[BotshareAI]

Summary

This PR adds a deterministic, read-only daily software-health report to the Watchdog and adds openamrobot-embodied-ai to the scanned repositories. No AI runs in this PR. decisions.yaml and the Thursday workflow .github/workflows/watchdog-org-scan.yml are unchanged.

The report runs on weekdays at 04:41 UTC and on demand. For every repository in rollout/repositories.yaml it collects, through the GitHub REST API:

• CI conclusions on the default branch and the 7-day green rate;
• open PRs;
• rc.1 issues;
• PRs and issues with no update for 14 days.

It uploads daily.json and daily.md as the watchdog-daily artifact and writes daily.md into a "Daily" section of the existing "[watchdog] Organization dashboard" issue. A repository it cannot read is "not measured", and the run is then INCOMPLETE and red.

Precondition

• Repository: openAMRobot/.github
• Branch: claude/cool-babbage-jyje2v. It was restarted from origin/main because its previous PR, decisions: head camera 42 mm forward and baseline pitch 30 degrees, second E-stop on the static lift column (P-03 rev20.0) #68, is merged.
• Parent SHA: 71c439e3b6dc823589ba2020a7063cf4dce72c13
• Expected outcome: one draft PR with the seven tasks below. No other repository is written to. No setting is changed.
• STATE.md: not present in this repository.

Work package

• Audit of 29 Oct 2026 (Watchdog gaps).
• [audit] EMBODIED-AI-REPO consumer is missing from the Watchdog manifest #59: openamrobot-embodied-ai is missing from the Watchdog manifest. This PR adds it. The issue stays open for its owner.
• Activation gate for AI workflows (docs-sync, weekly audit, monthly retro) #43: the AI activation gate. The AI summary stays design only.

Changes

Task 1: openamrobot-embodied-ai

• rollout/repositories.yaml: {name: openamrobot-embodied-ai, default_branch: main, agent_rules: required}.
• maintainers.yaml: openamrobot-embodied-ai: [software-lead], in the same style as the other software repositories.
• tests/test_org_scan.py: the repository count goes from 14 to 15, and the INCOMPLETE counts change to match.
• The Thursday scan will now report openamrobot-embodied-ai as required/missing AGENTS.md. That is the intended finding.

Task 2: tools/watchdog_daily.py (standard library only)

• CI: only completed runs whose head branch is the default branch, from this repository rather than a fork, within the last 7 days. It reports the latest conclusion per workflow file. The green rate is success / (success + failure + timed_out + startup_failure); cancelled, skipped and neutral runs are counted separately.
• Pull requests: number, draft state, author, age and days since the last update.
• rc.1 issues: issues labelled rc.1 or with [rc.1] in the title. Pull requests are removed from the issues list. Each entry shows assignees and age.
• Stale: PRs and issues with no update for 14 days.
• API handling:
  • Pagination follows Link rel="next", because GitHub returns /repositories/<id>/ URLs.
  • It waits on rate limits, using Retry-After or X-RateLimit-Reset, for at most --max-wait.
  • It backs off on 5xx errors.
  • It stops at 20 pages rather than truncating.
• Fail closed:
  • Any read error makes that repository "not measured" with the reason; other repositories continue.
  • The run is then INCOMPLETE and the tool exits 1 after writing both files.
  • An unreadable repository list exits 2 and writes nothing.
  • HTTP 410 on issues is reported as "issues disabled", not as a failure.
• Output:
  • daily.json holds all data.
  • daily.md has at most 60 lines: header, then changes since the previous daily.json, then one table row per repository. With 15 repositories, one table per repository would not fit in 60 lines, so the table has one row each.
  • With no previous report it says so instead of inventing changes.
  • Logins and workflow file names are sanitised, so the report contains no @ mentions.

Task 3: tests

• tests/test_watchdog_daily.py has 23 tests. tests/test_watchdog_issue_sync.py has 7 new tests for --daily.
• tests/fixtures/watchdog_daily/ holds recorded API fixtures. The response layout was recorded from openAMRobot/.github on 2026-10-29 and trimmed; repositories, numbers and logins are synthetic.
• The fixtures cover green and red runs, a draft PR, a stale PR, rc.1 issues by label and by title, an unreadable repository (404), issues disabled (410), a rate limit followed by a 502, and two-page pagination.

