@juangcarmona/lighthouse-sdlc 0.14.0 → 0.15.1

package/src/pr-state-actions.mjs

@@ -0,0 +1,106 @@
+import { readFile } from 'node:fs/promises';
+import { checkImplementationPullRequest } from './proposal-review.mjs';
+import { authorizedCiCallback, projectImplementationPrState, reconcileImplementationPr, scheduledImplementationPulls, setPullRequestDraft } from './pr-state.mjs';
+
+const apiFor = (repo, token) => async (path, method = 'GET', body, optional = false) => {
+  const response = await fetch(`https://api.github.com/repos/${repo}${path ? `/${path}` : ''}`, {
+    method, headers: { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json', 'X-GitHub-Api-Version': '2022-11-28', ...(body ? { 'Content-Type': 'application/json' } : {}) },
+    ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(30000),
+  });
+  if (optional && response.status === 404) return null;
+  if (!response.ok) throw Error(`GitHub ${method} ${path}: ${response.status}`);
+  return response.status === 204 ? null : response.json();
+};
+const commentsFor = async (api, issue) => {
+  const comments = [];
+  for (let page = 1; page <= 10; page++) {
+    const batch = await api(`issues/${issue}/comments?per_page=100&page=${page}`);
+    comments.push(...batch);
+    if (batch.length < 100) return comments;
+  }
+  throw Error('Issue comment history exceeds bound');
+};
+const requiredChecks = profile => {
+  const checks = profile.requiredChecks;
+  if (!Array.isArray(checks) || !checks.length || checks.length > 20 || checks.some(item => !item.context || item.integrationId !== null && !Number.isSafeInteger(item.integrationId))) throw Error('Invalid required-check profile');
+  return checks.map(item => ({ context: item.context, app: item.integrationId }));
+};
+async function main() {
+  const env = process.env, repo = env.GITHUB_REPOSITORY, owner = env.GITHUB_REPOSITORY_OWNER;
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo ?? '') || !env.GH_TOKEN) throw Error('Missing repository or token');
+  const api = apiFor(repo, env.GH_TOKEN);
+  const event = JSON.parse(await readFile(env.GITHUB_EVENT_PATH, 'utf8'));
+  const metadata = await api('');
+  const config = await api(`contents/.lighthouse/github.json?ref=${metadata.default_branch}`, 'GET', undefined, true);
+  if (!config) return;
+  const profile = JSON.parse(Buffer.from(config.content, 'base64').toString());
+  if (profile.repository !== repo) throw Error('Repository profile differs from the event');
+  let candidates = [];
+  const ciCallback = env.GITHUB_EVENT_NAME === 'workflow_dispatch' && env.LIGHTHOUSE_CI_RECONCILE === 'true';
+  if (env.GITHUB_EVENT_NAME === 'pull_request') {
+    if (env.GITHUB_ACTOR !== owner || !['ready_for_review', 'converted_to_draft', 'closed', 'reopened'].includes(event.action)) return;
+    candidates = [event.pull_request?.number];
+  } else if (env.GITHUB_EVENT_NAME === 'workflow_run') {
+    const id = event.workflow_run?.id;
+    if (event.action !== 'completed' || !Number.isSafeInteger(id)) return;
+    const run = await api(`actions/runs/${id}`);
+    if (run.status !== 'completed' || run.conclusion !== 'success' || run.head_sha !== event.workflow_run.head_sha || run.repository?.full_name !== repo || !profile.completion?.postMergeWorkflows?.some(name => run.path === `.github/workflows/${name}`)) return;
+    const pulls = await api(`commits/${run.head_sha}/pulls?per_page=100`);
+    if (pulls.length >= 100) throw Error('PR lookup exceeds bound');
+    candidates = pulls.filter(pr => pr.head?.sha === run.head_sha).map(pr => pr.number);
+  } else if (env.GITHUB_EVENT_NAME === 'schedule') {
+    candidates = await scheduledImplementationPulls(api);
+  } else if (ciCallback) {
+    const id = Number(env.GITHUB_RUN_ID);
+    if (!Number.isSafeInteger(id) || !/^[a-f0-9]{40}$/.test(env.GITHUB_SHA ?? '')) throw Error('CI callback lacks a run or head');
+    const run = await api(`actions/runs/${id}`);
+    if (!authorizedCiCallback(run, { id, sha: env.GITHUB_SHA, repo, workflows: profile.completion?.postMergeWorkflows })) return;
+    const pulls = await api(`commits/${run.head_sha}/pulls?per_page=100`);
+    if (pulls.length >= 100) throw Error('PR lookup exceeds bound');
+    candidates = pulls.filter(pr => pr.head?.sha === run.head_sha).map(pr => pr.number);
+  } else return;
+  for (const number of candidates) {
+    if (!Number.isSafeInteger(number)) continue;
+    const pr = await api(`pulls/${number}`);
+    if (env.GITHUB_EVENT_NAME === 'pull_request' && pr.head.sha !== event.pull_request.head.sha) continue;
+    if (env.GITHUB_EVENT_NAME === 'workflow_run' && pr.head.sha !== event.workflow_run.head_sha) continue;
+    if (ciCallback && pr.head.sha !== env.GITHUB_SHA) continue;
+    if (pr.base.ref !== metadata.default_branch) continue;
+    let target;
+    try { target = checkImplementationPullRequest({ ...pr, state: 'open', merged: false }, repo); }
+    catch {
+      const match = pr.head.ref.match(/^lighthouse\/implement-([1-9][0-9]*)-[a-f0-9]{12}$/);
+      if (!match || pr.user?.login !== 'github-actions[bot]' || pr.head.repo?.full_name !== repo || pr.base.repo?.full_name !== repo || pr.state !== 'open') continue;
+      const issue = await api(`issues/${match[1]}`);
+      if (issue.state !== 'open') continue;
+      if (!pr.draft) await setPullRequestDraft(env.GH_TOKEN, pr, true);
+      await projectImplementationPrState(api, issue.number, true);
+      const notice = `<!-- lighthouse-pr-link-changed:${pr.number}:${pr.head.sha} -->`;
+      if (!(await commentsFor(api, issue.number)).some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(notice))) await api(`issues/${issue.number}/comments`, 'POST', { body: `PR #${pr.number} is back in draft because its Lighthouse link changed. Restore the PR description before review. [Open PR](${pr.html_url}).\n\n${notice}` });
+      continue;
+    }
+    const issue = await api(`issues/${target.issue}`);
+    if (issue.state !== 'open') continue;
+    if (pr.state !== 'open' || pr.merged) {
+      for (const name of ['pr-draft', 'pr-ready']) if (issue.labels.some(label => label.name === name)) await api(`issues/${issue.number}/labels/${name}`, 'DELETE', undefined, true);
+      if (!pr.merged) {
+        await api(`issues/${issue.number}/labels`, 'POST', { labels: ['waiting-review'] });
+        const notice = `<!-- lighthouse-pr-closed:${pr.number}:${pr.head.sha} -->`;
+        if (!(await commentsFor(api, issue.number)).some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(notice))) await api(`issues/${issue.number}/comments`, 'POST', { body: `PR #${pr.number} was closed without merging. Reopen it or request a new implementation. [Open PR](${pr.html_url}).\n\n${notice}` });
+      }
+      continue;
+    }
+    const comments = await commentsFor(api, target.issue);
+    if (event.action === 'converted_to_draft') {
+      const hold = `<!-- lighthouse-pr-hold:${pr.number}:${pr.head.sha} -->`;
+      if (!comments.some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(hold))) await api(`issues/${target.issue}/comments`, 'POST', { body: `PR #${pr.number} is a draft by owner choice. [Open PR](${pr.html_url}).\n\n${hold}` });
+      await projectImplementationPrState(api, target.issue, true);
+      continue;
+    }
+    const hold = comments.some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(`<!-- lighthouse-pr-hold:${pr.number}:${pr.head.sha} -->`));
+    const auto = (['workflow_run', 'schedule'].includes(env.GITHUB_EVENT_NAME) || ciCallback) && !hold;
+    const result = await reconcileImplementationPr(api, repo, pr, issue, comments, requiredChecks(profile), (current, draft) => setPullRequestDraft(env.GH_TOKEN, current, draft), { auto });
+    if (event.action === 'ready_for_review' && result.status === 'draft') await api(`issues/${target.issue}/comments`, 'POST', { body: `PR #${pr.number} remains a draft: ${result.reason}. [Open PR](${pr.html_url}).` });
+  }
+}
+main().catch(error => { console.error(`::error::${error.message}`); process.exitCode = 1; });

