🧭 Idea Promotion Queue

[github-actions]

Legend: 🟢 Ripe — ready to promote now · 🟡 Soon — one gap to close · ⚪ Not yet / covered

---

🟢 Ripe to Promote

These are the pick-list for a human to bless. Add idea:approved to the Discussion to fire the BMAD Scrum Master initiative-planner.

Idea	Why now	Pre-drafted promotion note
#1842 Reusable Workflow Runtime Self-Identity for Live Drift Audit	GitHub shipped job.workflow_ref/job.workflow_sha on Sep 3 2026 — three weeks ago. The thin-caller ADR-0001 architecture and fleet_stub_drift.sh can absorb this immediately with no new dependencies. Directly addresses the drift-bug class from #1034.	Initiative: Extend fleet_stub_drift.sh and the reusable workflow template to emit a runtime identity assertion on each execution, comparing the resolved SHA against the expected channel tag. Drift caught live, not just in nightly lint, closes a detection gap that scheduled audits structurally cannot cover.
#1839 ARM64 Runner Migration for Fleet-Wide CI Cost Reduction	GitHub ARM64 runners for private repos launched Jan 2026 with a verified 39% pricing reduction. This org's CI is 100% bash/jq/Python with zero x86 binary dependencies — zero porting risk. The feature has been GA for 8 months with no reported issues.	Initiative: Migrate all scheduled utility workflows (fleet-monitor, compliance-audit, health-checks) to ubuntu-24.04-arm runners in a phased rollout starting with lowest-risk jobs, measuring actual minute savings against baseline before rolling to the PR-review cascade.
#1841 MCP Server Provenance Pinning with Hash Attestation for Review Tiers	A real-world malicious MCP server was disclosed in 2026; OX Security confirmed 10+ CVEs in Anthropic MCP SDKs affecting ~200K servers. This repo uses REVIEW_MCP_CONFIG for the deep review tier today — there is live exposure.	Initiative: Implement an MCP server allowlist (name + version + hash tuples in a committed file) with a pre-flight verification step in the MCP-enabled review invocation path, blocking any server update that has not been explicitly reviewed and promoted via a signed PR.
#1838 Non-Required Check Circuit Breaker for Merge Pipeline Resilience	A silent deadlock class exists today: one persistently failing non-required check causes every PR to appear CI-failing, halting the review pipeline with no fleet alert. ci-status.sh is the right insertion point and the circuit-breaker pattern is well-understood.	Initiative: Add a circuit-breaker detector to ci-status.sh that tracks N consecutive failures of a non-required check across M distinct PRs, degrades it from the CI-passing determination automatically, and fires a fleet-monitor alert — turning a silent deadlock into a noisy, self-healing degradation.
#1157 GitInject-Class PR Content Sanitization Layer for Review Pipeline Defense	The GitInject arXiv paper (Jun 2026) names GitHub Actions + Claude Code pipelines as the primary attack surface. OWASP reports a 340% YoY surge in prompt injection in CI/CD. review-one-pr.sh passes PR descriptions and commit messages to the LLM with no sanitization today.	Initiative: Add a pre-LLM sanitization stage to review-one-pr.sh that detects and neutralizes injection patterns (hidden instructions, role-override attempts, data-exfiltration commands) in PR descriptions, commit messages, and code comments before they reach any agentic tier.

---

🟡 Soon

Idea	What's missing before it's ripe
#1840 Confidence-Scored Issue Triage for Intelligent Auto-Routing	Needs a baseline measurement of the current triage false-positive rate (how many needs-human-review holds are actually auto-approvable). Without that number the confidence threshold is arbitrary and the initiative has no success criterion.
#1175 Agentic Persona Framework	The Kiro gap-closure epic (#1142) and the ADR-0007 agent-ingress rollout (#1723) are both in-flight and change where persona definitions live. Formalizing the framework before those settle risks immediate rework.
#636 OWASP Agentic Top 10 Security Posture Scoring	Strong direction, but #1157 (injection defense) and #1841 (MCP provenance) are higher-urgency remediations from the same threat model. Let those land first so the posture audit has real surface to score against.
#1041 Health-Check Issue Lifecycle Automation	Concrete and low-risk, but needs verification of the actual open-issue accumulation rate before scoping the de-duplication logic. The 15+ open daily issues claim needs a current count to define scope.
#1348 Evaluate Additional AI Code-Review Services	High urgency (CodeRabbit Free rate-limit is binding now), but this is an evaluation task, not a build initiative. Needs a defined benchmark harness and shortlist before promotion makes sense as an epic.
#1158 Canary Burn-Rate SLO with Post-Promotion Auto-Rollback	Extends the Safe Release initiative (#495), which has Phase 2 (#1623) in-flight. Wait for Phase 2 to close before adding the burn-rate SLO layer to avoid scope collision.

