fix: spawn's blanket .github/** rule ships broken instance automation

[Jammy2211]

Overview

MIND_RULES maps .github/* to KEEP_SUB, which only replaces PyAutoLabs with YOURORG. Everything else passes through verbatim, so a fresh-slate template arrives carrying somebody else's automation — most of which cannot succeed in the org it was spawned for.

Pre-existing; surfaced by the independent review of #118. Split from the bundled instance-state prompt (the autonomy_log half is filed separately).

Evidence — the template's own run history

PyAutoLabs/PyAutoMind-template currently has 13 failing runs from inherited workflows:

workflow	reaches outside its own repo?	template result
lifecycle_drift.yml	no — checkout + local scripts	success
spawn_drift.yml	clones YOURORG/*	fail: repository 'https://github.com/YOURORG/PyAutoMind/' not found
morning_status.yml	8 hardcoded sibling repos	fail ×5
morning_health.yml	PyAutoHeart/PyAutoBrain/PyAutoHands workflow names	fail ×5
arxiv_papers.yml + .github/scripts/arxiv_fetch.py	PYAUTO_PAPERS_WEBHOOK_URL, CLAUDE_CODE_OAUTH_TOKEN	fail ×3

The spawn_drift failure is the important one: it proves owner substitution does not make a cross-repo workflow work. YOURORG is a literal placeholder, so any workflow that clones or queries a sibling repo is broken on arrival.

Also instance content, not merely broken

• arxiv_fetch.py hardcodes strong-lensing search vocabulary and a domain-shaped Claude prompt — a template spawned for a non-lensing org inherits a strong-lensing arXiv query.
• arxiv_papers.yml / arxiv_fetch.py carry dated design decisions and incident notes in their headers — live task history.

The rule

A template workflow must be able to succeed on a freshly-spawned repo with no secrets and no sibling repos.

Only lifecycle_drift.yml clears that bar, and the run history proves it — it is the one green workflow.

Plan

• Update spawn_spec.md rule 9 first, replacing the blanket .github/** KEEP_SUB with explicit per-file rules and stating the principle above.
• Mirror in MIND_RULES:
  • lifecycle_drift.yml → KEEP (no owner references at all, so no substitution needed)
  • spawn_drift.yml → keep but strip the schedule: trigger, so it never auto-fails on an org with no published *-template repos; pull_request + workflow_dispatch remain, with a comment on re-adding the schedule
  • morning_status.yml, morning_health.yml, arxiv_papers.yml, .github/scripts/arxiv_fetch.py → DROP
• Extend tests/test_spawn_template_contract.py with the guard that keeps rule 9 honest as new workflows land in Mind: no shipped workflow may carry a secrets. reference, a YOURORG/ cross-repo reference, or a schedule: trigger.

Detailed implementation plan

Affected Repositories

• PyAutoMind (primary)

Branch Survey

Repository	Current Branch	Dirty?
./PyAutoMind	main	clean

Suggested branch: feature/spawn-github-instance-automation

Key Files

• docs/pyautobrain/spawn_spec.md — rule 9 (edit first, then mirror)
• scripts/spawn.py — MIND_RULES .github/* entries; a SPECIAL: handler for the schedule strip
• tests/test_spawn_template_contract.py — the new guards

Notes

• Dropping these is not a capability loss: a spawned org that later builds the same organs can copy the workflows across deliberately. Shipping them pre-broken, failing weekly and emailing the new owner, is strictly worse.
• Brain sized this "large (score 8), re-home as feature" — not taken; the score is prose-driven, repos_affected is 1, and the change is a rules table plus one transform and tests.

Original Prompt

Click to expand starting prompt

draft/bug/pyautomind/spawn_github_rules_export_instance_automation.md — filed from the independent review of #118, split from the bundled instance-state prompt.

[Jammy2211]

Shipped

PR #122 merged. Template published: PyAutoMind-template f3ae22b (Memory template already current).
Completion record: complete/2026/08/spawn-github-instance-automation.md.

Verified

• The four instance files are deleted from the published template, not merely disabled: arxiv_papers.yml, morning_health.yml, morning_status.yml, .github/scripts/arxiv_fetch.py.
• No remaining shipped workflow carries a schedule: — lifecycle_drift (push/PR/dispatch), spawn_drift (PR/dispatch).
• spawn --check against freshly cloned published repos: exit 0, both OK, canary clean.
• 72 tests pass locally and on GitHub runners.

Review caught three things worth recording

The tripwire test rejected the first design — it kept a .github/* fallback, and the test proved a future Mind workflow would ride it into the template with its schedule intact. The fallback was removed entirely (rule 9d).

Stress-testing found three defects in the schedule-strip that the happy-path test passed straight through: a schedule: line inside a run: | block being rewritten into comments, on.workflow_call.inputs.schedule being deleted as if it were a trigger, and a same-indent comment producing invalid YAML.

Codex found that pip install pytest alone would have failed the whole suite at collection, since the contract tests import PyYAML — the CI log confirms PyYAML was downloaded, not preinstalled. It also correctly flagged that the spec overclaimed: it demanded shipped workflows "must be able to succeed" and mandated a YOURORG/ assertion that would have forbidden rule 9b. The invariant now states what it protects (nothing fails unattended) and what it deliberately does not require.

Genuinely pending

Every failing run in the template predates the publish (newest 17:29:01Z vs publish 19:00:52Z). The daily jobs last fired at ~04:53 / 07:43 / 08:19 UTC; their files are now gone, so tomorrow morning is the observable proof — no pyauto-morning-health, pyauto-update-digest or pyauto-arxiv-papers runs should appear.

Sibling half still open: draft/bug/pyautomind/spawn_autonomy_log_parses_live_bytes.md — SPECIAL:autonomy_log still parses live bytes, the same hazard class as #118.