package/src/pr-state.mjs

@@ -0,0 +1,75 @@
+import { checkImplementationPullRequest } from './proposal-review.mjs';
+import { checkCommit } from './completion.mjs';
+
+const marker = /<!-- lighthouse-pr-state:(\{[^\n]*\}) -->/;
+
+export async function scheduledImplementationPulls(api) {
+  const numbers = [];
+  for (let page = 1; page <= 10; page++) {
+    const pulls = await api(`pulls?state=open&per_page=100&page=${page}`);
+    numbers.push(...pulls.filter(pr => /^lighthouse\/implement-[1-9][0-9]*-[a-f0-9]{12}$/.test(pr.head?.ref ?? '') && pr.user?.login === 'github-actions[bot]').map(pr => pr.number));
+    if (pulls.length < 100) return numbers;
+  }
+  throw Error('Open PR history exceeds reconciliation bound');
+}
+
+export function authorizedCiCallback(run, { id, sha, repo, workflows }) {
+  return Number.isSafeInteger(id) && /^[a-f0-9]{40}$/.test(sha ?? '') && run.id === id && run.event === 'workflow_dispatch' && run.head_sha === sha && run.repository?.full_name === repo && workflows?.some(name => run.path === `.github/workflows/${name}`) === true;
+}
+
+export async function setPullRequestDraft(token, pr, draft) {
+  if (!pr.node_id) throw Error('PR lacks GraphQL identity');
+  const field = draft ? 'convertPullRequestToDraft' : 'markPullRequestReadyForReview';
+  const response = await fetch('https://api.github.com/graphql', {
+    method: 'POST', headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ query: `mutation($id:ID!){${field}(input:{pullRequestId:$id}){pullRequest{id isDraft}}}`, variables: { id: pr.node_id } }),
+    signal: AbortSignal.timeout(30000),
+  });
+  const result = await response.json();
+  if (!response.ok || result.errors?.length || result.data?.[field]?.pullRequest?.isDraft !== draft) throw Error('GitHub could not change PR draft state');
+}
+
+export function implementationPrProof(comments, pr) {
+  for (const comment of [...comments].reverse()) {
+    if (comment.user?.login !== 'github-actions[bot]' || comment.user.type !== 'Bot') continue;
+    const raw = comment.body?.match(marker)?.[1];
+    if (!raw) continue;
+    let proof;
+    try { proof = JSON.parse(raw); } catch { continue; }
+    if (proof.pr === pr.number && proof.head === pr.head.sha && typeof proof.complete === 'boolean' && /^[1-9][0-9]*$/.test(String(proof.run))) return proof;
+  }
+  return null;
+}
+
+export async function projectImplementationPrState(api, issue, draft) {
+  const current = await api(`issues/${issue}`);
+  if (current.state !== 'open') return;
+  const wanted = draft ? 'pr-draft' : 'pr-ready';
+  for (const label of ['ready', 'waiting-review', draft ? 'pr-ready' : 'pr-draft']) {
+    if (current.labels.some(item => item.name === label)) await api(`issues/${issue}/labels/${label}`, 'DELETE', undefined, true);
+  }
+  if (!current.labels.some(item => item.name === wanted)) await api(`issues/${issue}/labels`, 'POST', { labels: [wanted] });
+}
+
+export async function reconcileImplementationPr(api, repo, pr, issue, comments, requiredChecks, setDraft, { auto = false } = {}) {
+  const target = checkImplementationPullRequest(pr, repo);
+  if (target.issue !== issue.number || issue.state !== 'open') return { status: 'ignored', reason: 'Issue or PR changed' };
+  const proof = implementationPrProof(comments, pr);
+  const checks = await checkCommit(api, pr.head.sha, requiredChecks);
+  const reserved = issue.labels.some(label => ['agent-working', 'human-working'].includes(label.name));
+  const complete = !reserved && proof?.complete === true && checks.length > 0 && checks.every(check => check.status === 'passed');
+  if (pr.draft && auto && complete) {
+    try { await setDraft(pr, false); }
+    catch (error) { if ((await api(`pulls/${pr.number}`)).draft) throw error; }
+    await projectImplementationPrState(api, issue.number, false);
+    return { status: 'ready', reason: 'Candidate and required checks passed' };
+  }
+  if (!pr.draft && !complete) {
+    try { await setDraft(pr, true); }
+    catch (error) { if (!(await api(`pulls/${pr.number}`)).draft) throw error; }
+    await projectImplementationPrState(api, issue.number, true);
+    return { status: 'draft', reason: reserved ? 'Implementation or owner work is still active' : !proof?.complete ? 'Implementation is incomplete' : 'Required checks have not passed' };
+  }
+  await projectImplementationPrState(api, issue.number, pr.draft);
+  return { status: pr.draft ? 'draft' : 'ready', reason: pr.draft ? 'PR is a draft' : 'Candidate and required checks passed' };
+}

