[Phase 4] Wire opt-in remediation into the fleet-monitor workflow behind a human go/no-go

[github-actions]

Story

As a fleet platform maintainer,
I want add an opt-in, DRY_RUN-default remediation step to the fleet monitor (after drift detection) with a workflow_dispatch input to go live for the pilot repo, and record the go/no-go decision,
so that remediation runs on the same cadence as detection without ever going live by accident.

Acceptance Criteria

1. actions-fleet-monitor.yml gains an opt-in remediation step (or a sibling workflow) that runs scripts/fleet_stub_remediate.sh AFTER fleet_stub_drift.json is produced, consuming that artifact.
2. The step defaults to DRY_RUN=true; going live requires an explicit workflow_dispatch input (e.g. remediate=live) AND the Phase-3 pilot scope — scheduled monitor runs never remediate live.
3. The step runs under the credential confirmed in the epic's untracked prerequisite to have cross-repo contents:write + pull_requests:write; if that credential is absent, the step degrades to dry-run with a ::warning:: and never fails the monitor.
4. The human go/no-go for enabling live pilot remediation (and, later, fleet-wide) is recorded (issue/PR/discussion comment), consistent with the repo's go/no-go pattern.
5. AGENTS.md documents the remediation loop: the allowlist, the pilot gate, the per-run cap, and the DRY_RUN default.
6. Existing workflow lint passes; the change edits the org-private monitor workflow (not a thin-caller stub), so the thin-caller no-edit constraint is not violated.

Tasks / Subtasks

• Add the remediation step to actions-fleet-monitor.yml in the job that already runs fleet_monitor.sh and emits fleet_stub_drift.json, after the report/dispatch steps. (AC: test issue from agent #1)
• Add a workflow_dispatch input (remediate: dry-run|live, default dry-run) and gate live behind it plus the pilot scope. (AC: Go-live improvements for PR review agent #2)
• Run the step under the confirmed cross-repo-write credential; degrade to dry-run + ::warning:: when unavailable. (AC: Add @claude delegation, auto-merge, and rebase handling #3)
• Record the human go/no-go for pilot enablement (comment on the tracking issue/PR). (AC: Optimize review: small-PR and incremental fast paths #4)
• Document the remediation loop, allowlist, pilot gate, cap, and DRY_RUN default in AGENTS.md. (AC: feat: add Copilot engine support via REVIEW_ENGINE toggle #5)
• Confirm workflow lint / actionlint passes and no thin-caller stub is modified. (AC: feat: feature ideation framework — adversarial proposer/challenger/synthesizer #6)

Dev Notes

• actions-fleet-monitor.yml already runs fleet_monitor.sh, emits fleet_stub_drift.json, sets HAS_STUB_DRIFT, and dispatches dev-lead on drift — add the remediation step in that same job after the existing report/dispatch steps so it consumes the already-written artifact. [Source: .github/workflows/actions-fleet-monitor.yml]
• This workflow is org-private automation, NOT a thin-caller stub, so it may be extended (unlike claude.yml / agent-shield.yml / auto-rebase.yml). [Source: CLAUDE.md, AGENTS.md]
• DRY_RUN-default + explicit-dispatch-to-go-live matches the repo's dry-run-first canary pattern; the credential fallback-to-warning matches fleet_monitor.sh's token-degradation posture (::warning:: instead of failing). [Source: scripts/fleet_monitor.sh, AGENTS.md]
• The go/no-go record is the human gate before widening from pilot to fleet-wide; keep the epic inert until that decision is made (consistent with the initiative-planner inert-epic model).

Project Structure Notes

Edits the org-private .github/workflows/actions-fleet-monitor.yml plus an AGENTS.md docs section; no new scripts.

References

• .github/workflows/actions-fleet-monitor.yml
• scripts/fleet_monitor.sh
• AGENTS.md
• CLAUDE.md

Likely target surface

• .github/workflows/actions-fleet-monitor.yml
• AGENTS.md

Story prepared by the BMAD Scrum Master (Bob) for epic #1148. Status: ready-for-dev.

