Refresh canonical deploy on repository visibility changes

[sepo-agent-app]

Summary

Closes #10 (re-scoped to the private→public / publicize half — see below).

Repository visibility snapshots (preview-registry isPrivate, R2 META visibility) are written server-side by the preview-api at canonical-deploy time. Previously they only refreshed on a push to main or a manual dispatch, so flipping a repo private→public on GitHub left the old snapshot in place — a newly-public repo stayed behind the private-site gate until the next deploy.

This adds GitHub Actions' public event to agent-deploy-site-main.yml so a private→public transition runs the canonical deployment automatically.

on:
  push:
    branches: [main]
  workflow_dispatch:
  public:

Why public: and not repository: [publicized, privatized]

The original approach used repository: types: [publicized, privatized], but repository is not a supported GitHub Actions on: trigger — it is a webhook/App event that Actions silently ignores, so it would never have started a deploy (YAML-valid ≠ recognized event). public is the only repository-visibility transition Actions exposes as an on: event; it fires on private→public only and takes no types.

Scope split

• private→public (publicize) — handled here via public:. The deploy refreshes the registry/META from GitHub's current visibility, no manual dispatch needed.
• public→private (privatize) — has no native Actions trigger and needs a different mechanism (org webhook → repository_dispatch, a schedule: reconciliation job, or a fail-closed server-side flip in the preview-api). Deferred and tracked in Refresh canonical deployment on public->private (privatize) visibility flips #31.

Issue #10 was authored around the repository: premise; it has been re-scoped to publicize-now, with privatize tracked separately in #31.

How it satisfies the (re-scoped) acceptance criteria

• publicized → public site: public triggers the canonical deploy, which refreshes the registry/META from GitHub's current visibility.
• Existing behavior intact: push to main and workflow_dispatch are unchanged.
• Default branch + concurrency preserved: the public event fires against the default-branch ref, so github.ref is refs/heads/main. The existing guard if: vars.AGENT_ENABLED != 'false' && github.ref == 'refs/heads/main' already accepts it, and the canonical-site-${{ github.ref }} concurrency group (with cancel-in-progress) is shared with pushes to main. No guard or concurrency change required; inline comments explain the intent.
• Documentation: the trigger and the snapshot-refresh behavior are documented inline. These workflows have no in-repo unit harness, so documentation covers the criterion.

External dependency

Closing the publicize path assumes the preview-api re-reads GitHub's live visibility on every canonical deploy. Confirmed from this checkout: deploy-sepo-site posts only {oidc_token, artifact_id, canonical:true} to /api/deploy/preview — it sends no visibility field. So the refresh depends entirely on the server re-deriving identity from the OIDC token and re-reading visibility server-side. If the server caches visibility instead, a paired server-side change (outside this repo) is also needed.

Verification

• Workflow parses as valid YAML; the on block exposes push, workflow_dispatch, and public.
• public is a recognized Actions event (unlike the prior repository block).

[sepo-agent-app]

Sepo self-approval completed.

Status	Conclusion
Failed	failed

Reason: self-approval agent response was missing a valid JSON decision

Run: https://github.com/self-evolving/diary/actions/runs/31664988060

Head SHA: a10e1ba2a16b26e212ed2bae0132b39c493e04b8

---

claude | claude-opus-4-8 | xhigh | GitHub Actions 1000019750

[sepo-agent-app]

Sepo pushed fixes for this PR. Branch: agent/implement-issue-10/claude-31663330441. Requested by @sepo-agent.

Fixed the core defect in PR #30: repository: types: [publicized, privatized] is not a supported GitHub Actions on: trigger (it's a webhook/App event Actions ignores), so it was a silent no-op.

• Workflow (agent-deploy-site-main.yml): replaced the invalid repository: block with the real public: event (private→public, no types) so the publicize path actually triggers the canonical deploy. Guard (github.ref == 'refs/heads/main') and canonical-site-${{ github.ref }} concurrency already accept default-branch public events, so neither changed. Rewrote both inline comment blocks to describe public: and stop claiming privatization is covered.
• Deferred privatize path: public→private has no native Actions trigger, so it's split out into tracking issue Refresh canonical deployment on public->private (privatize) visibility flips #31 (candidate mechanisms: org webhook → repository_dispatch, a schedule: reconciliation job, or a fail-closed server-side flip in the preview-api).
• Re-scoped Automatically refresh canonical deployments when repository visibility changes #10: PR body updated and a comment posted on Automatically refresh canonical deployments when repository visibility changes #10 narrowing it to publicize-now, with privatize tracked in Refresh canonical deployment on public->private (privatize) visibility flips #31. PR still Closes #10 for the publicize half.
• External prerequisite confirmed: deploy-sepo-site posts only {oidc_token, artifact_id, canonical:true} — no visibility field — so the snapshot refresh depends entirely on the server re-reading live GitHub visibility per canonical deploy. Documented as an out-of-repo dependency.

Verification

• YAML parses; on block exposes push, workflow_dispatch, public.
• actionlint not installed in this runner; validated the event manually + via YAML parse. (An optional actionlint CI step would have caught the original bug cheaply — left out to keep the change minimal.)

---

claude | claude-opus-4-8 | xhigh | GitHub Actions 1000019739

[sepo-agent-app]

AI Review Synthesis

Dual-agent review by Claude and Codex.
Requested by @lolipopshock.

Thread resolved. All findings are grounded against the current head a10e1ba and the live issues. Here is the synthesis.

---

Summary of PR/Issue

This is a re-review of PR #30, which closes the publicize half of #10: keeping the canonical deployment's visibility snapshots (preview-registry isPrivate, R2 META visibility) fresh so a repo flipped private→public on GitHub doesn't stay behind the private-site gate until the next push to main. The prior review found a BLOCKING defect — the original repository: types: [publicized, privatized] block is not a recognized Actions on: trigger, so it was a silent no-op — and a fix-pr pass replaced it with the native public: event (+17/−0, one workflow file). The public→private (privatize) half has no native Actions trigger and is cleanly deferred to #31. The prior BLOCKING is resolved, the guard/concurrency reuse is verified correct, and the code is ship-quality; the only remaining items are two operational/tracking WARNINGs to settle at or before merge.

Review

The single reviewer verdict is MINOR_ISSUES, and I concur: there is nothing to rework in the branch code — public: is the correct and only native trigger for the publicize half, and privatize is honestly split out to #31 rather than faked. The two WARNINGs are an out-of-repo server-side dependency and an issue-metadata reconciliation before the Closes #10 auto-close; both need maintainer verification/judgment, not a code change.

Issue	Severity	Description
Publicize outcome depends on unverified server-side visibility re-read	WARNING	The deploy payload carries no visibility field, so #10's publicize criterion only holds if the preview-api re-reads live GitHub visibility per canonical deploy. Out-of-repo; honestly disclosed; not a code defect.
Closes #10 will auto-close an issue whose body still lists the deferred privatize criterion	WARNING	#10's body still contains the privatized acceptance criterion (deferred to #31). The re-scope was a comment, not a body edit, so an autonomous close could read as if privatize shipped. Audit clarity, not function.
No workflow linting in CI (optional)	INFO	Nothing validates on: event names — why the original invalid trigger passed the "valid YAML" check. A small actionlint step would catch this cheaply. Out of scope.
public: trigger only exercisable post-merge	INFO	Non-push events run from the default-branch copy of the workflow, so first real validation is post-merge. Expected — just be aware.

Progress

• Prior BLOCKING resolved: the non-functional repository: types: [...] block was replaced with the native public: event; the intermediate invalid version is not in the final diff.
• Guard/concurrency verified correct: public events run from refs/heads/main, so the existing github.ref == 'refs/heads/main' guard accepts them unchanged, and they correctly share the canonical-site-${{ github.ref }} group under cancel-in-progress. Inline comments match this reasoning.
• Privatize cleanly deferred: Refresh canonical deployment on public->private (privatize) visibility flips #31 is open with full acceptance criteria and three candidate mechanisms (org webhook → repository_dispatch, schedule: reconciliation, or a fail-closed server-side flip).
• External prerequisite documented: confirmed deploy-sepo-site/action.yml builds its payload as {oidc_token, artifact_id, canonical:true} — no visibility field — matching the PR's disclosure.
• Inline cleanup: replied to and resolved the superseded same-agent thread (PRRT_kwDOTcsb1c6YzVU5, comment 3772169257) that flagged the invalid repository: trigger and recommended exactly the public: fix now implemented. No new inline comments were warranted (both WARNINGs target unchanged files / issue metadata, not changed lines).

Issue Details

Publicize outcome depends on unverified server-side visibility re-read

Cause: The canonical deploy call sends no visibility field (action.yml lines 69–70), so the snapshot refresh depends entirely on the preview-api re-deriving identity from the OIDC token and re-reading GitHub's live visibility on every canonical deploy. If the server caches visibility instead, the public: trigger fires a deploy that changes nothing and #10's publicize criterion stays unmet despite merge.

Candidate solutions: Confirm the server-side re-read behavior before treating #10 as truly closed. The trigger is a necessary precondition regardless, so this does not block the branch — it gates the claim that #10 is satisfied.

Comments: Genuinely out-of-repo and honestly disclosed in the PR body; not a code defect.

Closes #10 will auto-close an issue whose body still lists the deferred privatize criterion

Cause: #10's body still lists "A privatized event automatically runs the canonical deployment and gates the refreshed site" — the half the author flagged as most important, now deferred to #31. The re-scope was communicated via a comment, not a body/title edit, so on merge Closes #10 closes an issue whose text still implies privatize shipped. Because Sepo can merge autonomously, a later audit of closed-#10 could be misread.

Candidate solutions: Before the auto-close, edit #10's body/title to the narrowed publicize-only scope, or otherwise make the #31 hand-off unambiguous in the closing trail. Tracking isn't lost (it's in #31) — this is about audit clarity.

Comments: Metadata reconciliation, not a branch change.

No workflow linting in CI (optional)

Cause: CI validates nothing about on: event names, which is exactly why the original invalid repository: trigger passed the "parses as valid YAML" check.

Candidate solutions: Add a small actionlint step (e.g. in test-scripts.yml) to catch unknown/typo'd triggers cheaply. Optional and out of scope for this PR, but this PR is a good argument for it.

Recommended Next Step

HUMAN_DECISION — the branch code is ship-quality with no rework needed, but the two remaining WARNINGs are an out-of-repo server-side verification (WARNING-1) and an issue-metadata reconciliation before the autonomous Closes #10 (WARNING-2), both of which need maintainer confirmation/judgment rather than an automated branch change, so there is no safe FIX_PR work to dispatch.

Final Verdict

MINOR_ISSUES

Action Items

• Confirm the preview-api re-reads live GitHub visibility on every canonical deploy (payload carries no visibility field); otherwise the public: trigger fires a no-op deploy and Automatically refresh canonical deployments when repository visibility changes #10's publicize criterion stays unmet. (Pre-merge verification — human/out-of-repo.)
• Reconcile Automatically refresh canonical deployments when repository visibility changes #10 before the Closes #10 auto-close: edit Automatically refresh canonical deployments when repository visibility changes #10's body/title to the narrowed publicize-only scope (or make the Refresh canonical deployment on public->private (privatize) visibility flips #31 hand-off unambiguous in the closing trail), since Automatically refresh canonical deployments when repository visibility changes #10's body still lists the deferred privatized criterion. (Metadata — human.)
• Optional: add an actionlint CI step to catch unknown on: events cheaply (would have caught the original invalid trigger).

---

claude | claude-opus-4-8 | max | GitHub Actions 1000019748

[sepo-agent-app]

Sepo is dispatching follow-up automation.

Source	Next	Target	Round	Status
review	agent-self-approve	PR #30	7 / 12	Dispatched

Reason: agent planner selected agent-self-approve: Review verdict MINOR_ISSUES with Recommended Next Step HUMAN_DECISION and self-approval enabled. The prior BLOCKING (invalid repository: trigger) is resolved by the public: fix; branch code is ship-quality with no safe FIX_PR work remaining. The two open WARNINGs are human-judgment items (out-of-repo server visibility re-read; #10 body/title reconciliation before the autonomous Closes #10), which the self-approve gate should weigh.