fix(strix): bind evidence to exact workflow artifacts

.github/workflows/agent-mention-noema-dispatch.yml

@@ -11,7 +11,6 @@ on:
 concurrency:
   group: agent-mention-noema-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
   cancel-in-progress: false
-  queue: max
 
 permissions:
   contents: read

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -11,7 +11,6 @@ on:
 concurrency:
   group: agent-mention-opencode-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
   cancel-in-progress: false
-  queue: max
 
 permissions:
   contents: read
@@ -36,11 +35,15 @@ jobs:
       BASE_BRANCH: ${{ github.event.client_payload.base_branch || '' }}
       REQUESTED_BY: ${{ github.event.client_payload.requested_by || '' }}
       SOURCE_COMMENT_ID: ${{ github.event.client_payload.source_comment_id || '' }}
-      TRIGGER_REVIEWS: "true"
-      REVIEW_DISPATCH_LIMIT: "1"
-      ENABLE_AUTO_MERGE: "false"
-      UPDATE_BRANCHES: "false"
-      MERGE_MODE: "disabled"
+      # The router intentionally omits these immutable review-only controls so
+      # the repository_dispatch payload stays under GitHub's 10-property cap.
+      # The trusted wrapper reconstructs the canonical values before validating
+      # the invocation key, so transport minimization cannot weaken claim binding.
+      TRIGGER_REVIEWS: ${{ github.event.client_payload.trigger_reviews || 'true' }}
+      REVIEW_DISPATCH_LIMIT: ${{ github.event.client_payload.review_dispatch_limit || '1' }}
+      ENABLE_AUTO_MERGE: ${{ github.event.client_payload.enable_auto_merge || 'false' }}
+      UPDATE_BRANCHES: ${{ github.event.client_payload.update_branches || 'false' }}
+      MERGE_MODE: ${{ github.event.client_payload.merge_mode || 'disabled' }}
     steps:
       - name: Validate exact invocation payload
         run: |
@@ -195,8 +198,6 @@ jobs:
             --arg pr_head_sha "$PR_HEAD_SHA" \
             --arg pr_base_sha "$PR_BASE_SHA" \
             --arg base_branch "$BASE_BRANCH" \
-            --arg agent_invocation_key "$INVOCATION_KEY" \
-            --argjson source_comment_id "$SOURCE_COMMENT_ID" \
             '{
               event_type: "merge-scheduler",
               client_payload: {
@@ -205,11 +206,11 @@ jobs:
                 pr_head_sha: $pr_head_sha,
                 pr_base_sha: $pr_base_sha,
                 base_branch: $base_branch,
+                trigger_reviews: true,
+                review_dispatch_limit: "1",
                 enable_auto_merge: false,
                 update_branches: false,
-                merge_mode: "disabled",
-                agent_invocation_key: $agent_invocation_key,
-                source_comment_id: $source_comment_id
+                merge_mode: "disabled"
               }
             }' \
             | gh api "repos/${GITHUB_REPOSITORY}/dispatches" -X POST --input -

.github/workflows/agent-mention-router.yml

@@ -25,8 +25,7 @@ jobs:
         || contains(github.event.comment.body, '@opencode-agent')
       )
     concurrency:
-      group: review-agent-mention-router-local-${{ github.repository }}
-      queue: max
+      group: review-agent-mention-router-local-${{ github.repository }}-${{ github.event.comment.id }}
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:

.github/workflows/pr-review-merge-scheduler.yml

@@ -123,7 +123,8 @@ jobs:
     if: >-
       (
         github.event_name != 'pull_request_target' ||
-        github.event.action != 'closed'
+        github.event.action != 'closed' ||
+        github.event.pull_request.merged == true
       ) &&
       (
         github.event_name != 'workflow_run' ||
@@ -155,6 +156,7 @@ jobs:
       MAX_PRS: ${{ github.event.client_payload.max_prs || inputs.max_prs || '100' }}
       PROJECT_FLOW_INPUT: ${{ github.event.client_payload.project_flow || inputs.project_flow || vars.PROJECT_FLOW || '' }}
       PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number || github.event.workflow_run.pull_requests[0].number || github.event.client_payload.pr_number || inputs.pr_number || '' }}
+      POST_MERGE: ${{ github.event_name == 'pull_request_target' && github.event.action == 'closed' && github.event.pull_request.merged == true }}
       TRIGGER_REVIEWS: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_run' || github.event_name == 'push' || github.event_name == 'pull_request_target' || (github.event_name == 'repository_dispatch' && github.event.client_payload.trigger_reviews != false) || inputs.trigger_reviews == true }}
       REVIEW_DISPATCH_LIMIT_INPUT: ${{ github.event.client_payload.review_dispatch_limit || inputs.review_dispatch_limit || vars.REVIEW_DISPATCH_LIMIT || '1' }}
       BRANCH_UPDATE_LIMIT_INPUT: ${{ github.event.client_payload.branch_update_limit || inputs.branch_update_limit || vars.BRANCH_UPDATE_LIMIT || '1' }}
@@ -525,6 +527,9 @@ jobs:
           if [ -n "$PULL_REQUEST_NUMBER" ]; then
             args+=(--pr-number "$PULL_REQUEST_NUMBER")
           fi
+          if [ "$POST_MERGE" = "true" ]; then
+            args+=(--post-merge)
+          fi
           if [ "$DRY_RUN" = "true" ]; then
             args+=(--dry-run)
           fi