feat(renovate): stop consumer Renovate from editing Maint 68-owned files

docs/ci/TOOL_VERSION_MANAGEMENT.md

@@ -214,6 +214,25 @@ To ensure CI validation and autofix produce identical output, both must use the
 2. More mature and stable
 3. Explicit formatting rules prevent ambiguity
 
+## Renovate vs Maint 68 File Ownership
+
+Dev-tool pins are excluded from Renovate (see the fleet preset) because
+`autofix-versions.env` owns them. A second, path-level boundary applies to
+consumer repos: Maint 68 overwrites every manifest-managed file on each sync, so
+a consumer Renovate PR editing one of those files is reverted on the next sync.
+
+`renovate-presets/consumer-managed-paths.json` is generated from
+`.github/sync-manifest.yml` and disables dependency extraction for exactly those
+paths, per repo. Renovate stays enabled for `create_only`/`skip_repos` paths the
+consumer owns and for every canonical source file in `stranske/Workflows`, which
+means action and dependency bumps still land here first and reach consumers
+through the sync.
+
+Regenerate with `python scripts/generate_consumer_renovate_ownership.py` after
+changing the manifest; `--check` runs in `scripts/dev_check.sh` and fails on
+drift. Full ownership table:
+[Consumer Repository Maintenance](../ops/CONSUMER_REPO_MAINTENANCE.md#renovate-vs-maint-68-path-ownership).
+
 ## Related Documentation
 
 - [Autofix System](AUTOFIX.md) - How automatic fixes work

docs/ops/CONSUMER_REPO_MAINTENANCE.md

@@ -328,6 +328,46 @@ exist, but continues syncing the canonical pins from Workflows. The
 `maint-auto-update-pypi-versions.yml` workflow owns opening source bump PRs for
 freshness updates.
 
+### Renovate vs Maint 68 Path Ownership
+
+Maint 68 overwrites every manifest-managed path in a consumer on each sync. If
+that consumer's own Renovate opens a PR touching one of those paths, the change
+is discarded on the next sync — consumer Renovate PRs against
+`.github/workflows/agents-guard.yml` and
+`.github/workflows/maint-76-claude-code-review.yml` (Inv-Man-Intake#838,
+Manager-Database#1347) were both closed unmerged for exactly this reason.
+
+`renovate-presets/consumer-managed-paths.json` encodes the boundary. It is
+**generated** from `.github/sync-manifest.yml` and the registered consumer list,
+and `renovate-presets/fleet.json` extends it, so every consumer inherits it
+without a re-sync. Ownership follows the same rules Maint 68 applies:
+
+| Manifest state | Owner | Renovate |
+| --- | --- | --- |
+| No `sync_mode` (overwrite-managed) | Workflows | disabled in consumers |
+| `sync_mode: create_only` | consumer, after first seed | enabled |
+| `sync_mode: create_only` + repo in `overwrite_repos` | Workflows | disabled in that repo |
+| Repo listed in `skip_repos` | consumer | enabled in that repo |
+
+The preset matches consumer repositories only. `stranske/Workflows` is the sync
+source, so its canonical files stay fully Renovate-managed and dependency bumps
+still land here first, then reach consumers through Maint 68.
+
+Note that `.github/workflows/autofix.yml` has no `sync_mode`, which makes it
+overwrite-managed and therefore disabled for consumer Renovate. `ci.yml` and
+`pr-00-gate.yml` are `create_only` and stay consumer-owned.
+
+Regenerate after any manifest change:
+
+```bash
+python scripts/generate_consumer_renovate_ownership.py          # rewrite the preset
+python scripts/generate_consumer_renovate_ownership.py --check  # fail on drift
+```
+
+`scripts/dev_check.sh` runs `--check` (and regenerates under `--fix`), and
+`tests/scripts/test_generate_consumer_renovate_ownership.py` fails when a new
+overwrite-managed path becomes visible to consumer Renovate.
+
 ### Monorepo Package Dependencies (`app-baseline-kit`)
 
