chore: remove pinned agent digests, disable scaffold sync dispatch

[ggallen]

Summary

• Remove 7 pinned fullsend-ai/agents SHA+hash entries from .fullsend/config.yaml, keeping only the external qualityflow agent
• Disable automatic push → main trigger on notify-scaffold-sync.yml (workflow_dispatch retained for manual use)

The CLI now falls back to resolving agents from heads/main when no agents are configured in config.yaml (commit 072f8dfca), making the pinned SHA entries unnecessary. The pinned digests were also perpetually stale — the sync job that updated them created a new commit on each repo's main, so the pins were immediately behind the agents repo's actual HEAD.

The scaffold sync dispatch is similarly a no-op: all repos already reference @main in their shim workflows, so the upgrade logic finds nothing to change.

Both sync workflows are kept in their respective repos for manual re-pinning or rollback use cases — only the automatic triggers are removed.

Companion PRs

• fullsend-ai/agents — remove notify-agent-sync.yml push trigger + config.yaml agent entries
• fullsend-ai/experiments — remove config.yaml agent entries
• fullsend-ai/metrics — remove config.yaml agent entries

Test plan

• Verify CLI resolves agents from heads/main when agents: block only contains the qualityflow entry
• Verify scaffold sync workflow can still be triggered manually via workflow_dispatch
• Verify qualityflow agent continues to resolve correctly from its pinned external source

🤖 Generated with Claude Code

[qodo-code-review]

PR Summary by Qodo

Remove pinned agent digests and disable scaffold sync push trigger

⚙️ Configuration changes ✨ Enhancement 🕐 10-20 Minutes

AI Description

• Remove pinned fullsend-ai/agents digest URLs from .fullsend/config.yaml to rely on @main fallback.
• Keep only the external qualityflow agent pinned to its upstream repo.
• Disable automatic push→main trigger for scaffold sync; retain manual workflow_dispatch.

Diagram

graph TD
  CLI["Fullsend CLI"] --> CFG[".fullsend/config.yaml"] --> QF{{"Qualityflow agent (pinned)"}}
  CFG --> AG{{"fullsend-ai/agents @main"}}
  GHA["GitHub Actions"] --> WF[["notify-scaffold-sync.yml"]] --> MAN["Manual dispatch only"]

  subgraph Legend
    direction LR
    _cfg["Config / file"] ~~~ _wf[["Workflow"]] ~~~ _ext{{"External source"}}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Keep pinned digests with scheduled sync

• ➕ Maximizes reproducibility by pinning exact agent content
• ➕ Avoids unexpected behavior changes from upstream @main updates
• ➖ Requires ongoing automation and still tends to go stale quickly
• ➖ Creates maintenance churn (frequent commits) without clear benefit if fallback is desired

2. Pin to version tags / releases instead of commit digests

• ➕ More stable than @main while avoiding constant repinning
• ➕ Clear upgrade points and rollback story
• ➖ Requires the agents repo to publish and maintain tags/releases
• ➖ Still adds management overhead vs relying on @main fallback

Recommendation: Given the CLI now intentionally falls back to resolving agents from heads/main when local pins are absent, removing the pinned fullsend-ai/agents digests is the simplest and most consistent approach. Retaining the qualityflow pin is appropriate because it is sourced from an external repo and is not covered by the fallback. Disabling the push trigger for scaffold sync also aligns with current behavior (shim workflows already reference @main), while preserving manual dispatch for rare rollback/repin scenarios.

Files changed (2) +0 / -9

Other (2) +0 / -9

config.yamlRemove pinned fullsend-ai/agents sources; keep qualityflow pin +0/-7

Remove pinned fullsend-ai/agents sources; keep qualityflow pin

• Deletes seven pinned fullsend-ai/agents raw GitHub URLs (commit+sha256) from the agents list. Retains the external qualityflow agent entry so it continues to resolve from its pinned upstream source.

.fullsend/config.yaml

notify-scaffold-sync.ymlDisable push trigger; keep manual scaffold sync dispatch +0/-2

Disable push trigger; keep manual scaffold sync dispatch

• Removes the push-to-main trigger so the workflow no longer runs automatically. Leaves workflow_dispatch enabled to allow manual triggering when repinning/rollback is needed.

.github/workflows/notify-scaffold-sync.yml

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 6:43 PM UTC · Ended 6:44 PM UTC

Commit: 928d2b2 · View workflow run →

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 6:45 PM UTC · Ended 6:49 PM UTC

Commit: b4f14fb · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📜 Skill insights (0)

1. Scribe agent no longer resolvable 🐞 Bug ≡ Correctness

Description

Removing the config entry for the scribe harness makes fullsend run scribe fail because the
agents-repo fallback only supports a fixed known-agent allowlist that does not include "scribe". Any
workflow/user invocation of the scribe agent will now error with "not in config and agents-repo
fallback unavailable".

