fix(ci): repair advisory locks and platform regressions

[Daniel Meppiel (danielmeppiel)]

fix(ci): repair advisory locks and platform regressions

TL;DR

Repair stale advisory-workflow metadata and the Windows/macOS failures found
while investigating main after #3003. Regenerate both advisory locks with the
repository-pinned compiler, correct the Windows filesystem fixture,
and keep drift replay scoped to the original project's primitive directories.

Important

These are separate causes: the build immediately after #3003 passed.
The stale triage lock came from that migration; the Windows assertion came
from #2901, and the replay over-scan was latent.
Hosted PR checks pass at 0b169f4518, including the Windows compatibility
gate and both Linux shards. Post-merge macOS Intel remains unverified.

Problem (WHY)

• Triage run 35221460885
  stopped before agent execution with E009 CONFIG_HASH_MISMATCH.
  Both triage and PR-review lock headers were stale against current source.
• Build run 35235695292
  failed the Windows alias fixture: the filesystem created safe, but the
  assertion expected the input spelling safe..
• The same build exceeded the unchanged macOS replay budget:
  10.092998506000072 < 10.0 failed. Replay treated the scratch destination as
  the source identity, causing unnecessary full-project discovery.
• The first revision of this PR failed
  the compiler contract:
  PR-review metadata used v0.88.2, but repository tooling pins v0.87.8.
  The correction recompiles the entire lock rather than relabeling its header.

The repair uses concrete failure evidence and regression assertions rather
than bypassing gates. Agent Skills recommends:
"do the work, run a validator (a script, a reference checklist, or a self-check), fix any issues, and repeat until validation passes."

Approach (WHAT)

• Recompile with the repository-pinned v0.87.8 generator, retaining action
  SHAs and permissions while restoring its matching runtime defaults.
• Add a bounded source-freshness contract covering both workflows and their
  shared import, including LF/CRLF/CR coverage and compiler-header consistency.
• Assert the actual on-disk alias name and include the fixture in the
  existing Windows compatibility gate.
• Preserve recorded root-local identity when replay deploys into scratch;
  retain normal discovery for external packages.
• Reuse existing discovery tests for install and replay instead of
  introducing a second fixture suite or relaxing the timing budget.
• Set package-mock defaults explicitly and assert resolver initialization;
  isolate symlink prerequisites so they cannot skip alias coverage.

Implementation (HOW)

File	Change
.github/workflows/triage-panel.lock.yml	Refresh frontmatter/body hashes with gh-aw 0.87.8; no runtime changes.
.github/workflows/pr-review-panel.lock.yml	Regenerate with pinned 0.87.8, aligning metadata, banner, runtime wiring, and container defaults; retain action SHAs and permissions.
src/apm_cli/integration/base_integrator.py	Recognize root_local_project_root when the deployment destination is scratch.
tests/unit/integration/test_base_integrator.py	Exercise install/replay scoping and external-package behavior; assert successful resolver initialization with explicit deployment defaults.
tests/unit/test_deps_utils.py	Compare discovery to the resolved directory name; keep alias coverage independent of symlink support in windows_compat.
tests/unit/test_triage_panel_lock.py	Check both advisory locks against source/import hashes and generator headers using real LF, CRLF, and CR files.
tests/unit/test_shared_apm_workflow_contract.py	Enforce the repository compiler pin against both metadata and the generated banner, preventing header-only relabeling.
docs/src/content/docs/contributing/development-guide.md	Document lock regeneration guidance and the freshness check.
docs/src/content/docs/enterprise/drift-detection.md	Clarify that scratch changes the deployment destination, not root-local source scope.

The Python runtime change is confined to
BaseIntegrator._is_root_local_package.
No CLI flags, Python dependency versions, acceptance rules, or permissions change.
PR-review's generated firewall defaults return from 0.28.12 to 0.28.7 and
MCP gateway from 0.4.15 to 0.4.12, matching the pinned compiler and other locks.
There is no CHANGELOG edit or primitive-source change.

Diagrams

The dashed step preserves root-local source identity when replay uses a different deployment destination.

flowchart LR
    subgraph Replay["Drift replay"]
        P["Root-local package"]
        S["Scratch deployment root"]
    end
    subgraph Discovery["Source discovery"]
        I["BaseIntegrator._is_root_local_package"]
        R["Compare recorded root_local_project_root"]
        N["Scan original .apm and .github"]
        E["External package: scan install_path"]
    end
    P --> I
    S --> I
    I -->|"Destination differs from source"| R
    R -->|"Recorded root matches install_path"| N
    R -->|"Not root-local"| E
    classDef new stroke-dasharray: 5 5;
    class R new;

Loading

Trade-offs

• Keep the 10-second budget and all existing CI gates; remove redundant
  discovery rather than raising the threshold or skipping macOS.
• Restore PR-review's generated runtime to the repository pin rather than
  upgrading the compiler across all workflows or weakening its contract.
  This is a full regeneration, not a metadata-only change.
• The hash test intentionally supports the current single-import workflow
  shape. Structural changes fail explicitly and require updating the guard.
• Local execution used an existing development environment with this
  worktree on PYTHONPATH, because fresh PyPI downloads failed. Native
  macOS Intel timing remains unverified; the hosted Windows gate passes.

Benefits

1. Stale source metadata in either advisory workflow fails a repository
   test before the workflow reaches activation.
2. All four root-local discovery scenarios run for both normal install
   and scratch replay, including real directory-walk coverage.
3. The dotted-alias fixture enters the PR-time Windows compatibility gate
   without requiring symlink privileges; a separate test retains symlink exclusion.

Validation

Current origin/main was integrated before validation and commit.
Local and hosted PR checks pass at 0b169f4518.
CI run 35334185992
passed both Linux shards, Windows compatibility, lint, architecture ratchets,
and smoke checks. The merge gate
also passed. All three Copilot review threads are answered and resolved.

