Review dispatch should authorize the org's own code agent for review

[fullsend-ai-retro]

What happened

PR #2924 was authored by fullsend-ai-coder[bot] to fix #2903. The fullsend dispatch workflow fired on all pull_request_target events (opened, synchronize), but the is_event_actor_authorized function in reusable-dispatch.yml calls has_write_permission, which queries the GitHub collaborator permission API. For fullsend-ai-coder[bot], this returns permission: none because GitHub App bots are not collaborators — they operate via installation tokens. All four pull_request_target runs logged 'No stage matched — skipping dispatch', and the review agent never posted a review. Meanwhile, human-authored PRs #3039 and #3003, merged in the same timeframe, both received reviews from fullsend-ai-review[bot].

What could go better

Every PR authored by the code agent currently skips automated review entirely. This means the review agent — which is designed to catch issues before human reviewers see the PR — provides zero value on the PRs most likely to benefit from it (autonomous code changes). The human reviewer on PR #2924 approved without comments, which is reasonable for a simple change but means no automated review safety net existed. Confidence is high: the dispatch logs and GitHub API behavior confirm the root cause. Issue #2495 covers auto-applying the ok-to-test label for bot PRs (which gates E2E tests), but the review dispatch authorization is a separate code path with a separate gate.

Proposed change

In reusable-dispatch.yml, update is_event_actor_authorized to recognize trusted bot actors (e.g., fullsend-ai-coder[bot]) as authorized for review dispatch. Options: (1) add a hardcoded allowlist of the org's own bot usernames checked before the collaborator API call, or (2) check the actor's [bot] suffix and verify it belongs to an org-installed GitHub App. Scope the fix to the review stage — the ok-to-test / E2E gate is tracked separately in #2495.

Validation criteria

After the fix, the next 3 bot-authored PRs should each receive a review from fullsend-ai-review[bot] without manual intervention. Verify by checking for review comments on PRs where the author login ends in [bot].

---

Generated by retro agent from #2924

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 6:19 AM UTC · Completed 6:21 AM UTC
Commit: 0a95cac · View workflow run →

[fullsend-ai-triage]

This issue describes the same problem as #2674 — the is_event_actor_authorized check in reusable-dispatch.yml fails for GitHub App bot actors because they aren't collaborators, causing review dispatch to be silently skipped on all bot-authored PRs.

Both issues identify the same root cause (the has_write_permission collaborator API check), the same affected path (review stage dispatch for coder-bot PRs), and propose the same category of fix (recognizing trusted bot actors as authorized). The earlier issue #2674 also cross-references #2636 which documents the same root cause on the retro-to-triage dispatch path.

Recommending closing as duplicate in favor of #2674.