…1279)

* Initial plan

* chore(workflows): recompile safe-output fixtures with ado-aw v0.39.0

Co-authored-by: jamesadevine <[email protected]>

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: jamesadevine <[email protected]>

…de gh-aw to v0.81.6 (#1281)

* ci: upgrade gh-aw workflows to compiler v0.81.6

Regenerates all committed .lock.yml files (plus the agents/skills/actions-lock artifacts) via 'gh aw upgrade' + recompile. Bumps the pinned toolchain: gh-aw compiler v0.79.6->v0.81.6, copilot engine 1.0.60->1.0.65, actions/checkout v6->v7, gh-aw-firewall 0.27.2->0.27.11, gh-aw-mcpg v0.3.25->v0.3.30, github-mcp-server v1.1.2->v1.4.0, and adds the gh-aw-node container + GH_AW_RUNTIME_FEATURES passthrough. No agent-file (.md) behavior changes.

Co-authored-by: Copilot <[email protected]>

* feat(workflows): add issue-triage and issue-arborist agentic workflows

Adapts two gh-aw backlog-management patterns to ado-aw's conventions and label set:

- issue-triage: labels new/unlabeled issues (triggers on issue events + every 8h sweep + manual). Classifies into the repo's existing type/area/meta labels via add-labels, comments its rationale on issue events, stays comment-quiet on sweeps. min-integrity none, treats issue content as untrusted.
- issue-arborist: daily agent that clusters related issues and links them into [Parent] / sub-issue trees (create-issue + link-sub-issue) and posts a summary discussion. Pre-fetches the last 100 non-sub open issues via a gh step; conservative linking (5+ per cluster, precision over recall).

Both compile clean under gh-aw v0.81.6 (0 errors).

Co-authored-by: Copilot <[email protected]>

---------

Co-authored-by: Copilot <[email protected]>

…→54 (#1290)

Add entries for NodeTool@0, SonarQubeAnalyze@8, SonarQubePrepare@8,
SonarQubePublish@8, AzureFunctionApp@2, KubernetesManifest@1,
AzureResourceManagerTemplateDeployment@3, and BicepDeploy@0 to the
ir.mdx typed-task-helpers reference tables. These builders were
present in src/compile/ir/tasks/ but absent from documentation.

- Toolchain setup: NodeTool@0 (legacy; prefer UseNode@1)
- Build and test: SonarQube trio (Prepare → Analyze → Publish)
- Containers and cloud: AzureFunctionApp@2, KubernetesManifest@1
- New 'Infrastructure as code' section: ArmTemplateDeployment@3, BicepDeploy@0
- Command-dispatch list: +BicepDeploy@0, KubernetesManifest@1,
  AzureResourceManagerTemplateDeployment@3, SonarQubePrepare@8
- Count updated 46→54 in ir.mdx (×2) and extending.mdx

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <[email protected]>

…matter key references (#1289)

The Conclusion job is triggered automatically by `safe-outputs:` configuration;
there is no separate `conclusion:` front-matter key. Two places used the
backtick-wrapped form `conclusion:` in a way that implied a nonexistent key.

- AGENTS.md: docs index entry now describes the Conclusion job without
  implying a `conclusion:` key; notes it is triggered by `safe-outputs:`
- docs/safe-outputs.md (line 338): 'When `conclusion:` is configured' →
  'When `safe-outputs:` is configured' to match actual compiler behaviour

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <[email protected]>

)

Rescope the doc-freshness-check workflow to be solely responsible for
agent-facing documentation (AGENTS.md, docs/*, prompts/*). Human-facing
README/site docs remain owned by the docs-writer workflow.

Add guidance for structuring docs for agent consumption (agents.md
conventions) and active context-size management. Bump schedule to every 4h.

Co-authored-by: Copilot <[email protected]>

Reframe the docs-writer workflow as the human-facing documentation writer.
Add README.md to its allowed-files (excluded from protected files so it gets
PRs) alongside the existing site/ scope, and make clear its audience is
humans. Agent-facing docs (AGENTS.md, docs/*, prompts/*) remain owned by the
doc-freshness-check workflow.

Co-authored-by: Copilot <[email protected]>

…esting (#1294)

… schema (#1296)

…1298)

Set safe-outputs.threat-detection.max-ai-credits to -1 on all 19
gh-aw workflows and recompile their lock files so both the agent and
threat-detection stages run with unlimited AI credit budgets.

Co-authored-by: Copilot <[email protected]>

…mpt (#1299)

The conventional front matter order listed in Step 2 of the update
prompt was inaccurate in two ways:

1. 'schedule' was placed between 'engine' and 'workspace', implying it
   is a top-level field. It is actually a sub-key of 'on:' and should
   appear after 'safe-outputs:'.

2. 'runtimes' was missing entirely from the order, leaving agents with
   no guidance on where to insert runtime configuration.