Task 4: .github/workflows/watchdog-daily.yml

• Schedule 41 4 * * 1-5 (UTC) plus workflow_dispatch.
• Permissions contents: read, issues: write, actions: read.
• Concurrency group watchdog-daily without cancel; timeout 20 minutes.
• It downloads the newest earlier watchdog-daily artifact for the diff, using gh api and actions: read. If there is none, the report says there is no previous report.
• It runs the collector and uploads the watchdog-daily artifact (30 days).
• It runs watchdog_issue_sync.py --daily ... --apply.
• tools/check_workflow_policy.py reports 0 findings; both actions are pinned to the same SHAs as the Thursday workflow.
• --daily in tools/watchdog_issue_sync.py:
  • It replaces only the text between <!-- watchdog:daily:start --> and <!-- watchdog:daily:end --> and leaves the title and labels unchanged.
  • It creates the dashboard if none exists and writes nothing when the content is unchanged.
  • A missing daily.md is published as "Daily report INCOMPLETE" and the tool exits 1.
  • Markers in the report text are stripped, and credential-shaped values are redacted.
• Thursday scan: its workflow file is unchanged, but the sync tool now carries the existing Daily section over when the Thursday scan rewrites the dashboard. Without this, every Thursday run would wipe the Daily section.

Task 5: rollout/workflows/watchdog-daily-summary.yml (design only, not under .github/workflows)

• Triggered by workflow_run of "Watchdog daily".
• Guarded by if: vars.AI_STAGE_1_ENABLED == 'true'.
• Its only input is the triggering run's daily.json; there is no checkout.
• anthropics/claude-code-action@8c3fd987fa6a6b2654f69275e323d08207fcd36c # v1.0.264, with --max-turns 15 and --allowedTools "Read,Grep,Glob".
• It writes only to its own job summary.
• rollout/workflows/SETUP.md gains state rows and section 9, which has the activation steps and points to Activation gate for AI workflows (docs-sync, weekly audit, monthly retro) #43.

Task 6: WATCHDOG.md

• A short "Daily report" section covering what it reads, where it posts, and how to stop it (Actions, Watchdog daily, Disable workflow).

Integration Gate

• Reused:
  • the dashboard issue, marker, label and create_issue / ensure_labels / fetch_existing of watchdog_issue_sync.py;
  • the action SHAs of watchdog-org-scan.yml;
  • the fail-closed vocabulary (not measured, INCOMPLETE, red job).
• Overlapping work: [audit] EMBODIED-AI-REPO consumer is missing from the Watchdog manifest #59 (task 1). No open PR overlaps.
• Rejected:
  • Narrowing safety_paths in maintainers.yaml to stop the **/*watchdog* glob matching these files. That would weaken a check. See Safety impact.
  • A third-party download-artifact action. gh api with actions: read needs no new pinned action.
  • Showing PR titles. Numbers, authors and ages are enough and keep untrusted text out of the public issue.

Sample report

I ran the collector once in this session against the real organization: python3 tools/watchdog_daily.py --repositories rollout/repositories.yaml --out <dir> --previous <first run>/daily.json --max-wait 30. It exited 1 (INCOMPLETE). This session's token is scoped to openAMRobot/.github; the session proxy answered HTTP 403 for the API of every other repository. I did not attach credentials with write access to those repositories just to read them. The run therefore shows the fail-closed path for 14 repositories, and live data only for .github. A scheduled or manual run with the workflow token is the first full measurement.

### Daily software health, 2026-10-29 19:07:07 UTC: INCOMPLETE (1 of 15 repositories measured)

Read-only GitHub REST API data for the repositories in rollout/repositories.yaml. CI: default branch, last 7 days; green rate = success / (success + failure + timed out + startup failure). Stale: no update for 14 days. Deterministic, no AI.

