feat(#5780)!: per-repo manifest overrides and install-time GCP creds

[fullsend-ai-coder]

Summary

Add per-repo manifest overrides for infrastructure fields (inference_region, fullsend_ref, mint_url, allowed_remote_resources) using the existing NullableString + resolveField 3-level fallback pattern. Move GCP project ID and project number from the manifest into install-time-only CLI flags, and stop managing secrets in repos sync.

Related Issue

Closes #5780

Changes

• Manifest schema: Add 4 per-repo override fields to RepoEntry (3 NullableString + 1 []string), un-deprecate inference_region and fullsend_ref in UnmarshalYAML, update resolveWithEntry to use resolveField for the new fields
• Install-time GCP creds: Move inference_project and inference_project_number out of GitHubForgeInfra into CLI flags on repos install and repos add --install; remove InferenceProjectNumber requirement from Validate()
• Sync stops managing secrets: Empty managedSecrets — sync only reconciles variables (FULLSEND_MINT_URL, FULLSEND_GCP_REGION)
• CLI flags: Add --inference-region, --fullsend-ref, --mint-url, --allowed-remote-resources to repos add; add --inference-project, --inference-project-number to repos install
• Init discovery: buildManifest generates per-repo overrides where discovered values differ from the forge-level mode (mint_url, inference_region, fullsend_ref)
• Add discovery: AddToManifest populates per-repo overrides from probed repo state when values differ from manifest defaults
• Drift detection: Already works correctly with per-repo resolved values via resolveWithEntry — no changes needed

Testing

• New tests for per-repo override resolution (3-level fallback, explicit null, AllowedRemoteResources inheritance)
• New tests for YAML unmarshal/marshal round-trip with per-repo overrides
• Updated batch install tests to use install-time CLI flags instead of manifest fields
• Updated sync tests to verify secrets are no longer managed
• Updated init tests to verify InferenceProject is no longer in manifest
• All existing tests updated and passing

Checklist

• PR title follows Conventional Commits (correct type, ! for breaking changes)
• I wrote this contribution myself and can explain all changes in it

---

Closes #5780

Post-script verification

• Branch is not main/master (agent/5780-per-repo-overrides)
• Secret scan passed (gitleaks — 6df635a109f4951505ae2d7399e7d52fe15f4518..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:52 AM UTC · Completed 2:09 AM UTC
Commit: 67c2a97 · View workflow run →

[fullsend-ai-review]

Review

Findings

Low

• [cli-interface-change] internal/cli/repos.go — repos install now requires --inference-project and --inference-project-number CLI flags for GitHub repos. repos init no longer accepts these flags. Breaking change correctly marked with ! in the PR title.

• [scope-gap] internal/repos/init.go — Issue repos: per-repo overrides and install-time-only GCP credentials #5780 scope item 5 claims all 4 override fields are auto-discoverable, but allowed_remote_resources discovery from .fullsend/config.yaml is not implemented. The field works via manual override (repos add --allowed-remote-resources).

• [behavioral-contract-change] internal/repos/sync.go:55 — managedSecrets is intentionally empty — sync no longer reconciles secrets. Intentional per issue repos: per-repo overrides and install-time-only GCP credentials #5780.

• [documentation-comment] internal/repos/manifest.go — Comment groups truly deprecated fields (MintProject, MintRegion) with fields moved to CLI flags (InferenceProject, InferenceProjectNumber) under one "Deprecated" label. All are deprecated in the manifest, but InferenceProject/InferenceProjectNumber are still used at install time.

• [stale-plan-documentation] docs/plans/repos-management.md — Plan document references inference_project as a manifest field (line 41) and in the field-to-secret mapping table (line 75). These are now install-time-only CLI values.

• [stale-plan-documentation] docs/plans/repos-init.md — Plan references forge.github.inference_project_number (line 72) and lists inference_project/inference_project_number as manifest fields (line 225). These are now install-time-only CLI values.

---

Labels: PR modifies manifest schema, install-time credential handling, and sync behavior — a breaking-change feature across internal/repos/ and internal/cli/

Previous run

Review

Findings

High

• [protected-path] .github/workflows/reusable-dispatch.yml — PR modifies a file under .github/, a protected governance path. The PR description does not explain why this dispatch workflow is being changed — the linked issue (repos: per-repo overrides and install-time-only GCP credentials #5780) authorizes per-repo manifest overrides and install-time GCP credentials, not dispatch workflow modifications. Human approval is required for all protected-path changes.
  Remediation: Either revert the dispatch workflow change and handle it in a separate PR with proper authorization, or update the PR description to explain the rationale.

