[#811 re-split 1/2] canary-rollout: collapse run-list enumeration to a cached per-repo fetch

[don-petry]

Re-split of #811 (2/2 of #803), which timed out at the 2100s action budget bundling the fetch refactor + sync-issues + tests. This is the fetch-refactor half only. Builds on #810 (merged: _run_json backoff + error surfacing).

Scope — scripts/canary-rollout.sh (fetch mechanism only)

Replace the per-workflow gh run list --repo <r> --workflow <wf> enumeration (one call per workflow × per agent × per tier — the burst that trips secondary rate limits) with one paginated gh run list --repo <repo> per repo, cached for the run, then filter to the target workflow locally. Keep _run_json's public contract/return shape identical so callers and #810's backoff are unchanged.

Out of scope

• sync-issues resilience → [#811 re-split 1/2] canary-rollout: collapse run-list enumeration to a cached per-repo fetch #819.

Acceptance criteria

• Per-evaluation gh run list call count materially reduced (state before/after in the PR).
• Same promote/block decisions on good data (return shape unchanged).
• Fails closed; existing canary-rollout bats stay green; add a test for the per-repo cache + local filter.

[don-petry]

Dev-Lead Implementation Plan

Issue: #819 — [#811 re-split 1/2] canary-rollout: collapse run-list enumeration to a cached per-repo fetch

Scope

Replace the per-workflow gh run list --repo <r> --workflow <wf> enumeration in scripts/canary-rollout.sh with one paginated gh run list --repo <repo> per repo, memoized for the process, then filter to the target workflow (and the since cut) locally — collapsing the per-agent×per-workflow×per-tier burst that trips secondary rate limits into one read per repo. _run_json's public contract/return shape and #810's retry/backoff stay identical.

Key facts confirmed

• .agents[].run_workflow values are workflow display names (e.g. "Dev-Lead Agent", "AgentShield") — exactly the workflowName field gh run list --json returns, so a local select(.workflowName == $wf) is equivalent to the old server-side --workflow.
• Only gh run list call site is _run_json (line 446). Callers all pass run_workflow + the candidate cut; return shape must stay [{conclusion,createdAt,databaseId,workflowName}].

Implementation Checklist

• Add _repo_runs_cached <repo>: one gh run list --repo <repo> -L 1000 --json … per repo, memoized in a process-global _RUNS_CACHE assoc array; owns the [#803 split 1/2] _run_json: surface real error + exponential jittered backoff #810/[Fleet Monitor] petry-projects/.github — .github/workflows/canary-rollout.yml #738 retry/backoff/error-surfacing; fails CLOSED (non-zero, not cached) on sustained failure.
• Reduce _run_json <repo> <wf> <since> to: empty/wildcard guard → cached raw → local jq filter by workflowName == wf AND createdAt >= since (empty since = no lower bound). Return shape unchanged.

Tests to Write

• Two _run_json calls for the same repo but different workflows invoke gh exactly ONCE (per-repo cache) and each returns only its workflow's rows.
• Local workflow filter: rows of other workflows excluded.
• Local since filter: rows with createdAt before the cut excluded; empty since keeps all.
• gh is invoked with --repo and NOT --workflow/--created (burst-collapse proof).
• Existing [#803 split 1/2] _run_json: surface real error + exponential jittered backoff #810/[Fleet Monitor] petry-projects/.github — .github/workflows/canary-rollout.yml #738 retry/backoff/fail-closed tests stay green (payload-asserting ones query the workflow their stub returns).

Test Command

bats tests/canary_rollout.bats (plus bash .dev-lead/scripts/dev-lead-lint.sh)

[don-petry]

Dev-Lead: cannot implement issue #819 — needs human attention

A stage timed out (exit 124) while implementing this issue. A timeout is treated as a first-class, non-retryable condition — retrying with the same budget would just time out again — so this escalates for human review on the first occurrence instead of wasting a same-budget retry.

• Cause: timeout
• Tier: action
• Elapsed: 2101s
• Budget: 2100s
• Run: https://github.com/petry-projects/.github/actions/runs/29709627588

This hit the max action budget. Split this issue into smaller, independently-implementable pieces, or raise vars.ACTION_TIMEOUT_SEC, then re-apply the dev-lead label.

Note: the engine had produced changes before the timeout. They were on branch dev-lead/issue-819-20260720-0032 on the runner and were not pushed, so they are not recoverable from this run (the runner is ephemeral). The redacted session snippet below shows what it attempted — treat it as context, not restorable output. Re-apply dev-lead after splitting the issue or raising the budget to regenerate the work.

[don-petry]

Hand-fixed in #835 (worktree, dev-lead:hands-off) after 3 dev-lead timeouts at the 2100s action budget. The PR delivers this issue's cached-per-(repo,workflow) fetch and fixes the two defects the mode-B merges (#810/#821) introduced that were cancelling every Canary Rollout run since 02:44Z today: (1) "could not find any workflows named …" was retried 6× as transient → ~20-min sweep → cancel; (2) jq-on-empty exits 0 → executed + arithmetic syntax error. De-labeled dev-lead so the engine won't re-attempt; PR Review Agent will merge. Closes on #835 merge.