**INCOMPLETE: repositories marked not measured were not read and are not healthy or clean.**

Changes since 2026-10-29T18:59:41Z: none.

| Repository | CI latest per workflow | Green 7d | Open PRs | rc.1 issues | Stale |
|---|---|---|---|---|---|
| .github | 2 green | 100% (6/6) | 1 (0 draft): #41 wikki26 22d, upd 0d | none | issue #42; issue #43 |
| openamr-platform-sw | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamr-platform-fw | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamr-platform-hw | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamr-upperbody-sw | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamr-upperbody-fw | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamr-upperbody-hw | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamrobot-interfaces | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamrobot-manipulation | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamrobot-ui | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamrobot-comm | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamrobot-docs | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamrobot-embodied-ai | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamrobot-manifest | not measured: workflow runs: HTTP 403 | - | - | - | - |
| openamrobot-release | not measured: workflow runs: HTTP 403 | - | - | - | - |

Tests

• Before: python3 -m pytest tests -q 278 passed; bash rollout/verify.sh 278 tests, 0 skipped, PASS.
• After: python3 -m pytest tests -q 308 passed (23 new in test_watchdog_daily.py, 7 new in test_watchdog_issue_sync.py); bash rollout/verify.sh 308 of 308, 0 skipped, PASS.

Revert run. Each behaviour was reverted in the tool, one at a time, and the tests were run with python3 -m pytest tests/test_watchdog_daily.py tests/test_watchdog_issue_sync.py -q. The source was restored after each run, and the suite then passed, 55 of 55.

pagination (Link next ignored): 5 failed, 50 passed in 1.38s
    FAILED Collector::test_endless_pagination_is_not_measured_not_truncated
    FAILED Collector::test_green_and_red_runs_latest_per_workflow_and_green_rate
    FAILED Collector::test_pagination_follows_the_link_header
    FAILED Report::test_changes_since_previous_come_first
    FAILED Report::test_table_row_per_repository
fork and window filter removed: 3 failed, 52 passed in 1.23s
    FAILED Collector::test_green_and_red_runs_latest_per_workflow_and_green_rate
    FAILED Report::test_changes_since_previous_come_first
    FAILED Report::test_table_row_per_repository
draft flag dropped: 2 failed, 53 passed in 1.37s
    FAILED Collector::test_draft_and_stale_pull_requests
    FAILED Report::test_table_row_per_repository
stale threshold removed: 3 failed, 52 passed in 1.72s
    FAILED Collector::test_draft_and_stale_pull_requests
    FAILED Report::test_changes_since_previous_come_first
    FAILED Report::test_table_row_per_repository
rc.1 title match removed: 3 failed, 52 passed in 1.25s
    FAILED Collector::test_rc1_issues_by_label_or_title_without_pull_requests
    FAILED Report::test_changes_since_previous_come_first
    FAILED Report::test_table_row_per_repository
unreadable repository raises (no not measured): 17 failed, 38 passed in 1.79s
    FAILED Collector::test_draft_and_stale_pull_requests
    FAILED Collector::test_endless_pagination_is_not_measured_not_truncated
    FAILED Collector::test_green_and_red_runs_latest_per_workflow_and_green_rate
    FAILED Collector::test_issues_disabled_is_reported_not_guessed
    FAILED Collector::test_one_failing_repository_never_stops_the_others
    FAILED Collector::test_pagination_follows_the_link_header
    FAILED Collector::test_rate_limit_longer_than_max_wait_is_not_measured
    FAILED Collector::test_rate_limit_waits_for_reset_and_retries_server_errors
    FAILED Collector::test_rc1_issues_by_label_or_title_without_pull_requests
    FAILED Collector::test_unreadable_repository_is_not_measured_and_the_run_incomplete
    FAILED Report::test_at_most_60_lines_with_many_repositories_and_changes
    FAILED Report::test_changes_since_previous_come_first
    FAILED Report::test_output_is_deterministic
    FAILED Report::test_table_row_per_repository
    FAILED Report::test_untrusted_names_cannot_mention_or_break_the_table
    FAILED Report::test_without_previous_report_no_change_is_invented
    FAILED CommandLine::test_incomplete_run_writes_both_files_and_exits_one
rate-limit wait removed: 5 failed, 50 passed in 1.22s
    FAILED Collector::test_rate_limit_longer_than_max_wait_is_not_measured
    FAILED Collector::test_rate_limit_waits_for_reset_and_retries_server_errors
    FAILED Collector::test_unreadable_repository_is_not_measured_and_the_run_incomplete
    FAILED Report::test_changes_since_previous_come_first
    FAILED CommandLine::test_complete_run_exits_zero
60-line cap removed: 1 failed, 54 passed in 1.22s
    FAILED Report::test_at_most_60_lines_with_many_repositories_and_changes
--daily replaces whole body: 2 failed, 53 passed in 1.35s
    FAILED DailySection::test_appends_the_section_when_absent_and_skips_unchanged
    FAILED DailySection::test_replaces_only_the_daily_section
Thursday rewrite drops Daily: 1 failed, 54 passed in 1.37s
    FAILED DailySection::test_thursday_rewrite_keeps_the_daily_section
missing daily.md not INCOMPLETE: 1 failed, 54 passed in 1.41s
    FAILED DailySection::test_missing_report_is_published_as_incomplete_and_exits_one

