merge: bring aws-samples#247 orchestration + Linear-MCP attachments onto linear-vercel

linear-vercel had diverged into a stale parallel fork (37 commits behind
main, missing the workflow-driven-tasks system + Jira that aws-samples#247 depends on).
Main has since absorbed lv's screenshot pipeline (SigV4-presigned WSS,
private S3+CloudFront, de-Vercel-ize) and multi-workspace support, so lv's
source was effectively a subset of deploy/247-dev.

This advances linear-vercel to the deploy/247-dev tree + the 4 Linear-MCP
attachments commits cherry-picked on top (issue-context probe, Attachments
bucket wiring, uploads.linear.app skip, save_issue no-op detection). Both
parents are recorded so linear-vercel remains a true descendant of its prior
tip — no history rewrite, no force-push. Content is byte-identical to the
fully-tested integ/247-attachments (agent 1123 + CDK 2586 + CLI 407 green).

linear-vercel is NOT retired — it keeps its name and continues from here as
the current Linear+Vercel demo branch, now carrying aws-samples#247.

Author: isadeks

.abca/commands/review_pr.md

@@ -71,6 +71,28 @@ Then apply principal-architect judgment over the diff:
   together and parity fixtures were refreshed.
 - **Security & least privilege** — IAM scoping, Cedar HITL gates, secrets handling, path-
   traversal guards, input validation. Fail closed.
+- **Bootstrap policy coverage (CDK deploy IAM)** — When the PR adds or changes constructs,
+  stacks, or handlers that introduce new CloudFormation resource types (new AWS services,
+  `AWS::SQS::Queue`, `AWS::CloudFront::*`, `AWS::SecretsManager::Secret`, Lambda layers,
+  application S3 buckets, etc.), verify the least-privilege bootstrap bundle was updated in
+  the **same PR**:
+  1. `cdk/src/bootstrap/policies/*.ts` — new actions and resource ARN patterns on the
+     CloudFormation execution role.
+  2. `cdk/src/bootstrap/resource-action-map.ts` — entry for each new CFN type (minimum
+     create-time IAM actions).
+  3. `BOOTSTRAP_VERSION` bumped in `cdk/src/bootstrap/version.ts` (minor when adding
+     permissions) and artifacts regenerated (`mise //cdk:bootstrap:generate` → committed
+     `cdk/bootstrap/policies/*.json`, `bootstrap-template.yaml`, `BOOTSTRAP_HASH`).
+  4. `docs/design/DEPLOYMENT_ROLES.md` golden baseline updated (required by
+     `cdk/test/bootstrap/golden-baseline.test.ts`).
+  5. `cdk/test/bootstrap/synth-coverage.test.ts` passes — run
+     `mise //cdk:test -- test/bootstrap/synth-coverage` or the full bootstrap suite.
+     **Flag as blocking** if constructs changed but bootstrap policies, the action map, or
+     version/artifacts were not updated. Missing ARN patterns (action present but resource
+     too narrow) are a common gap — check secret/queue/bucket naming against the patterns
+     in `application.ts` / `observability.ts`, not just action presence.
+  See [ADR-002](../../docs/decisions/ADR-002-least-privilege-bootstrap-policies.md) and
+  issue #350 for the failure mode this prevents.
 - **AWS / CDK quality** — Prefer L2 constructs, sane removal policies, no hardcoded ARNs/account
   IDs, cdk-nag clean. Watch for cost and operational footguns.
 - **Tests** — Are unit tests added/updated under the matching `*/test/` tree? Do they cover the
@@ -126,7 +148,8 @@ Summarize as a principal architect would in a PR review. Structure the output:
 3. **Blocking issues** — Numbered, each with `file:line`, the risk, and a suggested fix.
 4. **Non-blocking suggestions / nits** — Clearly separated.
 5. **Documentation** — What was updated, what is missing, mirror-sync status.
-6. **Tests & CI** — Coverage assessment and check status.
+6. **Tests & CI** — Coverage assessment and check status. For CDK construct/stack changes,
+   explicitly note bootstrap synth-coverage status (pass / not applicable / missing updates).
 7. **Review agents run** — List each plugin/agent you invoked (Stage 3) and, for any in-scope
    agent you omitted, the one-line reason. This section is required — its absence means the
    mandatory plugin step was skipped.

