Promote dev → main: agent card + fleet-health filter + ceremony fixes (v0.7.22 candidate)

[mabry1985]

Promotes the post-#418 work since v0.7.21:

PR	Description
#427	wire alert.* executors + startup validator
#428	stop world.state.# leak from ceremony snapshots
#429	rollcall skill source
#431	wire ceremony skill executors
#432	wire 5 pr-remediator skills
#433	register protomaker A2A agent
#434	drop overscoped subscribesTo from protomaker
#435	rename web_search → searxng_search in ava.yaml
#436	disable fleet_agent_stuck loop (mitigation)
#451	disable 4 more action.* loops (mitigation)
#452	per-action cooldown infrastructure (closes #437)
#454	route 4 ceremonies, disable 3 broken
#455	pre-dispatch target registry guard (closes #444)
#456	honor enabled:false on initial ceremony load (closes #453)
#457	wrap subscribe-spy push callbacks to return void (CI green)
#460	filter outcomes from synthetic actors (closes #459)
#462	agent card advertises canonical A2A endpoint (closes #461)

All landed and verified live on :dev (workstacean container) since 2026-04-20. Discord ops silent for the duration (cooldown + registry guard holding).

This is HITL-gated per protocol — operator approval required before merge.

Summary by CodeRabbit

Release Notes

• New Features

  • Added GitHub issues monitoring with severity tracking and automatic triage actions.
  • Added per-action cooldown mechanism to prevent redundant dispatches.
  • Enhanced environment configuration with new URL resolution variables for A2A discovery.

• Bug Fixes

  • Corrected extension URIs across A2A specifications.
  • Fixed ceremony state topic isolation to prevent world-state namespace conflicts.

• Documentation

  • Updated configuration guides and API references.
  • Enhanced agent skill and extension documentation.

• Chores

  • Version bumped to 0.7.21.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR implements comprehensive fixes for multiple critical issues (#437, #444, #453, #459) involving action deduplication, executor validation, ceremony lifecycle management, and fleet health reporting. Core changes include: action-level cooldown throttling (cooldownMs), pre-dispatch executor registry validation, disabled-ceremony enforcement during initial load, synthetic-actor filtering in fleet health, extension URI hostname corrections, agent-card URL resolution separation, and new executor plugins for alerts/ceremonies/PR remediator skills. Workspace definitions are updated to reflect routing changes, new agents (protomaker), and GitHub issue tracking integration.

