chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• reference_packs.py: Validates and resolves reference pack configuration for shared runner prompt assembly
• orchestrator_skill.py: Validates and resolves exported Orchestrator skill context for remote Codex lanes
• runner_lib/ (1 files): Shared runner prompt assembly, output parsing, and dispatch debounce helpers
• langchain_client.py: LangChain client builder - multi-provider client with slot-based fallback and configuration
• llm_registry.py: LLM model registry helper - shared slot/model selection and blocked-model enforcement

Files Skipped

• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: 0b04de717dcadc23aea9e2eca0b8679d27e90666
Template hash: 76689bc445fd
Sync branch: sync/workflows-76689bc445fd
Consumer repo: stranske/Template
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

Release Notes

• New Features

  • Introduced configurable LLM model registry and slot configuration system for managing model selections across providers.

• Bug Fixes

  • Enforced stricter repository format validation requiring owner/name format.
  • Model blocking rules now prevent client construction with blocked models.

• Chores

  • Updated GitHub Action versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 16b4f5e0-6886-4eb6-b814-5faee8cbcc18

📥 Commits

Reviewing files that changed from the base of the PR and between 9cdbef3 and 0072aa1.

📒 Files selected for processing (6)

• .github/workflows/agents-guard.yml
• scripts/orchestrator_skill.py
• scripts/reference_packs.py
• scripts/runner_lib/core.py
• tools/langchain_client.py
• tools/llm_registry.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (5)

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.{yml,yaml}: Ensure coverage threshold settings in GitHub Actions workflow files for coverage-min match the [tool.coverage.report] fail_under setting in pyproject.toml, as the lower value will be the effective threshold
For startup_failure in GitHub Actions workflows with zero jobs, check for invalid YAML syntax, top-level permissions: blocks in workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (AGENTS.md)

Agent workflows (agents-*.yml), autofix.yml, synced prompts in .github/codex/, and synced scripts/docs should be fixed in stranske/Workflows, not in the consumer repository

Files:

• .github/workflows/agents-guard.yml

**/*.py

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

In Manager-Database repository using Prefect 2.x, import schedules from prefect.client.schemas.schedules rather than other locations

Files:

• scripts/reference_packs.py
• scripts/orchestrator_skill.py
• scripts/runner_lib/core.py
• tools/llm_registry.py
• tools/langchain_client.py

🔀 Multi-repo context stranske/Workflows

Linked repositories findings

Based on my exploration of the stranske/Workflows repository, here are the critical cross-repository impacts from this sync PR:

stranske/Workflows (source repository)

Critical: Interdependent module sync requirement

[::stranske/Workflows::] tests/workflows/test_sync_manifest_delivery.py:23-26 enforces that tools/llm_registry.py and tools/langchain_client.py must always be synced together to consumer repositories:

• Test: test_langchain_client_registry_dependency_stays_copy_synced() asserts both are in copy-synced manifest sections
• Reason: tools/langchain_client.py imports from tools.llm_registry (lines: from tools import llm_registry as _llm_registry and from tools.llm_registry import (PROVIDER_ANTHROPIC, PROVIDER_GITHUB, ...))
• Impact on consumers: If only one module is synced without the other, all LangChain client construction will fail with ImportError

Breaking change: Repository format validation tightening

[::stranske/Workflows::] Both scripts/orchestrator_skill.py and scripts/reference_packs.py now enforce stricter owner/name repository format validation (identical logic in both):

• Old behavior: Rejected only strings with leading/trailing slashes
• New behavior: Splits on / and requires exactly 2 parts with no empty strings
• Lines in both files: parts = repo.split("/") then if len(parts) != 2 or not all(parts): raise ConfigError("repo must use owner/name format")
• Tests validate rejection of nested paths like trend/research/extra via test_parse_reference_packs_rejects_nested_repo_names() and test_parse_rejects_nested_repo_names()
• Impact on consumers: Any reference pack or orchestrator skill config with 3+ path segments (e.g., org/repo/subdir) will now raise ConfigError instead of being accepted

