@cxi-lmai/ci-agent-platform 3.0.1 → 3.1.1

package/payload/ci-templates/github/claude-issue-pipeline.yml

@@ -74,7 +74,7 @@ env:
   PIPE_GIT_NAME: ${{ vars.PIPE_GIT_NAME || 'Pipeline Bot' }}
   PIPE_GIT_EMAIL: ${{ vars.PIPE_GIT_EMAIL || 'bot@pipeline.ci' }}
   PIPE_MODEL_TRIAGE: ${{ vars.PIPE_MODEL_TRIAGE || 'haiku' }}
-  PIPE_MODEL_CODE: ${{ vars.PIPE_MODEL_CODE || 'claude-sonnet-5-0' }}
+  PIPE_MODEL_CODE: ${{ vars.PIPE_MODEL_CODE || 'claude-sonnet-5' }}
   PIPE_AGENT_ENV_ALLOWLIST: ${{ vars.PIPE_AGENT_ENV_ALLOWLIST || '' }}
   # Runtime mapping onto the PIPE_ names the scripts read.
   PIPE_REPO: ${{ github.repository }}

package/payload/ci-templates/github/claude-pipeline.yml

@@ -44,8 +44,8 @@ env:
   PIPE_COMMIT_REVIEWFIX: ${{ vars.PIPE_COMMIT_REVIEWFIX || 'Fix review findings' }}
   PIPE_GIT_NAME: ${{ vars.PIPE_GIT_NAME || 'Pipeline Bot' }}
   PIPE_GIT_EMAIL: ${{ vars.PIPE_GIT_EMAIL || 'bot@pipeline.ci' }}
-  PIPE_MODEL_REVIEW: ${{ vars.PIPE_MODEL_REVIEW || 'claude-sonnet-5-0' }}
-  PIPE_MODEL_CODE: ${{ vars.PIPE_MODEL_CODE || 'claude-sonnet-5-0' }}
+  PIPE_MODEL_REVIEW: ${{ vars.PIPE_MODEL_REVIEW || 'claude-sonnet-5' }}
+  PIPE_MODEL_CODE: ${{ vars.PIPE_MODEL_CODE || 'claude-sonnet-5' }}
   PIPE_AGENT_ENV_ALLOWLIST: ${{ vars.PIPE_AGENT_ENV_ALLOWLIST || '' }}
   # Runtime mapping onto the PIPE_ names the scripts read.
   PIPE_REPO: ${{ github.repository }}

package/payload/ci-templates/github/claude-test-fix.yml

@@ -49,7 +49,7 @@ env:
   PIPE_COMMIT_COVERAGE: ${{ vars.PIPE_COMMIT_COVERAGE || 'Add coverage tests' }}
   PIPE_GIT_NAME: ${{ vars.PIPE_GIT_NAME || 'Pipeline Bot' }}
   PIPE_GIT_EMAIL: ${{ vars.PIPE_GIT_EMAIL || 'bot@pipeline.ci' }}
-  PIPE_MODEL_CODE: ${{ vars.PIPE_MODEL_CODE || 'claude-sonnet-5-0' }}
+  PIPE_MODEL_CODE: ${{ vars.PIPE_MODEL_CODE || 'claude-sonnet-5' }}
   PIPE_AGENT_ENV_ALLOWLIST: ${{ vars.PIPE_AGENT_ENV_ALLOWLIST || '' }}
   PIPE_TEST_ARTIFACT: ${{ vars.PIPE_TEST_ARTIFACT || 'test-reports' }}
   PIPE_REPO: ${{ github.repository }}

package/payload/ci-templates/scripts/agent-architect.sh

@@ -0,0 +1,233 @@
+#!/bin/bash
+# Runner for the opt-in weekly agent-architect job. It collects bounded,
+# forge-neutral evidence; the /agent-architect skill performs the analysis.
+set -e
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=lib/pipeline-common.sh
+source "$SCRIPT_DIR/lib/pipeline-common.sh"
+# shellcheck source=lib/issue-loop.sh
+source "$SCRIPT_DIR/lib/issue-loop.sh"
+pipe_defaults
+
+ARCHITECT_ENV="$PIPE_CONTEXT_DIR/architect.env"
+CONTEXT_FILE="$PIPE_CONTEXT_DIR/architect-context.md"
+REPORT_FILE="$PIPE_CONTEXT_DIR/architect-report.md"
+PROPOSALS_FILE="$PIPE_CONTEXT_DIR/architect-proposals.json"
+if [ "${DRY_RUN+x}" = x ]; then
+  DRY_RUN="$DRY_RUN"
+else
+  DRY_RUN="${PIPE_ARCHITECT_DRY_RUN:-true}"
+fi
+WINDOW_DAYS="${PIPE_ARCHITECT_WINDOW_DAYS:-7}"
+
+write_marker() {
+  printf 'ARCHITECT_STATUS=%s\nARCHITECT_PROPOSALS=%s\nARCHITECT_ISSUES_FILED=%s\n' \
+    "$1" "$2" "$3" > "$ARCHITECT_ENV"
+}
+
+if [ "${PIPE_AGENT_ARCHITECT:-0}" != "1" ]; then
+  write_marker disabled 0 0
+  pipe_log "Agent architect is disabled"
+  exit 0
+fi
+
+if ! [[ "$WINDOW_DAYS" =~ ^[1-9][0-9]*$ ]]; then
+  write_marker invalid_window 0 0
+  pipe_log "ERROR: PIPE_ARCHITECT_WINDOW_DAYS must be a positive integer"
+  exit 1
+fi
+
+if date --version >/dev/null 2>&1; then
+  SINCE=$(date -u -d "$WINDOW_DAYS days ago" '+%Y-%m-%dT%H:%M:%SZ')
+else
+  SINCE=$(date -u -v-"$WINDOW_DAYS"d '+%Y-%m-%dT%H:%M:%SZ')
+fi
+WEEK_TAG=$(date -u +%G-W%V)
+
+# The updated-since helper has the window semantics the source job needs. It
+# returns both states, so retain only merged MRs/PRs targeting this project’s
+# configured integration branch and cap the prompt input before any per-item IO.
+RECENT_MRS=$(platform_merge_requests_updated_since "$SINCE") || {
+  write_marker fetch_failed 0 0
+  pipe_log "ERROR: failed to fetch recently updated MRs/PRs"
+  exit 1
+}
+MRS=$(jq -c --arg target "$PIPE_TARGET_BRANCH" \
+  '[.[] | select(.state == "merged" and .target_branch == $target)] | .[0:30]' <<< "$RECENT_MRS") || {
+  write_marker fetch_failed 0 0
+  pipe_log "ERROR: unexpected merged MR/PR response"
+  exit 1
+}
+MR_COUNT=$(jq -r 'length' <<< "$MRS")
+if ! [[ "$MR_COUNT" =~ ^[0-9]+$ ]]; then
+  write_marker fetch_failed 0 0
+  pipe_log "ERROR: could not count merged MRs/PRs"
+  exit 1
+fi
+if [ "$MR_COUNT" = 0 ]; then
+  write_marker no_evidence 0 0
+  pipe_log "No merged MRs/PRs in the last $WINDOW_DAYS days"
+  exit 0
+fi
+
+# Stuck issues are current actionable context. Stuck MRs/PRs are selected from
+# the same bounded recent window, so neither evidence source can expand prompt
+# size without a hard limit.
+STUCK_ISSUES=$(issues_by_labels "$PIPE_LABEL_STUCK" "" opened 20) || {
+  pipe_log "WARNING: failed to fetch open $PIPE_LABEL_STUCK issues; continuing without them"
+  STUCK_ISSUES='[]'
+}
+STUCK_MRS=$(jq -c --arg label "$PIPE_LABEL_STUCK" \
+  '[.[] | select((.labels // []) | index($label))] | .[0:20]' <<< "$RECENT_MRS") || STUCK_MRS='[]'
+OPEN_IMPROVEMENTS=$(issues_by_label_created "$PIPE_LABEL_IMPROVEMENT" opened 10) || {
+  pipe_log "WARNING: failed to fetch open $PIPE_LABEL_IMPROVEMENT issues; continuing without dedup context"
+  OPEN_IMPROVEMENTS='[]'
+}
+
+# Resolve the configured bot identity once so automatic comments do not become
+# evidence. A failed lookup merely leaves the filter empty rather than failing a
+# read-only scheduled analysis.
+platform_resolve_bot_user || true
+
+MR_EVIDENCE=""
+while IFS= read -r IID; do
+  TITLE=$(jq -r --argjson iid "$IID" '.[] | select(.iid == $iid) | .title' <<< "$MRS")
+  AUTHOR=$(jq -r --argjson iid "$IID" '.[] | select(.iid == $iid) | .author' <<< "$MRS")
+  LABELS=$(jq -r --argjson iid "$IID" '.[] | select(.iid == $iid) | (.labels // []) | join(",")' <<< "$MRS")
+  FILES=$(platform_mr_changes "$IID" 15 2>/dev/null | sed 's/^/  /' || true)
+  NOTES=$(platform_mr_notes "$IID" 20 asc 2>/dev/null \
+    | jq -r --arg bot "${PIPE_BOT_USER:-}" \
+      '[.[] | select($bot == "" or .author != $bot)
+       | "  [" + .author + "]: " + ((.body | gsub("[\\r\\n]+"; " "))[0:200])]
+       | .[0:20] | join("\n")' 2>/dev/null || true)
+  MR_EVIDENCE="${MR_EVIDENCE}
+### MR/PR !${IID}: ${TITLE}
+Author: ${AUTHOR} | Labels: ${LABELS}
+Changed files:
+${FILES:-  (none)}
+Human review comments:
+${NOTES:-  (none)}
+"
+done < <(jq -r '.[].iid' <<< "$MRS")
+
+STUCK_EVIDENCE=""
+while IFS= read -r IID; do
+  TITLE=$(jq -r --argjson iid "$IID" '.[] | select(.iid == $iid) | .title' <<< "$STUCK_ISSUES")
