Merge branch 'github-actions/upgrade-main' of https://github.com/aws-samples/sample-autonomous-cloud-coding-agents into github-actions/upgrade-main

Resolve lockfile conflicts and fix post-merge build: pin Astro MDX/markdown-remark
via yarn resolutions and ignore ty deprecated warnings for asyncio 3.14 APIs.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: bgagent

.abca/commands/review_pr.md

@@ -71,10 +71,39 @@ Then apply principal-architect judgment over the diff:
   together and parity fixtures were refreshed.
 - **Security & least privilege** — IAM scoping, Cedar HITL gates, secrets handling, path-
   traversal guards, input validation. Fail closed.
+- **Bootstrap policy coverage (CDK deploy IAM)** — When the PR adds or changes constructs,
+  stacks, or handlers that introduce new CloudFormation resource types (new AWS services,
+  `AWS::SQS::Queue`, `AWS::CloudFront::*`, `AWS::SecretsManager::Secret`, Lambda layers,
+  application S3 buckets, etc.), verify the least-privilege bootstrap bundle was updated in
+  the **same PR**:
+  1. `cdk/src/bootstrap/policies/*.ts` — new actions and resource ARN patterns on the
+     CloudFormation execution role.
+  2. `cdk/src/bootstrap/resource-action-map.ts` — entry for each new CFN type (minimum
+     create-time IAM actions).
+  3. `BOOTSTRAP_VERSION` bumped in `cdk/src/bootstrap/version.ts` (minor when adding
+     permissions) and artifacts regenerated (`mise //cdk:bootstrap:generate` → committed
+     `cdk/bootstrap/policies/*.json`, `bootstrap-template.yaml`, `BOOTSTRAP_HASH`).
+  4. `docs/design/DEPLOYMENT_ROLES.md` golden baseline updated (required by
+     `cdk/test/bootstrap/golden-baseline.test.ts`).
+  5. `cdk/test/bootstrap/synth-coverage.test.ts` passes — run
+     `mise //cdk:test -- test/bootstrap/synth-coverage` or the full bootstrap suite.
+     **Flag as blocking** if constructs changed but bootstrap policies, the action map, or
+     version/artifacts were not updated. Missing ARN patterns (action present but resource
+     too narrow) are a common gap — check secret/queue/bucket naming against the patterns
+     in `application.ts` / `observability.ts`, not just action presence.
+  See [ADR-002](../../docs/decisions/ADR-002-least-privilege-bootstrap-policies.md) and
+  issue #350 for the failure mode this prevents.
 - **AWS / CDK quality** — Prefer L2 constructs, sane removal policies, no hardcoded ARNs/account
   IDs, cdk-nag clean. Watch for cost and operational footguns.
 - **Tests** — Are unit tests added/updated under the matching `*/test/` tree? Do they cover the
   new behavior and failure paths, not just the happy path?
+- **Test performance (CDK synth)** — New/changed CDK tests must not re-enable Lambda bundling at
+  synth or synthesize the same stack repeatedly. `cdk/` disables bundling globally via
+  `test/setup/disable-bundling.ts` (~15× faster synth); flag any test that turns
+  `aws:cdk:bundling-stacks` back on (only valid via `postCliContext`, not constructor
+  `context` — the env var overwrites the latter) without asserting on a bundled asset, or
+  that calls `new App()` + `Template.fromStack()` per-test instead of once in `beforeAll`.
+  See #366.
 - **Routing** — Changes should land in the right package per the AGENTS.md routing table
   (agent runtime in `agent/`, API/Lambdas in `cdk/`, CLI in `cli/`).
 