 Shared packages that live in this repo under `packages/` (currently

renovate-presets/consumer-managed-paths.json

@@ -0,0 +1,296 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "GENERATED by scripts/generate_consumer_renovate_ownership.py -- do not edit by hand. Disables Renovate dependency extraction for the paths that maint-68-sync-consumer-repos.yml overwrites from .github/sync-manifest.yml, and only in the consumer repos where that overwrite actually applies. Without this boundary a consumer's Renovate opens PRs against centrally-copied files (Inv-Man-Intake#838, Manager-Database#1347) that the next sync silently reverts. Renovate stays enabled for create-only/skipped paths the consumer owns, and for every canonical source file in stranske/Workflows, which is the sync source rather than a consumer. Regenerate with `python scripts/generate_consumer_renovate_ownership.py`; `--check` fails on drift and runs in scripts/dev_check.sh.",
+  "packageRules": [
+    {
+      "description": "Maint 68 overwrites these 207 manifest-managed paths in every registered consumer; Renovate edits there are reverted on the next sync.",
+      "matchRepositories": [
+        "stranske/Collab-Admin",
+        "stranske/Counter_Risk",
+        "stranske/Fine-Art-Archive",
+        "stranske/Inv-Man-Intake",
+        "stranske/Manager-Database",
+        "stranske/Pension-Data",
+        "stranske/Portable-Alpha-Extension-Model",
+        "stranske/Ready",
+        "stranske/Template",
+        "stranske/Travel-Plan-Permission",
+        "stranske/Trend_Model_Project",
+        "stranske/learning-management-system",
+        "stranske/trip-planner"
+      ],
+      "matchFileNames": [
+        ".coderabbit.yaml",
+        ".gitattributes",
+        ".github/ISSUE_TEMPLATE/agent_task.yml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/PULL_REQUEST_TEMPLATE.md",
+        ".github/actions/agent-event-eligibility/**",
+        ".github/actions/agent-run-base/**",
+        ".github/actions/artifact-cache/**",
+        ".github/actions/export-load-balancer-tokens/**",
+        ".github/actions/path-classifier/**",
+        ".github/actions/resolve-default-branch/**",
+        ".github/actions/setup-api-client/**",
+        ".github/agents/registry.yml",
+        ".github/codex/AGENT_INSTRUCTIONS.md",
+        ".github/codex/prompts/autofix_from_ci_failure.md",
+        ".github/codex/prompts/fix_bot_comments.md",
+        ".github/codex/prompts/fix_ci_failures.md",
+        ".github/codex/prompts/fix_merge_conflicts.md",
+        ".github/codex/prompts/keepalive_next_task.md",
+        ".github/codex/prompts/verifier_acceptance_check.md",
+        ".github/copilot-instructions.md",
+        ".github/copilot-skills/**",
+        ".github/path-classification.yml",
+        ".github/scripts/agent_delegation_policy.js",
+        ".github/scripts/agent_registry.js",
+        ".github/scripts/agent_stall_rotation.js",
+        ".github/scripts/agents-guard.js",
+        ".github/scripts/agents_belt_scan.js",
+        ".github/scripts/agents_dispatch_summary.js",
+        ".github/scripts/agents_orchestrator_resolve.js",
+        ".github/scripts/agents_pr_meta_keepalive.js",
+        ".github/scripts/agents_pr_meta_orchestrator.js",
+        ".github/scripts/agents_pr_meta_update_body.js",
+        ".github/scripts/agents_verifier_context.js",
+        ".github/scripts/auto_pilot_transitions.js",
+        ".github/scripts/autofix_emit_report.py",
+        ".github/scripts/autopilot_metrics.js",
+        ".github/scripts/bot-comment-dismiss.js",
+        ".github/scripts/bot-comment-handler.js",