+  DESCRIPTION=$(jq -r --argjson iid "$IID" '.[] | select(.iid == $iid) | .description // "(none)"' <<< "$STUCK_ISSUES" | head -c 400)
+  STUCK_EVIDENCE="${STUCK_EVIDENCE}
+### Stuck issue #${IID}: ${TITLE}
+${DESCRIPTION}
+"
+done < <(jq -r '.[].iid' <<< "$STUCK_ISSUES")
+while IFS= read -r IID; do
+  TITLE=$(jq -r --argjson iid "$IID" '.[] | select(.iid == $iid) | .title' <<< "$STUCK_MRS")
+  NOTES=$(platform_mr_notes "$IID" 15 asc 2>/dev/null \
+    | jq -r --arg bot "${PIPE_BOT_USER:-}" \
+      '[.[] | select($bot == "" or .author != $bot)
+       | "  [" + .author + "]: " + ((.body | gsub("[\\r\\n]+"; " "))[0:200])]
+       | .[0:15] | join("\n")' 2>/dev/null || true)
+  STUCK_EVIDENCE="${STUCK_EVIDENCE}
+### Stuck MR/PR !${IID}: ${TITLE}
+Human comments:
+${NOTES:-  (none)}
+"
+done < <(jq -r '.[].iid' <<< "$STUCK_MRS")
+
+OPEN_CONTEXT=$(jq -r '.[] | "Issue #\(.iid) (\(.created_at[0:10])): \(.title)\n\(.description[0:500])\n---"' <<< "$OPEN_IMPROVEMENTS" 2>/dev/null | head -c 6000 || true)
+rm -f "$ARCHITECT_ENV" "$REPORT_FILE" "$PROPOSALS_FILE"
+{
+  echo "# Agent architect context"
+  echo
+  echo "Time window: last $WINDOW_DAYS days (since $SINCE)"
+  echo "Week: $WEEK_TAG"
+  echo "Ready label: $PIPE_LABEL_READY"
+  echo "Improvement label: $PIPE_LABEL_IMPROVEMENT"
+  echo
+  echo "## Merged MRs/PRs"
+  printf '%s\n' "$MR_EVIDENCE"
+  echo "## Stuck items"
+  printf '%s\n' "${STUCK_EVIDENCE:-(none)}"
+  if [ -n "$OPEN_CONTEXT" ]; then
+    echo
+    echo "## Already-open improvement issues — do not re-propose these"
+    printf '%s\n' "$OPEN_CONTEXT"
+  fi
+} > "$CONTEXT_FILE"
+
+REPORT=$(pipe_run_agent agent-architect "/agent-architect" "Agent,Read,Glob,Grep" "$PIPE_MODEL_REVIEW" < /dev/null)
+printf '%s\n' "$REPORT" > "$REPORT_FILE"
+if [ ! -s "$REPORT_FILE" ]; then
+  write_marker no_output 0 0
+  pipe_failure_log_notice_files "the weekly agent-architect analysis" \
+    "review the recent changes and stuck items by hand" \
+    "$PIPE_AGENT_STDERR" "$REPORT_FILE" | while IFS= read -r line; do pipe_log "$line"; done
+  exit 0
+fi
+
+# Retain at most five complete delimiter blocks. The JSON file keeps body text
+# out of shell words and is also the sole source for issue creation below.
+if ! command -v python3 >/dev/null 2>&1; then
+  write_marker parser_failed 0 0
+  pipe_log "WARNING: python3 is unavailable; cannot parse architect proposals"
+  exit 0
+fi
+if ! python3 - "$REPORT_FILE" "$PROPOSALS_FILE" <<'PY'
+import json
+import re
+import sys
+
+report_path, proposals_path = sys.argv[1:]
+text = open(report_path, encoding="utf-8").read()
+proposals = []
+for block in re.findall(r"<!-- ISSUE-START -->(.*?)<!-- ISSUE-END -->", text, re.S)[:5]:
+    title = next((line[7:].strip() for line in block.splitlines() if line.startswith("Title: ")), "")
+    if not title or len(title) > 72:
+        continue
+    proposals.append({"title": title, "body": block.strip()[:8000]})
+with open(proposals_path, "w", encoding="utf-8") as output:
+    json.dump(proposals, output)
+PY
+then
+  rm -f "$PROPOSALS_FILE"
+  write_marker parser_failed 0 0
+  pipe_log "WARNING: could not parse architect proposals"
+  exit 0
+fi
+if ! jq -e 'type == "array"' "$PROPOSALS_FILE" >/dev/null 2>&1; then
+  rm -f "$PROPOSALS_FILE"
+  write_marker parser_failed 0 0
+  pipe_log "WARNING: architect proposal parser produced invalid output"
+  exit 0
+fi
+PROPOSAL_COUNT=$(jq -r 'length' "$PROPOSALS_FILE")
+if [ "$PROPOSAL_COUNT" = 0 ]; then
+  write_marker no_proposals 0 0
+  pipe_log "No concrete architect proposals"
+  exit 0
+fi
+
+case "$DRY_RUN" in
+  false|0) ;;
+  *)
+    write_marker ok "$PROPOSAL_COUNT" 0
+    pipe_log "DRY RUN: $PROPOSAL_COUNT proposal(s), no issues filed"
+    cat "$REPORT_FILE"
+    exit 0
+    ;;
+esac
+
+issue_ensure_label "$PIPE_LABEL_IMPROVEMENT" "#6F42C1" "Agent improvement proposals"
+ISSUES_FILE="$PIPE_CONTEXT_DIR/architect-issue.md"
+ISSUES_FILED=0
+while IFS= read -r proposal; do
+  TITLE=$(jq -r '.title' <<< "$proposal")
+  jq -r '.body' <<< "$proposal" > "$ISSUES_FILE"
+  ISSUE_IID=$(issue_create_file "$TITLE" "$ISSUES_FILE" "$PIPE_LABEL_READY,$PIPE_LABEL_IMPROVEMENT")
+  if [ -n "$ISSUE_IID" ]; then
+    ISSUES_FILED=$((ISSUES_FILED + 1))
+    pipe_log "Filed architect proposal as #$ISSUE_IID"
+  else
+    pipe_log "WARNING: could not file architect proposal: $TITLE"
+  fi
+done < <(jq -c '.[]' "$PROPOSALS_FILE")
+write_marker ok "$PROPOSAL_COUNT" "$ISSUES_FILED"

