drive: cloud run fef37e36

.github/workflows/review-swarm.yml

@@ -0,0 +1,98 @@
+name: Review swarm
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: review-swarm-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-24.04
+    # Ordering invariant: job 75m > poll 65m > swarm 60m.
+    timeout-minutes: 75
+    steps:
+      - name: Check out PR head
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: pr-head
+          fetch-depth: 0
+
+      - name: Check out immutable gate from main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          path: main-gate
+          sparse-checkout: |
+            workflows/review-swarm.yaml
+            .github/workflows/scripts
+          sparse-checkout-cone-mode: false
+
+      - name: Validate RELAY_WORKSPACE_KEY
+        env:
+          RELAY_WORKSPACE_KEY: ${{ secrets.RELAY_WORKSPACE_KEY }}
+        run: |
+          if [ "$RELAY_WORKSPACE_KEY" == '' ]; then
+            echo "RELAY_WORKSPACE_KEY secret not configured; see README §Cloud review swarm" >&2
+            exit 1
+          fi
+
+      - name: Install Agent Relay
+        run: npm install --global agent-relay
+
+      - name: Prepare review target on authenticated host
+        working-directory: pr-head
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: ../main-gate/.github/workflows/scripts/swarm-prepare.sh "${{ github.event.pull_request.number }}" ../main-gate/.github/workflows/scripts/swarm-verdict.sh
+
+      - name: Launch cloud swarm
+        id: launch
+        working-directory: pr-head
+        env:
+          RELAY_API_KEY: ${{ secrets.RELAY_WORKSPACE_KEY }}
+        run: |
+          response=$(agent-relay cloud run ../main-gate/workflows/review-swarm.yaml --sync-code --json)
+          run_id=$(jq -r '.runId // .run_id // .id // empty' <<< "$response")
+          [ -n "$run_id" ] || { echo "cloud run returned no run id: $response" >&2; exit 1; }
+          echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+
+      - name: Wait for terminal status
+        id: wait
+        if: steps.launch.outputs.run_id != ''
+        env:
+          RELAY_API_KEY: ${{ secrets.RELAY_WORKSPACE_KEY }}
+        run: |
+          # Ordering invariant: poll 3900s (65m) > swarm 3600s (60m).
+          deadline=$((SECONDS + 3900))
+          swarm_status=timed_out
+          while [ "$SECONDS" -lt "$deadline" ]; do
+            response=$(agent-relay cloud status "${{ steps.launch.outputs.run_id }}" --json) || { sleep 15; continue; }
+            swarm_status=$(jq -r '.status // .state // "unknown"' <<< "$response") || swarm_status=unknown
+            case "$swarm_status" in completed|failed|cancelled) break ;; esac
+            sleep 15
+          done
+          echo "swarm_status=$swarm_status" >> "$GITHUB_OUTPUT"
+          exit 0
+
+      - name: Post swarm evidence
+        if: always() && steps.launch.outputs.run_id != '' # post even after rejection
+        working-directory: pr-head
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELAY_API_KEY: ${{ secrets.RELAY_WORKSPACE_KEY }}
+        run: ../main-gate/.github/workflows/scripts/swarm-post.sh "${{ steps.launch.outputs.run_id }}" "${{ github.event.pull_request.number }}" ../main-gate/.github/workflows/scripts/swarm-verdict.sh
+
+      - name: Gate on cloud completion
+        if: steps.wait.outputs.swarm_status != 'completed'
+        run: |
+          echo "review swarm did not complete: ${{ steps.wait.outputs.swarm_status }}" >&2
+          exit 1

.github/workflows/scripts/swarm-post.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+run_id=${1:?usage: swarm-post.sh RUN_ID PR_NUMBER TRUSTED_VERDICT_SCRIPT}
+pr=${2:?usage: swarm-post.sh RUN_ID PR_NUMBER TRUSTED_VERDICT_SCRIPT}
+trusted_verdict=${3:?usage: swarm-post.sh RUN_ID PR_NUMBER TRUSTED_VERDICT_SCRIPT}
+sync_started=$(date +%s)
+
+agent-relay cloud sync "$run_id"
+# source the immutable checkout's swarm-verdict.sh, supplied by the workflow.
+# shellcheck source=/dev/null
+source "$trusted_verdict"
+
+swarm_evaluate ops/reviews "$pr" || true
+fresh=1
+while IFS='|' read -r lens verdict transcript; do
+  [ -n "$lens" ] || continue
+  if [ -z "$transcript" ] || [ ! -f "$transcript" ]; then
+    fresh=0
+  else
+    mtime=$(stat -c %Y "$transcript")
+    [ "$mtime" -ge "$sync_started" ] || fresh=0
+  fi
+done <<< "$SWARM_RESULTS"
+[ "$fresh" -eq 1 ] || SWARM_OVERALL=FAILED
+
+upsert_comment() {
+  local anchor=$1 body_file=$2 comment_id
+  comment_id=$(gh api --paginate "repos/${GITHUB_REPOSITORY}/issues/${pr}/comments" \
+    --jq ".[] | select(.body | contains(\"${anchor}\")) | .id" | head -n 1)
+  if [ -n "$comment_id" ]; then
+    gh api --method PATCH "repos/${GITHUB_REPOSITORY}/issues/comments/${comment_id}" \
+      -F "body=@${body_file}" >/dev/null
+  else
+    gh api --method POST "repos/${GITHUB_REPOSITORY}/issues/${pr}/comments" \
+      -F "body=@${body_file}" >/dev/null
+  fi
+}
+
+while IFS='|' read -r lens verdict transcript; do
+  [ -n "$lens" ] || continue
+  body=$(mktemp)
+  {
+    echo "<!-- swarm-lens: $lens -->"
+    echo "### Review swarm: $lens — $verdict"
+    echo
+    if [ -n "$transcript" ] && [ -f "$transcript" ]; then cat "$transcript"; else echo "Transcript missing."; fi
+  } > "$body"
+  upsert_comment "<!-- swarm-lens: $lens -->" "$body"
+  rm -f "$body"
+done <<< "$SWARM_RESULTS"
+
+marker=$(mktemp)
+{
+  echo '<!-- swarm-marker -->'
+  echo "### Review swarm: $SWARM_OVERALL"
+  echo
+  echo "Cloud run: \`$run_id\`. All three current-run transcripts must pass."
+} > "$marker"
+upsert_comment '<!-- swarm-marker -->' "$marker"
+rm -f "$marker"
+
+[ "$SWARM_OVERALL" = PASSED ]

