@plainconceptsplatform/workflows 1.9.0 → 1.10.0

package/README.md

@@ -46,7 +46,7 @@ workflows add refine --template agentics-checks --force  # routes + template + m
 workflows remove audit                     # uninstall the audit worker and drop it from the router
 ```
 
-Route names: refine, implement, triage, apply-review, merge-gate, audit, release. Unknown arguments produce an error.
+Route names: refine, implement, triage, apply-review, merge-gate, audit, docs-audit, release. `docs-audit` is optional: it installs only when named. Unknown arguments produce an error.
 
 ## Update
 

package/dist/catalog-installation.js

@@ -5,7 +5,7 @@ import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { parse as parseYaml } from "yaml";
-import { catalogTemplates, mandatoryFiles, retiredWorkflowFiles, routeNames, templateNames, workflowRoutes } from "./workflow-catalog.js";
+import { catalogTemplates, defaultRouteNames, mandatoryFiles, retiredWorkflowFiles, templateNames, workflowRoutes } from "./workflow-catalog.js";
 import { processRoutes, excludedWorkerFiles } from "./route-processing.js";
 import { generateOpencodeCi, generateOpencodeConfig, generateStackDefaults, injectStackEnv, shippedVerifyDefaults } from "./stack-defaults.js";
 import { mergeRouter, mergeWorker } from "./worker-env.js";
@@ -40,7 +40,7 @@ const normalizeEol = (text) => text.replaceAll("\r\n", "\n");
 export async function installCatalog(repositoryPath, options = {}) {
     const version = options.packageVersion ?? await packageVersion();
     const sourcePath = options.sourcePath ?? catalogSourcePath();
-    const selectedRoutes = options.selectedRoutes ?? routeNames;
+    const selectedRoutes = options.selectedRoutes ?? defaultRouteNames;
     const allFiles = [...await catalogFiles(sourcePath), ...mandatoryFileSpecs(sourcePath)];
     const deduplicated = allFiles.filter((file, index) => allFiles.findIndex((f) => f.target === file.target) === index).sort((left, right) => left.target.localeCompare(right.target));
     const excluded = excludedWorkerFiles(selectedRoutes);

package/dist/package-baseline.js

@@ -24,8 +24,11 @@ export async function packageVersion() {
 export function isValidVersion(version) {
     return new RegExp(`^${VERSION}$`).test(version);
 }
+// The header opens a line near the top of the file. A document that only quotes it is not ours:
+// matching it anywhere is how `update` deleted Guard's ADR 0010 and a Compass ADR from `docs/`.
+const HEADER_LINE = new RegExp(`^\\s*(?:#|//|<!--)?\\s*${escapeRegex(HEADER)}[@.]`);
 export function hasOwnershipHeader(content) {
-    return content.includes(HEADER);
+    return content.split("\n", 5).some((line) => HEADER_LINE.test(line));
 }
 /** The version recorded in a file's ownership header, or undefined for an unstamped file. */
 export function installedVersion(content) {

package/dist/route-processing.js

@@ -4,6 +4,7 @@ import { routeNames, workflowRoutes } from "./workflow-catalog.js";
 // route matrix reads the installed worker files, so neither is rewritten here.
 const routeCrons = {
     audit: "17 1 * * 1",
+    "docs-audit": "47 2 1,15 * *",
 };
 // Deterministic router jobs that exist only to serve one worker route. They leave with it, or
 // the route matrix finds a `route == 'implement'` guard in a router with no implement worker.
@@ -19,9 +20,11 @@ const routeHelperOperations = {
 };
 export function stripRouteFromRouter(yaml, route) {
     let result = yaml;
+    // By the slot comment as well as the value: a repository picks its own slot, and the shipped
+    // line carries that comment, so matching the bare default alone left the cron behind.
