gflow-cli 0.59.0__tar.gz → 0.60.0__tar.gz

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.59.0",
+  "version": "0.60.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/.github/workflows/ci.yml

@@ -26,6 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0  # full history so gitleaks can diff against base
 
       - name: Run gitleaks
@@ -39,8 +40,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       - name: Audit locked dependencies for known CVEs
         # Fails the build on any known advisory. Accept later via: pip-audit --ignore-vuln <GHSA-id>
         #
@@ -57,6 +60,42 @@ jobs:
           # dependabot ecosystem — bump by hand when it drifts).
           uvx pip-audit==2.10.1 -r requirements-audit.txt
 
+  # ── Security gate: static analysis of the workflows themselves ───────────
+  # Everything else in this file audits the Python we ship. Nothing audited the
+  # CI that ships it, and CI is a supply-chain surface in its own right: it
+  # holds a repository token, it publishes to PyPI, and its inputs (branch
+  # names, PR titles, fork content) are attacker-controllable text.
+  #
+  # zizmor is what turns that into a gate. It found real defects on its first
+  # run over this repo (#565): 12 checkouts persisting the job token into the
+  # workspace, and `${{ github.base_ref }}` interpolated straight into a
+  # governance-advisory shell script. Both are fixed; this job is what stops
+  # them coming back one copy-pasted step at a time.
+  workflow-audit:
+    name: Workflow audit (zizmor)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+
+      - name: Audit workflows (zizmor)
+        # --offline: the online audits need a GH token and reach the network, so
+        #   they would make this gate non-deterministic and unrunnable on fork
+        #   PRs. Action freshness/pinning is already covered by Dependabot plus
+        #   Scorecard's Pinned-Dependencies check.
+        # --min-severity low: informational findings are advisory, not defects.
+        #   The one open today is `superfluous-actions` on
+        #   softprops/action-gh-release; rewriting the release publisher is not
+        #   a hardening change and is deliberately declined (docs/GITHUB.md).
+        # Version pinned for a reproducible gate — uvx has no Dependabot
+        # ecosystem, so bump it by hand (the pin is asserted by
+        # tests/scripts/test_workflow_hardening.py, which fails if the two drift).
+        run: uvx zizmor==1.29.0 --offline --min-severity low .github/workflows/
+
   # ── Supply-chain gate: resolve WITHOUT the lockfile ───────────────────────
   # Every other job installs via `uv sync`, which honours uv.lock. That means CI
   # never exercises the version RANGES in pyproject.toml — the exact blind spot
@@ -73,9 +112,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Set up Python
         run: uv python install 3.13
@@ -127,18 +168,24 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Set up Python
         run: uv python install ${{ matrix.python-version }}
 
+      # --frozen: install from the committed uv.lock without re-resolving it.
+      # Plain `uv sync` REWRITES uv.lock in place, which would silently repair
+      # the exact version drift the hygiene gate below exists to catch.
       - name: Install deps
-        run: uv sync --extra dev
+        run: uv sync --frozen --extra dev
 
-      - name: Repo hygiene (no artefacts, no hardcoded paths)
-        run: uv run python scripts/ci/check_repo_hygiene.py
+      # --no-sync for the same reason: `uv run` re-locks before running.
+      - name: Repo hygiene (no artefacts, no hardcoded paths, version lockstep)
+        run: uv run --no-sync python scripts/ci/check_repo_hygiene.py
 
       - name: Documentation links
         run: uv run python scripts/ci/check_doc_links.py
@@ -196,9 +243,11 @@ jobs:
         os: [windows-latest, macos-latest, ubuntu-latest]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Set up Python
         run: uv python install 3.13
@@ -237,6 +286,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0  # shallow clones break blame / new-code detection
 
       - name: Download coverage report

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/.github/workflows/deps-watch.yml

@@ -29,9 +29,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Set up Python
         run: uv python install 3.13

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/.github/workflows/external-pr-triage.yml

@@ -1,7 +1,15 @@
 name: External PR Triage
 
+# `pull_request_target` is deliberate and is the reason this file is the
+# highest-risk surface in the repo: labelling a fork's PR needs a token forks
+# cannot be given, and `pull_request` does not have one. The trigger is only
+# unsafe when the workflow CHECKS OUT or EXECUTES the untrusted head — this one
+# never does: there is no `actions/checkout` step at all, every PR field is read
+# from `context.payload` inside github-script, and permissions are scoped to
+# `issues`/`pull-requests` write. Keep all three properties or drop the
+# suppression with them.
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, reopened, synchronize, ready_for_review, edited]
 
 permissions:

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/.github/workflows/governance-advisory.yml

@@ -21,13 +21,21 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0 # full history so `git diff origin/<base>..HEAD` resolves
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Classify touched paths (advisory, never blocks)
+        # BASE_REF arrives through `env:`, never interpolated into the script
+        # body: a branch name is attacker-supplied text, and `${{ ... }}` is
+        # substituted before the shell ever sees it (zizmor: template-injection).
+        # The fetch is belt-and-braces — `fetch-depth: 0` above already brings
+        # the base branch down — and needs no credential on a public repo.
+        env:
+          BASE_REF: ${{ github.base_ref }}
         run: |
-          git fetch --no-tags origin "${{ github.base_ref }}" || true
+          git fetch --no-tags origin "$BASE_REF" || true
           uv run python scripts/ci/check_materiality.py \
-            --base "origin/${{ github.base_ref }}"
+            --base "origin/$BASE_REF"

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/.github/workflows/governance-benchmark.yml

@@ -20,10 +20,11 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0 # full history — the backtest replays every commit
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Run backtest (advisory; writes to job summary)
         run: uv run python scripts/dev/materiality_backtest.py >> "$GITHUB_STEP_SUMMARY"

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/.github/workflows/main-base-guard.yml

@@ -31,6 +31,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Verify release artifacts
         env:
           BASE_REF: ${{ github.base_ref }}

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/.github/workflows/pages.yml

@@ -27,6 +27,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/.github/workflows/release.yml

@@ -25,10 +25,17 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          # This is the one workflow that publishes artefacts (PyPI + GitHub
+          # Release), so it must not restore a cache any other workflow can
+          # write: a poisoned entry would reach a signed release. Releases are
+          # rare; the cold resolve costs seconds (zizmor: cache-poisoning).
+          enable-cache: false
 
       - name: Set up Python
         run: uv python install 3.12

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/.github/workflows/scorecard.yml

@@ -47,6 +47,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
         with:
           sarif_file: results.sarif

gflow_cli-0.60.0/.github/workflows/selector-probe.yml

@@ -0,0 +1,26 @@
+name: Selector drift probe
+
+on:
+  schedule:
+    - cron: "0 5 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: github.repository == 'ffroliva/gflow-cli'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with: { persist-credentials: false }
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - run: uv sync --frozen
+      - run: uv run playwright install chromium --with-deps
+      - name: Probe
+        env:
+          GFLOW_CI_SESSION_TOKEN: ${{ secrets.GFLOW_CI_SESSION_TOKEN }}
+          GFLOW_CI_PROJECT_ID: ${{ secrets.GFLOW_CI_PROJECT_ID }}
+        run: uv run python scripts/probe/run_probe.py --surface editor

