fix(igla): harden auto-merge and brain-seal-refresh workflows

Closes #1440

Author: gHashTag

.github/workflows/auto-merge-ready-prs.yml

@@ -14,6 +14,7 @@ on:
         default: false
 
 permissions:
+  contents: write
   pull-requests: write
 
 jobs:
@@ -29,46 +30,79 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           READY_PRS=()
-          echo "Finding PRs with all CI checks passing..."
+          echo "Finding PRs with all CI checks passing and L1 traceability..."
 
           PR_LIST=$(gh pr list --state open --limit 50 --json number --jq '.[].number' 2>/dev/null || echo "")
 
           if [ -z "$PR_LIST" ]; then
             echo "No open PRs found"
             echo "ready_prs=" >> $GITHUB_OUTPUT
             echo "count=0" >> $GITHUB_OUTPUT
+            echo "skipped=0" >> $GITHUB_OUTPUT
             exit 0
           fi
 
+          SKIPPED=0
+          L1_RE='(Closes?|Fixes?|Resolves?|Refs?|Updates?)\s*#[0-9]+'
+
           for pr in $PR_LIST; do
-            MAIN_CHECKS=$(gh pr view "$pr" --json statusCheckRollup --jq \
-              '[.statusCheckRollup[] | select(.name != "NotebookLM Auto-Sync" and .name != ".github/workflows/notebook-sync.yml")]' 2>/dev/null || echo "[]")
+            echo "Evaluating PR #$pr..."
+
+            # L1 TRACEABILITY: require an issue reference in title or body.
+            PR_METADATA=$(gh pr view "$pr" --json title,body,reviews,statusCheckRollup 2>/dev/null || echo "")
+            if [ -z "$PR_METADATA" ]; then
+              echo "  Skipped: cannot fetch PR metadata"
+              SKIPPED=$((SKIPPED + 1))
+              continue
+            fi
+
+            TITLE=$(echo "$PR_METADATA" | jq -r '.title // empty')
+            BODY=$(echo "$PR_METADATA" | jq -r '.body // empty')
+            if ! echo "$TITLE
+$BODY" | grep -qiE "$L1_RE"; then
+              echo "  Skipped: missing L1 TRACEABILITY issue reference"
+              SKIPPED=$((SKIPPED + 1))
+              continue
+            fi
+
+            # Review gate: require at least one APPROVED review.
+            APPROVED_REVIEWS=$(echo "$PR_METADATA" | jq '[.reviews[]? | select(.state == "APPROVED")] | length')
+            if [ "$APPROVED_REVIEWS" = "0" ]; then
+              echo "  Skipped: no approved review"
+              SKIPPED=$((SKIPPED + 1))
+              continue
+            fi
 
-            FAILING=$(echo "$MAIN_CHECKS" | jq '[.[] | select(.conclusion != "SUCCESS" and .conclusion != "SKIPPED")] | length' 2>/dev/null || echo "1")
+            MAIN_CHECKS=$(echo "$PR_METADATA" | jq \
+              '[.statusCheckRollup[]? | select(.name != "NotebookLM Auto-Sync" and .name != ".github/workflows/notebook-sync.yml")]')
+            FAILING=$(echo "$MAIN_CHECKS" | jq '[.[] | select(.conclusion != "SUCCESS" and .conclusion != "SKIPPED")] | length')
 
-            echo "PR #$pr: $FAILING failing checks"
+            echo "  Failing checks: $FAILING | Approved reviews: $APPROVED_REVIEWS"
 
             if [ "$FAILING" = "0" ]; then
               READY_PRS+=("$pr")
               echo "  Ready to merge"
             else
-              echo "  Skipped ($FAILING failing)"
+              echo "  Skipped ($FAILING failing checks)"
+              SKIPPED=$((SKIPPED + 1))
             fi
           done
 
           echo "ready_prs=${READY_PRS[*]}" >> $GITHUB_OUTPUT
           echo "count=${#READY_PRS[@]}" >> $GITHUB_OUTPUT
+          echo "skipped=$SKIPPED" >> $GITHUB_OUTPUT
 
