[Decision] Fan out the ADR-0007 ingress collapse to the rest of the fleet: go/no-go, repo order, and runbook, using the markets pilot evidence #2177

Problem

Epic #1723 collapses ONE repo (the pilot, petry-projects/markets, collapse PR markets#513 merged 2026-10-10). It records, as still open and deliberately out of scope, the fleet fan-out, and says #1729 must record what the single-repo rename actually cost "as the input to the fan-out initiative". It also records the ADR-0007 position (exactly one ingress per repo) as something "the pilot should settle for real". No issue holds either decision, so the fan-out has no home and no gate. This is that home. Held, so it does not start before the evidence exists.

What the pilot has already taught (use as inputs, do not re-derive)

• Per-repo cost was high and almost all of it was process, not the file. The collapse itself is two files (add the ingress, delete the stubs). Getting it merged took many rounds, driven by the review gate, not by the collapse. See the pr-review defects in pr-review process defects found driving the ADR-0007 pilot (false hard-stop, empty fix-requested, silent no-op, gate counts maintainer comments, unwired bypass, edited-comment deadlock, self-dismissed approvals) #2173 and the gate deadlocks in Edited-after-disposition deadlock: fix-reviews never re-dispositions an edited CodeRabbit summary, so pr-review's gate holds the PR forever (#2008 follow-up) #2166, Restore the human @mention break-glass: mention listener must send force_review only for trusted human comment mentions (#2034 follow-up) #2082.
• Fleet scripts had to be made ingress-aware, and three gaps were found only by the pilot. Ten scripts were already ingress-aware (from [Phase 1] Author the agent-ingress.yml canonical structure and freeze the if:-as-event-filter boundary #1724-[Phase 2] Teach the interaction-model section 4 table and validate-interaction-model about a multi-role ingress file #1728 work); the pilot then needed deploy-standard-workflows.sh (it re-created the deleted stubs and double-dispatched; ADR-0007 collapse: standards-deploy RESURRECTS three collapsed stubs (double dispatch), and the agent rate-limit guard FAILS OPEN on a collapsed repo .github#1226, fixed in docs: refresh org READMEs (automated) #1239), the agent rate-limit guard (it failed open on a collapsed repo; same issue), and canary-rollout.sh attribution (the health gate went blind; canary-rollout health gate goes blind on an ADR-0007 collapsed repo: it resolves runs by per-role workflow NAME, which the ingress replaces with jobs .github#1224, fixed in petry-projects — workflow failures detected 2026-07-14 #1238). Follow-ups remain: canary-rollout: ingress attribution follow-ups from the #1238 review (pre-adoption runs, decision-class read failures, role scoping) .github#1244, docs: refresh org READMEs (automated) #1246, fix(fleet-monitor): token-usage summary step must not fail the whole monitor #1247, feat(readme-refresh): agentic-workflow fleet + working file links + agent-desc fix #1259. A fan-out should assume more such consumers exist and sweep for them first.
• A consumer's pin moves inside the ingress. The fleet repin tooling must handle per-job uses: in an ingress file (see the comment on Fleet pr-review callers pin legacy bare pr-review/stable and are unmanaged — no pr-review release can reach the fleet .github#1125).
• The ingress is not a verbatim copy of the package. markets' ingress needed two deliberate deviations from the ratified package (a pr-auto-review group and a Dependabot-bumped analyst pin); the package is being synced in Sync the markets collapse package §3/§4b to the deployed ingress (pr-auto-review group + ci-failure-analyst pin) #2171.
• Two pre-existing caller weaknesses are now baked into every collapsed repo until fixed: the analyst loop guard and no-PR handling (ci-failure-analyst caller: the self-exclusion guard never matches a real check name, and no-PR failures still start the analyst #2175), and the bare-SHA analyst pin (markets ingress pins ci-failure-analyst by bare commit SHA (DEFECTIVE PIN): move it to a channel once stable is no longer frozen #2176).

Decide (after the pilot evidence exists)

1. Go / no-go on the fan-out, with the pilot's measured numbers: the post-collapse billed-run count and skip-kind measurement ([Phase 3] Collapse the first repo's Class-1 event-driven stubs into agent-ingress.yml and rename the required checks #1729 AC5/AC10), and one observed run per collapsed role (AC7, linked on markets#506).
2. OQ3 from the epic, still open: required-check rename sequencing across all 8 consumer repos without a merge freeze. markets was safe because none of the five roles was a required check; other repos may differ (package §6, §8d). Survey each target repo's ruleset first.
3. Confirm or revisit "exactly one ingress per repo" against what the pilot showed (concurrency groups needed hand-rewriting; per-event slots vs per-commit slots).
4. Which repos, in what order, and who runs it. Candidates are the leaf consumers; exclude repos whose workflows are not true thin callers (the reason .github-private was rejected as the pilot).
5. A per-repo runbook (pre-merge gate = package §8a, rollback = revert the collapse PR, required-check name mapping §6) so the next repos don't repeat the pilot's rounds.

Blocked by

#1729 AC4 / AC5 / AC7 / AC10 / AC11 and the review-gate defects in #2173 (a fan-out through the current gate would repeat the pilot's cost in every repo).

Acceptance criteria

1. A written go/no-go with the pilot numbers cited.
2. If go: one tracking issue per repo (or per batch) with the runbook linked.
3. The "exactly one ingress" decision is recorded (confirmed, or a new ADR proposed).