@@ -110,12 +139,7 @@ Documentation drift is a blocking concern on this repo. Check:
 - **Never edit `docs/src/content/docs/` by hand** — it is generated.
 - **AGENTS.md / README / package docs** — Updated if the developer flow, routing, or commands
   changed.
-- **Roadmap reflects the change** — Confirm whatever this PR fixes or delivers is marked or
-  updated in [docs/guides/ROADMAP.md](../../docs/guides/ROADMAP.md) (e.g. item checked off,
-  status moved, or a new entry added). If the change advances or completes a roadmap item and
-  the PR leaves the roadmap untouched, flag it. Remember the roadmap is a synced source — after
-  editing `docs/guides/ROADMAP.md`, the Starlight mirror `docs/src/content/docs/roadmap/Roadmap.md`
-  must be regenerated via `mise //docs:sync`.
+- **Issue tracking reflects the change** — Confirm whatever this PR fixes or delivers is filed or updated as a [GitHub issue](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/issues) with an appropriate priority label (`P0`, `P1`, etc.). If the change completes planned work and no issue exists, flag it.
 
 ### Stage 5: Present to User
 
@@ -126,7 +150,8 @@ Summarize as a principal architect would in a PR review. Structure the output:
 3. **Blocking issues** — Numbered, each with `file:line`, the risk, and a suggested fix.
 4. **Non-blocking suggestions / nits** — Clearly separated.
 5. **Documentation** — What was updated, what is missing, mirror-sync status.
-6. **Tests & CI** — Coverage assessment and check status.
+6. **Tests & CI** — Coverage assessment and check status. For CDK construct/stack changes,
+   explicitly note bootstrap synth-coverage status (pass / not applicable / missing updates).
 7. **Review agents run** — List each plugin/agent you invoked (Stage 3) and, for any in-scope
    agent you omitted, the one-line reason. This section is required — its absence means the
    mandatory plugin step was skipped.

.github/CODEOWNERS

@@ -2,7 +2,29 @@
 
 ## Default owners for everything in the repo
 
-*                                   @aws-samples/coding-agents-admin
+*                                   @aws-samples/coding-agents-admin @aws-samples/coding-agents-maintainers
+
+.abca                               @aws-samples/coding-agents-admin
+.claude/settings.json               @aws-samples/coding-agents-admin
+.gitallowed                         @aws-samples/coding-agents-admin
+.gitattributes                      @aws-samples/coding-agents-admin
+.github                             @aws-samples/coding-agents-admin
+.gitignore                          @aws-samples/coding-agents-admin
+.gitleaks.toml                      @aws-samples/coding-agents-admin
+.gitleaksignore                     @aws-samples/coding-agents-admin
+.mergify.yml                        @aws-samples/coding-agents-admin
+.npmignore                          @aws-samples/coding-agents-admin
+.pre-commit-config.yaml             @aws-samples/coding-agents-admin
+.semgrep                            @aws-samples/coding-agents-admin
+.threat-composer                    @aws-samples/coding-agents-admin
+AGENTS.md                           @aws-samples/coding-agents-admin
+CLAUDE.md                           @aws-samples/coding-agents-admin
+CODE_OF_CONDUCT.md                  @aws-samples/coding-agents-admin
+contracts                           @aws-samples/coding-agents-admin
+CONTRIBUTING.md                     @aws-samples/coding-agents-admin
+LEGAL_DISCLAIMER.md                 @aws-samples/coding-agents-admin
+LICENSE                             @aws-samples/coding-agents-admin
+mise.toml                           @aws-samples/coding-agents-admin
 
 ## File must end with CODEOWNERS file
 

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -8,7 +8,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for helping improve ABCA. Please check [open](https://github.com/krokoko/bgagent/issues) and [recently closed](https://github.com/krokoko/bgagent/issues?q=is%3Aissue+is%3Aclosed) issues first.
+        Thanks for helping improve ABCA. Please check [open](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/issues) and [recently closed](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/issues?q=is%3Aissue+is%3Aclosed) issues first.
   - type: dropdown
     id: component
     attributes:

.github/ISSUE_TEMPLATE/config.yml

@@ -4,5 +4,5 @@ contact_links:
     url: https://aws.amazon.com/security/vulnerability-reporting/
     about: Do not report security vulnerabilities in public issues. Use AWS vulnerability reporting.
   - name: Documentation
-    url: https://github.com/krokoko/bgagent/tree/main/docs
-    about: Guides, design docs, and roadmap (ROADMAP.md, DEVELOPER_GUIDE.md, USER_GUIDE.md).
+    url: https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/tree/main/docs
+    about: Guides and design docs (DEVELOPER_GUIDE.md, USER_GUIDE.md).

