[pr-attention-pulse] Add scoped PR attention dashboards

[PureWeen]

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. The permanent dashboard is [pr-attention-pulse] ASP.NET Core PR Attention Pulse #69328; this PR also depends on the already-merged Add pull request attention queue skill #69199.

Add a deterministic PR attention dashboard workflow with a maintained Blazor scope and a repository-wide baseline.

Description

This adds PR Attention Pulse after its .github/skills/pr-attention-queue dependency was merged in #69199. It demonstrates collapsible per-area composition without claiming a final multi-area taxonomy:

• Blazor uses the maintained blazor skill preset: the defined label/path union, including the incidental-path floor. Its dashboard starts collapsed with <details>.
• Repository-wide independently collects all open pull requests as a collapsed baseline. It is not used as a fallback for Blazor, and each area's incomplete/unavailable state remains distinguishable.
• Additional maintained areas are intentionally deferred until maintainers define which areas matter, their exact label/path queries, and whether each needs this dashboard shape or a different one.

Within both areas, candidate presentation remains deterministic: an exact sanitized community-contribution reason adds a fixed Community marker beside the author, rows display days open without claiming inactivity, and collapsed summaries distinguish displayed (shown) counts from the full inventory and coverage audit.

The deterministic publication architecture is:

1. A trusted prerequisite job requires the run to be in dotnet/aspnetcore and verifies that permanent dashboard [pr-attention-pulse] ASP.NET Core PR Attention Pulse #69328 is an open issue (not a pull request) whose title starts with [pr-attention-pulse].
2. The merged queue skill performs two independent read-only collections against dotnet/aspnetcore: exact -Preset blazor -DisablePersonalInbox -OutputFormat Json and exact -AllRepo -DisablePersonalInbox -OutputFormat Json invocations.
3. Trusted sanitizers validate and reduce each result, delete raw GitHub data, and combine the ordered area envelopes into a bounded versioned input.
4. A trusted renderer creates the canonical body and constructs every PR link only from a validated integer, using [dotnet/aspnetcore#N](https://github.com/dotnet/aspnetcore/pull/N).
5. The model receives the bounded Pulse task data and acts only as a copy agent. A private validator rerenders from the sanitized input and requires ordinal equality across canonical, normalized, collected, and submitted bodies.
6. The generated native update-issue handler, trusted request serializer, and private validator all use immutable issue number 69328. The safe-output job repeats the repository/type/state/title validation immediately before its single body-only update.

No model-authored ranking, prose, URL, target, or interpretation is accepted. All GitHub text is untrusted. The contract preserves candidate order/counts, escapes table cells, enforces the size limit, and rejects malformed or duplicate links, mismatched labels and targets, arbitrary URLs, wrong repositories, issue paths, query/fragment suffixes, candidate-supplied URL text, changed issue targets, and malformed area/status metadata.

Security boundaries

The generated gh-aw v0.88.7 runtime expands the source bash: ["cat"] declaration to its required baseline shell surface. This PR does not claim that the effective shell is cat-only or that only three physical files exist in the runtime.

The enforceable boundary is data minimization:

• Before activation artifact staging, trusted cleanup removes /tmp/gh-aw/base and repository-derived /tmp/gh-aw/.github/agents and /tmp/gh-aw/.github/skills, then asserts they are absent.
• After activation download and before inference, trusted cleanup repeats those checks and removes every workspace-root entry except .pr-attention-pulse.
• The workspace must then contain exactly three regular, non-symlink task files: pulse-input.json, pulse-body.md, and pulse-request.json. Workspace .github, .git, raw queue data, and every unexpected root or task-directory entry fail closed.
• Compiler-required runtime files remain available under the gh-aw runtime paths; repository configuration, repository skills, Git data, and raw queue data do not remain model-visible.
• Trusted sanitizer and private-validator materials are copied to symlink-resolved private runner paths outside model-visible mounts.
• The generated main inference command excludes exactly once each: GH_TOKEN, GH_AW_GITHUB_TOKEN, GITHUB_MCP_SERVER_TOKEN, GITHUB_TOKEN, OTEL_EXPORTER_OTLP_HEADERS, and GH_AW_OTLP_ENDPOINTS. The v0.88.7 compatibility adapter uses only a deterministic non-secret job output; tests assert no sentinel is exported and no secret-bearing workflow value is copied into model environment.

Setup and execution

The permanent dashboard already exists at #69328. Merging this workflow does not run it: the workflow remains manual-only and must be explicitly dispatched in dotnet/aspnetcore. The repository guard prevents a fork run from reaching inference or publication with the same issue number. This PR does not close #69328.

Candidate verification

Latest follow-up commit bc490da6eac3ef56c26d409f11d559be72266fda builds on 456a5e87d407d9b140fb9b7d5e6dbb3621267c20 and changes only candidate presentation and its focused tests/goldens.

