Skip to content

Team Memory Automation

Jump to bottom
issuelens[bot] edited this page Oct 12, 2026 · 4 revisions

Team-memory automation

Scope and flow

The opt-in IssueLens pilot separates push dispatch from maintenance. Both workflows require ISSUELENS_TEAM_MEMORY_ENABLED == 'true', repository microsoft/IssueLens, and the default-branch ref. PR #51, merged at 0bc63baa3b6426b1f22daabe80e4ab004801f39b, replaces PR #50's identity-artifact transport with artifact-free range reconciliation. This is merged-source behavior, not proof of enablement, deployment, or live service behavior.

  1. Push dispatcher: .github/workflows/team-memory-post-merge.yml runs only on pushes to main, with a 10-minute timeout. It additionally requires the workflow SHA to equal the push head and the created/deleted/forced flags to be false. Its sole step calls the standalone .github/actions/queue-team-memory action at 296350903a578f3bcd847b34ce85b51e90b4b919, targeting team-memory-coordinator.yml on main. There is no source checkout, preparation helper, artifact upload/download, Azure login, or agent invocation.
  2. Scalar dispatch: the source sends five strings: source_repository, source_run_id, source_run_attempt, push_before, and push_after. The generic dispatcher validates the target repository, active workflow path, and branch identity, then makes one authenticated dispatch POST. It owns no source validation, PR discovery, agent/wiki policy, or maintenance authority.
  3. Coordinator: .github/workflows/team-memory-coordinator.yml accepts all four run/range fields together, or a positive manual pull_request_number, never both. source_repository defaults to the coordinator repository. Its two steps load trusted invocation-action code and call .github/actions/issuelens; invocation preflight validates source and discovers PRs before Azure login.
  4. Discovery and maintenance: preflight retrieves the complete requested fast-forward inventory in pages of 100, capped at 1,000 commits, then discovers eligible merged PRs, including the REST merge fallback for rebase associations. Empty/oversized/divergent ranges, incomplete or duplicate inventories, invalid identities, inconsistent counts, and source-tip races fail closed. No eligible PRs means a skip before Azure login. The agent still needs complete PR evidence, pinned final-source checks, and current wiki comparison; queue order is not merge order.

Trust limitation: this is authorized reconciliation of a caller-selected ancestor range, not attestation of the original push boundary. The source run API verifies push_after against the run head, but cannot establish the original push_before or push flags. No original-event snapshot, artifact digest, or artifact lifetime is claimed. Source and coordinator revisions remain distinct; event context and supplied identities are not independent write authorization.

The existing batch contract from PR #36, merge 2b5317815e15179899014a02c41678620ce2d390, remains: one atomic publication may include an independent, fully verified subset, but the result accounts for every submitted PR. Partial/incomplete results fail the workflow while retaining any confirmed wiki receipt.

Queue boundary

Automatic batches and manual PR requests share workflow-level concurrency group issuelens-team-memory-wiki-microsoft-IssueLens, with queue: max and cancel-in-progress: false. The documented limit is one active coordinator and at most 100 pending runs; overflow cancellations require monitoring. The 30-minute coordinator job holds the slot across source discovery, Azure authentication, agent invocation, and receipt validation.

The queue lives in the coordinator workflow, not the composite action. External direct-action consumers remain supported but are not serialized by this pilot; chat and issue-loop requests are also outside it. The IssueLens coordinator retains same-source defaults. Reusable cross-repository support requires trusted source configuration, separately authorized target writes and source reads, and an appropriate wiki-specific queue; this change does not establish another project's rollout.

This is neither a distributed hosted-runtime lock nor an exactly-once job ledger. Cancellation or timeout does not prove a hosted invocation stopped. Existing exact-base wiki publication and recovery protections remain necessary.

Trust and credentials

  • Dispatcher permissions are contents: read and actions: write at the target. Its inputs are dispatch-token, coordinator-repository, required workflow YAML basename coordinator-workflow, branch coordinator-ref, and JSON workflow-inputs. Repository/ref default to the caller repository/ref name; token defaults to github.token, but explicitly empty/invalid tokens fail. Inputs permit at most ten string-valued fields, reject duplicate keys, and bound both input and dispatch payload to 64 KiB. Metadata reads are bounded to 64 KiB, HTTP operations use 30-second timeouts, redirects are rejected, and dispatch is not retried automatically.
  • The dispatcher runs its own standard-library dispatch.py from the pinned action directory, with no sibling invocation helper or caller checkout dependency. The former source-token input and artifact output are removed. Dispatch acceptance is not queue admission, target execution, or maintenance completion; the action creates no credentials or additional repository access.
  • Coordinator permissions are contents: read, pull-requests: read, actions: read, and id-token: write. Only the coordinator performs Azure OIDC login and agent submission. Existing Azure client/tenant/subscription and agent URL/scope secrets remain required there; the dispatcher needs no new secret in this pilot. Before enabling, verify federation for the coordinator's actual default-branch workflow_dispatch identity, including any workflow-specific conditions.
  • Invocation preflight verifies canonical source name and immutable numeric repository ID, the exact source push workflow/run/attempt and default branch, full run head, and its ancestry in the current default branch. A trusted source-repositories JSON map may allow canonical names and positive numeric IDs (4 KiB/100-entry bounds, duplicate and case-alias rejection); it must not come from dispatch inputs. Default {} allows same-source only. Cross-repository source and coordinator must both be public. Source and coordinator default branches need not have the same name.
  • source-github-token needs source Contents/Actions/Pull requests reads and defaults to ${{ github.token }} for same-repository and supported public cross-repository reads; a separate source-scoped credential is not inherently required. Explicit overrides remain supported. An explicitly empty/invalid token fails without fallback, and source authentication failures do not trigger another credential, anonymous access, or retry. Public reads do not authorize dispatch writes: cross-repository dispatch still requires a target-authorized token with Contents read and Actions write. Successful public target reads followed by a denied dispatch do not trigger credential fallback or retry.
  • Only the coordinator uses sparse checkout at github.workflow_sha, with persisted credentials disabled, to load its local invocation action rather than PR-head code. The push workflow instead uses the immutable remote dispatcher pin.
  • The coordinator requires the validated wiki destination to match microsoft/IssueLens; request metadata does not override policy, and receipt validation rejects another destination. The workflows/actions do not directly access the wiki. Hosted GitHub App destination access and exact destination/base preconditions remain separate from workflow token permissions.

