agent-control-plane 0.2.0 → 0.4.9

package/tools/bin/agent-project-publish-issue-pr

@@ -186,9 +186,12 @@ fi
 resolve_actor_login() {
   local login=""
 
-  flow_export_github_cli_auth_env "${repo_slug}"
-  login="$(gh api user --jq .login 2>/dev/null || true)"
-  if [[ -z "${login}" ]]; then
+  login="$(flow_github_current_login 2>/dev/null || true)"
+  if [[ -z "${login}" && ! "$(flow_forge_provider)" =~ ^gitea$ ]]; then
+    flow_export_github_cli_auth_env "${repo_slug}"
+    login="$(gh api user --jq .login 2>/dev/null || true)"
+  fi
+  if [[ -z "${login}" && ! "$(flow_forge_provider)" =~ ^gitea$ ]]; then
     login="$(
       gh auth status 2>/dev/null \
         | sed -n 's/^  ✓ Logged in to github.com account \([^ ]*\) (.*/\1/p' \

package/tools/bin/agent-project-reconcile-issue-session

@@ -2,82 +2,33 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-bootstrap_flow_shell_lib() {
-  local candidate=""
-  local skill_name=""
-
-  for candidate in \
-    "${SCRIPT_DIR}/flow-shell-lib.sh" \
-    "${AGENT_CONTROL_PLANE_ROOT:-}/tools/bin/flow-shell-lib.sh" \
-    "${ACP_ROOT:-}/tools/bin/flow-shell-lib.sh" \
-    "${F_LOSNING_FLOW_ROOT:-}/tools/bin/flow-shell-lib.sh" \
-    "${AGENT_FLOW_SKILL_ROOT:-}/tools/bin/flow-shell-lib.sh" \
-    "${SHARED_AGENT_HOME:-}/tools/bin/flow-shell-lib.sh" \
-    "$(pwd)/tools/bin/flow-shell-lib.sh"; do
-    if [[ -n "${candidate}" && -f "${candidate}" ]]; then
-      printf '%s\n' "${candidate}"
-      return 0
-    fi
-  done
-
-  if [[ -n "${SHARED_AGENT_HOME:-}" ]]; then
-    for skill_name in "${AGENT_CONTROL_PLANE_SKILL_NAME:-agent-control-plane}" "${AGENT_CONTROL_PLANE_COMPAT_ALIAS:-}"; do
-      [[ -n "${skill_name}" ]] || continue
-      candidate="${SHARED_AGENT_HOME}/skills/openclaw/${skill_name}/tools/bin/flow-shell-lib.sh"
-      if [[ -f "${candidate}" ]]; then
-        printf '%s\n' "${candidate}"
-        return 0
-      fi
-    done
+RECONCILE_BOOTSTRAP_LIB=""
+for _rbl_candidate in \
+  "${SCRIPT_DIR}/reconcile-bootstrap-lib.sh" \
+  "${AGENT_CONTROL_PLANE_ROOT:-}/tools/bin/reconcile-bootstrap-lib.sh" \
+  "${ACP_ROOT:-}/tools/bin/reconcile-bootstrap-lib.sh" \
+  "${SHARED_AGENT_HOME:-}/tools/bin/reconcile-bootstrap-lib.sh"; do
+  if [[ -n "${_rbl_candidate}" && -f "${_rbl_candidate}" ]]; then
+    RECONCILE_BOOTSTRAP_LIB="${_rbl_candidate}"
+    break
   fi
-
-  echo "unable to locate flow-shell-lib.sh for reconcile bootstrap" >&2
-  return 1
-}
-
-FLOW_SHELL_LIB_PATH="$(bootstrap_flow_shell_lib)"
-BOOTSTRAP_TOOLS_DIR="$(cd "$(dirname "${FLOW_SHELL_LIB_PATH}")" && pwd)"
-# shellcheck source=/dev/null
-source "${FLOW_SHELL_LIB_PATH}"
-
-resolve_reconcile_tools_dir() {
-  local candidate_root=""
-  local skill_name=""
-