.github/workflows/scripts/swarm-prepare.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+pr=${1:?usage: swarm-prepare.sh PR_NUMBER TRUSTED_VERDICT_SCRIPT}
+trusted_verdict=${2:?usage: swarm-prepare.sh PR_NUMBER TRUSTED_VERDICT_SCRIPT}
+
+case "$pr" in *[!0-9]*|'') echo "invalid PR number: $pr" >&2; exit 1 ;; esac
+[ -f "$trusted_verdict" ] || { echo "trusted verdict script missing" >&2; exit 1; }
+
+mkdir -p .review-target
+printf '%s\n' "$pr" > .review-target/pr-number
+gh pr diff "$pr" > .review-target/pr.diff
+gh pr view "$pr" --json headRefName,headRefOid,title,url > .review-target/pr.json
+cp "$trusted_verdict" .review-target/swarm-verdict.sh
+git add -f .review-target/pr-number .review-target/pr.diff \
+  .review-target/pr.json .review-target/swarm-verdict.sh

.github/workflows/scripts/swarm-verdict.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+# Shared, fail-closed transcript selection and verdict extraction.
+swarm_latest_transcript() {
+  local reviews_dir=$1 pr=$2 lens=$3
+  find "$reviews_dir" -maxdepth 1 -type f \
+    -name "*-pr${pr}-${lens}.md" -printf '%f\n' 2>/dev/null \
+    | LC_ALL=C sort \
+    | tail -n 1 \
+    | sed "s|^|${reviews_dir}/|"
+}
+
+swarm_transcript_verdict() {
+  local transcript=$1 last_line token
+  [ -n "$transcript" ] && [ -f "$transcript" ] || {
+    printf '%s\n' MISSING
+    return
+  }
+  last_line=$(awk 'NF { line=$0 } END { print line }' "$transcript")
+  token=$(printf '%s\n' "$last_line" | awk '{ print $NF }')
+  case "$token" in
+    REVIEW_PASSED) printf '%s\n' PASSED ;;
+    REVIEW_FAILED) printf '%s\n' FAILED ;;
+    *) printf '%s\n' UNCLEAR ;;
+  esac
+}
+
+swarm_evaluate() {
+  local reviews_dir=$1 pr=$2 lens transcript verdict
+  SWARM_OVERALL=PASSED
+  SWARM_RESULTS=
+  for lens in maintainability history structure; do
+    transcript=$(swarm_latest_transcript "$reviews_dir" "$pr" "$lens")
+    verdict=$(swarm_transcript_verdict "$transcript")
+    [ "$verdict" = PASSED ] || SWARM_OVERALL=FAILED
+    SWARM_RESULTS="${SWARM_RESULTS}${lens}|${verdict}|${transcript}"$'\n'
+  done
+  export SWARM_OVERALL SWARM_RESULTS
+  [ "$SWARM_OVERALL" = PASSED ]
+}

.gitignore

@@ -7,7 +7,6 @@ dist/
 .env
 .agentworkforce/
 .cargo-home/
-.review-target
 
 # Toolchains materialize inside the workspace in a cloud sandbox and must never
 # be committed or delivered. Run f18ec684's patch carried .rustup-home/ files;

README.md

@@ -31,3 +31,17 @@ Nine gates, in `docs/RFC-0001` §3. Gate 1 first: a relayflow can run — the he
 ladder survives `kill -9` at every boundary.
 
 Private while we build. YC 2026-09-15 runs on this base.
+
+## Cloud review swarm
+
+The `review-swarm.yml` GitHub Actions workflow requires a repository Actions
+secret named `RELAY_WORKSPACE_KEY`. Obtain the unmasked key for the canonical
+workspace with:
+
+```bash
+agent-relay workspace key --reveal-secrets
+```
+
+Add that value under **Settings → Secrets and variables → Actions → New
+repository secret**. The workflow deliberately fails during preflight when the
+secret is absent; it never falls back to interactive authentication.