package/src/profile-delegation.mjs

@@ -0,0 +1,111 @@
+import { randomUUID } from 'node:crypto';
+import { validateLaunchRequest } from './control-plane.mjs';
+import { withinScope } from './implementation.mjs';
+import { resolveModelProfile, modelExecutionReceipt } from './model-profiles.mjs';
+
+const record = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const name = value => typeof value === 'string' && /^[a-z][a-z0-9-]{0,63}$/.test(value);
+const validScope = value => typeof value === 'string' && !/[?*\[\]{}\\]/.test(value) && withinScope(value.replace(/\/$/, ''), { paths: ['*'] });
+const contains = (scope, file) => scope === '*' || (scope.endsWith('/') ? file.startsWith(scope) : file === scope);
+const overlaps = (a, b) => a.replace(/\/$/, '') === b.replace(/\/$/, '') || contains(a, b) || contains(b, a);
+const boundedLimits = limits => record(limits) && Number.isInteger(limits.timeoutSeconds) && limits.timeoutSeconds > 0 && limits.timeoutSeconds <= 1800 && Number.isInteger(limits.maxAttempts) && limits.maxAttempts === 1;
+
+export function prepareDelegatedTasks({ tasks, parent, controlPlane, project = null, operator, maxParallel }) {
+  if (!Number.isInteger(maxParallel) || maxParallel < 1 || maxParallel > 8) throw Error('Host parallel limit must be 1..8');
+  if (!record(parent) || !record(controlPlane?.roles?.[parent.role]) || validateLaunchRequest(parent, controlPlane).length || !boundedLimits(parent.limits)) throw Error('Invalid bounded parent launch contract');
+  if (!Array.isArray(tasks) || !tasks.length || tasks.length > 100) throw Error('Delegation requires 1..100 tasks');
+  const ids = new Set();
+  const prepared = structuredClone(tasks).map(task => {
+    if (!record(task) || Object.keys(task).some(key => !['id', 'specialist', 'profile', 'dependencies', 'affectedFiles', 'input', 'tools', 'outputSchema', 'limits', 'stopConditions'].includes(key)) || !name(task.id) || ids.has(task.id) || !name(task.specialist)) throw Error('Invalid or duplicate delegated task');
+    ids.add(task.id);
+    if (!Array.isArray(task.dependencies) || task.dependencies.some(id => !name(id)) || new Set(task.dependencies).size !== task.dependencies.length) throw Error('Task dependencies must be unique task IDs');
+    if (!Array.isArray(task.affectedFiles) || !task.affectedFiles.length || task.affectedFiles.length > 100 || new Set(task.affectedFiles).size !== task.affectedFiles.length || task.affectedFiles.some(file => !validScope(file) || !parent.writeScope.some(scope => contains(scope, file)))) throw Error('Task affected files exceed parent scope or use unsupported paths');
+    if (task.tools !== undefined && !Array.isArray(task.tools) || task.stopConditions !== undefined && !Array.isArray(task.stopConditions)) throw Error('Task tools and stop conditions must be arrays');
+    if (task.limits !== undefined && (!record(task.limits) || Object.keys(task.limits).some(key => !['timeoutSeconds', 'maxAttempts'].includes(key)))) throw Error('Task limits may only narrow timeout and attempts');
+    if (!record(controlPlane.roles[task.specialist])) throw Error('Task specialist needs a declared launch contract');
+    const input = JSON.stringify(task.input ?? {});
+    if (Buffer.byteLength(input) > 65536) throw Error('Task context exceeds 64 KiB');
+    const child = {
+      runId: `${parent.runId}-${task.id}-${randomUUID()}`, parentRun: parent.runId, role: task.specialist,
+      input: JSON.parse(input), outputSchema: task.outputSchema ?? controlPlane.roles[task.specialist].outputSchema,
+      tools: task.tools ?? [...parent.tools], writeScope: [...task.affectedFiles], limits: { ...parent.limits, ...task.limits },
+      stopConditions: [...parent.stopConditions, ...(task.stopConditions ?? [])],
+    };
+    if (!boundedLimits(child.limits) || child.limits.timeoutSeconds > parent.limits.timeoutSeconds || child.tools.some(tool => !parent.tools.includes(tool)) || validateLaunchRequest(child, controlPlane).length) throw Error('Task launch exceeds specialist or parent contract');
+    const selection = resolveModelProfile({ project, operator, worker: task.specialist, profile: task.profile });
+    if (selection.mode !== 'profile' || !task.profile) throw Error('Delegated task must declare a profile');
+    return { id: task.id, dependencies: task.dependencies, affectedFiles: task.affectedFiles, child, selection };
+  });
+  for (const task of prepared) if (task.dependencies.some(id => !ids.has(id) || id === task.id)) throw Error('Unknown or self task dependency');
+  const visited = new Set(), active = new Set(), byId = new Map(prepared.map(task => [task.id, task]));
+  function visit(task) {