+        ".github/scripts/bot_comment_auth_coverage.js",
+        ".github/scripts/capability_bundle.js",
+        ".github/scripts/checkout_source.js",
+        ".github/scripts/comment-dedupe.js",
+        ".github/scripts/conflict_detector.js",
+        ".github/scripts/coverage-normalize.js",
+        ".github/scripts/coverage_monitor_summary.js",
+        ".github/scripts/decode_raw_input.py",
+        ".github/scripts/detect-changes.js",
+        ".github/scripts/error_classifier.js",
+        ".github/scripts/error_diagnostics.js",
+        ".github/scripts/failure_comment_formatter.js",
+        ".github/scripts/fallback_split.py",
+        ".github/scripts/gate-docs-only.js",
+        ".github/scripts/gate_summary.py",
+        ".github/scripts/github-api-cache-client.js",
+        ".github/scripts/github-api-cache.js",
+        ".github/scripts/github-api-with-retry.js",
+        ".github/scripts/github-rate-limited-wrapper.js",
+        ".github/scripts/issue_context_utils.js",
+        ".github/scripts/issue_pr_locator.js",
+        ".github/scripts/issue_scope_parser.js",
+        ".github/scripts/keepalive_contract.js",
+        ".github/scripts/keepalive_gate.js",
+        ".github/scripts/keepalive_guard_utils.js",
+        ".github/scripts/keepalive_instruction_template.js",
+        ".github/scripts/keepalive_loop.js",
+        ".github/scripts/keepalive_orchestrator_gate_runner.js",
+        ".github/scripts/keepalive_post_work.js",
+        ".github/scripts/keepalive_prompt_composer.js",
+        ".github/scripts/keepalive_prompt_routing.js",
+        ".github/scripts/keepalive_review_guard.js",
+        ".github/scripts/keepalive_state.js",
+        ".github/scripts/keepalive_worker_gate.js",
+        ".github/scripts/maint-post-ci.js",
+        ".github/scripts/merge_manager.js",
+        ".github/scripts/parse_chatgpt_topics.py",
+        ".github/scripts/post_completion_comment.js",
+        ".github/scripts/pr-context-graphql.js",
+        ".github/scripts/prompt_injection_guard.js",
+        ".github/scripts/prompt_integrity_guard.js",
+        ".github/scripts/runtime_ac_merge_guard.js",
+        ".github/scripts/should-post-review.js",
+        ".github/scripts/source_context.js",
+        ".github/scripts/sync_tracker_state/**",
+        ".github/scripts/terminal_disposition.js",
+        ".github/scripts/terminal_disposition_coverage.js",
+        ".github/scripts/timeout_config.js",
+        ".github/scripts/token_load_balancer.js",
+        ".github/scripts/verifier_ci_query.js",
+        ".github/scripts/verifier_issue_formatter.js",
+        ".github/scripts/verifier_verdict_json.py",
+        ".github/scripts/weekly_metrics_artifacts.js",
+        ".github/scripts/weekly_metrics_download_manifest.js",
+        ".github/templates/keepalive-instruction.md",
+        ".github/workflows/agents-71-codex-belt-dispatcher.yml",
+        ".github/workflows/agents-72-codex-belt-worker-dispatch.yml",
+        ".github/workflows/agents-72-codex-belt-worker.yml",
+        ".github/workflows/agents-73-codex-belt-conveyor.yml",
+        ".github/workflows/agents-80-pr-event-hub.yml",
+        ".github/workflows/agents-81-gate-followups.yml",
+        ".github/workflows/agents-auto-label.yml",
+        ".github/workflows/agents-auto-pilot.yml",
+        ".github/workflows/agents-autofix-dispatcher.yml",
+        ".github/workflows/agents-capability-check.yml",
+        ".github/workflows/agents-decompose.yml",
+        ".github/workflows/agents-dedup.yml",
+        ".github/workflows/agents-guard.yml",
+        ".github/workflows/agents-issue-intake.yml",
+        ".github/workflows/agents-issue-optimizer.yml",