[don-petry]

Dev-Lead Implementation Plan

Issue: #1152 — [Phase 4] Wire opt-in remediation into the fleet-monitor workflow behind a human go/no-go

Scope

Wire the already-built scripts/fleet_stub_remediate.sh into actions-fleet-monitor.yml as an opt-in, DRY_RUN-default step that only goes live on an explicit workflow_dispatch remediate=live input plus the Phase-3 pilot scope, degrading to dry-run with a ::warning:: (never failing the monitor) when the cross-repo write credential is absent.

Implementation Checklist

• Add scripts/fleet_remediate_gate.sh — a pure go/no-go gate that decides DRY_RUN vs. live from (event_name, remediate_mode, token_present, pilot_present) and emits the degrade-to-dry-run ::warning:: (keeps the wiring logic unit-testable, in the repo's pure-helper style).
• Add a remediate: dry-run|live workflow_dispatch input (default dry-run) to actions-fleet-monitor.yml — dispatch-only, so scheduled / workflow_call runs can never go live.
• Add the remediation step to the health-check job AFTER the drift report/dispatch steps, consuming the already-written fleet_stub_drift.json; runs under GH_PAT_WORKFLOWS, continue-on-error: true, pilot via vars.FLEET_REMEDIATE_PILOT_REPO, cap via vars.FLEET_REMEDIATE_MAX_REPOS (default 1).
• Register tests/fleet_remediate_gate.bats in the lint.yml bats list.
• Document the remediation loop in AGENTS.md: allowlist, pilot gate, per-run cap, and DRY_RUN default.
• Record the human go/no-go for pilot enablement as a comment on this issue (currently NO-GO / inert until a human flips it).

Tests to Write

• tests/fleet_remediate_gate.bats: schedule/workflow_call events always dry-run; workflow_dispatch+remediate=dry-run → dry-run; workflow_dispatch+remediate=live+token+pilot → live; live requested but token absent → dry-run + ::warning::; live requested but pilot absent → dry-run + ::warning::.

Test Command

bash scripts/run-bats.sh tests/fleet_remediate_gate.bats tests/fleet_stub_remediate.bats and bash .dev-lead/scripts/dev-lead-lint.sh

[don-petry]

Go/No-Go record — live pilot stub-drift remediation (#1152, epic #1148)

Per AC #4, recording the human go/no-go gate for enabling live pilot remediation. Consistent with
the repo's go/no-go / initiative-planner inert-epic pattern, the loop ships inert and stays that way
until a human explicitly flips a run to live.

Current decision: 🔴 NO-GO (inert / dry-run)

The remediation step is wired onto the Fleet Monitor's cadence but runs strictly dry-run:

• Scheduled and workflow_call runs can never go live (gate hard-codes them to dry-run).
• No pilot repo is configured yet (vars.FLEET_REMEDIATE_PILOT_REPO unset ⇒ fail-closed to dry-run).

To record a GO (enable the live pilot), a maintainer must:

1. Confirm GH_PAT_WORKFLOWS carries cross-repo contents:write + pull_requests:write on the pilot
   repo (the epic's untracked prerequisite). If absent, the step self-degrades to dry-run with a ::warning::.
2. Set repo variables:
   • FLEET_REMEDIATE_PILOT_REPO = the single pilot repo (e.g. petry-projects/<pilot>).
   • FLEET_REMEDIATE_MAX_REPOS = 1 (default; per-run cap).
3. Manually workflow_dispatch Actions Fleet Monitor with input remediate: live.
4. Comment GO on this issue naming the pilot repo + the maintainer approving, so the decision is auditable.

Widening from pilot → fleet-wide is a separate future GO recorded the same way. Until a GO is recorded
here, this change is a no-op on every scheduled run.