Medium

• [scope-creep] .github/workflows/reusable-dispatch.yml:272 — Removes the [bot]$ auto-authorization bypass from the pull_request_target review dispatch path. This change is not within issue repos: per-repo overrides and install-time-only GCP credentials #5780's authorized scope. The same removal is applied to the scaffold template (internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml:209). If intentional, this should be tracked separately.
  Remediation: Confirm whether this change is intentional or a rebase artifact. If intentional, file a separate issue with justification.

Low

• [validation-gap] internal/repos/manifest.go:872 — isValidGCPProjectID does not reject GCP project IDs ending with a hyphen (e.g., my-project-), which GCP does not allow.
  Remediation: Add a trailing-hyphen check to isValidGCPProjectID.

• [input-validation-gap] internal/cli/repos.go:384 — repos install does not validate --inference-project and --inference-project-number at the CLI layer; validation occurs inside BatchInstall() per-repo, causing all repos to fail individually rather than a single early exit.

• [scope-gap] internal/repos/init.go:34 — Issue repos: per-repo overrides and install-time-only GCP credentials #5780 scope item 5 claims all 4 override fields are auto-discoverable, but allowed_remote_resources discovery from .fullsend/config.yaml is not implemented. The field works via manual override (repos add --allowed-remote-resources).

• [behavioral-contract-change] internal/repos/sync.go:55 — managedSecrets is intentionally empty — sync no longer reconciles secrets. External automation expecting sync to write FULLSEND_GCP_PROJECT_ID will observe different behavior. Intentional per issue repos: per-repo overrides and install-time-only GCP credentials #5780.

• [cli-interface-change] internal/cli/repos.go:356 — repos install now requires --inference-project and --inference-project-number CLI flags for GitHub repos instead of reading from the manifest. repos init no longer accepts these flags. Breaking change correctly marked with ! in the PR title.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

Low

• [validation-gap] internal/cli/repos.go:570 — runReposAdd validates --fullsend-ref at the CLI layer but does not validate --mint-url. An invalid (non-HTTPS) mint URL can be persisted to the manifest; caught at next manifest load by Validate().
  Remediation: Add HTTPS URL validation for opts.mintURL alongside the existing opts.fullsendRef validation.

• [input-validation] internal/repos/batch_install.go:212 — InferenceProject (GCP project ID) is validated only for non-empty before being written as the FULLSEND_GCP_PROJECT_ID secret. No format validation unlike InferenceProjectNumber which has isNumeric(). Risk is low: operator-supplied via CLI, written to GitHub secret.

• [cli-interface-change] internal/cli/repos.go:332 — repos install now requires --inference-project and --inference-project-number CLI flags for GitHub repos instead of reading from the manifest. repos init no longer accepts these flags. Breaking change correctly marked with ! in the PR title.

• [scope-gap] internal/repos/init.go:34 — Issue repos: per-repo overrides and install-time-only GCP credentials #5780 scope item 5 claims all 4 override fields are auto-discoverable, but only 3 of 4 are implemented (mint_url, inference_region, fullsend_ref). allowed_remote_resources discovery from .fullsend/config.yaml is not implemented. The field works via manual override (repos add --allowed-remote-resources).

• [behavioral-contract-change] internal/repos/sync.go:55 — managedSecrets is intentionally empty — sync no longer reconciles secrets. External automation expecting sync to write FULLSEND_GCP_PROJECT_ID will observe different behavior. Intentional per issue repos: per-repo overrides and install-time-only GCP credentials #5780.

• [exported-struct-field-removal] internal/repos/manifest.go:319 — ResolvedConfig removes InferenceProject and InferenceProjectNumber fields. Types are under internal/ so not externally importable. GitHubForgeInfra retains these fields with identical YAML tags for backward-compatible manifest parsing.

Previous run (3)

Review

Findings

Low

• [validation-gap] internal/cli/repos.go:570 — runReposAdd validates --fullsend-ref at the CLI layer but does not validate --mint-url. An invalid (non-HTTPS) mint URL can be persisted to the manifest; caught at next manifest load by Validate().
  Remediation: Add HTTPS URL validation for opts.mintURL alongside the existing opts.fullsendRef validation.

