feat: implement issue #939 — [Fleet Monitor] petry-projects/.github — .github/workflows/canary-rollout.yml - #940

… .github/workflows/canary-rollout.yml (#940)

* Add org-wide AGENTS.md with cross-cutting development standards

Extracts common patterns from google-app-scripts, broodly, and TalkTerm
into a shared AGENTS.md that individual repos can import. Covers TDD,
pre-commit checks, CI gates, PR reviews, security, and agent guidance.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Address review comments: MD031 fencing and test clarity

- Add blank lines around fenced code block in PR Reviews section (MD031)
- Clarify pre-commit vs iteration test requirements with cross-references
  between Pre-Commit Quality Checks and Agent Operation Guidance

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add multi-agent isolation strategy using git worktrees (#2)

* Add multi-agent isolation strategy using git worktrees

Define org-wide rules for running multiple AI agents concurrently
without conflicts: one worktree per agent, no overlapping file
ownership, tool-specific setup for Claude Code/Copilot/Codex/Cursor,
naming conventions, cleanup, and a pre-launch coordination checklist.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Address review comments: overlap detection, markdown fixes, branch clarity

- Add "Detecting File Overlap" subsection per CodeRabbit suggestion
- Reword origin/HEAD to reference default branch explicitly (Copilot)
- Qualify "name flows into branch" for manual worktrees (Copilot)
- Quote isolation: "worktree" consistently in YAML example (Copilot)
- Add git branch -D fallback for squash/rebase merges (Copilot)
- Fix markdown blank lines and language specifiers (CodeRabbit)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add workflow, environment, and orchestration guidance (#4)

* Add workflow, environment, and orchestration guidance from usage insights

Adds four new sections based on recurring friction patterns observed across
80+ agent sessions: Project Context (assume brownfield), Git Workflow (branch
creation and switching guardrails), Development Environment (dependency checks
before launch), and Branch Protection & SonarCloud (merge retry limits). Also
adds Multi-Repo Orchestration rules to the existing multi-agent section.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update project context in AGENTS.md

Clarified primary languages used in the project.

* Address review comments from Copilot and CodeRabbit

- Use "default branch" terminology consistent with multi-agent section
- Add clean working tree check before branch creation
- Clarify branch switching risk (Git prevents most data loss)
- Gate admin override behind explicit user approval and verification
- Fix worktree/clone wording in multi-repo orchestration

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add stacked PR strategy and Epic-level workflow guidance (#5)

* Add workflow, environment, and orchestration guidance from usage insights

Adds four new sections based on recurring friction patterns observed across
80+ agent sessions: Project Context (assume brownfield), Git Workflow (branch
creation and switching guardrails), Development Environment (dependency checks
before launch), and Branch Protection & SonarCloud (merge retry limits). Also
adds Multi-Repo Orchestration rules to the existing multi-agent section.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update project context in AGENTS.md

Clarified primary languages used in the project.

* Address review comments from Copilot and CodeRabbit

- Use "default branch" terminology consistent with multi-agent section
- Add clean working tree check before branch creation
- Clarify branch switching risk (Git prevents most data loss)
- Gate admin override behind explicit user approval and verification
- Fix worktree/clone wording in multi-repo orchestration

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add stacked PR strategy for Epic-level development

Introduces a comprehensive stacked PR workflow where dependent Epics
form a linear chain (main ← Epic-1 ← Epic-2 ← ...) with bottom-up
merging. Within each Epic, multiple agents work stories in parallel
via worktrees branching from the Epic integration branch. Sprints
within an Epic can also overlap when independent.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Address review comments from Copilot and CodeRabbit

- Broaden Rule #4 exception to include story worktrees branching from
  Epic integration branches, not just child Epic branches
- Add git fetch before merging story branches into Epic branch
- Fix rebase snippet to run from within the story worktree instead of
  using git checkout (which fails when branch is in another worktree)
- Add language identifiers (text/bash) to all unfenced code blocks
- Add blank lines around fenced blocks inside ordered lists (MD031)
- Add mandatory repo-level template for dev commands and env vars

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Simplify and tighten stacked PR documentation

- Clarify Rule #5 re: story PRs targeting Epic branch are internal,
  not standalone feature PRs
- Consolidate Step 3 merge commands into "Story and Sprint Organization"
  section to eliminate duplication
- Replace vague "enough foundation" with explicit dependency criterion
- Add "Keeping Epic Branches in Sync with Main" guidance
- Standardize terminology on "Epic branch" (define "integration branch"
  once on first use)
- Add story worktree cleanup guidance (remove after merging into Epic)
- Add scoping note linking Epic naming convention to general convention
- Remove redundant "When to use" callout (already covered in intro)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Revise multi-agent isolation guidelines in AGENTS.md

Clarified rules for branching and pull requests in multi-agent environments.

* Treat Epic and Feature as interchangeable using Epic/Feature label

Updates all generic/conceptual references throughout the stacked PR
section to use "Epic/Feature" — section headings, rules, workflow
steps, checklists, tables, and internal anchor links. Concrete
example names (Epic 1, epic-1/foundation) remain unchanged as
illustrative instances.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Clarify enforce_admins impact on branch protection

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* feat: add Structured Logging and CQRS standards (#6)

* feat: add Structured Logging and CQRS standards to AGENTS.md

Add two new organization-wide sections with agentic-friendly directives:

- Structured Logging: JSON format, canonical fields, correlation/tracing,
  log levels, what to log/not log, Go (slog) and TypeScript (pino) patterns
- CQRS: when to apply, command/query/event naming conventions, separation
  rules, idempotency, eventual consistency, GraphQL integration, testing

Both sections include numbered "Agentic Directives" blocks with deterministic
rules that AI coding agents can follow without ambiguity.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add E2E testing standards — validate real functionality, not smoke tests

Add comprehensive E2E testing section to org-wide AGENTS.md that enforces
testing real business outcomes through the full stack. Key additions:

- Philosophy: every E2E test must answer "what would break for a real user?"
- Forbidden patterns table: smoke tests disguised as E2E, UI-only assertions,
  mocked backends, status-code-only checks, arbitrary sleeps, happy-path-only
- Required test structure: Arrange → Act → Assert → Verify → Cleanup
- Multi-layer assertions: UI + API response + database state
- GraphQL E2E: mutation→query round trips, auth on every resolver, pagination
- Go backend E2E: testcontainers for real databases, migration testing,
  concurrency/idempotency testing
- Mobile E2E: Detox/Maestro patterns, offline/online, testID selectors
- 12 agentic directives for deterministic agent behavior

