fix(igla): harden auto-merge and brain-seal-refresh workflows

- Fix dry_run guard and add contents:write permission in auto-merge-ready-prs.yml.
- Require L1 issue reference and at least one APPROVED review before auto-merge.
- Add contents:write permission and fix change-detection guard in brain-seal-refresh.yml.
- Prefix brain-seal commit with Refs #1440 for L1 traceability.
- Delete obsolete scripts/auto-merge.sh and scripts/auto-close-prs.sh.

Closes #1440

Author: Dmitrii Vasilev

.github/workflows/auto-merge-ready-prs.yml

@@ -14,6 +14,7 @@ on:
         default: false
 
 permissions:
+  contents: write
   pull-requests: write
 
 jobs:
@@ -29,46 +30,79 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           READY_PRS=()
-          echo "Finding PRs with all CI checks passing..."
+          echo "Finding PRs with all CI checks passing and L1 traceability..."
 
           PR_LIST=$(gh pr list --state open --limit 50 --json number --jq '.[].number' 2>/dev/null || echo "")
 
           if [ -z "$PR_LIST" ]; then
             echo "No open PRs found"
             echo "ready_prs=" >> $GITHUB_OUTPUT
             echo "count=0" >> $GITHUB_OUTPUT
+            echo "skipped=0" >> $GITHUB_OUTPUT
             exit 0
           fi
 
+          SKIPPED=0
+          L1_RE='(Closes?|Fixes?|Resolves?|Refs?|Updates?)\s*#[0-9]+'
+
           for pr in $PR_LIST; do
-            MAIN_CHECKS=$(gh pr view "$pr" --json statusCheckRollup --jq \
-              '[.statusCheckRollup[] | select(.name != "NotebookLM Auto-Sync" and .name != ".github/workflows/notebook-sync.yml")]' 2>/dev/null || echo "[]")
+            echo "Evaluating PR #$pr..."
+
+            # L1 TRACEABILITY: require an issue reference in title or body.
+            PR_METADATA=$(gh pr view "$pr" --json title,body,reviews,statusCheckRollup 2>/dev/null || echo "")
+            if [ -z "$PR_METADATA" ]; then
+              echo "  Skipped: cannot fetch PR metadata"
+              SKIPPED=$((SKIPPED + 1))
+              continue
+            fi
+
+            TITLE=$(echo "$PR_METADATA" | jq -r '.title // empty')
+            BODY=$(echo "$PR_METADATA" | jq -r '.body // empty')
+            if ! echo "$TITLE
+$BODY" | grep -qiE "$L1_RE"; then
+              echo "  Skipped: missing L1 TRACEABILITY issue reference"
+              SKIPPED=$((SKIPPED + 1))
+              continue
+            fi
+
+            # Review gate: require at least one APPROVED review.
+            APPROVED_REVIEWS=$(echo "$PR_METADATA" | jq '[.reviews[]? | select(.state == "APPROVED")] | length')
+            if [ "$APPROVED_REVIEWS" = "0" ]; then
+              echo "  Skipped: no approved review"
+              SKIPPED=$((SKIPPED + 1))
+              continue
+            fi
 
-            FAILING=$(echo "$MAIN_CHECKS" | jq '[.[] | select(.conclusion != "SUCCESS" and .conclusion != "SKIPPED")] | length' 2>/dev/null || echo "1")
+            MAIN_CHECKS=$(echo "$PR_METADATA" | jq \
+              '[.statusCheckRollup[]? | select(.name != "NotebookLM Auto-Sync" and .name != ".github/workflows/notebook-sync.yml")]')
+            FAILING=$(echo "$MAIN_CHECKS" | jq '[.[] | select(.conclusion != "SUCCESS" and .conclusion != "SKIPPED")] | length')
 
-            echo "PR #$pr: $FAILING failing checks"
+            echo "  Failing checks: $FAILING | Approved reviews: $APPROVED_REVIEWS"
 
             if [ "$FAILING" = "0" ]; then
               READY_PRS+=("$pr")
               echo "  Ready to merge"
             else
-              echo "  Skipped ($FAILING failing)"
+              echo "  Skipped ($FAILING failing checks)"
+              SKIPPED=$((SKIPPED + 1))
             fi
           done
 
           echo "ready_prs=${READY_PRS[*]}" >> $GITHUB_OUTPUT
           echo "count=${#READY_PRS[@]}" >> $GITHUB_OUTPUT
+          echo "skipped=$SKIPPED" >> $GITHUB_OUTPUT
 
       - name: Dry Run Check
-        if: inputs.dry_run == 'true'
+        if: inputs.dry_run
         run: |
           echo "DRY RUN - No actual merges will occur"
           echo "Ready PRs: ${{ steps.find-ready.outputs.count }}"
+          echo "Skipped PRs: ${{ steps.find-ready.outputs.skipped }}"
           echo "PRs: ${{ steps.find-ready.outputs.ready_prs }}"
           exit 0
 
       - name: Merge Ready PRs
-        if: steps.find-ready.outputs.count != '0'
+        if: ${{ steps.find-ready.outputs.count != '0' && !inputs.dry_run }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -84,4 +118,5 @@ jobs:
         run: |
           echo "## Summary"
           echo ""
-          echo "**PRs processed:** ${{ steps.find-ready.outputs.count }}"
+          echo "**PRs merged/ready:** ${{ steps.find-ready.outputs.count }}"
+          echo "**PRs skipped:** ${{ steps.find-ready.outputs.skipped }}"

.github/workflows/brain-seal-refresh.yml

@@ -8,6 +8,9 @@ on:
       - 'scripts/aggregate-experience.sh'
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   refresh-brain-seals:
     runs-on: ubuntu-latest
@@ -43,10 +46,15 @@ jobs:
           path: .trinity/seals/brain_*.json
 
       - name: Commit brain seals
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
-          git config --local user.email "admin@t27.ai"
+          git config --local user.email "t27-bot@trinity.ai"
           git config --local user.name "T27 Autonomous Agent"
           git add .trinity/seals/brain_*.json
-          git diff --staged --quiet || echo "No changes to commit"
-          git commit -m "chore: refresh brain seals from experience aggregation" || echo "Nothing to commit"
+          if git diff --staged --quiet; then
+            echo "No brain seal changes to commit"
+            exit 0
+          fi
+          git commit -m "chore: refresh brain seals from experience aggregation (Refs #1440)"
           git push

.trinity/current_task/activity.md

@@ -1464,3 +1464,7 @@
 - **Commit:** docs(w420): set W420 issue number to #1361 and record W419 PR #1360 (Closes #1357, Refs #1361)
 - **Files:** .trinity/current-issue.md,.trinity/experience.md,cli/tri/src/fpga.rs,docs/NOW.md,docs/reports/FPGA_LOOP_COOPERATION_W420_2026-07-05.md,docs/reports/FPGA_LOOP_EVIDENCE_W419_2026-07-05.md,docs/reports/WAVE_LOOP_419_REPORT.md,fpga/HARDWARE_SSOT.md,proofs/lean4/Trinity/TernaryFPGABoot.lean
 
+## 2026-07-07T11:58:01Z — igla/w470-auto-workflow-harden
+- **Commit:** 
+- **Files:** .github/workflows/auto-merge-ready-prs.yml,.github/workflows/brain-seal-refresh.yml,scripts/auto-close-prs.sh,scripts/auto-merge.sh
+