• [input-validation] internal/repos/batch_install.go:225 — InferenceProject (GCP project ID) is validated only for non-empty before being written as the FULLSEND_GCP_PROJECT_ID secret. No format validation unlike InferenceProjectNumber which has isNumeric(). Risk is low: operator-supplied via CLI, written to GitHub secret.

• [cli-interface-change] internal/cli/repos.go:332 — repos install now requires --inference-project and --inference-project-number CLI flags for GitHub repos instead of reading from the manifest. repos init no longer accepts these flags. Breaking change correctly marked with ! in the PR title.

• [scope-gap] internal/repos/init.go:34 — Issue repos: per-repo overrides and install-time-only GCP credentials #5780 scope item 5 claims all 4 override fields are auto-discoverable, but only 3 of 4 are implemented (mint_url, inference_region, fullsend_ref). allowed_remote_resources discovery from .fullsend/config.yaml is not implemented. The field works via manual override (repos add --allowed-remote-resources).

• [behavioral-contract-change] internal/repos/sync.go:55 — managedSecrets is intentionally empty — sync no longer reconciles secrets. External automation expecting sync to write FULLSEND_GCP_PROJECT_ID will observe different behavior. Intentional per issue repos: per-repo overrides and install-time-only GCP credentials #5780.

• [exported-struct-field-removal] internal/repos/manifest.go:319 — ResolvedConfig removes InferenceProject and InferenceProjectNumber fields. Types are under internal/ so not externally importable. GitHubForgeInfra retains these fields with identical YAML tags for backward-compatible manifest parsing.

Previous run (4)

Review

Findings

Medium

• [stale-cli-behavior-claim] internal/cli/repos.go:1043 — The repos sync command's Long description says "Apply variable and secret changes to reconcile installed repos with the manifest" but managedSecrets is now empty — sync no longer manages secrets. The CLI help text claims functionality that no longer exists.
  Remediation: Update the Long description to "Apply variable changes to reconcile installed repos with the manifest. Use --dry-run to preview changes without applying them."

• [cli-interface-change] internal/cli/repos.go:332 — repos install now requires --inference-project and --inference-project-number CLI flags for GitHub repos instead of reading from the manifest. Scripts or CI/CD pipelines calling this command will need to pass these flags. The breaking change is correctly marked with ! in the PR title.
  Remediation: Add migration path documentation showing how to pass these values as CLI flags.

Low

• [behavioral-contract-change] internal/repos/sync.go:55 — managedSecrets is intentionally empty — sync no longer reconciles secrets. External automation expecting sync to write FULLSEND_GCP_PROJECT_ID will observe different behavior. Intentional per issue repos: per-repo overrides and install-time-only GCP credentials #5780.

• [input-validation] internal/cli/repos.go:338 — The --inference-project CLI flag accepts arbitrary strings with no GCP project ID format validation, unlike --inference-project-number which is validated via isNumeric(). Impact is limited since the value is written as a GitHub Actions secret, not interpolated into shell commands.

• [scope-gap] internal/repos/init.go:34 — Issue repos: per-repo overrides and install-time-only GCP credentials #5780 scope item 5 claims all 4 override fields are auto-discoverable, but only 3 of 4 are implemented (mint_url, inference_region, fullsend_ref). allowed_remote_resources discovery from .fullsend/config.yaml is not implemented. The field works via manual override (repos add --allowed-remote-resources).

• [stale-doc] docs/plans/repos-management.md — Plan document shows inference_project and inference_project_number as active manifest fields (line 41), references sync reconciling FULLSEND_GCP_PROJECT_ID (line 193), and shows the old GitHubForgeInfra struct definition (line 464). Plan documents are design artifacts — user-facing docs were updated in this PR.

• [stale-doc] docs/plans/repos-init.md:68 — Plan document lists --inference-project and --inference-project-number as repos init flags, but these have been removed from that command.

• [exported-struct-field-removal] internal/repos/manifest.go — GitHubForgeInfra struct moves InferenceProject and InferenceProjectNumber to a deprecated comment section. The fields remain in the struct with identical YAML tags for backward compatibility, but business logic no longer uses them.