-  for candidate_root in \
-    "${AGENT_CONTROL_PLANE_ROOT:-}" \
-    "${ACP_ROOT:-}" \
-    "${F_LOSNING_FLOW_ROOT:-}" \
-    "${AGENT_FLOW_SKILL_ROOT:-}"; do
-    if [[ -n "${candidate_root}" && -d "${candidate_root}/tools/bin" ]]; then
-      printf '%s/tools/bin\n' "${candidate_root}"
-      return 0
+done
+if [[ -n "${SHARED_AGENT_HOME:-}" && -z "${RECONCILE_BOOTSTRAP_LIB}" ]]; then
+  for _rbl_skill in "${AGENT_CONTROL_PLANE_SKILL_NAME:-agent-control-plane}" "${AGENT_CONTROL_PLANE_COMPAT_ALIAS:-}"; do
+    [[ -n "${_rbl_skill}" ]] || continue
+    _rbl_candidate="${SHARED_AGENT_HOME}/skills/openclaw/${_rbl_skill}/tools/bin/reconcile-bootstrap-lib.sh"
+    if [[ -f "${_rbl_candidate}" ]]; then
+      RECONCILE_BOOTSTRAP_LIB="${_rbl_candidate}"
+      break
     fi
   done
-
-  if [[ -n "${SHARED_AGENT_HOME:-}" ]]; then
-    if [[ -d "${SHARED_AGENT_HOME}/tools/bin" ]]; then
-      printf '%s/tools/bin\n' "${SHARED_AGENT_HOME}"
-      return 0
-    fi
-    for skill_name in "${AGENT_CONTROL_PLANE_SKILL_NAME:-agent-control-plane}" "${AGENT_CONTROL_PLANE_COMPAT_ALIAS:-}"; do
-      [[ -n "${skill_name}" ]] || continue
-      candidate_root="${SHARED_AGENT_HOME}/skills/openclaw/${skill_name}"
-      if [[ -d "${candidate_root}/tools/bin" ]]; then
-        printf '%s/tools/bin\n' "${candidate_root}"
-        return 0
-      fi
-    done
-  fi
-
-  if [[ -d "${SCRIPT_DIR}" ]]; then
-    printf '%s\n' "${SCRIPT_DIR}"
-    return 0
-  fi
-
-  printf '%s\n' "${BOOTSTRAP_TOOLS_DIR}"
-}
+fi
+if [[ -z "${RECONCILE_BOOTSTRAP_LIB}" ]]; then
+  echo "unable to locate reconcile-bootstrap-lib.sh" >&2
+  exit 1
+fi
+# shellcheck source=/dev/null
+source "${RECONCILE_BOOTSTRAP_LIB}"
 
 usage() {
   cat <<'EOF'
@@ -89,30 +40,8 @@ allowing project adapters to inject policy hooks.
 EOF
 }
 
-shared_tools_dir="$(resolve_reconcile_tools_dir)"
-resolve_reconcile_helper_path() {
-  local helper_name="${1:?helper name required}"
-  local candidate=""
-
-  for candidate in \
-    "${SCRIPT_DIR}/${helper_name}" \
-    "${BOOTSTRAP_TOOLS_DIR}/${helper_name}" \
-    "${shared_tools_dir}/${helper_name}"; do
-    if [[ -n "${candidate}" && -f "${candidate}" ]]; then
-      printf '%s\n' "${candidate}"
-      return 0
-    fi
-  done
-
-  echo "unable to locate ${helper_name} for reconcile bootstrap" >&2
-  return 1
-}
-
-FLOW_CONFIG_LIB_PATH="$(resolve_reconcile_helper_path "flow-config-lib.sh")"
 FLOW_RESIDENT_WORKER_LIB_PATH="$(resolve_reconcile_helper_path "flow-resident-worker-lib.sh")"
 # shellcheck source=/dev/null
-source "${FLOW_CONFIG_LIB_PATH}"
-# shellcheck source=/dev/null
 source "${FLOW_RESIDENT_WORKER_LIB_PATH}"
 session=""
 repo_slug=""
@@ -302,6 +231,7 @@ if [[ -n "$hook_file" && -f "$hook_file" ]]; then
 fi
 
 provider_cooldown_script="${shared_tools_dir}/provider-cooldown-state.sh"
+github_write_outbox_script="${shared_tools_dir}/github-write-outbox.sh"
 
 schedule_provider_quota_cooldown() {
   local reason="${1:-provider-quota-limit}"
@@ -406,7 +336,17 @@ post_issue_comment_if_present() {
   if issue_latest_comment_matches_artifact; then
     return 0
   fi
-  flow_github_api_repo "${repo_slug}" "issues/${issue_id}/comments" --method POST -f body="$(cat "$comment_file")" >/dev/null || true
+  if flow_github_api_repo "${repo_slug}" "issues/${issue_id}/comments" --method POST -f body="$(cat "$comment_file")" >/dev/null 2>&1; then
+    return 0
+  fi
+  if [[ -x "${github_write_outbox_script}" ]]; then
+    "${github_write_outbox_script}" enqueue-comment \
+      --repo-slug "${repo_slug}" \
+      --number "${issue_id}" \
+      --kind issue \
+      --body-file "${comment_file}" >/dev/null 2>&1 || true
+  fi
+  return 0
 }
 
 issue_latest_comment_matches_artifact() {
@@ -1053,15 +993,6 @@ extract_recovery_worktree_from_publish_output() {
   awk -F= '/^RECOVERY_WORKTREE=/{print $2}' <<<"$publish_out" | tail -n 1
 }
 
-require_transition() {
-  local step="${1:?step required}"
-  shift
-  if ! "$@"; then
-    echo "reconcile transition failed: ${step}" >&2
-    exit 1
-  fi
-}
-
 mark_reconciled() {
   local reconciled_at tmp_file
   if [[ -d "$run_dir" ]]; then
@@ -1141,6 +1072,40 @@ update_resident_issue_metadata() {
     "LAST_WORKTREE_REUSED=${last_worktree_reused:-no}"
 }
 
+cleanup_output_value() {
+  local cleanup_output="${1:-}"
+  local key="${2:?key required}"
+  awk -F= -v target_key="${key}" '$1 == target_key { print substr($0, index($0, "=") + 1); exit }' <<<"${cleanup_output}"
+}
+
+warn_cleanup_issue_session() {
+  local cleanup_output="${1:-}"
+  local cleanup_exit="${2:-0}"
+  local cleanup_status=""
+  local cleanup_mode=""
+  local cleanup_error=""
+
+  cleanup_status="$(cleanup_output_value "${cleanup_output}" "CLEANUP_STATUS")"
+  if [[ -z "${cleanup_status}" ]]; then
+    cleanup_status="${cleanup_exit}"
+  fi
+  [[ "${cleanup_status}" != "0" ]] || return 0
+
+  cleanup_mode="$(cleanup_output_value "${cleanup_output}" "CLEANUP_MODE")"
+  cleanup_error="$(cleanup_output_value "${cleanup_output}" "CLEANUP_ERROR")"
+  printf '[%s] issue cleanup warning session=%s status=%s mode=%s\n' \
+    "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+    "${session}" \
+    "${cleanup_status}" \
+    "${cleanup_mode:-unknown}" >&2
+  if [[ -n "${cleanup_error}" ]]; then
+    printf '[%s] issue cleanup detail session=%s %s\n' \
+      "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+      "${session}" \
+      "${cleanup_error}" >&2
+  fi
+}
+
 cleanup_issue_session() {
   local -a cleanup_args=(
     --repo-root "$repo_root"
@@ -1156,7 +1121,14 @@ cleanup_issue_session() {
     cleanup_args+=(--skip-worktree-cleanup)
   fi
 
-  "${shared_tools_dir}/agent-project-cleanup-session" "${cleanup_args[@]}" >/dev/null
+  local cleanup_output=""
+  local cleanup_exit="0"
+  if cleanup_output="$("${shared_tools_dir}/agent-project-cleanup-session" "${cleanup_args[@]}" 2>&1)"; then
+    cleanup_exit="0"
+  else
+    cleanup_exit="$?"
+  fi
+  warn_cleanup_issue_session "${cleanup_output}" "${cleanup_exit}"
 }
 
 notify_issue_reconciled() {

package/tools/bin/agent-project-reconcile-pr-session

@@ -2,82 +2,33 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-bootstrap_flow_shell_lib() {
-  local candidate=""
-  local skill_name=""
-
-  for candidate in \
-    "${SCRIPT_DIR}/flow-shell-lib.sh" \
-    "${AGENT_CONTROL_PLANE_ROOT:-}/tools/bin/flow-shell-lib.sh" \
-    "${ACP_ROOT:-}/tools/bin/flow-shell-lib.sh" \
-    "${F_LOSNING_FLOW_ROOT:-}/tools/bin/flow-shell-lib.sh" \
-    "${AGENT_FLOW_SKILL_ROOT:-}/tools/bin/flow-shell-lib.sh" \
-    "${SHARED_AGENT_HOME:-}/tools/bin/flow-shell-lib.sh" \
-    "$(pwd)/tools/bin/flow-shell-lib.sh"; do
-    if [[ -n "${candidate}" && -f "${candidate}" ]]; then
-      printf '%s\n' "${candidate}"
-      return 0
-    fi
-  done
-
-  if [[ -n "${SHARED_AGENT_HOME:-}" ]]; then
-    for skill_name in "${AGENT_CONTROL_PLANE_SKILL_NAME:-agent-control-plane}" "${AGENT_CONTROL_PLANE_COMPAT_ALIAS:-}"; do
-      [[ -n "${skill_name}" ]] || continue
-      candidate="${SHARED_AGENT_HOME}/skills/openclaw/${skill_name}/tools/bin/flow-shell-lib.sh"
-      if [[ -f "${candidate}" ]]; then
-        printf '%s\n' "${candidate}"
-        return 0
-      fi
-    done
+RECONCILE_BOOTSTRAP_LIB=""
+for _rbl_candidate in \
+  "${SCRIPT_DIR}/reconcile-bootstrap-lib.sh" \
+  "${AGENT_CONTROL_PLANE_ROOT:-}/tools/bin/reconcile-bootstrap-lib.sh" \
+  "${ACP_ROOT:-}/tools/bin/reconcile-bootstrap-lib.sh" \
+  "${SHARED_AGENT_HOME:-}/tools/bin/reconcile-bootstrap-lib.sh"; do
+  if [[ -n "${_rbl_candidate}" && -f "${_rbl_candidate}" ]]; then
+    RECONCILE_BOOTSTRAP_LIB="${_rbl_candidate}"
+    break
   fi
-
-  echo "unable to locate flow-shell-lib.sh for reconcile bootstrap" >&2
-  return 1
-}
-
-FLOW_SHELL_LIB_PATH="$(bootstrap_flow_shell_lib)"
-BOOTSTRAP_TOOLS_DIR="$(cd "$(dirname "${FLOW_SHELL_LIB_PATH}")" && pwd)"
-# shellcheck source=/dev/null
-source "${FLOW_SHELL_LIB_PATH}"
-
-resolve_reconcile_tools_dir() {
-  local candidate_root=""
-  local skill_name=""
-
-  for candidate_root in \
-    "${AGENT_CONTROL_PLANE_ROOT:-}" \
-    "${ACP_ROOT:-}" \
-    "${F_LOSNING_FLOW_ROOT:-}" \
-    "${AGENT_FLOW_SKILL_ROOT:-}"; do
-    if [[ -n "${candidate_root}" && -d "${candidate_root}/tools/bin" ]]; then
-      printf '%s/tools/bin\n' "${candidate_root}"
-      return 0
+done
+if [[ -n "${SHARED_AGENT_HOME:-}" && -z "${RECONCILE_BOOTSTRAP_LIB}" ]]; then
+  for _rbl_skill in "${AGENT_CONTROL_PLANE_SKILL_NAME:-agent-control-plane}" "${AGENT_CONTROL_PLANE_COMPAT_ALIAS:-}"; do
+    [[ -n "${_rbl_skill}" ]] || continue
+    _rbl_candidate="${SHARED_AGENT_HOME}/skills/openclaw/${_rbl_skill}/tools/bin/reconcile-bootstrap-lib.sh"
+    if [[ -f "${_rbl_candidate}" ]]; then
+      RECONCILE_BOOTSTRAP_LIB="${_rbl_candidate}"
+      break
     fi
   done
-
-  if [[ -n "${SHARED_AGENT_HOME:-}" ]]; then
-    if [[ -d "${SHARED_AGENT_HOME}/tools/bin" ]]; then
-      printf '%s/tools/bin\n' "${SHARED_AGENT_HOME}"
-      return 0
-    fi
-    for skill_name in "${AGENT_CONTROL_PLANE_SKILL_NAME:-agent-control-plane}" "${AGENT_CONTROL_PLANE_COMPAT_ALIAS:-}"; do
-      [[ -n "${skill_name}" ]] || continue
-      candidate_root="${SHARED_AGENT_HOME}/skills/openclaw/${skill_name}"
-      if [[ -d "${candidate_root}/tools/bin" ]]; then
-        printf '%s/tools/bin\n' "${candidate_root}"
-        return 0
-      fi
-    done
-  fi
-
-  if [[ -d "${SCRIPT_DIR}" ]]; then
-    printf '%s\n' "${SCRIPT_DIR}"
-    return 0
-  fi
-
-  printf '%s\n' "${BOOTSTRAP_TOOLS_DIR}"
-}
+fi
+if [[ -z "${RECONCILE_BOOTSTRAP_LIB}" ]]; then
+  echo "unable to locate reconcile-bootstrap-lib.sh" >&2
+  exit 1
+fi
+# shellcheck source=/dev/null
+source "${RECONCILE_BOOTSTRAP_LIB}"
 
