Use artifact-free team-memory reconciliation with standalone dispatch

[Changyong Gong (chagong)]

Architecture

Implement the approved artifact-free reconciliation design in IssueLens only:

1. Source workflows call the immutable standalone .github/actions/queue-team-memory action with five scalar fields: source_repository, source_run_id, source_run_attempt, push_before, and push_after. No source checkout, preparation helper, upload, or download remains. The existing generic dispatch implementation is unchanged and pinned to published revision 296350903a578f3bcd847b34ce85b51e90b4b919.
2. The central coordinator retains its wiki-specific concurrency queue and only loads trusted local action code and invokes .github/actions/issuelens. Automatic ranges and manual PR selections share that queue.
3. Invocation preflight verifies the canonical source identity, exact default-branch push workflow/run/attempt, source run head, and current default-branch ancestry. It centrally retrieves every commit in the requested fast-forward range in pages of 100, then reuses the existing bounded PR discovery and result validation. All of this precedes Azure login. Source and coordinator revisions remain distinct.

Trust and Compatibility

• Deliberate trust change: this is authorized reconciliation of a selected ancestor range, not proof of the original push boundary. The source run API verifies after/head but cannot establish original before or push flags. The task explicitly preserves this limitation; no original-event snapshot, digest, or artifact lifetime is claimed.
• Coordinated interface change: remove source-artifact-id, prepare-source, and validate-source; supply run ID/attempt plus full nonzero before/after SHAs, or one manual PR, never both. Invocation returns to preflight/login/submit. Issue-loop, direct task, direct push, and legacy/manual external callers keep their behavior and receipt contracts.
• The IssueLens workflow remains same-source only. Future central receivers may configure a trusted source-repositories map of canonical names to immutable numeric IDs, never from dispatched inputs. Cross-repository sources and coordinators must both be public, with independent source Contents/Actions/Pull requests read credentials. Source develop and coordinator main remain independent.
• The dispatcher is still generic and self-contained: validated target repository/active workflow/ref, bounded caller-owned string inputs, independent target authentication, one POST, no retries/redirects, explicit unknown outcomes. It owns no source validation, agent/wiki policy, or job authority.
• Missing/truncated pages, duplicate/malformed identities, divergent ranges, more than 1,000 commits, inconsistent source tips, unverified PR associations, privacy failures, and mismatched wiki receipts fail closed. Coordinated wiki identity is checked against validated source policy, never forced. Partial publication/outcome reporting is unchanged.
• Java Pack and microsoft/vscode-java-pack#1769 are untouched and still use their older immutable pin. A separately authorized migration must adopt the five-field range request, trusted source-ID configuration/read access, and the shared invocation path instead of its artifact adapter.

No live dispatch, agent invocation/deployment, wiki publication, workflow enablement, credential installation, or merge was performed.

Validation

• Published implementation: 293649325caa3df4996a211d1248f0b461b65e9b.
• 128 focused tests passed on Python 3.12, covering standalone dispatch, complete 1,000-commit pagination/partial final pages, truncation/duplicates/limits, source run/head/workflow/ancestry checks, ref races, source policy/visibility, token separation/sanitization, branch independence, direct/manual/issue-loop compatibility, and exact receipt behavior.
• Copied action-folder execution confirms isolated invocation and standalone-dispatch boundaries. Python compile checks, git diff --check, and self-review passed.
• Fresh hosted CI passed all six jobs for this exact revision: CI run 37912883783, including full application tests on Python 3.13, MCP tests/package builds on Python 3.12/3.13, and actionlint workflow validation. CLA also passed.

Mocked/local and hosted CI checks do not establish live App permissions, dispatch delivery, OIDC federation, hosted readiness, or wiki publication. The PR remains open and unmerged.

[Copilot]

🔵 Needs a closer look

Security-sensitive workflow authentication and cross-repository operational behavior still require final human validation despite passing CI.

0 open findings

What changed in this PR

Replaces artifact-based team-memory coordination with bounded, artifact-free range reconciliation while preserving the central queue and trust boundaries.

Changes:

• Adds a standalone, pinned workflow-dispatch transport.
• Moves source, ancestry, pagination, and PR validation into preflight.
• Updates workflows, documentation, and comprehensive tests.

File	Description
tests/​test_workflow_dispatch_action.py	Tests standalone dispatch behavior and security.
tests/​test_team_memory_workflow.py	Updates workflow contract tests.
tests/​test_team_memory_coordinator.py	Tests reconciliation and cross-repository validation.
tests/​test_ci_workflow.py	Verifies expanded syntax checks.
github_app_mcp/​README.md	Documents artifact-free orchestration.
docs/​guide.md	Updates operational guidance.
CONTRIBUTING.md	Adds action layout and validation commands.
.github/​workflows/​team-memory-post-merge.yml	Dispatches the immutable standalone action.
.github/​workflows/​team-memory-coordinator.yml	Accepts run/range reconciliation inputs.
.github/​workflows/​ci.yml	Compiles the new action code.
.github/​copilot-instructions.md	Updates repository architecture guidance.
.github/​actions/​queue-team-memory/​README.md	Defines the generic dispatch contract.
.github/​actions/​queue-team-memory/​dispatch.py	Implements bounded target validation and dispatch.
.github/​actions/​queue-team-memory/​action.yml	Exposes the standalone transport inputs.
.github/​actions/​issuelens/​README.md	Documents coordinated reconciliation.
.github/​actions/​issuelens/​issuelens_action.py	Implements source and range preflight validation.
.github/​actions/​issuelens/​action.yml	Adds source reconciliation inputs.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.