drive: cloud run 4d577b53

.github/workflows/review-swarm.yml

@@ -0,0 +1,71 @@
+---
+name: Review swarm
+
+"on":
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+concurrency:
+  group: review-swarm-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    if: >-
+      github.event.pull_request.user.login == 'kjgbot' ||
+      github.event.pull_request.user.login == 'miyaontherelay'
+    runs-on: ubuntu-latest
+    timeout-minutes: 50
+    env:
+      GH_TOKEN: ${{ github.token }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+      RELAY_WORKSPACE_KEY: ${{ secrets.RELAY_WORKSPACE_KEY }}
+    steps:
+      - name: Check out pull request merge commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+          fetch-depth: 0
+
+      - name: Install Agent Relay
+        run: npm install --global agent-relay@11.8.2
+
+      - name: Set review target
+        run: echo "$PR_NUMBER" > .review-target
+
+      - name: Start review swarm
+        id: start
+        run: |
+          response=$(
+            agent-relay cloud run workflows/review-swarm.yaml --json
+          )
+          run_id=$(jq -er '.runId' <<<"$response")
+          echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+          echo "Started cloud run $run_id"
+
+      - name: Wait for review swarm
+        env:
+          RUN_ID: ${{ steps.start.outputs.run_id }}
+        run: |
+          deadline=$((SECONDS + 2700))
+          while (( SECONDS < deadline )); do
+            status=$(
+              agent-relay cloud status "$RUN_ID" --json | jq -er '.status'
+            )
+            echo "Cloud run $RUN_ID: $status"
+            if [[ "$status" == "completed" ]]; then
+              exit 0
+            fi
+            sleep 30
+          done
+          echo "Timed out waiting 45 minutes for cloud run $RUN_ID" >&2
+          exit 1
+
+      - name: Post review comments
+        env:
+          RUN_ID: ${{ steps.start.outputs.run_id }}
+        run: bash .github/workflows/scripts/swarm-post.sh "$RUN_ID" "$PR_NUMBER"

.github/workflows/scripts/swarm-post.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+run_id="${1:-}"
+pr_number="${2:-}"
+
+if [[ -z "$run_id" || ! "$pr_number" =~ ^[0-9]+$ ]]; then
+  echo "usage: bash $0 <runId> <PR-number>" >&2
+  exit 64
+fi
+
+agent-relay cloud sync "$run_id"
+logs=$(agent-relay cloud logs "$run_id")
+
+declare -A verdicts
+for lens in maintainability history structure; do
+  review=$(find ops/reviews -maxdepth 1 -type f \
+    -name "*-pr${pr_number}-${lens}.md" -printf '%T@ %p\n' |
+    sort -nr | head -1 | cut -d' ' -f2-)
+  if [[ -z "$review" ]]; then
+    echo "No $lens review found for PR #$pr_number" >&2
+    exit 1
+  fi
+
+  if grep -q 'REVIEW_FAILED' "$review"; then
+    verdicts[$lens]=FAILED
+  elif grep -q 'REVIEW_PASSED' "$review"; then
+    verdicts[$lens]=PASSED
+  else
+    echo "$review has no review verdict" >&2
+    exit 1
+  fi
+
+  gh pr comment "$pr_number" --body-file "$review"
+done
+
+if grep -q 'SWARM_PASSED' <<<"$logs"; then
+  swarm_verdict=PASSED
+elif grep -q 'SWARM_FAILED' <<<"$logs"; then
+  swarm_verdict=FAILED
+else
+  echo "Cloud run $run_id has no aggregate swarm verdict" >&2
+  exit 1
+fi
+
+marker="🎯 review-swarm: $swarm_verdict (M:${verdicts[maintainability]} H:${verdicts[history]} S:${verdicts[structure]})"
+gh pr comment "$pr_number" --body "$marker"

README.md

@@ -30,3 +30,5 @@ Nine gates, in `docs/RFC-0001` §3. Gate 1 first: a relayflow can run — the he
 ladder survives `kill -9` at every boundary.
 