Changes

Cohort / File(s)	Summary
Extension URI hostname corrections src/executor/extensions/{blast,confidence,cost,effect-domain,hitl-mode}.ts, src/executor/task-tracker.ts, docs/extensions/*	Updated all A2A extension URI constants and documentation from protolabs.ai to proto-labs.ai hostname.
Action-level cooldown mechanism src/planner/types/action.ts, src/schemas/yaml-schemas.ts, src/plugins/action-dispatcher-plugin.ts, src/plugins/action-dispatcher-plugin.test.ts, src/telemetry/telemetry-service.ts, workspace/actions.yaml	Added per-action meta.cooldownMs field for dispatch throttling; implemented _admitOrCooldown gate and lastDispatchedAt tracking in dispatcher; added cooldown_dropped telemetry event.
Pre-dispatch executor registry validation src/planner/validate-action-executors.ts, src/planner/__tests__/validate-action-executors.test.ts, src/plugins/action-dispatcher-plugin.ts, src/plugins/action-dispatcher-plugin.test.ts	Introduced validateActionExecutors, findUnwiredActions, and UnwiredActionsError to cross-check actions against live executor registry; added _admitOrTargetUnresolved dispatch gate with target_unresolved telemetry.
Agent fleet health synthetic actor filtering src/plugins/agent-fleet-health-plugin.ts, src/plugins/agent-fleet-health-plugin.test.ts	Split outcome aggregation into real-agent (agentWindows) and synthetic-actor (systemActorWindows) buckets; added SystemActorOutcomeSummary and systemActors[] to snapshot; updated _isRegisteredAgent() whitelist using executor registry.
Ceremony disabled-state enforcement src/loaders/ceremonyYamlLoader.ts, src/loaders/__tests__/ceremonyYamlLoader.test.ts, src/plugins/CeremonyPlugin.ts, src/plugins/__tests__/CeremonyPlugin.test.ts	Modified loader to return disabled ceremonies with enabled: false instead of filtering; added initial-load and hot-reload guards in CeremonyPlugin to skip scheduling disabled entries; added test coverage for enabled↔disabled transitions.
Ceremony state topic separation src/world/extensions/CeremonyStateExtension.ts, src/world/extensions/__tests__/CeremonyStateExtension.test.ts, docs/reference/ceremony-plugin.md	Changed publication topic from world.state.snapshot to ceremony.state.snapshot; added regression test ensuring ceremony state doesn't leak into world-state namespace.
Agent-card URL resolution restructuring src/api/agent-card.ts, src/api/__tests__/agent-card.test.ts, src/config/env.ts, .env.dist, docs/reference/env-vars.md, docs/reference/http-api.md	Separated WORKSTACEAN_BASE_URL (A2A callback only) from new WORKSTACEAN_PUBLIC_BASE_URL (canonical A2A discovery) and WORKSTACEAN_INTERNAL_HOST (docker-network fallback); updated card URL resolution to use resolveA2aUrl() and include additionalInterfaces.
Alert skill executor plugin src/plugins/alert-skill-executor-plugin.ts, src/plugins/__tests__/alert-skill-executor-plugin.test.ts	Added new AlertSkillExecutorPlugin registering FunctionExecutor handlers for alert.* GOAP skills; publishes to message.outbound.discord.alert topic with severity/headline metadata.
Ceremony skill executor plugin src/plugins/ceremony-skill-executor-plugin.ts, src/plugins/__tests__/ceremony-skill-executor-plugin.test.ts	Added CeremonySkillExecutorPlugin bridging GOAP ceremony.* actions to ceremony.<id>.execute trigger events via BusMessage.
PR remediator skill executor plugin src/plugins/pr-remediator-skill-executor-plugin.ts, src/plugins/__tests__/pr-remediator-skill-executor-plugin.test.ts	Added PrRemediatorSkillExecutorPlugin routing GOAP action.pr_* and action.dispatch_backmerge skills to PR remediator bus topics with fire-and-forget dispatch.
PR remediator enhancements lib/plugins/pr-remediator.ts, src/pr-remediator.test.ts	Added auto-approve patterns, continuous self-dispatch from cached state, per-action HITL policy extraction/forwarding, and policy-aware expiry in merge-ready error path.
Goal evaluator payload validation src/plugins/goal_evaluator_plugin.ts, __tests__/goal_evaluator_plugin.test.ts	Added _looksLikeWorldState() type guard, selector validation (_validateLoadedGoalSelectors), and defensive payload inspection to reject malformed world.state.# events.
Bus tools expansion src/agent-runtime/tools/bus-tools.ts	Added list action to manage_board tool with GET endpoint; replaced web_search with searxng_search supporting optional category, time_range, max_results parameters and richer response fields.
DeepAgent executor refinements src/executor/executors/deep-agent-executor.ts	Updated searxng_search tool schema; implemented per-skill systemPromptOverride resolution in execute() for world-state prompt injection.
Langfuse trace extension src/executor/extensions/langfuse-trace.ts	Added new extension URI (https://proto-labs.ai/a2a/ext/trace-v1) and registerLangfuseTraceExtension() stamping trace metadata (traceId, callerAgent, skill, project) into context.
API board features list endpoint src/api/board.ts	Added GET /api/board/features/list route proxying to Studio's feature list API with query-param forwarding and error handling.
GitHub issues polling API src/api/github.ts	Added GET /api/github-issues endpoint aggregating open issues per project with label/timestamp/author metadata and zero-fallback behavior.
Root startup wiring src/index.ts	Added registration of executor plugins (alert, ceremony, PR remediator skill executors) and Langfuse trace extension; wired ExecutorRegistry into ActionDispatcher and AgentFleetHealth; added startup validation via validateActionExecutors() with optional strict mode; registered github_issues polling domain.
Deep-agent runtime documentation docs/integrations/runtimes/deep-agent.ts	Updated system prompt injection behavior, executor tool groups, and example ava.yaml configuration (model, maxTurns, tools/skills).
Agent skills schema docs/reference/agent-skills.md	Removed chain.{agent,skill} fields; added systemPromptOverride optional field; restructured documentation with explicit name/description/keywords/systemPromptOverride table.
Workspace agent/project/ceremony configuration workspace/agents.yaml, workspace/agents/ava.yaml, workspace/projects.yaml, workspace/ceremonies/*.yaml	Added protomaker agent; expanded Ava's tools/skills for orchestration/observation/act; added protoagent project; disabled ceremonies (agent-health, board.pr-audit, board.retro, service-health); routed ceremonies to specific agents (quinn for board.cleanup, board.health, daily-standup, health-check).
GOAP actions and goals workspace/actions.yaml, workspace/goals.yaml	Added meta.cooldownMs across all actions (alerts 15min, skill dispatch 30min, PR remediation 5min, ceremonies 30min); added "Issue Zero" actions for GitHub critical/bug/total issue thresholds; added three new goals (issues.zero_critical, issues.zero_bugs, issues.total_low).
Documentation updates README.md, .claude/commands/rollcall.md, docs/explanation/self-improving-loop.md	Updated to reflect DeepAgent executor (not ProtoSdkExecutor), expanded Ava operational skills, new A2A extension URIs, environment variable semantics, and self-improvement loop with chronic-failure-driven goal/config proposals.
Package versions package.json, dashboard/package.json	Bumped both to version 0.7.21.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

• feat(ava): expand helm toolset, wire GOAP skills, fix ceremony disable bug #415 — Overlaps on ceremony loader behavior (disabled ceremony handling), DeepAgentExecutor system prompt per-skill customization, and agent/README documentation reflecting expanded Ava capabilities.
• promote: dev -> main — A2A Phases 1-8 complete #174 — Overlaps on A2A agent-card URL resolution, WORKSTACEAN environment variable semantics, and task-tracker/callback infrastructure changes.