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add breaking changes policy — require human approval, tests as contracts

Add "Breaking Changes — Human Approval Required" subsection to Coding
Standards. Technology-agnostic rules covering all layers:

- What constitutes a breaking change (API, database, frontend, backend,
  shared contracts) with concrete examples table
- Tests as the primary detection mechanism — existing tests encode contracts,
  never modify a test to accommodate a breaking change
- Mandatory human approval gate: stop, describe, list impact, propose
  non-breaking alternative, wait for explicit approval
- Non-breaking alternatives in priority order: additive changes, deprecation,
  feature flags, adapters, staged database migrations
- 9 agentic directives (deterministic always/never rules)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: use "functional requirement" terminology, remove tech-specific refs, address review comments

E2E Testing section:
- Replace "workflow" with "functional requirement" throughout
- Remove all technology-specific references (Playwright, Detox, Maestro,
  testcontainers-go, httptest, errgroup, React Native, GraphQL)
- Generalize subsections: "GraphQL E2E" → "API E2E", "Go Backend E2E" →
  "Backend E2E", "Mobile / React Native E2E" → "Frontend E2E (Web and Mobile)"
- Use generic terms: "frontend", "backend", "database", "test-ID attributes"
- Fix code block: add language identifier (pseudocode) for MD031/MD040

Logging section (addressing Copilot + CodeRabbit review comments):
- Add logger initialization guidance for baseline fields (timestamp, service,
  version) — addresses Copilot comment on line 826
- Add correlation_id, causation_id to canonical field names with explicit
  relationship definitions linking to CQRS — addresses comments on lines 832, 962
- Clarify error_message vs err object serialization — addresses line 853
- Narrow sensitive field name matching from substring "key" to explicit
  suffixes (api_key, private_key, etc.) — addresses line 882

CQRS section:
- Add "CQRS is not Event Sourcing" clarification — addresses CodeRabbit nitpick
- Cross-reference correlation_id/causation_id back to Structured Logging

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: document branch protection rules, rulesets, and auto-merge policy (#7)

Add comprehensive documentation of:
- Classic branch protection settings across all repos
- Required status checks per repo
- pr-quality ruleset with required thread resolution
- Dependabot auto-merge behavior and AI reviewer handling
- Claude Code workflow behavior on Dependabot PRs
- SonarCloud check name mismatch guidance

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add weekly compliance audit workflow (#12)

* feat: add weekly compliance audit workflow

Adds automated weekly audit that checks all petry-projects repos
against org standards (CI, Dependabot, settings, labels, rulesets)
and creates/updates/closes issues for each finding.

- Deterministic shell script for reliable, repeatable checks
- Claude Code Action job for standards improvement research
- Issues auto-assigned to Claude for remediation
- Summary notification for org owners
- Idempotent: updates existing issues, closes resolved ones

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review findings in compliance audit

- Add retry error logging to gh_api helper
- Fix pnpm detection when package.json absent
- Fix empty ecosystem array display
- Replace heredoc with direct assignment for issue body
- Add jq error safety in close_resolved_issues
- Increase repo list limit to 500 with empty check
- Use process substitution instead of pipe subshell
- Add concurrency group and timeout to workflow
- Add timeout-minutes to audit job

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address CodeRabbit and Copilot review comments

- Handle single-job workflows with job-level permissions
- Add has_issues to required settings checks
- Soften CODEOWNERS wording (SHOULD not MUST per standards)
- Remove misleading issues:write from audit job permissions
- Rename repo_count to repos_with_findings for clarity

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: do not auto-close previous summary issues

Per feedback, only humans should close summary/notification
issues. Changed Claude prompt to explicitly not close them.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: run compliance audit every Friday at noon UTC

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add full CI pipeline for .github repo (#15)

* feat: add full CI pipeline for .github repo

Adds all 6 required workflows per ci-standards.md:
- ci.yml: markdownlint, yamllint, actionlint, shellcheck, AgentShield
- codeql.yml: actions language analysis
- sonarcloud.yml: code quality scanning
- claude.yml: AI-assisted PR review
- dependabot-automerge.yml: auto-merge eligible PRs
- dependency-audit.yml: vulnerability scanning

Also adds:
- .github/dependabot.yml (github-actions ecosystem)
- .markdownlint-cli2.yaml (config for standards docs)
- sonar-project.properties

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: correct markdownlint SHA, use npx for AgentShield, remove duplicate CodeQL

- Fix markdownlint-cli2-action SHA to v9.0.0 (v20 doesn't exist)
- Use npx ecc-agentshield CLI instead of broken GitHub Action
- Remove codeql.yml — repo already has default CodeQL setup enabled

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: relax markdownlint rules, pin actionlint download

- Disable line-length, duplicate-heading, blanks-around-lists,
  bare-urls rules — existing docs have many violations; fix
  incrementally as separate PRs
- Replace curl|bash with pinned version download for actionlint
  (fixes SonarCloud security hotspot)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: break long line in org-scorecard.yml for yamllint

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: make actionlint fail on errors, guard shellcheck glob

- Remove || true from actionlint on our own workflows (fail properly)
- Keep || true only for template workflows (expected placeholder issues)
- Guard shellcheck glob against missing scripts/ directory

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: ignore shellcheck style hints in actionlint

SC2129 (use grouped redirects) is a style suggestion, not a bug.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add SHA256 checksum verification for curl downloads

Addresses SonarCloud security hotspots by verifying checksums
on all binary downloads:
- actionlint 1.7.7 in ci.yml
- scorecard 5.1.1 in org-scorecard.yml

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enforce MD041, add standards references to all YAML files

- Enable MD041 (first line heading) — all markdown files already comply
- Add header comment to each workflow YAML with purpose and link to
  the org standard definition that governs it
- Add header comment to dependabot.yml

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: resolve all markdown lint violations and enable enforced rules (#24)

