fix(automation): isolate interactive agent mention concurrency - #815

#!/bin/bash
set -euo pipefail

expected_head="fc8b2e6728686856f44fc9cf6d0f4f300df34414"
expected_base="e71fdab2ab088001f218765ecb5e3b7fabfee11a"

echo '== Checked-out commit =='
git rev-parse HEAD
git status --short
printf '\n== Base ancestry ==\n'
git merge-base HEAD "$expected_base" || true
printf '\n== Changed files from stated base ==\n'
git diff --name-status "$expected_base" "$expected_head"
printf '\n== Diff from stated base ==\n'
git diff --check "$expected_base" "$expected_head"
git diff --unified=80 "$expected_base" "$expected_head" -- \
  .github/workflows CHANGELOG.md docs tests || true

printf '\n== Candidate workflow and test file outlines ==\n'
fd -t f . .github tests docs 2>/dev/null | rg 'agent-mention|mention.*(router|workflow)|concurrency-isolation|CHANGELOG' || true
fd -t f -e yml -e yaml .github 2>/dev/null | while IFS= read -r f; do
  if rg -q 'route-local-agent-mention|sweep-organization-agent-mentions|review-agent-mention-router' "$f"; then
    echo "-- $f"
    rg -n -C 12 'route-local-agent-mention|sweep-organization-agent-mentions|concurrency:|queue:|cancel-in-progress|permissions:|COPILOT_GITHUB_TOKEN' "$f"
  fi
done

printf '\n== Artifact ledger and canonical invocation-key references ==\n'
rg -n -C 5 'canonical invocation|invocation.key|artifact.*ledger|ledger.*artifact|exact.key|duplicate' .github tests 2>/dev/null || true

printf '\n== GitHub PR metadata, commits, checks, reviews, and threads ==\n'
gh pr view 815 --repo ContextualWisdomLab/.github \
  --json number,url,headRefOid,baseRefOid,state,mergeStateStatus,isDraft,reviews,statusCheckRollup \
  --jq '{number,url,headRefOid,baseRefOid,state,mergeStateStatus,isDraft,reviews,statusCheckRollup}'
gh api repos/ContextualWisdomLab/.github/pulls/815/commits \
  --paginate --jq '.[] | {sha: .sha, parents: [.parents[].sha]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=815 -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes { isResolved isOutdated comments(first: 10) { nodes { author { login } body } } }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {isOutdated, comments: [.comments.nodes[] | {author: .author.login, body: .body}]}'

#!/bin/bash
set -euo pipefail

echo '== Doctoring document and its regression contract =='
nl -ba docs/doctoring/agent-mention-concurrency-isolation.md | sed -n '1,180p'
nl -ba tests/test_agent_mention_artifact_ledger.py | sed -n '180,210p'
nl -ba tests/test_agent_mention_workflow_contract.py | sed -n '1,110p'

echo '== Exact workflow sections: router and downstream ledger claim =='
nl -ba .github/workflows/agent-mention-router.yml | sed -n '1,180p'
for f in .github/workflows/agent-mention-noema-dispatch.yml .github/workflows/agent-mention-opencode-dispatch.yml; do
  echo "-- $f"
  nl -ba "$f" | sed -n '1,230p'
done

echo '== RED and GREEN Actions evidence =='
for run in 31154969412 31155285450; do
  echo "-- run $run"
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
    --jq '{id,event,head_sha,head_branch,conclusion,status,created_at,updated_at,workflow_id}'
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}/jobs" --paginate \
    --jq '.jobs[] | {id,name,head_sha,conclusion,status,started_at,completed_at,steps:[.steps[] | {name,conclusion}]}'
done

echo '== Targeted logs for stated quality jobs =='
for job in 92792374352 92793335764; do
  echo "-- job $job"
  gh api "repos/ContextualWisdomLab/.github/actions/jobs/${job}/logs" 2>/dev/null \
    | rg -n -C 3 'failed|passed|coverage|statement|branch|docstring|compile|diff --check|964|963|100%' \
    || echo 'Log retrieval or matching output was unavailable.'
done

echo '== PR protection and latest workflow-run conclusions =='
gh api repos/ContextualWisdomLab/.github/branches/main/protection \
  --jq '{required_status_checks,required_pull_request_reviews,required_linear_history,allow_force_pushes,allow_deletions}' \
  || true
gh run list --repo ContextualWisdomLab/.github --commit fc8b2e6728686856f44fc9cf6d0f4f300df34414 \
  --limit 100 --json databaseId,name,workflowName,event,status,conclusion,headSha,createdAt,updatedAt \
  --jq '.[] | {databaseId,name,workflowName,event,status,conclusion,headSha,createdAt,updatedAt}'

