[jmclong (jmclong)]

Summary

• Add a weekly Monday GitHub Agentic Workflow, with manual dispatch for branch testing, to maintain .github/copilot-instructions.md and Markdown review skills under .github/skills/.
• Keep root AGENTS.md as a short pointer to the Copilot instructions rather than duplicate guidance.
• Inspect merged PRs, accepted review feedback, issues, and source changes since the last successful run that actually executed the agent. Bootstrap with 30 days, ignore skipped/failed runs as cursors, and fail rather than silently accept incomplete inventories.
• Require source-backed, reusable lessons; avoid incident-specific rules, duplicate guidance, unverified issue proposals, and routine dependency churn. Account for rejected maintenance PRs.
• Open at most one scoped draft maintenance PR, wait while a previous proposal is open, and use an explicit no-op when no useful changes remain. The agent has no repository write permissions; writes go through restricted safe outputs targeting the default branch.
• Include the compiled lock, generated-file attributes, and narrowly scoped actionlint/zizmor compatibility rules for this generated workflow only. Exclude that compiled lock from DevSkim while retaining scanning of the authored Markdown; the generated framework configuration otherwise produces hash-of-time and loopback-address false positives.

Repository evidence informing the design

Recent socket wiring and lifecycle changes (#692), certificate ownership/upgrade discussion (#696), and feature-specific RBAC changes (#690 and #691), together with cleanup ownership and helper-resource reports (#659 and #458), informed the evidence checks. None of those examples is hardcoded into the workflow as a rule.

Validation

• gh aw compile maintain-agent-guidance --strict --validate --no-check-update passed.
• gh aw lint passed, retaining its warning about the compiler-owned safe-output checkout requiring Git credentials.
• All applicable pre-commit hooks passed, including Markdown, YAML, actionlint, zizmor, codespell, and link checks.
• One-off checks exercised bootstrap, skipped-run baseline selection, source commit inventory, pagination, oversized/incomplete results, count drift, and divergent history.
• git diff --check passed.
• Go builds/tests are not applicable: no Go code or runtime behavior changes.

Live verification

Manual startup was attempted from commit 19c01e7c54773805e209e181a172d23d94f1a68b. The gh-aw CLI could not find the new workflow in the repository registry, and a direct workflow-dispatch API request returned HTTP 404. No agent run started; GitHub requires this workflow to exist on the default branch before manual dispatch is available. Scheduled execution starts only after the workflow is on the default branch. Copilot inference uses the Actions token with copilot-requests: write; organization policy and repository permissions still govern execution and PR creation.