Suggested reviewers

• protoquinn

Poem

🐰 Cooldowns, guards, and synthetic whispers—
The dispatcher now knows which actors matter,
No more duplicate incidents clattering,
Each action waits its turn, ceremonies sleep clean,
And fleet health sees only the real in between! ✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch dev

[coderabbitai]

Actionable comments posted: 9

🧹 Nitpick comments (4)

src/executor/extensions/hitl-mode.ts (1)

23-23: Consider centralizing the extension URI base to avoid host drift.

You’re updating this hostname in multiple extension files; a shared constant/helper would reduce future mismatches.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/executor/extensions/hitl-mode.ts` at line 23, HITL_MODE_URI is hardcoded
causing host drift risk; extract the common host into a shared constant (e.g.,
EXTENSION_BASE_URI) in a central module (like an extensions/constants or config
file) and rebuild HITL_MODE_URI by concatenating that base with the path (e.g.,
`${EXTENSION_BASE_URI}/a2a/ext/hitl-mode-v1`); update the symbol HITL_MODE_URI
in src/executor/extensions/hitl-mode.ts to import and use the centralized base
and change other extension files to import the same constant so all extension
URIs are composed from one authoritative source.

src/planner/__tests__/end-to-end-loop.test.ts (1)

146-152: Make the async assertion condition-based to reduce flakiness.

The fixed setTimeout(50) can intermittently fail on slower CI nodes. Prefer waiting until the expected condition is met (with an upper timeout).

Proposed stabilization diff

-    await new Promise((r) => setTimeout(r, 50));
+    const deadline = Date.now() + 1000;
+    while (skillRequests.length < 1 && Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, 10));
+    }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/planner/__tests__/end-to-end-loop.test.ts` around lines 146 - 152,
Replace the fixed sleep with a condition-based wait: instead of await new
Promise((r) => setTimeout(r, 50)), poll/wait until the expected condition is
true (skillRequests has length 1) with a reasonable upper timeout (e.g., 1–2s)
to avoid flaky CI; target the assertion around skillRequests in this test (and
consider also checking planner inFlightGoals or ActionDispatcher cooldown state
if relevant) so the test only proceeds when skillRequests.length === 1 or the
timeout is reached.

src/plugins/agent-fleet-health-plugin.ts (1)

320-334: Consider caching the registered agent list for performance.

_isRegisteredAgent is called on every outcome event and iterates executorRegistry.list() each time. For high-throughput scenarios, this could become a bottleneck.

♻️ Optional: Cache known agents periodically

+  private knownAgentsCache: Set<string> = new Set();
+  private knownAgentsCacheTime = 0;
+  private static readonly CACHE_TTL_MS = 10_000; // 10 seconds

   private _isRegisteredAgent(actor: string): boolean {
     if (!this.executorRegistry) return true;
-    const known = this.executorRegistry
-      .list()
-      .map(r => r.agentName)
-      .filter((n): n is string => typeof n === "string" && n.length > 0);
-    return known.includes(actor);
+    const now = Date.now();
+    if (now - this.knownAgentsCacheTime > AgentFleetHealthPlugin.CACHE_TTL_MS) {
+      this.knownAgentsCache = new Set(
+        this.executorRegistry
+          .list()
+          .map(r => r.agentName)
+          .filter((n): n is string => typeof n === "string" && n.length > 0)
+      );
+      this.knownAgentsCacheTime = now;
+    }
+    return this.knownAgentsCache.has(actor);
   }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/plugins/agent-fleet-health-plugin.ts` around lines 320 - 334, The
_isRegisteredAgent method currently calls this.executorRegistry.list() on every
outcome event which is expensive; cache the known agent names in a Set (e.g.,
this._knownAgentNames: Set<string>) and change _isRegisteredAgent to check that
Set instead of re-listing; populate/update the Set from executorRegistry.list()
when the plugin initializes, and refresh it either on executorRegistry change
events (if available) or on a short timer/periodic interval to keep it in sync
with the registry.

src/planner/__tests__/validate-action-executors.test.ts (1)

141-166: Verify mock usage aligns with test guidelines.

The test uses mock() to create a minimal bus stub. While the guideline states "no mocks," this appears to be a lightweight interface stub rather than mocking implementation details or LLM calls. If strict adherence is required, consider using the same makeBus() pattern from the ceremony-skill-executor tests.

