chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-81-gate-followups.yml: Gate followups hub - consolidates keepalive and autofix followups
• agents-73-codex-belt-conveyor.yml: Codex belt conveyor - orchestrates belt worker execution and handles completion
• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• check_deliberate_break.py: Opt-in Gate helper that proves named deliberate-break acceptance tests fail against the base implementation
• runtime_ac_merge_guard.js: Blocks external merge lanes for PRs that require local Orchestrator runtime acceptance checks
• gate_summary.py: Gate summary renderer - generates PR gate check summary
• AGENTS.md: Context file for agents and coding assistants
• CLAUDE.md: Context file for Claude/AI assistants

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• .github/scripts/package.json: Repo installs .github/scripts dependencies from package-lock.json and forbids tracked node_modules
• .github/scripts/node_modules/minimatch: Repo installs .github/scripts dependencies from package-lock.json and forbids tracked node_modules
• .github/scripts/node_modules/brace-expansion: Repo installs .github/scripts dependencies from package-lock.json and forbids tracked node_modules
• .github/scripts/node_modules/balanced-match: Repo installs .github/scripts dependencies from package-lock.json and forbids tracked node_modules
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: deacb8ee2852a7c22fe229645468776f35921628
Template hash: 536a715df8b0
Sync branch: sync/workflows-536a715df8b0
Consumer repo: stranske/trip-planner
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• Chores
  • Enhanced CI/CD infrastructure with improved test quality tracking and merge validation
  • Added deliberate break test verification for test validation
  • Updated workflow configurations with runtime merge guards
  • Updated internal agent guidance documentation

[netlify]

✅ Deploy Preview for stranske-trip-planner canceled.

Name	Link
🔨 Latest commit	7789fd7
🔍 Latest deploy log	https://app.netlify.com/projects/stranske-trip-planner/deploys/6a35f111a7076400088c6846

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

Adds scripts/check_deliberate_break.py for spec-driven, execution-based deliberate-break test verification and .github/scripts/runtime_ac_merge_guard.js for label-gated merge blocking. Both are wired into two agent workflows. gate_summary.py gains a test-quality outcome row. An action pin is bumped and agent guidance docs receive a critical-evaluator section.

Changes

Deliberate-break and runtime-AC merge gate feature

Layer / File(s)	Summary
check_deliberate_break.py: spec parsing and verification scripts/check_deliberate_break.py	New Python CLI implementing DeliberateBreakSpec, markdown spec extraction (explicit marker and fallback), subprocess/tamper-check helpers, git-archive extraction with path-safety enforcement, and a head/base verification flow emitting PASS, FAIL_BROKEN, or FAIL_HOLLOW verdicts as JSON and GitHub Actions output variables.
runtime_ac_merge_guard.js: label-based merge gate .github/scripts/runtime_ac_merge_guard.js	New Node.js module exporting RUNTIME_AC_REQUIRED_LABELS, normalizeLabelName, hasRuntimeAcRequirement, and assertRuntimeAcMergeAllowed; the latter fetches PR labels with optional retry and either returns { allowed: true } or throws a structured runtime_ac_merge_blocked error.
Workflow wiring of merge guard .github/workflows/agents-73-codex-belt-conveyor.yml, .github/workflows/agents-81-gate-followups.yml	Both workflows add runtime_ac_merge_guard.js to sparse-checkout and call assertRuntimeAcMergeAllowed with GitHub/core context and a source label before invoking the squash-merge API.
gate_summary.py: test-quality outcome tracking .github/scripts/gate_summary.py	SummaryContext gains test_quality_result; build_context reads TEST_QUALITY_RESULT from env; _append_job_table, _active_lines, and summarize() propagate the value; summarize() maps cancelled → pending and other non-success/non-skipped values → failure, and rewrites the test-quality table row.

CI pin bump and agent guidance docs

Layer / File(s)	Summary
Action pin bump and agent docs .github/workflows/agents-guard.yml, AGENTS.md, CLAUDE.md	Fallback setup-api-client action reference updated to commit d68de19 for both pull_request_target and pull_request paths; both agent guidance files gain a "Working Stance — Critical Evaluator" section.

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant Guard
  participant GitHubAPI
  Workflow->>Guard: assertRuntimeAcMergeAllowed(context)
  Guard->>GitHubAPI: listLabelsOnIssue(owner, repo, prNumber)
  GitHubAPI-->>Guard: PR labels
  Guard->>Guard: normalize and evaluate required labels
  alt runtime-AC-required label exists
    Guard-->>Workflow: throw runtime_ac_merge_blocked
  else no required label
    Guard-->>Workflow: allowed true
    Workflow->>GitHubAPI: pulls.merge(squash)
  end

Loading

sequenceDiagram
  participant CI
  participant Parser
  participant Verifier
  participant Runner
  participant Archive
  participant Actions
  CI->>Parser: parse deliberate-break spec from PR markdown
  Parser-->>CI: DeliberateBreakSpec or None
  CI->>Verifier: verify_spec(base, head, spec)
  Verifier->>Runner: run pytest command on head
  Runner-->>Verifier: head result
  Verifier->>Archive: extract base archive to temp tree
  Archive-->>Verifier: extracted base snapshot
  Verifier->>Runner: run pytest command on base snapshot
  Runner-->>Verifier: base result
  Verifier-->>CI: verdict payload
  CI->>Actions: write verdict outputs

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related issues

• Enforce acceptance criteria with a pre-merge execution-based deliberate-break gate (opt-in) Workflows#2475: This PR directly implements the requirements described in that issue — adding scripts/check_deliberate_break.py for execution-based deliberate-break verification, runtime_ac_merge_guard.js for label-gated merge blocking, wiring both into agent workflow merge steps, and extending the gate summary to surface test-quality results.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 8.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'chore: sync workflow templates' is vague and generic, using non-descriptive terminology that does not clearly convey the specific changes made to multiple files including new guard scripts, workflow updates, and context documentation.	Consider a more specific title that indicates the key changes, such as 'chore: sync workflow templates and add runtime AC merge guard' or 'chore: sync workflow templates with runtime verification updates'.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-536a715df8b0

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}