agtag 0.1.3__tar.gz

agtag-0.1.3/.claude/skills/cicd/SKILL.md

@@ -0,0 +1,164 @@
+---
+name: cicd
+description: >
+  agtag's CI/CD lane: open PR (auto-wait for Qodo/Copilot), push fixes
+  (re-poll bots), triage feedback, reply, resolve. Adds a portability lint
+  (no absolute /home paths, no per-user dotfile refs in committed docs),
+  an alignment-delta check when CLAUDE.md or culture.yaml change, and
+  greenfield-aware test/version-bump steps. Use when: creating PRs in
+  agtag, handling review feedback, polling CI status, or the user says
+  "create PR", "review comments", "address feedback", "resolve threads".
+  Vendored from steward (renamed from `pr-review` in steward 0.7.0).
+---
+
+# CI/CD — agtag edition (vendored from steward)
+
+agtag's PRs touch agent prompts, `culture.yaml` configs, and cross-project
+guidance once they begin landing. The generic `pr-review` skills don't know
+that, so they miss two classes of bugs the AgentCulture stack keeps
+producing in PRs of this shape:
+
+- **Path leaks** — committing absolute home-directory paths that work only on
+  the author's machine.
+- **Per-user config dependencies** — referencing a dotfile under the user's
+  home directory in repo guidance, breaking reproducibility for other
+  contributors and CI.
+
+This skill specializes Culture's `pr-review` flow to catch both up front, plus
+an alignment-delta step when agtag-affecting files (`CLAUDE.md`,
+`culture.yaml`, vendored skills) change. The workflow is
+encapsulated in `scripts/workflow.sh` — follow that, not a manual checklist.
+
+## Prerequisites
+
+Hard requirements: `gh` (GitHub CLI), `jq`, `bash`, `python3` (stdlib only),
+`curl` (used by `pr-status.sh`).
+
+Soft requirement: `PyYAML` is needed **only for suffix mode** of the sibling
+`agent-config` skill, where it parses Culture's server manifest. Path mode
+and every `cicd` script work without it. If suffix mode runs without
+PyYAML it exits with a clear install hint.
+
+Per-machine paths (sibling-project layout) live in
+`.claude/skills.local.yaml`; see the committed `.example` for the schema.
+
+## How to run
+
+`scripts/workflow.sh` is the entry point. Subcommands:
+
+| Command | Purpose |
+|---------|---------|
+| `workflow.sh lint` | Portability lint on the current diff (staged + unstaged). |
+| `workflow.sh open-pr --title T [--body-file F] [--wait SECS] [...]` | `gh pr create` then sleep 180s (or `--wait SECS`) and fetch reviewer comments in one shot. Use after pushing the initial branch. |
+| `workflow.sh poll <PR>` | Fetch and display all review comments. |
+| `workflow.sh poll-readiness <PR> [--max-iters N] [--interval SECS] [--require LIST]` | Loop until all required reviewers are ready (default `qodo`; pass `--require qodo,copilot` to also gate on Copilot) — or the PR closes / iteration cap hits. Headline on stdout, per-iteration diagnostics on stderr. Direct wrapper around `scripts/poll-readiness.sh`. |
+| `workflow.sh wait-after-push <PR> [--wait SECS]` | Sleep 180s (or `--wait SECS`) then re-fetch comments. Use after pushing fixes. |
+| `workflow.sh await <PR>` | Poll for reviewer readiness (default: 30 × 60s ≈ 30 min cap, requires qodo only; tune with `STEWARD_PR_AWAIT_ITERS`, `STEWARD_PR_AWAIT_INTERVAL`, and `STEWARD_PR_REVIEWERS`), then run `pr-status.sh` (CI checks + SonarCloud quality gate, OPEN issues, hotspots) and `pr-comments.sh` (inline / issue / top-level / SonarCloud-new-issues sections). Exits non-zero on SonarCloud `ERROR` or unresolved threads. Setting the legacy `STEWARD_PR_AWAIT_SECONDS=<n>` falls back to a fixed sleep with a deprecation warning. |
+| `workflow.sh delta` | Dump each sibling project's `CLAUDE.md` head + `culture.yaml`. |
+| `workflow.sh reply <PR>` | Batch reply (JSONL on stdin) and resolve threads. |
+| `workflow.sh help` | Print this list. |
+
+The vendored single-comment helpers — `pr-reply.sh`, `pr-status.sh` — live
+next to `workflow.sh` and are usable directly when batching isn't appropriate.
+
+## Polling for reviewer readiness
+
+`scripts/poll-readiness.sh` watches a PR until its required reviewers post
+real (not placeholder) feedback, the PR closes, or an iteration cap fires.
+It fetches `gh api` JSON directly — never `pr-comments.sh` output — so
+truncation can't bias the gate. Default required set is qodo only
+(see header comments and `--help` for tunables, env vars, and the `qodo` /
+`copilot` heuristics; Copilot is detected but not required because its
+review bot is silent on agentculture repos in 2026). Heartbeats stream to
+stderr; the final headline is the only thing on stdout.
+
+Two ways to drive it:
+
+- **Synchronous** — `workflow.sh await <PR>` after `gh pr create`. The
+  main session burns context during the wait; fine up to ~5 minutes.
+- **Asynchronous** — for longer waits, run the looper inside a background
+  subagent (Agent tool, `run_in_background: true`) so the main session
+  only pays the cache cost when readiness fires. The subagent's only job
+  is to invoke `poll-readiness.sh` and echo its headline back. The
+  parent triages with `workflow.sh await <PR>` when the notification
+  arrives. The user can interrupt with TaskStop.
+
+This pattern is borrowed from sibling repo
+[`agentculture/cfafi`](https://github.com/agentculture/cfafi)'s `poll`
+skill — Steward vendors only the looper here rather than promoting `poll`
+to its own first-class skill until other Steward verbs need the same
+primitive.
+
+## End-to-end flow
+
+```text
+git checkout -b <type>/<desc>
+# ... edit ...
+.claude/skills/cicd/scripts/workflow.sh lint
+git commit -am "..." && git push -u origin <branch>
+gh pr create --title "..." --body "..."   # title <70 chars, body signed "- <nick> (Claude)"
+.claude/skills/cicd/scripts/workflow.sh await <PR>   # readiness loop, then CI + SonarCloud + all comments
+# triage; if CLAUDE.md/culture.yaml/.claude/skills changed:
+.claude/skills/cicd/scripts/workflow.sh delta
+# fix, re-lint, push
+.claude/skills/cicd/scripts/workflow.sh reply <PR> < replies.jsonl
+gh pr checks <PR>
+# Wait for human merge — never merge yourself.
+```
+
+Branch naming: `fix/<desc>`, `feat/<desc>`, `docs/<desc>`, `skill/<name>`.
+PR / comment signature: `- <nick> (Claude)`, where `<nick>` comes from
+the agent's own `culture.yaml` — first agent's `suffix` — falling back
+to the git-repo basename when no `culture.yaml` is present. The reply
+script resolves this via `scripts/_resolve-nick.sh` and auto-appends the
+signature only when the body isn't already signed, so JSONL reply
+entries can include or omit it. Hand-rolled `gh pr create` and
+`gh issue comment` calls should follow the same convention.
+
+## Triage rules
+
+For every comment, decide **FIX** or **PUSHBACK** with reasoning.
+
+Default to **FIX** for: portability complaints (always valid for AgentCulture
+repos — recurring bug class), test or doc requests, style nits aligned with
+workspace conventions.
+
+Default to **PUSHBACK** for: architecture opinions that conflict with workspace
+`CLAUDE.md` or the all-backends rule; greenfield false-positives (e.g. "add
+tests" before there's any source — defer to a later PR, don't refuse).
+
+### Alignment-delta rule
+
+If the PR touches `CLAUDE.md`, `culture.yaml`, or anything under
+`.claude/skills/`, run `workflow.sh delta` **before** declaring FIX or
+PUSHBACK on each comment. The script dumps the head of every sibling
+project's `CLAUDE.md` plus the full `culture.yaml`, using `sibling_projects`
+from `skills.local.yaml`. Note any sibling that needs a follow-up PR and
+mention it in your reply.
+
+## Greenfield-aware steps
+
+The lint and the workflow script are always-on. Stack-specific steps are
+conditional and currently no-op (greenfield repo):
+
+```bash
+[ -d tests ] && [ -f pyproject.toml ] && uv run pytest tests/ -x -q
+[ -f pyproject.toml ] && bump_version_per_project_convention   # see project README
+[ -f .markdownlint-cli2.yaml ] && markdownlint-cli2 "$(git diff --name-only --cached '*.md')"
+```
+
+Revisit each line as the corresponding stack element actually lands.
+
+## Reply etiquette
+
+Every comment must get a reply — no silent fixes. Always pass `--resolve`
+when batch-replying so threads close automatically. Reference the
+review-comment IDs in the fix-up commit message.
+
+SonarCloud is queried in two places: `pr-status.sh` (quality gate, OPEN
+issues, hotspots) and the Section-4 dump in `pr-comments.sh` (new-issue
+list). Both derive the project key as `<owner>_<repo>`; override with
+`SONAR_PROJECT_KEY=<key>` for non-standard naming, and they silently skip
+when the project isn't on SonarCloud. agtag isn't yet a registered mesh
+agent, so the post-merge IRC ping that Culture's `pr-review` includes is
+still skipped — that returns when agtag joins the mesh.

agtag-0.1.3/.claude/skills/cicd/scripts/_resolve-nick.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Resolve the agent's nick for GitHub message signing.
+# Order: first agent's `suffix` in <repo-root>/culture.yaml,
+# then basename of the git repo root.
+# Prints the nick to stdout. Always exits 0 — pr-reply.sh needs *some*
+# nick to sign with — but if a culture.yaml exists and we couldn't
+# extract a suffix from it, emits a stderr warning so a misconfigured
+# manifest doesn't silently mask itself behind the basename fallback.
+
+repo_root="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [[ -z "$repo_root" ]]; then
+    repo_root="$PWD"
+fi
+
+manifest="$repo_root/culture.yaml"
+
+if [[ -f "$manifest" ]]; then
+    if ! command -v python3 >/dev/null 2>&1; then
+        echo "_resolve-nick: python3 not found; cannot parse $manifest, falling back to repo basename" >&2
+    else
+        nick="$(python3 - "$manifest" <<'PY' 2>/dev/null || true
+import re, sys
+path = sys.argv[1]
+with open(path, encoding="utf-8") as f:
+    for raw in f:
+        line = raw.rstrip("\n")
+        m = re.match(r"^[\s-]*\s*suffix:\s*(\S+)", line)
+        if m:
+            print(m.group(1).strip("'\""))
+            break
+PY
+)"
+        if [[ -n "$nick" ]]; then
+            printf '%s\n' "$nick"
+            exit 0
+        fi
+        echo "_resolve-nick: $manifest exists but no suffix could be parsed; falling back to repo basename" >&2
+    fi
+fi
+
+basename "$repo_root"

agtag-0.1.3/.claude/skills/cicd/scripts/create-pr-and-wait.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Create a PR, wait for automated reviewers (qodo, copilot, sonarcloud) to
+# post comments, then dump the feedback. Wraps the manual `gh pr create →
+# sleep 300 → pr-comments.sh` sequence into one invocation.
+#
+# Usage:
+#   create-pr-and-wait.sh --title "Title" --body-file PATH [--wait SECS] [extra gh pr create flags...]