♻️ Optional: Use makeBus() pattern for consistency

-    const published: BusMessage[] = [];
-    const bus = {
-      subscribe: mock(() => "sub-id"),
-      unsubscribe: mock(() => {}),
-      publish: mock((_topic: string, msg: BusMessage) => { published.push(msg); }),
-      topics: () => [],
-    };
+    function makeBus() {
+      const published: BusMessage[] = [];
+      return {
+        published,
+        subscribe(_topic: string, _name: string, _handler: (msg: BusMessage) => void) {
+          return `sub-${Math.random()}`;
+        },
+        unsubscribe(_id: string) {},
+        publish(_topic: string, msg: BusMessage) { published.push(msg); },
+        topics() { return []; },
+      };
+    }
+    const bus = makeBus();

-    validateActionExecutors(actions, executors, { bus: bus as never });
+    validateActionExecutors(actions, executors, { bus: bus as never });

-    const alerts = published.filter(m => m.topic === "message.outbound.discord.alert");
+    const alerts = bus.published.filter(m => m.topic === "message.outbound.discord.alert");

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/planner/__tests__/validate-action-executors.test.ts` around lines 141 -
166, Replace the ad-hoc mock bus stub with the shared test bus factory used
elsewhere (e.g., makeBus) so the test follows the “no mocks” guideline: locate
the test in validate-action-executors.test.ts that constructs the bus object
(used by validateActionExecutors) and swap the mock-based
subscribe/unsubscribe/publish/topics implementation for a makeBus() instance
that records published messages (so you can still inspect published messages),
keeping assertions on ActionRegistry, ExecutorRegistry, noopExecutor, and the
published array intact; ensure the created bus implements publish to push
BusMessage objects and exposes topics/subscribe/unsubscribe as the other tests
expect.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.claude/commands/rollcall.md:
- Line 5: The command in the README uses a machine-specific absolute path ("bash
/home/josh/dev/protoWorkstacean/scripts/agent-rollcall.sh"); change it to a
repo-relative invocation (e.g., "bash ./scripts/agent-rollcall.sh" or
"scripts/agent-rollcall.sh") so the instruction is portable across machines and
consistent with the repo-local guidance elsewhere; update every occurrence of
that absolute path (the same string) to the repo-relative form.

In `@docs/integrations/runtimes/deep-agent.md`:
- Line 51: The docs YAML example still references the old tool name
"web_search"; update the example so the tool name is "searxng_search" (to match
the executor rename in deep-agent-executor.ts where the tool was renamed), and
ensure any agent "tools" arrays in the example use "searxng_search" instead of
"web_search" so the search tool is available at runtime.
- Line 116: The table entry currently lists the tool as `web_search` but the
implementation uses `searxng_search`; update the docs table row (the entry
containing `web_search` and the description "SearXNG `/search` | Quick web
search (5 results)") to replace the `web_search` symbol with `searxng_search` so
the documentation matches the runtime/tool name used by the code.

In `@src/api/github.ts`:
- Around line 466-468: The handler currently treats missing GITHUB_TOKEN as a
successful empty-result by returning Response.json({...}), which hides
data-unavailable state; change the early-return that checks repoList and
GITHUB_TOKEN so that when GITHUB_TOKEN is falsy you return a non-2xx response
(e.g., Response.json({ message: "GitHub auth missing", availability: false }, {
status: 503 })) or at minimum include an explicit availability flag
(availability: false) in the returned payload; update the check around repoList
and GITHUB_TOKEN and the Response.json call (symbols: GITHUB_TOKEN, repoList,
Response.json) so consumers can detect and gate on missing auth.
- Around line 489-491: The issues fetch currently calls ghApi once with
per_page=100 (const issues = await
ghApi(`/repos/${repo}/issues?state=open&per_page=100&sort=created&direction=asc`)
), so implement paginated fetching like the PR pipeline handler: loop over page
numbers adding `&page=${page}` to the request, collect each batch into the
existing issues array, break when the returned batch.length < 100 or when page
>= MAX_PAGES, and then use the accumulated issues to compute totalOpen and label
totals; use the same MAX_PAGES constant and ghApi function to guard against
runaway loops.

In `@src/plugins/__tests__/pr-remediator-skill-executor-plugin.test.ts`:
- Around line 13-31: Replace the custom makeBus() stub in the test with the real
InMemoryEventBus implementation: remove makeBus() and any as never casts and
instantiate InMemoryEventBus (or a small typed helper wrapper) where makeBus()
was used so the tests exercise real install()/publish()/subscribe() semantics;
update references in the test file (pr-remediator-skill-executor-plugin.test.ts)
for each occurrence (lines around the makeBus usage, and the other noted
occurrences) to use InMemoryEventBus and adjust any test helper types to match
its API (subscribe, unsubscribe, publish, topics, published inspection) so the
tests run against the actual in-memory bus contract instead of a partial mock.

In `@src/plugins/pr-remediator-skill-executor-plugin.ts`:
- Around line 56-69: install registers FunctionExecutor instances for each entry
in PR_REMEDIATOR_SKILL_TOPICS via registry.register but uninstall only clears
this.bus, leaving executors live; fix by tracking registrations created in
install (e.g., store the skills or registration handles from registry.register)
and then during uninstall iterate those tracked identifiers to call
registry.unregister (or registry.register with null/replace) to remove them;
also make install idempotent by checking for existing registrations for each
entry.skill before creating/registering a new FunctionExecutor (or unregistering
first) so repeated install/uninstall cycles do not leave stale executors.