LLM client blocking behavior change

[::stranske/Workflows::] tools/langchain_client.py now delegates model blocking checks to tools.llm_registry._is_model_blocked(provider, model):

• build_chat_client() now returns None if the (provider, model) pair is blocked (previously might have been constructed)
• build_chat_clients() skips blocked model candidates instead of attempting construction
• Warning logged: "Refusing blocked LLM model: %s/%s"
• Impact on consumers: Any code relying on building clients with blocked models will now silently get None or empty list instead of a client

Shared constants centralization

[::stranske/Workflows::] Provider identifiers and environment variable names moved from langchain_client.py to llm_registry.py:

• Constants now imported: PROVIDER_OPENAI, PROVIDER_ANTHROPIC, PROVIDER_GITHUB
• Environment variables now imported: ENV_SLOT_CONFIG, ENV_MODEL_REGISTRY_CONFIG
• Default paths now imported: DEFAULT_SLOT_CONFIG_PATH, DEFAULT_MODEL_REGISTRY_CONFIG_PATH
• Impact on consumers: Consumer code directly importing these from langchain_client (if any) should still work since they are re-exported, but source is now delegated to llm_registry

Orchestrator skill materialization improvements

[::stranske/Workflows::] scripts/runner_lib/core.py improvements:

• Now imports contextlib and uses contextlib.suppress(FileNotFoundError) when removing stale checkout directories (safer cleanup that won't fail if directory is already missing)
• Prompt assembly now supports dual modes: either materialize the skill or use path from ORCHESTRATOR_SKILL_SUMMARY_PATH environment variable
• "Orchestrator Skill Context" section conditionally included only when the summary file exists and is a file (not just when materialize_orchestrator_skill flag is set)
• Impact on consumers: Environments using ORCHESTRATOR_SKILL_SUMMARY_PATH will now work properly; materialization cleanup will be more robust

🔇 Additional comments (23)

.github/workflows/agents-guard.yml (1)

114-114: LGTM!

Also applies to: 183-183

scripts/orchestrator_skill.py (1)

83-86: LGTM!

scripts/reference_packs.py (1)

86-87: LGTM!

scripts/runner_lib/core.py (5)

8-8: LGTM!

---

370-376: LGTM!

---

419-431: LGTM!

---

461-465: LGTM!

---

955-955: LGTM!

tools/llm_registry.py (8)

1-24: LGTM!

---

26-51: LGTM!

---

108-146: LGTM!

---

149-192: LGTM!

---

195-233: LGTM!

---

236-263: LGTM!

---

266-276: LGTM!

---

92-96: No action required. The project declares requires-python = ">=3.12" in pyproject.toml, and the union syntax in isinstance() is supported in Python 3.10+. The code is compatible with all supported versions.

			> Likely an incorrect or invalid review comment.

tools/langchain_client.py (7)

15-45: LGTM!

---

74-75: LGTM!

---

92-138: LGTM!

---

229-231: LGTM!

---

281-287: LGTM!

---

363-371: LGTM!

---

489-491: LGTM!

---

📝 Walkthrough

Walkthrough

Introduces tools/llm_registry.py as a new shared module for LLM slot/model-registry resolution and blocked-model enforcement, then refactors tools/langchain_client.py to delegate to it. Tightens owner/name repo validation in two scripts, updates orchestrator-skill prompt assembly to use a configurable summary path, and bumps a GitHub Actions SHA pin.

Changes

LLM Registry Extraction and Blocked-Model Enforcement

Layer / File(s)	Summary
Registry types, constants, and lookup helpers tools/llm_registry.py	Defines provider/env/path constants, ModelRegistryEntry and SlotDefinition dataclasses, normalize_provider, load_model_registry, registry_entry_for, is_model_blocked, and select_model_for_tier.
Slot config loading, env overrides, and resolve_slots tools/llm_registry.py	Adds configured_model_for_provider, default_slots, load_slot_config, apply_slot_env_overrides, and resolve_slots — the full pipeline from config file or built-in defaults through per-slot environment overrides, with blocked-model skipping throughout.
langchain_client delegation and blocked-model guards tools/langchain_client.py	Replaces local provider constants, path defaults, _normalize_provider, and registry/slot helpers with imports and thin wrappers from llm_registry; adds blocked-model guards in build_chat_client (resolved model and model override) and build_chat_clients (explicit-provider path and per-slot iteration).