 Private while we build. YC 2026-09-15 runs on this base.
+
+The review-swarm workflow requires the `RELAY_WORKSPACE_KEY` repository secret to authenticate its Agent Relay cloud run to the canonical workspace.

ops/ASSESS_SUMMARY.md

@@ -0,0 +1,68 @@
+# Assessment Summary
+
+**Date:** 2026-08-31 04:28 UTC
+**Gate:** 3 (review-swarm automation via GitHub Actions)
+**Status:** Work package written to ops/NEXT.md
+
+## Assessment performed
+
+1. ✓ Read ops/TARGET.md — gate 3 scope confirmed
+2. ✓ Read ops/STATE.md — ground truth about gates and open PRs
+3. ✓ Read ops/DIRECTIVES.md — empty, no standing directives
+4. ✓ Read charter/LEAD.md — confirmed constitution and responsibilities
+5. ✓ Read docs/bootstrap-report.md — gate 1 status
+6. ✓ Attempted git log — unavailable (cloud sandbox, no .git)
+7. ✓ Attempted gh pr list — unavailable (no gh auth)
+8. ✓ Read workflows/review-swarm.yaml — confirmed existing swarm workflow
+9. ✓ Verified SDK tests baseline — 197 tests passing
+10. ✓ Checked for .github/workflows/ — does not exist yet
+11. ✓ Verified agent-relay installed — available at /usr/local/share/nvm/current/bin/agent-relay
+12. ✓ Checked .env.example — RELAY_WORKSPACE_KEY documented
+
+## Current state
+
+**Gate 1:** GREEN (closed, PR #48)
+**Gate 2:** AMBER (in progress, proactive agent primitives landed but "real workload runs" bar not yet met)
+**Gate 3:** RED (not started — this is the work package)
+**Gates 4-9:** RED (not started)
+
+**Open PRs:** NONE (per ops/STATE.md updated 2026-08-30 02:55 UTC)
+
+## Work package scope (gate 3)
+
+Wire the review-swarm to fire automatically on PR open via GitHub Actions + `agent-relay cloud run`.
+
+**Why this matters (from TARGET.md):**
+`workflows/review-swarm.yaml` exists and works, but only fires manually. External bots (CodeRabbit, Devin) are unreliable. RFC-0001 §2 rule 7 requires OUR own review team. The swarm is that team — it just needs to be wired to GitHub Actions.
+
+**The task:**
+Create `.github/workflows/review-swarm.yml` that:
+- Triggers on PR open/synchronize/reopened
+- Gates on drive-loop authors only (kjgbot, miyaontherelay)
+- Invokes `agent-relay cloud run workflows/review-swarm.yaml`
+- Syncs results back and posts each review as a PR comment
+- Posts aggregate verdict marker
+
+**Definition of done:**
+1. Workflow file passes actionlint/yamllint
+2. RELAY_WORKSPACE_KEY requirement documented (1 sentence)
+3. Author gating expression verified (kjgbot/miyaontherelay=true, khaliqgant=false)
+4. Companion script `.github/workflows/scripts/swarm-post.sh` works against a real completed run
+5. SDK tests remain green (197 passing)
+6. git status --porcelain pasted
+
+**Out of scope:**
+- NOT creating the secret (human step if missing)
+- NOT fixing auth failures (file NEEDS_HUMAN)
+- NOT running in CI (dry-run only)
+- NOT touching kernel/preflight/worker.ts
+
+## Blockers
+
+**COMMIT FAILED:** Cloud sandbox has no git repository (known environment fault from ops/STATE.md §"Known environment faults in a cloud sandbox"). The work package was written to ops/NEXT.md but could not be committed to git history. This is expected in cloud sandboxes where `sync` runs in SYNC_MODE=snapshot.
+
+## Next action
+
+The work package is written to ops/NEXT.md. The assess-gate step will read it and proceed with implementation or parking as appropriate.
+
+**ASSESS_DONE** — work package complete, blocked on git unavailability (known sandbox limitation).

ops/NEEDS_HUMAN.md

@@ -0,0 +1,11 @@
+# Review-swarm credentials required
+
+The current environment is not authenticated to GitHub, so it cannot verify
+that `RELAY_WORKSPACE_KEY` exists in the `AgentWorkforce/flows` repository or
+post the definition-of-done test comments. A repository administrator must add
+the canonical workspace key as that Actions secret if it is absent.
+
+Agent Relay cloud authentication is also unavailable here: the CLI requests
+device authorization instead of reaching the laptop's canonical workspace. A
+human must authorize the environment and confirm that a cloud run launched with
+the repository secret reaches that same workspace.