package/payload/ci-templates/scripts/code.sh

@@ -61,24 +61,21 @@ COMMITS=$(git rev-list "origin/$PIPE_TARGET_BRANCH..HEAD" --count 2>/dev/null ||
 # issue_implemented is emitted only when commits exist (E2E finding N-7:
 # emitting it before this check produced the metric for stuck runs too).
 if [ "${COMMITS:-0}" = "0" ]; then
-  pipe_log "Coder made no commits, marking #$CODER_ISSUE stuck"
-  pipe_metric_event coder issue_stuck \
-    "$(jq -n --argjson i "$CODER_ISSUE" '{issue_iid: $i, reason: "no_commits"}')"
-  # The agent's own account of why it stopped is the most useful thing in a
-  # stuck comment, and it was being read and then dropped.
-  EXPL=$(head -c 3000 "$PIPE_CONTEXT_DIR/implement.env" 2>/dev/null || true)
-  issue_comment "$CODER_ISSUE" "🤖 **Coder agent made no commits for issue #$CODER_ISSUE.**
-
-The implementation agent ran but produced no commits. A human needs to take over.
-${EXPL:+
-What the agent reported before stopping:
-
-\`\`\`
-$EXPL
-\`\`\`
-}
-${PIPE_JOB_URL:+CI job: $PIPE_JOB_URL}"
-  issue_set_labels "$CODER_ISSUE" "$PIPE_LABEL_STUCK" "$PIPE_LABEL_READY,$PIPE_LABEL_WIP"
+  NOTICE_FILE="$PIPE_CONTEXT_DIR/implementation-failure.md"
+  {
+    printf '🤖 '
+    pipe_failure_notice_files "implementation of issue #$CODER_ISSUE" "implement this issue by hand" \
+      "$PIPE_AGENT_STDERR" "$PIPE_CONTEXT_DIR/implement.env"
+  } > "$NOTICE_FILE"
+  issue_comment_file "$CODER_ISSUE" "$NOTICE_FILE"
+  if pipe_is_credit_exhaustion_files "$PIPE_AGENT_STDERR" "$PIPE_CONTEXT_DIR/implement.env"; then
+    pipe_log "Coder credit exhausted; #$CODER_ISSUE remains $PIPE_LABEL_READY"
+  else
+    pipe_log "Coder made no commits, marking #$CODER_ISSUE stuck"
+    pipe_metric_event coder issue_stuck \
+      "$(jq -n --argjson i "$CODER_ISSUE" '{issue_iid: $i, reason: "no_commits"}')"
+    issue_set_labels "$CODER_ISSUE" "$PIPE_LABEL_STUCK" "$PIPE_LABEL_READY,$PIPE_LABEL_WIP"
+  fi
   exit 0
 fi
 