+        ".github/workflows/agents-keepalive-loop-reporter.yml",
+        ".github/workflows/agents-keepalive-sweep.yml",
+        ".github/workflows/agents-pr-health.yml",
+        ".github/workflows/agents-verifier.yml",
+        ".github/workflows/agents-verify-to-new-pr.yml",
+        ".github/workflows/agents-weekly-metrics.yml",
+        ".github/workflows/autofix.yml",
+        ".github/workflows/backplane-conformance.yml",
+        ".github/workflows/list-llm-models.yml",
+        ".github/workflows/maint-76-claude-code-review.yml",
+        ".github/workflows/maint-coverage-guard.yml",
+        ".github/workflows/pr-46-dependency-repair-contract.yml",
+        ".github/workflows/reusable-pr-context.yml",
+        "CLAUDE.md",
+        "WORKFLOW_USER_GUIDE.md",
+        "config/model_registry.json",
+        "config/model_selection_policy.json",
+        "design-system/PRESENTATION_PATTERNS.md",
+        "design-system/README.md",
+        "design-system/components.css",
+        "design-system/ds_streamlit.py",
+        "design-system/tokens.css",
+        "docs/AGENT_ISSUE_FORMAT.md",
+        "docs/CI_SYSTEM_GUIDE.md",
+        "docs/CODEX_TOKEN_REFRESH.md",
+        "docs/LABELS.md",
+        "docs/MODEL_SELECTION_POLICY.md",
+        "docs/SETUP_CHECKLIST.md",
+        "docs/contracts/agent-runner-output.md",
+        "docs/contracts/capability-bundle-v1.md",
+        "docs/contracts/identity-map-conventions.md",
+        "docs/contracts/run-contract-v1.md",
+        "docs/contracts/schemas/artifact-manifest-v1.schema.json",
+        "docs/contracts/schemas/capability-bundle-v1.schema.json",
+        "docs/contracts/schemas/evidence-object-v1.schema.json",
+        "docs/contracts/schemas/run-contract-v1.schema.json",
+        "scripts/aggregate_agent_metrics.py",
+        "scripts/api_client.py",
+        "scripts/autopilot_metrics_collector.py",
+        "scripts/autopilot_step_timer.py",
+        "scripts/check_agents_md_freshness.py",
+        "scripts/check_deliberate_break.py",
+        "scripts/check_test_dependencies.sh",
+        "scripts/ci_coverage_delta.py",
+        "scripts/ci_history.py",
+        "scripts/ci_metrics.py",
+        "scripts/coverage_history_append.py",
+        "scripts/langchain/_llm_client.py",
+        "scripts/langchain/capability_check.py",
+        "scripts/langchain/checklist_utils.py",
+        "scripts/langchain/context_extractor.py",
+        "scripts/langchain/injection_guard.py",
+        "scripts/langchain/integration_layer.py",
+        "scripts/langchain/issue_dedup.py",
+        "scripts/langchain/issue_formatter.py",
+        "scripts/langchain/issue_optimizer.py",
+        "scripts/langchain/issue_pr_context.py",
+        "scripts/langchain/label_matcher.py",
+        "scripts/langchain/pr_verifier.py",
+        "scripts/langchain/progress_reviewer.py",
+        "scripts/langchain/prompts/analyze_issue.md",
+        "scripts/langchain/prompts/apply_suggestions.md",
+        "scripts/langchain/prompts/context_extract.md",
+        "scripts/langchain/prompts/decompose_task.md",
+        "scripts/langchain/prompts/format_issue.md",
+        "scripts/langchain/prompts/pr_evaluation.md",
+        "scripts/langchain/prompts/refine_tasks.md",
+        "scripts/langchain/semantic_matcher.py",
+        "scripts/langchain/structured_output.py",
+        "scripts/langchain/task_decomposer.py",
+        "scripts/langchain/task_validator.py",
+        "scripts/langchain/topic_splitter.py",
+        "scripts/langchain/trace_utils.py",
+        "scripts/langchain/verdict_extract.py",
+        "scripts/langchain/verdict_policy.py",