Evidence

Base SHA: 71c439e
Head SHA: 49a20d0

bash rollout/verify.sh
  PASS: prerequisites / install / build / lint / test-markers / test / evidence
  Tests executed: 308 of 308 (skipped 0)
python3 -m pytest tests -q
  308 passed
python3 tools/check_workflow_policy.py
  result: 0 workflow policy findings
python3 tools/check_agent_rules.py --canonical agent-rules/SHARED_RULES.md --file AGENTS.md
  PASS AGENTS.md (v2)
python3 tools/check_decisions.py --decisions decisions.yaml --maintainers maintainers.yaml --validate-only
  decisions: 39 loaded, 35 recorded and scanned, 1 open, 3 superseded   exit 0
python3 tools/check_decisions.py --decisions decisions.yaml --maintainers maintainers.yaml --root . --repository .github
  result: 0 contradiction(s)
python3 tools/check_public_extract.py --root . --repository .github --changed-files <changed files>
  result: 0 finding(s)   (a full scan reports 50 findings, the same 50 as on main; none in changed files)
python3 tools/watchdog_daily.py --repositories rollout/repositories.yaml --out <dir> [--previous <dir>/daily.json] --max-wait 30
  Daily report incomplete: 1 of 15 repositories measured, 17 API requests   exit 1
python3 tools/check_pr_evidence.py --event <this description> --changed-files <diff> --maintainers maintainers.yaml --commit-messages <log> --root .
  FAIL only on the three safety-path items described in Safety impact; every evidence-presence rule passes

Dependencies

None. tools/watchdog_daily.py uses the standard library only. The publish step installs PyYAML==6.0.2 only when it is missing, exactly as the Thursday workflow already does.

Safety impact

None to safety logic. This is a CI report that reads GitHub API data and edits one issue. It touches no E-stop, brake, contactor, motor-enable or charge-inhibit code, and no firmware or safety-chain watchdog.

maintainers.yaml lists **/*watchdog* under safety_paths, and the file names this task specifies (tools/watchdog_daily.py, tools/watchdog_issue_sync.py, tests/test_watchdog_*.py, .github/workflows/watchdog-daily.yml, rollout/workflows/watchdog-daily-summary.yml, tests/fixtures/watchdog_daily/*) match it. check_pr_evidence.py will therefore report this PR as a safety-path change in a PR with AI assistance, and fail.

I did not narrow the glob, because that would weaken a check. The name collision between the organization Watchdog and safety watchdogs is for the platform lead to resolve, either by approving this PR under the two-approval rule or by scoping the glob in a separate reviewed PR. The PR is opened under the platform lead's account, so the software lead (panthera-momagdii) and the CI owner (wikki26) are requested as the two other human reviewers. The check's "platform lead is not requested" item cannot clear while the platform lead is the author; maintainers.yaml review_policy (platform-lead-authored) applies.

STATE.md

No STATE.md exists in this repository; no change.

