ci: add automatic Planfile GitHub synchronization

.github/workflows/planfile-github-sync.yml

@@ -0,0 +1,31 @@
+name: Planfile GitHub sync
+
+on:
+  schedule:
+    - cron: "17 * * * *"
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - ".planfile/**"
+      - "*.planfile.yaml"
+      - "*.planfile.yml"
+      - "planfile.yaml"
+      - "tickets.planfile.yaml"
+
+concurrency:
+  group: planfile-github-sync-${{ github.repository }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  sync:
+    uses: semcod/planfile/.github/workflows/planfile-sync-reusable.yml@e79d79509c050514ba434c3bd6589f932b91c920 # v0.1.126
+    with:
+      planfile-version: "0.1.126"
+    permissions:
+      contents: read
+      issues: write

TODO.md

@@ -4,3 +4,7 @@
 - [x] Implement ticket-bound URI process resource measurements.
 - [x] Aggregate historical samples into scheduling estimates.
 - [x] Validate representative Subactor processes.
+
+## Automatic Planfile synchronization — 2026-09-15
+
+- [x] Add the reusable GitHub Actions caller workflow pinned to `v0.1.126` — ticket-015.

project/TICKETS.md

@@ -17,4 +17,5 @@ analysis artifacts.
 | **ticket-009** | [`README.md`](./ticket-009/README.md) | [`preprompt.md`](./ticket-009/preprompt.md) | - |  [`ai-codex.md`](./ticket-009/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-009/ai-codex-logs.txt) | [`changelog.md`](./ticket-009/changelog.md) |
 | **ticket-010** | [`README.md`](./ticket-010/README.md) | [`preprompt.md`](./ticket-010/preprompt.md) | - |  [`ai-codex.md`](./ticket-010/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-010/ai-codex-logs.txt) | [`changelog.md`](./ticket-010/changelog.md) |
 | **ticket-011** | [`README.md`](./ticket-011/README.md) | [`preprompt.md`](./ticket-011/preprompt.md) | - |  [`ai-codex.md`](./ticket-011/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-011/ai-codex-logs.txt) | [`changelog.md`](./ticket-011/changelog.md) |
+| **ticket-012** | [`README.md`](./ticket-012/README.md) | [`preprompt.md`](./ticket-012/preprompt.md) | - |  [`ai-codex.md`](./ticket-012/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-012/ai-codex-logs.txt) | [`changelog.md`](./ticket-012/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-015/README.md

@@ -0,0 +1,32 @@
+# Ticket 015: Add automatic Planfile GitHub synchronization
+
+- **ID**: ticket-015
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-09-15
+
+## Goal and scope
+
+To be completed from human-owned input.
+
+## Acceptance criteria
+
+- [ ] AC-01: Scope is approved by a human owner.
+
+## Participants
+
+- Human participant: unresolved; no user-* file was created by this script.
+- Agent participant: [ai-codex.md](ai-codex.md)
+
+## Implementation scope
+
+This ticket adds `.github/workflows/planfile-github-sync.yml` using the reusable workflow published by
+`semcod/planfile` at `v0.1.126`. It runs on the repository schedule, on
+Planfile changes, and through manual dispatch. The workflow has only read access
+to repository contents and write access to GitHub Issues.
+
+## Session authorization
+
+The user request to update the other projects and make synchronization automatic
+records `SESSION_EXECUTION_AUTHORIZATION` for this bounded implementation.

project/ticket-015/ai-codex-logs.txt

@@ -0,0 +1,3 @@
+planfile sync rollout: scaffold, intent scope, workflow, governance check, commit, push, PR
+planfile rollout: scaffold, bounded intent, workflow, gate, commit and PR
+planfile rollout: scaffold, bounded intent, workflow, gate, commit and PR

project/ticket-015/ai-codex.md

@@ -0,0 +1,35 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-015
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+To be completed after reading human-owned input and the ticket preprompt.
+
+## Execution plan
+
+1. Validate the ticket scope and acceptance evidence before implementation.
+
+## Actual changes
+
+- Initialized the bounded ticket and recorded SESSION_EXECUTION_AUTHORIZATION
+  from the request to execute this work.
+
+## Blockers
+
+- None inside the recorded intent; proceed without a second confirmation.
+- New authority remains required for destructive action, secret access, new
+  external coordination or material objective expansion. Protected delivery
+  may be invoked without another prompt when publication is in scope; its
+  exact-head trusted approval remains independent evidence.
+
+## Execution record
+
+- Added the reusable Planfile caller workflow pinned to `v0.1.126`.
+- Restricted the change to `.github/workflows/planfile-github-sync.yml`, ticket evidence, and `TODO.md`.
+- Default branch used for the push trigger: `main`.
+- No human-owned `user-*.md` file was created or edited.

project/ticket-015/changelog.md

@@ -0,0 +1,6 @@
+# Ticket Changelog (ticket-015)
+
+## [0.1.0] - 2026-09-15
+
+- Initial governance scaffold created.
+- No human participant identity or content was generated.

project/ticket-015/intent.json

@@ -0,0 +1,74 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-015",
+  "summary": "Add the standard automatic Planfile GitHub synchronization workflow.",
+  "workstream": "infrastructure",
+  "classification": {
+    "kind": "FEATURE",
+    "priority": "P1",
+    "origin": "requested"
+  },
+  "allowedPaths": [
+    ".github/workflows/planfile-github-sync.yml",
+    "TODO.md",
+    "project/TICKETS.md",
+    "project/ticket-015/**"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "e207b5182d289bd2db2b33b2b6d7cd105551cf30",
+    "targetBranch": "main",
+    "outcome": "The repository gets a pinned, scheduled Planfile GitHub Issue synchronization caller workflow.",
+    "nonGoals": [
+      "Change application source behavior.",
+      "Add runtime dependencies.",
+      "Modify human-owned ticket input."
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 10,
+    "budgets": {
+      "maxImplementationFiles": 1,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Use the shared Planfile reusable workflow pinned to the published release and grant only contents read plus issues write.",
+      "components": [
+        {
+          "name": "github-planfile-sync",
+          "paths": [
+            ".github/workflows/planfile-github-sync.yml"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Remove the caller workflow; repository application files remain unchanged."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "./project/governance-check.sh",
+          "git diff --check"
+        ],
+        "evidence": "The bounded ticket and workflow pass the repository governance gate."
+      }
+    ]
+  }
+}

project/ticket-015/preprompt.md

@@ -0,0 +1,15 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-015
+- **Task title**: Add automatic Planfile GitHub synchronization
+- **Created**: 2026-09-15T13:45:30Z
+
+Keep executable implementation outside this governance/evidence directory.
+Read a human-owned user-*.md file only when one exists.
+The request to execute this work creates SESSION_EXECUTION_AUTHORIZATION;
+proceed within the recorded intent without a redundant confirmation prompt.
+Require new authority for destructive action, secrets, external coordination,
+or material objective expansion. When publication is in scope, session
+authorization permits the declared protected delivery process and its merge
+after exact-head trusted approval without another prompt. Session prose is
+never approval evidence and the agent must not merge directly.