drive: cloud run 1a0b4c65

.github/workflows/review-swarm.yml

@@ -0,0 +1,68 @@
+---
+name: Review swarm
+
+"on":
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    if: >-
+      github.event.pull_request.user.login == 'kjgbot' ||
+      github.event.pull_request.user.login == 'miyaontherelay'
+    runs-on: ubuntu-latest
+    env:
+      RELAY_WORKSPACE_KEY: ${{ secrets.RELAY_WORKSPACE_KEY }}
+    steps:
+      - name: Check out pull request
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Install Agent Relay
+        run: npm install --global agent-relay
+
+      - name: Run swarm and post transcripts
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+
+          printf '%s\n' "$PR_NUMBER" > .review-target
+          git add --intent-to-add .review-target
+
+          run_json=$(agent-relay cloud run workflows/review-swarm.yaml --json)
+          run_id=$(jq -er '.runId' <<<"$run_json")
+          echo "Review swarm run: $run_id"
+
+          agent-relay cloud logs "$run_id" --follow
+          status=$(agent-relay cloud status "$run_id" --json | jq -er '.status')
+          if [ "$status" != completed ]; then
+            echo "Review swarm ended with status: $status" >&2
+            exit 1
+          fi
+
+          agent-relay cloud sync "$run_id"
+          mapfile -t transcripts < <(
+            git status --porcelain --untracked-files=all -- ops/reviews/ |
+              sed 's/^...//' |
+              grep -E -- \
+                "-pr${PR_NUMBER}-(maintainability|history|structure)\.md$" |
+              sort
+          )
+          if [ "${#transcripts[@]}" -ne 3 ]; then
+            echo \
+              "Expected 3 new review transcripts, found ${#transcripts[@]}" \
+              >&2
+            exit 1
+          fi
+
+          for transcript in "${transcripts[@]}"; do
+            gh pr comment "$PR_NUMBER" --body-file "$transcript"
+          done

README.md

@@ -30,3 +30,6 @@ Nine gates, in `docs/RFC-0001` §3. Gate 1 first: a relayflow can run — the he
 ladder survives `kill -9` at every boundary.
 
 Private while we build. YC 2026-09-15 runs on this base.
+
+The `RELAY_WORKSPACE_KEY` repository secret is required to run the review swarm
+in GitHub Actions.

ops/NEXT.md

@@ -1,87 +1,84 @@
 # NEXT — work package for this tick
 
-**Scope:** Build a minimal agent worker in the SDK. CODE task, SDK-side.
+**This run is pinned to gate 3.**
 
-This run is pinned to **gate 3** and must not work on any other gate.
+## Scope (quoted from ops/TARGET.md)
 
-## Objective
-
-Promote the throwaway worker the tests already build into a real SDK component
-that can execute agent steps by running their declared CLI as a subprocess.
-
-## Context
-
-Nothing in this repo can execute an agent step. Searching for `workerAttach` /
-`step.complete` finds only TESTS (`sdk/tests/live-kernel.test.ts`,
-`journal-client.test.ts`, `journal-client-loopback.ts`) and the protocol
-definitions. `sdk/src/cli/run.ts` only OBSERVES worker leases and waits for one
-that never arrives.
+Wire the review-swarm to fire on PR open via GitHub Actions + `agent-relay cloud run`. CODE task, `.github/workflows/`-side.
 
-The kernel's dispatch, lease and claim machinery is real and tested. The worker
-side of the protocol is simply unimplemented, and that is what blocks gate 2
-("a workload RUNS as a relayflow" — today a run can only be shown CREATED) and
-gate 3 ("every claim/lease/retry served by the kernel").
+## Objective
 
-`sdk/tests/live-kernel.test.ts` around the `live-manual-agent` case (line 288)
-shows the whole shape: connect, `hello`, `workerAttach` with pins, receive
-`step.dispatch`, act, complete. The protocol is already proven there.
+Create `.github/workflows/review-swarm.yml` that automatically triggers the existing `workflows/review-swarm.yaml` workflow when a PR is opened, synchronized, or reopened by a drive-loop author (`kjgbot`, `miyaontherelay`). The swarm transcripts are fetched and posted as PR comments.
 
 ## Files in scope
 
-- `sdk/src/worker.ts` — new file, the worker implementation
-- `sdk/src/index.ts` — export the worker
-- `sdk/tests/live-kernel.test.ts` OR a new test file — add a test that runs a
-  real flow with an agent step end to end against a live `relayflowd`, with
-  this worker attached, and asserts the step reaches `done`.
+- `.github/workflows/review-swarm.yml` (to be created)
+- `.github/workflows/scripts/swarm-post.sh` (optional helper script for posting comments)
+- `README.md` or a doc in `docs/` (update to document `RELAY_WORKSPACE_KEY` secret requirement)
 
 ## Definition of done
 
 ALL of the following must hold:
 