Activation

1. Merge this PR (human decision).
2. In Actions, open "Watchdog daily" and choose "Run workflow" on main.
3. Check four things:
   • the job summary shows the report;
   • the watchdog-daily artifact holds daily.json and daily.md;
   • the dashboard issue ([watchdog] Organization dashboard #44) has a "Daily" section;
   • the Thursday part of [watchdog] Organization dashboard #44 is unchanged.
4. The weekday schedule then runs on its own at 04:41 UTC. To stop it, go to Actions, open Watchdog daily and choose Disable workflow.
5. The AI summary stays off: rollout/workflows/watchdog-daily-summary.yml is not installed, and its activation follows rollout/workflows/SETUP.md section 9 only after Activation gate for AI workflows (docs-sync, weekly audit, monthly retro) #43 is closed.

Not verified

• Not run on GitHub:
  • the scheduled run after merge and the manual dispatch;
  • the dashboard edit on the live issue [watchdog] Organization dashboard #44: --apply was not run, so nothing was posted;
  • the previous-artifact download step (gh api artifacts and unzip);
  • the artifact upload.
• Workflow-token read access: that the workflow GITHUB_TOKEN can read Actions runs, pulls and issues of the other public repositories in the organization is assumed from public-repository API access. It was not shown in this session, where those calls returned 403 from the session proxy.
• Live data: for 14 of 15 repositories it has not been collected, because of that 403. Only .github was measured live.
• Thursday carry-over: the Daily section surviving a Thursday rewrite is covered by a unit test only.
• AI summary: rollout/workflows/watchdog-daily-summary.yml never ran. The action input names and the execution_file output are taken from the v1 action interface and were not exercised.
• Evidence check: check_pr_evidence.py was run locally on this description only, not in CI.

AI disclosure

Claude Code (Claude, Anthropic), acting as CI and release engineer at the request of the platform lead. It wrote every changed file listed above, generated the test fixtures, ran every command in Evidence, ran the collector once against the organization, and wrote this description. The commit is signed off with the git identity configured in the session environment. Human review must check the workflow permissions, the fail-closed behaviour and the safety-path note above.

Contribution terms

• Every commit is signed off under the DCO.
• I am covered by an accepted Contributor Agreement.
• Third-party material is identified with source and licence.
• No confidential, personal, credential or export-controlled information is included.
• No partner, customer or private person is named; the application is Use_Case_1.

---

Generated by Claude Code

[panthera-momagdii]

Draft review for head 49a20d0b9b6ca6ff81667b90f2999087f9ea9b8c: the deterministic collector, fail-closed handling, dashboard-section isolation, sanitization, and fixture coverage are well structured, and the current repository-quality checks pass. I am not approving the draft yet because the production path is still unverified: the only live collection recorded in the PR measured 1 of 15 repositories, and this new scheduled/manual workflow has not demonstrated that its actual GITHUB_TOKEN can read all enrolled repositories, upload the artifact, and update only the Daily section. Before marking ready, add a safe live dry-run path or equivalent evidence, record a COMPLETE run for all 15 repositories (or document any intentional inaccessible repository), then retain the required two human approvals for the Watchdog safety-path changes. Do not weaken the existing **/*watchdog* review rule.

[wikki26]

[P1] Reject repository entries that the daily collector cannot parse.

Reviewed head 49a20d0. In tools/watchdog_daily.py, load_repositories() silently continues past every non-flow-mapping line. A valid YAML block-style entry, or a damaged flow entry, is therefore omitted while the remaining entries determine both expected and measured. collect() can label that reduced scan complete.

Local reproduction: a repositories file containing - {name: good, default_branch: main} followed by a block mapping - name: silently-omitted / default_branch: main returns only [('good', 'main')] without an error. Both entries are part of the supplied repository list. This repeats the incomplete-scan failure class fixed in the organization scanner.

Please parse and validate the complete YAML structure (or strictly reject every unsupported repository-list line), retain an independent expected-coverage check, and add regressions for block-style entries, malformed entries among valid entries, and truncated lists. Missing repositories must be explicitly incomplete, never silently dropped.

Validation: python3 -m pytest -q tests on this exact head: 308 passed, 226 subtests passed. The standalone parser reproduction above was run locally and exposes a gap outside those tests. Existing live-token/artifact/Daily-section acceptance concerns remain; no live workflow, dashboard write, hardware or safety validation was performed. OpenAI ChatGPT/Codex-assisted review; not approval or activation.