#!/bin/bash
set -euo pipefail

number_file() {
  awk '{printf "%6d\t%s\n", NR, $0}' "$1"
}

echo '== Doctoring document and its regression contract =='
number_file docs/doctoring/agent-mention-concurrency-isolation.md | sed -n '1,180p'
number_file tests/test_agent_mention_artifact_ledger.py | sed -n '180,210p'
number_file tests/test_agent_mention_workflow_contract.py | sed -n '1,110p'

echo '== Router and downstream ledger claim sections =='
number_file .github/workflows/agent-mention-router.yml | sed -n '1,180p'
for f in .github/workflows/agent-mention-noema-dispatch.yml .github/workflows/agent-mention-opencode-dispatch.yml; do
  echo "-- $f"
  number_file "$f" | sed -n '1,230p'
done

echo '== RED and GREEN Actions evidence =='
for run in 31154969412 31155285450; do
  echo "-- run $run"
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
    --jq '{id,event,head_sha,head_branch,conclusion,status,created_at,updated_at,workflow_id}'
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}/jobs" --paginate \
    --jq '.jobs[] | {id,name,head_sha,conclusion,status,started_at,completed_at,steps:[.steps[] | {name,conclusion}]}'
done

echo '== Targeted logs for stated quality jobs =='
for job in 92792374352 92793335764; do
  echo "-- job $job"
  gh api "repos/ContextualWisdomLab/.github/actions/jobs/${job}/logs" 2>/dev/null \
    | rg -n -C 3 'failed|passed|coverage|statement|branch|docstring|compile|diff --check|964|963|100%' \
    || echo 'Log retrieval or matching output was unavailable.'
done

echo '== PR protection and current-head workflow conclusions =='
gh api repos/ContextualWisdomLab/.github/branches/main/protection \
  --jq '{required_status_checks,required_pull_request_reviews,required_linear_history,allow_force_pushes,allow_deletions}' \
  || true
gh run list --repo ContextualWisdomLab/.github --commit fc8b2e6728686856f44fc9cf6d0f4f300df34414 \
  --limit 100 --json databaseId,name,workflowName,event,status,conclusion,headSha,createdAt,updatedAt \
  --jq '.[] | {databaseId,name,workflowName,event,status,conclusion,headSha,createdAt,updatedAt}'

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='815'
head='6b01e7ce65d95657f6c6b920369495e3c60c125e'
base='e71fdab2ab088001f218765ecb5e3b7fabfee11a'

echo '== Exact revision identity =='
printf 'checked_out='; git rev-parse HEAD
gh pr view "$pr" --repo "$repo" \
  --json number,url,state,headRefOid,baseRefOid,mergeStateStatus,changedFiles \
  --jq '{number,url,state,headRefOid,baseRefOid,mergeStateStatus,changedFiles}'
git merge-base "$head" "$base"

echo '== Exact changed paths and whitespace =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --stat "$base" "$head"

echo '== Exact diff =='
git diff --unified=40 "$base" "$head" -- \
  .github/workflows/agent-mention-router.yml \
  CHANGELOG.md \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py

echo '== Router concurrency and security context =='
nl -ba .github/workflows/agent-mention-router.yml | sed -n '1,260p'
echo '== Dispatch ledger context =='
rg -n -C 8 'permissions:|concurrency:|group:|invocation|artifact|retention-days|github-token|token:|COPILOT_GITHUB_TOKEN|repository_dispatch|workflow_dispatch' \
  .github/workflows/agent-mention-noema-dispatch.yml \
  .github/workflows/agent-mention-opencode-dispatch.yml || true