---

⚪ Not Yet / Covered

• When CI gets really good, what happens next? #1822 "When CI gets really good, what happens next?" — External vendor pitch (Tomosu product); not an org idea. Suggest closing or tagging external.
• 💡 Fable 5 Apex Tier + Opus 4.8 Upgrade for engine.sh Model Chains #562 Fable 5 Apex Tier + Opus 4.8 — Covered by open epics Opus 4.8 engine upgrade: validate the deep-review tier, finish the reference rollout, and keep cost data accurate #835 (Opus 4.8 engine upgrade) and approved 💡 Claude Sonnet 5 Engine Chain Integration with Introductory Pricing Capture #1039 (Sonnet 5 integration).
• Enable enhanced model selection for agents #413 Enable enhanced model selection — Subsumed by Opus 4.8 engine upgrade: validate the deep-review tier, finish the reference rollout, and keep cost data accurate #835/[Phase 1] Confirm Opus 4.8 standard pricing in model-pricing.tsv and lock it with a regression test #838 Opus 4.8 epics already in progress.
• 💡 Token Cost Observatory with Pre-Agentic Optimization #332 Token Cost Observatory — Covered by approved 💡 Pre-Agentic Data Gathering Pipeline for 60%+ Token Savings #563 (pre-agentic data gathering) and active epic Pre-agentic context prefetch for the PR-review cascade: eliminate redundant in-loop gh fetches across the agentic tiers, flag-gated and ET/eval-verified #1101 (pre-agentic context prefetch). High comment count but work is tracked.
• 💡 Sonnet 5 Tokenizer Inflation Forecasting for the Token Cost Observatory #1156 Sonnet 5 Tokenizer Inflation Forecasting — Moot: introductory pricing ended Aug 31, 2026; the forecast window this was scoped to has closed.
• 💡 Fleet-Wide Action Version Currency Probe with checkout v7 Backport Readiness #1155 Fleet-Wide Action Version Currency Probe — The immediate trigger (checkout v7 backport Jul 16) has already passed. Useful hygiene; revisit as a maintenance item rather than an urgent initiative.
• 💡 Eval-Score-Gated Canary Promotion for Quality-Aware Progressive Delivery #1042 Eval-Score-Gated Canary Promotion — Covered by Safe Release initiative (Initiative: Safe Release Strategy for Agentic Workflows (versioning · rings · canary) #495) and eval-gated skills initiative (Initiative: Eval-gated, human-reviewed self-improving skills (SkillOpt-style) #581), both with open epics.
• 💡 AWI Event-Context Input Sanitization for Agent Prompt Injection Defense #651 AWI Event-Context Input Sanitization — Substantially overlapped by 💡 GitInject-Class PR Content Sanitization Layer for Review Pipeline Defense #1157 (newer, more specific). If 💡 GitInject-Class PR Content Sanitization Layer for Review Pipeline Defense #1157 is promoted, merge 💡 AWI Event-Context Input Sanitization for Agent Prompt Injection Defense #651 into its scope.
• 💡 Anthropic Usage & Cost API Integration for Ground-Truth Budget Tracking #643 Anthropic Usage & Cost API — Downstream of Token Cost Observatory (💡 Token Cost Observatory with Pre-Agentic Optimization #332), which isn't yet approved. Revisit after 💡 Token Cost Observatory with Pre-Agentic Optimization #332 lands.
• 💡 GitHub Agentic Workflows Coexistence Evaluation for Utility Automation #652 GitHub Agentic Workflows Coexistence — Still public-preview; GA status needed before committing utility workflows. Track for Q4.
• Implement GitHub Agentic workflows #228 Implement GitHub Agentic Workflows — Superseded by the more-scoped 💡 GitHub Agentic Workflows Coexistence Evaluation for Utility Automation #652.
• 💡 Agent Pipeline Stall Detector & Automatic Recovery Escalation #791, 💡 Stacked PR Awareness for Review and Dev-Lead Pipelines #792, 💡 Stale-Base Semantic Revert Detection Guard #790 Stacked PR awareness / stall detector / stale-base guard — Concrete but no recent human engagement; below urgency threshold.
• TEST(875-revalidate): bridge fix #973, TEST(875): single-idea enhancement validation #958 TEST discussions — Harness test artefacts, not real ideas.
• Enhanced Prompting Frameworks #851, Evaluate additional providers, models, and optimizations #631, Market Research and Ideation: Agentic SWE Bots for GitHub Integration #177, Evaluate Goal based criteria for dev-lead #427, RFC: Deterministic pre-agentic review gate to cut token burn (draft-until-green) #743, Idea: Adopt pi as Org-Wide Terminal Coding Agent Harness #283 — Older or vague; no recent engagement above noise floor.
• 💡 Complexity-Aware Dynamic Model Routing for Cost-Optimized PR Review #564, 💡 Effective Token (ET) Anomaly Alerting with Runaway Session Detection #565, 💡 Shadow Mode Dual-Run for Safe Agent Canary Validation #566, 💡 LSP-Grounded Finding Verification for PR Review False-Positive Reduction #594, 💡 Per-Tier MCP Tool Gating with Selective LSP Tool Exposure #595, 💡 Token Cost Observatory LSP Metrics: Measuring the ROI of Semantic Code Intelligence #596, 💡 OpenTelemetry GenAI Semantic Conventions for Agent Harness Observability #634, 💡 Structured Agent Decision Audit Trail with Provenance Export #637, 💡 GitHub Models API Multi-Model Chains for the Copilot Engine Tier #642 — Good ideas, low urgency vs. the Ripe set; revisit next triage pass.

