jonah-fleet 1.6.0 → 1.9.0

package/templates/prompts/peer-review.md

@@ -8,7 +8,7 @@ Review a pull request (in Targeted mode for a specific `$PR_NUMBER`, or in Scan
 
 Before reading further, before any tool call, and before deciding the mode, check the environment variable `$PR_NUMBER`.
 
-- **$PR_NUMBER is set → Targeted mode.** The value of `$PR_NUMBER` is your target PR. You may also check `$PR_URL`. Skip all selection logic.
+- **$PR_NUMBER is set → Targeted mode.** The value of `$PR_NUMBER`is your target PR. You may also check`$PR_URL`. Skip all selection logic.
 - **$PR_NUMBER is not set → Scan mode.** Only then select a PR by priority.
 
 **Targeted mode is sticky: it can never fall back to Scan mode.** Once the invocation contains a PR reference, you must review exactly that PR. If you cannot act on it (closed/merged/missing), STOP and log FAILURE.
@@ -19,7 +19,7 @@ The run is SUCCESS only if ALL of these are true:
 
 - [ ] Identified the target PR: if one was named in the invocation, reviewed exactly that PR; otherwise listed open PRs and selected one by priority
 - [ ] Ran the code-review pass (`/code-review` and security pass), and posted findings as inline review comments
-- [ ] Took exactly one final action: squash-merged (if PR is good, CI green and present; executed Autonomous Issue Synthesis if unlinked) OR posted findings and **converted the PR back to draft** (`gh pr ready <N> --undo`) for author/autowork in-session fixes OR, if round cap reached at round 5 with blocking findings, converted to draft and escalated to human
+- [ ] Took exactly one final action: squash-merged (if PR is good, CI green and present; executed Autonomous Issue Synthesis if unlinked; closed tracking issue explicitly if referenced) OR posted findings and **converted the PR back to draft** (`gh pr ready <N> --undo`) for author/autowork in-session fixes OR, if round cap reached at round 5 with blocking findings, converted to draft and escalated to human
 - [ ] If merging: captured deferred non-blocking findings per materiality bar (filed follow-up issues for material ones, batched or dropped immaterial ones)
 - [ ] If in Scan mode and no eligible PRs exist, logged SUCCESS with "No PRs to review"
 
@@ -37,8 +37,9 @@ If any criterion cannot be met, stop immediately and log FAILURE with the reason
 ## Final action: merge or bounce to draft
 
 Every review ends in exactly one of two states:
+
 - **Merge** — only if PR is good, CI is green and verified on the head commit. If the PR does not reference a tracked issue (`Closes #N`), execute Autonomous Issue Synthesis prior to merge.
-  - Sequence: (1) if unlinked, synthesize tracking issue (`gh issue create`) and link to PR (`gh pr edit`), (2) squash-merge, (3) submit held review comments, (4) file follow-up issues for deferred material findings.
+  - Sequence: (1) if unlinked, synthesize tracking issue (`gh issue create`) and link to PR (`gh pr edit`), (2) squash-merge (`gh pr merge <N> --squash --delete-branch`), (3) explicitly close tracking issue if referenced (`gh issue close <ISSUE_NUMBER>`), (4) submit held review comments, (5) file follow-up issues for deferred material findings.
   - Immaterial findings (style/preference) default to dying in the review thread or getting batched.
   - Mechanical doc fixes (missing changelog line, doc typo in diff) can be committed directly to `main` after squash-merge.
 - **Bounce to draft** — if any **blocking** finding remains (correctness bug, security flaw, failing/missing CI, broken contract):
@@ -63,12 +64,13 @@ Every review ends in exactly one of two states:
 ### Step 0: Determine the target PR (do this FIRST)
 
 Check if `$PR_NUMBER` is set:
+
 - **$PR_NUMBER is set → Targeted mode.** Review that exact PR. Skip selection steps 1–2.
 - **$PR_NUMBER is not set → Scan mode.** Proceed to steps 1–2.
 