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Added scripts/fleet_remediate_gate.sh — pure go/no-go gate deciding DRY_RUN vs. live from (event, mode, token_present, pilot_present), warning + degrading on any missing live precondition.
• Added remediate: dry-run|live workflow_dispatch input (default dry-run, dispatch-only) to actions-fleet-monitor.yml.
• Wired the remediation step into the health-check job AFTER the drift report/dispatch steps, consuming fleet_stub_drift.json; runs under GH_PAT_WORKFLOWS, continue-on-error: true, pilot via vars.FLEET_REMEDIATE_PILOT_REPO, cap via vars.FLEET_REMEDIATE_MAX_REPOS (default 1).
• Registered tests/fleet_remediate_gate.bats in the lint.yml bats list.
• Documented the remediation loop (allowlist, pilot gate, per-run cap, DRY_RUN default) in AGENTS.md.
• Recorded the human go/no-go (NO-GO / inert until a maintainer flips a run to remediate=live) in a comment above.

Test Results

ok 35 driver: per-run cap defers repos beyond REMEDIATE_MAX_REPOS (no silent truncation, AC #2)
ok 36 driver: emits a per-repo drift-closed verification summary (log + artifact, AC #3)
ok 37 driver: a byte-identity mismatch is reported drift-closed=no in the summary (AC #3, #5)
ok 38 driver: an idempotent skip (existing PR) reports status=skipped, NOT drift-closed=yes (AC #3)
ok 39 driver: a non-numeric REMEDIATE_MAX_REPOS fails loud (never a bad -ge comparison, AC #2)
ok 40 pilot helpers: _in_pilot matches a named repo and fail-closes on empty (AC #1, #4)

Also green: bash .dev-lead/scripts/dev-lead-lint.sh (shellcheck 92 files + agent profiles), actionlint (exit 0), validate-workflow-schedules.sh (no minute-0 crons), YAML parse.

Files Changed

• .github/workflows/actions-fleet-monitor.yml: new remediate dispatch input + opt-in, DRY_RUN-default remediation step (non-blocking, credential/pilot-gated).
• scripts/fleet_remediate_gate.sh (new): pure go/no-go gate.
• tests/fleet_remediate_gate.bats (new): 10 tests covering the gate matrix.
• .github/workflows/lint.yml: registered the new bats file.
• AGENTS.md: "Fleet stub-drift remediation loop" section.

Notes

• AC feat: feature ideation framework — adversarial proposer/challenger/synthesizer #6: actions-fleet-monitor.yml is the canonical org-private monitor (not a thin-caller stub), so the no-edit constraint is not violated.
• Live remediation is defense-in-depth gated: workflow_dispatch + remediate=live + GH_PAT_WORKFLOWS + a configured pilot repo — any missing precondition degrades to dry-run with a ::warning:: and never fails the monitor. workflow_call cannot set remediate, so callers can never go live.
• No new scheduled workload: the step runs inline in the existing daily monitor job.
• Enabling the live pilot is an ops action (set the two repo variables + dispatch live + record GO) — no further code change needed.

[don-petry]

Go/no-go — recorded (AC #4)

Decision: GO to land the Phase-4 opt-in remediation wiring (PR #1275), given by the fleet maintainer on 2026-07-16.

Scope of this GO: merge the wiring only. This does not turn live remediation on. Per the gate (scripts/fleet_remediate_gate.sh), a run only goes live when all of these hold together:

1. an explicit workflow_dispatch with remediate=live,
2. the cross-repo write credential (GH_PAT_WORKFLOWS) present, and
3. a configured pilot repo (vars.FLEET_REMEDIATE_PILOT_REPO).

Scheduled/workflow_call monitor runs remain DRY_RUN unconditionally, and the step is continue-on-error so it can never fail the daily monitor.

Still gated (separate, deliberate step — NOT done here): enabling an actual live pilot run requires setting vars.FLEET_REMEDIATE_PILOT_REPO and manually dispatching the monitor with remediate=live. That first live pilot dispatch is its own go decision when the maintainer chooses to exercise it.