In `@workspace/actions.yaml`:
- Around line 167-170: The meta entries that set skillHint to debug_ci_failures
(and the similar entries at the other locations mentioned) are missing an
explicit target selector, so dispatch may be claimed by any agent exposing the
same skill; edit those action blocks (the ones with meta.skillHint:
debug_ci_failures and the blocks for investigate_orphaned_skills / issue_triage)
to add an explicit target selector field that pins them to Ava (for example add
target: "ava" or executor: "Ava" following your repo's action schema) so
validation ensures these actions are routed only to Ava.

In `@workspace/projects.yaml`:
- Around line 99-105: The Discord config for the project defines empty values
for the discord.dev.channelId, discord.dev.webhook, discord.release.channelId,
and discord.release.webhook, which will disable notifications; either populate
these four fields with the correct channel IDs and webhook URLs or, if
empty-by-design, add a comment or link to a tracking issue next to the discord
block to signal intentional omission (modify the `discord` section in
projects.yaml, touching the `dev` and `release` entries and their
`channelId`/`webhook` keys).

---

Nitpick comments:
In `@src/executor/extensions/hitl-mode.ts`:
- Line 23: HITL_MODE_URI is hardcoded causing host drift risk; extract the
common host into a shared constant (e.g., EXTENSION_BASE_URI) in a central
module (like an extensions/constants or config file) and rebuild HITL_MODE_URI
by concatenating that base with the path (e.g.,
`${EXTENSION_BASE_URI}/a2a/ext/hitl-mode-v1`); update the symbol HITL_MODE_URI
in src/executor/extensions/hitl-mode.ts to import and use the centralized base
and change other extension files to import the same constant so all extension
URIs are composed from one authoritative source.

In `@src/planner/__tests__/end-to-end-loop.test.ts`:
- Around line 146-152: Replace the fixed sleep with a condition-based wait:
instead of await new Promise((r) => setTimeout(r, 50)), poll/wait until the
expected condition is true (skillRequests has length 1) with a reasonable upper
timeout (e.g., 1–2s) to avoid flaky CI; target the assertion around
skillRequests in this test (and consider also checking planner inFlightGoals or
ActionDispatcher cooldown state if relevant) so the test only proceeds when
skillRequests.length === 1 or the timeout is reached.

In `@src/planner/__tests__/validate-action-executors.test.ts`:
- Around line 141-166: Replace the ad-hoc mock bus stub with the shared test bus
factory used elsewhere (e.g., makeBus) so the test follows the “no mocks”
guideline: locate the test in validate-action-executors.test.ts that constructs
the bus object (used by validateActionExecutors) and swap the mock-based
subscribe/unsubscribe/publish/topics implementation for a makeBus() instance
that records published messages (so you can still inspect published messages),
keeping assertions on ActionRegistry, ExecutorRegistry, noopExecutor, and the
published array intact; ensure the created bus implements publish to push
BusMessage objects and exposes topics/subscribe/unsubscribe as the other tests
expect.

In `@src/plugins/agent-fleet-health-plugin.ts`:
- Around line 320-334: The _isRegisteredAgent method currently calls
this.executorRegistry.list() on every outcome event which is expensive; cache
the known agent names in a Set (e.g., this._knownAgentNames: Set<string>) and
change _isRegisteredAgent to check that Set instead of re-listing;
populate/update the Set from executorRegistry.list() when the plugin
initializes, and refresh it either on executorRegistry change events (if
available) or on a short timer/periodic interval to keep it in sync with the
registry.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2b05879d-8b80-404e-b0de-a13b082a908a

📥 Commits

Reviewing files that changed from the base of the PR and between 4e910d7 and 7ebbbf9.

📒 Files selected for processing (71)