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/CHANGELOG.md

@@ -7,6 +7,88 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.60.0] — 2026-08-25
+
+### Added
+
+- **Selector registry + nightly CI drift probe
+  ([#404](https://github.com/ffroliva/gflow-cli/issues/404),
+  [#493](https://github.com/ffroliva/gflow-cli/issues/493),
+  [#313](https://github.com/ffroliva/gflow-cli/issues/313)).** New
+  `gflow_cli.flow_selectors` package: a structured, enumerable inventory of the
+  Flow DOM selectors gflow depends on (`Surface`, `Selector`) plus a pure
+  grader (`HIT` / `FALLBACK` / `AMBIGUOUS` / `MISS` / `EXPECTED_ABSENT`), so
+  selector drift is *named* rather than inferred from a failing test. A $0
+  probe (`scripts/probe/run_probe.py`, driven by the `selector-probe` workflow
+  on `schedule` + `workflow_dispatch` only) walks the registry against a live
+  editor: navigate and read only, never generates. Exit 0 clean / 1 drift /
+  2 inconclusive — an expired token or dead project is never published as
+  drift.
+
+- **Incident bundles record what was submitted
+  ([#528](https://github.com/ffroliva/gflow-cli/issues/528)).**
+  `network.json` gains a `generation_requests` array carrying a counts-only
+  summary of each outgoing generation submit (body size, reference-entity
+  count, reference-field count). The reference shape that triggers a policy 400
+  was previously visible only in the stderr stream, so bundles attached to an
+  issue could not be diagnosed. Counts and booleans only — no key names, field
+  values, or prompt text — matching the existing §5.3 retention boundary.
+
+### Changed
+
+- **All labs.google requests now carry `origin`/`referer`
+  ([#578](https://github.com/ffroliva/gflow-cli/pull/578)).** Header
+  construction moved into a single `_request_headers()` shared by
+  `_post_json`/`_patch_json`/`_get_json`, which previously assembled headers
+  inline three times and could diverge per verb. The labs lane now sends the
+  same `origin`/`referer` every other lane already sent. A live A/B against
+  `project.createProject` showed these headers are **not** required — an
+  origin-less mutation still returns 200 — so this is consistency and
+  defence-in-depth, not a fix for any observed failure.
+
+### Fixed
+
+- **Content-policy 400s are no longer misclassified as `WireFormatError`
+  ([#528](https://github.com/ffroliva/gflow-cli/issues/528)).** An HTTP 400 from
+  `flowMedia:batchGenerateImages` or `batchAsyncGenerateVideo*` now raises
+  `ContentPolicyError` with remediation that names the levers that actually
+  work — reduce to a single face-bearing reference, replace age-explicit person
+  descriptors with relational or role nouns — and states outright that
+  shortening the prompt does not help. Previously these surfaced as "the
+  request was rejected as malformed… retry with a simpler prompt text", which
+  sends operators down a path that cannot succeed. Same defect shape as
+  [#379](https://github.com/ffroliva/gflow-cli/issues/379) (429), one status
+  over, and the self-documenting-errors goal of
+  [#380](https://github.com/ffroliva/gflow-cli/issues/380).
+- **Video generation gained the 429 branch the image path got in #379.** A
+  quota hit on `batchAsyncGenerateVideo*` raised `WireFormatError` instead of
+  `RateLimitError`, losing `Retry-After` and the retryable classification.
+- **`generate_images_batch` no longer reports a bare, remediation-free
+  `GFlowError`** when every response failed — it classifies the first error the
+  same way the single-prompt path does.
+
+### Security
+
+- **CI/CD supply-chain hardening
+  ([#565](https://github.com/ffroliva/gflow-cli/issues/565)).** Every
+  `actions/checkout` step now sets `persist-credentials: false` (12 existing
+  steps fixed across `ci.yml`, `deps-watch.yml`, `governance-advisory.yml`,
+  `governance-benchmark.yml`, `main-base-guard.yml`, `pages.yml` and
+  `release.yml`); the default leaves the job token in `.git/config` for the rest
+  of the job. No workflow needed it — releases publish over PyPI Trusted
+  Publishing (OIDC) and Pages deploys over `actions/deploy-pages`. A new
+  `workflow-audit` job runs [zizmor](https://github.com/zizmorcore/zizmor)
+  (pinned, `--offline`) over `.github/workflows/` on every push and PR, so the
+  class cannot come back. Its first run also caught two defects the manual pass
+  missed: `${{ github.base_ref }}` interpolated directly into a
+  `governance-advisory.yml` shell script (template injection — the value now
+  arrives through `env:`), and a shared uv cache restored by the publishing
+  release job (cache poisoning — caching is now off there). The
+  `pull_request_target` trigger in `external-pr-triage.yml` is suppressed inline
+  with its rationale, and a changelog-guard workflow was evaluated and declined
+  — both decisions recorded in
+  [docs/GITHUB.md § Workflow Security Gates](docs/GITHUB.md#workflow-security-gates).
+
 ## [0.59.0] — 2026-08-16
 
 ### Added
@@ -3073,7 +3155,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.59.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.60.0...HEAD
+[0.60.0]: https://github.com/ffroliva/gflow-cli/compare/v0.59.0...v0.60.0
 [0.59.0]: https://github.com/ffroliva/gflow-cli/compare/v0.58.0...v0.59.0
 [0.58.0]: https://github.com/ffroliva/gflow-cli/compare/v0.57.1...v0.58.0
 [0.57.1]: https://github.com/ffroliva/gflow-cli/compare/v0.57.0...v0.57.1

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.59.0
+Version: 0.60.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -58,7 +58,7 @@ Requires-Dist: numpy>=1.24; extra == 'dev'
 Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.16.2; extra == 'dev'
+Requires-Dist: ruff==0.16.4; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'

{gflow_cli-0.59.0 → gflow_cli-0.60.0}/deploy/PR-TRIAGE-AUTOPILOT-OPS.md

@@ -16,6 +16,8 @@ The autopilot orchestrator (`scripts/autopilot/pr_triage_autopilot.py`) runs as
 | `TELEGRAM_USER_ID` | Autopilot orchestrator (host) | The chat ID to receive triage alert messages. |
 | `PR_TRIAGE_ENGINE` | Autopilot orchestrator (host), optional | Review engine selector. Default `council-claude`; any other value exits at startup (`council-multi-cli` is reserved backlog). |
 | `HERMES_OPS_DIR` | Autopilot orchestrator (host), optional | Location of the hermes-ops checkout hosting the Resend email notifier. Default `/opt/hermes-ops`. |
+| `GH_SANDBOX_TOKEN` | Review **container** | Fine-grained **read-only** PAT for the repo under review. The container only reads the PR; the host posts the comment. If unset the orchestrator falls back and raises an alert rather than degrading silently. Stored in the SOPS secret store. |
+| `GFLOW_TRIAGE_MEMORY_DIR` | Autopilot orchestrator (host), optional | Council memory directory mounted read-only for D5. Set it only to override the XDG default (`$XDG_DATA_HOME/gflow-cli/memory`, i.e. `~/.local/share/gflow-cli/memory`). **Never put a machine-specific path in the cron line** — see §2. |
 | `RESEND_API_KEY` | Email notifier (hermes-ops) | Resend API key consumed by `$HERMES_OPS_DIR/scripts/notify/email_notify.py`. |
 | `HERMES_NOTIFY_EMAIL_TO` | Email notifier (hermes-ops) | Recipient address for high-signal triage emails. |
 | `HERMES_NOTIFY_EMAIL_FROM` | Email notifier (hermes-ops) | Verified sender address for the Resend account. |
@@ -28,8 +30,19 @@ The autopilot orchestrator (`scripts/autopilot/pr_triage_autopilot.py`) runs as
 
 Deploy the following layout on the VPS:
 - `/opt/gflow-cli`: Dedicated git repository checkout representing the active branch.
-- `/opt/experience-vault`: Host experience vault directory structure.
-- `/opt/experience-vault/projects/C--development-github-gflow-cli/memory`: The project-specific memory namespace to mount.
+- `~hermes/.local/share/gflow-cli/memory`: Council memory namespace, mounted read-only into the sandbox for dimension D5.
+
+Create the memory directory once, as the user the cron runs under:
+
+```bash
+sudo -u hermes mkdir -p ~hermes/.local/share/gflow-cli/memory
+```
+
+An **empty** directory is a valid deployment — D5 then reports that no memory is available, and the other 13 dimensions run normally. Populate it only if you want the council to consult durable project memory.
+
+> **The memory path is resolved by the orchestrator, never hardcoded.** Precedence is `--memory-dir` > `$GFLOW_TRIAGE_MEMORY_DIR` > `$XDG_DATA_HOME/gflow-cli/memory` (XDG default, falling back to `~/.local/share`). `XDG_DATA_HOME` is the correct slot per the XDG Base Directory Specification: council memory is durable knowledge that should be backed up, not regenerable cache or throwaway state.
+>
+> The orchestrator validates the resolved path on the host and refuses to start with an actionable error if it is missing, rather than failing later inside the container.
 
 ---
 
@@ -51,7 +64,7 @@ Ensure `iptables` is installed on the host VPS. If `iptables` permissions are wi
 Configure a cron job checking every hour on the hour under the `hermes` system user:
 
 ```cron
-0 * * * * set -a; . /opt/hermes/.env 2>/dev/null; set +a; cd /opt/gflow-cli && uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli --memory-dir /opt/experience-vault/projects/C--development-github-gflow-cli/memory >> /var/log/hermes/pr_triage.log 2>&1
+0 * * * * set -a; . /opt/hermes/.env 2>/dev/null; set +a; cd /opt/gflow-cli && uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli >> /var/log/hermes/pr_triage.log 2>&1
 ```
 
 Sourcing `/opt/hermes/.env` first (`set -a` exports everything it defines) is what delivers `GH_COMMENT_TOKEN`, `TELEGRAM_*`, and the `RESEND_API_KEY` / `HERMES_NOTIFY_EMAIL_*` vars to the process. Without it the email channel silently disables itself, and without `GH_COMMENT_TOKEN` the run exits 1.
@@ -83,6 +96,17 @@ Do **NOT** register the orchestrator directly via `hermes cron create --script p
 - **(a) Plain crontab** — the line above, under the `hermes` system user.
 - **(b) Thin shim in `HERMES_HOME/scripts/`** — a script that does `cd /opt/gflow-cli && exec uv run python scripts/autopilot/pr_triage_autopilot.py "$@"` (mirrors the existing EV ops-health shim pattern), registered with `hermes cron create "1h" --no-agent --script <shim> --deliver telegram`.
 
+### Log rotation
+
+`pr_triage.log` grows without bound otherwise. Install once, as root:
+
+```bash
+install -m 644 /opt/gflow-cli/deploy/logrotate-pr-triage /etc/logrotate.d/pr-triage
+logrotate --debug /etc/logrotate.d/pr-triage    # dry-run
+```
+
+Scoped to `pr_triage.log` alone — the rest of `/var/log/hermes/` belongs to hermes-ops, and two packages rotating one glob is how logs get silently truncated.
+
 ### Check Logs & Status
 - **Log Location**: `/var/log/hermes/pr_triage.log`
 - **Triage Ledger**: `/opt/gflow-cli/pr_triage_ledger.jsonl` tracks verdicts and failure states.
@@ -110,5 +134,5 @@ If a PR enters the `FAILED_PERMANENT` state in `pr_triage_ledger.jsonl` due to 3
 2. Fix the underlying environmental or syntax issue.
 3. To trigger a re-review, delete or edit the `FAILED_PERMANENT` entries for that PR number/SHA in `pr_triage_ledger.jsonl`, then run the script manually:
    ```bash
-   uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli --memory-dir /opt/experience-vault/projects/C--development-github-gflow-cli/memory
+   uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli
    ```

gflow_cli-0.60.0/deploy/logrotate-pr-triage

@@ -0,0 +1,21 @@
+# logrotate config for the PR-Triage Autopilot log.
+#
+# Install on the VPS as root:
+#   install -m 644 /opt/gflow-cli/deploy/logrotate-pr-triage /etc/logrotate.d/pr-triage
+#   logrotate --debug /etc/logrotate.d/pr-triage   # dry-run to verify
+#
+# Scoped to pr_triage.log alone, not /var/log/hermes/*.log: the rest of that
+# directory belongs to hermes-ops, and two packages rotating the same glob is
+# how you get silently truncated logs.
+/var/log/hermes/pr_triage.log {
+    weekly
+    rotate 8
+    compress
+    delaycompress
+    missingok
+    notifempty
+    # The hourly cron reopens the file on each tick, but copytruncate keeps
+    # rotation safe if the orchestrator is ever run as a long-lived process.
+    copytruncate
+    su hermes hermes
+}

{gflow_cli-0.59.0/website → gflow_cli-0.60.0}/docs/E2E_TESTING.md

@@ -149,6 +149,165 @@ See [DEVELOPMENT.md § E2e gate](DEVELOPMENT.md#e2e-gate-before-merging-develop-
 
 ---
 
+## Nightly canary (#502)
+
+Between releases the live tiers are invisible, so Flow-side drift (cohort flaps,
+selector renames, auth rot) surfaces ad-hoc during feature work instead of on a
+schedule. The canary closes that gap.
+
+It runs **locally, not in hosted CI** — the live tiers need a real authenticated
+Chrome profile, and Google bot-detection plus reCAPTCHA make hosted auth
+infeasible. Results are published to a single **rolling issue**; the canary never
+opens new ones (issue spam trains red-blindness) and **gates nothing** (a gate on
+a machine that might be off is self-DoS).
+
+### Four states
+
+| State | Meaning | Action |
+|---|---|---|
+| `GREEN` | every selected $0 tier passed | none |
+| `RED` | auth healthy, a $0 tier failed | **real drift or regression** — triage |
+| `AUTH-EXPIRED` | session rot (expected) | `gflow auth login` |
+| `DEFERRED` | nothing conclusive ran | fix the profile / config — says nothing about Flow |
+
+Splitting the last two out of `RED` is the point: `RED` must always mean "code or
+Flow drifted", never "please re-login" or "you had Chrome open". The classifier is
+a pure function with all four states covered in
+`tests/scripts/test_canary_classify.py`.
+
+**Rot vs. drift is decided by a second probe, not by error names.** When a tier
+fails for a reason other than a profile precondition, the canary re-runs
+`gflow auth status`. Session still valid ⇒ the failure is
+drift (`RED`); session now dead ⇒ genuine rot (`AUTH-EXPIRED`). The first live run
+proved why this matters: an `AuthExpiredError` on `project.createProject`
+*looked* exactly like session rot, but the session verified clean seconds later —
+so it was a real divergence between two auth surfaces, and a name-matching
+classifier would have buried it. The extra probe costs ~45s and only runs after a
+failure.
+
+> The route is `labs.google/fx/api/trpc/project.createProject` — the NextAuth
+> **cookie** surface — not the aisandbox Bearer path. #561 originally recorded it
+> as an `uploadImage` failure because the failing test is named for an upload;
+> the traceback dies one line earlier, on the project-creation call. Corrected
+> here so the next reader does not re-investigate the wrong host.
+
+`DEFERRED` covers every run that **exercised nothing**: a held `ProfileLease`, a
+`ProfileEngineDowngradeError` (profile written by a newer Chromium than the bundled
+engine), a refused `--pull`, or a run where every selected test skipped. All fail
+before reaching Flow, so none can evidence drift.
+
+Two subtleties, both found by council review and both regression-tested:
+
+- **A precondition is matched on the raised exception, never a substring.** Two
+  `e2e_auth` tests mention `ProfileLockedError` in ordinary source — one in an
+  assertion message, one in a comment — and pytest echoes the failing function's
+  source into its traceback. Substring matching therefore published a genuine
+  regression in those tests as `DEFERRED`, the one label that says "ignore me".
+- **A green run that executed nothing is not green.** pytest exits 0 when every
+  test skips, and every e2e test skips on a missing profile directory. `GREEN`
+  requires `passed > 0`.
+
+Because the issue carries a last-updated timestamp, a machine that was off is
+*visibly stale* — unlike a lingering green commit status, which lies.
+
+**A RED preserves its own evidence, logs included.** The run's JUnit is copied to
+`tmp/canary-red-<stamp>.xml` (the live one is overwritten nightly), and pytest runs
+with `-o junit_logging=all` so that copy carries the captured structlog output, not
+just a traceback. This is not optional detail: the canary's failures reproduce only
+unattended, so whatever the run does not record cannot be recovered afterwards. For
+an auth 401 the deciding line is `client.context_cookie_state` — the #222
+diagnostic, which reports whether the launched browser context actually loaded the
+Flow session cookie. That single boolean separates "the browser never got the
+cookie" from "the session was genuinely refused"; without it a 401 traceback is the
+same shape either way. The copy stays **local** — it carries raw tracebacks and