ops/NEXT.md

@@ -1,87 +1,89 @@
 # NEXT — work package for this tick
 
-**Scope:** Build a minimal agent worker in the SDK. CODE task, SDK-side.
+**Gate:** 3
 
-This run is pinned to **gate 3** and must not work on any other gate.
+**Scope:**
+> Wire the review-swarm to fire on PR open via GitHub Actions + `agent-relay cloud run`. CODE task, `.github/workflows/`-side.
+> Add `.github/workflows/review-swarm.yml`. That is the only file this tick should create; the workflow it invokes already exists.
 
 ## Objective
 
-Promote the throwaway worker the tests already build into a real SDK component
-that can execute agent steps by running their declared CLI as a subprocess.
-
-## Context
-
-Nothing in this repo can execute an agent step. Searching for `workerAttach` /
-`step.complete` finds only TESTS (`sdk/tests/live-kernel.test.ts`,
-`journal-client.test.ts`, `journal-client-loopback.ts`) and the protocol
-definitions. `sdk/src/cli/run.ts` only OBSERVES worker leases and waits for one
-that never arrives.
-
-The kernel's dispatch, lease and claim machinery is real and tested. The worker
-side of the protocol is simply unimplemented, and that is what blocks gate 2
-("a workload RUNS as a relayflow" — today a run can only be shown CREATED) and
-gate 3 ("every claim/lease/retry served by the kernel").
-
-`sdk/tests/live-kernel.test.ts` around the `live-manual-agent` case (line 288)
-shows the whole shape: connect, `hello`, `workerAttach` with pins, receive
-`step.dispatch`, act, complete. The protocol is already proven there.
+Create a GitHub Actions workflow that automatically triggers the existing `workflows/review-swarm.yaml` relayflow on PR open/synchronize/reopened for drive-loop PRs only (authors: kjgbot, miyaontherelay). The swarm produces three independent reviews (maintainability, history, structure) and an aggregate verdict.
 
 ## Files in scope
 
-- `sdk/src/worker.ts` — new file, the worker implementation
-- `sdk/src/index.ts` — export the worker
-- `sdk/tests/live-kernel.test.ts` OR a new test file — add a test that runs a
-  real flow with an agent step end to end against a live `relayflowd`, with
-  this worker attached, and asserts the step reaches `done`.
+- `.github/workflows/review-swarm.yml` (NEW) — the GHA workflow
+- `.github/workflows/scripts/swarm-post.sh` (NEW) — companion script to post comments
+- `README.md` or `docs/` — document RELAY_WORKSPACE_KEY secret requirement (one sentence)
 
 ## Definition of done
 
-ALL of the following must hold:
-
-1. The worker in `sdk/src/worker.ts`, exported from `sdk/src/index.ts`
-
-2. A test that runs a real flow with an agent step end to end against a live
-   `relayflowd`, with this worker attached, and asserts the step reaches
-   `done`. `sdk/tests/live-kernel.test.ts` already starts a daemon — follow
-   that pattern.
+All of the following must be satisfied:
+
+1. **`.github/workflows/review-swarm.yml` exists and is valid:**
+   ```bash
+   actionlint .github/workflows/review-swarm.yml || yamllint .github/workflows/review-swarm.yml
+   ```
+   Must exit 0 and produce no errors.
+
+2. **Documentation added:**
+   README.md or docs/ describes the required repo secret `RELAY_WORKSPACE_KEY` and what it does — one sentence is enough.
+
+3. **Author gating works correctly:**
+   The workflow's `jobs.review.if` expression must be tested to verify it evaluates:
+   - TRUE for kjgbot
+   - TRUE for miyaontherelay
+   - FALSE for khaliqgant
+
+   Test the expression manually and paste the command + output.
+
+4. **Shell script exists and works:**
+   ```bash
+   bash .github/workflows/scripts/swarm-post.sh <runId> <PR-number>
+   ```
+   Must successfully post comments from a completed cloud run. Show it working against an EXISTING completed cloud run and quote the posted comment URL.
+
+5. **SDK tests remain green:**
+   ```bash
+   cd sdk && npm test
+   ```
+   All tests pass (currently 197 passed).
+
+6. **Git status clean at end:**
+   ```bash
+   git status --porcelain
+   ```
+   Paste the literal output as the LAST action.
+
+## Workflow requirements
+
+Trigger: `pull_request` events `opened`, `synchronize`, `reopened`
+Author filter: only kjgbot or miyaontherelay
+Concurrency: group per PR (cancel in-progress on new push)
+
+Steps:
+1. Checkout PR head at merge commit
+2. Install agent-relay (curl release or mise)
+3. `echo "$PR_NUMBER" > .review-target`
+4. `agent-relay cloud run workflows/review-swarm.yaml` with RELAY_WORKSPACE_KEY from secret; capture runId
+5. Poll `agent-relay cloud status <runId> --json` every 30s until status==completed or 45min timeout
+6. `agent-relay cloud sync <runId>` to fetch artifacts
+7. Read `ops/reviews/*-pr<N>-*.md`; post each as PR comment via `gh pr comment`
+8. Post aggregate marker: `🎯 review-swarm: PASSED|FAILED (M:<v> H:<v> S:<v>)` — grep for SWARM_PASSED or SWARM_FAILED from aggregate step stdout
 
