fix: decide .github per file so templates stop shipping broken automation

[Jammy2211]

Closes #121.

Overview

MIND_RULES mapped .github/* to KEEP_SUB, which only replaces PyAutoLabs with YOURORG. Everything else passed through verbatim, so the public template arrived carrying instance automation that cannot run in the org it was spawned for — 13 failing runs in PyAutoMind-template.

Owner substitution does not help. YOURORG is a literal placeholder, so the template's own spawn_drift run failed with repository 'https://github.com/YOURORG/PyAutoMind/' not found. Anything cloning or querying a sibling repo is broken on arrival, secrets or not.

The rule

No workflow shipped into a template may fail unattended on a freshly-spawned repo.

Two conditions: no unattended trigger it cannot satisfy, and no configured secret (GITHUB_TOKEN is auto-provided and allowed). Evidence-backed by the template's own run history — lifecycle_drift.yml is the one green workflow, and it is the one that clears the bar.

rule	file	action
9a	lifecycle_drift.yml	KEEP — self-contained, no owner reference at all
9b	spawn_drift.yml	keep, schedule: stripped — generic machinery, but a fresh org has no *-template repos
9c	morning_status, morning_health, arxiv_papers, .github/scripts/**	DROP — sibling repo lists, organ workflow names, org secrets, strong-lensing vocabulary
9d	anything else under .github	no catch-all — UNMATCHED by design

MEMORY_RULES gets the same treatment; its validate.yml is self-contained and still ships byte-identical, so no Memory drift.

9d is the part that matters

A catch-all is fail-open: a workflow added to Mind later rides it into the template with whatever schedule and secrets it has. The tripwire test caught exactly that against an earlier draft of this change that kept the fallback — so the fallback is gone. A new .github file now fails the run and gets an explicit human decision, like every other new file class.

Found by testing, not by reading

Three defects in the schedule-strip, each fixed and pinned:

• a schedule: line inside a run: | shell block was rewritten into comments, silently mangling the script;
• on.workflow_call.inputs.schedule — a legitimate input, not a trigger — was deleted, because the match was "anywhere under on:" rather than "direct child of on:";
• a comment at the same indent as schedule: ended block consumption early, orphaning the - cron line and emitting invalid YAML.

Flow style (on: {schedule: ...}) and a workflow with no schedule both fail loudly rather than being guessed at, so the rule cannot rot into a silent no-op.

Independent review (Codex)

Five findings, all verified against the real transform before fixing. Two were the YAML defects above. Also:

• pip install pytest only, but the contract tests import PyYAML. setup-python gives a clean interpreter, so this would have failed at collection on the next CI run — the whole suite, not one test.
• Memory's fail-closed rule was untested — every workflow fixture drove generate_mind. Now covered, and control-tested by reverting the rule and confirming the test fails.
• The spec overclaimed. It said shipped workflows "must be able to succeed" and mandated a test asserting no YOURORG/ reference — but rule 9b deliberately ships spawn_drift.yml, which clones <owner>/*-template and will fail on manual dispatch until the org publishes templates. The rule being protected is "nothing fails unattended", not "every human-invoked path succeeds"; asserting no YOURORG/ would forbid shipping the generator at all. The invariant now states both conditions precisely and records what it does not require, so the next reader does not "fix" the gap by breaking 9b.

Verification

• 72 tests pass. Generated output is byte-identical before and after the review fixes — the shipped .github tree and spawn_drift triggers/jobs are unchanged.
• Post-merge --check preview: 7 drifts on the Mind template (4 removals, the schedule-stripped workflow, the 2 files changed here), Memory OK.

API Changes

None. spawn.py is a repo-local generator with no importers outside this repo. New helper unscheduled_workflow_body(); no signature changes to existing functions.

Ship notes

Heart YELLOW at ship time (score 70, red_reasons: []) on a subset of the reason set the human acknowledged earlier today: workspace validation not passing, and tenant-firewall manifest drift. Neither relates to this change.

Post-merge: re-run /spawn --apply to publish, then confirm the template's pyauto-morning-health / pyauto-update-digest / pyauto-arxiv-papers workflows are gone rather than merely disabled.

🤖 Generated with Claude Code