echo '== Doctoring and regression-contract context =='
for f in \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py; do
  echo "-- $f"
  nl -ba "$f" | sed -n '1,280p'
done

echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json databaseId,name,workflowName,status,conclusion,headSha,createdAt,updatedAt \
  --jq '.[] | {databaseId,name,workflowName,status,conclusion,headSha,createdAt,updatedAt}'

echo '== Requested quality run =='
gh api "repos/$repo/actions/runs/31167544508" \
  --jq '{id,status,conclusion,head_sha,workflow_id,created_at,updated_at,html_url}'
gh api "repos/$repo/actions/runs/31167544508/jobs" --paginate \
  --jq '.jobs[] | {id,name,status,conclusion,head_sha,started_at,completed_at,steps:[.steps[]|{name,conclusion}]}'

echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          isOutdated
          comments(first: 20) { nodes { author { login } body path line } }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
  | select(.isResolved == false)
  | {isOutdated,comments:[.comments.nodes[]|{author:.author.login,path,line,body}]}'

echo '== Branch protection, if readable =='
gh api "repos/$repo/branches/main/protection" \
  --jq '{required_status_checks,required_pull_request_reviews,required_linear_history,allow_force_pushes,allow_deletions}' || true

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='815'
expected_head='6b01e7ce65d95657f6c6b920369495e3c60c125e'

echo '== PR identity =='
gh pr view "$pr" --repo "$repo" \
  --json number,url,state,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup \
  --jq '{number,url,state,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup}'

actual_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq -r .headRefOid)"
printf 'expected_head=%s\nactual_head=%s\n' "$expected_head" "$actual_head"
if [ "$actual_head" != "$expected_head" ]; then
  echo 'HEAD_MISMATCH: stop before source and evidence review.'
  exit 0
fi

echo '== Checked-out revision =='
git rev-parse HEAD
git status --short
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq -r .baseRefOid)"
printf 'base=%s\nmerge_base=' "$base"
git merge-base "$expected_head" "$base"

echo '== Changed paths and whitespace =='
git diff --name-status "$base" "$expected_head"
git diff --check "$base" "$expected_head"

echo '== Router concurrency and permission sections =='
nl -ba .github/workflows/agent-mention-router.yml | sed -n '1,260p'

echo '== Dispatch ledger, credentials, and permission sections =='
for f in .github/workflows/agent-mention-noema-dispatch.yml .github/workflows/agent-mention-opencode-dispatch.yml; do
  echo "-- $f"
  rg -n -C 8 'permissions:|concurrency:|group:|queue:|cancel-in-progress|invocation|artifact|retention-days|github-token|token:|COPILOT_GITHUB_TOKEN|repository_dispatch|workflow_dispatch' "$f" || true
done

echo '== Doctoring and regression-contract sections =='
for f in docs/doctoring/agent-mention-concurrency-isolation.md tests/test_agent_mention_workflow_contract.py tests/test_agent_mention_artifact_ledger.py; do
  echo "-- $f"
  nl -ba "$f" | sed -n '1,280p'
done

echo '== Exact-head workflow results =='
gh run list --repo "$repo" --commit "$expected_head" --limit 100 \
  --json databaseId,name,workflowName,status,conclusion,headSha,createdAt,updatedAt \
  --jq '.[] | {databaseId,name,workflowName,status,conclusion,headSha,createdAt,updatedAt}'

echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          isOutdated
          comments(first: 20) { nodes { author { login } body path line } }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
  | select(.isResolved == false)
  | {isOutdated,comments:[.comments.nodes[]|{author:.author.login,path,line,body}]}'