---

Labels: PR modifies repos install/sync/init infrastructure and manifest schema under internal/repos/ and internal/cli/

Previous run (5)

Review

Findings

Medium

• [breaking-change-unmarked] — PR title missing required ! suffix for breaking change. The removal of inference_project and inference_project_number from GitHubForgeInfra changes how users invoke repos install (now requires --inference-project and --inference-project-number CLI flags). repos sync no longer reconciles secrets. Per COMMITS.md, GoReleaser builds release notes from merged PR titles — an unmarked title makes the breaking change invisible.
  Remediation: Change PR title to feat(#5780)!: per-repo manifest overrides and install-time GCP creds. Add BREAKING CHANGE: trailer to the merge commit.

• [validation-gap] internal/repos/manifest.go:525 — Per-repo fullsend_ref override is not validated against IsValidRef() in Validate(). The forge-level fullsend_ref IS validated at line 578. A per-repo entry with unsafe characters passes manifest validation and flows into scaffold workflow uses: lines via batch_install.go:302. The --fullsend-ref CLI flag on repos add is also not validated.
  Remediation: Add IsValidRef() validation in the per-repo entry loop in Validate(), similar to the per-repo mint_url validation at line 525. Also validate opts.fullsendRef in runReposAdd when the flag is non-empty.

Low

• [scope-gap] internal/repos/init.go:481 — Issue repos: per-repo overrides and install-time-only GCP credentials #5780 scope item 5 claims all 4 override fields are auto-discoverable, but only 3 of 4 are implemented (mint_url, inference_region, fullsend_ref). allowed_remote_resources discovery from .fullsend/config.yaml is not implemented. The field works via manual override (repos add --allowed-remote-resources).

• [scope-expansion] internal/repos/manifest.go:783 — Per-repo AllowedRemoteResources can expand the allowlist beyond defaults.allowed_remote_resources. By design per the issue.

• [behavioral-contract-change] internal/repos/sync.go:55 — managedSecrets is intentionally empty — sync no longer reconciles secrets. Intentional per issue repos: per-repo overrides and install-time-only GCP credentials #5780 but represents a contract change.

---

Labels: PR modifies repos install/sync/init infrastructure and manifest schema under internal/repos/ and internal/cli/

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (6)

Review

Findings

High

• [stale-manifest-example] docs/guides/getting-started/repo-management.md:82 — YAML example shows inference_project and inference_project_number as active fields in forge.github section. These are now deprecated install-time-only CLI flags.
  Remediation: Remove deprecated fields from the example.

• [stale-cli-docs] docs/cli/repos.md:91 — States inference_project_number field is "required in the manifest for GitHub repos." It is now a CLI flag (--inference-project-number), not a manifest field.
  Remediation: Rewrite to document the new CLI flags.

• [stale-sync-scope] docs/cli/repos.md:252 — States sync reconciles "variables and secrets (FULLSEND_GCP_PROJECT_ID)." Sync no longer manages secrets.
  Remediation: Update to "variables only."

• [stale-sync-description] docs/cli/repos.md:214 — States sync writes "variables and secrets" and "secrets are always written for convergence." Sync no longer writes secrets.
  Remediation: Remove secret references from sync description.

• [stale-diff-description] docs/guides/getting-started/repo-management.md:224 — States diff checks FULLSEND_GCP_PROJECT_ID as a "managed secret." Sync no longer manages secrets.
  Remediation: Remove managed-secret references from diff description.

• [stale-sync-scope] docs/guides/getting-started/repo-management.md:263 — States "Sync reconciles variables and secrets." Sync no longer reconciles secrets.
  Remediation: Update to "variables only."

Medium

• [validation-gap] internal/repos/batch_install.go:255 — InferenceProjectNumber moved from manifest (where Validate() enforced numeric-only) to CLI flag, but numeric validation was dropped. A non-numeric value would produce an invalid WIF provider resource name.
  Remediation: Add numeric-only validation for cfg.InferenceProjectNumber alongside the empty check.

• [dead-code] internal/cli/repos.go:186 — repos init still registers --inference-project and --inference-project-number CLI flags that buildManifest no longer uses. The flags silently accept values with no effect.
  Remediation: Remove dead fields from InitConfig and CLI flag registrations, or mark as deprecated/hidden.