     const cron = routeCrons[route];
     if (cron !== undefined) {
-        result = result.replace(new RegExp(`^    - cron: "${escapeRegex(cron)}"\\n`, "gm"), "");
+        result = result.replace(new RegExp(`^    - cron: "(?:${escapeRegex(cron)}"|[^"]*" # ${escapeRegex(route)} slot.*)\\n`, "gm"), "");
     }
     for (const job of [`call-${route}`, ...(routeHelperJobs[route] ?? [])]) {
         result = removeJobBlock(result, job);

package/dist/worker-env.d.ts

@@ -32,7 +32,7 @@ export declare function mergeWorkerEnv(packageContent: string, consumerContent:
     content: string;
     report: WorkerMergeReport;
 };
-/** Copy the router's own `env:` values into the two literal lines that cannot read them. */
+/** Copy the router's own `env:` values into the literal lines that cannot read them. */
 export declare function mirrorRouterLiterals(router: string): string;
 /** The package's router with the consumer's `env:` values put back and mirrored into place. */
 export declare function mergeRouter(packageContent: string, consumerContent: string, baselineContent?: string): {

package/dist/worker-env.js

@@ -142,13 +142,14 @@ function engineEndpoint(content) {
 // now: every job, router and release included, belongs on the Azure fleet (agents-arc, runner
 // group `agentic`). The route matrix asserts it, so a repo cannot drift back without a red run. Per the standing rule for this package, anything a
 // consumer really must vary belongs in `env:` at the top of the file, not in `runs-on`.
-// GitHub evaluates no expression in a `workflow_run.workflows:` list or in a `cron:`, so the two
+// GitHub evaluates no expression in a `workflow_run.workflows:` list or in a `cron:`, so the
 // router values that are also needed there cannot be read from `env:` at those two lines. The
 // installer copies them in instead, which is what keeps the pair in step across an update; the
 // route matrix asserts the copies still agree.
 const CI_NAME_TRIGGER = /^(\s*workflows: \[")[^"]*("\]\s*)$/m;
 const AUDIT_CRON_LINE = /^(\s*- cron: ")[^"]*(" # audit slot.*)$/m;
-/** Copy the router's own `env:` values into the two literal lines that cannot read them. */
+const DOCS_AUDIT_CRON_LINE = /^(\s*- cron: ")[^"]*(" # docs-audit slot.*)$/m;
+/** Copy the router's own `env:` values into the literal lines that cannot read them. */
 export function mirrorRouterLiterals(router) {
     const values = new Map(parseYamlEnv(router).entries.map((entry) => [entry.key, unquote(entryValue(entry))]));
     const ciName = values.get("CI_WORKFLOW_NAME");
@@ -158,6 +159,9 @@ export function mirrorRouterLiterals(router) {
         result = result.replace(CI_NAME_TRIGGER, `$1${ciName}$2`);
     if (auditCron !== undefined)
         result = result.replace(AUDIT_CRON_LINE, `$1${auditCron}$2`);
+    const docsAuditCron = values.get("DOCS_AUDIT_CRON");
+    if (docsAuditCron !== undefined)
+        result = result.replace(DOCS_AUDIT_CRON_LINE, `$1${docsAuditCron}$2`);
     return result;
 }
 function unquote(value) {

package/dist/workflow-catalog.d.ts

@@ -1,4 +1,4 @@
-export declare const routeNames: readonly ["refine", "implement", "triage", "apply-review", "merge-gate", "audit", "release"];
+export declare const routeNames: readonly ["refine", "implement", "triage", "apply-review", "merge-gate", "audit", "docs-audit", "release"];
 export type RouteName = (typeof routeNames)[number];
 export interface WorkflowRoute {
     readonly name: RouteName;
@@ -9,6 +9,8 @@ export interface WorkflowRoute {
     readonly companions?: readonly string[];
 }
 export declare const workflowRoutes: readonly WorkflowRoute[];
+/** What an install with no explicit selection gets. An optional worker is added by name. */
+export declare const defaultRouteNames: readonly RouteName[];
 export declare const retiredWorkflowFiles: readonly ["agent-visual-verify.md", "agent-visual-verify.lock.yml"];
 export declare const packageOwnedTargets: readonly [".github/actions", ".github/workflows/agent-*.md", ".github/workflows/shared/platform-defaults.md", ".github/workflows/shared/opencode-ci.md", ".github/workflows/work-router.yml", ".github/workflows/evidence.yml", "scripts/compile-agent-workflows.mjs", "opencode.ci.json", "docs/diagrams.md"];
 export interface MandatoryFile {

package/dist/workflow-catalog.js

@@ -5,6 +5,7 @@ export const routeNames = [
     "apply-review",
     "merge-gate",
     "audit",
+    "docs-audit",
     "release",
 ];
 export const workflowRoutes = [
@@ -14,8 +15,13 @@ export const workflowRoutes = [
     { name: "apply-review", worker: "agent-apply-review.md", description: "Applies reviewer feedback to an open pull request the bot authored, then pushes the fixes to the same branch.", defaultEnabled: true },
     { name: "merge-gate", worker: "agent-merge-gate.md", description: "Decides what happens to the pull request the merge train hands it, the bot's or a person's: repair it, merge it, or hand it to a human.", defaultEnabled: true },
     { name: "audit", worker: "agent-audit.md", description: "Read-only repository audit. Finds 5-7 problems, scores each 1-10, and files a single issue that Refine then sizes and splits.", defaultEnabled: true },
