[Fan-out] dev-lead self-host pin (trigger stub + reusable-only + agent_ref)

Parent: #497 · Work type: Infra · Fan-out (B).

Apply the proven pr-review self-host pattern to dev-lead: split dev-lead.yml (currently inline, directly event-triggered) into a thin trigger stub + reusable invoked at @dev-lead/stable, threading an agent_ref so dev-lead's own scripts run at the pinned version too. Breaks dev-lead's self-hosting circular dependency for ring 0.

Acceptance: .github-private's dev-lead runs @dev-lead/stable; promotion = moving the dev-lead/stable tag; validated on a real dev-lead pickup. Cut dev-lead/v1.1.0+ as needed via cut-release.sh.

See #497 (pr-review reference implementation: PRs #513/#519/#523).

feat(dev-lead): add agent_ref input for pinned script checkout (#535/#…

Drift analysis (gating the inline→stub conversion)

Increment 1 DONE: agent_ref input added to dev-lead-reusable.yml (PR #537); dev-lead/v1.1.0 cut, dev-lead/stable → v1.1.0.

Inline (dev-lead.yml, 352L) vs reusable (dev-lead-reusable.yml, 387L) have diverged:

Same 2 jobs (dispatch, ci-relay).
Inline calls scripts/dev-lead-ci-relay.sh; the reusable inlines ci-relay (no script call).
Inline runs scripts in-place; the reusable uses a cross-repo .dev-lead/ sub-checkout model.

⚠️ So converting inline → stub-calling-the-reusable is not a safe drop-in — it would change ci-relay behavior and script paths for .github-private's own dev-lead. dev-lead is the most central agent (a bad conversion halts all issue implementation).

Recommendation: before the conversion, reconcile the reusable to be a verified superset of the inline (port/align ci-relay; confirm the .dev-lead/ model is equivalent), then convert + validate on a real dev-lead pickup. This is a deliberate task, not a quick flip. Acute crisis (stuck approvals) is already resolved via pr-review, so this can be done carefully.

Note: dev-lead/stable is now a real pinned release (v1.1.0), so #536 consumer pinning of @dev-lead/stable is technically unblocked for the pr-review path; keeping #536 blocked-by #535 enforces ring-0-first discipline for dev-lead.

fix(dev-lead): self-host pin to @dev-lead/stable + agent_ref (#535) (#…

#535 acceptance met ✅ (ring-0 self-host pin)

.github-private's dev-lead now runs @dev-lead/stable with agent_ref — the ring-0 self-host circular dependency is broken.

Done:

fix(dev-lead): self-host pin to @dev-lead/stable + agent_ref (#535) #554 (merged): pinned .github-private/dev-lead.yml from dev-lead-reusable.yml@main → @dev-lead/stable, threading agent_ref: dev-lead/stable.
No reconciliation needed: audit found dev-lead.yml was already a thin trigger stub and dev-lead-reusable.yml already held the logic — the split pre-existed. This was purely the version pin.
No regression: dev-lead/stable was first advanced v1.1.0 → v1.2.0 (= current main) because v1.1.0 was 84 lines behind, missing feat: implement issue #395 — Compliance: non-stub-dev-lead.yml #488's ci-relay commits-to-pulls fallback + exit-2 soft-skip handling.

Validated on a real pickup (run 27307027856, post-merge pull_request event):

Uses: …/dev-lead-reusable.yml@refs/tags/dev-lead/stable (d827464)
agent_ref: dev-lead/stable → ref: dev-lead/stable
INTENT_TYPE: review-changes → completed/success

Follow-up (separate issue, parallels #536): consumer fan-out — markets/ContentTwin/google-app-scripts/bmad-bgreat-suite still call dev-lead-reusable.yml@main; convert them to @dev-lead/stable + agent_ref so the whole fleet runs the pinned channel. Promotion of dev-lead releases is then a central tag move.

Ready to close (ring-0 scope complete).

🤖 Generated with Claude Code

feat(dev-lead): add agent_ref input for pinned script checkout (#535/#…

fix(dev-lead): self-host pin to @dev-lead/stable + agent_ref (#535) (#…

feat(dev-lead): add agent_ref input for pinned script checkout (#535/#…

fix(dev-lead): self-host pin to @dev-lead/stable + agent_ref (#535) (#…

feat(dev-lead): add agent_ref input for pinned script checkout (#535/#…

fix(dev-lead): self-host pin to @dev-lead/stable + agent_ref (#535) (#…

feat(dev-lead): add agent_ref input for pinned script checkout (#535/#…

fix(dev-lead): self-host pin to @dev-lead/stable + agent_ref (#535) (#…

feat(dev-lead): add agent_ref input for pinned script checkout (#535/#…

fix(dev-lead): self-host pin to @dev-lead/stable + agent_ref (#535) (#…