Code

.fullsend/config.yaml[22]

-    - source: https://raw.githubusercontent.com/fullsend-ai/agents/de64c17219ce3cfcf034882e56f56c20d2e462d2/harness/scribe.yaml#sha256=988dc1b90889abda5cf9cca06059bcdd0df6ca32e860318a8a433f698b9d9004

Relevance

●●● Strong

Removing scribe appears to create a concrete runtime resolution failure; no contrary rejection
precedent found.

PR-#6400

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The repo config now registers only qualityflow, so scribe is not in config. The CLI fallback
explicitly only allows the agents in defaultAgentsRepoKnownAgents; since scribe is absent from
that list, fallback is skipped and resolveAgentSource errors when the agent is not found in
config.

.fullsend/config.yaml[8-20]
internal/cli/run.go[3858-3886]
internal/cli/run.go[91-106]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR removes the `scribe.yaml` agent registration from `.fullsend/config.yaml`. The runtime fallback to `fullsend-ai/agents` only applies to a small hard-coded set of known agents and does **not** include `scribe`, so resolving `scribe` now fails.

## Issue Context
- After this PR, `.fullsend/config.yaml` lists only the external qualityflow harness under `agents:`.
- In `internal/cli/run.go`, `resolveAgentSource` falls back to `tryAgentsRepoFallback` when an agent is not found in config.
- `tryAgentsRepoFallback` is gated by `defaultAgentsRepoKnownAgents`, which does not include `scribe`, so fallback is skipped and resolution fails.

## Fix Focus Areas
- .fullsend/config.yaml[8-20]
- internal/cli/run.go[3858-3886]
- internal/cli/run.go[91-106]

## Expected fix
Choose one:
1) Re-add the `scribe` agent entry in `.fullsend/config.yaml` (with integrity pin) if `scribe` is still intended to be runnable in this repo.
2) If `scribe` is now intended to be resolved via fallback, add `"scribe": true` to `defaultAgentsRepoKnownAgents` and ensure `fullsend-ai/agents` actually contains `harness/scribe.yaml`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Unpinned agent resolution increased 🐞 Bug ⛨ Security

Description

By removing the pinned fullsend-ai/agents URLs (commit+sha256), most first-party agents will now
be resolved via the agents-repo fallback from heads/main, which is not deterministic across runs
and does not use enrollment-time integrity fragments. This increases supply-chain risk and can cause
agent behavior to change without any config change in this repo.

Code

.fullsend/config.yaml[L16-19]

-    - source: https://raw.githubusercontent.com/fullsend-ai/agents/de64c17219ce3cfcf034882e56f56c20d2e462d2/harness/triage.yaml#sha256=44b1cecd335aa0a857e3d11a9224d9a1fb8ca60d2ffbd3abe3b84c6c7653e1c9
-    - source: https://raw.githubusercontent.com/fullsend-ai/agents/de64c17219ce3cfcf034882e56f56c20d2e462d2/harness/code.yaml#sha256=0658cd738a4747a2ebac4726c857dca466cca54f9c92305a3a9fea3587a6866b
-    - source: https://raw.githubusercontent.com/fullsend-ai/agents/de64c17219ce3cfcf034882e56f56c20d2e462d2/harness/fix.yaml#sha256=929c8b44f724cf6f385c9fa2987786a24813c331bd9537ca7b01e90a7ef26e9d
-    - source: https://raw.githubusercontent.com/fullsend-ai/agents/de64c17219ce3cfcf034882e56f56c20d2e462d2/harness/review.yaml#sha256=8e761b0f56f87379635ca559dc33b5aa45304f8c951d75f456a0d2a42456531c

Relevance

●●● Strong

Recent history accepts supply-chain findings against mutable agent refs and floating fallback
sources.

PR-#6036
PR-#1682

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR removes the sha256-pinned harness sources from config, so agent resolution will fall through
to the agents-repo fallback. That fallback resolves heads/main for non-release builds and fetches
content without enrollment-time integrity fragments, as documented in code comments.

.fullsend/config.yaml[13-20]
internal/cli/run.go[3921-3926]
internal/cli/run.go[3961-4015]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR removes commit+sha256 pinned harness URLs for first-party agents (triage/code/fix/review/retro/prioritize). Those agents will now resolve through the agents-repo fallback, which tracks `heads/main` for non-release builds and does not use the enrollment-time `#sha256=...` integrity fragment.