+profile paths, which the sanitization contract keeps off the public issue.
+
+### Scope
+
+`-m e2e_auth` only ($0, no reCAPTCHA); fast-follow adds `e2e_scene` ($0). Credit
+tiers (`e2e_image` / `e2e_video` / `smoke`) stay **strictly manual** via
+`/gflow:live-verify` — no unattended credit spend on a personal account.
+
+### Run it
+
+```bash
+# dry run — executes for real, prints the payload, touches nothing on GitHub
+uv run python scripts/canary/run_canary.py --profile <name> --dry-run
+```
+
+Credit-spending markers (`e2e_image`, `e2e_video`, `e2e_batch`, `e2e_character`,
+`smoke`) are **refused outright** — the canary never spends credits unattended.
+Run those manually via `/gflow:live-verify`.
+
+### Schedule it
+
+```powershell
+.\scripts\canary\register_task.ps1 -Profile <name> -Issue <n> `
+    -RepoRoot C:\path\to\dedicated\clone
+```
+
+Point `-RepoRoot` at a **dedicated clone**, never your working tree: the runner's
+`--pull` refuses a dirty checkout rather than resetting over uncommitted work, and
+reports that refusal as `DEFERRED` rather than exiting silently. `--pull` also
+re-syncs dependencies, so a lockfile bump on `develop` cannot masquerade as a
+`RED` import error.
+
+Publishing uses your already-authenticated local `gh` — **no new secrets or
+tokens**. Published content is sanitized for a public repo: SHA, pass/fail
+counts, duration, failure class, and failing test *names* only — never raw logs,
+profile paths, prompts, or signed URLs.
+
+## Selector drift probe (#563)
+
+The canary answers *"does gflow still work on the maintainer's cohort?"*; the
+probe answers *"which Flow DOM selector moved?"* — from hosted CI, with no
+maintainer machine involved. It walks the structured selector inventory in
+`gflow_cli.flow_selectors` (the incident families from #404/#493/#313) against
+a live editor at the pinned 1920×1080 viewport: navigate and read only, **$0**,
+never submits.
+
+Runs via `.github/workflows/selector-probe.yml` on `schedule` (05:00 UTC daily)
+plus `workflow_dispatch`. **Never add a `pull_request` trigger**: same-repo
+branch PRs receive repository secrets while running attacker-editable probe
+code (fork PRs are safe — GitHub withholds secrets — but the same-repo case is
+not).
+
+### Exit contract
+
+| Exit | Meaning | Action |
+|---|---|---|
+| `0` | every registered selector resolved (`ok` / `FALLBACK[n]` / `n/a`) | none |
+| `1` | **drift** — a selector graded MISS or AMBIGUOUS; the report names its key | re-derive that selector, ship a registry edit |
+| `2` | **inconclusive** — expired token, dead project, known alternate UI state, or no recognizable editor arm | fix the credential/project; says nothing about Flow |
+
+Keeping `1` and `2` apart is the whole design: an expired credential must never
+be published as "Google changed the page". The deciding gate is a poll on
+production's own arm indicators (the six `crop_*` variants ⇒ classic, the
+agentic ligatures ⇒ agentic); a page showing neither within 25 s — a sign-in
+wall renders neither — is inconclusive, not drift. Mode-scoped selectors absent
+on the observed arm grade `n/a` (`EXPECTED_ABSENT`), never drift — the probe's
+first two live runs landed on opposite arms (classic locally, agentic on the
+runner) and both graded clean.
+
+### Secrets and token care
+
+Two repository secrets, from a **dedicated throwaway Google account**, never
+the maintainer's: `GFLOW_CI_SESSION_TOKEN` (the
+`__Secure-next-auth.session-token` cookie) and `GFLOW_CI_PROJECT_ID` (any
+project that account owns — a deleted id renders an error shell the probe
+reports as exit 2).
+
+The token **re-issues on every profile open** (observed live 2026-08-21: three
+values in 15 minutes; the first CI dispatch failed exit 2 on a superseded
+snapshot). Harvest accordingly: open the throwaway profile once, read the
+cookie, close the browser, `gh secret set GFLOW_CI_SESSION_TOKEN` from stdin —
+and never reopen that profile without re-syncing the secret afterwards. The
+value also hard-dies at day 30 with no warning. Either way an aged token shows
+as a red exit-2 run, never as drift, and the nightly schedule itself is the
+aging test.
+
+---
+
 ## File map
 
 ```