Default GITHUB_TOKEN cannot mutate Repository Variables (always 403).
Use a PAT-backed secret CTO_ADMIN_TOKEN for the budget counter steps.
Also restores formal APPROVE/REQUEST_CHANGES verdicts now that repo
setting can_approve_pull_request_reviews is enabled.
Agent-Session: cowork-reviewer-ab-20260414
Two enhancements to the PR reviewer:
1. Monthly spend cap: tracked in Repo Variables (CTO_REVIEW_MONTH,
CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS). Default cap $10/month.
Auto-resets on month rollover. Posts a skip-comment on PRs when cap hit.
2. A/B harness: reviews every PR with 3 models in parallel
(Claude Haiku 4.5, DeepSeek V3.1, Kimi K2 Thinking). Comment shows
all 3 verdicts side-by-side so we can compare quality/cost on real
PRs before picking a permanent default. Drop to 1 model by editing
the MODELS list after A/B window closes.
Agent-Session: cowork-reviewer-ab-20260414
* ci: post CTO review as COMMENT instead of APPROVE
GITHUB_TOKEN cannot formally approve PRs without a repo setting toggle.
Verdict is still prominent in the first line of the review body, and
the human merges based on reading it — no behavior loss.
Agent-Session: cowork-reviewer-fix-20260414
* fix(ci): ssh-keyscan failure no longer fails the deploy
ssh-keyscan was being called with set -e in effect and stderr suppressed,
so a single keyscan failure killed the entire deploy with no diagnostic
output. Since rsync/ssh use StrictHostKeyChecking=no, the known_hosts
entry is not load-bearing — making the keyscan best-effort is safe.
stderr is now captured to /tmp/keyscan.err and emitted as a warning so
future failures are debuggable.
Agent-Session: cowork-deploy-fix-20260414
* ci: add main-push audit tripwire
Flags direct pushes to main that did not come from a merged PR.
Free-plan workaround since branch protection requires GitHub Pro.
* docs: add Git Workflow section to CONVENTIONS.md
Documents the PR-gated review process enforced at the agent layer.
Free-plan workaround since branch protection requires GitHub Pro.
* ci: add Claude-powered CTO PR review workflow
Auto-reviews every PR with Claude Haiku 4.5 and posts a structured
review (APPROVE / REQUEST_CHANGES / COMMENT). Does NOT auto-merge — a
human still clicks Merge. Requires ANTHROPIC_API_KEY secret on the repo.
* ci: switch CTO reviewer from Anthropic direct to OpenRouter
Reuses the OPENROUTER_API_KEY secret that already backs the other AI
plugins. Consolidates AI spend on one bill. Model: anthropic/claude-haiku-4.5.