Token-contract evidence: microsoft/IssueLens#54, merged to main at 30443a6f6256ff36cb539308ab1ebcd8fe5b6c5d, also the inspected push-after/source-tip revision. The action input contract clarifies existing behavior; the PR changes no runtime Python, workflows, permissions, or action pins. Coordinator tests exercise caller-token/override routing for REST/GraphQL, rebase lookup, ancestry, complete 1,000-commit pagination, identity/privacy guards, and fail-closed authentication. Workflow tests preserve built-in defaults; dispatcher tests distinguish public reads from dispatch authorization. All four patches were inspected one file per page through the empty page, with stable PR metadata and matching merged file blob identities. Tests were inspected, not executed during maintenance; these mocked regressions do not prove live GitHub permissions, OIDC, deployment, or another project's rollout.

Recovery and diagnostics

Manual reconciliation uses Coordinate IssueLens team memory (opt-in) on the default branch, with pull_request_number and the automatic run/range fields left empty. Automatic callers must migrate from artifact IDs to the complete run/range interface; invocation now follows preflight/login/submit without artifact preparation or validation commands. Direct task, issue-loop, direct push, and legacy/manual callers retain their existing behavior and receipts.

There is no source artifact to recover or expire. Dispatch and hosted submission are not automatically retried after ambiguous transport outcomes. Inspect coordinator runs, retained receipts, and current wiki content/history before manual recovery; monitor queue overflow. On replay, matching wiki content avoids a repeat write but does not establish who published it; uncertain publication remains incomplete until reconciled. Never treat workflow cancellation as evidence that an invocation or write could not have completed.

Invocation timing

The shared invocation action uses a 300-second (5-minute) socket/read inactivity timeout, increased from 60 seconds, via AGENT_STREAM_INACTIVITY_TIMEOUT_SECONDS. This applies to team-memory, issue-loop, and direct-task submissions and accommodates model/orchestration turns that emit no SSE bytes for more than a minute. The cooperative total stream-read budget remains 900 seconds (15 minutes) via AGENT_STREAM_READ_BUDGET_SECONDS; Azure endpoint-token acquisition retains its separate 60-second timeout. Stream limits remain 8 MiB total and 1 MiB per line. These socket/cooperative limits are not hard end-to-end deadlines: the elapsed-budget check occurs after a nonempty line read.

The action documentation recommends a 30-minute caller job timeout. Nominal discovery (3 minutes), token acquisition (1 minute), request/read inactivity (5 minutes), and stream-read (15 minutes) budgets can total 24 minutes, leaving 6 minutes for setup, cooperative overruns, and receipt/summary handling. The issue-loop workflow's job timeout increases from 20 to 30 minutes; the coordinator remains at 30 minutes. No automatic submission retry is added. An interrupted stream can leave an unknown write outcome, so inspect current target state before retrying.

Source: microsoft/IssueLens#53, merged to main at a81d2d96167fc0e69ac631c2edc85f858e693289, also the inspected supplied push-after/source-tip revision. All five PR patches were inspected one file per page through the terminating empty page; PR base/head/merge SHAs and file count remained stable. All five merged file blob identities matched the reviewed PR, and the invocation helper and issue-loop workflow were read at that revision. The action guide documents timing/headroom. Submission and budget tests assert 300-second submission, unchanged 60-second token and 900-second stream limits, one submission call, and coordinator headroom; issue-loop tests assert the 30-minute job timeout. Tests were inspected, not executed during maintenance. This records merged caller behavior, not deployment, a live timing guarantee, or independent verification of an earlier invocation's cancellation.

Evidence and validation

All 17 PR #51 file patches were inspected one file per page, through the terminating empty page, with unchanged PR base/head/merge identities and file count after paging. Final workflow and dispatcher source was read at the authoritative merge/push-after SHA 0bc63baa3b6426b1f22daabe80e4ab004801f39b; invocation-action merged blob identities matched the reviewed PR. The remote dispatcher pin's implementation and action metadata match the reviewed implementation.

Freshness was checked at supplied source tip cb0776caad2da948c4004eefd6d31a89c8c90098: both workflows and the standalone dispatcher remain unchanged. The inspected invocation-helper change refines batch-request evidence guidance, not range discovery or the artifact-free flow. This reconciliation does not reinstate original-boundary attestation. Tests were inspected, not executed during maintenance; live OIDC, queue behavior, deployment, and hosted invocation termination were not independently tested.

Pinned PR #51 sources at 0bc63baa3b6426b1f22daabe80e4ab004801f39b:

Clone this wiki locally