• .claude/commands/rollcall.md
• .env.dist
• README.md
• __tests__/goal_evaluator_plugin.test.ts
• dashboard/package.json
• docs/explanation/self-improving-loop.md
• docs/extensions/blast-v1.md
• docs/extensions/confidence-v1.md
• docs/extensions/cost-v1.md
• docs/extensions/effect-domain-v1.md
• docs/extensions/hitl-mode-v1.md
• docs/guides/extend-an-a2a-agent.md
• docs/integrations/runtimes/deep-agent.md
• docs/reference/agent-skills.md
• docs/reference/ceremony-plugin.md
• docs/reference/env-vars.md
• docs/reference/http-api.md
• lib/plugins/pr-remediator.ts
• package.json
• src/agent-runtime/tools/bus-tools.ts
• src/api/__tests__/agent-card.test.ts
• src/api/agent-card.ts
• src/api/board.ts
• src/api/github.ts
• src/config/env.ts
• src/executor/executors/deep-agent-executor.ts
• src/executor/extensions/blast.ts
• src/executor/extensions/confidence.ts
• src/executor/extensions/cost.ts
• src/executor/extensions/effect-domain.ts
• src/executor/extensions/hitl-mode.ts
• src/executor/extensions/langfuse-trace.ts
• src/executor/task-tracker.ts
• src/index.ts
• src/loaders/__tests__/ceremonyYamlLoader.test.ts
• src/loaders/ceremonyYamlLoader.ts
• src/planner/__tests__/end-to-end-loop.test.ts
• src/planner/__tests__/validate-action-executors.test.ts
• src/planner/types/action.ts
• src/planner/validate-action-executors.ts
• src/plugins/CeremonyPlugin.ts
• src/plugins/__tests__/CeremonyPlugin.test.ts
• src/plugins/__tests__/alert-skill-executor-plugin.test.ts
• src/plugins/__tests__/ceremony-skill-executor-plugin.test.ts
• src/plugins/__tests__/pr-remediator-skill-executor-plugin.test.ts
• src/plugins/action-dispatcher-plugin.test.ts
• src/plugins/action-dispatcher-plugin.ts
• src/plugins/agent-fleet-health-plugin.test.ts
• src/plugins/agent-fleet-health-plugin.ts
• src/plugins/alert-skill-executor-plugin.ts
• src/plugins/ceremony-skill-executor-plugin.ts
• src/plugins/goal_evaluator_plugin.ts
• src/plugins/pr-remediator-skill-executor-plugin.ts
• src/pr-remediator.test.ts
• src/schemas/yaml-schemas.ts
• src/telemetry/telemetry-service.ts
• src/world/extensions/CeremonyStateExtension.ts
• src/world/extensions/__tests__/CeremonyStateExtension.test.ts
• workspace/actions.yaml
• workspace/agents.yaml
• workspace/agents/ava.yaml
• workspace/ceremonies/agent-health.yaml
• workspace/ceremonies/board.cleanup.yaml
• workspace/ceremonies/board.health.yaml
• workspace/ceremonies/board.pr-audit.yaml
• workspace/ceremonies/board.retro.yaml
• workspace/ceremonies/daily-standup.yaml
• workspace/ceremonies/health-check.yaml
• workspace/ceremonies/service-health.yaml
• workspace/goals.yaml
• workspace/projects.yaml

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Use a repo-relative invocation instead of a machine-specific absolute path.

Line 5 hard-codes a local home directory and conflicts with the repo-local guidance in Line 11, making the command non-portable.

Suggested fix

-1. Run `bash /home/josh/dev/protoWorkstacean/scripts/agent-rollcall.sh`
+1. Run `bash scripts/agent-rollcall.sh`

Also applies to: 11-11

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.claude/commands/rollcall.md at line 5, The command in the README uses a
machine-specific absolute path ("bash
/home/josh/dev/protoWorkstacean/scripts/agent-rollcall.sh"); change it to a
repo-relative invocation (e.g., "bash ./scripts/agent-rollcall.sh" or
"scripts/agent-rollcall.sh") so the instruction is portable across machines and
consistent with the repo-local guidance elsewhere; update every occurrence of
that absolute path (the same string) to the repo-relative form.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Tool name mismatch: web_search should be searxng_search.

The executor code renamed this tool from web_search to searxng_search (see deep-agent-executor.ts line 265), but the YAML example still lists the old name. Agents referencing web_search in their tools array will not have the search tool available.

Proposed fix

-  - web_search
+  - searxng_search

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- web_search
	- searxng_search

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/integrations/runtimes/deep-agent.md` at line 51, The docs YAML example
still references the old tool name "web_search"; update the example so the tool
name is "searxng_search" (to match the executor rename in deep-agent-executor.ts
where the tool was renamed), and ensure any agent "tools" arrays in the example
use "searxng_search" instead of "web_search" so the search tool is available at
runtime.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Tool table also references old name web_search.

For consistency with the implementation, this should be searxng_search.

Proposed fix

-| `web_search` | SearXNG `/search` | Quick web search (5 results) |
+| `searxng_search` | SearXNG `/search` | Web search with category routing (default: 10 results) |

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	| `web_search` | SearXNG `/search` | Quick web search (5 results) |
	| `searxng_search` | SearXNG `/search` | Web search with category routing (default: 10 results) |

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/integrations/runtimes/deep-agent.md` at line 116, The table entry
currently lists the tool as `web_search` but the implementation uses
`searxng_search`; update the docs table row (the entry containing `web_search`
and the description "SearXNG `/search` | Quick web search (5 results)") to
replace the `web_search` symbol with `searxng_search` so the documentation
matches the runtime/tool name used by the code.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Don’t treat missing GitHub auth as “zero issues.”

When GITHUB_TOKEN is absent, this returns success with all counters at 0. That can falsely indicate healthy issue state instead of “data unavailable.” Return a non-2xx status or add an explicit availability flag so downstream goals can gate on freshness.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/api/github.ts` around lines 466 - 468, The handler currently treats
missing GITHUB_TOKEN as a successful empty-result by returning
Response.json({...}), which hides data-unavailable state; change the
early-return that checks repoList and GITHUB_TOKEN so that when GITHUB_TOKEN is
falsy you return a non-2xx response (e.g., Response.json({ message: "GitHub auth
missing", availability: false }, { status: 503 })) or at minimum include an
explicit availability flag (availability: false) in the returned payload; update
the check around repoList and GITHUB_TOKEN and the Response.json call (symbols:
GITHUB_TOKEN, repoList, Response.json) so consumers can detect and gate on
missing auth.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

GitHub REST API docs for "List repository issues": confirm pagination requirements, per_pagemaximum, and use ofpage/Link headers for full result sets.