+    { name: "docs-audit", worker: "agent-docs-audit.md", description: "Read-only documentation audit, every fortnight. Checks the documentation against the code and the Platform standard, and files one issue that Refine then sizes and splits, only when something is stale.", defaultEnabled: false },
     { name: "release", worker: "agent-release.md", description: "Writes release notes from the commit log, then a deterministic job opens a version-bump pull request with auto-merge; once it merges, release-tag.yml tags the commit and publishes the GitHub Release. Manual dispatch only (operation=release).", defaultEnabled: true, companions: ["release-tag.yml"] },
 ];
+/** What an install with no explicit selection gets. An optional worker is added by name. */
+export const defaultRouteNames = workflowRoutes
+    .filter((route) => route.defaultEnabled)
+    .map((route) => route.name);
 // Workflow files the package used to ship and no longer does. `.github/workflows/` is not pruned
 // wholesale, because a missing worker there means a route the consumer left out, so a retired one
 // is named here or it sits in every consumer forever with a lock that still compiles.

package/loops/actions/add-issue-labels/action.yml

@@ -1,50 +1,50 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/add-issue-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Add issue labels
-description: Add one or more labels to an issue or pull request.
-inputs:
-  token:
-    description: GitHub token used by github-script.
-    required: true
-  issue-number:
-    description: Issue or pull request number.
-    required: true
-  labels:
-    description: Labels to add, one per line. A comma-separated list is accepted as well.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Add labels
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        LABELS: ${{ inputs.labels }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const labels = process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean);
-          if (labels.length === 0) {
-            core.notice('No labels to add.');
-            return;
-          }
-
-          // Create what does not exist yet, so shipping a new label in the package does not
-          // require a person to go and make it in every repository first. Its sibling
-          // remove-issue-labels has swallowed 404 for a long time; this one had no guard at all,
-          // so a label the package introduced would fail the step in every consumer until
-          // somebody created it by hand. 422 is "already exists", which is the happy path on
-          // every run after the first.
-          for (const name of labels) {
-            try {
-              await github.rest.issues.createLabel({ ...context.repo, name, color: 'ededed' });
-              core.notice(`Created the ${name} label.`);
-            } catch (error) {
-              if (error.status !== 422) throw error;
-            }
-          }
-
-          await github.rest.issues.addLabels({
-            ...context.repo,
-            issue_number: Number(process.env.ISSUE_NUMBER),
-            labels,
-          });
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/add-issue-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Add issue labels
+description: Add one or more labels to an issue or pull request.
+inputs:
+  token:
+    description: GitHub token used by github-script.
+    required: true
+  issue-number:
+    description: Issue or pull request number.
+    required: true
+  labels:
+    description: Labels to add, one per line. A comma-separated list is accepted as well.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Add labels
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        LABELS: ${{ inputs.labels }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const labels = process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean);
+          if (labels.length === 0) {
+            core.notice('No labels to add.');
+            return;
+          }
+
+          // Create what does not exist yet, so shipping a new label in the package does not
+          // require a person to go and make it in every repository first. Its sibling
+          // remove-issue-labels has swallowed 404 for a long time; this one had no guard at all,
+          // so a label the package introduced would fail the step in every consumer until
+          // somebody created it by hand. 422 is "already exists", which is the happy path on
+          // every run after the first.
+          for (const name of labels) {
+            try {
+              await github.rest.issues.createLabel({ ...context.repo, name, color: 'ededed' });
+              core.notice(`Created the ${name} label.`);
+            } catch (error) {
+              if (error.status !== 422) throw error;
+            }
+          }
+
+          await github.rest.issues.addLabels({
+            ...context.repo,
+            issue_number: Number(process.env.ISSUE_NUMBER),
+            labels,
+          });

package/loops/actions/agent-output.cjs

@@ -1,17 +1,17 @@
-// Managed by @plainconceptsplatform/workflows. Source: loops/actions/agent-output.cjs. Update with `workflows update --force`; consumer edits may be overwritten.