* fix: resolve all markdown lint violations, enable enforced rules

Enable previously-disabled markdownlint rules:
- MD013 (line length 200, excluding tables/code blocks)
- MD024 (duplicate headings, siblings only)
- MD032 (blanks around lists)
- MD034 (no bare URLs)

Fix 54 violations across 3 files:
- AGENTS.md: wrap 44 long lines, add 6 blank lines around lists,
  wrap 3 bare URLs in angle brackets
- standards/ci-standards.md: 1 blank line around list
- standards/dependabot-policy.md: 1 blank line around list

Also add .claude/ and node_modules/ to markdownlint ignore list.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: indent list continuations, correct issue trigger security note

- Fix 7 locations in AGENTS.md where wrapped list items had
  unindented continuation lines (breaks Markdown rendering)
- Fix ci-standards.md issue trigger security note: triage role
  can also label, and compliance audit uses its own label

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: extend compliance audit with CI/automation health survey (#13)

Replaces compliance-audit.yml with compliance-audit-and-improvement.yml,
extending the existing weekly compliance audit with runtime health
telemetry and a forward-looking best practices research phase.

Architecture (3 jobs):

  Job 1 — Compliance Audit (unchanged)
    Deterministic shell script checking all repos against org standards.
    Creates/updates/closes compliance issues per finding.

  Job 2 — Health Survey (new)
    Collects runtime telemetry across all org repos:
    CI run failures (7d), security alerts (Dependabot/secret/code scanning),
    PR staleness, branch protection status, workflow inventory.

  Job 3 — Analyze & Create Issues (Claude, rewritten)
    Six-phase analysis combining both datasets:
    1. Load compliance + health data and org standards
    2. Correlate and categorize findings by severity
    3. Research root causes and automation opportunities
    4. Evaluate against industry best practices and emerging capabilities
       (agentic guardrails, supply chain integrity, reliability SLOs, etc.)
       — outputs only standards proposals, not implementation issues
    5. Create issues: repo-specific go in that repo, org-wide in .github,
       every issue gets the claude label for agent pickup
    6. Summary report to step summary

Issue rules:
- Every issue must have the `claude` label
- Repo-specific issues are created in that repo
- Org-wide and standards proposals go in .github
- Deduplicates against existing open issues
- Max 3 standards-improvement + 3 best-practices proposals per run

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add dependabot-rebase workflow standard (#52)

* feat: add dependabot-rebase workflow to unblock auto-merge serialization

When strict status checks require branches to be up-to-date, merging one
Dependabot PR makes others fall behind. Dependabot only rebases on its
weekly schedule, leaving auto-merge stalled. This workflow triggers on
push to main and comments @dependabot rebase on behind PRs, preserving
Dependabot's commit signature for fetch-metadata verification.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use API merge method and add direct merge step

Based on testing in google-app-scripts:
- @dependabot rebase only works from human users, not bots
- API rebase breaks Dependabot ownership; API merge preserves it
- GitHub auto-merge (--auto) fails due to BLOCKED mergeable_state
- Add direct merge step and skip-commit-verification to automerge

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency group to prevent overlapping runs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): Bump anthropics/claude-code-action from 1.0.83 to 1.0.89 (#22)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.89.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/v1.0.83...6e2bd52842c65e914eba5c8badd17560bd26b5de)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.89
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: split Claude workflow into interactive + issue automation jobs (#54)

* feat: split Claude workflow into interactive + issue automation jobs

The single-job Claude workflow created branches for issue-labeled triggers
but never opened PRs — requiring a human to click through. Split into two
jobs so issue-triggered work runs in automation mode with a prompt that
drives the full lifecycle: implement, create PR, self-review, resolve
comments, check CI, and tag the maintainer.

Updates both the workflow and the ci-standards.md standard definition.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CODEOWNERS for maintainer tagging instead of hardcoded username

The claude-issue prompt now reads CODEOWNERS at runtime to determine
who to tag when a PR is ready. This removes the need for per-repo
customization of the prompt.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: require GitHub Discussions on all repos (#53)

* feat: require GitHub Discussions on all repos with standard categories

Elevate Discussions from optional community feature to required org standard.
Add Discussions Configuration section defining required categories (Ideas,
General) and automated ideation workflow integration. Promote has_discussions
audit check from warning to error via REQUIRED_SETTINGS_BOOL.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: require feature-ideation workflow for BMAD Method repos

Add bmad-method ecosystem detection (looks for _bmad/ directory) and
conditionally require feature-ideation.yml workflow. Add CI Standards
section 8 documenting the conditional workflow. Update ecosystem table
in github-settings.md to include bmad-method.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review comments — severity levels and requirement language

- Extend REQUIRED_SETTINGS_BOOL tuple format to include per-entry severity
  (key:expected:severity:detail) instead of hardcoding all as warning
- Set has_discussions and has_issues to error severity; others remain warning
- Change feature-ideation.yml finding from warning to error for BMAD repos
- Change SHOULD to MUST for BMAD ideation workflow requirement in standards

Addresses CodeRabbit and Copilot review comments on PR #53.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: grant claude-issue job tools to create PRs and check CI (#55)

The claude-issue job had no access to `gh` CLI or file editing tools,
so Claude could implement and push but never actually open a PR.
Added --allowedTools for gh pr create/view, gh run view/watch, cat,
Edit, and Write so the automation prompt can execute end-to-end.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools so Claude can
  post review replies, resolve threads, and tag code owners
- Remove Bash(cat:*) since the Read tool already covers file reads

Addresses review feedback from CodeRabbit and Copilot across org PRs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add claude.yml template + checkout audit check (#63)

fix: add claude.yml template + checkout audit check (#33)

Root cause: the recent org-wide PRs added checkout only to the
claude-issue job, leaving the claude job (PR reviews / @claude
mentions) without one. claude-code-action reads CLAUDE.md and
AGENTS.md from the working tree; without checkout it errors on
every PR-triggered run.

Changes:
- standards/workflows/claude.yml: canonical copy-paste template
  with checkout in both jobs, matching the other templates in
  standards/workflows/. Both checkout steps are annotated as
  REQUIRED to prevent silent removal.
- scripts/compliance-audit.sh: new check_claude_workflow_checkout()
  detects any repo whose claude or claude-issue job is missing
  checkout and raises an error finding. Wired into the main audit
  loop so weekly scans surface affected repos automatically.
- standards/ci-standards.md: added a visible callout that both jobs
  need checkout and a pointer to the new template file.

Closes #33

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* fix: auto-create required labels during compliance audit (#67)

fix: auto-create required labels during compliance audit and settings apply

Adds ensure_required_labels() to compliance-audit.sh so all 6 required
labels (security, dependencies, scorecard, bug, enhancement, documentation)
are idempotently created during each audit run, eliminating the
missing-label-* compliance finding category.

Also extends apply-repo-settings.sh with apply_labels() so the remediation
script covers labels alongside repository settings.

Closes #46

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* feat: prevent duplicate agent PRs via in-progress labels and umbrella issues (#76)

* feat: prevent duplicate agent PRs via in-progress labels and umbrella issues

- Add `in-progress` label (#fbca04) to standard label set in github-settings.md
  and apply-repo-settings.sh so all repos have it available for agents to claim issues
- Add `in-progress` to compliance-audit.sh REQUIRED_LABELS and ensure_required_labels()
  so the audit enforces its presence across repos
- Remove `--label "claude"` from individual compliance finding issues; individual issues
  now only get the `compliance-audit` label so multiple agents don't race on them
- Add create_umbrella_issue() to compliance-audit.sh: after each audit run, one umbrella
  issue is created in petry-projects/.github grouping all findings by remediation category.
  Only the umbrella gets the `claude` label, triggering one coordinated agent run instead
  of N competing agents each fixing the same script/file
- Add "Multi-Agent Issue Coordination" section to AGENTS.md with:
  - Claim-before-work protocol (check in-progress label, check for open PRs, claim before
    writing code, release claim on abandonment)
  - File-conflict check (search open PRs for the target file before creating it)
  - Compliance umbrella issue guidance (work from umbrella, fix whole category per PR)

Closes #75

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* fix: declare body separately in create_umbrella_issue to satisfy ShellCheck SC2155

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* feat: reusable Claude Code workflow with workflows write permission (#77)

feat: extract reusable Claude Code workflow with GH_PAT_WORKFLOWS support

Centralizes the Claude Code prompt and config into a reusable workflow
(claude-code-reusable.yml) so repo-level claude.yml files are thin callers.
Adds github_token input using GH_PAT_WORKFLOWS secret to grant workflows
write permission, unblocking Claude from pushing .github/workflows/ changes.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Feature Ideation workflow as standard for BMAD-enabled repos (#81)

* feat: add Feature Ideation workflow as a standard for BMAD-enabled repos

Promotes the BMAD Analyst (Mary) feature ideation workflow piloted in
petry-projects/TalkTerm to an org-wide standard for any repo with BMAD
Method installed.

Adds:
- standards/workflows/feature-ideation.yml — the canonical template,
  generalised from TalkTerm. Customisation surface is a single
  PROJECT_CONTEXT env var that describes the project and its market.
- standards/ci-standards.md §8 rewrite — documents the multi-skill
  ideation pipeline (Market Research → Brainstorming → Party Mode →
  Adversarial), the Opus 4.6 model requirement, the github_token
  permissions gotcha, and the show_full_output secrets hazard.
- standards/agent-standards.md — adds a "BMAD Method Workflows"
  section linking the standard from the agent ecosystem docs.

The four critical gotchas baked into the template were each discovered
empirically during the TalkTerm pilot and would silently regress without
the inline comments. Most importantly: the action's auto-generated
claude[bot] App token lacks discussions:write, so the workflow MUST
pass github_token: ${{ secrets.GITHUB_TOKEN }} explicitly or every
Discussion mutation fails silently while the run reports success.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: split feature-ideation into reusable workflow + thin caller stub

Avoids ~600 lines of prompt duplication across every BMAD-enabled repo and
makes the multi-skill ideation pipeline tunable in one place — changes here
propagate to every adopter on next scheduled run.

- .github/workflows/feature-ideation-reusable.yml — the actual reusable
  workflow (workflow_call). Contains both jobs (signal collection +
  analyst), the full Phase 1-8 prompt, and the four critical gotchas
  (Opus 4.6 model, github_token override, no show_full_output, structural
  Phase 2-5 sequence) hard-coded so they cannot regress.
- standards/workflows/feature-ideation.yml — replaced the 600-line copy
  with a ~60-line caller stub that only defines the schedule, the
  workflow_dispatch inputs, and a single required parameter:
  project_context.
- standards/ci-standards.md §8 — documents the reusable + caller stub
  architecture, the inputs/secrets contract, and updated adoption steps.
  Reference implementation pointer updated to note that TalkTerm is now
  also a thin caller stub.

Inputs exposed by the reusable workflow:
- project_context (required) — project description for Mary
- focus_area (default '') — typically wired to workflow_dispatch
- research_depth (default 'standard')
- model (default 'claude-opus-4-6') — escape hatch only
- timeout_minutes (default 60)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(lint): add shellcheck disable for GraphQL variable false positive

The gh api graphql queries use $repo / $owner / $categoryId as GraphQL
variables (not shell expansions), which must remain in single quotes.
shellcheck SC2016 fires anyway — disable it for this script.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(lint): use quoted heredocs for GraphQL queries to satisfy SC2016

actionlint runs shellcheck on the entire run script as one unit and ignores
inline disable directives. Rewriting the gh api graphql calls to use
cat <<'GRAPHQL' heredocs makes the GraphQL variable references ($repo,
$owner, $categoryId) shell-inert without depending on single-quoted
string literals — eliminating the SC2016 false positive.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: expand prompt variables via Actions expressions, add placeholder guard

CodeRabbit caught a critical latent bug inherited from the original TalkTerm
prompt: shell-style $VAR and $(date) syntax inside the action's `prompt:`
input is NOT expanded — the action receives literal text. This silently
broke variable substitution in every prior run, but mattered most for the
new reusable workflow because PROJECT_CONTEXT is now load-bearing.

Changes:
- Replace $PROJECT_CONTEXT, $FOCUS_AREA, $RESEARCH_DEPTH, and $(date ...)
  with ${{ inputs.* }} and ${{ github.run_started_at }} expressions, which
  ARE evaluated by GitHub before passing the prompt to the action.
- Add a "Validate project_context is customised" pre-step that fails fast
  if an adopter copied the caller stub without replacing the TODO
  placeholder. Prevents wasted Opus runs producing generic Discussions.
- scripts/compliance-audit.sh: detect BMAD repos via `_bmad-output/` as
  well as `_bmad/`, matching the broader detection rule documented in
  ci-standards.md §8 (TalkTerm only has `_bmad-output/`).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(lint): drop github.run_started_at (not in actionlint context schema)

The agent can read scan_date from signals.json instead — added a hint
in the Environment section.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(caller): grant cascading permissions on the calling job

CodeRabbit caught: the caller stub had `permissions: {}` at workflow
level and no permissions block on the calling job. Reusable workflows
inherit permissions from the calling job — without an explicit grant,
the reusable workflow's `discussions: write` declaration would have
nothing to apply, and Discussion mutations would fail with FORBIDDEN
just like the original bug we fixed in TalkTerm.

The reusable workflow's job-level permissions are documentation of
what it needs; the caller is what actually grants them.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_args --model interface; instruct re-query before create

Two more fixes from CodeRabbit review:

1. Model selection via claude_args (the documented v1 interface)
   instead of ANTHROPIC_MODEL env var. claude_args takes precedence over
   the env var per the action's docs, so depending on the env var was
   relying on undocumented behavior. The pinned v1.0.89 happens to honor
   ANTHROPIC_MODEL too (verified in TalkTerm run #3 logs), but the
   documented path is more robust against future action upgrades.

2. Re-query existing Ideas discussions before each create. The signals
   snapshot only fetches the first page of discussions (GraphQL caps
   connections at 100 per page) and only covers the Ideas category, not
   the General fallback. Mary now does a fresh query before each create
   to avoid duplicates in repos with >100 idea threads or where Ideas
   doesn't exist.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: pass GH_PAT_WORKFLOWS to actions/checkout so git push uses workflow-scoped token (#82)

* fix: encode compliance-fix learnings into standards and Claude prompt (#86)

* fix(claude-action): grant administration:write, allow gh api/label create, add standards-conformance prompt rules

* docs(ci-standards): add 'Using Templates' section, SHA lookup procedure, document administration:write

* docs(AGENTS): link standards root and per-topic standards files at top of file

* docs(AGENTS): wrap standards-rule paragraph to satisfy MD013 line-length

* fix(claude-action): yamllint disable for long allowedTools line

* fix(claude-action): remove invalid 'administration' permission scope; document GH_PAT_WORKFLOWS as the actual mechanism

* docs(ci-standards): replace bogus 'administration: write' note with explanation of how admin ops actually work via GH_PAT_WORKFLOWS

* feat(workflows): centralize standards via reusable workflows (#87)

* feat(workflows): centralize standards via reusable workflows

Build org-wide reusable workflows for the four standards that previously
required full inline copies in every downstream repo, and migrate the
matching standards/workflows/*.yml templates to thin caller stubs that
delegate via `uses: petry-projects/.github/.github/workflows/*-reusable.yml@main`.

This extends the pattern already proven by feature-ideation and the
existing claude-code-reusable workflow to the rest of the standard set:

  - dependency-audit-reusable.yml      (zero per-repo config)
  - dependabot-automerge-reusable.yml  (uses secrets: inherit for APP_*)
  - dependabot-rebase-reusable.yml     (uses secrets: inherit for APP_*)
  - agent-shield-reusable.yml          (inputs for severity/required-files/org-ref)

The standards/workflows/claude.yml template was also still the inline
115-line version even though claude-code-reusable.yml has existed for
weeks; migrate it to a stub matching the central repo's own claude.yml.

Each migrated stub now carries a uniform "SOURCE OF TRUTH" header block
telling agents what they may and may not edit. Net effect: ~580 lines
removed from standards/workflows, single point of maintenance for the
five centralizable workflows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(workflows): grant read permissions to dependabot caller stubs

Reusable workflows can be granted no more permissions than the calling
workflow has. The dependabot-automerge and dependabot-rebase stubs had
`permissions: {}` at workflow level with no job-level overrides, which
intersected to zero — the reusable's `gh pr ...` calls would fail
because GITHUB_TOKEN had no scopes.

Fix: declare `contents: read` and `pull-requests: read` on the calling
job, matching the scopes the reusable's job already declares. Caught
by Copilot review on #87.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs(workflows): note permissions stanza in immutable-stub contract

CodeRabbit follow-up on #87: now that the dependabot stubs declare a
job-level permissions block (required for the reusable's gh API calls),
add it to the "MUST NOT change" list so future adopters don't strip it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(workflows): pin reusable callers to @v1 and document tier model (#88)

* feat(workflows): pin all reusable callers to @v1 + add tier model

Pins all stubs in standards/workflows/ and the central repo's own
.github/workflows/claude.yml from @main to @v1. From here on, a bad
commit on main cannot break every downstream repo simultaneously —
breaking changes will publish v2 and downstream repos opt in.

Adds a "Centralization tiers" section to ci-standards.md documenting
the three tiers (stub / per-repo template / free per-repo) so future
agents know whether a workflow file is editable, what they may tune,
and where to send fixes when behavior needs to change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* revert(workflows): keep central claude.yml caller at @main in this PR

claude-code-action validates that .github/workflows/claude.yml in a PR
is byte-identical to main, so updating it within a normal PR is
impossible — the validation fails before the merge can land. Updating
the central repo's own caller will be done as a tiny separate change
after this lands.

Standards stubs remain pinned to @v1 — that is the change that matters
for downstream repos.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(workflows): unify feature-ideation header + correct tier doc

Address Copilot review on #88:

1. feature-ideation.yml: prepend the same SOURCE OF TRUTH header block
   used by the other Tier 1 stubs so the claim "Tier 1 stubs all carry
   an identical header" is actually true.