## Issue Context
- `resolveAgentsRef()` returns `heads/main` when the build is not a tagged release.
- `fetchPinnedAgentsRepoFile` explicitly documents that it performs no self-referential hash verification and relies on the resolved commit SHA from the ref.
- Removing the pinned config entries increases reliance on this weaker / more dynamic path.

## Fix Focus Areas
- .fullsend/config.yaml[13-20]
- internal/cli/run.go[3921-3926]
- internal/cli/run.go[3961-4015]

## Expected fix
Pick the desired security posture:
1) Re-introduce explicit `agents:` entries for first-party harnesses with `#sha256=...` integrity fragments (best reproducibility and strongest pinning).
2) Alternatively, change fallback behavior to resolve against a stable ref (e.g., a tag matching the fullsend version input) even for non-release builds, or require an opt-in flag/config for `heads/main` fallback.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 58 rules

✅ Skills: writing-user-docs, writing-adrs

Tip of the day

💡 Did you know, you can commit Qodo's fix in one click with committable suggestions (GitHub & GitLab)

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Scribe agent no longer resolvable 🐞 Bug ≡ Correctness

Removing the config entry for the scribe harness makes fullsend run scribe fail because the
agents-repo fallback only supports a fixed known-agent allowlist that does not include "scribe". Any
workflow/user invocation of the scribe agent will now error with "not in config and agents-repo
fallback unavailable".

Agent Prompt

## Issue description
The PR removes the `scribe.yaml` agent registration from `.fullsend/config.yaml`. The runtime fallback to `fullsend-ai/agents` only applies to a small hard-coded set of known agents and does **not** include `scribe`, so resolving `scribe` now fails.

## Issue Context
- After this PR, `.fullsend/config.yaml` lists only the external qualityflow harness under `agents:`.
- In `internal/cli/run.go`, `resolveAgentSource` falls back to `tryAgentsRepoFallback` when an agent is not found in config.
- `tryAgentsRepoFallback` is gated by `defaultAgentsRepoKnownAgents`, which does not include `scribe`, so fallback is skipped and resolution fails.

## Fix Focus Areas
- .fullsend/config.yaml[8-20]
- internal/cli/run.go[3858-3886]
- internal/cli/run.go[91-106]

## Expected fix
Choose one:
1) Re-add the `scribe` agent entry in `.fullsend/config.yaml` (with integrity pin) if `scribe` is still intended to be runnable in this repo.
2) If `scribe` is now intended to be resolved via fallback, add `"scribe": true` to `defaultAgentsRepoKnownAgents` and ensure `fullsend-ai/agents` actually contains `harness/scribe.yaml`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

2. Unpinned agent resolution increased 🐞 Bug ⛨ Security

By removing the pinned fullsend-ai/agents URLs (commit+sha256), most first-party agents will now
be resolved via the agents-repo fallback from heads/main, which is not deterministic across runs
and does not use enrollment-time integrity fragments. This increases supply-chain risk and can cause
agent behavior to change without any config change in this repo.

Agent Prompt

## Issue description
The PR removes commit+sha256 pinned harness URLs for first-party agents (triage/code/fix/review/retro/prioritize). Those agents will now resolve through the agents-repo fallback, which tracks `heads/main` for non-release builds and does not use the enrollment-time `#sha256=...` integrity fragment.

## Issue Context
- `resolveAgentsRef()` returns `heads/main` when the build is not a tagged release.
- `fetchPinnedAgentsRepoFile` explicitly documents that it performs no self-referential hash verification and relies on the resolved commit SHA from the ref.
- Removing the pinned config entries increases reliance on this weaker / more dynamic path.

## Fix Focus Areas
- .fullsend/config.yaml[13-20]
- internal/cli/run.go[3921-3926]
- internal/cli/run.go[3961-4015]

## Expected fix
Pick the desired security posture:
1) Re-introduce explicit `agents:` entries for first-party harnesses with `#sha256=...` integrity fragments (best reproducibility and strongest pinning).
2) Alternatively, change fallback behavior to resolve against a stable ref (e.g., a tag matching the fullsend version input) even for non-release builds, or require an opt-in flag/config for `heads/main` fallback.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:51 PM UTC · Completed 7:02 PM UTC

Commit: 11f7e4e · View workflow run →

[fullsend-ai-review]

Review skipped — this PR is already merged.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend pre-review check}

[fullsend-ai-review]

Review skipped — this PR is already merged.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend post-review check}