-const fs = require('node:fs');
-
-// Every apply-agent-* action reads the same artifact the same way: a missing file means the
-// agent produced nothing, which is a normal outcome rather than a failure.
-function readAgentItems(outputFile, type) {
-  if (!outputFile || !fs.existsSync(outputFile)) {
-    return [];
-  }
-
-  const parsed = JSON.parse(fs.readFileSync(outputFile, 'utf8'));
-  const items = Array.isArray(parsed.items) ? parsed.items : [];
-
-  return type ? items.filter((item) => item.type === type) : items;
-}
-
-module.exports = { readAgentItems };
+// Managed by @plainconceptsplatform/workflows. Source: loops/actions/agent-output.cjs. Update with `workflows update --force`; consumer edits may be overwritten.
+const fs = require('node:fs');
+
+// Every apply-agent-* action reads the same artifact the same way: a missing file means the
+// agent produced nothing, which is a normal outcome rather than a failure.
+function readAgentItems(outputFile, type) {
+  if (!outputFile || !fs.existsSync(outputFile)) {
+    return [];
+  }
+
+  const parsed = JSON.parse(fs.readFileSync(outputFile, 'utf8'));
+  const items = Array.isArray(parsed.items) ? parsed.items : [];
+
+  return type ? items.filter((item) => item.type === type) : items;
+}
+
+module.exports = { readAgentItems };

package/loops/actions/apply-agent-bundle/action.yml

@@ -1,24 +1,24 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-bundle/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Apply agent bundle
-description: Fast-forward an intended branch to the single commit exported by a verified git bundle.
-inputs:
-  bundle-file:
-    description: Path to the git bundle from the agent artifact.
-    required: true
-  target-branch:
-    description: Branch that must fast-forward to the bundle commit.
-    required: true
-  base-branch:
-    description: Existing branch used only when target-branch does not exist.
-    required: false
-    default: ''
-runs:
-  using: composite
-  steps:
-    - name: Fast-forward branch from bundle
-      shell: bash
-      env:
-        BUNDLE_FILE: ${{ inputs.bundle-file }}
-        TARGET_BRANCH: ${{ inputs.target-branch }}
-        BASE_BRANCH: ${{ inputs.base-branch }}
-      run: bash "$GITHUB_ACTION_PATH/apply-bundle.sh" "$BUNDLE_FILE" "$TARGET_BRANCH" "$BASE_BRANCH"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-bundle/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Apply agent bundle
+description: Fast-forward an intended branch to the single commit exported by a verified git bundle.
+inputs:
+  bundle-file:
+    description: Path to the git bundle from the agent artifact.
+    required: true
+  target-branch:
+    description: Branch that must fast-forward to the bundle commit.
+    required: true
+  base-branch:
+    description: Existing branch used only when target-branch does not exist.
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Fast-forward branch from bundle
+      shell: bash
+      env:
+        BUNDLE_FILE: ${{ inputs.bundle-file }}
+        TARGET_BRANCH: ${{ inputs.target-branch }}
+        BASE_BRANCH: ${{ inputs.base-branch }}
+      run: bash "$GITHUB_ACTION_PATH/apply-bundle.sh" "$BUNDLE_FILE" "$TARGET_BRANCH" "$BASE_BRANCH"

package/loops/actions/apply-agent-comments/action.yml

@@ -1,42 +1,42 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-comments/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Apply agent comments
-description: Post every add_comment item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write and pull-requests:write.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Post comments
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE, 'add_comment');
-
-          let posted = 0;
-
-          for (const item of items) {
-            if (!item.item_number) {
-              core.warning(`add_comment item has no item_number, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            await github.rest.issues.createComment({
-              ...context.repo,
-              issue_number: Number(item.item_number),
-              body: item.body,
-            });
-
-            posted += 1;
-          }
-
-          core.info(`Posted ${posted} comment(s).`);
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-comments/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Apply agent comments
+description: Post every add_comment item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write and pull-requests:write.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Post comments
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE, 'add_comment');
+
+          let posted = 0;
+
+          for (const item of items) {
+            if (!item.item_number) {
+              core.warning(`add_comment item has no item_number, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: Number(item.item_number),
+              body: item.body,
+            });
+
+            posted += 1;
+          }
+
+          core.info(`Posted ${posted} comment(s).`);

package/loops/actions/apply-agent-labels/action.yml

