chore: sync 4 org-standard workflow stub(s) from petry-projects/.github

.github/workflows/auto-rebase.yml

@@ -22,14 +22,12 @@
 # To adopt: copy this file to .github/workflows/auto-rebase.yml in your repo.
 # No secrets required — uses GITHUB_TOKEN only.
 #
-# By default the reusable only updates *review-ready* PRs: non-draft AND
-# (carrying a current APPROVED review OR the `auto-rebase:ready` label). This
-# keeps the workflow from fanning out branch-update CI runs to every behind PR.
-# To tune it, pass inputs to the reusable, e.g.:
+# By default the reusable updates *every* behind PR (`eligibility: all`). The
+# `eligibility` input is a tunable extension point for future modes; to select
+# one, pass it to the reusable, e.g.:
 #
 #   with:
-#     eligibility: review-ready      # default; or `all` to update every behind PR
-#     ready_label: auto-rebase:ready # label that opts a non-draft PR in
+#     eligibility: all  # default — update every behind PR
 #
 name: Auto-rebase non-Dependabot PRs
 

.github/workflows/dev-lead.yml

@@ -61,9 +61,9 @@ jobs:
     # dependency). Promotion is done by moving the dev-lead/v1-stable tag centrally; this
     # caller is never edited on release. agent_ref threads the same channel into
     # dev-lead's own scripts/prompts checkout. See https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#dev-lead-agent.
-    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v1-stable  # NOSONAR(githubactions:S7637) first-party channel ref
     with:
-      agent_ref: dev-lead/stable
+      agent_ref: dev-lead/v1-stable
     secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable
     permissions:
       contents: write

.github/workflows/pr-review.yml

@@ -344,81 +344,6 @@ jobs:
             fi
           fi
 
-      - name: Cache claude-code CLI
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.npm-global
-          key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
-
-      - name: Verify auth scopes
-        # Inlined from scripts/verify-auth-scopes.sh so this step is self-contained
-        # when pr-review.yml is deployed to target repos that do not have the scripts/ dir.
-        run: |
-          set -euo pipefail
-
-          if auth_status="$(gh auth status 2>&1)"; then
-            :
-          else
-            auth_rc=$?
-            printf '%s\n' "$auth_status"
-            echo "::error::gh auth status failed"
-            exit "$auth_rc"
-          fi
-          printf '%s\n' "$auth_status"
-
-          # Fine-grained PATs are NOT supported — they fail at addPullRequestReview.
-          # Two detection methods: (1) prefix in auth status output; (2) gh auth token
-          # for gh versions that mask the prefix in status output (token never logged).
-          _fgpat=0
-          if grep -qi 'Token:.*github_pat_' <<< "$auth_status"; then
-            _fgpat=1
-          else
-            _tok="$(gh auth token 2>/dev/null || true)"
-            if [[ "${_tok:-}" == github_pat_* ]]; then
-              _fgpat=1
-            fi
-            unset _tok
-          fi
-          if [[ "$_fgpat" -eq 1 ]]; then
-            unset _fgpat
-            echo "::error::Fine-grained PAT detected — fine-grained PATs are not supported by this workflow."
-            echo "::error::Fine-grained PATs fail at addPullRequestReview (GraphQL: Resource not accessible by personal access token)."
-            echo "::error::Replace DON_PETRY_BOT_GH_PAT with a classic PAT that has repo, workflow, and read:org scopes."
-            echo "::error::See docs/pr-review-agent/setup.md → Troubleshooting for details."
-            exit 1
-          fi
-          unset _fgpat
-
-          scopes_line="$(grep 'Token scopes:' <<< "$auth_status" || true)"
-          normalized_scopes="${scopes_line//,/ }"
-          normalized_scopes="${normalized_scopes//$'\''/ }"
-
-          if [ -z "$normalized_scopes" ] || grep -qiE '(cannot determine|fine.grained)' <<< "$auth_status"; then
-            echo "::warning::Token scopes could not be determined. Skipping scope validation."
-            echo "::warning::Ensure the token has: repo + read:org (classic PAT) or contents + pull_requests:write."
-            exit 0
-          fi
-
-          if grep -qE "(^|[[:space:]])repo([[:space:]]|$)" <<< "$normalized_scopes"; then
-            if ! grep -qE "(^|[[:space:]])read:org([[:space:]]|$)" <<< "$normalized_scopes"; then
-              echo "::error::GH_TOKEN has 'repo' scope but is missing 'read:org'."
-              echo "::error::PRs with team-based reviewers will fail at 'gh pr view --json reviewRequests'."
-              echo "::error::Edit the classic PAT and check the 'read:org' box (no regeneration needed)."
-              exit 1
-            fi
-          else
-            if ! grep -qE "(^|[[:space:]])contents(:[^[:space:]]+)?([[:space:]]|$)" <<< "$normalized_scopes"; then
-              echo "::error::GH_TOKEN is missing required scope: contents"
-              echo "::error::Token must have either 'repo' + 'read:org' (classic) or 'contents' + 'pull_requests:write'"
-              exit 1
-            fi
-            if ! grep -qE "(^|[[:space:]])pull_requests(:write)?([[:space:]]|$)" <<< "$normalized_scopes"; then
-              echo "::error::GH_TOKEN is missing required scope: pull_requests with write access"
-              echo "::error::Token must have either 'repo' + 'read:org' (classic) or 'contents' + 'pull_requests:write'"
-              exit 1
-            fi
-          fi
-
       - name: Install review engine CLIs
         run: |
           set -euo pipefail

.gitignore

@@ -418,3 +418,6 @@ coverage/
 # actionlint scanner binary — downloaded fresh in CI, never committed
 /actionlint
 /actionlint.tar.gz
+
+# Editor/tooling backup artifacts — never committed (see #1378)
+*.backup

.gitleaksignore

@@ -15,10 +15,11 @@ eb7fd4c955378d274794e38ee9b942912ce79c6f:tests/dev-lead/unit/test_engine_fallbac
 # 40-char classic-PAT-length test placeholder verbatim; commit a547c50 rewrote
 # it to avoid the literal. Fingerprint suppresses the historical commit's finding.
 334fac2ca4528d821b7511e1a0f8e5051a2aca65:.gitleaksignore:github-pat:5
-# Framework test fixtures with sample/fake API keys (not real credentials).
-# These are included in the frameworks subtree (git subtree) as test data.
-68ab3109d74633dc4aa4c09ff58d1901795bbd11:frameworks/bmad-method/test/adversarial-review-tests/sample-content.md:generic-api-key:24
-68ab3109d74633dc4aa4c09ff58d1901795bbd11:frameworks/gsd/sdk/src/query/config-query.test.ts:generic-api-key:228
-68ab3109d74633dc4aa4c09ff58d1901795bbd11:frameworks/gsd/sdk/src/query/config-mutation.test.ts:generic-api-key:501
-68ab3109d74633dc4aa4c09ff58d1901795bbd11:frameworks/gsd/tests/security-scan.test.cjs:generic-api-key:300
-68ab3109d74633dc4aa4c09ff58d1901795bbd11:frameworks/gsd/tests/commands.test.cjs:generic-api-key:759
+# commit 95fe0d4 (refactor: migrate to org-wide .github-private convention):
+# framework subtree import introduced test fixture files with dummy API keys used
+# for testing security scanning. These are not real credentials.
+95fe0d46addc83e56a0ba36468583c2970b104e3:frameworks/bmad-method/test/adversarial-review-tests/sample-content.md:generic-api-key:24
+95fe0d46addc83e56a0ba36468583c2970b104e3:frameworks/gsd/sdk/src/query/config-query.test.ts:generic-api-key:228
+95fe0d46addc83e56a0ba36468583c2970b104e3:frameworks/gsd/sdk/src/query/config-mutation.test.ts:generic-api-key:501
+95fe0d46addc83e56a0ba36468583c2970b104e3:frameworks/gsd/tests/commands.test.cjs:generic-api-key:759
+95fe0d46addc83e56a0ba36468583c2970b104e3:frameworks/gsd/tests/security-scan.test.cjs:generic-api-key:300

AGENTS.md

@@ -230,7 +230,7 @@ breaks post-merge (the #1034 defect). This guard closes that gap.
 The `caller-stub-freeze` job in `lint.yml` (#1255, epic #1052 Part B) is the byte-identity **backstop** to
 `validate-caller-inputs` for the specific **ring-0 / self-host** caller stubs — the ones whose reusable lives
 in **this** repo and is pinned to a canary channel tag (`docs/initiatives/agentic-release-strategy.md` §5):
-`dev-lead.yml` (`@dev-lead/v1-next`), `pr-review-trigger.yml` (`@pr-review/next`), and
+`dev-lead.yml` (`@dev-lead/v1-stable`), `pr-review-trigger.yml` (`@pr-review/next`), and
 `ci-failure-analyst.lock.yml` (`@ci-failure-analyst/v1-stable`). A trigger/`with:` forwarding change to a
 channel-pinned self-host stub is exercised by nothing in PR CI and only breaks post-merge (the #1034 defect
 class), so each stub's `on:` trigger + `uses:`/`with:` forwarding block is frozen byte-for-byte against a

docs/initiatives/idea-to-initiative-pipeline.md

@@ -107,43 +107,6 @@ inputs.
    marker) — the idempotency guarantee that let the standalone `idea-enhancer`
    be retired (#876).
 
-There is exactly **one** Discussion-triggered enhancer. The standalone
-`idea-enhancer.yml` (with its `scripts/idea-enhancer/` tooling) has been
-**removed** (#876) now that its capability is fully folded into the
-`feature-ideation` reusable workflow (epic #872) — so a human-authored idea is
-enhanced **once**, never twice.
-
-For each open, human-authored, not-yet-enhanced **Ideas** Discussion the folded
-enhancer posts **one** comment (sharpened problem/goal, repo + market context,
-impact/effort, suggested acceptance criteria). Bot-authored ideas are skipped —
-they are already AI-generated. It never approves, labels, or promotes — that
-stays with triage and the human gates.
-
-The enhancement logic lives in the **central** reusable `petry-projects/.github`
-(`feature-ideation-reusable.yml`); `.github-private` ships only the thin
-`feature-ideation.yml` caller stub (pinned to the `@feature-ideation/next`
-dogfood ring), which exposes the enhancement modes as `workflow_dispatch`
-inputs.
-
-- **Backfill sweep** — dispatch `feature-ideation` with `enhance_backlog: true`.
-  It sweeps the target repo's open, human-authored, not-yet-enhanced **Ideas**
-  Discussions and posts **exactly one** structured enhancement comment each.
-  Bot-authored and already-enhanced ideas are skipped. This is the safety-net
-  backfill that catches human ideas added before the folded enhancer went live.
-- **Dry-run** — dispatch with `dry_run: true` **and** `enhance_backlog: true`.
-  Every intended per-Discussion enhancement comment is logged to the JSONL
-  artifact and **nothing** is posted (one artifact entry per candidate
-  Discussion). The dry-run is free of model spend beyond candidate gathering.
-- **Marker continuity (cutover-safe).** The idempotency check honors **both**
-  the legacy `<!-- idea-enhancer:enhanced -->` marker and the canonical
-  `<!-- feature-ideation:enhanced -->` marker; new enhancement comments emit the
-  single canonical marker. So **no** idea enhanced by the old `idea-enhancer` is
-  re-enhanced after the cutover, and a repeated backfill is a no-op.
-- **Cost.** Operator-triggered (`workflow_dispatch`), **no new cron** — the
-  backfill reuses `feature-ideation`'s existing model budget and 20-minute
-  timeout, so it is cost-neutral-to-reducing.
-
-### `idea-triage.yml` — weekly ripeness shortlist
 - Scans every open **Ideas** Discussion, scores each **Ripe / Soon / Not yet**
   on evidence, prerequisites, alignment, coverage, and freshness.
 - Rewrites a single **Idea Promotion Queue** tracking issue (label

evals/validate-cases.py

@@ -32,17 +32,6 @@ def fail(msg: str) -> NoReturn:
 