+    if (active.has(task.id)) throw Error('Delegated task dependency cycle');
+    if (visited.has(task.id)) return;
+    active.add(task.id);
+    for (const id of task.dependencies) visit(byId.get(id));
+    active.delete(task.id); visited.add(task.id);
+  }
+  for (const task of prepared) visit(task);
+  return prepared;
+}
+
+// Callbacks are host-owned: enforce paths/tools, stop on abort, validate output schemas,
+// retain evidence and check actual file changes. This scheduler grants no permissions.
+export async function runDelegatedTasks(options) {
+  const { launch, verifyWave, signal } = options;
+  if (typeof launch !== 'function' || typeof verifyWave !== 'function') throw Error('Host launch and wave verification callbacks required');
+  const tasks = prepareDelegatedTasks(options), results = new Map(), waves = [];
+  const deadline = Date.now() + options.parent.limits.timeoutSeconds * 1000;
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  signal?.addEventListener('abort', abort, { once: true });
+  if (signal?.aborted) abort();
+  const timer = setTimeout(abort, Math.max(1, deadline - Date.now()));
+  const validResult = result => result?.status === 'passed' && Array.isArray(result.evidence) && result.evidence.length > 0;
+  async function bounded(callback, seconds) {
+    if (controller.signal.aborted) throw Error('Delegation stopped');
+    let timeout, onAbort;
+    try {
+      return await Promise.race([
+        Promise.resolve().then(() => callback(controller.signal)),
+        new Promise((_, reject) => {
+          onAbort = () => reject(Error('Delegation stopped'));
+          controller.signal.addEventListener('abort', onAbort, { once: true });
+          timeout = setTimeout(() => { controller.abort(); reject(Error('Delegation deadline exceeded')); }, Math.min(seconds * 1000, Math.max(1, deadline - Date.now())));
+        }),
+      ]);
+    } finally { clearTimeout(timeout); controller.signal.removeEventListener('abort', onAbort); }
+  }
+  try {
+    while (results.size < tasks.length && !controller.signal.aborted) {
+      // Propagate failures transitively before selecting eligible tasks.
+      let changed;
+      do {
+        changed = false;
+        for (const task of tasks) if (!results.has(task.id) && task.dependencies.some(id => results.has(id) && results.get(id).status !== 'passed')) {
+          results.set(task.id, { id: task.id, status: 'blocked', reason: 'dependency-failed' }); changed = true;
+        }
+      } while (changed);
+      const wave = [];
+      for (const task of tasks) {
+        if (results.has(task.id) || task.dependencies.some(id => results.get(id)?.status !== 'passed')) continue;
+        if (wave.length < options.maxParallel && !wave.some(other => other.affectedFiles.some(a => task.affectedFiles.some(b => overlaps(a, b))))) wave.push(task);
+      }
+      if (!wave.length) break;
+      const executions = await Promise.all(wave.map(async task => {
+        try {
+          const outcome = await bounded(signal => launch({ ...structuredClone(task.child), model: structuredClone(task.selection), signal }), task.child.limits.timeoutSeconds);
+          return { id: task.id, status: validResult(outcome) ? 'passed' : 'failed', reason: validResult(outcome) ? undefined : 'launch-result-failed', outcome, modelExecution: modelExecutionReceipt(task.selection) };
+        } catch { return { id: task.id, status: 'failed', reason: 'launch-failed-or-stopped', modelExecution: modelExecutionReceipt(task.selection) }; }
+      }));
+      let verification;
+      try { verification = await bounded(signal => verifyWave({ tasks: structuredClone(wave), results: structuredClone(executions), signal }), options.parent.limits.timeoutSeconds); }
+      catch { verification = { status: 'failed', evidence: [] }; }
+      const passed = validResult(verification);
+      for (const execution of executions) results.set(execution.id, execution.status === 'passed' && !passed ? { ...execution, status: 'failed', reason: 'wave-verification-failed' } : execution);
+      waves.push({ tasks: wave.map(task => task.id), status: passed && executions.every(result => result.status === 'passed') ? 'passed' : 'failed', verification });
+    }
+    for (const task of tasks) if (!results.has(task.id)) results.set(task.id, { id: task.id, status: 'blocked', reason: controller.signal.aborted ? 'execution-stopped' : 'dependency-failed' });
+    return { status: [...results.values()].every(result => result.status === 'passed') ? 'passed' : 'blocked', waves, tasks: tasks.map(task => results.get(task.id)) };
+  } finally { clearTimeout(timer); signal?.removeEventListener('abort', abort); }
+}