.github/ISSUE_TEMPLATE/documentation.yml

@@ -18,7 +18,7 @@ body:
         - User guide (`docs/guides/USER_GUIDE.md` or synced site)
         - Developer guide (`docs/guides/DEVELOPER_GUIDE.md` or synced site)
         - Design / architecture (`docs/design/`)
-        - Roadmap or prompts (`docs/guides/`)
+        - Prompt guide (`docs/guides/PROMPT_GUIDE.md` or synced site)
         - README / root docs
         - Other
     validations:

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -8,7 +8,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for suggesting an idea. You may want to check the [ROADMAP](https://github.com/krokoko/bgagent/blob/main/docs/guides/ROADMAP.md) and [design docs](https://github.com/krokoko/bgagent/tree/main/docs/design) to see if something similar is already planned.
+        Thanks for suggesting an idea. You may want to check [open GitHub issues](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/issues) and [design docs](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/tree/main/docs/design) to see if something similar is already planned.
   - type: dropdown
     id: component
     attributes:

.github/ISSUE_TEMPLATE/rfc.yml

@@ -8,7 +8,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Use this template for significant feature or design proposals. Please add as much detail as possible. See the [ROADMAP](https://github.com/krokoko/bgagent/blob/main/docs/guides/ROADMAP.md) and [design docs](https://github.com/krokoko/bgagent/tree/main/docs/design) for existing direction; your RFC should align or explain divergence.
+        Use this template for significant feature or design proposals. Please add as much detail as possible. See [open GitHub issues](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/issues) and [design docs](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/tree/main/docs/design) for existing direction; your RFC should align or explain divergence.
   - type: dropdown
     id: area
     attributes:

.github/workflows/auto-approve.yml

@@ -45,5 +45,5 @@ jobs:
     steps:
       - uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ secrets.AUTOMATION_GITHUB_TOKEN }}
           review-message: Auto approved automated PR

.github/workflows/build.yml

@@ -0,0 +1,64 @@
+name: dead-code-pr
+# Advisory dead-code detection gate (issue #282, cairn MVG gate #6).
+# Steps use continue-on-error so findings surface as annotations without
+# blocking the merge queue. Flips to required/blocking once the knip
+# baseline (knip-baseline.json) is driven to zero. The eslint no-unused-vars
+# half of the gate is already blocking via the `build` check.
+on:
+  pull_request: {}
+  merge_group: {}
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dead-code-pr-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dead-code:
+    name: Dead-code detection (advisory)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    env:
+      CI: "true"
+      MISE_EXPERIMENTAL: "1"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Install mise
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
+        with:
+          cache: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22.x
+
+      - name: Install dependencies
+        run: mise run install
+
+      - name: TS dead-code ratchet (knip, advisory)
+        continue-on-error: true
+        run: |
+          if mise run check:deadcode-ratchet; then
+            echo "::notice title=knip ratchet::Dead-code count is at or below baseline."
+          else
+            echo "::warning title=knip ratchet::Dead-code count increased above the baseline (knip-baseline.json). Run 'yarn knip' locally and remove the new dead code, or suppress a false positive in knip.json."
+          fi
+
+      - name: Python dead-code scan (vulture, advisory)
+        continue-on-error: true
+        run: |
+          if mise //agent:lint:deadcode; then
+            echo "::notice title=vulture::No Python dead code above the confidence threshold."
+          else
+            echo "::warning title=vulture::vulture found unused Python code. Remove it, or add an intentional keep to agent/.vulture_allowlist.py."
+          fi