MIP-0086: GitHub Apps for automation — marola-pr-bot opens, marola-merge-bot merges #787

MIP-0086 (#773 until it merges): every automated GitHub write moves from three PATs to two org Apps, marola-pr-bot (proposes) and marola-merge-bot (lands). Its tasks file orders the work; one sub-issue per row, filed in the repo its PR lands in. Rows 13 and 14 are #740 and #762, which keep their own merge-policy design.

• task 1: MIP-0086 task 1: rename the Apps, widen marola-merge-bot, set the new secrets (a person) #784
• task 2: MIP-0086 task 2: bot-token action, merge-key-check, notify-umbrella and gemini-review on marola-pr-bot marola-devkit#79
• task 3: MIP-0086 task 3: ruleset-sync's @consumers extra gives marola-merge-bot its bypass marola-devkit#100
• task 4: MIP-0086 task 4: pointer-sync opens as marola-pr-bot, merges as marola-merge-bot, honours hold and AUTO_MERGE #766
• task 5: MIP-0086 task 5: site-data pushes and site-data-updated as marola-pr-bot marola-app#91
• task 6: MIP-0086 task 6: Scala Steward as marola-pr-bot marola-app#92
• task 7: MIP-0086 task 7: the compiled-prompt PR opened as marola-pr-bot marola-ml#37
• task 8: MIP-0086 task 8: bump-consumers prepares without a key and publishes as marola-merge-bot marola-devkit#80
• task 9: MIP-0086 task 9: refresh.yml opens its PR with github.token and dispatches CI marola-skills#14
• task 10: MIP-0086 task 10: docs — the two Apps, the leak runbook, AUTO_MERGE, NEW-REPO #785
• task 11: MIP-0086 task 11: retire MAROLA_CROSS_REPO_PAT, MAROLA_BUMP_PAT, STEWARD_GH_TOKEN and the old App names (a person) #765
• task 12: MIP-0086 task 12: leak drill — does suspending marola-merge-bot stop a token already minted? marola-devkit#101
• task 13: Dependabot: auto-merge green pip updates through their own GitHub App, after a cooldown #740
• task 14: Devkit bumps merge themselves in every consumer: soak, canary, semver, scope guard, kill switch #762
• task 15: MIP-0086 task 15: MIP-0086 Implemented #786
• task 16: MIP-0086 task 16: notify-umbrella passes marola-pr-bot's key, not MAROLA_CROSS_REPO_PAT marola-app#95
• task 16: MIP-0086 task 16: notify-umbrella passes marola-pr-bot's key, not MAROLA_CROSS_REPO_PAT marola-corpus#16
• task 16: MIP-0086 task 16: notify-umbrella passes marola-pr-bot's key, not MAROLA_CROSS_REPO_PAT marola-ml#40
• task 16: MIP-0086 task 16: notify-umbrella passes marola-pr-bot's key, not MAROLA_CROSS_REPO_PAT marola-oods#34
• task 16: MIP-0086 task 16: notify-umbrella passes marola-pr-bot's key, not MAROLA_CROSS_REPO_PAT marola-site#111

Follow-up, ci-rule (2026-10-14): main-rule gains a 1-approval requirement and a second ruleset, ci-rule, requires ci-ok from GitHub Actions with no bypass actors, so neither bot can merge a red PR.

• ci-ok: MIP-0086 follow-up: a ci-ok job in ci.yml for ci-rule #812

• ci-ok: MIP-0086 follow-up: a ci-ok job in ci.yml for ci-rule marola-app#104

• ci-ok: MIP-0086 follow-up: a ci-ok job in ci.yml for ci-rule marola-site#130

• ci-ok: MIP-0086 follow-up: a ci-ok job in ci.yml for ci-rule marola-ml#44

• ci-ok: MIP-0086 follow-up: a ci-ok job in ci.yml for ci-rule marola-corpus#19

• ci-ok: MIP-0086 follow-up: a ci-ok job in ci.yml for ci-rule marola-oods#39

• ci-ok: MIP-0086 follow-up: a ci-ok job in devkit-ci.yml for ci-rule marola-devkit#111

• ruleset-sync: MIP-0086 follow-up: ruleset-sync manages ci-rule beside main-rule; main-rule needs 1 approval marola-devkit#112

• apply (a person, blocked by all of the above): MIP-0086 follow-up: apply ci-rule and main-rule's approval count (a person) #813

• prerequisite of MIP-0086 follow-up: apply ci-rule and main-rule's approval count (a person) #813: MIP-0086 follow-up: skills-update.yml opens its PR as marola-pr-bot (pr_bot_key) marola-devkit#116 (skills-update.yml as marola-pr-bot)

• prerequisite of MIP-0086 follow-up: apply ci-rule and main-rule's approval count (a person) #813: MIP-0086 follow-up: members.yml opens its PR as marola-pr-bot marola-site#133 (members.yml as marola-pr-bot)

• prerequisite of MIP-0086 follow-up: apply ci-rule and main-rule's approval count (a person) #813: MIP-0086 follow-up: skills.yml passes pr_bot_key to skills-update.yml marola-site#134 (skills.yml passes pr_bot_key; after Mip 0011/6 claude rules split #116's release)

• prerequisite of MIP-0086 follow-up: apply ci-rule and main-rule's approval count (a person) #813: MIP-0086 task 6: Scala Steward as marola-pr-bot marola-app#92 (task 6, Scala Steward as marola-pr-bot)

Follow-ups after the ci-rule apply (2026-10-14, #813):

• docker.yml's image build under ci-ok: MIP-0086 follow-up: run docker.yml's image build under ci-ok (changes-gated, in ci.yml) marola-app#110
• NEW-REPO.md adds ci-ok before rulesets-apply: MIP-0086 follow-up: NEW-REPO.md adds the ci-ok job before rulesets-apply #824
• Cost row out of the PR template: Remove the Cost row from the PR template marola-site#140, Remove the Cost row from the PR template marola-app#111, Remove the Cost row from the PR template marola-corpus#23, Remove the Cost row from the PR template marola-oods#43

Follow-ups after wave 3 (2026-10-16 and 2026-10-17):

• REPOS.md routing rows name deleted workflows: REPOS.md's routing row names marola-app's docker.yml, which app#110 folds into ci.yml #855
• skills-update drops its token fallback: skills-update drops its token secret fallback (pre-MIP-0086) marola-devkit#148
• runner-preflight drops the STEWARD_GH_TOKEN advice: runner-preflight stops advising the STEWARD_GH_TOKEN PAT; Scala Steward runs as marola-pr-bot marola-devkit#149
• deps-stack and pr_labels match Steward as marola-pr-bot: deps-stack and pr_labels find Scala Steward PRs by marola-pr-bot and the update/ branch, not app/scala-steward marola-devkit#167
• workflow-runners exempts the removed marola-sea-publish.yml: workflow-runners exempts marola-sea-publish.yml, which no longer exists marola-devkit#168
• wiring reads a paths-filter changes job (follow-up to REPOS.md's routing row names marola-app's docker.yml, which app#110 folds into ci.yml #855): wiring reads a changes job's paths-filter as a pin trigger, so ci.yml's corpus.version rebuild is listed marola-devkit#169
• ruff.toml excludes every submodule: ruff.toml excludes every submodule, so just quality passes in a --recurse-submodules clone #870
• refresh.yml opens its PR as marola-pr-bot (GITHUB_TOKEN may not create PRs): refresh.yml opens its PR as marola-pr-bot: GITHUB_TOKEN may not create PRs in this org marola-skills#32