chore: remove pinned agent digests, disable auto sync dispatch

[ggallen]

Summary

• Remove the 7 pinned fullsend-ai/agents entries from .fullsend/config.yaml, keeping only the qualityflow agent (external repo, not covered by CLI fallback)
• Disable the automatic push trigger on notify-agent-sync.yml, keeping only workflow_dispatch for manual use

The CLI now falls back to resolving agents from heads/main when no agents are configured in config.yaml, making the pinned SHA entries and automatic sync dispatch unnecessary. The pinned SHAs were also perpetually stale — the sync job's own commit to update them immediately moved main past the pinned ref.

Test plan

• Verify fullsend agents (triage, code, fix, review, retro, prioritize, scribe) still resolve correctly via CLI fallback
• Verify qualityflow agent still resolves via its pinned entry
• Verify notify-agent-sync workflow no longer triggers on push to main
• Verify notify-agent-sync workflow can still be triggered manually via workflow_dispatch

🤖 Generated with Claude Code

[qodo-code-review]

PR Summary by Qodo

Remove pinned agent digests; make agent-sync workflow manual-only

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Remove pinned fullsend-ai/agents SHA+digest entries from fullsend config.
• Retain the external qualityflow agent pin (not covered by CLI fallback resolution).
• Disable notify-agent-sync automatic push trigger; keep manual workflow_dispatch only.

Diagram

graph TD
  A[".fullsend/config.yaml"] --> B["Fullsend CLI"] --> C{{"fullsend-ai/agents@main"}}
  A --> D{{"qualityflow-fullsend (pinned)"}}
  E["notify-agent-sync.yml"] --> F{{"GitHub Actions"}}
  F --> E

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin to version tags/releases instead of main fallback

• ➕ More deterministic than heads/main while avoiding per-SHA churn
• ➕ Easier to audit/rollback than digest+SHA updates on every upstream change
• ➖ Requires an upstream release/tagging discipline
• ➖ Still needs periodic manual updates when you want new behavior

2. Keep auto-sync, but update pins via PR without self-invalidating ref

• ➕ Retains deterministic pins while staying up-to-date automatically
• ➕ Avoids reliance on mutable heads/main resolution
• ➖ More workflow complexity (needs careful sequencing to avoid stale pins)
• ➖ Still creates frequent config churn/PR noise across repos

Recommendation: Given the CLI’s explicit fallback to resolving agents from heads/main when config pins are absent, removing the pinned fullsend-ai/agents entries and disabling the automatic sync trigger is the simplest and least noisy approach. Keeping the qualityflow pin is appropriate since it is external to the fallback mechanism.

Files changed (2) +0 / -11

Other (2) +0 / -11

config.yamlRemove pinned fullsend-ai/agents entries; keep qualityflow pin +0/-7

Remove pinned fullsend-ai/agents entries; keep qualityflow pin

• Deletes the seven pinned fullsend-ai/agents raw.githubusercontent.com sources (with SHA+sha256 digests). Retains the qualityflow agent entry because it points to an external repository not covered by CLI fallback resolution.

.fullsend/config.yaml

notify-agent-sync.ymlDisable push-triggered agent sync notification; keep manual dispatch +0/-4

Disable push-triggered agent sync notification; keep manual dispatch

• Removes the push-to-main trigger (and paths-ignore) so the workflow no longer runs automatically. Leaves workflow_dispatch enabled for manual invocation when needed.

.github/workflows/notify-agent-sync.yml

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 6:43 PM UTC · Ended 6:46 PM UTC

Commit: e97042e · View workflow run →

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 6:48 PM UTC · Ended 6:49 PM UTC

Commit: 5944cc3 · View workflow run →

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Sync dispatch no longer automatic 🐞 Bug ☼ Reliability

Description

notify-agent-sync.yml no longer triggers on pushes to main, so the repository_dispatch to
fullsend-ai/.fullsend will not run when agents are updated unless someone manually starts it. This
breaks the workflow’s stated purpose/contract of notifying .fullsend whenever main updates,
which can leave downstream digest sync tasks unstarted.

Code

.github/workflows/notify-agent-sync.yml[L17-20]

-  push:
-    branches: [main]
-    paths-ignore:
-      - '.fullsend/**'

Relevance

●● Moderate

Intent explicitly disables automatic dispatch, but documented workflow contract supports the
finding; historical evidence is mixed and not trigger-specific.

PR-#776
PR-#25

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR removes the on.push trigger from the workflow, leaving only workflow_dispatch, while the
workflow’s own comments and repository documentation describe it as notifying .fullsend when
agents main updates (i.e., on push).

.github/workflows/notify-agent-sync.yml[1-18]
AGENTS.md[71-84]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`notify-agent-sync.yml` no longer runs automatically on pushes to `main`, so `.fullsend` will not receive the `agents-updated` dispatch when this repo’s `main` advances.