Focused suite and local lint evidence

Executed with VIRTUAL_ENV=/Users/danielmeppiel/Repos/awd-cli/.venv,
PYTHONPATH=src, and uv run --active --no-sync --extra dev.
This binds production imports to the repair worktree without modifying
the existing dependency environment.

pytest -q selected test_base_integrator.py, test_drift.py,
test_drift_perf.py, test_triage_panel_lock.py, test_shared_apm_workflow_contract.py,
test_workflow_actor_contract.py, test_deps_utils.py, and
test_alias_traversal.py:

313 passed in 4.50s

Ruff check and format over the canonical CI paths:

All checks passed!
1874 files already formatted

Pylint R0801 over the canonical CI paths:

Your code has been rated at 10.00/10 (previous run: 10.00/10, +0.00)

The auth and architecture boundary scripts, YAML/file-length/relative-path
guards, assertion-quality and duplicate-test ratchets, and git diff --check
also completed successfully.

Both original stale metadata snapshots were rejected by the new hash guard.
An in-memory replacement with the original root-local predicate made all
four replay regression cases fail; restored production code passes.
The Mermaid diagram was rendered successfully with mmdc.
The strengthened compiler test rejects main's mismatched generated banner.
Disabling universal-newline translation makes the CRLF fixture fail.
Simulating denied symlink privileges yields four alias passes and only
one skip, for the isolated symlink test.

Scenario Evidence

#	Scenario (user promise)	Principle(s)	Test(s) proving it	Type
1	Edited advisory workflows do not deploy with stale configuration metadata	Governed by policy	tests/unit/test_triage_panel_lock.py::test_advisory_lock_metadata_matches_source (regression trap for the #3003 migration)	unit
2	Installed dotted aliases are discovered using the real filesystem name	Portability by manifest	tests/unit/test_deps_utils.py::test_scan_includes_flattened_alias_without_nested_packages	integration
3	Audit replay does not walk unrelated project subtrees	DevX (pragmatic as npm)	tests/unit/integration/test_base_integrator.py::TestInitLinkResolverLocalScoping::test_real_walk_does_not_traverse_noise_subtree[replay]	integration
4	External packages retain their own discovery scope	Portability by manifest	tests/unit/integration/test_base_integrator.py::TestInitLinkResolverHomeScoping::test_uses_install_path_when_not_home	unit
5	Replay and diff of 100 primitives retain the existing time budget	DevX (pragmatic as npm)	tests/unit/install/test_drift_perf.py::test_drift_replay_under_10s_for_100_primitives	integration
6	Generated workflows use the same compiler pinned by repository tooling	Governed by policy	tests/unit/test_shared_apm_workflow_contract.py::test_repository_pins_exact_gh_aw_compiler_and_generated_locks	unit

How to test

• Run uv run --frozen --extra dev pytest -q tests/unit/test_triage_panel_lock.py tests/unit/test_shared_apm_workflow_contract.py tests/unit/test_workflow_actor_contract.py; both advisory locks must match source and the repository compiler pin.
• Run uv run --frozen --extra dev pytest -q tests/unit/test_deps_utils.py tests/unit/test_alias_traversal.py; dotted aliases remain accepted and discoverable.
• Run uv run --frozen --extra dev pytest -q tests/unit/integration/test_base_integrator.py tests/unit/install/test_drift.py tests/unit/install/test_drift_perf.py; install/replay scoping and the unchanged timing budget must pass.
• Confirm the PR-time Windows compatibility gate and hosted build results; no hosted platform result is inferred from local execution.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Copilot review overview

🟡 Changes recommended

The new Windows/hash regression tests have cross-platform robustness gaps (CRLF hashing stability, unguarded symlink creation, and MagicMock attribute defaults) that could cause false CI failures.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3

Open (3)

• Set deployment_package_root=None on MagicMock package_info in init_link_resolve… · New
• Guard symlink creation in windows_compat test · New
• Normalize CRLF to LF before hashing workflow sources · New

What changed in this PR

Repairs CI regressions by refreshing gh-aw advisory workflow lock metadata, hardening repository tests that detect stale lock/source drift, and fixing platform-specific discovery/scoping behavior (Windows dotted-alias directories; drift replay root-local discovery).

Changes:

• Regenerated advisory workflow lock metadata and added a unit guard that compares lock hashes against workflow source/import contents.
• Adjusted Windows alias fixture expectations to use the on-disk directory name and selected it into the windows_compat gate.
• Updated BaseIntegrator root-local detection to preserve source scoping during drift replay into scratch, plus corresponding tests and docs clarifications.

File	Description
.github/​workflows/​triage-panel.lock.yml	Refreshed gh-aw metadata hashes for triage advisory lock.
.github/​workflows/​pr-review-panel.lock.yml	Refreshed gh-aw metadata hashes and compiler header for PR review advisory lock.
tests/​unit/​test_triage_panel_lock.py	Added regression test to ensure advisory lock metadata matches workflow source/import hashes.
tests/​unit/​test_deps_utils.py	Fixed Windows trailing-dot alias expectation by asserting the actual on-disk directory name; marked windows_compat.
src/​apm_cli/​integration/​base_integrator.py	Treated root_local_project_root as identity root during scratch replay to avoid over-scanning.
tests/​unit/​integration/​test_base_integrator.py	Extended scoping tests to cover install vs scratch-replay contexts.
docs/​src/​content/​docs/​contributing/​development-guide.md	Documented lock regeneration guidance and the new freshness check.
docs/​src/​content/​docs/​enterprise/​drift-detection.md	Clarified that scratch affects deployment destination, not root-local source discovery scope.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.