-1. The worker in `sdk/src/worker.ts`, exported from `sdk/src/index.ts`
-
-2. A test that runs a real flow with an agent step end to end against a live
-   `relayflowd`, with this worker attached, and asserts the step reaches
-   `done`. `sdk/tests/live-kernel.test.ts` already starts a daemon — follow
-   that pattern.
-
-3. **The worker must attach BEFORE the run starts.** A run that finds no worker
-   parks, and attaching afterwards does not re-drive it — `run.resume` is what
-   picks a parked run back up. That contract is pinned in the live-kernel
-   suite; do not fight it.
-
-4. The worker must:
-   - attach for `agent` steps with the pins it holds
-   - on `step.dispatch`, run the step's declared `cli` as a subprocess
-   - report the result back through the existing protocol (`step.complete`, and
-     the failure path when the CLI exits nonzero)
-   - nothing speculative: no retries of its own, no scheduling, no LLM calls.
-     The kernel owns retry and lease policy — do not reimplement it.
-
-5. `cd sdk && npm test` must be green. Run it and paste the literal command and
-   output tail showing test counts.
-
-6. `cd kernel && sh ../ops/cargo.sh test` must be green. Run it and paste the
-   literal command and output tail showing test counts.
-
-7. EVERY new test confirmed to FAIL against current code, with the literal
-   failing output quoted in the summary.
-
-8. As your LAST action, run `git status --porcelain` and paste it.
-
-## Explicitly OUT of scope
-
-- LLM steps — not in the gate 3 scope
-- Retry logic in the worker — the kernel owns retry policy
-- Scheduling or lease management — the kernel owns lease policy
-- Optimizations, abstractions, or speculative features
-- Changes to the kernel
-- Changes to existing tests (except adding new test cases)
+1. **`.github/workflows/review-swarm.yml` exists and is syntactically valid**
+   - Must pass `actionlint` if installed, otherwise `yamllint`
+   - Command to verify:
+     ```
+     actionlint .github/workflows/review-swarm.yml || yamllint .github/workflows/review-swarm.yml
+     ```
+   - Paste literal command and output
+
+2. **Workflow triggers correctly scoped**
+   - Triggers on: `pull_request` events `opened`, `synchronize`, `reopened`
+   - Only runs if PR author is `kjgbot` or `miyaontherelay`
+   - The job's `if` condition must correctly gate on drive-loop author only
+   - Verify the expression evaluates true for `kjgbot` and false for `khaliqgant`
+   - Paste the actual conditional expression from the workflow
+
+3. **Documentation updated**
+   - `README.md` or `docs/` contains a sentence describing the `RELAY_WORKSPACE_KEY` repo secret requirement
+   - States what it's for (running the review swarm in GitHub Actions)
+   - Command to verify:
+     ```
+     grep -r "RELAY_WORKSPACE_KEY" README.md docs/
+     ```
+   - Paste literal command and matching lines
+
+4. **Dry-run test of the posting logic** (if applicable)
+   - If a helper script is created (`.github/workflows/scripts/swarm-post.sh`), test it manually against an existing completed cloud run
+   - Command format:
+     ```
+     bash .github/workflows/scripts/swarm-post.sh <runId> <PR-number>
+     ```
+   - Paste actual command and output showing posted comment URL
+   - If no helper script created, describe inline posting logic in the workflow
+
+5. **SDK tests remain green**
+   - Command:
+     ```
+     cd sdk && npm test
+     ```
+   - Paste literal command and full output showing test counts
+
+6. **Final state verification**
+   - Command:
+     ```
+     git status --porcelain
+     ```
+   - Paste literal output
+
+## Explicitly OUT of scope for this tick
+
+- Actually running the workflow in GitHub Actions (requires the `RELAY_WORKSPACE_KEY` secret to exist in the repo)
+- Modifying `workflows/review-swarm.yaml` (it already exists and is working)
+- Modifying any kernel code in `kernel/`
+- Modifying SDK code in `sdk/` (except to fix failures)
+- Creating any tests in `kernel/` or modifying existing tests there
+- Touching `ops/cargo.sh`, `sdk/src/worker.ts`, `sdk/src/work-package-validator.ts`, or any files from closed PRs listed in ops/TARGET.md
 - Work on any gate other than gate 3
 
-## If blocked
+## Known blocker: RELAY_WORKSPACE_KEY prerequisite
+
+Per ops/TARGET.md lines 89-94, the `RELAY_WORKSPACE_KEY` must exist as a GitHub Actions secret on `AgentWorkforce/flows`. This cannot be verified in this environment (no `gh` auth, no network to GitHub).
 
-If gate 3 is genuinely unreachable from the current state, write
-ops/NEEDS_HUMAN.md saying exactly why and still end with ASSESS_DONE. Do not
-silently substitute different work: a run that reports progress on the wrong
-gate is worse than one that reports it is blocked.
+If the secret is missing, this is documented in ops/NEEDS_HUMAN.md and does not block creation of the workflow file itself. A working workflow that stalls at the auth step, plus documentation of the missing secret, is a complete deliverable.