+#   create-pr-and-wait.sh --title "Title" [--wait SECS] [extra gh pr create flags...] < body-on-stdin
+#
+# Flags:
+#   --title TITLE     PR title (required)
+#   --body-file PATH  Read the body from a file. If omitted, reads stdin.
+#   --wait SECS       How long to sleep after `gh pr create` before fetching
+#                     comments. Default: 180 (3 min). qodo/copilot/sonarcloud
+#                     usually post within this window. Use `wait-and-check.sh`
+#                     to extend by another 3 min if reviewers haven't finished.
+#   Any other flags pass through to `gh pr create` (e.g. --base, --reviewer).
+#
+# Behavior:
+#   1. Stage the body to a tempfile and `gh pr create --body-file …` so
+#      large self-contained briefs don't hit the OS argv length limit.
+#   2. `sleep $WAIT_SECS` to give reviewers time to post.
+#   3. Run the sibling `pr-comments.sh <PR_NUMBER>` (vendored next to this
+#      script) to dump inline + issue + review comments.
+#
+# Exit codes:
+#   0  PR created and feedback fetched (no judgment about whether feedback
+#      is clean — caller decides what to do with it).
+#   2  Bad usage (missing --title, or no body source on a TTY).
+#   3  Could not parse PR number from `gh pr create` output.
+#   *  Whatever `gh pr create` or the comment-fetch step returns.
+
+usage() {
+    echo "Usage: create-pr-and-wait.sh --title TITLE [--body-file PATH | < stdin] [--wait SECS] [gh pr create flags...]" >&2
+    exit 2
+}
+
+require_value() {
+    if [[ $# -lt 2 ]]; then
+        echo "Missing value for $1" >&2
+        usage
+    fi
+}
+
+WAIT_SECS=180
+TITLE=""
+BODY_FILE=""
+PASSTHROUGH=()
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --title)      require_value "$@"; TITLE="$2"; shift 2 ;;
+        --body-file)  require_value "$@"; BODY_FILE="$2"; shift 2 ;;
+        --wait)       require_value "$@"; WAIT_SECS="$2"; shift 2 ;;
+        -h|--help)    usage ;;
+        *) PASSTHROUGH+=("$1"); shift ;;
+    esac
+done
+
+if [[ -z "$TITLE" ]]; then
+    usage
+fi
+
+# Stage the body to a tempfile and pass `--body-file` to gh. Large
+# self-contained briefs can otherwise hit the OS argv length limit
+# (~128 KB) when passed via `--body "$BODY"`.
+TMP_BODY=$(mktemp -t cicd-create-pr-body.XXXXXX)
+trap 'rm -f "$TMP_BODY"' EXIT
+
+if [[ -n "$BODY_FILE" ]]; then
+    cat "$BODY_FILE" > "$TMP_BODY"
+elif [[ ! -t 0 ]]; then
+    cat > "$TMP_BODY"
+else
+    echo "No --body-file given and stdin is a TTY — refusing to hang on cat." >&2
+    echo "Pass --body-file PATH or pipe the body in." >&2
+    exit 2
+fi
+
+# Step 1: create the PR
+PR_URL=$(gh pr create --title "$TITLE" --body-file "$TMP_BODY" "${PASSTHROUGH[@]}")
+echo "Created: $PR_URL"
+
+PR_NUM=$(echo "$PR_URL" | grep -oE '[0-9]+$' || true)
+if [[ -z "$PR_NUM" ]]; then
+    echo "Could not parse PR number from gh pr create output: $PR_URL" >&2
+    exit 3
+fi
+
+# Step 2: wait for reviewers
+echo "Waiting ${WAIT_SECS}s for automated reviewers (qodo, copilot, sonarcloud)..."
+sleep "$WAIT_SECS"
+
+# Step 3: dump feedback. The cicd skill always vendors pr-comments.sh
+# next to this script — no per-user $HOME fallback (would violate the
+# skills-portability rule).
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+bash "$SCRIPT_DIR/pr-comments.sh" "$PR_NUM"

agtag-0.1.3/.claude/skills/cicd/scripts/poll-readiness.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# poll-readiness.sh — wait until both automated PR reviewers (qodo + Copilot)
+# have posted their full reviews, OR the PR is merged/closed, OR an iteration
+# cap is hit.
+#
+# Designed to be invoked two ways:
+#   (a) Synchronously by `workflow.sh await` (stdin/stdout local to the
+#       caller — main session burns context during the wait).
+#   (b) Asynchronously by a background subagent (Agent tool with
+#       run_in_background:true). The subagent owns the wait so the main
+#       session pays the cache cost only once, at completion.
+#
+# Usage:
+#   poll-readiness.sh [--repo OWNER/REPO] [--max-iters N] [--interval SECS]
+#                     [--require LIST] PR_NUMBER
+#
+# Defaults: --max-iters 30, --interval 60, --require qodo  (≈30-minute hard cap)
+#
+# --require accepts a comma-separated subset of {qodo,copilot}; the loop
+# exits 0 only when every listed reviewer is "ready" (or PR state flips
+# to MERGED/CLOSED). Override the default via STEWARD_PR_REVIEWERS=...
+# Copilot is *not* required by default — its automated PR-review bot
+# stopped posting top-level reviews on agentculture repos in 2026, so
+# requiring it would cause every wait to TIMEOUT. Re-add `--require
+# qodo,copilot` if Copilot starts posting again.
+#
+# Exit codes:
+#   0  All required reviewers ready, OR PR state is MERGED / CLOSED.
+#   1  TIMEOUT after --max-iters with at least one required reviewer pending.
+#   2  Bad usage.
+#
+# Output:
+#   stdout — final headline (≤10 lines), suitable for capture.
+#   stderr — per-iteration diagnostics ("still waiting (qodo: …, copilot: …)").
+#
+# Detection heuristics (mirror cfafi's `poll` skill):
+#   qodo ready    = ISSUE COMMENTS section contains "Code Review by Qodo"
+#                   AND does NOT contain "Looking for bugs?" (qodo's
+#                   "still analysing" placeholder).
+#   Copilot ready = TOP-LEVEL REVIEWS header reports a count > 0.
+#
+# Dependencies: gh, jq, bash, curl  (same as the rest of the skill).
+
+usage() {
+    cat >&2 <<'EOF'
+Usage: poll-readiness.sh [--repo OWNER/REPO] [--max-iters N] [--interval SECS]
+                         [--require LIST] PR_NUMBER
+
+Defaults: --max-iters 30, --interval 60, --require qodo
+  (set STEWARD_PR_REVIEWERS to override the default --require list)
+
+--require LIST  comma-separated subset of {qodo,copilot}. Exit 0 only
+                when every listed reviewer is ready, or PR closes.
+                Copilot is not required by default — its bot stopped
+                posting top-level reviews on agentculture repos in 2026.
+
+Exit 0 when all required reviewers ready (or PR closed),
+exit 1 on TIMEOUT, exit 2 on bad usage.
+EOF
+    exit 2
+}
+
+require_value() {
+    if [[ $# -lt 2 ]]; then
+        echo "Missing value for $1" >&2
+        usage
+    fi
+}
+
+REPO=""
+MAX_ITERS=30
+INTERVAL=60
+PR_NUMBER=""
+REQUIRE="${STEWARD_PR_REVIEWERS:-qodo}"
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --repo)       require_value "$@"; REPO="$2"; shift 2 ;;
+        --max-iters)  require_value "$@"; MAX_ITERS="$2"; shift 2 ;;
+        --interval)   require_value "$@"; INTERVAL="$2"; shift 2 ;;
+        --require)    require_value "$@"; REQUIRE="$2"; shift 2 ;;
+        -h|--help)    usage ;;
+        --) shift; break ;;
+        -*) echo "Unknown flag: $1" >&2; usage ;;
+        *)  PR_NUMBER="$1"; shift ;;
+    esac
+done
+
+[[ -z "$PR_NUMBER" ]] && usage
+[[ "$PR_NUMBER" =~ ^[0-9]+$ ]] || { echo "PR_NUMBER must be a positive integer" >&2; exit 2; }
+[[ "$MAX_ITERS" =~ ^[0-9]+$ ]] || { echo "--max-iters must be a positive integer" >&2; exit 2; }
+[[ "$INTERVAL"  =~ ^[0-9]+$ ]] || { echo "--interval must be a positive integer"  >&2; exit 2; }
+
+# Parse --require into REQUIRE_QODO / REQUIRE_COPILOT booleans. Reject
+# unknown reviewers so a typo (e.g. "qoda") doesn't silently make the
+# loop exit on iteration 1.
+REQUIRE_QODO=0
+REQUIRE_COPILOT=0
+IFS=',' read -ra _REQ <<<"$REQUIRE"
+for r in "${_REQ[@]}"; do
+    r="${r// /}"
+    case "$r" in
+        ""|qodo)   REQUIRE_QODO=1 ;;
+        copilot)   REQUIRE_COPILOT=1 ;;
+        *) echo "--require: unknown reviewer '$r' (valid: qodo, copilot)" >&2; exit 2 ;;
+    esac
+done
+if [[ $REQUIRE_QODO -eq 0 && $REQUIRE_COPILOT -eq 0 ]]; then
+    echo "--require: at least one reviewer must be required" >&2
+    exit 2
+fi
+
+if [[ -z "$REPO" ]]; then
+    REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PR_URL="https://github.com/${REPO}/pull/${PR_NUMBER}"
+
+emit_headline() {
+    # $1 final state, $2 qodo status, $3 copilot status, $4 iter count, $5 next-step hint
+    cat <<EOF
+PR URL:        ${PR_URL}
+Final state:   $1
+qodo:          $2
+Copilot:       $3
+Iterations:    $4 / ${MAX_ITERS}
+Next step:     $5
+EOF
+}
+
+iter=0
+qodo_status="not-posted"
+copilot_status="not-posted"
+
+while (( iter < MAX_ITERS )); do
+    iter=$((iter + 1))
+
+    # 1. Short-circuit on closed/merged.
+    pr_state=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json state -q .state 2>/dev/null || echo "UNKNOWN")
+    if [[ "$pr_state" == "MERGED" || "$pr_state" == "CLOSED" ]]; then
+        emit_headline "$pr_state" "$qodo_status" "$copilot_status" "$iter" \
+            "PR was ${pr_state,,} before reviewers finished — no triage needed."
+        exit 0
+    fi
+
+    # 2. Fetch raw, untruncated bodies directly from the GitHub API.
+    #    Reasoning: pr-comments.sh truncates comment bodies for human display,
+    #    so its output isn't a reliable input for readiness logic — a long
+    #    qodo comment can have its "Code Review by Qodo" marker fall past the
+    #    truncation, and a stale "Looking for bugs?" placeholder elsewhere in
+    #    the dump can flip a real review back to "placeholder-only". Using
+    #    `gh api` here also avoids the SonarCloud round-trip pr-comments.sh
+    #    now does on every iteration (qodo PR #17 review, perf bug).