@@ -89,25 +86,27 @@ pipe_metric_event coder issue_implemented \
 git push -u origin "$CODER_BRANCH"
 
 # --- 8. Open the MR/PR ------------------------------------------------------
-SUMMARY=$(head -c 6000 "$PIPE_CONTEXT_DIR/mr-summary.md" 2>/dev/null || true)
-[ -z "$SUMMARY" ] && SUMMARY="Implemented by the ci-agent-platform coder agent."
+MR_DESC_FILE="$PIPE_CONTEXT_DIR/mr-description.md"
+{
+  printf 'Closes #%s\n\n' "$CODER_ISSUE"
+  if [ -s "$PIPE_CONTEXT_DIR/mr-summary.md" ]; then
+    cat "$PIPE_CONTEXT_DIR/mr-summary.md"
+  else
+    printf 'Implemented by the ci-agent-platform coder agent.'
+  fi
+  printf '\n\n---\n🤖 Implemented by the ci-agent-platform coder\n'
+} > "$MR_DESC_FILE"
 
 # Inherit the issue labels onto the MR/PR: drop the ready label, add wip.
 MR_LABELS=$( { echo "$ISSUE_LABELS" | tr ',' '\n' | grep -vxF "$PIPE_LABEL_READY" | grep -v '^$'; echo "$PIPE_LABEL_WIP"; } \
   | awk '!seen[$0]++' | paste -sd, - )
 
 MR_TITLE="Resolve \"$ISSUE_TITLE\""
-MR_DESC="Closes #$CODER_ISSUE
-
-$SUMMARY
-
----
-🤖 Implemented by the ci-agent-platform coder"
 
 # Ensure the MR/PR labels exist (repo/project may not have them yet).
 issue_ensure_label "$PIPE_LABEL_WIP" "#3498DB" "Pipeline is working on this change"
 
-MR_URL=$(mr_create "$CODER_BRANCH" "$PIPE_TARGET_BRANCH" "$MR_TITLE" "$MR_DESC" "$MR_LABELS")
+MR_URL=$(mr_create_file "$CODER_BRANCH" "$PIPE_TARGET_BRANCH" "$MR_TITLE" "$MR_DESC_FILE" "$MR_LABELS")
 if [ -n "$MR_URL" ]; then
   pipe_log "Opened MR/PR: $MR_URL"
 else

package/payload/ci-templates/scripts/codebase-audit.sh

@@ -0,0 +1,252 @@
+#!/bin/bash
+# Runner for the opt-in `codebase-audit` job (periodic convention-drift scan).
+# Fetches merged MRs/PRs since the last audit, runs the `/codebase-audit` skill
+# in `audit` mode (delegates to the codebase-auditor agent), files the findings
+# as an issue, and — when a push-capable identity is configured and the report
+# suggests documentation updates — runs the skill again in `apply-docs` mode
+# (delegates to the coder agent), then pushes the branch and opens the MR/PR.
+# All reasoning is in the skill; this script does token, API and git work.
+#
+# Generalized from a single-project original: the last-audited-MR lookup, the
+# MR/PR summary, and the doc-suggestion extraction moved into the skill/runner
+# split, platform calls go through lib/platform.sh and lib/issue-loop.sh, and
+# the codebase-auditor/coder agents run via pipe_run_agent.
+set -e
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=lib/pipeline-common.sh
+source "$SCRIPT_DIR/lib/pipeline-common.sh"
+# shellcheck source=lib/issue-loop.sh
+source "$SCRIPT_DIR/lib/issue-loop.sh"
+pipe_defaults
+
+CONTEXT_FILE="$PIPE_CONTEXT_DIR/audit-context.md"
+REPORT_FILE="$PIPE_CONTEXT_DIR/audit-report.md"
+SUGGESTIONS_FILE="$PIPE_CONTEXT_DIR/audit-doc-suggestions.md"
+AUDIT_ENV="$PIPE_CONTEXT_DIR/audit.env"
+
+# --- 1. Last-audited MR/PR IID, parsed from the most recent audit issue -----
+# The most recent codebase-audit-labeled issue regardless of state: a closed
+# one still marks how far the previous audit got. A genuine fetch failure
+# must not be mistaken for "no prior audit issue" (which legitimately yields
+# an empty array and keeps LAST_AUDITED_IID at 0): capture the helper's own
+# exit status explicitly instead of piping it straight into jq.
+LAST_AUDITED_IID=0
+LAST_AUDIT_ISSUES=$(issues_by_label_created "$PIPE_LABEL_AUDIT" all 1) || {
+  pipe_log "ERROR: failed to fetch the most recent $PIPE_LABEL_AUDIT-labeled issue"
+  exit 1
+}
+LAST_AUDIT_DESC=$(jq -r '.[0].description // ""' <<< "$LAST_AUDIT_ISSUES" 2>/dev/null || echo "")
+if [ -n "$LAST_AUDIT_DESC" ]; then
+  PARSED_IID=$(printf '%s' "$LAST_AUDIT_DESC" | grep -oE 'audited-up-to-mr-iid: [0-9]+' | grep -oE '[0-9]+$' || echo "")
+  [ -n "$PARSED_IID" ] && LAST_AUDITED_IID="$PARSED_IID"
+fi
+pipe_log "Last audited MR/PR IID: $LAST_AUDITED_IID"
+
+# --- 2. Merged MRs/PRs since then, with a changed-file summary --------------
+MRS=$(platform_merged_mrs "$PIPE_TARGET_BRANCH" "$LAST_AUDITED_IID" 50) || {
+  pipe_log "ERROR: failed to fetch merged MRs/PRs"
+  exit 1
+}
+MR_COUNT=$(echo "$MRS" | jq 'length' 2>/dev/null || echo "")
+if ! [[ "$MR_COUNT" =~ ^[0-9]+$ ]]; then
+  pipe_log "ERROR: unexpected API response while counting merged MRs/PRs"
+  exit 1
+fi
+pipe_log "Analyzing $MR_COUNT recently merged MR/PR(s) (since IID $LAST_AUDITED_IID)"
+[ "$MR_COUNT" = "0" ] && { pipe_log "No new MRs/PRs since last audit — skipping"; exit 0; }
+MAX_AUDITED_IID=$(echo "$MRS" | jq '[.[].iid] | max // 0' 2>/dev/null || echo "")
+if ! [[ "$MAX_AUDITED_IID" =~ ^[0-9]+$ ]]; then
+  pipe_log "ERROR: could not determine the max merged MR/PR IID from the API response"
+  exit 1
+fi
+
+MR_SUMMARY=""
+while IFS= read -r IID; do
+  TITLE=$(echo "$MRS" | jq -r --argjson i "$IID" '.[] | select(.iid == $i) | .title')
+  # A single MR's changed-file fetch failing is an acceptable degradation (an
+  # empty file list in its summary line), not grounds to abort the whole audit.
+  FILES=$(platform_mr_changes "$IID" 10 | paste -sd, -) || true
+  MR_SUMMARY="${MR_SUMMARY}MR/PR !${IID} ${TITLE} -- Files ${FILES}; "
+done < <(echo "$MRS" | jq -r '.[].iid')
+
+# --- 3. Open audit issues, as dedup context for the auditor ------------------
+OPEN_AUDIT_CONTEXT=""
+# Dedup context only tells the auditor which findings are already filed; a
+# transient fetch failure here must not abort the whole scheduled audit
+# (unlike step 1's watermark read, which is load-bearing). Degrade to an
+# empty result and continue, analogous to a single MR's changes-fetch
+# degradation in step 2.