 usage() {
   cat <<'EOF'
@@ -89,28 +40,6 @@ allowing project adapters to inject policy hooks.
 EOF
 }
 
-shared_tools_dir="$(resolve_reconcile_tools_dir)"
-resolve_reconcile_helper_path() {
-  local helper_name="${1:?helper name required}"
-  local candidate=""
-
-  for candidate in \
-    "${SCRIPT_DIR}/${helper_name}" \
-    "${BOOTSTRAP_TOOLS_DIR}/${helper_name}" \
-    "${shared_tools_dir}/${helper_name}"; do
-    if [[ -n "${candidate}" && -f "${candidate}" ]]; then
-      printf '%s\n' "${candidate}"
-      return 0
-    fi
-  done
-
-  echo "unable to locate ${helper_name} for reconcile bootstrap" >&2
-  return 1
-}
-
-FLOW_CONFIG_LIB_PATH="$(resolve_reconcile_helper_path "flow-config-lib.sh")"
-# shellcheck source=/dev/null
-source "${FLOW_CONFIG_LIB_PATH}"
 verification_guard_script="${shared_tools_dir}/branch-verification-guard.sh"
 session=""
 repo_slug=""
@@ -222,6 +151,9 @@ if [[ -n "$hook_file" && -f "$hook_file" ]]; then
 fi
 
 provider_cooldown_script="${shared_tools_dir}/provider-cooldown-state.sh"
+github_core_rate_limit_script="${shared_tools_dir}/github-core-rate-limit-state.sh"
+github_write_outbox_script="${shared_tools_dir}/github-write-outbox.sh"
+automated_pr_approval_body="Automated final review passed. Safe low-risk scope, green checks, and host-side merge approved."
 
 schedule_provider_quota_cooldown() {
   local reason="${1:-provider-quota-limit}"
@@ -243,6 +175,26 @@ blocked_runtime_reason=""
 host_github_rate_limited="no"
 host_github_rate_limit_detail=""
 
+host_github_rate_limit_state_active() {
+  local state_out=""
+  local ready=""
+  local next_attempt_at=""
+
+  [[ -x "${github_core_rate_limit_script}" ]] || return 1
+  state_out="$("${github_core_rate_limit_script}" get 2>/dev/null || true)"
+  ready="$(awk -F= '/^READY=/{print $2; exit}' <<<"${state_out}")"
+  [[ "${ready}" == "no" ]] || return 1
+
+  next_attempt_at="$(awk -F= '/^NEXT_ATTEMPT_AT=/{print $2; exit}' <<<"${state_out}")"
+  host_github_rate_limited="yes"
+  if [[ -n "${next_attempt_at}" ]]; then
+    host_github_rate_limit_detail="GitHub core API rate limit cooldown is active and resets at ${next_attempt_at}."
+  else
+    host_github_rate_limit_detail="GitHub core API rate limit cooldown is active."
+  fi
+  return 0
+}
+
 owner="${repo_slug%%/*}"
 repo="${repo_slug#*/}"
 pr_view_json="$(flow_github_pr_view_json "$repo_slug" "$pr_number")"
@@ -257,6 +209,40 @@ if [[ "$status" == "RUNNING" && "$pr_state" != "MERGED" && "$pr_state" != "CLOSE
   exit 0
 fi
 
+cleanup_output_value() {
+  local cleanup_output="${1:-}"
+  local key="${2:?key required}"
+  awk -F= -v target_key="${key}" '$1 == target_key { print substr($0, index($0, "=") + 1); exit }' <<<"${cleanup_output}"
+}
+
+warn_cleanup_pr_session() {
+  local cleanup_output="${1:-}"
+  local cleanup_exit="${2:-0}"
+  local cleanup_status=""
+  local cleanup_mode=""
+  local cleanup_error=""
+
+  cleanup_status="$(cleanup_output_value "${cleanup_output}" "CLEANUP_STATUS")"
+  if [[ -z "${cleanup_status}" ]]; then
+    cleanup_status="${cleanup_exit}"
+  fi
+  [[ "${cleanup_status}" != "0" ]] || return 0
+
+  cleanup_mode="$(cleanup_output_value "${cleanup_output}" "CLEANUP_MODE")"
+  cleanup_error="$(cleanup_output_value "${cleanup_output}" "CLEANUP_ERROR")"
+  printf '[%s] pr cleanup warning session=%s status=%s mode=%s\n' \
+    "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+    "${session}" \
+    "${cleanup_status}" \
+    "${cleanup_mode:-unknown}" >&2
+  if [[ -n "${cleanup_error}" ]]; then
+    printf '[%s] pr cleanup detail session=%s %s\n' \
+      "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+      "${session}" \
+      "${cleanup_error}" >&2
+  fi
+}
+
 review_pass_action_from_result_action() {
   case "${1:-}" in
     host-advance-double-check-2)
@@ -402,9 +388,27 @@ post_pr_comment_if_present() {
   if pr_comment_already_posted; then
     return 0
   fi
-  if ! host_github_post_issue_comment "${pr_number}" "$(cat "$comment_file")"; then
-    return 1
+  if host_github_post_issue_comment "${pr_number}" "$(cat "$comment_file")"; then
+    return 0
   fi
+  if [[ -x "${github_write_outbox_script}" ]]; then
+    if "${github_write_outbox_script}" enqueue-comment \
+      --repo-slug "${repo_slug}" \
+      --number "${pr_number}" \
+      --kind pr \
+      --body-file "${comment_file}" >/dev/null 2>&1; then
+      return 0
+    fi
+  fi
+  return 1
+}
+
+enqueue_pr_approval_intent() {
+  [[ -x "${github_write_outbox_script}" ]] || return 1
+  "${github_write_outbox_script}" enqueue-approval \
+    --repo-slug "${repo_slug}" \
+    --number "${pr_number}" \
+    --body "${automated_pr_approval_body}" >/dev/null 2>&1
 }
 