+    issue_json=$(gh api "repos/$REPO/issues/$PR_NUMBER/comments" --paginate 2>/dev/null) || {
+        echo "iter ${iter}: gh api issues/comments failed; will retry" >&2
+        sleep "$INTERVAL"
+        continue
+    }
+    reviews_json=$(gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" --paginate 2>/dev/null) || {
+        echo "iter ${iter}: gh api pulls/reviews failed; will retry" >&2
+        sleep "$INTERVAL"
+        continue
+    }
+
+    # 3. qodo readiness — match the structural <h3>Code Review by Qodo</h3>
+    #    header, which appears only in the done-state body. Cfafi's bare-text
+    #    heuristic ("contains 'Code Review by Qodo' AND NOT 'Looking for
+    #    bugs?'") false-positives when qodo's done review *quotes* either
+    #    string while reporting bugs about polling code (PR #17 hit this).
+    #    The placeholder comment uses a different layout (no <h3> wrapper),
+    #    so the H3 marker alone is enough.
+    qodo_real=$(echo "$issue_json" | jq '[
+        .[] | select(.user.login == "qodo-code-review[bot]")
+            | select(.body | contains("<h3>Code Review by Qodo</h3>"))
+    ] | length')
+    qodo_any=$(echo "$issue_json" | jq '[
+        .[] | select(.user.login == "qodo-code-review[bot]")
+    ] | length')
+    if (( qodo_real > 0 )); then
+        qodo_status="ready"
+    elif (( qodo_any > 0 )); then
+        qodo_status="placeholder-only"
+    else
+        qodo_status="not-posted"
+    fi
+
+    # 4. Copilot readiness — at least one top-level review with a non-empty
+    #    body. Excludes "review whose only content is inline comments".
+    copilot_count=$(echo "$reviews_json" | jq '[
+        .[] | select((.user.login // "") | startswith("copilot"))
+            | select((.body // "") != "")
+    ] | length')
+    if (( copilot_count > 0 )); then
+        copilot_status="ready"
+    else
+        copilot_status="not-posted"
+    fi
+
+    # 5. Done?
+    qodo_ok=1
+    copilot_ok=1
+    [[ $REQUIRE_QODO    -eq 1 && "$qodo_status"    != "ready" ]] && qodo_ok=0
+    [[ $REQUIRE_COPILOT -eq 1 && "$copilot_status" != "ready" ]] && copilot_ok=0
+    if [[ $qodo_ok -eq 1 && $copilot_ok -eq 1 ]]; then
+        emit_headline "OPEN" "$qodo_status" "$copilot_status" "$iter" \
+            "Required reviewers ready (require=${REQUIRE}); run pr-status.sh and triage."
+        exit 0
+    fi
+
+    echo "iter ${iter}/${MAX_ITERS}: qodo=${qodo_status}, copilot=${copilot_status} (require=${REQUIRE}); sleeping ${INTERVAL}s" >&2
+    if (( iter < MAX_ITERS )); then
+        sleep "$INTERVAL"
+    fi
+done
+
+# Fell off the loop — TIMEOUT.
+emit_headline "TIMEOUT" "$qodo_status" "$copilot_status" "$MAX_ITERS" \
+    "Hit ${MAX_ITERS}-iteration cap; re-run poll-readiness.sh or check PR manually."
+exit 1

agtag-0.1.3/.claude/skills/cicd/scripts/portability-lint.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Portability lint: catch path leaks and per-user config dependencies in
+# committed docs/configs before they ship in a PR. Steward's recurring bug
+# class.
+#
+# Usage: portability-lint.sh [--all]
+#   default: lint files modified vs HEAD (staged + unstaged)
+#   --all:   lint all tracked files
+#
+# Exits 0 if clean, 1 if any leak is found.