+OPEN_AUDITS=$(issues_by_label_created "$PIPE_LABEL_AUDIT" opened 5) || {
+  pipe_log "WARNING: failed to fetch open $PIPE_LABEL_AUDIT-labeled issues for dedup context — continuing without it"
+  OPEN_AUDITS="[]"
+}
+OPEN_COUNT=$(echo "$OPEN_AUDITS" | jq 'length' 2>/dev/null || echo 0)
+if [ "$OPEN_COUNT" != "0" ] && [ "$OPEN_COUNT" != "null" ]; then
+  OPEN_AUDIT_CONTEXT=$(echo "$OPEN_AUDITS" | jq -r '.[] | "Issue #\(.iid) (\(.created_at[0:10])): \(.title)\n\(.description[0:800])\n---"' 2>/dev/null | head -c 8000 || echo "")
+fi
+
+# --- 4. Run the /codebase-audit skill in audit mode --------------------------
+# Write the context file the skill and the codebase-auditor agent read.
+# Unbounded text stays out of argv/env; this content is already bounded above.
+rm -f "$AUDIT_ENV" "$REPORT_FILE" "$SUGGESTIONS_FILE"
+{
+  echo "# Codebase audit context"
+  echo
+  echo "Mode: audit"
+  echo
+  echo "## Recently merged MRs/PRs"
+  echo
+  printf '%s\n' "$MR_SUMMARY"
+  if [ -n "$OPEN_AUDIT_CONTEXT" ]; then
+    echo
+    echo "## Already-open ${PIPE_LABEL_AUDIT}-labeled issues (skip findings already covered here)"
+    echo
+    printf '%s\n' "$OPEN_AUDIT_CONTEXT"
+  fi
+} > "$CONTEXT_FILE"
+
+pipe_run_agent codebase-audit "/codebase-audit" "Agent,Read,Write,Edit,Glob,Grep,Bash" "$PIPE_MODEL_TRIAGE" < /dev/null
+
+AUDIT_STATUS=$(pipe_get_env "$AUDIT_ENV" AUDIT_STATUS)
+AUDIT_FINDINGS_TOTAL=$(pipe_get_env "$AUDIT_ENV" AUDIT_FINDINGS_TOTAL); AUDIT_FINDINGS_TOTAL=${AUDIT_FINDINGS_TOTAL:-0}
+# pipe_get_env does no shell expansion: a marker that copies the sample line
+# literally (e.g. `AUDIT_REPORT_PATH=$PIPE_CONTEXT_DIR/audit-report.md`
+# unexpanded) or otherwise points at a path that doesn't exist must not
+# discard a perfectly good report at the runner's own default path (review
+# round 2 finding).
+AUDIT_REPORT_PATH=$(pipe_get_env "$AUDIT_ENV" AUDIT_REPORT_PATH)
+if [ ! -s "$AUDIT_REPORT_PATH" ] && [ -s "$REPORT_FILE" ]; then
+  AUDIT_REPORT_PATH="$REPORT_FILE"
+fi
+AUDIT_REPORT_PATH=${AUDIT_REPORT_PATH:-$REPORT_FILE}
+
+# --- 5. Empty output, or a missing/empty report file: log-only notice -------
+# (no issue exists yet to post to). A model-authored marker claiming ok/
+# no_findings with no actual report on disk is a reachable contract failure,
+# not just a literal no_output status; guard the file the same way
+# docs-sync.sh guards its own agent output before touching it.
+if [ -z "$AUDIT_STATUS" ] || [ "$AUDIT_STATUS" = "no_output" ] || [ ! -s "$AUDIT_REPORT_PATH" ]; then
+  pipe_failure_log_notice_files "the periodic codebase audit" \
+    "audit recent MRs/PRs by hand for convention violations, or re-run this job after topping up" \
+    "$PIPE_AGENT_STDERR" "$AUDIT_REPORT_PATH" | while IFS= read -r line; do pipe_log "$line"; done
+  exit 0
+fi
+
+# --- 6. No findings above threshold: nothing to file --------------------------
+if [ "$AUDIT_STATUS" = "no_findings" ]; then
+  pipe_log "No findings above threshold in either section — skipping issue creation"
+  exit 0
+fi
+
+# --- 7. File the findings as an issue -----------------------------------------
+issue_ensure_label "$PIPE_LABEL_AUDIT" "#6F42C1" "Periodic convention-drift audit findings"
+ISSUE_BODY_FILE="$PIPE_CONTEXT_DIR/audit-issue-body.md"
+{
+  printf '<!-- audited-up-to-mr-iid: %s -->\n' "$MAX_AUDITED_IID"
+  head -c 20000 "$AUDIT_REPORT_PATH"
+} > "$ISSUE_BODY_FILE"
+ISSUE_IID=$(issue_create_file "Codebase Audit — $(date +%Y-%m-%d)" "$ISSUE_BODY_FILE" "$PIPE_LABEL_AUDIT")
+if [ -z "$ISSUE_IID" ]; then
+  pipe_log "ERROR: failed to create the audit findings issue"
+  exit 0
+fi
+pipe_log "Filed audit findings as #$ISSUE_IID"
+# The runner is the one that knows the IID: append it now so the marker
+# artifact is complete when the job finishes (see the skill's own contract).
+printf 'AUDIT_ISSUE_IID=%s\n' "$ISSUE_IID" >> "$AUDIT_ENV"
+
+pipe_metric_event codebase-audit audit_filed \
+  "$(jq -n --argjson i "$ISSUE_IID" --argjson f "$AUDIT_FINDINGS_TOTAL" '{issue_iid: $i, findings_total: $f}')"
+
+# --- 8. No push-capable identity: audit-only run, stop here -----------------
