ADR-0007 collapse: standards-deploy RESURRECTS three collapsed stubs (double dispatch), and the agent rate-limit guard FAILS OPEN on a collapsed repo

[don-petry]

Summary

Two more consumers in this repo resolve agent identity in a way the ADR-0007 collapse breaks. Both bite the pilot repo (petry-projects/markets, petry-projects/.github-private#1729, companion petry-projects/markets#506). Sibling of #1224 (canary-rollout), same root cause: identity keyed on per-role workflow name/path, which the ingress replaces with jobs.

Found by sweeping both org-infra repos for identity consumers. Ten scripts in .github-private were already made ingress-aware (#1724/#1725/#1726/#1727); nothing in this repo was.

---

Gap 1 — deploy-standard-workflows.sh re-creates the deleted stubs (double dispatch)

SKIP_REPOS=(".github" ".github-private"), so markets is a deploy target. DEPLOYABLE_WORKFLOWS contains three of the five stubs the collapse deletes:

pr-review-mention.yml
dev-lead.yml
pr-auto-review.yml

After markets lands the collapse, the next standards sweep deploys those three templates back from standards/workflows/. The repo then has both agent-ingress.yml and the per-role stubs subscribing to the same events — so dev-lead, pr-review-mention and pr-auto-review each dispatch twice per event. That is double token spend and two racing claims on the same PR, not a cosmetic drift.

.github-private's #1726 taught fleet_stub_drift / fleet_stub_remediate never to resurrect a collapsed stub. This script is a second, unpatched resurrector in a different repo.

Secondary: the header notes that a workflow which is universal-required and deployable but neither opted-in nor self-managed is "drift: the sweep skips it and the audit flags it required-but-missing forever". A collapsed repo is exactly that state for these three — so the compliance audit will flag markets non-compliant permanently.

Acceptance criteria

1. A repo that has .github/workflows/agent-ingress.yml with a job for role R does not receive standards/workflows/R.yml from the sweep.
2. Detection reads the repo's actual state (ingress present + role job present), not a hardcoded repo list — fan-out is incremental, so the set of collapsed repos changes.
3. The compliance audit treats a role served by an ingress job as present, not required-but-missing.
4. Tests: a collapsed repo is not re-seeded for a collapsed role; a non-collapsed repo still receives the stub; a repo with an ingress that lacks a given role job does still receive that role's stub.

---

Gap 2 — the agent rate-limit guard fails OPEN (no throttle)

scripts/lib/agent-rate-limit.sh → arl_count_concurrent_runs():

runs="$(gh run list --workflow "$agent_type" --json status --limit 1000 2>/dev/null || true)"
if [ -z "$runs" ]; then
  arl_log "warning: run enumeration for '${agent_type}' returned no data (treating concurrency as 0)"

scripts/agent-rate-limit-gate.sh → argate_fetch_runs() does the same and degrades to [] with "treating as empty (degraded)".

On a collapsed repo there is no workflow named for the agent, so enumeration returns nothing and concurrency is counted as 0. The guard then never throttles that repo. This is worse than #1224: canary-rollout loses evidence, while this one actively permits runaway concurrency — and the fail-open is deliberate for transient API errors, so a permanent absence is indistinguishable from a blip.

Acceptance criteria

1. Concurrency and run-history resolution count an agent's runs on a collapsed repo (ingress job attribution), consistent with canary-rollout health gate goes blind on an ADR-0007 collapsed repo: it resolves runs by per-role workflow NAME, which the ingress replaces with jobs #1224 and .github-private's run-attribution.sh.
2. A permanent "no such workflow" is distinguished from a transient API failure. The former must not silently read as zero — surface it, and fail closed (or explicitly report unresolved) rather than allowing.
3. AGENT_RATE_LIMITS_ORG_REPOS tallying works across a mixed fleet of collapsed and non-collapsed repos.
4. Tests: collapsed repo contributes its in-flight ingress role jobs to the tally; a transient failure still degrades permissively with its existing warning; a permanent missing-workflow does not read as 0.

---

Sequencing

Gap 1 must land before markets merges its collapse — a resurrected stub double-dispatches immediately, and the sweep is scheduled. Gap 2 should land before too, since the pilot is a live agent repo. markets#506 is deliberately unlabelled pending ADR-0010 acceptance, so there is time.

May be split into two issues if that suits implementation better; they share only the root cause.

[don-petry]

Dev-Lead Implementation Plan

Issue: #1226 — ADR-0007 collapse: standards-deploy resurrects collapsed stubs; agent rate-limit guard fails open on a collapsed repo

Scope

Make the standards sweep, the compliance audit, and the agent rate-limit guard ingress-aware: a role is served when the repo's agent-ingress.yml has a job for it, detected from the repo's live state (no hardcoded repo list). Also, a permanently missing workflow no longer reads as zero concurrency.