@@ -1,55 +1,55 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Apply agent labels
-description: Apply every add_labels and remove_labels item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Apply label changes
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE)
-            .filter((item) => item.type === 'add_labels' || item.type === 'remove_labels');
-
-          let added = 0;
-          let removed = 0;
-
-          for (const item of items) {
-            const labels = (item.labels ?? []).map((label) => label.name).filter(Boolean);
-
-            if (!item.item_number || labels.length === 0) {
-              core.warning(`${item.type} item is not actionable, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            const issue_number = Number(item.item_number);
-
-            if (item.type === 'add_labels') {
-              await github.rest.issues.addLabels({ ...context.repo, issue_number, labels });
-              added += labels.length;
-              continue;
-            }
-
-            for (const name of labels) {
-              try {
-                await github.rest.issues.removeLabel({ ...context.repo, issue_number, name });
-                removed += 1;
-              } catch (error) {
-                if (error.status !== 404) throw error;
-              }
-            }
-          }
-
-          core.info(`Added ${added} label(s), removed ${removed}.`);
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Apply agent labels
+description: Apply every add_labels and remove_labels item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Apply label changes
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE)
+            .filter((item) => item.type === 'add_labels' || item.type === 'remove_labels');
+
+          let added = 0;
+          let removed = 0;
+
+          for (const item of items) {
+            const labels = (item.labels ?? []).map((label) => label.name).filter(Boolean);
+
+            if (!item.item_number || labels.length === 0) {
+              core.warning(`${item.type} item is not actionable, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            const issue_number = Number(item.item_number);
+
+            if (item.type === 'add_labels') {
+              await github.rest.issues.addLabels({ ...context.repo, issue_number, labels });
+              added += labels.length;
+              continue;
+            }
+
+            for (const name of labels) {
+              try {
+                await github.rest.issues.removeLabel({ ...context.repo, issue_number, name });
+                removed += 1;
+              } catch (error) {
+                if (error.status !== 404) throw error;
+              }
+            }
+          }
+
+          core.info(`Added ${added} label(s), removed ${removed}.`);

package/loops/actions/audit-close/action.yml

@@ -21,12 +21,19 @@ runs:
       with:
         github-token: ${{ inputs.token }}
         script: |
-          const reports = await github.paginate(github.rest.issues.listForRepo, {
-            ...context.repo,
-            state: 'open',
-            labels: 'audit',
-            per_page: 100,
-          });
+          // A documentation audit is the same chain: a report Refine splits into children. A
+          // report carrying both labels must not be processed twice.
+          const reportsById = new Map();
+          for (const labels of ['audit', 'docs-audit']) {
+            const found = await github.paginate(github.rest.issues.listForRepo, {
+              ...context.repo,
+              state: 'open',
+              labels,
+              per_page: 100,
+            });
+            for (const report of found) reportsById.set(report.number, report);
+          }
+          const reports = [...reportsById.values()];
 
           if (reports.length === 0) {
             core.info('No open audit reports.');

package/loops/actions/classify-route/classify-route.sh

@@ -13,6 +13,7 @@ set -euo pipefail
 # fired on a cron this file does not know classifies to no route and dies silently, so the
 # route matrix asserts the two still agree.
 readonly AUDIT_CRON="${AUDIT_CRON:-17 1 * * 1}"
+readonly DOCS_AUDIT_CRON="${DOCS_AUDIT_CRON:-47 2 1,15 * *}"
 readonly AUDIT_CLOSE_CRON="43 3 * * *"
 readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
 readonly RECONCILE_BOT_PR_RUNS_CRON="17 * * * *"
@@ -192,6 +193,7 @@ classify_route() {
       trigger_kind="scheduled"
       case "${SCHEDULE:-}" in
         "$AUDIT_CRON") route="audit" ;;
+        "$DOCS_AUDIT_CRON") route="docs-audit" ;;
         "$AUDIT_CLOSE_CRON") route="audit-close" ;;
         "$CLEANUP_ARTIFACTS_CRON") route="cleanup-artifacts" ;;
         "$RECONCILE_BOT_PR_RUNS_CRON") route="reconcile-bot-pr-runs" ;;
@@ -266,7 +268,7 @@ classify_route() {
             error="operation 'evidence' needs a positive pr-number, got '${INPUT_PR_NUMBER:-}'"
           fi
           ;;
-        audit)
+        audit | docs-audit)
           route="${OPERATION}"
           trigger_kind="${INPUT_TRIGGER_KIND:-manual}"
           ;;