 ### Steps 1–2: Select a PR (Scan mode only)
 
-1. List all open PRs, excluding drafts, pure log PRs (`.github/prompts/logs/**`), and automated release PRs (`release-please--*` / `chore(main): release*`).
+1. List all open PRs, excluding drafts and automated release PRs (`release-please--*` / `chore(main): release*`).
 2. **Dual Execution Priority Routing**:
    - If running in **Cloud Actions** (`$GITHUB_ACTIONS` / `$CI`): Scan mode prioritizes PRs labeled `priority/P0` or `priority/P1` (or untagged PRs). Lower-priority PRs (`priority/P2`, `priority/P3`) are eligible for cloud review ONLY if they have remained ready and unreviewed for more than 48 hours (`created_at` older than 48h, acting as a cloud catchup sweep).
    - If running in **Local Agent** (`$LOCAL_AGENT`): Scan mode reviews any ready PR across all priorities (P0 → P1 → P2 → P3) with no age gating.
@@ -78,8 +80,21 @@ Check if `$PR_NUMBER` is set:
 
 ### Step 3: Round tracking & Starting Review marker
 
-- Post a "Starting review (round N)" comment on the target PR to claim the review window.
+- Post a "Starting review (round N)" comment on the target PR to claim the review window:
+  - If `$ROUTINE_ISSUE_NUMBER` is set in the environment or routine prompt, include a link to the tracking log issue:
+    `Starting review (round N) · [Run Log #$ROUTINE_ISSUE_NUMBER](${GITHUB_SERVER_URL:-https://github.com}/${GITHUB_REPOSITORY}/issues/${ROUTINE_ISSUE_NUMBER})`
+    (or `Starting review (round N) · Run log: #$ROUTINE_ISSUE_NUMBER`).
+  - If `$ROUTINE_ISSUE_NUMBER` is not set, post `Starting review (round N)`.
 - Check round count `N`. If `N >= 5` and blocking findings persist, prepare to escalate.
+- **Milestone 1 (Intake & Review Scope)**: If `$ROUTINE_ISSUE_NUMBER` is set, emit milestone card to the routine issue thread:
+  ```bash
+  gh issue comment "$ROUTINE_ISSUE_NUMBER" --body "### 🧭 Milestone: Intake & Review Scope
+- **Phase**: \`Phase 1 · Review Target & Scope\`
+- **Status**: ⏳ In Progress
+- **Target / Context**: \`PR #<PR_NUMBER> (Round N)\`
+- **Key Decision / Finding**: Claimed review window; starting multi-angle evaluation passes.
+- **Next**: Multi-Angle Code Review Pass" || true
+  ```
 
 ### Step 4: Multi-Angle Code Review Pass
 
@@ -98,12 +113,14 @@ Check if `$PR_NUMBER` is set:
 ### Step 5: Classify Findings & Make Decision
 
 Classify each finding:
+
 - **Blocking**: Broken logic, security hole, data loss, regression, broken tests, missing deliverable from the issue/PR specification.
 - **Non-blocking**: Minor refactor, style preference, performance micro-optimization, missing `Closes #N` on contributor PRs with self-contained descriptions.
 
 ### Step 5.5: Autonomous Issue Synthesis (for unlinked PRs)
 
 If the PR is clean and approved for merge, but lacks a `Closes #N` tracking link:
+
 1. Synthesize a retroactive tracking issue on GitHub:
    ```bash
    gh issue create --title "<PR Title>" --body "Tracked retroactively from external pull request #<PR_NUMBER>.\n\n## Deliverables & Context\n<PR Description>\n\n_Synthesized autonomously by Jonah Fleet Peer Review_"
@@ -120,17 +137,35 @@ If the PR is clean and approved for merge, but lacks a `Closes #N` tracking link
   - If `N < 5`: Post inline comments, submit review as `COMMENT`, and convert PR to draft (`gh pr ready <N> --undo`).
   - If `N >= 5`: Convert PR to draft, post summary comment escalating to repo maintainer, and apply `needs-human` label.
 - **If Clean (or only Non-blocking findings)**:
+  - If the PR branch has minor mechanical merge conflicts against `origin/main` (e.g. adjacent `CHANGELOG.md` entries from concurrent merges) while code and tests are sound, resolve the conflict mechanically via `/resolving-merge-conflicts` before squash-merging rather than bouncing the PR back to draft.
   - If PR lacks `Closes #N`, execute Autonomous Issue Synthesis (Step 5.5).
+  - Extract the tracking issue number `$ISSUE_NUMBER` from the PR description or title (e.g. `Closes #<N>`, `Fixes #<N>`, `Resolves #<N>`).
   - Squash-merge the PR: `gh pr merge <N> --squash --delete-branch`.
+  - **Explicit Tracking Issue Closure Guardrail**: If a tracking issue was referenced (`$ISSUE_NUMBER`), explicitly close it immediately after merge rather than relying solely on GitHub's native keyword parser (which often fails to trigger on bot-merged squash commits or draft PRs):
+    ```bash
+    gh issue close "$ISSUE_NUMBER" --comment "Closed via PR #<N> (merged into main)."
+    ```
   - Submit held review comments.
+  - In any review summary, decision comment, or escalation comment posted to the PR, include the run log reference if `$ROUTINE_ISSUE_NUMBER` is set (e.g. `- **Run Log**: [#$ROUTINE_ISSUE_NUMBER](${GITHUB_SERVER_URL:-https://github.com}/${GITHUB_REPOSITORY}/issues/${ROUTINE_ISSUE_NUMBER})`).
   - File follow-up issues for material non-blocking findings.
   - If mechanical doc fixes are needed, commit directly to `main`.
 