       - name: Dry Run Check
-        if: inputs.dry_run == 'true'
+        if: inputs.dry_run
         run: |
           echo "DRY RUN - No actual merges will occur"
           echo "Ready PRs: ${{ steps.find-ready.outputs.count }}"
+          echo "Skipped PRs: ${{ steps.find-ready.outputs.skipped }}"
           echo "PRs: ${{ steps.find-ready.outputs.ready_prs }}"
           exit 0
 
       - name: Merge Ready PRs
-        if: steps.find-ready.outputs.count != '0'
+        if: ${{ steps.find-ready.outputs.count != '0' && !inputs.dry_run }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -84,4 +118,5 @@ jobs:
         run: |
           echo "## Summary"
           echo ""
-          echo "**PRs processed:** ${{ steps.find-ready.outputs.count }}"
+          echo "**PRs merged/ready:** ${{ steps.find-ready.outputs.count }}"
+          echo "**PRs skipped:** ${{ steps.find-ready.outputs.skipped }}"

.github/workflows/brain-seal-refresh.yml

@@ -8,6 +8,9 @@ on:
       - 'scripts/aggregate-experience.sh'
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   refresh-brain-seals:
     runs-on: ubuntu-latest
@@ -43,10 +46,15 @@ jobs:
           path: .trinity/seals/brain_*.json
 
       - name: Commit brain seals
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
-          git config --local user.email "admin@t27.ai"
+          git config --local user.email "t27-bot@trinity.ai"
           git config --local user.name "T27 Autonomous Agent"
           git add .trinity/seals/brain_*.json
-          git diff --staged --quiet || echo "No changes to commit"
-          git commit -m "chore: refresh brain seals from experience aggregation" || echo "Nothing to commit"
+          if git diff --staged --quiet; then
+            echo "No brain seal changes to commit"
+            exit 0
+          fi
+          git commit -m "chore: refresh brain seals from experience aggregation (Refs #1440)"
           git push

.trinity/current_task/activity.md

@@ -1504,3 +1504,11 @@
 - **Commit:** 
 - **Files:** .trinity/audit/igla-loop-state.json
 
+## 2026-07-07T11:58:01Z — igla/w470-auto-workflow-harden
+- **Commit:** 
+- **Files:** .github/workflows/auto-merge-ready-prs.yml,.github/workflows/brain-seal-refresh.yml,scripts/auto-close-prs.sh,scripts/auto-merge.sh
+
+## 2026-07-07T12:14:42Z — igla/w470-auto-workflow-harden
+- **Commit:** 
+- **Files:** docs/NOW.md
+

docs/NOW.md

@@ -12,6 +12,15 @@ Last updated: 2026-07-07
 - Completed: worktree cleanup (#1442); salvaged compiler postfix-array change to `salvage/ae9fe-postfix-array-notation`.
 - Blocked: W469 2D-struct-array Verilog lowering (#1443, blocked on `wave-loop-469`); Digilent FTDI `cli/dlc10` support (#1446, blocked on hardware access).
 
+## IGLA cycle 1 — auto-workflow hardening (Closes #1440)
+
+- PR #1441 hardens `.github/workflows/auto-merge-ready-prs.yml` and
+  `.github/workflows/brain-seal-refresh.yml` with explicit permissions,
+  L1 traceability gating, correct dry-run boolean handling, and change-detection
+  guards before `git commit`.
+- This closes issue #1440 (automated workflows could merge/commit without
+  issue linkage or review).
+
 ## Architecture — ADR-007 documents de-jure/de-facto split for generated .v in specs/ (Closes #1435)
 
 - Fact-check on HEAD 6c704801: specs/**/*.v = 61 files, gen/**/*.v = 33. Issues