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='815'
expected_head='6b01e7ce65d95657f6c6b920369495e3c60c125e'

echo '== Pull request identity =='
gh pr view "$pr" --repo "$repo" \
  --json number,url,state,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup \
  --jq '{number,url,state,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup}'

actual_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq -r '.headRefOid')"
printf 'expected_head=%s\nactual_head=%s\n' "$expected_head" "$actual_head"

if [ "$actual_head" != "$expected_head" ]; then
  echo 'HEAD_MISMATCH: stop before source and status review.'
  exit 0
fi

echo '== Checked-out revision and changed paths =='
git rev-parse HEAD
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq -r '.baseRefOid')"
printf 'base=%s\nmerge_base=' "$base"
git merge-base "$expected_head" "$base"
git diff --name-status "$base" "$expected_head"
git diff --check "$base" "$expected_head"

echo '== Router concurrency and security boundary =='
nl -ba .github/workflows/agent-mention-router.yml | sed -n '1,260p'

echo '== Dispatch idempotency and artifact-ledger boundary =='
rg -n -C 8 \
  'permissions:|concurrency:|group:|invocation|artifact|retention-days|github-token|token:|COPILOT_GITHUB_TOKEN|repository_dispatch|workflow_dispatch' \
  .github/workflows/agent-mention-noema-dispatch.yml \
  .github/workflows/agent-mention-opencode-dispatch.yml || true

echo '== Doctoring and regression contracts =='
for f in \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py
do
  echo "-- $f"
  nl -ba "$f" | sed -n '1,300p'
done

echo '== Requested Strix run and exact-head runs =='
gh api "repos/$repo/actions/runs/31167542225" \
  --jq '{id,status,conclusion,head_sha,html_url,created_at,updated_at}'
gh run list --repo "$repo" --commit "$expected_head" --limit 100 \
  --json databaseId,name,workflowName,status,conclusion,headSha,createdAt,updatedAt \
  --jq '.[] | {databaseId,name,workflowName,status,conclusion,headSha,createdAt,updatedAt}'

echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          isOutdated
          comments(first: 20) { nodes { author { login } body path line } }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
  | select(.isResolved == false)
  | {isOutdated,comments:[.comments.nodes[]|{author:.author.login,path,line,body}]}'

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='815'
head='db653d61f9eb52d3f9afa89ef244bac98aabc3ff'
base='e71fdab2ab088001f218765ecb5e3b7fabfee11a'

echo '== Pull request identity =='
gh pr view "$pr" --repo "$repo" \
  --json number,url,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,changedFiles,additions,deletions,statusCheckRollup \
  --jq '{number,url,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,changedFiles,additions,deletions,statusCheckRollup}'

actual_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq -r '.headRefOid')"
printf 'requested_head=%s\nlive_head=%s\n' "$head" "$actual_head"
if [ "$actual_head" != "$head" ]; then
  echo 'HEAD_MISMATCH: stop before source and evidence inspection.'
  exit 0
fi

echo '== Checked-out revision and exact diff =='
printf 'checked_out='; git rev-parse HEAD
printf 'merge_base='; git merge-base "$head" "$base"
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --stat "$base" "$head"
git diff --unified=50 "$base" "$head" -- \
  .github/workflows/agent-mention-router.yml \
  CHANGELOG.md \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py

echo '== Router workflow outline and routing security context =='
ast-grep outline .github/workflows/agent-mention-router.yml --items all 2>/dev/null || true
nl -ba .github/workflows/agent-mention-router.yml | sed -n '1,280p'

echo '== Downstream dispatcher: idempotency, retention, and credentials =='
for f in .github/workflows/agent-mention-noema-dispatch.yml .github/workflows/agent-mention-opencode-dispatch.yml; do
  echo "-- $f"
  rg -n -C 10 \
    'permissions:|concurrency:|group:|invocation|artifact|retention-days|github-token|token:|COPILOT_GITHUB_TOKEN|repository_dispatch|workflow_dispatch|allowlist|TARGET_REPOSITORY' \
    "$f" || true
done

echo '== Regression contracts and doctoring =='
for f in \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  CHANGELOG.md
do
  echo "-- $f"
  nl -ba "$f" | sed -n '1,300p'
done

echo '== Exact-head Actions results =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json databaseId,name,workflowName,event,status,conclusion,headSha,createdAt,updatedAt \
  --jq '.[] | {databaseId,name,workflowName,event,status,conclusion,headSha,createdAt,updatedAt}'

echo '== Non-success exact-head runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json databaseId,name,status,conclusion,headSha \
  --jq '.[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral")) | {databaseId,name,status,conclusion,headSha}'

echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          isOutdated
          comments(first: 20) {
            nodes { author { login } body path line }
          }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
  | select(.isResolved == false)
  | {isOutdated, comments: [.comments.nodes[] | {author: .author.login, path, line, body}]}'

echo '== Branch protection, if permission permits =='
gh api "repos/$repo/branches/main/protection" \
  --jq '{required_status_checks,required_pull_request_reviews,required_linear_history,allow_force_pushes,allow_deletions}' || true