 ## Logging
 
-After completing (SUCCESS or FAILURE), write a log file to `.github/prompts/logs/peer-review/{timestamp}.md` following the schema in `.github/prompts/logs/_template.md`. Include:
+After completing (SUCCESS or FAILURE), record run execution details to `.jonah-fleet/run-report.md`. Include:
+
 - Prompt SHA
 - Target PR number and decision (MERGE / BOUNCE / ESCALATE)
 - Execution trace and findings summary
 
-**Important**: Commit the log file directly to `main` and push. Follow the Log delivery fallback in `ORCHESTRATION.md` if direct push fails.
+**Issue Logging Protocol**:
+- **Milestone 4 (Run Completed)**: If `$ROUTINE_ISSUE_NUMBER` is set, emit compact milestone card to close out the comment stream:
+  ```bash
+  gh issue comment "$ROUTINE_ISSUE_NUMBER" --body "### 🏁 Milestone: Run Completed
+- **Phase**: \`Phase 4 · Reconciliation\`
+- **Status**: ✅ SUCCESS
+- **Target / Context**: \`PR #<PR_NUMBER>\`
+- **Key Decision / Finding**: Review completed with decision \`<MERGE | BOUNCE | ESCALATE>\`.
+- **Next**: Routine finished; issue closed by harness" || true
+  ```
+- Follow the Routine Issue Logging & Telemetry Protocol in `ORCHESTRATION.md`. Never commit run logs to git branches.

package/templates/prompts/product-planning.md

@@ -11,8 +11,8 @@ This routine runs behind a **human approval gate**: it **never files autowork-re
 This routine runs in two modes: **Propose** (scheduled cron sweep / unapproved fire) and **Promote** (operator-approved fire).
 
 In **Propose mode**, SUCCESS requires:
-- [ ] Read current roadmap, domain documentation, closed measurement trackers, and recent feedback/analytics findings
-- [ ] Performed Feature Pruning & Deprecation Audit: evaluated shipped features and measurement outcomes for low-ROI (<2% user adoption or >50% failure rate) features, drafting deprecation, removal, or simplification proposals
+- [ ] Read current roadmap, domain documentation, closed measurement trackers, recent feedback/analytics findings, and the latest open `🎨 Design Review` issue / recent design-review routine run issues
+- [ ] Performed Feature Pruning & Deprecation Audit: evaluated shipped features, measurement outcomes (<2% user adoption or >50% failure rate), and Design Review pruning/clutter directives, drafting deprecation, removal, or simplification proposals
 - [ ] Created or updated exactly one dated staging issue (`🗺️ Product Plan — {date}`) containing:
   - Up to 3 well-scoped proposals (Summary/Tasks/Why/Complexity), covering additions, pivots, or deprecations
   - Backlog re-ranking recommendations
@@ -51,10 +51,10 @@ If any criterion cannot be met, stop immediately and log FAILURE with the reason
 
 ### Steps 1–3: Propose Mode (Staging Proposals)
 
-1. Read `ROADMAP.md`, `AGENTS.md`, closed measurement trackers with `RECOMMENDATION: [PIVOT | DEPRECATE | ITERATE]`, and open issues.
+1. Read `ROADMAP.md`, `AGENTS.md`, closed measurement trackers with `RECOMMENDATION: [PIVOT | DEPRECATE | ITERATE]`, the latest open `🎨 Design Review` issue (and recent run issues with `gh issue list --label "routine:design-review"`), and open issues.
 2. **Feature Pruning & Deprecation Audit**:
-   - Audit shipped features and closed measurement tracker verdicts.
-   - For any feature with <2% user adoption, sub-threshold CTR, or >50% failure rate, draft explicit deprecation, removal, or pivot proposals to keep the codebase lean and eliminate maintenance waste.
+   - Audit shipped features, closed measurement tracker verdicts, and `🎨 Design Review` clutter/pruning findings.
+   - For any feature with <2% user adoption, sub-threshold CTR, >50% failure rate, or persistent UI clutter flagged by Design Review, draft explicit deprecation, removal, or pivot proposals to keep the codebase lean and eliminate maintenance waste.
 3. Draft up to 3 high-impact proposals (including additions, pivots, or deprecations) based on roadmap priorities, measurement outcomes, and user feedback.
 4. For proposals sized `size/M` or above, draft a formal specification using `/to-spec`.
 5. Stage all proposals in a dedicated staging issue: `🗺️ Product Plan — {YYYY-MM-DD}` assigned to the repo maintainer.
@@ -70,9 +70,13 @@ If any criterion cannot be met, stop immediately and log FAILURE with the reason
 
 ## Logging
 
-After completing (SUCCESS or FAILURE), write a log file to `.github/prompts/logs/product-planning/{timestamp}.md` following the schema in `.github/prompts/logs/_template.md`. Include:
-- Prompt SHA
-- Mode (Propose or Promote)
-- Staged or promoted proposals tally
+Follow the Routine Issue Logging Protocol in `ORCHESTRATION.md`:
+1. Write the final run report to `.jonah-fleet/run-report.md`.
+2. Include the Run Summary table with:
+   - Routine: `product-planning`
+   - Mode: `Propose` or `Promote`
+   - Result: `SUCCESS` or `FAILURE`
+   - Prompt SHA: (run `git rev-parse --short HEAD:.github/prompts/product-planning.md` or template)
+   - Staged or promoted proposals tally
+3. The surrounding execution harness will reconcile the corresponding GitHub issue.
 
-**Important**: Commit the log file directly to `main` and push. Follow the Log delivery fallback in `ORCHESTRATION.md` if direct push fails.

package/templates/workflows/autowork-cron.yml

@@ -24,7 +24,7 @@ concurrency:
 jobs:
   run-autowork:
     runs-on: ubuntu-latest
-    timeout-minutes: 65
+    timeout-minutes: 70
     permissions:
       contents: write
       issues: write
@@ -37,7 +37,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.GH_PAT || github.token }}
-
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -45,10 +45,13 @@ jobs:
           node-version: 22
 
       - name: Configure Git author identity
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
         run: |
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          gh auth setup-git
 
       - name: Cache Antigravity CLI
         id: cache-agy
@@ -105,6 +108,74 @@ jobs:
           fi
           echo "skills_prompt=$SKILLS_PROMPT" >> "$GITHUB_OUTPUT"
 