💡 Result:

The GitHub REST API endpoint for "List repository issues" (GET /repos/{owner}/{repo}/issues) requires pagination for result sets exceeding the default of 30 items (max per_page=100). Use the per_page parameter (1-100, default 30) and page parameter (default 1) for offset-based pagination. For full result sets, parse the Link response header, which provides rel="next", "prev", "first", "last" URLs (omitted if all results fit on one page). Example Link: https://api.github.com/repos/.../issues?page=2&per_page=100; rel="next". Cursor-based pagination (before/after) may apply for very large datasets, but page/Link is standard.

Citations:

• 1: https://docs.github.com/en/rest/issues/issues
• 2: https://docs.github.com/en/rest/using-the-rest-api/using-pagination-in-the-rest-api
• 3: https://docs.github.com/en/rest/issues/issues?apiVersion=latest

---

🏁 Script executed:

cd /root/codebase && wc -l src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 136

---

🏁 Script executed:

cd /root/codebase && sed -n '480,500p' src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 136

---

🏁 Script executed:

cd /root/codebase && sed -n '520,545p' src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 136

---

🏁 Script executed:

cd /root/codebase && rg -n "ghApi.*issues" src/api/github.ts -A 3

Repository: protoLabsAI/protoWorkstacean

Length of output: 136

---

🏁 Script executed:

wc -l src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 93

---

🏁 Script executed:

sed -n '480,500p' src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 632

---

🏁 Script executed:

sed -n '520,545p' src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 1238

---

🏁 Script executed:

rg -n "ghApi.*issues" src/api/github.ts -A 3

Repository: protoLabsAI/protoWorkstacean

Length of output: 54

---

🏁 Script executed:

rg -n "ghApi" src/api/github.ts -A 2 -B 1

Repository: protoLabsAI/protoWorkstacean

Length of output: 3431

---

🏁 Script executed:

sed -n '1,50p' src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 1818

---

🏁 Script executed:

sed -n '500,547p' src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 2097

---

🏁 Script executed:

grep -n "per_page=100" src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 346

---

🏁 Script executed:

sed -n '138,160p' src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 1053

---

🏁 Script executed:

sed -n '525,540p' src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 601

---

🏁 Script executed:

rg -n "issues" src/api/github.ts -B 2 -A 2

Repository: protoLabsAI/protoWorkstacean

Length of output: 1997

---

🏁 Script executed:

sed -n '485,510p' src/api/github.ts

Repository: protoLabsAI/protoWorkstacean

Length of output: 1050

---

Implement pagination for issues query — currently only fetches first 100 results.

The issues endpoint at lines 489-491 fetches with per_page=100 but missing the page parameter and pagination loop. Repos with more than 100 open issues will be undercounted, skewing totalOpen and label totals.

Use the same pagination pattern as the PR pipeline handler (lines 138-160): loop through pages with a page parameter, break when batch.length < 100, and cap at MAX_PAGES to guard against runaway loops.

Suggested fix

-        const issues = await ghApi(
-          `/repos/${repo}/issues?state=open&per_page=100&sort=created&direction=asc`,
-        ) as Array<{
-          number: number;
-          title: string;
-          labels: Array<{ name: string }>;
-          created_at: string;
-          updated_at: string;
-          user: { login: string } | null;
-          pull_request?: unknown;
-        }>;
+        type IssueItem = {
+          number: number;
+          title: string;
+          labels: Array<{ name: string }>;
+          created_at: string;
+          updated_at: string;
+          user: { login: string } | null;
+          pull_request?: unknown;
+        };
+        const issues: IssueItem[] = [];
+        const MAX_PAGES = 5;
+        for (let page = 1; page <= MAX_PAGES; page++) {
+          const batch = await ghApi(
+            `/repos/${repo}/issues?state=open&per_page=100&page=${page}&sort=created&direction=asc`,
+          ) as IssueItem[];
+          if (batch.length === 0) break;
+          issues.push(...batch);
+          if (batch.length < 100) break;
+        }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/api/github.ts` around lines 489 - 491, The issues fetch currently calls
ghApi once with per_page=100 (const issues = await
ghApi(`/repos/${repo}/issues?state=open&per_page=100&sort=created&direction=asc`)
), so implement paginated fetching like the PR pipeline handler: loop over page
numbers adding `&page=${page}` to the request, collect each batch into the
existing issues array, break when the returned batch.length < 100 or when page
>= MAX_PAGES, and then use the accumulated issues to compute totalOpen and label
totals; use the same MAX_PAGES constant and ghApi function to guard against
runaway loops.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Use the real InMemoryEventBus here.

The bespoke makeBus() stub plus as never installs bypasses the actual bus contract, so these tests can go green while install() / publish() behavior drifts from the real runtime. Rebase these cases on InMemoryEventBus (or a typed helper built on top of it) instead of a partial mock.

As per coding guidelines, "Write unit tests with bun test against in-memory bus with no mocks and no LLM calls" and "Use TypeScript with strict mode for all application code".

Also applies to: 42-43, 87-88, 145-146, 163-164

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/plugins/__tests__/pr-remediator-skill-executor-plugin.test.ts` around
lines 13 - 31, Replace the custom makeBus() stub in the test with the real
InMemoryEventBus implementation: remove makeBus() and any as never casts and
instantiate InMemoryEventBus (or a small typed helper wrapper) where makeBus()
was used so the tests exercise real install()/publish()/subscribe() semantics;
update references in the test file (pr-remediator-skill-executor-plugin.test.ts)
for each occurrence (lines around the makeBus usage, and the other noted
occurrences) to use InMemoryEventBus and adjust any test helper types to match
its API (subscribe, unsubscribe, publish, topics, published inspection) so the
tests run against the actual in-memory bus contract instead of a partial mock.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

uninstall() leaves dead executors registered.

After uninstall(), the registry will still resolve these five skills, but each executor now only returns "not installed". That means dispatch and startup validation can still treat the skills as wired even though the plugin is gone. uninstall() should remove the registrations it added, or install() needs to replace them idempotently.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/plugins/pr-remediator-skill-executor-plugin.ts` around lines 56 - 69,
install registers FunctionExecutor instances for each entry in
PR_REMEDIATOR_SKILL_TOPICS via registry.register but uninstall only clears
this.bus, leaving executors live; fix by tracking registrations created in
install (e.g., store the skills or registration handles from registry.register)
and then during uninstall iterate those tracked identifiers to call
registry.unregister (or registry.register with null/replace) to remove them;
also make install idempotent by checking for existing registrations for each
entry.skill before creating/registering a new FunctionExecutor (or unregistering
first) so repeated install/uninstall cycles do not leave stale executors.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Route these skills explicitly to Ava.

These entries describe Ava-only work, but unlike the later investigate_orphaned_skills / issue_triage actions they leave target selection open. That means validation only proves that some executor exists for the skill, not that the dispatch lands on Ava, and it becomes ambiguous if another agent later exposes the same skill.

Suggested config fix

   meta:
     skillHint: debug_ci_failures
+    agentId: ava
     fireAndForget: true
     cooldownMs: 1800000  # 30 min — agent skill dispatch (`#437`)

   meta:
     skillHint: fleet_incident_response
+    agentId: ava
     fireAndForget: true
     cooldownMs: 1800000  # 30 min — agent skill dispatch, expensive (`#437`)

   meta:
     skillHint: downshift_models
+    agentId: ava
     fireAndForget: true
     cooldownMs: 1800000  # 30 min — agent skill dispatch (`#437`)

Also applies to: 572-575, 636-639

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@workspace/actions.yaml` around lines 167 - 170, The meta entries that set
skillHint to debug_ci_failures (and the similar entries at the other locations
mentioned) are missing an explicit target selector, so dispatch may be claimed
by any agent exposing the same skill; edit those action blocks (the ones with
meta.skillHint: debug_ci_failures and the blocks for investigate_orphaned_skills
/ issue_triage) to add an explicit target selector field that pins them to Ava
(for example add target: "ava" or executor: "Ava" following your repo's action
schema) so validation ensures these actions are routed only to Ava.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Discord configuration is incomplete.

The channelId and webhook fields are empty strings, which will silently skip Discord notifications for this project. If this is intentional (awaiting Discord channel setup), consider adding a comment or tracking issue. Otherwise, ensure these are populated before release.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@workspace/projects.yaml` around lines 99 - 105, The Discord config for the
project defines empty values for the discord.dev.channelId, discord.dev.webhook,
discord.release.channelId, and discord.release.webhook, which will disable
notifications; either populate these four fields with the correct channel IDs
and webhook URLs or, if empty-by-design, add a comment or link to a tracking
issue next to the discord block to signal intentional omission (modify the
`discord` section in projects.yaml, touching the `dev` and `release` entries and
their `channelId`/`webhook` keys).

[protoquinn]

Auto-remediation verdict: decomposable — closing and proposing a split.

This PR has merge conflicts that cluster into distinct file groups. Rather than attempting a complex merge, the recommended path is to split this PR into smaller, focused PRs — one per file cluster.

Conflicting file clusters:

• src/services/a2a/agentCard.ts
• src/services/fleet-health/collector.ts
• src/services/ceremonies/loader.ts
• package.json

Evidence: This dev→main promotion PR bundles 3 independent concerns (agent card URL fix, fleet-health synthetic-actor filter, ceremony-loader enabled flag) across 33 commits of drift. The conflicts arise because main diverged with hotfixes touching overlapping files. Splitting into separate PRs per feature area (agent-card, fleet-health, ceremony) would isolate the conflicting files and allow each to merge independently.

Please re-cut this as smaller, focused PRs targeting each cluster independently. This avoids the conflict and makes each change easier to review.

Automated verdict by pr-remediator diagnose_pr_stuck skill.