post-retro.sh doesn't respect create_issues.allow_targets

[ralphbean]

post-triage.sh gates cross-repo issue creation on create_issues.allow_targets in config.yaml (is_target_allowed in scripts/post-triage.sh:169). post-retro.sh doesn't have anything like that — it takes proposals[i].target_repo straight from the retro agent's output and calls gh issue create on it, no allowlist check in between.

ADR 0080 (fullsend-ai/fullsend#5798) settles that a knob like this — one that governs dispatch/policy across agents — belongs in config.yaml, not a per-agent env var. So this seems like it should be the same create_issues.allow_targets triage already reads, rather than a retro-specific one.

Following the checklist in FEATURES.md (#566), this'd touch post-retro.sh (and maybe pull is_target_allowed out somewhere shareable between the two scripts), plus docs/triage.md and whatever the retro docs equivalent is, plus tests.

Do you see the gap the same way?

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 2:05 PM UTC · Completed 2:10 PM UTC
Commit: 37f148b · View workflow run →

[fullsend-ai-triage]

Triage Summary

Confirmed gap: post-retro.sh creates cross-repo issues without checking create_issues.allow_targets from config.yaml, while post-triage.sh enforces this allowlist via is_target_allowed.

Root Cause

The is_target_allowed function and the config-reading logic (ALLOWED_ORGS, ALLOWED_REPOS from create_issues.allow_targets) are defined inline in post-triage.sh (around line 169). post-retro.sh was not given equivalent logic — its issue creation loop (around line 102) goes straight from validation to gh issue create with no allowlist gate.

Recommended Fix

1. Extract is_target_allowed (and the yq config-reading preamble) into a shared library under scripts/lib/ so both scripts use the same implementation
2. Add the allowlist check to post-retro.sh's proposal filing loop, before the gh issue create call
3. Handle disallowed targets gracefully — skip with a warning and surface the skipped proposal in the summary comment (matching post-triage.sh's FAILED_CREATES pattern)
4. Update docs/retro.md to document that create_issues.allow_targets governs retro-filed issues
5. Add tests to post-retro-test.sh covering allowed targets, disallowed targets, and missing config/yq fallback

Note: post-retro.sh is not currently bundled from a .src.sh file, so if extracting to a shared lib, it may need to be converted to the bundled script pattern first (add post-retro.src.sh, update BUNDLE_SRCS in Makefile). Alternatively, the function can be inlined.

Proposed Test Case

# Test: disallowed target repo is skipped with warning
# Setup: config.yaml with allow_targets listing only "fullsend-ai/agents"
# Input: retro agent output with a proposal targeting "other-org/other-repo"
# Expected: issue is NOT created in other-org/other-repo,
#   warning is logged, and the skipped proposal details appear
#   in the summary comment.

# Test: allowed target repo proceeds normally
# Setup: config.yaml with allow_targets listing "fullsend-ai/agents"
# Input: proposal targeting "fullsend-ai/agents"
# Expected: issue is created successfully

# Test: missing yq degrades gracefully
# Setup: yq not on PATH, config.yaml present
# Expected: cross-repo issue creation is disabled with a warning
#   (matching post-triage.sh behavior)

Related but not blocking: issue #525 proposes agent-side filing policy via a skill, which is complementary — that controls what the agent proposes, while this controls what the post-script is allowed to file.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 2:11 PM UTC · Completed 2:21 PM UTC
Commit: 37f148b · View workflow run →

[ralphbean]

This overlaps with fullsend-ai/fullsend#978, which frames the same gap as a security issue (agent could file into arbitrary repos on hallucination/injection). Linking so they don't drift apart.

[fullsend-ai-prioritize]

RICE Priority Score: 2.7

Score breakdown

Dimension	Score	Reasoning
Reach	1.5	This affects all users of the retro agent who rely on cross-repo issue creation. The linked security issue (fullsend-ai/fullsend#978) indicates the gap could allow filing into arbitrary repos, widening the blast radius. Filed by a project member (ralphbean) suggesting organizational awareness of the problem.
Impact	2	Very high because the missing allowlist check is both a functional inconsistency and a security gap — the retro agent can file issues into arbitrary repos on hallucination or injection, bypassing the policy gate that post-triage.sh already enforces. The linked issue explicitly frames this as a security concern.
Confidence	0.9	Very high — the issue is precisely described with exact code locations (post-retro.sh line 102, post-triage.sh line 169), a confirmed triage summary, a clear ADR reference (ADR 0080), and a well-scoped fix plan. The author is a project member with deep codebase knowledge.
Effort	1	Medium — the fix involves extracting is_target_allowed into a shared library, adding the allowlist check to post-retro.sh's proposal loop, updating docs (retro.md), and adding tests. The triage summary notes a possible need to convert to the bundled script pattern, but the core logic change is well-understood and localized.

Formula: (1.5 x 2 x 0.9) / 1 = 2.7