• [stale-comment] internal/repos/sync.go:213 — Sync function godoc states secrets are written for convergence, but managedSecrets is now empty.
  Remediation: Update godoc to reflect variable-only reconciliation.

• [missing-new-flags] docs/cli/repos.md:114 — repos install flags table missing --inference-project and --inference-project-number.
  Remediation: Add the two new required flags to the table.

• [missing-new-flags] docs/cli/repos.md:274 — repos add flags table missing six new CLI flags (--inference-region, --fullsend-ref, --mint-url, --allowed-remote-resources, --inference-project, --inference-project-number).
  Remediation: Add the new flags to the table.

• [stale-init-commands] docs/guides/getting-started/repo-management.md:33 — Example commands show --inference-project flag on repos init which no longer populates a manifest field.
  Remediation: Remove --inference-project from init example commands.

• [stale-operations-description] docs/guides/getting-started/operations.md:87 — repos sync described as reconciling "variables and secrets." Sync no longer manages secrets.
  Remediation: Update to "variables only."

Low

• [round-trip-correctness] internal/repos/manifest.go:121 — AllowedRemoteResources with omitempty loses explicit-null semantics on marshal round-trip ([]string{} → omitted → nil).

• [scope-expansion] internal/repos/manifest.go:110 — Per-repo AllowedRemoteResources can expand the allowlist beyond defaults. Verify downstream consumers treat empty slice as deny-all.

• [behavioral-contract-change] internal/repos/sync.go:55 — managedSecrets is empty — sync stops managing secrets. Intentional per design but may need release notes.

• [cross-forge-override] internal/cli/repos.go:595 — Per-repo override comparisons check against manifest.Forge.GitHub.* regardless of forge type. GitLab entries get unnecessary overrides.

• [scope-gap] internal/repos/init.go — allowed_remote_resources discovery (issue scope item 5.4) not implemented.

• [unused-struct-fields] internal/repos/manifest.go:233 — ResolvedConfig retains InferenceProject and InferenceProjectNumber fields that resolveWithEntry no longer populates.

• [per-repo-validation] internal/repos/manifest.go:154 — Per-repo mint_url override not validated as HTTPS URL, unlike forge-level mint_url.

• [stale-init-flags] docs/cli/repos.md:53 — repos init flags table lists --inference-project as active; buildManifest no longer uses it.

• [stale-cli-internals] docs/guides/dev/cli-internals.md:298 — Phase 6 diagram shows FULLSEND_GCP_PROJECT_ID without noting it is install-time-only.

---

Labels: PR modifies repos install/sync/init infrastructure and manifest schema under internal/repos/ and internal/cli/

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[ggallen]

/fs-review

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 2:25 AM UTC · Ended 2:42 AM UTC
Commit: 7deeb28 · View workflow run →

[github-actions]

Site preview

Preview: https://70bc3378-site.fullsend-ai.workers.dev

Commit: c1f8be6a6b3b48d9c65c837a1f2d8eb8892cfc15

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:25 AM UTC · Completed 2:42 AM UTC
Commit: 7deeb28 · View workflow run →

[ggallen]

/fs-review

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 2:51 AM UTC · Ended 3:07 AM UTC
Commit: 22172eb · View workflow run →

[codecov]

Codecov Report

❌ Patch coverage is 81.91489% with 34 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/cli/repos.go	62.50%	15 Missing and 6 partials ⚠️
internal/repos/manifest.go	87.35%	5 Missing and 6 partials ⚠️
internal/repos/manifest_edit.go	75.00%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:51 AM UTC · Completed 3:07 AM UTC
Commit: 22172eb · View workflow run →

[ggallen]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:12 AM UTC · Completed 3:30 AM UTC
Commit: 52caa22 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:42 AM UTC · Completed 10:00 AM UTC
Commit: 0ca6497 · View workflow run →

[ggallen]

/fs-review

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 10:06 AM UTC · Ended 10:09 AM UTC
Commit: 5b71f28 · View workflow run →

[ggallen]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:11 AM UTC · Completed 10:31 AM UTC
Commit: 1f3c61c · View workflow run →

[ggallen]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:40 AM UTC · Completed 10:58 AM UTC
Commit: c1f8be6 · View workflow run →

Superseded by updated review

[fullsend-ai-review]

Note: The following inline comments could not be posted on the diff (GitHub returned 422) and are included here instead:

• internal/cli/repos.go:383: [low] cli-interface-change

repos install now requires --inference-project and --inference-project-number CLI flags for GitHub repos. repos init no longer accepts these flags. Breaking change correctly marked with ! in the PR title.