+      - name: Resolve routine configuration
+        id: routine-config
+        run: |
+          ROUTINE="autowork"
+          DEFAULT_MODEL="gemini-3.8-flash-high"
+          DEFAULT_TIMEOUT="60"
+
+          MODEL="$DEFAULT_MODEL"
+          TIMEOUT="$DEFAULT_TIMEOUT"
+
+          if [ -f "agents-manifest.json" ]; then
+            CONFIG_JSON=$(node -e '
+              try {
+                const fs = require("fs");
+                const m = JSON.parse(fs.readFileSync("agents-manifest.json", "utf8"));
+                const r = process.argv[1];
+                const model = m.models?.[r] || m.models?.default;
+                const timeout = m.budgets?.timeoutMinutes?.[r] || m.budgets?.timeoutMinutes?.default;
+                console.log(JSON.stringify({ model: model || "", timeout: timeout ? String(timeout) : "" }));
+              } catch (e) {
+                console.log(JSON.stringify({ model: "", timeout: "" }));
+              }
+            ' "$ROUTINE")
+
+            RESOLVED_MODEL=$(node -e "try { console.log(JSON.parse(process.argv[1]).model || ''); } catch {}" "$CONFIG_JSON")
+            RESOLVED_TIMEOUT=$(node -e "try { console.log(JSON.parse(process.argv[1]).timeout || ''); } catch {}" "$CONFIG_JSON")
+
+            if [ -n "$RESOLVED_MODEL" ]; then
+              MODEL="$RESOLVED_MODEL"
+            fi
+            if [ -n "$RESOLVED_TIMEOUT" ]; then
+              TIMEOUT="$RESOLVED_TIMEOUT"
+            fi
+          fi
+
+          echo "model=$MODEL" >> "$GITHUB_OUTPUT"
+          echo "print_timeout=${TIMEOUT}m" >> "$GITHUB_OUTPUT"
+          echo "Resolved routine configuration: model=$MODEL, timeout=${TIMEOUT}m"
+
+      - name: Initialize Routine Run Issue
+        id: run-issue
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          TARGET_ARG: ${{ inputs.target_issue || inputs.issue_number }}
+          EVENT_NAME: ${{ github.event_name }}
+          RUN_ID: ${{ github.run_id }}
+          SERVER_URL: ${{ github.server_url }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          TIMESTAMP=$(date -u +"%Y-%m-%dT%H-%M-%SZ")
+          if [ -n "$TARGET_ARG" ]; then
+            TITLE="[autowork] run ${TIMESTAMP} (Issue #${TARGET_ARG})"
+          else
+            TITLE="[autowork] run ${TIMESTAMP}"
+          fi
+          BODY="### Autonomous Routine Execution in Progress
+          - **Routine**: \`autowork\`
+          - **Timestamp**: \`${TIMESTAMP}\`
+          - **Trigger**: \`${EVENT_NAME}\`
+          - **Run ID**: [\`${RUN_ID}\`](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})
+
+          ---
+          _Generated by [Antigravity](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})_"
+          ISSUE_URL=$(gh issue create --title "$TITLE" --body "$BODY" --label "routine-log,routine:autowork,status:running,runner:github-actions")
+          ISSUE_NUMBER=$(echo "$ISSUE_URL" | grep -oE '[0-9]+$')
+          echo "issue_number=$ISSUE_NUMBER" >> "$GITHUB_OUTPUT"
+          echo "ROUTINE_ISSUE_NUMBER=$ISSUE_NUMBER" >> "$GITHUB_ENV"
+
       - name: Run Autowork
         timeout-minutes: 60
         env:
@@ -113,7 +184,10 @@ jobs:
           ANTIGRAVITY_API_KEY: ${{ secrets.GEMINI_API_KEY }}
           GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
           TARGET_ISSUE: ${{ inputs.target_issue || inputs.issue_number }}
+          ROUTINE_ISSUE_NUMBER: ${{ steps.run-issue.outputs.issue_number }}
           SKILLS_PROMPT: ${{ steps.skills.outputs.skills_prompt }}
+          MODEL: ${{ steps.routine-config.outputs.model || 'gemini-3.8-flash-high' }}
+          PRINT_TIMEOUT: ${{ steps.routine-config.outputs.print_timeout || '60m' }}
           GITHUB_SERVER_URL: ${{ github.server_url }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_RUN_ID: ${{ github.run_id }}
@@ -125,17 +199,17 @@ jobs:
           fi
 
           agy -p "$PROMPT" \
-            --model gemini-3.7-flash-high \
+            --model "$MODEL" \
             --output-format text \
-            --print-timeout 60m \
+            --print-timeout "$PRINT_TIMEOUT" \
             --dangerously-skip-permissions
 
       - name: Emit run summary
         if: always()
         run: |
-          LATEST_LOG=$(ls -t .github/prompts/logs/autowork/*.md 2>/dev/null | head -n 1)
-          if [ -n "$LATEST_LOG" ] && [ -n "$GITHUB_STEP_SUMMARY" ]; then
-            cat "$LATEST_LOG" >> "$GITHUB_STEP_SUMMARY"
+          REPORT_FILE=".jonah-fleet/run-report.md"
+          if [ -f "$REPORT_FILE" ] && [ -n "$GITHUB_STEP_SUMMARY" ]; then
+            cat "$REPORT_FILE" >> "$GITHUB_STEP_SUMMARY"
           fi
 
       - name: Emit Fleet Telemetry (Opt-in)
@@ -147,9 +221,9 @@ jobs:
           GITHUB_RUN_ID: ${{ github.run_id }}
           GITHUB_RUN_NUMBER: ${{ github.run_number }}
         run: |
-          LATEST_LOG=$(ls -t .github/prompts/logs/autowork/*.md 2>/dev/null | head -n 1)
-          if [ -n "$LATEST_LOG" ] && [ -f "$LATEST_LOG" ]; then
-            npx --yes jonah-fleet telemetry --emit --log "$LATEST_LOG" --endpoint "$TELEMETRY_ENDPOINT" || true
+          REPORT_FILE=".jonah-fleet/run-report.md"
+          if [ -f "$REPORT_FILE" ]; then
+            npx --yes jonah-fleet telemetry --emit --log "$REPORT_FILE" --endpoint "$TELEMETRY_ENDPOINT" || true
           fi
 
