"title":"Test Issue","body":"Test body"}' ;;
+    esac ;;
+  issue)
+    case "$*" in
+      comment*) exit 0 ;;
+      *) echo "{}" ;;
+    esac ;;
   *) echo "{}" ;;
 esac
 GHEOF
@@ -221,14 +232,24 @@ esac
 GITEOF
   chmod +x "$STUB_BIN_DIR/git"
 
+  # Dispatch on subcommand ($1) so the prompt body's literal "gh api .../issues/..."
+  # text does not match the api branch and mask the copilot rate-limit path.
   cat > "$STUB_BIN_DIR/gh" <<GHEOF
 #!/usr/bin/env bash
-case "\$*" in
-  *"pulls?state=open"*) echo "0" ;;
-  *"api"*"repos/"*"issues/"*) echo '{"title":"Test","body":"body"}' ;;
-  *"api"*"users/"*) echo '{"id":12345}' ;;
-  *"issue comment"*) touch "${comment_posted_sentinel}"; exit 0 ;;
-  *"copilot"*) echo "rate limit exceeded"; exit 1 ;;
+cmd="\$1"; shift || true
+case "\$cmd" in
+  copilot) echo "rate limit exceeded"; exit 1 ;;
+  api)
+    case "\$*" in
+      *"pulls?state=open"*) echo "0" ;;
+      *"users/"*) echo '{"id":12345}' ;;
+      *) echo '{"title":"Test","body":"body"}' ;;
+    esac ;;
+  issue)
+    case "\$*" in
+      comment*) touch "${comment_posted_sentinel}"; exit 0 ;;
+      *) echo "{}" ;;
+    esac ;;
   *) echo "{}" ;;
 esac
 GHEOF

From 1b17359dbe886c24b985af10c6b2888db020b600 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Wed, 27 May 2026 17:15:32 -0500
Subject: [PATCH 12/15] fix(dev-lead): set git identity before commit in
 commit_and_push (#369)

* fix(dev-lead): set git identity before commit in commit_and_push

actions/checkout only sets local git config for the repo it checks out
(.github-private). When the script operates on a cloned target repo in a
separate workspace, user.name and user.email are unset, causing git commit
to fail on all non-.github-private repos.

Fixes #368

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* style: improve git-identity.sh comments and conditionals

- Add context about GitHub runner's missing git identity
- Use Bash [[ ]] conditional instead of POSIX [ ] for consistency
- Resolves CodeRabbit style suggestions

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
---
 scripts/dev-lead-fix-reviews.sh | 4 ++++
 scripts/lib/git-identity.sh     | 5 ++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/scripts/dev-lead-fix-reviews.sh b/scripts/dev-lead-fix-reviews.sh
index a3d6f38c8..755f1caaf 100755
--- a/scripts/dev-lead-fix-reviews.sh
+++ b/scripts/dev-lead-fix-reviews.sh
@@ -30,6 +30,7 @@ fi
 # Checkout the PR branch for modification (Requirement 1)
 if [ "${DEV_LEAD_DRY_RUN:-false}" = "false" ] && [ -n "${PR_NUMBER:-}" ]; then
   gh pr checkout "$PR_NUMBER" --repo "$REPO"
+  setup_git_identity
 fi
 
 build_and_run() {
@@ -375,6 +376,9 @@ commit_and_push() {
       # before committing or commit fails with "fatal: empty ident name".
       setup_git_identity
       git add -A
+      # Ensure git identity is set — actions/checkout only sets local config for the
+      # repo it checks out (.github-private), not for target repos cloned separately.
+      setup_git_identity
       # Explicit exit on failure: set -e is suspended when commit_and_push is called from
       # an if-statement condition, so git commit failures would be silently swallowed
       # otherwise. Using exit (not return) ensures CI fails visibly instead of posting a
diff --git a/scripts/lib/git-identity.sh b/scripts/lib/git-identity.sh
index a8f985711..b47af5b70 100644
--- a/scripts/lib/git-identity.sh
+++ b/scripts/lib/git-identity.sh
@@ -15,6 +15,9 @@
 
 # setup_git_identity — configure git user.name/user.email for the bot user.
 #
+# GitHub-hosted runners lack git identity by default; this helper ensures
+# commits succeed whether we're committing to the primary repo or secondary checkouts.
+#
 # BOT_USER env var (default: donpetry-bot) determines the identity. The
 # canonical noreply form (<id>+<login>@users.noreply.github.com) is preferred
 # because it links commits to the bot's GitHub profile; fall back to the
@@ -23,7 +26,7 @@ setup_git_identity() {
   local bot="${BOT_USER:-donpetry-bot}"
   local bot_id
   bot_id=$(gh api "users/${bot}" --jq '.id' 2>/dev/null || echo "")
-  if [ -n "$bot_id" ]; then
+  if [[ -n $bot_id ]]; then
     git config user.email "${bot_id}+${bot}@users.noreply.github.com"
   else
     git config user.email "${bot}@users.noreply.github.com"

From 1f4aa75e0c95dfc80d5f0fb9699a72eb8f3f90e9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 28 May 2026 19:42:39 +0000
Subject: [PATCH 13/15] chore(deps): bump anthropics/claude-code-action from
 1.0.128 to 1.0.133 (#406)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.128 to 1.0.133.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/20c8abf165d5f85ab3fc970db9498436377dc9d1...787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.133
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/issue-triage-runner.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/issue-triage-runner.yml b/.github/workflows/issue-triage-runner.yml
index 48ddbb507..8a33f6221 100644
--- a/.github/workflows/issue-triage-runner.yml
+++ b/.github/workflows/issue-triage-runner.yml
@@ -22,7 +22,7 @@ jobs:
           persist-credentials: false
 
       - name: Install claude CLI
-        uses: anthropics/claude-code-action/setup@20c8abf165d5f85ab3fc970db9498436377dc9d1  # main
+        uses: anthropics/claude-code-action/setup@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251  # main
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

From f8a03dfb3fdf075366b6bcc91aa3d5554d72ddd2 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Sat, 30 May 2026 09:13:52 -0500
Subject: [PATCH 14/15] fix(dev-lead): resolve outdated comments in both
 applied and no-changes paths (#411)

* fix: pin GitHub Actions to specific commit SHAs per compliance standard

* fix(dev-lead): resolve outdated comments in both applied and no-changes paths

The resolve_actor_outdated_threads() safety net was only called when the
agent made no code changes. When the agent successfully addressed comments
and pushed changes, outdated review threads were never resolved.

Move resolve_actor_outdated_threads() outside the if/else block for:
- fix-reviews intent
- fix-bot-comment intent
- review-changes intent

This ensures outdated threads from the triggering reviewer are marked as
resolved regardless of whether code changes were pushed or not.

Tests: All 36 unit tests pass, including new tests validating that
resolve_actor_outdated_threads is called in the applied path (dry-run).

Resolves: PR #403 comment resolution issue

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

* fix(ci): correct invalid GitHub Actions cache SHA in daily-pr-review-health.yml

The actions/cache@v5.0.5 SHA was pinned to an invalid commit hash
(0c45773b...) that doesn't exist in the actions/cache repository.
Updated to the correct SHA (27d5ce7f...) used elsewhere in the repo.

This fixes the health check workflow which would fail on scheduled runs.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

---------

Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
---
 .github/workflows/daily-pr-review-health.yml |  2 +-
 .github/workflows/repair-pr-approvals.yml    |  2 +-
 .github/workflows/test.yml                   |  2 +-
 scripts/dev-lead-fix-reviews.sh              |  6 +--
 tests/dev-lead/unit/test_fix_reviews.bats    | 41 ++++++++++++++++++++
 5 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/daily-pr-review-health.yml b/.github/workflows/daily-pr-review-health.yml
index a4505eda3..f3eb4954a 100644
--- a/.github/workflows/daily-pr-review-health.yml
+++ b/.github/workflows/daily-pr-review-health.yml
@@ -42,7 +42,7 @@ jobs:
           node-version: '20'
 
       - name: Cache claude-code CLI
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.npm-global
           key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
diff --git a/.github/workflows/repair-pr-approvals.yml b/.github/workflows/repair-pr-approvals.yml
index 0df095892..d8cfbeecf 100644
--- a/.github/workflows/repair-pr-approvals.yml
+++ b/.github/workflows/repair-pr-approvals.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Repair PR approvals
         env:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bcf7efafa..c20eb4b57 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Run copilot_chat tests
         run: bash tests/test_copilot_chat.sh
diff --git a/scripts/dev-lead-fix-reviews.sh b/scripts/dev-lead-fix-reviews.sh
index 755f1caaf..ed889a799 100755
--- a/scripts/dev-lead-fix-reviews.sh
+++ b/scripts/dev-lead-fix-reviews.sh
@@ -542,9 +542,9 @@ case "$INTENT_TYPE" in
         post_reviews_terminal "fix-reviews" "applied" "Changes committed and pushed."
       else
         notify_coderabbit_resolve
-        resolve_actor_outdated_threads "fix-reviews"
         post_no_changes "fix-reviews"
       fi
+      resolve_actor_outdated_threads "fix-reviews"
       try_enable_auto_merge
     fi
     exit "$rc"
@@ -561,9 +561,9 @@ case "$INTENT_TYPE" in
         post_reviews_terminal "fix-bot-comment" "applied" "Changes committed and pushed."
       else
         notify_coderabbit_resolve
-        resolve_actor_outdated_threads "fix-bot-comment"
         post_no_changes "fix-bot-comment"
       fi
+      resolve_actor_outdated_threads "fix-bot-comment"
       try_enable_auto_merge
     fi
     exit "$rc"
@@ -613,9 +613,9 @@ case "$INTENT_TYPE" in
         post_reviews_terminal "review-changes" "applied" "Changes committed and pushed."
       else
         notify_coderabbit_resolve
-        resolve_actor_outdated_threads "review-changes"
         post_reviews_terminal "review-changes" "no-changes" "No changes were needed for this PR."
       fi
+      resolve_actor_outdated_threads "review-changes"
       try_enable_auto_merge
     fi
     exit "$rc"
diff --git a/tests/dev-lead/unit/test_fix_reviews.bats b/tests/dev-lead/unit/test_fix_reviews.bats
index 6dd30602c..4872d8484 100644
--- a/tests/dev-lead/unit/test_fix_reviews.bats
+++ b/tests/dev-lead/unit/test_fix_reviews.bats
@@ -877,3 +877,44 @@ STUB
 
   [[ "$output" == *"ACTOR not set for intent=fix-reviews"* ]]
 }
+
+# ── resolve_actor_outdated_threads: called in both branches ─────────────────
+
+@test "fix-reviews: resolve_actor_outdated_threads called in applied path (dry-run)" {
+  export INTENT_TYPE="fix-reviews"
+  export DEV_LEAD_DRY_RUN="true"
+  export ACTOR="chatgpt-codex-connector[bot]"
+
+  run bash "$FIX_REVIEWS_SCRIPT"
+
+  [ "$status" -eq 0 ]
+  # In dry-run, resolve_actor_outdated_threads should announce it would resolve
+  [[ "$output" == *"would resolve outdated review threads authored by chatgpt-codex-connector[bot]"* ]]
+}
+
+@test "fix-bot-comment: resolve_actor_outdated_threads called in applied path (dry-run)" {
+  export INTENT_TYPE="fix-bot-comment"
+  export DEV_LEAD_DRY_RUN="true"
+  export ACTOR="sonarqubecloud[bot]"
+  export COMMENT_BODY="SonarQube found issues"
+
+  run bash "$FIX_REVIEWS_SCRIPT"
+
+  [ "$status" -eq 0 ]
+  # Should call resolve_actor_outdated_threads in dry-run mode
+  [[ "$output" == *"would resolve outdated review threads authored by sonarqubecloud[bot]"* ]]
+}
+
+@test "review-changes: resolve_actor_outdated_threads called in applied path (dry-run)" {
+  export INTENT_TYPE="review-changes"
+  export DEV_LEAD_DRY_RUN="true"
+  export ACTOR="donpetry"
+  export PR_TITLE="Test PR"
+  export PR_DESCRIPTION="A test PR"
+
+  run bash "$FIX_REVIEWS_SCRIPT"
+
+  [ "$status" -eq 0 ]
+  # Should call resolve_actor_outdated_threads in dry-run mode
+  [[ "$output" == *"would resolve outdated review threads authored by donpetry"* ]]
+}

From 5cbe5771a221cbb6bc63667785be44400fa23d95 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Sat, 30 May 2026 09:00:19 -0500
Subject: [PATCH 15/15] fix: simplify PR_URL_OVERRIDE logic to resolve
 enumeration bug

## Root Cause

PR #403 was not reviewed despite the workflow running successfully.
Investigation revealed that PR_URL_OVERRIDE was evaluating to an empty
string for pull_request synchronize events, causing the workflow to skip
enumeration entirely (or fall back to list-prs.sh and silently return
no candidates).

The bug occurred because:
1. The original YAML boolean expression used complex && operators within
   || chains: (github.event_name == 'pull_request' && github.event.pull_request.html_url)
2. For some event payloads, github.event.pull_request.html_url was null
3. OR the YAML expression evaluation has precedence/scoping issues with the && operator

This caused PR_URL_OVERRIDE to fall through to the empty string default.

## Solution

Simplify the expression to directly access github.event.pull_request.html_url
without boolean event_name checks. This field is:
- Populated for both 'pull_request' and 'pull_request_review' events
- Null/falsy for other event types, which causes safe fallthrough to the next || clause
- Already successfully used this way in the concurrency group logic

## Result

- pull_request (synchronize, ready_for_review, reopened): PR_URL_OVERRIDE is set directly
- pull_request_review (submitted, dismissed): PR_URL_OVERRIDE is set directly
- check_suite: PR_URL_OVERRIDE is null, falls through to CHECK_SUITE_PRS logic
- All other events: PR_URL_OVERRIDE is null, falls through to list-prs.sh

Fixes #403 not being reviewed.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 .github/workflows/pr-review.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index ee4e41d2d..7c1f51cd5 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -150,8 +150,7 @@ jobs:
         ${{
           inputs.pr_url
           || github.event.client_payload.pr_url
-          || (github.event_name == 'pull_request_review' && github.event.pull_request.html_url)
-          || (github.event_name == 'pull_request' && github.event.pull_request.html_url)
+          || github.event.pull_request.html_url
           || ''
         }}
       # JSON array of PRs associated with a check_suite event. Empty for all