---

Already Approved (past triage)

These carry idea:approved and are active in the initiative pipeline — listed for reference, not re-ranked.

• Approved: one agent-ingress stub per repo — webhooks are not the lever (ADR-0007) #1711 — One agent-ingress stub per repo (ADR-0007 accepted)
• Architectural integrity in the agentic delivery model — what enforces our standards, and where does the Solution Architect fit? #1360 — Architectural integrity in the agentic delivery model
• Formalize the agentic PR-interaction model (event-first, timers-as-backstop) — clear, repeatable, enforceable #1400 — Formalize the agentic PR-interaction model (event-first, timers-as-backstop)
• 💡 Adversarial Plan-Critic + Structural Gates for the Initiative-Planner (Bob) #593 — Adversarial Plan-Critic + Structural Gates for initiative-planner (Bob)
• 💡 Pre-Agentic Data Gathering Pipeline for 60%+ Token Savings #563 — Pre-Agentic Data Gathering Pipeline for 60%+ token savings
• 💡 Fleet-Wide Stub Drift Auto-Remediation via Automated PRs #1043 — Fleet-Wide Stub Drift Auto-Remediation via Automated PRs
• Gap Analysis: Kiro by AWS #1118 — Gap Analysis: Kiro by AWS
• 💡 Gemini Engine Model Currency Refresh: Migrate Deprecated gemini-2.0-flash References #641 — Gemini Engine Model Currency Refresh
• Idea: add LSP (language-server) tooling to the dev-lead / pr-review agent harness #578 — LSP tooling for dev-lead / pr-review agent harness
• 💡 Claude Sonnet 5 Engine Chain Integration with Introductory Pricing Capture #1039 — Claude Sonnet 5 Engine Chain Integration
• Enhance PR Review Agent pipeline #906 — Enhance PR Review Agent pipeline
• Initiative: unify Discussion-triggered ideation into a feature-ideation mode, deprecate idea-enhancer, and roll out fleet-wide via canary rings #866 — Unify Discussion-triggered ideation, deprecate idea-enhancer
• Create a GitHub template repository to scaffold new petry-projects repos with org standards #962 — GitHub template repository for org scaffold
• Initiative: Fleet-enable the initiative-driver (per-repo stub → central driver, target_repo) #877 — Fleet-enable initiative-driver (per-repo stub → central driver)

---

To promote an idea: open the linked Discussion and add the label idea:approved. The initiative-planner.yml workflow fires automatically and the BMAD Scrum Master (Bob) drafts the initiative plan as a new epic.