Orchestrator Skill Context and Repo Validation

Layer / File(s)	Summary
Strict owner/name validation scripts/orchestrator_skill.py, scripts/reference_packs.py	Both scripts update _validate_repo to split on / and require exactly two non-empty parts, replacing looser checks that accepted multi-segment or empty-component values.
Orchestrator skill materialization and dynamic summary path scripts/runner_lib/core.py	Adds contextlib import, suppresses FileNotFoundError on checkout cleanup in materialize_orchestrator_skill, replaces the hard-coded .reference/ORCHESTRATOR_SKILL.md path with a configurable orchestrator_summary_path derived from either the materializer result or ORCHESTRATOR_SKILL_SUMMARY_PATH env var, and conditions the prompt section on actual file existence.

CI Workflow SHA Pin Update

Layer / File(s)	Summary
agents-guard.yml SHA bump .github/workflows/agents-guard.yml	Both pull_request_target and pull_request event paths re-pin the stranske/Workflows/.github/actions/setup-api-client action from c2537cc9... to d68de190....

Sequence Diagram(s)

sequenceDiagram
    participant assemble_prompt
    participant materialize_orchestrator_skill
    participant llm_registry
    participant build_chat_client

    rect rgba(100, 150, 200, 0.5)
        Note over assemble_prompt,materialize_orchestrator_skill: Orchestrator skill context path
        assemble_prompt->>materialize_orchestrator_skill: materialize_orchestrator_skill enabled?
        materialize_orchestrator_skill-->>assemble_prompt: orchestrator_summary_path (or from env ORCHESTRATOR_SKILL_SUMMARY_PATH)
        assemble_prompt->>assemble_prompt: include section only if path exists as file
    end

    rect rgba(150, 100, 200, 0.5)
        Note over build_chat_client,llm_registry: Blocked-model enforcement
        build_chat_client->>llm_registry: is_model_blocked(provider, model)
        llm_registry-->>build_chat_client: blocked=true → return None
        build_chat_client->>llm_registry: is_model_blocked(provider, model_override)
        llm_registry-->>build_chat_client: blocked=true → return None
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Possibly related PRs

• stranske/Template#834: Also updates the Setup API client (Workflows fallback) step in agents-guard.yml by re-pinning the same stranske/Workflows/.github/actions/setup-api-client action to a newer commit digest.
• stranske/Template#835: Touches the same agents-guard.yml "Setup API client (Workflows fallback)" step for both pull_request_target and pull_request event paths to swap pinned SHA values.
• stranske/Template#836: Shares changes to the orchestrator skill context flow in scripts/orchestrator_skill.py (repo validation) and scripts/runner_lib/core.py (prompt assembly with ORCHESTRATOR_SKILL.md).

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title 'chore: sync workflow templates' is vague and does not accurately represent the substantial changes made in this PR, which extend far beyond workflow template synchronization.	Revise the title to reflect the main changes: consider 'refactor: centralize LLM registry and slot management with workflow template updates' or similar, capturing both the workflow sync and the significant new llm_registry module plus related refactoring.
Docstring Coverage	⚠️ Warning	Docstring coverage is 9.38% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-76689bc445fd

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[agents-workflows-bot]

Automated Status Summary

Head SHA: 8865703
Latest Runs: ⏳ pending — Gate
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 1

Coverage Trend

Metric	Value
Current	100.00%
Baseline	0.00%
Delta	+100.00%
Minimum	70.00%
Status	✅ Pass

Top Coverage Hotspots (lowest coverage)

File	Coverage	Missing
src/my_project/__init__.py	100.0%	0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined