feat(automation): route trusted review-agent mentions

.github/pr787-payload-repair.trigger

@@ -0,0 +1 @@
+Trigger the exact-head payload-binding repair workflow after the quality gate identified the missing Noema base-branch identity field.

.github/workflows/agent-mention-noema-dispatch.yml

@@ -0,0 +1,96 @@
+name: Agent Mention Noema Dispatch
+run-name: >-
+  Agent Mention Noema ${{ github.event.client_payload.target_repository }}#${{
+  github.event.client_payload.pr_number }} [cwl-agent-invocation:${{
+  github.event.client_payload.agent_invocation_key }}]
+
+on:
+  repository_dispatch:
+    types: [agent-mention-noema]
+
+concurrency:
+  group: agent-mention-noema-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
+  cancel-in-progress: false
+
+permissions:
+  actions: read
+  contents: write
+
+jobs:
+  validate-and-forward:
+    if: github.repository == 'ContextualWisdomLab/.github'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REQUESTED_AGENT: "cwl-noema-review"
+      PAYLOAD_AGENT: ${{ github.event.client_payload.requested_agent || '' }}
+      INVOCATION_KEY: ${{ github.event.client_payload.agent_invocation_key || '' }}
+      TARGET_REPOSITORY: ${{ github.event.client_payload.target_repository || '' }}
+      PR_NUMBER: ${{ github.event.client_payload.pr_number || '' }}
+      PR_HEAD_SHA: ${{ github.event.client_payload.pr_head_sha || '' }}
+      REQUESTED_BY: ${{ github.event.client_payload.requested_by || '' }}
+      SOURCE_COMMENT_ID: ${{ github.event.client_payload.source_comment_id || '' }}
+    steps:
+      - name: Validate exact invocation and elect one durable leader
+        id: leader
+        run: |
+          set -euo pipefail
+          if [ "$PAYLOAD_AGENT" != "$REQUESTED_AGENT" ] ||
+            ! [[ "$INVOCATION_KEY" =~ ^[0-9a-f]{64}$ ]] ||
+            ! [[ "$TARGET_REPOSITORY" =~ ^ContextualWisdomLab/[A-Za-z0-9_.-]+$ ]] ||
+            ! [[ "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]] ||
+            ! [[ "$PR_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]] ||
+            ! [[ "$SOURCE_COMMENT_ID" =~ ^[1-9][0-9]*$ ]] ||
+            ! [[ "$REQUESTED_BY" =~ ^[A-Za-z0-9-]+$ ]]; then
+            echo "::error::Rejected malformed or mismatched Noema agent invocation payload."
+            exit 1
+          fi
+
+          marker="[cwl-agent-invocation:${INVOCATION_KEY}]"
+          leader_id="$(
+            gh api --paginate --slurp \
+              "repos/${GITHUB_REPOSITORY}/actions/workflows/agent-mention-noema-dispatch.yml/runs?event=repository_dispatch&per_page=100" \
+              | jq -r --arg marker "$marker" '
+                  [.[].workflow_runs[]
+                    | select((.display_title // "") | contains($marker))
+                    | .id]
+                  | min // empty
+                '
+          )"
+          if [ -z "$leader_id" ]; then
+            echo "::error::Could not establish the durable Noema invocation leader."
+            exit 1
+          fi
+          if [ "$leader_id" != "$GITHUB_RUN_ID" ]; then
+            echo "forward=false" >>"$GITHUB_OUTPUT"
+            echo "Duplicate exact-key invocation suppressed by durable workflow-run identity."
+            exit 0
+          fi
+          echo "forward=true" >>"$GITHUB_OUTPUT"
+
+      - name: Forward once to the authoritative Noema workflow
+        if: steps.leader.outputs.forward == 'true'
+        run: |
+          set -euo pipefail
+          jq -n \
+            --arg target_repository "$TARGET_REPOSITORY" \
+            --argjson pr_number "$PR_NUMBER" \
+            --arg pr_head_sha "$PR_HEAD_SHA" \
+            --arg requested_agent "$REQUESTED_AGENT" \
+            --arg agent_invocation_key "$INVOCATION_KEY" \
+            --arg requested_by "$REQUESTED_BY" \
+            --argjson source_comment_id "$SOURCE_COMMENT_ID" \
+            '{
+              event_type: "noema-review",
+              client_payload: {
+                target_repository: $target_repository,
+                pr_number: $pr_number,
+                pr_head_sha: $pr_head_sha,
+                requested_agent: $requested_agent,
+                agent_invocation_key: $agent_invocation_key,
+                requested_by: $requested_by,
+                source_comment_id: $source_comment_id
+              }
+            }' \
+            | gh api "repos/${GITHUB_REPOSITORY}/dispatches" -X POST --input -

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -0,0 +1,116 @@
+name: Agent Mention OpenCode Dispatch
+run-name: >-
+  Agent Mention OpenCode ${{ github.event.client_payload.target_repository }}#${{
+  github.event.client_payload.pr_number }} [cwl-agent-invocation:${{
+  github.event.client_payload.agent_invocation_key }}]
+
+on:
+  repository_dispatch:
+    types: [agent-mention-opencode]
+
+concurrency:
+  group: agent-mention-opencode-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
+  cancel-in-progress: false
+
+permissions:
+  actions: read
+  contents: write
+
+jobs:
+  validate-and-forward:
+    if: github.repository == 'ContextualWisdomLab/.github'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REQUESTED_AGENT: "opencode-agent"
+      PAYLOAD_AGENT: ${{ github.event.client_payload.requested_agent || '' }}
+      INVOCATION_KEY: ${{ github.event.client_payload.agent_invocation_key || '' }}
+      TARGET_REPOSITORY: ${{ github.event.client_payload.target_repository || '' }}
+      PR_NUMBER: ${{ github.event.client_payload.pr_number || '' }}
+      PR_HEAD_SHA: ${{ github.event.client_payload.pr_head_sha || '' }}
+      BASE_BRANCH: ${{ github.event.client_payload.base_branch || '' }}
+      REQUESTED_BY: ${{ github.event.client_payload.requested_by || '' }}
+      SOURCE_COMMENT_ID: ${{ github.event.client_payload.source_comment_id || '' }}
+      TRIGGER_REVIEWS: ${{ github.event.client_payload.trigger_reviews }}
+      REVIEW_DISPATCH_LIMIT: ${{ github.event.client_payload.review_dispatch_limit || '' }}
+      ENABLE_AUTO_MERGE: ${{ github.event.client_payload.enable_auto_merge }}
+      UPDATE_BRANCHES: ${{ github.event.client_payload.update_branches }}
+      MERGE_MODE: ${{ github.event.client_payload.merge_mode || '' }}
+    steps:
+      - name: Validate exact review-only invocation and elect one durable leader
+        id: leader
+        run: |
+          set -euo pipefail
+          if [ "$PAYLOAD_AGENT" != "$REQUESTED_AGENT" ] ||
+            ! [[ "$INVOCATION_KEY" =~ ^[0-9a-f]{64}$ ]] ||
+            ! [[ "$TARGET_REPOSITORY" =~ ^ContextualWisdomLab/[A-Za-z0-9_.-]+$ ]] ||
+            ! [[ "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]] ||
+            ! [[ "$PR_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]] ||
+            ! [[ "$BASE_BRANCH" =~ ^[A-Za-z0-9._/-]+$ ]] ||
+            [[ "$BASE_BRANCH" == -* ]] ||
+            ! [[ "$SOURCE_COMMENT_ID" =~ ^[1-9][0-9]*$ ]] ||
+            ! [[ "$REQUESTED_BY" =~ ^[A-Za-z0-9-]+$ ]] ||
+            [ "$TRIGGER_REVIEWS" != "true" ] ||
+            [ "$REVIEW_DISPATCH_LIMIT" != "1" ] ||
+            [ "$ENABLE_AUTO_MERGE" != "false" ] ||
+            [ "$UPDATE_BRANCHES" != "false" ] ||
+            [ "$MERGE_MODE" != "disabled" ]; then
+            echo "::error::Rejected malformed, mismatched, or mutation-capable OpenCode invocation payload."
+            exit 1
+          fi
+
+          marker="[cwl-agent-invocation:${INVOCATION_KEY}]"
+          leader_id="$(
+            gh api --paginate --slurp \
+              "repos/${GITHUB_REPOSITORY}/actions/workflows/agent-mention-opencode-dispatch.yml/runs?event=repository_dispatch&per_page=100" \
+              | jq -r --arg marker "$marker" '
+                  [.[].workflow_runs[]
+                    | select((.display_title // "") | contains($marker))
+                    | .id]
+                  | min // empty
+                '
+          )"
+          if [ -z "$leader_id" ]; then
+            echo "::error::Could not establish the durable OpenCode invocation leader."
+            exit 1
+          fi
+          if [ "$leader_id" != "$GITHUB_RUN_ID" ]; then
+            echo "forward=false" >>"$GITHUB_OUTPUT"
+            echo "Duplicate exact-key invocation suppressed by durable workflow-run identity."
+            exit 0
+          fi
+          echo "forward=true" >>"$GITHUB_OUTPUT"
+
+      - name: Forward once to the authoritative review-only scheduler
+        if: steps.leader.outputs.forward == 'true'
+        run: |
+          set -euo pipefail
+          jq -n \
+            --arg target_repository "$TARGET_REPOSITORY" \
+            --argjson pr_number "$PR_NUMBER" \
+            --arg pr_head_sha "$PR_HEAD_SHA" \
+            --arg base_branch "$BASE_BRANCH" \
+            --arg requested_agent "$REQUESTED_AGENT" \
+            --arg agent_invocation_key "$INVOCATION_KEY" \
+            --arg requested_by "$REQUESTED_BY" \
+            --argjson source_comment_id "$SOURCE_COMMENT_ID" \
+            '{
+              event_type: "merge-scheduler",
+              client_payload: {
+                target_repository: $target_repository,
+                pr_number: $pr_number,
+                pr_head_sha: $pr_head_sha,
+                base_branch: $base_branch,
+                trigger_reviews: true,
+                review_dispatch_limit: "1",
+                enable_auto_merge: false,
+                update_branches: false,
+                merge_mode: "disabled",
+                requested_agent: $requested_agent,
+                agent_invocation_key: $agent_invocation_key,
+                requested_by: $requested_by,
+                source_comment_id: $source_comment_id
+              }
+            }' \
+            | gh api "repos/${GITHUB_REPOSITORY}/dispatches" -X POST --input -

.github/workflows/agent-mention-router-quality-ci.yml

@@ -0,0 +1,96 @@
+name: Agent Mention Router Quality CI
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/workflows/agent-mention-router.yml"
+      - ".github/workflows/agent-mention-router-quality-ci.yml"
+      - ".github/workflows/agent-mention-noema-dispatch.yml"
+      - ".github/workflows/agent-mention-opencode-dispatch.yml"
+      - "scripts/ci/agent_mention_router.py"
+      - "scripts/ci/agent_mention_sweep.py"
+      - "tests/test_agent_mention_*.py"
+      - "requirements-opencode-review-ci-hashes.txt"
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/agent-mention-router.yml"
+      - ".github/workflows/agent-mention-router-quality-ci.yml"
+      - ".github/workflows/agent-mention-noema-dispatch.yml"
+      - ".github/workflows/agent-mention-opencode-dispatch.yml"
+      - "scripts/ci/agent_mention_router.py"
+      - "scripts/ci/agent_mention_sweep.py"
+      - "tests/test_agent_mention_*.py"
+      - "requirements-opencode-review-ci-hashes.txt"
+
+concurrency:
+  group: agent-mention-router-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  quality:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+      - name: Checkout exact head
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+      - name: Install exact hash-locked tooling
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+      - name: Run complete focused branch coverage
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          cat >"${RUNNER_TEMP}/agent-mention-coveragerc" <<'EOF'
+          [run]
+          branch = True
+          include =
+              scripts/ci/agent_mention_router.py
+              scripts/ci/agent_mention_sweep.py
+          [report]
+          fail_under = 100
+          show_missing = True
+          EOF
+          export COVERAGE_RCFILE="${RUNNER_TEMP}/agent-mention-coveragerc"
+          python -m coverage erase
+          python -m coverage run -m pytest -q \
+            tests/test_agent_mention_router.py \
+            tests/test_agent_mention_sweep.py \
+            tests/test_agent_mention_workflow_contract.py \
+            tests/test_agent_mention_idempotency.py \
+            tests/test_agent_mention_downstream_idempotency.py \
+            tests/test_agent_mention_receipt_authority.py
+          python -m coverage report --fail-under=100
+          python -m interrogate --fail-under=100 \
+            scripts/ci/agent_mention_router.py \
+            scripts/ci/agent_mention_sweep.py
+          python -m compileall -q \
+            scripts/ci/agent_mention_router.py \
+            scripts/ci/agent_mention_sweep.py \
+            tests/test_agent_mention_router.py \
+            tests/test_agent_mention_sweep.py \
+            tests/test_agent_mention_workflow_contract.py \
+            tests/test_agent_mention_idempotency.py \
+            tests/test_agent_mention_downstream_idempotency.py \
+            tests/test_agent_mention_receipt_authority.py
+          git diff --check