package/src/proposal.mjs

@@ -80,7 +80,7 @@ export async function loadStageReport(api, repo, report, current) {
     }
     const request = values.input;
     if (request.dispatch) {
-      if (!['refine', 'propose', 'implement'].includes(request.stage) || !report.body.includes(`<!-- lighthouse-stage:${request.stage}:`)) throw Error('Unexpected dispatched stage');
+      if (!['triage', 'refine', 'propose', 'implement'].includes(request.stage) || !report.body.includes(`<!-- lighthouse-stage:${request.stage}:`)) throw Error('Unexpected dispatched stage');
       const dispatch = await loadDispatch(api, repo, current.owner, current.issue, request.dispatch.commentId, run);
       if (dispatch.request.stage !== request.stage || dispatch.request.id !== request.dispatch.requestId || dispatch.request.sourceRevision !== request.sourceRevision || dispatch.request.workflowRevision !== request.workflowRevision) throw Error('Dispatched report identity mismatch');
       await checkDispatchClaim(api, repo, current.issue, request.dispatch, run.id);

package/src/request-triage.mjs

@@ -0,0 +1,42 @@
+import { isDeepStrictEqual } from 'node:util';
+
+// Semantic assessments come from the agent; these checks enforce the public contract.
+export const storyPoints = Object.freeze([1, 2, 3, 5, 8, 13]);
+const text = value => typeof value === 'string' && value.trim().length > 0;
+const record = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+export function validateEstimate(estimate, { provisional = false } = {}) {
+  const errors = [];
+  if (!record(estimate)) return ['estimate must be an object'];
+  if (!storyPoints.includes(estimate.points)) errors.push('estimate.points must be 1, 2, 3, 5, 8 or 13');
+  if (!['low', 'medium', 'high'].includes(estimate.confidence)) errors.push('estimate.confidence must be low, medium or high');
+  if (!['provisional', 'confirmed'].includes(estimate.status) || provisional && estimate.status !== 'provisional') errors.push('estimate.status must match the provisional triage or confirmed refinement assessment');
+  for (const factor of ['scope', 'dependencies', 'verification']) if (!text(estimate.rationale?.[factor])) errors.push(`estimate.rationale.${factor} must explain the estimate`);
+  if (!Array.isArray(estimate.uncertainty) || estimate.uncertainty.some(item => !text(item))) errors.push('estimate.uncertainty must be a separate array of descriptions');
+  return errors;
+}
+
+export function validateRequestTriage(output, originalRequest) {
+  if (!record(output)) return ['triage output must be an object'];
+  const errors = validateEstimate(output.estimate, { provisional: true });
+  const analysis = output.requestAnalysis;
+  if (!record(analysis)) return [...errors, 'requestAnalysis must preserve the request and distinguish inferences, unknowns and blocking questions'];
+  if (typeof analysis.originalRequest !== 'string' || originalRequest !== undefined && analysis.originalRequest !== originalRequest) errors.push('requestAnalysis.originalRequest must preserve the exact original request');
+  for (const field of ['problem', 'desiredResult']) if (!text(analysis[field])) errors.push(`requestAnalysis.${field} is required`);
+  if (!Array.isArray(analysis.inferences) || analysis.inferences.some(item => !text(item?.inference) || !text(item?.source))) errors.push('each inference needs a description and evidence source');
+  if (!Array.isArray(analysis.unknowns) || analysis.unknowns.some(item => !text(item))) errors.push('unknowns must be a separate array of descriptions');
+  if (!Array.isArray(analysis.questions) || analysis.questions.some(item => !text(item?.question) || !text(item?.blocks))) errors.push('each question must state the outcome it blocks');
+  if (analysis.questions?.length) errors.push('blocking questions prevent passed triage');
+  return errors;
+}
+
+export function validateEstimateRevision(output, prior) {
+  if (!prior) return [];
+  const errors = validateEstimate(output?.estimate);
+  if (!isDeepStrictEqual(output?.estimateRevision?.previous, prior)) errors.push('refinement must preserve the prior estimate');
+  if (!text(output?.estimateRevision?.reason)) errors.push('refinement must explain whether and why the estimate changed');
+  return errors;
+}
+
+// Later owner requests on external issues need the triage receipt checked in preparation.
+export const eligibleIssueAuthor = (issue, owner, stage) => issue?.user?.login === owner || stage === 'triage' || issue?.labels?.some(label => label.name === 'triaged');

package/src/stage-dispatch.mjs

@@ -2,13 +2,14 @@ import { digest } from './host-contract.mjs';
 import { readActionsJson } from './actions-artifact.mjs';
 
