[kiwidream]

	Files	Added	Deleted	Net
Test	3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​62	$\color{#cf222e}{\Huge{\mathbf{−}}}$​3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​59
Prod	2	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​45	0	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​45

ELI5

When the fork publishes a new build, the dev VMs should move to it. SwapLabsInc/SwapLabs's pin workflow does that, but it only checks once an hour. This makes the fork's release workflow tap it on the shoulder the moment a build goes live.

What Changed

• Before: a published fork release reached the minidev fork hosts only after the Orca fork pin workflow in SwapLabsInc/SwapLabs next ran on its hourly schedule. That workflow already accepts an orca-fork-release repository dispatch, but nothing sent one.
• After: a new notify-devvms job in .github/workflows/swaplabs-build.yml runs after publish, only when the release actually went live. It sends that dispatch, with the tag in the payload.
  • It holds no GITHUB_TOKEN permission (permissions: {}).
  • It reads one new secret, SWAPLABS_DEVVMS_DISPATCH_TOKEN.
  • Without the secret, or if the dispatch fails, it prints a notice or warning and the build stays green. The hourly check is the fallback.
• docs/reference/swaplabs-fork-builds.md gains "Waking the devvms pin", which says what token to create.

Why

• Why a token: GITHUB_TOKEN is scoped to this repository and can't dispatch to another. A fine-grained token limited to SwapLabsInc/SwapLabs with Contents read and write is the narrowest thing the dispatches API accepts.
• Why a separate job: keeping the token out of every other job leaves the secret boundary checkable. The mac-signing contract test now asserts that this job reads this secret and nothing else, and that no other job reads it.
• Why never fail the build: the release is already live by then, and the hourly check is a complete fallback. A red build here would suggest a broken release that isn't one.

Linked Issue

None. Fork-only; the SwapLabs side is SwapLabsInc/SwapLabs#114 (the pin workflow's repository_dispatch trigger), stablyai#116 (smoke test plus auto-merge) and stablyai#117 (the host timer).

Visual Proof

N/A. CI only.

Testing

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

• New config/scripts/swaplabs-build-workflow-devvms-notify.test.mjs:

  • the job runs only after a live publish, with no permissions, reading only this secret;
  • with a token, the dispatch carries the event type and the tag (run against a stand-in gh);
  • no token, or a failing gh, still exits 0 with a notice or warning.

• The existing contract tests keep their rules, with a narrow exception for this job. "Every gh call stays on this repository" exempts notify-devvms only. The secret-names test allows exactly this one extra secret, in this job only.

• vitest on the three workflow test files: 59 passed. oxlint and oxfmt are clean on the changed tests. actionlint reports only the SC2016 already on swaplabs/main.

Needs the operator: create the fine-grained token and set it with gh secret set SWAPLABS_DEVVMS_DISPATCH_TOKEN -R SwapLabsInc/orca. Until then the job only prints its notice.

AI Disclosure

Written by Claude Opus 5.5 (Claude Code).

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[tenki-reviewer]

Review complete. No blocking issues — approved ✅; 1 nitpick below.

🧹 Nitpicks (1) — 🟢 1 low

• 🟢 Assertion message omits result.stdout (swaplabs-build-workflow-devvms-notify.test.mjs:29) — The new test at config/scripts/swaplabs-build-workflow-devvms-notify.test.mjs:29 passes result.stderr alone as the assertion message, unlike all five sibling assertions in the codebase which use a combined `${result.stdout} ${result.stderr}`.

---

Adds a SwapLabs fork build workflow (GitHub Actions) with mac signing, dev-VM notification, and new workflow-consistency test scripts plus reference docs.

_{Reviewed commit: d88c5df}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-28T18:11:58.750898Z	d88c5df	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d88c5df67f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Run the notification after post-publish failures

When Publish the verified release succeeds but the following Prune old fork releases step fails—for example, if the gh release list command at lines 897–898 encounters a transient error—the release is already live and the published output is true, but the publish job result is failure. GitHub Actions implicitly adds success() to a job-level condition without a status-check function, so this job is skipped and the dev VMs wait for the hourly fallback. Include always() in this condition while retaining the published == 'true' check.

Useful? React with 👍 / 👎.