Operator decisions to start stage-1 shadow data collection

[mabry1985]

ADR 0078 is Accepted and everything is built; stage-1 (the ≥2-repo / ≥2-week three-way shadow report) starts when these operator calls are made:

1. Vera's GitHub identity — required

The dry run proved it twice: GitHub 422s a review APPROVE from the PR author's own token, and the self-review guard drops same-identity PRs by design. The reviewer must run under an identity that does not author PRs in the managed repos — a dedicated machine account PAT or (better, matching Quinn) a GitHub App. The ADR deferred this to Phase D; it's now the blocking decision.

• Create/choose the identity (suggestion: an App like protovera, mirroring @protoquinn)
• gh auth / token in the instance env for the gh CLI + git clones

2. Shadow repos — required

• Pick ≥2 repos Quinn + CodeRabbit already review (e.g. protoLabsAI/protoAgent, protoLabsAI/projectBoard-plugin) and set pr_reviewer.repos
• Add the GitHub webhook per repo: https://<host>/plugins/pr-reviewer/webhook, JSON, secret → pr_reviewer.webhook_secret (Settings; it lands in the secrets overlay)

3. Where Vera runs — required

• A persistent instance (the local systemd unit is currently failed and has no gateway key in env — model.api_key in config or OPENAI_API_KEY in protoagent.env both work now, the plugin falls back to host config)
• Install: python -m server plugin install https://github.com/protoLabsAI/qaEngineer, enable [workflows, github, pr-reviewer], keep shadow_mode: true, promotion_owner: false
• Host needs: git, gh (as Vera), clawpatch (npm i -g @protolabsai/protopatch)

Then

Data accrues automatically (telemetry + posted COMMENT verdicts). The report comes from GET /api/plugins/pr-reviewer/eval + eval.three_way_rows (us vs Quinn's verdicts vs CodeRabbit threads per PR), with Quinn's own metrics (99.4% completion, 44.7s median) as the floor. Stage-2 (formal layer) and stage-3 (per-repo promotion handover / retirement) stay data-earned per-repo decisions.

Housekeeping

• Delete mabry1985/qa-dryrun (private scratch repo from the acceptance run; token here lacked admin scope)
• pr-reviewer-plugin#1 stays as the standing draft review fixture — don't merge it
• pr-reviewer-plugin#6 tracks the promote-retry backoff nit

🤖 Generated with Claude Code

[protoquinn]

---

Triage Report — protoLabsAI/qaEngineer#2

Classification: actionable (ops/deployment checklist, not a bug)

Field	Assessment
Type	Operational deployment checklist — not a software defect
Repo status	qaEngineer is not in the managed project registry — clawpatch, labels, comments, and close are all 403-blocked
Commit cross-ref	No commits or PRs across managed repos reference Vera, shadow data collection, or qaEngineer setup tasks
Checklist progress	All 10+ checkboxes appear unchecked in the issue body; no comments or activity visible

Why actionable (not stale / already-fixed / duplicate)

The issue is a concrete, well-scoped deployment checklist:

1. Vera's GitHub identity — create a machine account or GitHub App (e.g. protovera), provision token
2. Shadow repos — pick ≥2 repos, configure webhooks
3. Instance — provision persistent host, install plugin + deps, set shadow_mode: true
4. Housekeeping — delete dry-run scratch repo, preserve fixture PRs

These are real, blocking items — the ADR is accepted and code is built. No evidence any have been completed. The issue should remain open until the checklist is resolved.

Action taken

None — qaEngineer is outside the managed project registry. I cannot label, comment, or close the issue. To make it triageable:

• Add the repo to the project registry (tag with protoagent-plugin topic on GitHub, or register it server-side)
• Alternatively, manually label it ops, deployment, actionable and consider whether any items can be checked off

Pattern observation

This is the only open item referencing Vera/shadow-data — no sister issues or related PRs across the 24 managed repos. The deployment is gated entirely on this single checklist.

[mabry1985]

Update before setup: install from bundle v0.1.1 — it pins pr-reviewer-plugin v0.2.2, which adds the promotion-failure backoff (#6, typed hold:promote-backoff + one inbox escalation) and the stage-1 report command: pr_review_eval agent tool + GET /api/plugins/pr-reviewer/eval/three-way (summary + per-PR ours/Quinn/CodeRabbit rows + rendered markdown). Identity note from Josh: the reviewer identity will be set up as protoReview.

[mabry1985]

Parking is built (headless fleet-container plan, per Josh):

• Image: ghcr.io/protolabsai/vera:latest — Dockerfile in this repo (stock protoAgent + node22/clawpatch + members baked at manifest pins + seed config + SOUL). Publishing on every main push; v0.1.2 pins pr-reviewer v0.2.3 (adds the PR_REVIEWER_WEBHOOK_SECRET env fallback headless deploys need).
• Stack: homelab-iac#183 — stacks/vera on ai_default, tailnet A2A at http://ava:7874 (bearer VERA_API_KEY), headless, watchtower.
• Webhook: https://hooks.proto-labs.ai/plugins/pr-reviewer/webhook (cloudflared path rule ahead of Quinn's catch-all) — set this as the protoReview App's webhook URL.

Remaining operator steps collapse to: mint the three Infisical secrets (VERA_API_KEY, PROTOREVIEW_GH_TOKEN, PR_REVIEWER_WEBHOOK_SECRET), finish the protoReview App (webhook URL above), merge #183 + compose up, set pr_reviewer.repos. Full checklist: stacks/vera/SECRETS.md.