 const routerPath = '.github/workflows/lighthouse-sdlc-router.yml';
-export const stages = ['refine', 'propose', 'implement', 'integrate', 'review'];
+export const stages = ['triage', 'refine', 'propose', 'implement', 'integrate', 'review'];
 export const workers = [...stages, 'apply-review'];
 export const workerFor = request => request.worker ?? request.stage ?? 'implement';
 export const stagePath = stage => { if (!workers.includes(stage)) throw Error('Unknown dispatch worker'); return `.github/workflows/lighthouse-sdlc-${stage}.lock.yml`; };
 export const implementPath = stagePath('implement');
 export const statusText = (stage, status) => `${({ requested: '📥 Requested', running: '▶️ Execution admitted', completed: '✅ Completed', waiting: '⏸️ Waiting for your response', failed: '❌ Failed or cancelled' })[status]} · ${stage}`;
 const positive = value => /^[1-9][0-9]*$/.test(String(value));
+export const isBotContinuation = (event, eventName, actor, triggeringActor) => eventName === 'workflow_dispatch' && actor === 'github-actions[bot]' && triggeringActor === actor && event.inputs?.stage === 'implement' && positive(event.inputs?.issue) && positive(event.inputs?.after_run);
 const sha = value => /^[a-f0-9]{40}$/.test(value ?? '');
 const hash = value => /^[a-f0-9]{64}$/.test(value ?? '');
 export const dispatchId = (repository, runId, stage = 'implement') => digest(`${repository}:${runId}:${stage}`);
@@ -77,7 +78,8 @@ export function verifyDispatchOrigin(request, receipt, parent, worker, repositor
   const recovery = !!request.recovery;
   const originPath = recovery ? '.github/workflows/lighthouse-worker-maintenance.yml' : routerPath;
   const originEvent = recovery ? request.routerEventName : request.eventName;
-  if (String(parent.id) !== String(receipt.routerRunId) || parent.run_attempt !== receipt.routerAttempt || request.routerRunId !== receipt.routerRunId || request.routerAttempt !== receipt.routerAttempt || parent.path !== originPath || (parent.event !== 'workflow_run' && (parent.actor?.login !== owner || parent.triggering_actor?.login !== owner)) || !(recovery ? ['schedule', 'workflow_dispatch'] : events).includes(parent.event) || parent.event !== originEvent || parent.head_sha !== (request.routerRevision ?? request.workflowRevision) || parent.head_branch !== (request.routerRef ?? request.ref) || parent.repository?.full_name !== repository) throw Error('Dispatch origin is not an authorized router execution');
+  const continuation = !recovery && isBotContinuation(request.event, parent.event, parent.actor?.login, parent.triggering_actor?.login) && request.stage === 'implement' && request.handoff && !request.worker && !request.feedbackKey && Number(request.event.inputs.issue) === issue && request.predecessor?.runId === request.event.inputs.after_run;
+  if (String(parent.id) !== String(receipt.routerRunId) || parent.run_attempt !== receipt.routerAttempt || request.routerRunId !== receipt.routerRunId || request.routerAttempt !== receipt.routerAttempt || parent.path !== originPath || (parent.event !== 'workflow_run' && !continuation && (parent.actor?.login !== owner || parent.triggering_actor?.login !== owner)) || !(recovery ? ['schedule', 'workflow_dispatch'] : events).includes(parent.event) || parent.event !== originEvent || parent.head_sha !== (request.routerRevision ?? request.workflowRevision) || parent.head_branch !== (request.routerRef ?? request.ref) || parent.repository?.full_name !== repository) throw Error('Dispatch origin is not an authorized router execution');
   const eventRunId = request.eventName === 'workflow_run' ? request.event?.workflow_run?.id : request.event?.inputs?.after_run;
   if (String(eventRunId ?? '') !== String(receipt.eventRunId ?? '') || String(request.eventRunId ?? '') !== String(receipt.eventRunId ?? '')) throw Error('Completion event identity mismatch');
   if (worker.path !== stagePath(workerFor(request)) || worker.event !== 'workflow_dispatch' || worker.head_sha !== request.workflowRevision || worker.head_branch !== request.ref || worker.repository?.full_name !== repository || ![owner, 'github-actions[bot]'].includes(worker.actor?.login) || ![owner, 'github-actions[bot]'].includes(worker.triggering_actor?.login)) throw Error('Dispatch worker identity mismatch');
@@ -91,6 +93,11 @@ export async function loadDispatch(api, repository, owner, issue, commentId, wor
   const parent = await api(`actions/runs/${receipt.routerRunId}/attempts/${receipt.routerAttempt}`);
   const request = await readArtifact(api, repository, receipt.routerRunId, dispatchArtifact(receipt), 'dispatch.json');
   verifyDispatchOrigin(request, receipt, parent, worker, repository, owner, issue);
+  if (isBotContinuation(request.event, parent.event, parent.actor?.login, parent.triggering_actor?.login)) {
+    const predecessor = await api(`actions/runs/${request.predecessor.runId}`);
+    const next = await (await import('./stage-transition.mjs')).refinementAfterRun(api, repository, owner, { action: 'completed', workflow_run: { id: predecessor.id, head_sha: predecessor.head_sha } }, readArtifact);
+    if (next?.issue !== issue || JSON.stringify(next.predecessor) !== JSON.stringify(request.predecessor)) throw Error('Bot continuation lacks an authenticated refinement');
+  }
   const dispatch = { request, receipt, commentId: Number(commentId) };
   if (request.recovery) await (await import('./worker-recovery.mjs')).verifyRecoveryOrigin(api, repository, owner, dispatch, parent, readArtifact, depth);
   return dispatch;
@@ -138,11 +145,20 @@ export async function finishDispatch(api, repository, issue, commentId, workerId
 