2. ci-standards.md tier table: drop the inaccurate "~30-line" claim
   (feature-ideation.yml is ~95 lines because of the `project_context`
   input). Replace with "thin caller stub" and call out feature-ideation's
   required input alongside agent-shield's optional ones.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(compliance-audit): detect non-stub centralized workflow copies (#89)

* feat(compliance-audit): detect non-stub centralized workflow copies

Adds a new check to compliance-audit.sh that flags downstream repos
whose Tier 1 workflows are not the canonical thin caller stubs pinned
to @v1. For each centralizable workflow (claude, dependency-audit,
dependabot-{automerge,rebase}, agent-shield, feature-ideation), the
check distinguishes three failure modes for actionable findings:

  1. Inline copy of pre-centralization logic
     → "is an inline copy instead of a thin caller stub"
  2. References the reusable but not pinned to @v1 (e.g. @main, @v0)
     → "references the reusable but is not pinned to @v1"
  3. Some other malformed uses: line
     → "the uses: line does not match the canonical stub"

The central .github repo is exempt because it owns the reusables and
may legitimately reference them by @main during release preparation.

Verified locally with hand-crafted fixtures: stub@v1 → no finding,
stub@main → flagged with the @v1 message, inline copy → flagged with
the inline message, missing file → no finding (handled by
check_required_workflows).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(compliance-audit): use fixed-string grep for reusable path match

CodeRabbit on #89: the second-branch grep used an unescaped
"petry-projects/.github/.github/workflows/${reusable}" pattern,
where BRE dots could in principle match any character. Switch to
\`grep -F\` (fixed-string) to match the path literally. No real-world
false positive observed (workflow paths contain literal dots), but
the hygiene is right.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(compliance-audit): anchor uses: regex + reduce per-repo API calls

Address remaining Copilot review feedback on #89:

1. Anchor the \`uses:\` regex to start-of-line + optional indent
   (\`^[[:space:]]*uses:\`) so a commented \`# uses: ...@v1\` line
   cannot fool the check into marking an inline workflow as compliant.
   Verified with a fixture: a workflow whose only mention of @v1 is in
   a YAML comment is now correctly flagged.

2. List \`.github/workflows/\` once per repo and short-circuit the
   per-file check when the workflow isn't present, instead of probing
   each of the six centralized files individually. Cuts up to 5 wasted
   gh api calls per repo (worst case ~2500 fewer requests across the
   org per audit run).

3. Drop the misleading "missing workflow caught by check_required_workflows"
   comment — only some of the six are required (claude, dependency-audit,
   dependabot-automerge, agent-shield); dependabot-rebase and feature-ideation
   are intentionally optional/conditional. The new directory-listing
   short-circuit handles all of these uniformly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(compliance-audit): detect stale required-check names in rulesets (#96)

* feat(compliance-audit): detect stale required-check names in rulesets

Closes #92.

Adds `check_centralized_check_names` to compliance-audit.sh. For every
non-`.github` repo in the org, fetches the active required-status-check
contexts from BOTH the new ruleset system (gh api .../rules/branches/main)
and classic branch protection (gh api .../branches/main/protection),
then flags two distinct problems:

1. Stale pre-centralization names (`claude`, `claude-issue`,
   `AgentShield`, `Detect ecosystems`) — emits
   `stale-required-check-<old-name>` with the canonical replacement in
   the message.

2. `claude-code / claude` listed as required — emits
   `required-claude-code-check-broken` because that check is
   structurally incompatible with workflow-modifying PRs:
   claude-code-action's GitHub App refuses to mint a token whenever
   the PR diff includes a workflow file, so the check fails on every
   workflow PR and the merge gate becomes a deadlock. This was the
   exact root cause of the markets/bmad-bgreat-suite stuck PRs from
   #87 sweep.

Tested locally with stub fixtures for all four cases (stale claude,
stale AgentShield, broken claude-code/claude, clean ruleset).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(compliance-audit): never recommend renaming claude → claude-code/claude

CodeRabbit on #96: the rename map said `claude` → `claude-code / claude`,
but a separate check correctly flags `claude-code / claude` as a forbidden
required check (it deadlocks workflow PRs). Following the rename
recommendation would have moved a repo from one broken state to another.

Fix: split the logic into two distinct sets.

1. `renames[]` — only contains checks where the new name is safe to
   require (AgentShield, Detect ecosystems). These get a "rename to X"
   message.

2. `forbidden_required[]` — contains every claude variant (legacy and
   post-centralization). Any of them as a required check emits a
   stable per-name finding telling the maintainer to REMOVE it from
   required checks, not rename it.

The Claude review check still runs and surfaces feedback on normal PRs
without being a merge gate; only the required-status-checks pin is
removed.

Each forbidden_required entry maps to a stable check id so findings
don't churn across audit runs from slashes in canonical names.

Verified locally with stub fixtures for all five cases:
  stale `claude`              -> required-claude-check-broken
  stale `claude-issue`        -> required-claude-issue-check-broken
  `claude-code / claude`      -> required-claude-code-check-broken
  stale `AgentShield`         -> stale-required-check-AgentShield (rename)
  clean ruleset               -> 0 findings

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(compliance-audit): suffix-match forbidden Claude required checks

Address remaining CodeRabbit feedback on #96: the previous exact-match
list (`claude-code / claude`, `claude-code / claude-issue`) only caught
the canonical caller-job-id. Repos with a custom caller — e.g. a
ruleset that pins `Claude Code / claude` (workflow display name) or
`review-claude / claude` (custom job id) — would slip past the audit
even though they're equally broken.

Fix: classify each context line by suffix:

  - bare `claude` / `claude-issue`            → match
  - `<anything> / claude`                     → match
  - `<anything> / claude-issue`               → match

Then map to a stable check id (claude vs claude-issue) so findings
don't churn across audit runs from prefix variation. The full
forbidden context string is still echoed in the finding message so
maintainers see exactly what to remove.

Verified locally with stub fixtures for 8 cases:
  bare claude / claude-issue
  canonical claude-code / claude{,-issue}
  custom-prefix Claude Code / claude
  weird-prefix review-claude / claude
  stale AgentShield (rename, unaffected)
  clean ruleset (no findings)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(security): add codeql.yml for SAST scanning (#100)

Adds the required CodeQL Analysis workflow for the .github repository.
Scans the `actions` ecosystem (per standard: repos with .github/workflows/*.yml
must scan `actions`). Uses codeql-action@v4.35.1 pinned to SHA per the
Action Pinning Policy.

Closes #39

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* Replace per-repo CodeQL workflows with GitHub default setup (#103)

* feat(security): replace per-repo CodeQL workflows with GitHub default setup

The org standard previously required every repo to carry a codeql.yml
workflow file. In practice the fleet used a minimal advanced configuration
that added maintenance overhead (SHA pinning, Dependabot bumps, manual
language matrix) without providing anything GitHub's managed default setup
doesn't already cover.

This commit:
- Rewrites ci-standards.md §2 to make default setup the standard
- Deletes .github/workflows/codeql.yml from this repo (added in #100)
- Updates compliance-audit.sh: replaces codeql.yml file existence check
  with code-scanning/default-setup API probe, and flags stray codeql.yml
  files as drift
- Updates apply-rulesets.sh: derives the `CodeQL` required-status-check
  context from the default-setup API instead of workflow file parsing
- Updates apply-repo-settings.sh: adds apply_codeql_default_setup()
  so `--all` runs enable default setup fleet-wide

Repos with a concrete need for advanced setup (custom query packs, path
filters, compiled-language build modes) may opt out by filing a standards
PR documenting the exception.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review comments from Copilot and CodeRabbit on #103

- Replace placeholder #<this-pr> with #103 in compliance-audit.sh
- Fix apply-repo-settings.sh: docstring now matches behavior (warn and
  continue on failure, not hard fail); add CODEQL_ADVANCED_EXCEPTIONS
  list so approved advanced-setup repos are skipped
- Fix apply-rulesets.sh: distinguish API probe errors from explicit
  "not-configured" state — probe failures now exit nonzero instead of
  silently omitting CodeQL from required checks
- Fix ci-standards.md: remove misleading "coverage" wording from Python
  section; fix MD028 blank line inside blockquote (Lint failure)
- Update github-settings.md: CodeQL check name is now `CodeQL` (default
  setup context), not `Analyze` / `Analyze (<language>)`

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: trigger CodeQL default setup scan on PR

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Auto-respond to all PR review comments without @claude mention (#123)

Remove @claude mention filter so Claude auto-responds to all PR reviews

Instead of requiring reviewers to explicitly mention @claude, Claude now
responds to all issue comments and PR review comments from trusted
contributors (OWNER, MEMBER, COLLABORATOR). Added a claude[bot] exclusion
to prevent infinite feedback loops.

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(ci): move Dependabot exclusion to job-level if in claude-code-reusable.yml (#136)

fix(ci): move dependabot exclusion to job-level if in claude-code-reusable.yml

The claude job was reporting as failed on Dependabot PRs because the
dependabot[bot] check was at the step level, causing the job to start
but all steps to be skipped. GitHub marks such jobs as failed rather
than skipped.

Move the exclusion to the job-level if condition so the entire job is
properly skipped. Also remove the now-redundant step-level if, and
update AGENTS.md to describe the corrected behavior.

Closes #135

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* fix(dependabot): use correct ecosystem value github_actions (underscore) (#138)

* fix(dependabot): use correct ecosystem value github_actions (underscore)

fetch-metadata outputs package-ecosystem as "github_actions" with an
underscore, not "github-actions" with a hyphen. The condition was never
matching, so major GitHub Actions updates were still being skipped.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(dependabot): add rebase workflow to enable App-token bypass of CODEOWNERS

GitHub's auto-merge mechanism does not apply ruleset bypass actors at
merge time, so gh pr merge --auto cannot bypass the CODEOWNERS review
requirement even when the App has bypass_mode:always. The rebase
workflow's direct gh api .../merge call uses the App token directly and
does apply the bypass, allowing Dependabot PRs to merge without a human
CODEOWNERS review.

Also updates dependabot-policy.md to document this nuance — the rebase
workflow is now required for repos with CODEOWNERS review requirements,
not only for repos with strict required-status-checks.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(sonar): pin rebase workflow SHA and pass secrets explicitly

Address SonarCloud hotspots S7637 and S7635:
- S7637: pin reusable workflow to full commit SHA instead of @v1 tag
- S7635: pass APP_ID and APP_PRIVATE_KEY explicitly instead of secrets: inherit

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs(dependabot-policy): align config table with conditional rebase workflow

The "Each repository must have" table listed dependabot-rebase.yml as
universally required, contradicting the conditional wording added in the
Applying to a Repository section. Split the table into baseline (always
required) and conditional (when strict checks or CODEOWNERS review
applies) to eliminate the inconsistency.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): Bump anthropics/claude-code-action from 1.0.89 to 1.0.93 (#128)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.89 to 1.0.93.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/6e2bd52842c65e914eba5c8badd17560bd26b5de...b47fd721da662d48c5680e154ad16a73ed74d2e0)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.93
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* feat(claude): trigger Claude to fix CI failures on PRs (#148)

* feat(claude): trigger Claude to fix CI failures on PRs

Add a new `claude-ci-fix` job to the reusable Claude Code workflow that
fires whenever a check run completes with a `failure` conclusion on a
same-repo PR. Claude is prompted to check out the PR branch, diagnose
the failure via logs and annotations, apply a minimal fix, push, and
comment with a summary.

Caller stubs (both the local `.github/workflows/claude.yml` and the
`standards/workflows/claude.yml` template) gain the `check_run:
types: [completed]` trigger needed to activate the new job.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(claude): wrap long prompt lines in yamllint disable/enable

The `prompt:` block in the `claude-ci-fix` job contained a line over
200 characters (329). Wraps it in `# yamllint disable/enable
rule:line-length` comments, matching the pattern already used for
`claude_args` throughout the reusable workflow.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(claude-ci-fix): address Copilot review — null guard, anti-loop, repo placeholder

Three correctness issues raised in PR review:

1. Explicit null guard: add `pull_requests[0] != null` before the repo
   check so the expression is safe when `check_run` fires without any
   associated PR (e.g. pushes to main, external checks).

2. Anti-self-loop: add `!startsWith(..., 'claude-code / claude')` to
   exclude this workflow's own check runs from re-triggering the job,
   preventing an infinite retry cycle if claude-ci-fix itself fails.

3. Concurrency group: replace the bare `${{ pull_requests[0].number }}`
   interpolation with a safe `format()` expression that falls back to
   `run_id` when there is no associated PR.

4. Prompt API path: replace the literal `{owner}/{repo}` placeholder
   with `${{ github.repository }}` so the gh api command Claude is
   instructed to run is immediately executable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(feature-ideation): add curated reputable source list for Mary (#102)

* feat(feature-ideation): per-repo source list + feed checkpoint via last successful run

Source list (addresses all Copilot/CodeRabbit/don-petry review threads):
- Add standards/feature-ideation-sources.md as a starter template; each
  adopting repo copies it to .github/feature-ideation-sources.md and owns
  it independently (no cross-repo checkout).
- Add sources_file input to the reusable workflow (default:
  .github/feature-ideation-sources.md). Phase 2 prompt reads the repo-
  local file; falls back to open web search if absent.
- Fix three arXiv RSS feed URLs from http:// to https://.
- Update propagation wording in ci-standards.md to reflect per-repo
  ownership and v1 tag model.
- Pin caller stub reusable ref from mutable @v1 to commit SHA ae9709f # v1.
- Add actions: read to gather-signals permissions and caller stub template
  (required for gh run list in same repo).

Feed checkpoint (new — avoids re-reviewing same content every week):
- collect-signals.sh: query gh run list --status=success --limit=1 to
  resolve the previous successful run timestamp; fall back to 30 days ago
  on first run or after a long outage.
- compose-signals.sh: add last_successful_run as arg 10 (schema_version
  shifts to arg 11, truncation_warnings to arg 12).
- signals.schema.json: add last_successful_run field; bump schema version
  1.0.0 → 1.1.0 (SCHEMA_VERSION constant updated in lockstep per bats test).
- Test fixtures (populated, empty-repo, truncated): add last_successful_run
  and bump schema_version to 1.1.0.
- Phase 2 prompt: instruct Mary to filter feed entries to those published
  after last_successful_run; bypass checkpoint if >60 days old.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(feature-ideation): validate ISO-8601 format for last_successful_run fallback

The gh stub used in bats tests returns raw fixture JSON without applying
--jq filters, so the captured last_successful_run value was a JSON array
instead of an ISO-8601 timestamp. Add a grep -qE '^[0-9]{4}-...' guard
that falls back to the 30-day default whenever the output is not a valid
date-time string, keeping all existing bats tests green without requiring
every test script to stub the new gh run list call.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(collect-signals): align bats stub order with new gh run list call

The feed-checkpoint `gh run list` call added in the previous commit is
now the *first* gh invocation, so every manually-built stub script in
collect-signals.bats needs a corresponding first entry.

- Prepend run-list-last-success.txt to all 5 manual script builders
  (auth-failure, graphql-errors, bot-only-truncation,
  discussions-truncated, no-ideas-category)
- Fix date fallback format: append T00:00:00Z to date_days_ago output
  so the JSON Schema format:date-time constraint is satisfied

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(compose-signals.bats): update call sites to 12-arg signature

All compose_signals invocations now pass last_successful_run as
the new arg 10, shifting schema_version to 11 and
truncation_warnings to 12. Also adds last_successful_run to the
required-fields assertion in the empty-inputs test.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(review): address CodeRabbit and Copilot review comments

- collect-signals.sh: use WORKFLOW_FILE env var (default: feature-ideation.yml)
  so repos that rename their caller stub can override without a code change;
  capture gh run list stderr in a temp file and log it when the fallback is
  triggered so auth/network failures are distinguishable from first-run
- feature-ideation-reusable.yml: clarify propagation comment — changes reach
  @v1 stubs only after the v1 tag is bumped, not on every next run
- ci-standards.md: align Tier-1 table wording with the @v1 tag-bump model
- standards/workflows/feature-ideation.yml: reword sources_file comment to
  make clear users must uncomment AND change the path for non-default locations;
  show a non-default example path to reduce ambiguity

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test: add self-test feature-ideation stub for dry-run validation

* fix: trailing newline + clean up stub

* fix: pin reusable workflow ref to commit SHA (SonarCloud)

* chore: remove temporary test stub (not for main)

* fix(reusable): guard against empty sources_file in Phase 2 prompt

If a caller passes sources_file: '' the prompt previously rendered a
bare 'Read: ' instruction. Now uses a GitHub Actions expression to
branch: non-empty value emits the Read instruction; empty/omitted
emits a clear fallback note directing Mary to open web search and log
a warning in the step summary.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(lint): move sources_file expression to env var to respect line-length

The format() expression was 241 chars, over the 200-char yamllint limit.
Moving it to SOURCES_INSTRUCTION in the step env block (where the
expression is still valid) and referencing $SOURCES_INSTRUCTION in the
prompt string brings all lines under 200 chars.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(lint): resolve YAML syntax error in sources_file prompt guard

The format() expression with backtick literals inside a GHA expression
caused a YAML mapping-value syntax error at parse time. Replaced with
a plain env var SOURCES_FILE_PATH + shell-style conditional in the prompt
text — no GHA expressions inside the multiline prompt string, fully
YAML-safe and under the 200-char line limit.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(dotgithub): add feature-ideation caller stub for .github self-test

Adds the Feature Research & Ideation workflow to the .github repo itself,
making it a BMAD-enabled consumer of its own reusable pipeline.

Key configuration:
- project_context: org-level DevX/tooling repo (CI standards, reusable
  workflows, BMAD framework, agent security)
- sources_file: 'standards/feature-ideation-sources.md' — the template
  lives right here, so no copy needed
- dry_run defaults to false (use workflow_dispatch input to enable)
- actions: read permission for feed checkpoint

Note: uses: SHA points to current v1. After this PR merges, bump the
v1 tag to the new merge commit and update the SHA here.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* fix: correct reusable workflow path syntax (remove duplicate .github) (#154)

* fix: correct reusable workflow path in claude.yml and agent-shield.yml

The workflow references were using an incorrect path with duplicate
'.github/' segment: 'petry-projects/.github/.github/workflows/...'

This caused failures in all child repos trying to call these reusables
because GitHub Actions couldn't find the workflow at that path.

Corrected to: 'petry-projects/.github/workflows/...'

This fix will resolve failing compliance PRs across markets, ContentTwin,
TalkTerm, and bmad-bgreat-suite that pinned these workflows.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

* feat: add compliance audit check for reusable workflow path syntax

Adds validation to catch the duplicate .github/ segment issue in reusable
workflow references:
  - BROKEN: uses: petry-projects/.github/.github/workflows/...
  - CORRECT: uses: petry-projects/.github/workflows/...

This …