• Focused red controls against unchanged production failed for the required presentation differences across ordinary review, discussion verification, rescue, and ready views in both scopes. After the production change, every independently named exact-code/partial-code case passes, including private-validator rejection of forged marker insertion or removal.
• Complete, complete-zero, capped, unassessed, and unavailable collapsed-summary cases pass. Summary counts use the displayed arrays and preserve matched inventory, caps, overflow, coverage, and the original source timestamp; unavailable data remains distinguishable.
• A retained hosted snapshot rendered before changes byte-for-byte equal to the published fork body (16,012 bytes; SHA-256 cb566918bd65cbdeab39c015a882ee229552853ca876446057ad266a8fbdcff1). The updated local preview preserves the exact ordinal sequence of all 26 clickable PR references, both collapsed scopes, six sections per scope, candidate membership/order/rank/title/next actor/reasons/blockers/discussion/census/overflow/caps, and changes only the approved marker, age, and summary presentation.
• Complete Pulse suite passed, including all independently named presentation controls, literal goldens, real producer/sanitizer/combiner/renderer/private-validator paths, publication-handler tests, and fail-closed canonical-body checks.
• Focused review/security requirements passed, preserving fixed target [pr-attention-pulse] ASP.NET Core PR Attention Pulse #69328, upstream-only guards, model-input cleanup, credential exclusions, exact model policy, and single body-only publication.
• Legacy .github/skills/pr-attention-queue/tests/Test-PRAttentionQueue.ps1 suite passed.
• Official gh-aw v0.88.7 strict compile and explicit validation each passed: 1 workflow succeeded, 0 warnings. The generated workflow lock is unchanged.
• The compiler's known .github/aw/actions-lock.json pruning side effect was restored byte-for-byte from HEAD; it is not in the commit.
• git diff --check and git diff --cached --check passed. The follow-up changes exactly 6 Pulse presentation/test files and no workflow policy, skill, collector, sanitizer, schema, package, global.json, NuGet.config, shared registry, or unrelated file.

Hosted proof

The original imported source SHA completed successfully on the fork in run 34863123658, attempt 1, and published to PureWeen/aspnetcore#58.

• One dispatch at exact SHA 723d8601; all required jobs succeeded.
• Trusted collection, sanitization, rendering, detection, private validation, and safe-output publication succeeded.
• Collected 380 of 380 open pull requests and performed exactly one body-only issue mutation.
• Seven canonical, payload, and live-body copies were ordinally equal.
• Final body: 8,166 UTF-8 bytes; SHA-256 b1f310822a0b2005cb8907e0c51c7e349e76249c50f50634754cc9408554a828.
• All five model responses used gpt-5.6-sol; steering was false, no actual fallback occurred, and total usage was 22.02204 AI credits.

That run is historical proof for the original revision. The current upstream-only fixed-target revision has not been dispatched, and this PR intentionally does not close or mutate either dashboard issue.

[Copilot]

Copilot review overview

🟡 Changes recommended

One or more issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Review tier: Lite
Findings: 4

Open findings (4)

• Activation artifact exposes the saved repository configuration · New
• Generated lock grants file-reading shell tools · New
• Generated lock drops the declared credential exclusions · New
• Exclude OTLP credentials from the model environment · New

What changed in this PR

Adds a fork-only, manually dispatched PR attention dashboard using deterministic collection, sanitization, rendering, validation, and issue publication.

Changes:

• Adds the workflow and generated lock file.
• Adds trusted sanitizer, renderer, and publication validator.
• Adds comprehensive tests and fixtures.

File	Description
.github/​workflows/​pr-attention-pulse/​Validate-PRAttentionPulseOutput.ps1	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse/​Sanitize-PRAttentionPulse.ps1	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse/​Render-PRAttentionPulse.ps1	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse/​PRAttentionPulseContract.psm1	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse/​Compile-PRAttentionPulse.ps1	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse.md	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​Test-PulsePublicationCommand.cjs	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​Test-PulseIssueUpdate.cjs	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​Test-PRAttentionPulse.ps1	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​wrong-repository.json	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​presentation/​published-34643961191.pulse.json	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​presentation/​published-34643961191.expected.txt	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​presentation/​provenance.json	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​presentation/​normal-legacy.expected.txt	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​presentation/​incomplete-query.expected.txt	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​presentation/​complete-zero.expected.txt	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​presentation/​bounded-empty-verification.expected.txt	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​normal-legacy.json	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​malformed.json	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​incomplete.json	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​incompatible.json	Updated as part of this pull request.
.github/​workflows/​pr-attention-pulse-tests/​fixtures/​complete-zero.json	Updated as part of this pull request.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.