• internal/repos/init.go (file-level): Line 34 · [low] scope-gap

Issue #5780 scope item 5 claims all 4 override fields are auto-discoverable, but allowed_remote_resources discovery from .fullsend/config.yaml is not implemented. The field works via manual override (repos add --allowed-remote-resources).

• internal/repos/sync.go:55: [low] behavioral-contract-change

managedSecrets is intentionally empty — sync no longer reconciles secrets. Intentional per issue #5780.

• internal/repos/manifest.go (file-level): Line 593 · [low] documentation-comment

Comment groups truly deprecated fields (MintProject, MintRegion) with fields moved to CLI flags (InferenceProject, InferenceProjectNumber) under one 'Deprecated' label. All are deprecated in the manifest, but InferenceProject/InferenceProjectNumber are still used at install time.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 6:12 PM UTC · Completed 6:30 PM UTC
Commit: c1f8be6 · View workflow run →

[fullsend-ai-retro]

Retro Analysis: PR #5781 — per-repo manifest overrides and install-time GCP creds

Workflow Overview

PR #5781 was a breaking-change feature PR (feat(#5780)!) implementing per-repo manifest overrides and install-time GCP credentials. The workflow spanned ~16 hours from issue creation to merge:

1. Triage (01:01–01:22 UTC): 3 runs on issue repos: per-repo overrides and install-time-only GCP credentials #5780 (1 cancelled, 2 successful)
2. Code (01:30–01:51 UTC): Single run created a substantial 15-file, +982/−489 line PR
3. Review (01:51–10:58 UTC): 9 dispatches (2 cancelled, 7 completed) across 7 iterations
4. Fix (02:09–10:31 UTC): 3 dispatches — all failed immediately
5. Merge (18:09 UTC): Human approval, then merge

Total dispatch runs: 16 (3 triage + 1 code + 9 review + 3 fix), plus ~29 CI runs on the PR branch. Agents repo: fullsend-ai/agents.

What Went Well

• Code agent performance was excellent. A single run produced a well-structured 15-file feature with tests, docs, and a clear commit message. Only one real validation gap was found by review.
• Review agent found a genuine bug. The fullsend_ref validation gap (medium severity) could have allowed unsafe characters in scaffold workflow uses: lines. The human confirmed and fixed it.
• Review convergence was clean. Findings progressed from 19 (5H+7M+7L) to 6 (6L only) as the human addressed issues.
• Autonomy readiness is high. The review agent's final assessment aligned with the human reviewer's clean approval. The agent caught a real validation gap, correctly identified breaking changes, and its informational low-severity findings were all acknowledged as intentional design decisions.

Issues Found (All Covered by Existing Open Issues)

1. Fix agent eligibility failures — evidence for #5536
All 3 fix dispatches failed with: "Human-authored PR #5781 without 'fullsend-fix' label." The PR was authored by fullsend-ai-coder (a bot), but the eligibility check's [bot]$ regex doesn't match GitHub's app/ prefix format. This forced the human to manually fix all review findings across 7+ commits. Third confirmed instance of this bug (after PRs #5414 and #5450 cited in #5536).

2. Acknowledged findings re-raised every iteration — evidence for #5265
Three informational findings (scope-gap, behavioral-contract-change, cli-interface-change) appeared in all 7 review iterations with identical text, despite the human replying to inline comments acknowledging each one. The review agent doesn't incorporate author response context when re-reviewing.

3. Scope expansion after approval not flagged — evidence for #925
Review 5 approved SHA 0ca6497. The human then pushed SHA 1f3c61c adding dispatch workflow files. Review 6 correctly re-escalated to CHANGES_REQUESTED but didn't explain that new files drove the verdict change, making it appear as oscillation. The human removed the files and review 7 re-approved.

4. Non-deterministic finding coverage — evidence for #1389
The final review introduced stale-plan-documentation findings absent from all 6 prior reviews, despite the plan documents being unchanged throughout.

No Novel Proposals

All identified improvement opportunities are covered by existing open issues. The most impactful fix for this workflow would be #5536, which would have allowed the fix agent to assist with the manual fixes the human had to make across 7+ commits.