#!/bin/bash
set -u

repo='ContextualWisdomLab/.github'
pr='815'
head='db653d61f9eb52d3f9afa89ef244bac98aabc3ff'
base='e71fdab2ab088001f218765ecb5e3b7fabfee11a'

echo '== Checked-out head and changed paths =='
git rev-parse HEAD || true
git diff --name-status "$base" "$head" || true
git diff --check "$base" "$head" || true
git diff --unified=35 "$base" "$head" -- \
  .github/workflows/agent-mention-router.yml \
  CHANGELOG.md \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py || true

echo '== Router concurrency and routing controls =='
nl -ba .github/workflows/agent-mention-router.yml | sed -n '1,280p' || true

echo '== Dispatcher artifact ledger and authorization controls =='
for f in .github/workflows/agent-mention-noema-dispatch.yml .github/workflows/agent-mention-opencode-dispatch.yml; do
  echo "-- $f"
  rg -n -C 8 \
    'permissions:|concurrency:|group:|invocation|artifact|retention-days|github-token|token:|COPILOT_GITHUB_TOKEN|repository_dispatch|workflow_dispatch|allowlist|TARGET_REPOSITORY' \
    "$f" || true
done

echo '== Tests and doctoring contract =='
for f in \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  CHANGELOG.md
do
  echo "-- $f"
  nl -ba "$f" | sed -n '1,300p' || true
done

echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          isOutdated
          comments(first: 20) { nodes { author { login } body path line } }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
  | select(.isResolved == false)
  | {isOutdated, comments: [.comments.nodes[] | {author: .author.login, path, line, body}]}' || true

echo '== Branch protection, if available =='
gh api "repos/$repo/branches/main/protection" \
  --jq '{required_status_checks,required_pull_request_reviews,required_linear_history,allow_force_pushes,allow_deletions}' || true

#!/bin/bash
set -u

repo='ContextualWisdomLab/.github'
quality_run='31169212436'
quality_job='92836959742'

echo '== Artifact-ledger doctoring assertions =='
sed -n '1,260p' tests/test_agent_mention_artifact_ledger.py || true

echo '== Workflow-contract assertions =='
sed -n '1,180p' tests/test_agent_mention_workflow_contract.py || true

echo '== Router workflow: complete job declarations =='
sed -n '1,210p' .github/workflows/agent-mention-router.yml || true

echo '== Exact-head quality run and job =='
gh api "repos/$repo/actions/runs/$quality_run" \
  --jq '{id,head_sha,status,conclusion,created_at,updated_at,html_url}' || true
gh api "repos/$repo/actions/jobs/$quality_job" \
  --jq '{id,name,head_sha,status,conclusion,started_at,completed_at,steps:[.steps[] | {name,conclusion}]}' || true

echo '== Quality evidence excerpts =='
gh api "repos/$repo/actions/jobs/$quality_job/logs" 2>/dev/null \
  | tr -d '\033' \
  | rg -n -i -C 2 '964 passed|[0-9]+ passed|100%|statement|branch|docstring|compile|diff --check|failed' \
  || true

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='815'
head='db653d61f9eb52d3f9afa89ef244bac98aabc3ff'
base='e71fdab2ab088001f218765ecb5e3b7fabfee11a'

echo '== Exact PR identity =='
gh pr view "$pr" --repo "$repo" \
  --json number,url,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,changedFiles,additions,deletions,statusCheckRollup \
  --jq '{number,url,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,changedFiles,additions,deletions,statusCheckRollup}'
live_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq -r '.headRefOid')"
printf 'requested_head=%s\nlive_head=%s\nchecked_out=' "$head" "$live_head"
git rev-parse HEAD
if [ "$live_head" != "$head" ]; then
  echo 'HEAD_MISMATCH: stop before source review.'
  exit 0
fi