.github/CODEOWNERS

@@ -2,7 +2,29 @@
 
 ## Default owners for everything in the repo
 
-*                                   @aws-samples/coding-agents-admin
+*                                   @aws-samples/coding-agents-admin @aws-samples/coding-agents-maintainers
+
+.abca                               @aws-samples/coding-agents-admin
+.claude/settings.json               @aws-samples/coding-agents-admin
+.gitallowed                         @aws-samples/coding-agents-admin
+.gitattributes                      @aws-samples/coding-agents-admin
+.github                             @aws-samples/coding-agents-admin
+.gitignore                          @aws-samples/coding-agents-admin
+.gitleaks.toml                      @aws-samples/coding-agents-admin
+.gitleaksignore                     @aws-samples/coding-agents-admin
+.mergify.yml                        @aws-samples/coding-agents-admin
+.npmignore                          @aws-samples/coding-agents-admin
+.pre-commit-config.yaml             @aws-samples/coding-agents-admin
+.semgrep                            @aws-samples/coding-agents-admin
+.threat-composer                    @aws-samples/coding-agents-admin
+AGENTS.md                           @aws-samples/coding-agents-admin
+CLAUDE.md                           @aws-samples/coding-agents-admin
+CODE_OF_CONDUCT.md                  @aws-samples/coding-agents-admin
+contracts                           @aws-samples/coding-agents-admin
+CONTRIBUTING.md                     @aws-samples/coding-agents-admin
+LEGAL_DISCLAIMER.md                 @aws-samples/coding-agents-admin
+LICENSE                             @aws-samples/coding-agents-admin
+mise.toml                           @aws-samples/coding-agents-admin
 
 ## File must end with CODEOWNERS file
 

.github/dependabot.yml

@@ -44,6 +44,14 @@ updates:
     groups:
       all-python:
         patterns: ["*"]
+    ignore:
+      # Cedar engine parity — bump in lockstep with @cedar-policy/cedar-wasm via a
+      # dedicated coordinated PR. See docs/design/CEDAR_HITL_GATES.md §15.6 (decision #23).
+      - dependency-name: "cedarpy"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
 
   - package-ecosystem: "npm"
     directories:
@@ -59,3 +67,11 @@ updates:
     groups:
       all-npm:
         patterns: ["*"]
+    ignore:
+      # Cedar engine parity — bump in lockstep with cedarpy via a dedicated
+      # coordinated PR. See docs/design/CEDAR_HITL_GATES.md §15.6 (decision #23).
+      - dependency-name: "@cedar-policy/cedar-wasm"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"

.github/workflows/auto-approve.yml

@@ -0,0 +1,49 @@
+name: auto-approve
+# Approves PRs carrying the 'auto-approve' label (e.g. the scheduled
+# upgrade-main dependency PRs). pull_request_target is intentional and safe
+# here: the job never checks out or executes PR code — it only calls the
+# review API. Branch protection still requires the build workflow to pass.
+#
+# Trigger is `labeled` ONLY: each approval requires an explicit label event
+# from someone with triage+ permission. Approving on `synchronize` would
+# re-approve arbitrary future commits pushed to an already-labeled PR with no
+# human re-review — combined with Mergify's auto-merge that is an
+# unreviewed-merge path. The Mergify `dismiss stale approvals` rule is the
+# other half of this invariant: a push invalidates the bot's prior approval,
+# and re-approval requires removing and re-adding the label (deliberate
+# friction: new content needs a fresh, explicit trigger).
+on:
+  pull_request_target:
+    types:
+      - labeled
+permissions:
+  actions: none
+  attestations: none
+  checks: none
+  contents: none
+  deployments: none
+  discussions: none
+  id-token: none
+  issues: none
+  models: none
+  packages: none
+  pages: none
+  pull-requests: none
+  repository-projects: none
+  security-events: none
+  statuses: none
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    # Only act on the auto-approve label itself, and never on fork PRs —
+    # a fork head can be force-pushed by the fork owner after labeling.
+    if: |
+      github.event.label.name == 'auto-approve' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    steps:
+      - uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
+        with:
+          github-token: ${{ secrets.AUTOMATION_GITHUB_TOKEN }}
+          review-message: Auto approved automated PR

.github/workflows/build.yml

@@ -140,7 +140,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -153,7 +153,7 @@ jobs:
           github-token: ${{ github.token }}
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -215,7 +215,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -228,13 +228,13 @@ jobs:
           github-token: ${{ github.token }}
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           aws-region: ${{ vars.AWS_REGION }}
 
       - name: Install mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
         with:
           cache: true