       - name: Verify Atomic Handoff Invariant (PR Existence Guard)
@@ -157,10 +231,10 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          LATEST_LOG=$(ls -t .github/prompts/logs/autowork/*.md 2>/dev/null | head -n 1)
-          if [ -n "$LATEST_LOG" ]; then
-            if grep -q "Result.*SUCCESS" "$LATEST_LOG"; then
-              WORKED_BRANCH=$(grep -E '^\s*-\s*(Pushed branch|Branch):' "$LATEST_LOG" | head -n 1 | sed -E 's/.*`([^`]+)`.*/\1/')
+          REPORT_FILE=".jonah-fleet/run-report.md"
+          if [ -f "$REPORT_FILE" ]; then
+            if grep -q "Result.*SUCCESS" "$REPORT_FILE"; then
+              WORKED_BRANCH=$(grep -E '^\s*-\s*(Pushed branch|Branch):' "$REPORT_FILE" | head -n 1 | sed -E 's/.*`([^`]+)`.*/\1/')
               if [ -n "$WORKED_BRANCH" ] && [[ "$WORKED_BRANCH" =~ (feat|fix)/ ]]; then
                 echo "Verifying PR existence for branch: $WORKED_BRANCH"
                 PR_COUNT=$(gh pr list --head "$WORKED_BRANCH" --state all --json number --jq 'length' 2>/dev/null || echo "0")
@@ -173,33 +247,58 @@ jobs:
             fi
           fi
 
-      - name: Commit and push run log directly to main
+      - name: Reconcile Routine Run Issue
         if: always()
         env:
           GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          ISSUE_NUMBER: ${{ steps.run-issue.outputs.issue_number }}
+          JOB_STATUS: ${{ job.status }}
+          EVENT_NAME: ${{ github.event_name }}
+          RUN_ID: ${{ github.run_id }}
+          SERVER_URL: ${{ github.server_url }}
+          REPOSITORY: ${{ github.repository }}
         run: |
-          LATEST_LOG=$(ls -t .github/prompts/logs/autowork/*.md 2>/dev/null | head -n 1)
-          if [ -n "$LATEST_LOG" ] && [ -f "$LATEST_LOG" ]; then
-            TMP_LOG_FILE=$(mktemp)
-            cp "$LATEST_LOG" "$TMP_LOG_FILE"
-            LOG_REL_PATH="$LATEST_LOG"
-            LOG_NAME=$(basename "$LATEST_LOG" .md)
-
-            git fetch origin main:main || git fetch origin main || true
-            git checkout main || git checkout -B main origin/main || true
-
-            mkdir -p "$(dirname "$LOG_REL_PATH")"
-            cp "$TMP_LOG_FILE" "$LOG_REL_PATH"
-            rm -f "$TMP_LOG_FILE"
-
-            git add "$LOG_REL_PATH"
-            if ! git diff --cached --quiet; then
-              git commit -m "docs(log): record autowork run ${LOG_NAME} [skip ci]" || true
-              if [ -n "$GH_TOKEN" ]; then
-                git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" main || git push origin main || true
-              else
-                git push origin main || true
-              fi
-            fi
+          if [ -z "$ISSUE_NUMBER" ]; then
+            echo "No routine issue to reconcile."
+            exit 0
+          fi
+
+          REPORT_FILE=".jonah-fleet/run-report.md"
+
+          if [ -f "$REPORT_FILE" ]; then
+            BODY_CONTENT=$(cat "$REPORT_FILE")
+          else
+            BODY_CONTENT="### Autonomous Routine Execution Completed (${JOB_STATUS})
+          - **Routine**: \`autowork\`
+          - **Run ID**: [\`${RUN_ID}\`](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})
+          - **Trigger**: \`${EVENT_NAME}\`"
+          fi
+
+          FINAL_BODY="${BODY_CONTENT}
+
+          ---
+          _Generated by [Antigravity](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})_"
+
+          TEMP_BODY=$(mktemp)
+          echo "$FINAL_BODY" > "$TEMP_BODY"
+          gh issue edit "$ISSUE_NUMBER" --body-file "$TEMP_BODY"
+          rm -f "$TEMP_BODY"
+
+          if [ "$JOB_STATUS" = "success" ]; then
+            gh issue edit "$ISSUE_NUMBER" --add-label "status:success" --remove-label "status:running"
+            gh issue close "$ISSUE_NUMBER" --reason completed
+            echo "✓ Routine run issue #$ISSUE_NUMBER closed as completed."
+          else
+            INTERRUPTION_BODY="### ❌ Milestone: Run Interrupted / Failed
+- **Routine**: \`autowork\`
+- **Status**: Workflow job failed or timed out (\`${JOB_STATUS}\`)
+- **Step**: Actions execution halted before normal completion
+- **Action Log**: [View GitHub Actions Run](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})
+
+---
+_Generated by [Antigravity](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})_"
+            gh issue comment "$ISSUE_NUMBER" --body "$INTERRUPTION_BODY" || true
+            gh issue edit "$ISSUE_NUMBER" --add-label "status:failure,needs-attention" --remove-label "status:running"
+            echo "⚠️ Routine run issue #$ISSUE_NUMBER left open for triage (status: $JOB_STATUS)."
           fi
 