 # ── File mode: schema + id-uniqueness validation ──────────────────────────────
 
-def validate_file(cases_path: Path, schema_path: Path) -> None:
-    try:
-        import jsonschema
-    except ImportError:
-        fail("jsonschema not installed (pip install 'jsonschema>=4')")
-
-    try:
-        schema = json.loads(schema_path.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError) as exc:
-        fail(f"could not read/parse schema {schema_path}: {exc}")
-
 def validate_file(cases_path: Path, schema_path: Path) -> None:
     try:
         import jsonschema
@@ -157,80 +146,6 @@ def validate_directory(eval_root: Path) -> None:
     print(f"OK: {len(skills)} skill(s), {total} case(s) across dev+holdout, "
           f"no cross-split id overlap.")
 
-
-# ── Directory mode: dev/holdout split hygiene ─────────────────────────────────
-
-def load_split_ids(cases_path: Path) -> list[str]:
-    try:
-        raw = cases_path.read_text(encoding="utf-8")
-    except OSError as exc:
-        fail(f"could not read {cases_path}: {exc}")
-
-    ids: list[str] = []
-    seen: set[str] = set()
-    for lineno, line in enumerate(raw.splitlines(), start=1):
-        if not line.strip():
-            continue
-        try:
-            case = json.loads(line)
-        except json.JSONDecodeError as exc:
-            fail(f"{cases_path}:{lineno}: invalid JSON: {exc}")
-        if not isinstance(case, dict):
-            fail(f"{cases_path}:{lineno}: each case line must be a JSON object")
-        if "id" not in case:
-            fail(f"{cases_path}:{lineno}: case is missing required field 'id'")
-        cid = case["id"]
-        if not isinstance(cid, str) or not cid.strip():
-            fail(f"{cases_path}:{lineno}: case 'id' must be a non-empty string")
-        if cid in seen:
-            fail(f"{cases_path}:{lineno}: duplicate id '{cid}' within this split")
-        seen.add(cid)
-        ids.append(cid)
-    return ids
-
-
-def validate_skill(skill_dir: Path) -> int:
-    split_ids: dict[str, list[str]] = {}
-    for split in SPLITS:
-        cases_path = skill_dir / split / CASES_FILENAME
-        if not cases_path.is_file():
-            fail(f"skill '{skill_dir.name}' is missing its {split} split "
-                 f"(expected {cases_path})")
-        split_ids[split] = load_split_ids(cases_path)
-
-    overlap = set(split_ids["dev"]) & set(split_ids["holdout"])
-    if overlap:
-        joined = ", ".join(sorted(overlap))
-        fail(f"skill '{skill_dir.name}': id(s) appear in both dev and holdout "
-             f"splits (a case must not be in both): {joined}")
-
-    return sum(len(ids) for ids in split_ids.values())
-
-
-def discover_skills(eval_root: Path) -> list[Path]:
-    skills = []
-    for child in sorted(eval_root.iterdir()):
-        if not child.is_dir():
-            continue
-        if any((child / split).is_dir() for split in SPLITS):
-            skills.append(child)
-    return skills
-
-
-def validate_directory(eval_root: Path) -> None:
-    skills = discover_skills(eval_root)
-    if not skills:
-        fail(f"no skills found under {eval_root} "
-             f"(expected <skill>/dev/ and <skill>/holdout/ subdirectories)")
-
-    total = 0
-    for skill_dir in skills:
-        total += validate_skill(skill_dir)
-
-    print(f"OK: {len(skills)} skill(s), {total} case(s) across dev+holdout, "
-          f"no cross-split id overlap.")
-
-
 # ── Entry point ───────────────────────────────────────────────────────────────
 