## Issue Context
The workflow header comment describes this workflow as notifying `.fullsend` whenever agents main is updated, and `AGENTS.md` documents that it fires “on every push to main”. Removing the trigger changes the behavior and the cross-repo expectation.

## Fix Focus Areas
- .github/workflows/notify-agent-sync.yml[14-21]

### Suggested implementation direction
- Re-add the `on.push.branches: [main]` trigger (keeping the existing `paths-ignore` if desired), OR
- If the intent is to make it manual-only, add an explicit comment in the workflow explaining the new operating model and ensure downstream processes do not rely on automatic dispatch.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 56 rules

✅ Skills: 4 invoked

  code-review

  code-implementation

  pr-review

  docs-review

Tip of the day

💡 Did you know, you can commit Qodo's fix in one click with committable suggestions (GitHub & GitLab)

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:50 PM UTC · Completed 7:06 PM UTC

Commit: af9e61a · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 6:58 PM UTC · Completed 7:16 PM UTC

Commit: af9e61a · View workflow run →

[waynesun09]

MEDIUM+ unique findings (HIGH on notify-agent-sync auto-dispatch is already covered by Qodo on the deleted push trigger).

[waynesun09]

Medium — scribe is not covered by CLI fallback

The PR test plan says fleet agents including scribe still resolve via CLI fallback after these pins are removed. tryAgentsRepoFallback only allows triage, code, fix, review, retro, and prioritize (defaultAgentsRepoKnownAgents in fullsend internal/cli/run.go). scribe is not in that map.

This repo currently pins harness/scribe.yaml. After this change, fullsend run scribe here fails with not in config and agents-repo fallback unavailable. Qualityflow staying in agents: is correct (fallback is per missing name, not an empty list).

Drop scribe from the test plan, or note that scribe is org-customized / not fallback-eligible. This repo's roles: also omit scribe, so it may be unused — the test-plan claim is still wrong.

[fullsend-ai-review]

Review skipped — this PR is already merged.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend post-review check}

[fullsend-ai-retro]

Retro: PR #936 — Remove pinned agent digests, disable auto sync dispatch

Timeline

1. 18:42 UTC — PR opened by ggallen (co-authored with Claude Code). Removes 7 pinned agent digest entries from .fullsend/config.yaml and disables the on.push trigger on notify-agent-sync.yml.
2. 18:42–18:48 — Two review runs (32591517205, 32591731626) triggered and cancelled by successive pushes (normal concurrency-group supersession).
3. 18:48 — Final review run 32591841422 starts on commit af9e61a.
4. 18:50 — Qodo bot posts 1 High finding (auto-dispatch removed).
5. 18:56 — PR merged by ggallen while the fullsend review agent is still running (sub-agents mid-execution).
6. 18:59 — waynesun09 (human reviewer) posts 2 inline findings: scribe not in CLI fallback, and remaining consumers still have SHA pins.
7. 19:06 — Review agent completes with 7 findings and a request-changes verdict ($3.35 cost). Post-script detects PR is already merged and posts "Review skipped" — all 7 findings silently dropped.

Key findings

Review findings lost to merge race. The review agent spent ~18 minutes and $3.35 producing 7 genuine findings (stale docs in AGENTS.md and README.md, cross-repo contract change, protected-path modification, permission-expansion concern). None were posted because the PR was merged 10 minutes before the review completed. The post-script correctly detected the merged state but had no mechanism to surface findings as informational.

Stale documentation now live on main. AGENTS.md (line 76) still says notify-agent-sync.yml fires "on every push to main" — this push trigger was removed by this PR. The review agent caught this but couldn't post it. README.md's workflow table has a similar gap (no mention that the workflow is now manual-only).

Human reviewer added complementary depth. waynesun09 identified that the scribe agent is not in the CLI's defaultAgentsRepoKnownAgents fallback list (citing specific Go identifiers in fullsend internal/cli/run.go). The review agent caught the broader "undocumented CLI fallback" issue but missed the scribe-specific detail. This is a cross-repo knowledge gap — the agent lacks access to the fullsend CLI source during review.

Existing issue evidence

• Evidence supporting fullsend#837 (status comment updates for non-happy-path runs): this workflow shows the status comment was never updated to terminal state until 19:06, well after the merge at 18:56.
• The two cancelled runs (normal concurrency behavior) did not produce novel issues; the finalize-orphaned-status-comment cleanup worked correctly for both.

Proposals filed

• Update AGENTS.md and README.md: notify-agent-sync is now manual-only (in fullsend-ai/agents)

Proposals skipped (target repo not allowed)

File manually or update create_issues.allow_targets in config.yaml:

• Post review findings as informational comment when PR merges before review completes (fullsend-ai/fullsend)