package/templates/workflows/dependency-check-cron.yml

@@ -25,6 +25,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -32,10 +33,13 @@ jobs:
           node-version: 22
 
       - name: Configure Git author identity
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
         run: |
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          gh auth setup-git
 
       - name: Cache Antigravity CLI
         id: cache-agy
@@ -65,6 +69,69 @@ jobs:
           printf '%s' "$ANTIGRAVITY_OAUTH_TOKEN" > "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
           chmod 600 "$HOME/.gemini/antigravity-cli/antigravity-oauth-token"
 
+      - name: Resolve routine configuration
+        id: routine-config
+        run: |
+          ROUTINE="dependency-update-security-check"
+          DEFAULT_MODEL="gemini-3.8-flash-medium"
+          DEFAULT_TIMEOUT="25"
+
+          MODEL="$DEFAULT_MODEL"
+          TIMEOUT="$DEFAULT_TIMEOUT"
+
+          if [ -f "agents-manifest.json" ]; then
+            CONFIG_JSON=$(node -e '
+              try {
+                const fs = require("fs");
+                const m = JSON.parse(fs.readFileSync("agents-manifest.json", "utf8"));
+                const r = process.argv[1];
+                const model = m.models?.[r] || m.models?.default;
+                const timeout = m.budgets?.timeoutMinutes?.[r] || m.budgets?.timeoutMinutes?.default;
+                console.log(JSON.stringify({ model: model || "", timeout: timeout ? String(timeout) : "" }));
+              } catch (e) {
+                console.log(JSON.stringify({ model: "", timeout: "" }));
+              }
+            ' "$ROUTINE")
+
+            RESOLVED_MODEL=$(node -e "try { console.log(JSON.parse(process.argv[1]).model || ''); } catch {}" "$CONFIG_JSON")
+            RESOLVED_TIMEOUT=$(node -e "try { console.log(JSON.parse(process.argv[1]).timeout || ''); } catch {}" "$CONFIG_JSON")
+
+            if [ -n "$RESOLVED_MODEL" ]; then
+              MODEL="$RESOLVED_MODEL"
+            fi
+            if [ -n "$RESOLVED_TIMEOUT" ]; then
+              TIMEOUT="$RESOLVED_TIMEOUT"
+            fi
+          fi
+
+          echo "model=$MODEL" >> "$GITHUB_OUTPUT"
+          echo "print_timeout=${TIMEOUT}m" >> "$GITHUB_OUTPUT"
+          echo "Resolved routine configuration: model=$MODEL, timeout=${TIMEOUT}m"
+
+      - name: Initialize Routine Run Issue
+        id: run-issue
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          RUN_ID: ${{ github.run_id }}
+          SERVER_URL: ${{ github.server_url }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          TIMESTAMP=$(date -u +"%Y-%m-%dT%H-%M-%SZ")
+          TITLE="[dependency-check] run ${TIMESTAMP}"
+          BODY="### Autonomous Routine Execution in Progress
+          - **Routine**: \`dependency-update-security-check\`
+          - **Timestamp**: \`${TIMESTAMP}\`
+          - **Trigger**: \`${EVENT_NAME}\`
+          - **Run ID**: [\`${RUN_ID}\`](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})
+
+          ---
+          _Generated by [Antigravity](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})_"
+          ISSUE_URL=$(gh issue create --title "$TITLE" --body "$BODY" --label "routine-log,routine:dependency-check,status:running,runner:github-actions")
+          ISSUE_NUMBER=$(echo "$ISSUE_URL" | grep -oE '[0-9]+$')
+          echo "issue_number=$ISSUE_NUMBER" >> "$GITHUB_OUTPUT"
+          echo "ROUTINE_ISSUE_NUMBER=$ISSUE_NUMBER" >> "$GITHUB_ENV"
+
       - name: Run Dependency Update Check
         timeout-minutes: 25
         env:
@@ -72,6 +139,9 @@ jobs:
           GOOGLE_API_KEY: ${{ secrets.GEMINI_API_KEY }}
           ANTIGRAVITY_API_KEY: ${{ secrets.GEMINI_API_KEY }}
           GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          ROUTINE_ISSUE_NUMBER: ${{ steps.run-issue.outputs.issue_number }}
+          MODEL: ${{ steps.routine-config.outputs.model || 'gemini-3.8-flash-medium' }}
+          PRINT_TIMEOUT: ${{ steps.routine-config.outputs.print_timeout || '25m' }}
           GITHUB_SERVER_URL: ${{ github.server_url }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_RUN_ID: ${{ github.run_id }}
@@ -79,7 +149,62 @@ jobs:
           PROMPT="You are the Dependency Update & Security Check routine. Read and follow .github/prompts/dependency-update-security-check.md exactly. Check dependencies for updates and vulnerabilities, and create or update tracking issues."
 