echo '== Diff identity and changed paths =='
printf 'merge_base='; git merge-base "$head" "$base"
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --unified=35 "$base" "$head" -- \
  .github/workflows/agent-mention-router.yml \
  CHANGELOG.md \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py

echo '== Router jobs and security boundaries =='
nl -ba .github/workflows/agent-mention-router.yml | sed -n '1,280p'

echo '== Dispatcher ledger and payload boundaries =='
for f in .github/workflows/agent-mention-noema-dispatch.yml .github/workflows/agent-mention-opencode-dispatch.yml; do
  echo "-- $f"
  rg -n -C 8 \
    'permissions:|concurrency:|group:|invocation|artifact|retention-days|github-token|token:|COPILOT_GITHUB_TOKEN|repository_dispatch|workflow_dispatch|comment|body|model|output|allowlist|TARGET_REPOSITORY|merge' \
    "$f" || true
done

echo '== Regression contracts and doctoring =='
for f in \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  CHANGELOG.md
do
  echo "-- $f"
  nl -ba "$f" | sed -n '1,320p'
done

echo '== Exact-head Actions runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json databaseId,name,workflowName,event,status,conclusion,headSha,createdAt,updatedAt \
  --jq '.[] | {databaseId,name,workflowName,event,status,conclusion,headSha,createdAt,updatedAt}'

echo '== Quality job metadata and evidence when available =='
quality_run="$(gh run list --repo "$repo" --commit "$head" --limit 100 --json databaseId,workflowName \
  --jq -r '.[] | select(.workflowName == "Agent Mention Router Quality") | .databaseId' | head -n 1)"
if [ -n "${quality_run:-}" ]; then
  gh api "repos/$repo/actions/runs/$quality_run" \
    --jq '{id,head_sha,status,conclusion,html_url,created_at,updated_at}'
  quality_job="$(gh api "repos/$repo/actions/runs/$quality_run/jobs" --paginate \
    --jq -r '.jobs[] | select(.name == "quality") | .id' | head -n 1)"
  if [ -n "${quality_job:-}" ]; then
    gh api "repos/$repo/actions/jobs/$quality_job" \
      --jq '{id,name,head_sha,status,conclusion,steps:[.steps[]|{name,conclusion}]}'
    gh api "repos/$repo/actions/jobs/$quality_job/logs" 2>/dev/null \
      | tr -d '\033' \
      | rg -n -i -C 2 '[0-9]+ passed|100%|statement|branch|docstring|compile|diff --check|failed' \
      || true
  fi
fi

echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          isOutdated
          comments(first: 20) { nodes { author { login } body path line } }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
  | select(.isResolved == false)
  | {isOutdated, comments: [.comments.nodes[] | {author: .author.login, path, line, body}]}'

echo '== Branch protection, if readable =='
gh api "repos/$repo/branches/main/protection" \
  --jq '{required_status_checks,required_pull_request_reviews,required_linear_history,allow_force_pushes,allow_deletions}' || true

#!/bin/bash
set -uo pipefail

repo='ContextualWisdomLab/.github'
pr='815'
head='db653d61f9eb52d3f9afa89ef244bac98aabc3ff'
base='e71fdab2ab088001f218765ecb5e3b7fabfee11a'

echo '== Exact identity =='
live_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
printf 'requested_head=%s\nlive_head=%s\n' "$head" "$live_head"
if [ "$live_head" != "$head" ]; then
  echo 'HEAD_MISMATCH: stop before source review.'
  exit 0
fi
printf 'checked_out='; git rev-parse HEAD || true
printf 'merge_base='; git merge-base "$head" "$base" || true

echo '== Changed paths and whitespace =='
git diff --name-status "$base" "$head" || true
git diff --check "$base" "$head" || true
git diff --unified=35 "$base" "$head" -- \
  .github/workflows/agent-mention-router.yml \
  CHANGELOG.md \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py || true

echo '== Router workflow =='
nl -ba .github/workflows/agent-mention-router.yml | sed -n '1,280p' || true