+        "scripts/langchain/verifier_config.py",
+        "scripts/orchestrator_skill.py",
+        "scripts/reference_packs.py",
+        "scripts/reusable_ci_scope.py",
+        "scripts/runner_lib/**",
+        "scripts/state_fingerprint.py",
+        "scripts/sync_dev_dependencies.py",
+        "scripts/sync_test_dependencies.py",
+        "scripts/validate_run_contract.py",
+        "tools/__init__.py",
+        "tools/check_model_registry_freshness.py",
+        "tools/ci_failure_triage.py",
+        "tools/coverage_guard.py",
+        "tools/coverage_trend.py",
+        "tools/discover_model_catalog.py",
+        "tools/embedding_provider.py",
+        "tools/evaluate_model_benchmark.py",
+        "tools/langchain_client.py",
+        "tools/llm_provider.py",
+        "tools/llm_registry.py",
+        "tools/post_ci_summary.py",
+        "tools/requirements-llm.txt",
+        "tools/resolve_mypy_pin.py"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "stranske/Collab-Admin, stranske/Counter_Risk, stranske/Fine-Art-Archive, stranske/Inv-Man-Intake, stranske/Manager-Database, stranske/Pension-Data, stranske/Portable-Alpha-Extension-Model, stranske/Ready, stranske/Travel-Plan-Permission, stranske/learning-management-system additionally has 5 manifest-managed path(s) that at least one other consumer owns via skip_repos, create_only, or an overwrite_repos opt-in.",
+      "matchRepositories": [
+        "stranske/Collab-Admin",
+        "stranske/Counter_Risk",
+        "stranske/Fine-Art-Archive",
+        "stranske/Inv-Man-Intake",
+        "stranske/Manager-Database",
+        "stranske/Pension-Data",
+        "stranske/Portable-Alpha-Extension-Model",
+        "stranske/Ready",
+        "stranske/Travel-Plan-Permission",
+        "stranske/learning-management-system"
+      ],
+      "matchFileNames": [
+        ".github/scripts/node_modules/balanced-match/**",
+        ".github/scripts/node_modules/brace-expansion/**",
+        ".github/scripts/node_modules/minimatch/**",
+        ".github/scripts/package.json",
+        "AGENTS.md"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "stranske/Template additionally has 7 manifest-managed path(s) that at least one other consumer owns via skip_repos, create_only, or an overwrite_repos opt-in.",
+      "matchRepositories": [
+        "stranske/Template"
+      ],
+      "matchFileNames": [
+        ".github/scripts/node_modules/balanced-match/**",
+        ".github/scripts/node_modules/brace-expansion/**",
+        ".github/scripts/node_modules/minimatch/**",
+        ".github/scripts/package.json",
+        ".github/workflows/ci.yml",
+        ".github/workflows/pr-00-gate.yml",
+        "AGENTS.md"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "stranske/Trend_Model_Project additionally has 4 manifest-managed path(s) that at least one other consumer owns via skip_repos, create_only, or an overwrite_repos opt-in.",
+      "matchRepositories": [
+        "stranske/Trend_Model_Project"
+      ],
+      "matchFileNames": [
+        ".github/scripts/node_modules/balanced-match/**",
+        ".github/scripts/node_modules/brace-expansion/**",
+        ".github/scripts/node_modules/minimatch/**",
+        ".github/scripts/package.json"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "stranske/trip-planner additionally has 1 manifest-managed path(s) that at least one other consumer owns via skip_repos, create_only, or an overwrite_repos opt-in.",
+      "matchRepositories": [
+        "stranske/trip-planner"
+      ],
+      "matchFileNames": [
+        "AGENTS.md"
+      ],
+      "enabled": false
+    }
+  ]
+}