 // An owner can replay a completed run on a reviewed workflow branch for acceptance.
 // Automated events and manual replays use the same fresh GitHub observation.
-export async function completedEvent(api, event, env) {
+export async function completedEvent(api, event, env, wait = ms => new Promise(resolve => setTimeout(resolve, ms))) {
   if (env.GITHUB_EVENT_NAME === 'workflow_run') return event;
   const id = event.inputs?.after_run;
   if (!id) return null;
-  if (env.GITHUB_EVENT_NAME !== 'workflow_dispatch' || env.GITHUB_ACTOR !== env.GITHUB_REPOSITORY_OWNER || env.GITHUB_TRIGGERING_ACTOR !== env.GITHUB_REPOSITORY_OWNER || !positive(id)) throw Error('Completion replay requires an owner and a run ID');
-  const run = await api(`actions/runs/${id}`);
+  const bot = isBotContinuation(event, env.GITHUB_EVENT_NAME, env.GITHUB_ACTOR, env.GITHUB_TRIGGERING_ACTOR);
+  if (!bot && (env.GITHUB_EVENT_NAME !== 'workflow_dispatch' || env.GITHUB_ACTOR !== env.GITHUB_REPOSITORY_OWNER || env.GITHUB_TRIGGERING_ACTOR !== env.GITHUB_REPOSITORY_OWNER || !positive(id))) throw Error('Completion replay requires an owner and a run ID, or a verified refinement continuation');
+  let run = await api(`actions/runs/${id}`);
+  if (bot) {
+    if (run.path !== stagePath('refine')) throw Error('Bot continuation must reference a refinement');
+    // The publisher signals before its own workflow has finished its final jobs.
+    for (let attempt = 0; run.status !== 'completed' && attempt < 24; attempt++) {
+      await wait(5000); run = await api(`actions/runs/${id}`);
+    }
+    if (run.status !== 'completed') throw Error('Refinement completion timed out; replay after the execution completes');
+  }
   return { action: 'completed', workflow_run: { id: run.id, head_sha: run.head_sha } };
 }

package/src/stage-transition.mjs

@@ -2,6 +2,16 @@ import { readActionsJson } from './actions-artifact.mjs';
 import { loadDispatch, checkDispatchClaim, stagePath, issueComments } from './stage-dispatch.mjs';
 import { validateStageEnvelope } from './host-contract.mjs';
 
+// Explicit dispatch also works when GitHub suppresses follow-up token events.
+// This is a wake-up only; the router rechecks the completed run and owner intent.
+export async function signalRefinementContinuation(api, request, envelope) {
+  if (request.stage !== 'refine' || !request.dispatch || request.autoImplement !== true || envelope.result?.status !== 'passed' || envelope.result?.gate !== 'ready') return false;
+  if (validateStageEnvelope(envelope, request).length) throw Error('Invalid refinement result');
+  const repository = await api('');
+  await api('actions/workflows/lighthouse-sdlc-router.yml/dispatches', 'POST', { ref: repository.default_branch, inputs: { issue: String(request.issue), stage: 'implement', after_run: String(request.workflowRunId) } });
+  return true;
+}
+
 // The completed execution is an observation. Its retained owner request grants the handoff.
 export async function refinementAfterRun(api, repository, owner, event, readArtifact = readActionsJson) {
   if (event.action !== 'completed' || !Number.isSafeInteger(event.workflow_run?.id)) return null;

package/src/triage.mjs

@@ -1,3 +1,5 @@
+import { validateEstimate } from './request-triage.mjs';
+
 const DIMENSIONS = Object.freeze({
   size: ['S', 'M', 'L', 'XL'],
   urgency: ['normal', 'asap', 'now'],
@@ -126,6 +128,7 @@ function validateAssessment(assessment, errors) {
     addIssue(errors, 'assessment.invalid', 'assessment must be an object', 'assessment');
     return;
   }
+  if (assessment.estimate !== undefined) for (const message of validateEstimate(assessment.estimate, { provisional: true })) addIssue(errors, 'assessment.estimate', message, 'assessment.estimate');
   for (const dimension of Object.keys(DIMENSIONS)) {
     const value = normalizedValue(dimension, assessment[dimension === 'blast-radius' ? 'blastRadius' : dimension]);
     if (!DIMENSIONS[dimension].includes(value) && !(dimension === 'blast-radius' && value === 'unknown')) {
@@ -254,6 +257,7 @@ export function buildTriageReport(input) {
     canApply: status === 'ready',
     workItem: input.workItem ?? null,
     assessment: {
+      ...(assessment.estimate !== undefined ? { estimate: assessment.estimate } : {}),
       size: normalizedValue('size', assessment.size),
       urgency: normalizedValue('urgency', assessment.urgency),
       impact: normalizedValue('impact', assessment.impact),

package/templates/change-request.yml

@@ -0,0 +1,24 @@
+name: Request a change
+description: Tell us what is difficult and what would help.
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What is difficult today?
+      description: Describe the problem and who it affects.
+    validations:
+      required: true
+  - type: textarea
+    id: result
+    attributes:
+      label: What result would help?
+      description: Describe what you would like to be different.
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Examples or context (optional)
+      description: Add examples, links or screenshots if useful. No technical plan is needed.
+    validations:
+      required: false

package/workflows/lighthouse-sdlc-apply-review.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"b53e69b59b107e49da418b572f7b91a908ecc6640f2e9a5ecf8af1e418467b0c","body_hash":"8151890e19043f86541decb00d0dc86741daec051c004feb7beab27b025e3621","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"9c9a74c51b01ca45a33547aa564ae10c46766c84093b5f96471b20bce2a505ac","body_hash":"8151890e19043f86541decb00d0dc86741daec051c004feb7beab27b025e3621","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -55,7 +55,7 @@
 # Container images used:
 #   - ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382
 