 def main() -> None:

package.json

@@ -0,0 +1,8 @@
+{
+  "name": ".github-private",
+  "version": "1.0.0",
+  "private": true,
+  "devDependencies": {
+    "bats": "1.13.0"
+  }
+}

prompts/cascade-action.md

@@ -59,6 +59,12 @@ PLACEHOLDER_SUMMARY
 ### Cross-engine agreement (if deep+duck)
 <If tier is deep+duck and agreement field exists, include this section>
 
+### Cross-engine agreement (if deep+duck)
+<If tier is deep+duck and agreement field exists, include this section>
+
+### Cross-engine agreement (if deep+duck)
+<If tier is deep+duck and agreement field exists, include this section>
+
 ### Findings
 PLACEHOLDER_FINDINGS_LIST
 

prompts/dev-lead/fix-ci.md

@@ -83,52 +83,6 @@ Read every changed line as if you are a reviewer:
 4. Ask: is there a simpler fix that achieves the same result with less risk?
 5. Fix anything found, then re-run Phase 3
 
-### Phase 2 — Fix
-
-Apply targeted fixes using the Edit/Write tools:
-
-1. Address each root cause identified in Phase 1
-2. Fix only what is broken — do not refactor unrelated code
-3. Do not modify test expectations to make tests pass artificially
-
-#### External quality gate (SonarCloud, CodeQL, etc.)
-
-If **Failure Logs** begins with `# External quality gate`, this check is not a GitHub Actions workflow — it is an external service that reported a quality gate failure. In this case:
-
-- **Annotations** contains the specific lines and rule messages flagged by the gate — read it carefully
-- If **Annotations** is empty, **Failure Logs** contains the PR diff to identify what the gate likely flagged
-- For **SonarQube / SonarCloud**, note: `# NOSONAR` suppresses Bugs/Code Smells but **not Security Hotspots** — hotspots require code changes or UI acknowledgment in SonarCloud
-
-Common SonarCloud Security Hotspot patterns to look for in changed files:
-
-| Pattern | Typical fix |
-|---|---|
-| `curl … \| bash` / `wget … \| sh` | Replace with pinned download + verify checksum, or `gh extension install` |
-| Hardcoded credentials / API keys | Move to secrets / env vars |
-| `eval` / `exec` with dynamic input | Remove dynamic execution or sanitize input |
-| HTTP (non-HTTPS) download URLs | Change to `https://` |
-| `npm install` without `--ignore-scripts` | Add `--ignore-scripts` if install scripts are not required; otherwise, this may require manual acknowledgment in the SonarCloud UI |
-| `npm install pkg@variable` or `@latest` | Pin to an exact version number (e.g. `pkg@1.2.3`), or exclude the file in `sonar-project.properties` if version is intentionally managed via a CI variable |
-
-### Phase 3 — Verify Locally
-
-After applying fixes, run the local equivalent of the failing check to confirm the fix works before finishing:
-
-1. Identify the test/lint command this repo uses (check AGENTS.md, `package.json`, `Makefile`, etc.)
-2. Run the full test suite — every test must pass, not just the ones that were failing
-3. Run any lint/format checks relevant to the failing check
-4. **If the local run still fails, diagnose and fix before finishing — the CI workflow will push and re-run checks; hand it a working fix**
-
-### Phase 4 — Rubber Duck Review
-
-Read every changed line as if you are a reviewer:
-
-1. Run `git diff HEAD` to see all changes made during this session
-2. Ask: does each change directly address a root cause from Phase 1?
-3. Ask: could any fix introduce a regression in code that was previously passing?
-4. Ask: is there a simpler fix that achieves the same result with less risk?
-5. Fix anything found, then re-run Phase 3
-
 ## Constraints
 
 - Fix only what is broken — do not refactor unrelated code