Implementation Checklist

• scripts/lib/agent-ingress.sh (new, pure helpers shared by all three consumers): role↔workflow mapping (dev-lead.yml → dev-lead), agent_ingress_has_role_job (job key under top-level jobs:), a gh-error classifier (permanent missing-workflow vs transient), and per-role run attribution from ingress run+jobs JSON (job <role> or <role> / <nested>, all-skipped ⇒ did not run, worst-outcome conclusion). Consistent with .github-private's run-attribution.sh.
• scripts/deploy-standard-workflows.sh: probe agent-ingress.yml once per repo. If a role job is present, skip <role>.yml (served by agent-ingress.yml) and never re-seed or re-pin it. If the probe is inconclusive (an error other than 404), fail closed for that repo (err + non-zero) so a transient blip can't resurrect a stub.
• scripts/compliance-audit.sh check_required_workflows: a required workflow whose role is served by an ingress job counts as present. No missing-<wf> finding.
• scripts/lib/agent-rate-limit.sh: new arl_resolve_agent_runs.
  • Legacy per-role workflow first.
  • On a permanent "no such workflow", fall back to agent-ingress.yml runs attributed by role job.
  • Neither present ⇒ unresolved (return 3), logged loudly.
  • Transient failure ⇒ keeps the existing permissive degrade and warning.
  • arl_count_concurrent_runs uses the resolver per repo, including AGENT_RATE_LIMITS_ORG_REPOS, so a mixed fleet tallies correctly. arl_admission_gate defers (fails closed) on unresolved concurrency.
• scripts/agent-rate-limit-gate.sh: argate_fetch_runs uses the resolver, so history, concurrency and breaker are counted from ingress role jobs on a collapsed repo. Unresolved history ⇒ computed defer (still log-only for non-enforcing agents).
• CI path filters / run lists: agent-rate-limits-tests.yml, standards-deploy-tests.yml (new lib + new bats).
• Existing deploy test gh fakes: add an explicit agent-ingress.yml 404 case. Today they return the stub body for every contents path, so the probe would otherwise read a stub as an ingress. Fixture fidelity only; no expectation changes.

Tests to Write

• Deploy: a collapsed repo (ingress has the role job) is not re-seeded for that role; a non-collapsed repo still gets the stub; an ingress that lacks a role job still gets that role's stub; an inconclusive ingress probe does not seed.
• Pure: agent_ingress_has_role_job (job key vs. same-named key outside jobs: / nested keys).
• Audit: a role served by an ingress job is not flagged missing; an unserved missing role still is.
• Rate-limit: a collapsed repo contributes its in-flight ingress role jobs (not sibling roles' jobs, not skipped jobs); a transient failure still degrades to 0 with its existing warning; a permanent missing workflow with no ingress does not read as 0 (unresolved ⇒ gate defers); AGENT_RATE_LIMITS_ORG_REPOS tallies across mixed collapsed and non-collapsed repos; the orchestrator gate derives history from ingress role jobs.

Test Command

bats tests/test_agent_rate_limit*.bats test/scripts/deploy-standard-workflows/ test/scripts/standards-deploy-driver/ test/scripts/compliance-audit/ + bash .dev-lead/scripts/dev-lead-lint.sh

[don-petry]

Dev-Lead: Progress (in progress — not yet durable)

Provisional. Nothing is pushed yet. The automation posts the authoritative
completion record (with PR number + head SHA) after the push. Treat the notes
below as intent, not delivered results.

Plan Execution (intended)

• Gap 1: the standards sweep and the compliance audit read the repo's live agent-ingress.yml. A role with an ingress job is never re-seeded or re-pinned, and the audit counts it as present.
• Gap 2: the rate-limit guard resolves runs ingress-aware. A permanent "no such workflow" falls back to ingress role-job attribution. Neither present ⇒ UNRESOLVED ⇒ fail closed. Transient errors keep the existing permissive degrade.

Files touched (this workspace, not yet pushed)

• scripts/lib/agent-ingress.sh (new): pure helpers for role↔workflow mapping, jobs.<role> detection, missing-vs-transient gh error classification, and per-role run attribution from ingress jobs.
• scripts/deploy-standard-workflows.sh: ingress probe per repo. A served role is skipped. A non-404 probe error fails closed for that repo, so a blip can't resurrect a stub.
• scripts/compliance-audit.sh: check_required_workflows counts a role served by an ingress job as present.
• scripts/lib/agent-rate-limit.sh: new arl_resolve_agent_runs. arl_count_concurrent_runs is ingress-aware across AGENT_RATE_LIMITS_ORG_REPOS and returns unresolved (rc 3) instead of 0. arl_admission_gate defers on unresolved.
• scripts/agent-rate-limit-gate.sh: argate_fetch_runs uses the resolver and derives history from ingress role jobs. Unresolved ⇒ computed defer.
• Tests:
  • test/scripts/deploy-standard-workflows/ingress-collapse.bats
  • test/scripts/compliance-audit/required-workflows-ingress.bats
  • tests/test_agent_rate_limit_ingress.bats
• Existing deploy-test gh fakes gained an explicit agent-ingress.yml 404 case (fixture fidelity only; no expectation changes).
• Path filters in agent-rate-limits-tests.yml and standards-deploy-tests.yml; docs in standards/ci-standards.md and standards/agent-rate-limits.md.

Notes

• Behaviour change: a repo listed in AGENT_RATE_LIMITS_ORG_REPOS that has neither the agent's workflow nor an ingress now defers the gate instead of counting 0. Neither AGENT_RATE_LIMITS_ORG_REPOS nor arl_admission_gate is wired into a live workflow today. The live orchestrator callers (initiative-driver, feature-ideation) read workflows that exist, so this can't fire in today's fleet.
• Cost: an ingress history read costs one jobs-API call per ingress run, up to --history-limit. The concurrency count reads jobs only for runs still in flight.
• Pre-existing: 5 tests in tests/test_bootstrap_new_repo.bats (DRY_RUN cases) fail identically on a clean main in this environment. That is unrelated to this change.

[don-petry]

Dev-Lead: Implementation Complete — PR #1239

The implementation for issue #1226 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.

• Pull request: feat: implement issue #1226 — ADR-0007 collapse: standards-deploy RESURRECTS three collapsed stubs (double dispatch), and the agent rate-limit guard FAILS OPEN on a collapsed repo #1239
• Head commit: 3f9cc7db2e8ed97e8b4cc443471c5f0e8cce6de0
• Net change against main: 18 file(s), +1022/-46 lines
• Run: https://github.com/petry-projects/.github/actions/runs/37076411028

Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.