-name: "Lighthouse SDLC apply-review"
+name: "apply review"
 on:
   # roles: all # Roles processed as role check in pre-activation job
   workflow_dispatch:
@@ -90,7 +90,7 @@ env:
   LIGHTHOUSE_WORKER: apply-review
   OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.GH_AW_DEFAULT_OTLP_ENDPOINT || vars.GH_AW_DEFAULT_OTLP_ENDPOINT }}
   OTEL_SERVICE_NAME: gh-aw.lighthouse-sdlc-apply-review
-  OTEL_RESOURCE_ATTRIBUTES: 'gh-aw.workflow.name=Lighthouse%20SDLC%20apply-review,gh-aw.repository=${{ github.repository }},gh-aw.run.id=${{ github.run_id }},github.run_id=${{ github.run_id }},gh-aw.engine.id=opencode'
+  OTEL_RESOURCE_ATTRIBUTES: 'gh-aw.workflow.name=apply%20review,gh-aw.repository=${{ github.repository }},gh-aw.run.id=${{ github.run_id }},github.run_id=${{ github.run_id }},gh-aw.engine.id=opencode'
   OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.GH_AW_DEFAULT_OTLP_HEADERS }}
   GH_AW_OTLP_ENDPOINTS: '[{"url":"${{ secrets.GH_AW_DEFAULT_OTLP_ENDPOINT || vars.GH_AW_DEFAULT_OTLP_ENDPOINT }}","headers":"${{ secrets.GH_AW_DEFAULT_OTLP_HEADERS }}"}]'
   GH_AW_OTLP_IF_MISSING: ignore
@@ -139,7 +139,7 @@ jobs:
           parent-span-id: ${{ needs.pre_activation.outputs.setup-parent-span-id || needs.pre_activation.outputs.setup-span-id }}
           safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
         env:
-          GH_AW_SETUP_WORKFLOW_NAME: "Lighthouse SDLC apply-review"
+          GH_AW_SETUP_WORKFLOW_NAME: "apply review"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/lighthouse-sdlc-apply-review.lock.yml@${{ github.ref }}
           GH_AW_INFO_VERSION: "2.1.0"
           GH_AW_INFO_ENGINE_ID: "opencode"
@@ -155,7 +155,7 @@ jobs:
           GH_AW_INFO_VERSION: "2.1.0"
           GH_AW_INFO_AGENT_VERSION: "2.1.0"
           GH_AW_INFO_CLI_VERSION: "v0.93.2"
-          GH_AW_INFO_WORKFLOW_NAME: "Lighthouse SDLC apply-review"
+          GH_AW_INFO_WORKFLOW_NAME: "apply review"
           GH_AW_INFO_WORKFLOW_ID: ${{ job.workflow_ref }}
           GH_AW_INFO_EXPERIMENTAL: "false"
           GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
@@ -204,7 +204,7 @@ jobs:
         if: ${{ env.GH_AW_ADMISSION_RESULT != 'admitted' && env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_AW_WORKFLOW_NAME: "Lighthouse SDLC apply-review"
+          GH_AW_WORKFLOW_NAME: "apply review"
           GH_AW_WORKFLOW_ID: "lighthouse-sdlc-apply-review"
           GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}
@@ -278,7 +278,7 @@ jobs:
           GH_AW_COMPILED_VERSION: "v0.93.2"
           GH_AW_HAS_SAFE_OUTPUTS: "true"
           GH_AW_BLOCKED_VERSION_REPORT_AS_ISSUE: "false"
-          GH_AW_WORKFLOW_NAME: "Lighthouse SDLC apply-review"
+          GH_AW_WORKFLOW_NAME: "apply review"
         with:
           script: |
             const path = require('path');
@@ -458,7 +458,7 @@ jobs:
           trace-id: ${{ needs.activation.outputs.setup-trace-id }}
           parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
         env:
-          GH_AW_SETUP_WORKFLOW_NAME: "Lighthouse SDLC apply-review"
+          GH_AW_SETUP_WORKFLOW_NAME: "apply review"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/lighthouse-sdlc-apply-review.lock.yml@${{ github.ref }}
           GH_AW_INFO_VERSION: "2.1.0"
           GH_AW_INFO_ENGINE_ID: "opencode"
@@ -981,7 +981,7 @@ jobs:
           trace-id: ${{ needs.activation.outputs.setup-trace-id }}
           parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
         env:
-          GH_AW_SETUP_WORKFLOW_NAME: "Lighthouse SDLC apply-review"
+          GH_AW_SETUP_WORKFLOW_NAME: "apply review"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/lighthouse-sdlc-apply-review.lock.yml@${{ github.ref }}
           GH_AW_INFO_VERSION: "2.1.0"
           GH_AW_INFO_ENGINE_ID: "opencode"
@@ -1018,7 +1018,7 @@ jobs:
         env:
           GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
           GH_AW_NOOP_MAX: "2"
-          GH_AW_WORKFLOW_NAME: "Lighthouse SDLC apply-review"
+          GH_AW_WORKFLOW_NAME: "apply review"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/lighthouse-sdlc-apply-review.md"
           GH_AW_ENGINE_ID: "opencode"
           GH_AW_ENGINE_VERSION: "2.1.0"
@@ -1044,7 +1044,7 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
-          GH_AW_WORKFLOW_NAME: "Lighthouse SDLC apply-review"
+          GH_AW_WORKFLOW_NAME: "apply review"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/lighthouse-sdlc-apply-review.md"
           GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
@@ -1086,7 +1086,7 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
-          GH_AW_WORKFLOW_NAME: "Lighthouse SDLC apply-review"
+          GH_AW_WORKFLOW_NAME: "apply review"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/lighthouse-sdlc-apply-review.md"
           GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           GH_AW_REPORT_FAILED_JOBS: "true"
@@ -1217,7 +1217,7 @@ jobs:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
         env:
-          GH_AW_SETUP_WORKFLOW_NAME: "Lighthouse SDLC apply-review"
+          GH_AW_SETUP_WORKFLOW_NAME: "apply review"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/lighthouse-sdlc-apply-review.lock.yml@${{ github.ref }}
           GH_AW_INFO_VERSION: "2.1.0"
           GH_AW_INFO_ENGINE_ID: "opencode"
@@ -1231,6 +1231,7 @@ jobs:
       actions: read
       contents: read
       issues: write
+      pull-requests: write
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     outputs: