Compliance: non-stub-agent-shield.yml

[don-petry]

Compliance Finding

Category: ci-workflows
Severity: error
Check: non-stub-agent-shield.yml

Detail

Centralized workflow agent-shield.yml references the reusable but is not pinned to the major-scoped channel @agent-shield/v<M>-next (org standard — a bare @agent-shield/next tier pin is drift). Replace with the canonical stub from standards/workflows/agent-shield.yml which delegates to petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v<M>-next.

Standard Reference

standards/ci-standards.md#centralization-tiers

Remediation

Copy the relevant workflow template from standards/workflows/ verbatim — do not generate from scratch:

gh api repos/petry-projects/.github/contents/standards/workflows/<template>.yml --jq '.content' | base64 -d > .github/workflows/<template>.yml

Available templates: agent-shield.yml, dev-lead.yml, dependabot-automerge.yml, dependabot-rebase.yml, dependency-audit.yml, feature-ideation.yml

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Dev-Lead: Cannot Implement — Target File Is Agent-Immutable

This finding requires modifying .github/workflows/agent-shield.yml. That file is on the org's structurally-immutable / agent-must-not-modify list, so I am not opening a change for it. This must be routed to human-reviewed remediation instead.

Why this is blocked

The exemption is documented in three authoritative places:

1. Local AGENTS.md (this repo), "Workflow Files":

   Do not modify .github/workflows/agent-shield.yml — this is exempted from agent modification per standards/agent-standards.md.

2. petry-projects/.github → standards/agent-standards.md, "Compliance Exemptions — Files Agents Must Not Modify":

   The following files are structurally immutable. Agents must not open PRs that modify them. No compliance finding will ever require a change to these files; if an existing agent-created PR touches them, close it without merging.

   | .github/workflows/agent-shield.yml | Security boundary — agents are not permitted to weaken security scanning; changes require explicit human review |

3. petry-projects/.github → standards/workflow-exemptions.json (canonical source):

   { "path": ".github/workflows/agent-shield.yml",
     "reason": "Security boundary — agents cannot weaken security scanning",
     "requires_human_review": true }

Per standard #2, a compliance finding must never drive an agent change to this file — which makes this issue self-conflicting: it asks the dev-lead agent to do the one edit the standard forbids it from doing.

The underlying drift is real (but human-owned)

For transparency, the finding's substance is accurate:

• Current pin (local): ...agent-shield-reusable.yml@agent-shield/stable — a bare tier tag, not major-scoped.
• Canonical stub (petry-projects/.github → standards/workflows/agent-shield.yml): ...agent-shield-reusable.yml@agent-shield/v2-stable — major-scoped.

So the local stub is one major-scope behind the canonical template. Note also a discrepancy in this issue's own prose: it says the canonical stub delegates to @agent-shield/v<M>-next, but the actual canonical template pins @agent-shield/v2-stable (the stable tier, not next). That mismatch is a further reason to route this to a human rather than auto-apply.

Correct remediation path

Per agent-standards.md, these files are:

adopted verbatim from standards/workflows/ and updated only by merging a standards PR from petry-projects/.github, which propagates the canonical stub.

Recommended:

• Human maintainer propagates the canonical standards/workflows/agent-shield.yml (pinning @agent-shield/v2-stable) into this repo via the standards-sync path, with explicit review (security boundary).
• The compliance-audit should add .github/workflows/agent-shield.yml to its exemption list so non-stub-agent-shield.yml stops filing agent-directed findings against an agent-immutable file (it reads standards/workflow-exemptions.json as canonical).

Files changed

None. No source files were modified, consistent with the immutability exemption.

[don-petry]

Dev-Lead: Finding cannot be actioned by an agent — file is a compliance exemption

I investigated this finding and am declining to modify .github/workflows/agent-shield.yml, because the org standard explicitly forbids agents from touching this file and states that no compliance finding may require a change to it.

Authoritative conflict

.github/workflows/agent-shield.yml is on the org immutable-files list:

• petry-projects/.github → standards/agent-standards.md, §"Compliance Exemptions — Files Agents Must Not Modify":

  The following files are structurally immutable. Agents must not open PRs that modify them. No compliance finding will ever require a change to these files; if an existing agent-created PR touches them, close it without merging.

  | .github/workflows/agent-shield.yml | Security boundary — agents are not permitted to weaken security scanning; changes require explicit human review |

• petry-projects/.github → standards/workflow-exemptions.json (canonical source):

  { "path": ".github/workflows/agent-shield.yml", "reason": "Security boundary — agents cannot weaken security scanning", "requires_human_review": true }

• This repo's AGENTS.md (lines 22–23) restates it: "Do not modify .github/workflows/agent-shield.yml — this is exempted from agent modification per standards/agent-standards.md."

Per the standard, this file "must be adopted verbatim from standards/workflows/ and updated only by merging a standards PR from petry-projects/.github", i.e. through human review — not an agent-authored PR.

On the finding's substance

There is a small real drift, but the finding's specifics are inaccurate:

	Claimed in issue	Actual
Current pin in this repo	@agent-shield/next	@agent-shield/stable
Canonical template pin	@agent-shield/v<M>-next	@agent-shield/v2-stable

So the genuine delta is @agent-shield/stable → @agent-shield/v2-stable (bare-tier → major-scoped stable channel). This is a legitimate drift, but remediating it on this file is a human-review action routed through a standards propagation from petry-projects/.github, not an agent change.

Recommendation

• No agent PR will be opened for this issue.
• Route the stable → v2-stable repin through the standards-propagation path (human-reviewed), which updates all consumer repos.
• The compliance-audit check non-stub-agent-shield.yml should be taught to exclude files on standards/workflow-exemptions.json so exempt files stop generating findings that no agent is permitted to fix.
• Suggest closing this issue as won't-fix (agent-exempt) or reassigning to a human owner.