           agy -p "$PROMPT" \
-            --model gemini-3.7-flash-high \
+            --model "$MODEL" \
             --output-format text \
-            --print-timeout 25m \
+            --print-timeout "$PRINT_TIMEOUT" \
             --dangerously-skip-permissions
+
+      - name: Reconcile Routine Run Issue
+        if: always()
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          ISSUE_NUMBER: ${{ steps.run-issue.outputs.issue_number }}
+          JOB_STATUS: ${{ job.status }}
+          EVENT_NAME: ${{ github.event_name }}
+          RUN_ID: ${{ github.run_id }}
+          SERVER_URL: ${{ github.server_url }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          if [ -z "$ISSUE_NUMBER" ]; then
+            echo "No routine issue to reconcile."
+            exit 0
+          fi
+
+          REPORT_FILE=".jonah-fleet/run-report.md"
+
+          if [ -f "$REPORT_FILE" ]; then
+            BODY_CONTENT=$(cat "$REPORT_FILE")
+          else
+            BODY_CONTENT="### Autonomous Routine Execution Completed (${JOB_STATUS})
+          - **Routine**: \`dependency-update-security-check\`
+          - **Run ID**: [\`${RUN_ID}\`](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})
+          - **Trigger**: \`${EVENT_NAME}\`"
+          fi
+
+          FINAL_BODY="${BODY_CONTENT}
+
+          ---
+          _Generated by [Antigravity](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})_"
+
+          TEMP_BODY=$(mktemp)
+          echo "$FINAL_BODY" > "$TEMP_BODY"
+          gh issue edit "$ISSUE_NUMBER" --body-file "$TEMP_BODY"
+          rm -f "$TEMP_BODY"
+
+          if [ "$JOB_STATUS" = "success" ]; then
+            gh issue edit "$ISSUE_NUMBER" --add-label "status:success" --remove-label "status:running"
+            gh issue close "$ISSUE_NUMBER" --reason completed
+            echo "✓ Routine run issue #$ISSUE_NUMBER closed as completed."
+          else
+            INTERRUPTION_BODY="### ❌ Milestone: Run Interrupted / Failed
+- **Routine**: \`dependency-check\`
+- **Status**: Workflow job failed or timed out (\`${JOB_STATUS}\`)
+- **Step**: Actions execution halted before normal completion
+- **Action Log**: [View GitHub Actions Run](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})
+
+---
+_Generated by [Antigravity](${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID})_"
+            gh issue comment "$ISSUE_NUMBER" --body "$INTERRUPTION_BODY" || true
+            gh issue edit "$ISSUE_NUMBER" --add-label "status:failure,needs-attention" --remove-label "status:running"
+            echo "⚠️ Routine run issue #$ISSUE_NUMBER left open for triage (status: $JOB_STATUS)."
+          fi