+
+set -euo pipefail
+
+mode="${1:-diff}"
+case "$mode" in
+    --all) files=$(git ls-files -- ':(exclude)*.lock') ;;
+    diff|--diff) files=$(git diff --diff-filter=AMR --name-only HEAD -- ':(exclude)*.lock') ;;
+    *) echo "Usage: $(basename "$0") [--all]" >&2; exit 2 ;;
+esac
+
+[ -z "$files" ] && { echo "(no files to check)"; exit 0; }
+
+# ----- Check 1: hard-coded /home/<user>/... paths -----
+hits1=$(echo "$files" | xargs -r grep -nE '/home/[a-z][a-z0-9_-]+/' 2>/dev/null || true)
+
+# ----- Check 2: per-user dotfile *config* refs in committed docs/configs -----
+# Carve-outs (allowed, NOT flagged):
+#   - ~/.claude/skills/<x>/scripts/   vendored tool calls
+#   - ~/.culture/                     Culture mesh data this skill is supposed to read
+md_yaml=$(echo "$files" | grep -E '\.(md|ya?ml|toml|json|jsonc)$' || true)
+if [ -n "$md_yaml" ]; then
+    hits2=$(echo "$md_yaml" | xargs -r grep -nE '~/\.[A-Za-z]' 2>/dev/null \
+        | grep -vE '~/\.claude/skills/[^[:space:]"]+/scripts/' \
+        | grep -vE '~/\.culture/' \
+        || true)
+else
+    hits2=""
+fi
+
+fail=0
+if [ -n "$hits1" ]; then
+    echo "❌ Hard-coded /home/<user>/ paths:"
+    echo "$hits1" | sed 's/^/    /'
+    echo "   Fix: use ../sibling, repo URL, or \$WORKSPACE/sibling instead."
+    fail=1
+fi
+if [ -n "$hits2" ]; then
+    [ "$fail" -eq 1 ] && echo
+    echo "❌ Per-user ~/.<dotfile> config refs in committed doc/config:"
+    echo "$hits2" | sed 's/^/    /'
+    echo "   Allowed carve-outs: ~/.claude/skills/.../scripts/ (tool calls), ~/.culture/ (mesh data)."
+    echo "   Otherwise: commit a repo-local config or document a portable lookup."
+    fail=1
+fi
+
+[ "$fail" -eq 0 ] && echo "✓ portability lint clean ($(echo "$files" | wc -l | tr -d ' ') files checked)"
+exit $fail

agtag-0.1.3/.claude/skills/cicd/scripts/pr-batch.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Batch reply to PR review comments from JSONL on stdin.
+# Each line: {"comment_id": 123, "body": "reply text"}
+# Usage: pr-batch.sh [--repo OWNER/REPO] [--resolve] PR_NUMBER < input.jsonl
+
+REPO=""
+RESOLVE=false
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --repo) REPO="$2"; shift 2 ;;
+        --resolve) RESOLVE=true; shift ;;
+        *) break ;;
+    esac
+done
+
+PR_NUMBER="${1:?Usage: pr-batch.sh [--repo OWNER/REPO] [--resolve] PR_NUMBER < input.jsonl}"
+
+if [[ -z "$REPO" ]]; then
+    REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RESOLVE_FLAG=""
+if [[ "$RESOLVE" == true ]]; then
+    RESOLVE_FLAG="--resolve"
+fi
+
+SUCCESS=0
+FAIL=0
+
+while IFS= read -r line; do
+    # Skip empty lines
+    [[ -z "$line" ]] && continue
+
+    COMMENT_ID=$(echo "$line" | jq -r '.comment_id')
+    BODY=$(echo "$line" | jq -r '.body')
+
+    if [[ "$COMMENT_ID" == "null" || "$BODY" == "null" ]]; then
+        echo "SKIP: invalid line: $line"
+        ((FAIL++)) || true
+        continue
+    fi
+
+    echo "--- Comment $COMMENT_ID ---"
+    if bash "$SCRIPT_DIR/pr-reply.sh" --repo "$REPO" $RESOLVE_FLAG "$PR_NUMBER" "$COMMENT_ID" "$BODY"; then
+        ((SUCCESS++)) || true
+    else
+        echo "FAILED: comment $COMMENT_ID"
+        ((FAIL++)) || true
+    fi
+done
+
+echo ""
+echo "Done: $SUCCESS succeeded, $FAIL failed"