echo '== Dispatcher idempotency, receipt, payload, and security context =='
for f in .github/workflows/agent-mention-noema-dispatch.yml .github/workflows/agent-mention-opencode-dispatch.yml; do
  echo "-- $f"
  rg -n -C 10 \
    'permissions:|concurrency:|group:|invocation|artifact|retention-days|github-token|token:|COPILOT_GITHUB_TOKEN|repository_dispatch|workflow_dispatch|comment|body|model|output|allowlist|TARGET_REPOSITORY|merge' \
    "$f" || true
done

echo '== Changed tests and documentation =='
for f in \
  tests/test_agent_mention_workflow_contract.py \
  tests/test_agent_mention_artifact_ledger.py \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  CHANGELOG.md
do
  echo "-- $f"
  nl -ba "$f" | sed -n '1,340p' || true
done

echo '== Exact-head Actions =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json databaseId,name,workflowName,event,status,conclusion,headSha,createdAt,updatedAt \
  --jq '.[] | {databaseId,name,workflowName,event,status,conclusion,headSha,createdAt,updatedAt}' || true

echo '== Quality metadata and log evidence =='
quality_run="$(gh run list --repo "$repo" --commit "$head" --limit 100 --json databaseId,workflowName \
  --jq '.[] | select(.workflowName == "Agent Mention Router Quality CI") | .databaseId' | head -n 1)"
printf 'quality_run=%s\n' "${quality_run:-missing}"
if [ -n "${quality_run:-}" ]; then
  gh api "repos/$repo/actions/runs/$quality_run" \
    --jq '{id,head_sha,status,conclusion,html_url,created_at,updated_at}' || true
  quality_job="$(gh api "repos/$repo/actions/runs/$quality_run/jobs" --paginate \
    --jq '.jobs[] | select(.name == "quality") | .id' | head -n 1)"
  printf 'quality_job=%s\n' "${quality_job:-missing}"
  if [ -n "${quality_job:-}" ]; then
    gh api "repos/$repo/actions/jobs/$quality_job" \
      --jq '{id,name,head_sha,status,conclusion,steps:[.steps[]|{name,conclusion}]}' || true
    gh api "repos/$repo/actions/jobs/$quality_job/logs" 2>/dev/null \
      | tr -d '\033' \
      | rg -n -i -C 2 '[0-9]+ passed|100%|statement|branch|docstring|compile|diff --check|failed' \
      || true
  fi
fi

echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          isOutdated
          comments(first: 20) { nodes { author { login } body path line } }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
  | select(.isResolved == false)
  | {isOutdated,comments:[.comments.nodes[]|{author:.author.login,path,line,body}]}' || true

echo '== Branch protection, if readable =='
gh api "repos/$repo/branches/main/protection" \
  --jq '{required_status_checks,required_pull_request_reviews,required_linear_history,allow_force_pushes,allow_deletions}' || true

#!/bin/bash
set -uo pipefail

echo '== Artifact-ledger regression assertions =='
sed -n '1,260p' tests/test_agent_mention_artifact_ledger.py || true

echo '== Workflow concurrency regression assertions =='
sed -n '1,180p' tests/test_agent_mention_workflow_contract.py || true

echo '== Quality workflow enforcement =='
sed -n '1,300p' .github/workflows/agent-mention-router-quality-ci.yml || true

echo '== Exact diff checks for unchanged boundaries =='
git diff --unified=8 \
  e71fdab2ab088001f218765ecb5e3b7fabfee11a \
  db653d61f9eb52d3f9afa89ef244bac98aabc3ff -- \
  .github/workflows/agent-mention-noema-dispatch.yml \
  .github/workflows/agent-mention-opencode-dispatch.yml \
  scripts/ci/agent_mention_router.py \
  scripts/ci/agent_mention_sweep.py || true

echo '== Token identifier search in changed router and ledger dispatchers =='
rg -n -C 2 'COPILOT_GITHUB_TOKEN|comment\.body|claim\.json|model output|credentials|business' \
  .github/workflows/agent-mention-router.yml \
  .github/workflows/agent-mention-noema-dispatch.yml \
  .github/workflows/agent-mention-opencode-dispatch.yml \
  docs/doctoring/agent-mention-concurrency-isolation.md \
  tests/test_agent_mention_artifact_ledger.py || true