 pr_comment_already_posted() {
@@ -427,6 +431,9 @@ record_host_github_rate_limit() {
   host_github_rate_limited="yes"
   host_github_rate_limit_detail="${output}"
   printf '%s\n' "${output}" >"${detail_file}"
+  if [[ -x "${github_core_rate_limit_script}" ]]; then
+    "${github_core_rate_limit_script}" schedule "github-api-rate-limit" >/dev/null 2>&1 || true
+  fi
 }
 
 host_github_post_issue_comment() {
@@ -434,9 +441,13 @@ host_github_post_issue_comment() {
   local body="${2:-}"
   local output=""
 
+  if host_github_rate_limit_state_active; then
+    return 1
+  fi
+
   flow_export_github_cli_auth_env "${repo_slug}"
   if output="$(
-    gh api "repos/${repo_slug}/issues/${issue_number}/comments" \
+    flow_github_api_repo "${repo_slug}" "issues/${issue_number}/comments" \
       --method POST \
       -f body="${body}" 2>&1
   )"; then
@@ -455,23 +466,25 @@ host_github_post_issue_comment() {
 host_github_submit_pr_approval() {
   local output=""
 
+  if host_github_rate_limit_state_active; then
+    enqueue_pr_approval_intent || true
+    return 1
+  fi
+
   flow_export_github_cli_auth_env "${repo_slug}"
   if output="$(
-    gh api "repos/${repo_slug}/pulls/${pr_number}/reviews" \
-      --method POST \
-      -f event=APPROVE \
-      -f body="Automated final review passed. Safe low-risk scope, green checks, and host-side merge approved." \
-      2>&1
+    flow_github_pr_review_approve "${repo_slug}" "${pr_number}" "${automated_pr_approval_body}" 2>&1
   )"; then
     return 0
   fi
 
-  if grep -q "Can not approve your own pull request" <<<"${output}"; then
+  if grep -q "Can not approve your own pull request" <<<"${output}" || grep -q "approve your own pull is not allowed" <<<"${output}"; then
     return 0
   fi
 
   if host_github_output_indicates_rate_limit "${output}"; then
     record_host_github_rate_limit "${output}"
+    enqueue_pr_approval_intent || true
     return 1
   fi
 
@@ -684,15 +697,6 @@ attempt_blocked_pr_host_verification_recovery() {
   return 0
 }
 
-require_transition() {
-  local step="${1:?step required}"
-  shift
-  if ! "$@"; then
-    echo "reconcile transition failed: ${step}" >&2
-    exit 1
-  fi
-}
-
 close_linked_issue_if_open() {
   local issue_id="${1:-}"
   [[ -n "$issue_id" ]] || return 0
@@ -889,13 +893,21 @@ merge_state_prepared() {
 }
 
 current_github_login() {
+  if host_github_rate_limit_state_active; then
+    printf '\n'
+    return 0
+  fi
   flow_export_github_cli_auth_env "${repo_slug}"
-  gh api user --jq '.login // ""' 2>/dev/null || true
+  flow_github_current_login
 }
 
