chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-81-gate-followups.yml: Gate followups hub - consolidates keepalive and autofix followups
• agents-73-codex-belt-conveyor.yml: Codex belt conveyor - orchestrates belt worker execution and handles completion
• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• check_deliberate_break.py: Opt-in Gate helper that proves named deliberate-break acceptance tests fail against the base implementation
• runtime_ac_merge_guard.js: Blocks external merge lanes for PRs that require local Orchestrator runtime acceptance checks
• gate_summary.py: Gate summary renderer - generates PR gate check summary
• AGENTS.md: Context file for agents and coding assistants
• CLAUDE.md: Context file for Claude/AI assistants

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: deacb8ee2852a7c22fe229645468776f35921628
Template hash: 536a715df8b0
Sync branch: sync/workflows-536a715df8b0
Consumer repo: stranske/Inv-Man-Intake
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• New Features

  • Added support for documenting intentional test failures through deliberate-break acceptance criteria.

• Documentation

  • Updated guidance documents to emphasize critical evaluation of claims and designs rather than default agreement.

• Chores

  • Enhanced CI/CD gate enforcement with runtime acceptance criteria validation before PR merge.
  • Updated workflow action versions.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

Adds scripts/check_deliberate_break.py for opt-in execution-based deliberate-break acceptance checks, a new runtime_ac_merge_guard.js that gates PR merges on required labels, wires both into the agents-73 and agents-81 workflows, extends gate_summary.py with a test-quality signal, bumps a pinned action in agents-guard.yml, and adds a critical-evaluator stance to AGENTS.md and CLAUDE.md.

Changes

Deliberate-break acceptance check + gate summary

Layer / File(s)	Summary
DeliberateBreakSpec data shape and parsing scripts/check_deliberate_break.py	Defines verdict constants and compiled regexes, the frozen DeliberateBreakSpec dataclass, and markdown parsing helpers that extract a spec from an Acceptance Criteria section via an explicit deliberate-break: marker or a fallback heuristic.
Test execution, tamper detection, and base archiving scripts/check_deliberate_break.py	Implements subprocess runners with timeouts, assertion-tamper detection via git diff, _archive_ref to snapshot the base revision, and verify_spec to run the test on head and base and return a PASS/FAIL_HOLLOW/FAIL_BROKEN verdict.
CLI entrypoint scripts/check_deliberate_break.py	main() parses CLI args, loads the PR body, calls parsing and verification, writes GITHUB_OUTPUT fields (has_marker, verdict), prints JSON, and exits non-zero for non-PASS verdicts.
Gate summary test-quality signal .github/scripts/gate_summary.py	SummaryContext gains test_quality_result; build_context reads TEST_QUALITY_RESULT from env; _append_job_table and _active_lines render a test-quality table row; the final adjustment loop rewrites both docker-smoke and test-quality rows.

Runtime AC merge guard and workflow wiring

Layer / File(s)	Summary
runtime_ac_merge_guard.js module .github/scripts/runtime_ac_merge_guard.js	Defines RUNTIME_AC_REQUIRED_LABELS, normalizeLabelName, runtimeAcRequirement, hasRuntimeAcRequirement, fetchPullRequestLabels, and assertRuntimeAcMergeAllowed, then exports them all. Throws Error with code = 'runtime_ac_merge_blocked' and matched labels when gating is triggered.
Workflow wiring .github/workflows/agents-73-codex-belt-conveyor.yml, .github/workflows/agents-81-gate-followups.yml	Both workflows add runtime_ac_merge_guard.js to sparse checkout, import assertRuntimeAcMergeAllowed, and invoke it with github, core, repo identifiers, prNumber, withRetry, and a source tag before the existing merge execution.

Action pin and AI instruction updates

Layer / File(s)	Summary
agents-guard action pin and AI instructions .github/workflows/agents-guard.yml, AGENTS.md, CLAUDE.md	setup-api-client action reference updated to a new pinned commit in both pull_request_target and pull_request branches; a "Working Stance — Critical Evaluator" section is inserted near the top of both AGENTS.md and CLAUDE.md.

Sequence Diagram(s)

sequenceDiagram
    rect rgba(100, 149, 237, 0.5)
        Note over Workflow,assertRuntimeAcMergeAllowed: Runtime AC Merge Guard
        Workflow->>assertRuntimeAcMergeAllowed: call with github, core, owner, repo, prNumber, withRetry
        assertRuntimeAcMergeAllowed->>GitHub Issues API: listLabelsOnIssue (if labels not provided)
        GitHub Issues API-->>assertRuntimeAcMergeAllowed: label list
        assertRuntimeAcMergeAllowed->>assertRuntimeAcMergeAllowed: runtimeAcRequirement(labels)
        alt requirement not matched
            assertRuntimeAcMergeAllowed-->>Workflow: return (merge allowed)
            Workflow->>GitHub PR API: squash merge
        else requirement matched
            assertRuntimeAcMergeAllowed-->>Workflow: throw Error(runtime_ac_merge_blocked)
            Workflow->>Workflow: merge blocked
        end
    end

Loading

sequenceDiagram
    rect rgba(144, 238, 144, 0.5)
        Note over main,verify_spec: Deliberate-break check
        main->>parse_deliberate_break_spec: PR body markdown
        parse_deliberate_break_spec-->>main: DeliberateBreakSpec or None
        main->>verify_spec: spec, base, head
        verify_spec->>subprocess: run test on HEAD
        subprocess-->>verify_spec: pass/fail/timeout
        verify_spec->>git: diff test file for tamper check
        git-->>verify_spec: removed assertion lines
        verify_spec->>git: archive base ref
        git-->>tmpdir: extracted base snapshot
        verify_spec->>subprocess: run test in tmpdir (base)
        subprocess-->>verify_spec: base result
        verify_spec-->>main: PASS / FAIL_HOLLOW / FAIL_BROKEN
        main->>GITHUB_OUTPUT: write has_marker, verdict
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related issues

• Enforce acceptance criteria with a pre-merge execution-based deliberate-break gate (opt-in) Workflows#2475 — The PR directly implements this issue: it adds scripts/check_deliberate_break.py for execution-based deliberate-break AC enforcement, arms runtime_ac_merge_guard.js and integrates it into both auto-merge workflows, and adds test-quality tracking to the gate summary.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 8.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'chore: sync workflow templates' is vague and does not accurately represent the breadth of changes. The PR synchronizes multiple helper scripts (check_deliberate_break.py, runtime_ac_merge_guard.js, gate_summary.py) and documentation updates alongside workflow templates, making the title overly narrow and incomplete.	Consider a more descriptive title that captures the main changes, such as 'chore: sync workflow templates and gate helpers' or 'chore: add runtime AC checks and deliberate-break validation to workflows'.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-536a715df8b0

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.