-3. **The worker must attach BEFORE the run starts.** A run that finds no worker
-   parks, and attaching afterwards does not re-drive it — `run.resume` is what
-   picks a parked run back up. That contract is pinned in the live-kernel
-   suite; do not fight it.
-
-4. The worker must:
-   - attach for `agent` steps with the pins it holds
-   - on `step.dispatch`, run the step's declared `cli` as a subprocess
-   - report the result back through the existing protocol (`step.complete`, and
-     the failure path when the CLI exits nonzero)
-   - nothing speculative: no retries of its own, no scheduling, no LLM calls.
-     The kernel owns retry and lease policy — do not reimplement it.
-
-5. `cd sdk && npm test` must be green. Run it and paste the literal command and
-   output tail showing test counts.
-
-6. `cd kernel && sh ../ops/cargo.sh test` must be green. Run it and paste the
-   literal command and output tail showing test counts.
-
-7. EVERY new test confirmed to FAIL against current code, with the literal
-   failing output quoted in the summary.
+## Explicitly OUT of scope
 
-8. As your LAST action, run `git status --porcelain` and paste it.
+- **NOT creating the GitHub secret** — if `RELAY_WORKSPACE_KEY` is missing from `AgentWorkforce/flows` repo secrets, file ops/NEEDS_HUMAN.md and report it. The secret must be added manually by a human in repo settings.
+- **NOT fixing auth failures** — if `agent-relay cloud run` fails with auth errors, file ops/NEEDS_HUMAN.md. Do not invent workarounds.
+- **NOT running the workflow in CI** — dry-run testing only via the companion script.
+- **NOT touching any other files** — specifically do not modify preflight, kernel tests, or sdk/src/worker.ts (which is gate 3 SDK work, not workflow work).
+- **NOT working on gates 1, 2, 4-9** — this run is pinned to gate 3.
 
-## Explicitly OUT of scope
+## Prerequisites (block if missing)
 
-- LLM steps — not in the gate 3 scope
-- Retry logic in the worker — the kernel owns retry policy
-- Scheduling or lease management — the kernel owns lease policy
-- Optimizations, abstractions, or speculative features
-- Changes to the kernel
-- Changes to existing tests (except adding new test cases)
-- Work on any gate other than gate 3
+If either prerequisite fails, file ops/NEEDS_HUMAN.md:
 
-## If blocked
+1. `RELAY_WORKSPACE_KEY` must exist as a repo secret in AgentWorkforce/flows
+2. `agent-relay cloud run` must reach the same cloud workspace as the laptop
 
-If gate 3 is genuinely unreachable from the current state, write
-ops/NEEDS_HUMAN.md saying exactly why and still end with ASSESS_DONE. Do not
-silently substitute different work: a run that reports progress on the wrong
-gate is worse than one that reports it is blocked.
+A working workflow that stalls at auth + a NEEDS_HUMAN is a complete deliverable.