 pr_author_login() {
+  if host_github_rate_limit_state_active; then
+    printf '\n'
+    return 0
+  fi
   flow_export_github_cli_auth_env "${repo_slug}"
-  gh pr view "${pr_number}" -R "${repo_slug}" --json author --jq '.author.login // ""' 2>/dev/null || true
+  flow_github_pr_author_login "${repo_slug}" "${pr_number}"
 }
 
 pr_is_self_authored_for_current_actor() {
@@ -908,8 +920,12 @@ pr_is_self_authored_for_current_actor() {
 }
 
 pr_remote_head_oid() {
+  if host_github_rate_limit_state_active; then
+    printf '\n'
+    return 0
+  fi
   flow_export_github_cli_auth_env "${repo_slug}"
-  gh pr view "${pr_number}" -R "${repo_slug}" --json headRefOid --jq '.headRefOid // ""' 2>/dev/null || true
+  flow_github_pr_head_oid "${repo_slug}" "${pr_number}"
 }
 
 pr_remote_already_has_final_head() {
@@ -931,39 +947,46 @@ approve_and_merge() {
     fi
   fi
 
+  if host_github_rate_limit_state_active; then
+    return 2
+  fi
+
   flow_export_github_cli_auth_env "${repo_slug}"
-  if ! gh pr merge "${pr_number}" -R "${repo_slug}" --squash --delete-branch --admin >"${run_dir}/host-github-merge.out" 2>"${run_dir}/host-github-merge.err"; then
-    local merge_output=""
-    merge_output="$(cat "${run_dir}/host-github-merge.err" 2>/dev/null || true)"
-    if host_github_output_indicates_rate_limit "${merge_output}"; then
-      record_host_github_rate_limit "${merge_output}"
-      return 2
-    fi
-    if flow_github_pr_merge "$repo_slug" "$pr_number" "squash" "yes" 2>"${run_dir}/host-github-merge.err"; then
-      return 0
-    fi
-    merge_output="$(cat "${run_dir}/host-github-merge.err" 2>/dev/null || true)"
-    if host_github_output_indicates_rate_limit "${merge_output}"; then
-      record_host_github_rate_limit "${merge_output}"
-      return 2
-    fi
-    if [[ -n "${merge_output}" ]]; then
-      printf '%s\n' "${merge_output}" >&2
-    fi
-    return 1
+  if flow_github_pr_merge "$repo_slug" "$pr_number" "squash" "yes" >"${run_dir}/host-github-merge.out" 2>"${run_dir}/host-github-merge.err"; then
+    return 0
   fi
 
-  return 0
+  local merge_output=""
+  merge_output="$(cat "${run_dir}/host-github-merge.err" 2>/dev/null || true)"
+  if host_github_output_indicates_rate_limit "${merge_output}"; then
+    record_host_github_rate_limit "${merge_output}"
+    return 2
+  fi
+  if [[ -n "${merge_output}" ]]; then
+    printf '%s\n' "${merge_output}" >&2
+  fi
+  return 1
 }
 
 cleanup_pr_session() {
-  "${shared_tools_dir}/agent-project-cleanup-session" \
-    --repo-root "$repo_root" \
-    --runs-root "$runs_root" \
-    --history-root "$history_root" \
-    --session "$session" \
-    --worktree "$pr_worktree" \
-    --mode pr >/dev/null || true
+  local cleanup_output=""
+  local cleanup_exit="0"
+
+  if cleanup_output="$(
+    "${shared_tools_dir}/agent-project-cleanup-session" \
+      --repo-root "$repo_root" \
+      --runs-root "$runs_root" \
+      --history-root "$history_root" \
+      --session "$session" \
+      --worktree "$pr_worktree" \
+      --mode pr 2>&1
+  )"; then
+    cleanup_exit="0"
+  else
+    cleanup_exit="$?"
+  fi
+
+  warn_cleanup_pr_session "${cleanup_output}" "${cleanup_exit}"
 }
 
 notify_pr_reconciled() {