3. 'execution-context' was missing — it belongs between 'on' and
   'steps'.

The corrected order now matches the actual template in
docs/front-matter.md, grouping schedule and pipeline/PR triggers
together under 'on', and inserting 'runtimes' and 'execution-context'
in their correct positions.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <[email protected]>

…mods to registry table (#1300)

Two codemods introduced in 0.37.0 and 0.38.0 were missing from the
registered-codemods table and the file-layout tree in codemods.mdx.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <[email protected]>

… in update_pr.rs (#1301)

Extract lookup_reviewer_id (VSSPS GET + identity resolution) and
add_reviewer_to_pr (PUT reviewer + response handling) as focused
async helpers. resolve_and_add_reviewer becomes a thin 5-line
coordinator.

Cognitive complexity: 17 → below 10 (both helpers ~4-5 each).
All existing tests pass.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <[email protected]>

…nitor (#1306)

Nothing was pruning the bot-authored issue backlog, so it filled with
self-superseding issues. This adds cleanup and stops the churn at source.

- update-awf-version: instead of opening a new [deps-release-notes] issue
  per upstream release, maintain a single canonical rolling issue per
  component (awf/mcpg/copilot-cli) titled
  "[deps-release-notes] <token> — upstream release action items" and append
  a comment per version bump.
- deps-notes-consolidator (new, weekly + dispatch): folds the existing
  per-release backlog into the newest issue per component (preserving all
  action-item history) and closes the superseded ones as not_planned.
- stale-bot-issue-janitor (new, weekly + dispatch): closes exact-title
  duplicate [aw] failure reports and superseded recompile-fixture chore
  issues, keeping only the most recent of each. Scoped to bot-authored
  issues with a hard protect-list for the [aw] No-Op Runs / Detection Runs
  rolling aggregates.

Co-authored-by: Copilot <[email protected]>

Three field descriptions in docs/execution-context.md referenced
'plan.md' (a development planning file that does not exist in the repo):
- pipeline.enabled: 'Stage 2 of the build-out — see plan.md'
- ci-push.enabled: 'Stage 3 of the build-out — see plan.md'
- workitem.enabled: 'Stage 4 of the build-out — see plan.md'

The contributors described are fully implemented; the stage-numbering
and planning-doc references add no value to readers and the link target
does not exist. Removed the stale parentheticals; the workitem entry
retains the meaningful '(PR-linked mode only)' constraint.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <[email protected]>

…1310)

- Remove test_result_has_correct_name: strict subset duplicate of the
  result.name assertion already present in test_params_converts_to_result.
- Rewrite test_validation_rejects_zero_pr_id: bare is_err() → assert error
  message contains 'pull_request_id must be positive'.
- Rewrite test_validation_rejects_zero_thread_id: bare is_err() → assert error
  message contains 'thread_id must be positive'.
- Rewrite test_validation_rejects_short_content: bare is_err() → assert error
  message contains 'content must be at least 10 characters'.
- Rewrite test_validation_rejects_repository_pipeline_command: bare is_err() →
  assert error message contains 'repository' and '##vso['.
- Remove now-unused ToolResult import from the test module.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <[email protected]>

* fix(ado-script): read auto-injected collection URI in getWebApi

conclusion.js could not file the pipeline_failure work item because the
Conclusion step never injected ADO_COLLECTION_URI, which the shared
getWebApi() auth helper required. ADO does not auto-inject that renamed
var, and the Conclusion step builder only set SYSTEM_ACCESSTOKEN.

Align ado-script with the Rust `ado-aw execute` path by reading ADO's
auto-injected collection URI directly: SYSTEM_COLLECTIONURI, falling back
to SYSTEM_TEAMFOUNDATIONCOLLECTIONURI. This removes the collection URI
from the per-step injection contract entirely, so no compiler-emitted
step can forget it again (fixes already-compiled locks too).

Also drop the now-redundant ADO_COLLECTION_URI exports from the gate and
synthetic-PR step builders, update gate_e2e to set SYSTEM_COLLECTIONURI,
refresh docs, and add auth.test.ts precedence coverage.

Fixes #1307

Co-authored-by: Copilot <[email protected]>

* chore(ado-script): stop tracking built conclusion.js bundle

Every ado-script bundle is a build artifact shipped via the release
ado-script.zip and downloaded to /tmp at pipeline runtime; the in-repo
copies are gitignored. conclusion.js was the sole exception — PR #1076
added the bundle but omitted it from scripts/ado-script/.gitignore, so
the built file was committed and tracked by accident. Nothing consumes
the repo copy (only the /tmp runtime path is referenced), so untrack it
and ignore it alongside the other bundles.

Co-authored-by: Copilot <[email protected]>

---------

Co-authored-by: Copilot <[email protected]>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>