+PUSH_TOKEN=""
+case "$PIPE_PLATFORM" in
+  gitlab) PUSH_TOKEN="${PIPE_TOKEN:-}" ;;
+  github) PUSH_TOKEN="${GH_TOKEN:-${GITHUB_TOKEN:-}}" ;;
+esac
+if [ -z "$PUSH_TOKEN" ]; then
+  pipe_log "No push-capable identity configured — skipping auto-fix phase"
+  exit 0
+fi
+
+# --- 9. No doc-update suggestions: nothing for the coder to apply -----------
+if [ ! -s "$SUGGESTIONS_FILE" ]; then
+  pipe_log "No documentation update suggestions — skipping auto-fix phase"
+  exit 0
+fi
+pipe_log "Doc suggestions found — spawning the coder agent"
+
+# --- 10. Branch, then run the skill again in apply-docs mode -----------------
+pipe_git_identity
+git fetch origin "$PIPE_TARGET_BRANCH"
+BRANCH="audit-$(date +%Y-%m-%d)"
+# A same-day retry (transient failure, manual re-trigger) can find this
+# branch already on the remote from an earlier attempt. Fetch it so the
+# --force-with-lease push below has a known expected state instead of
+# refusing for lack of a remote-tracking ref.
+git fetch origin "$BRANCH" 2>/dev/null || true
+git checkout -B "$BRANCH" "origin/$PIPE_TARGET_BRANCH"
+
+APPLY_ENV="$PIPE_CONTEXT_DIR/audit-apply.env"
+rm -f "$APPLY_ENV"
+{
+  echo "# Codebase audit apply-docs context"
+  echo
+  echo "Mode: apply-docs"
+  echo
+  echo "Issue: #$ISSUE_IID"
+  echo "Documentation roots: $PIPE_DOCS_ROOTS"
+  echo "Commit subject: $PIPE_COMMIT_AUDIT"
+  echo "Doc suggestions file: $SUGGESTIONS_FILE"
+  echo "Full audit report: $AUDIT_REPORT_PATH"
+} > "$CONTEXT_FILE"
+
+pipe_run_agent codebase-audit-apply "/codebase-audit" "Agent,Read,Write,Edit,Glob,Grep,Bash" "$PIPE_MODEL_CODE" < /dev/null
+
+# --- 11. Authoritative commit count (the runner owns the push decision) ------
+AHEAD=$(git rev-list "origin/$PIPE_TARGET_BRANCH..HEAD" --count 2>/dev/null || echo 0)
+if [ "${AHEAD:-0}" = "0" ]; then
+  pipe_log "Coder made no commits — skipping MR/PR"
+  # "No commits" reads as "nothing needed fixing", but a credit outage produces
+  # the same silence. Issue #$ISSUE_IID already holds the findings, so on a
+  # credit outage tell its readers the apply step never ran rather than
+  # leaving them to assume it found nothing.
+  pipe_failure_log_notice_files "the audit apply step" \
+    "apply the findings in this issue by hand" \
+    "$PIPE_AGENT_STDERR" "$APPLY_ENV" | while IFS= read -r line; do pipe_log "$line"; done
+  if pipe_is_credit_exhaustion_files "$PIPE_AGENT_STDERR" "$APPLY_ENV"; then
+    NOTICE_FILE="$PIPE_CONTEXT_DIR/audit-apply-credit-notice.md"
+    pipe_failure_notice_files "application of these audit findings" \
+      "apply the findings above by hand, or re-run the audit job after topping up" \
+      "$PIPE_AGENT_STDERR" "$APPLY_ENV" > "$NOTICE_FILE"
+    issue_comment_file "$ISSUE_IID" "$NOTICE_FILE"
+    pipe_log "Posted credit-exhaustion notice to issue #$ISSUE_IID"
+  fi
+  git checkout "$PIPE_TARGET_BRANCH" 2>/dev/null || true
+  git branch -D "$BRANCH" 2>/dev/null || true
+  exit 0
+fi
+
+pipe_metric_event codebase-audit audit_apply_committed \
+  "$(jq -n --argjson i "$ISSUE_IID" --argjson c "$AHEAD" '{issue_iid: $i, commits: $c}')"
+
+# --- 12. Push and open the MR/PR ---------------------------------------------
+# --force-with-lease: this is a dedicated bot branch reset fresh from the
+# target branch every run, so a same-day retry intentionally replaces
+# whatever an earlier attempt left on the remote. --force-with-lease (rather
+# than a bare --force) still refuses if the branch changed unexpectedly
+# between the fetch above and now.
+git push --force-with-lease -u origin "$BRANCH"
+
+MR_DESC_FILE="$PIPE_CONTEXT_DIR/audit-mr-description.md"
+{
+  printf 'Automated documentation updates from the periodic convention audit.\n\nCloses #%s\n\n---\n\n' "$ISSUE_IID"
+  head -c 10000 "$AUDIT_REPORT_PATH"
+} > "$MR_DESC_FILE"
+
+MR_URL=$(mr_create_file "$BRANCH" "$PIPE_TARGET_BRANCH" "docs: codebase audit updates ($(date +%Y-%m-%d))" "$MR_DESC_FILE" "$PIPE_LABEL_AUDIT")
+if [ -n "$MR_URL" ]; then
+  pipe_log "Opened MR/PR: $MR_URL"
+else
+  pipe_log "WARNING: MR/PR creation returned no URL (it may already exist for this branch)"
+fi