feat(ci): isolate triage agent credentials and run all triage on ECS (#16468)

* feat(ci): isolate triage agent credentials and run all triage on ECS

The triage agent carried a write PAT, so comment reruns and external fork-PR triage had to stay on ephemeral hosted runners while hosted capacity is tight and the ECS pool has headroom. Wire the token-isolation follow-up the workflow already documented: the agent reads GitHub with the job's read-only GITHUB_TOKEN and expresses every write as a draft; a separate publish job validates and executes drafts with the bot PAT, using one publisher script shared with local /triage runs. Contain the agent job, launch the CLI directly behind the hardened loopback model proxy, and move the deterministic maintainer resolver into the publisher. With no write credential in the agent environment, route every triage trigger to ECS behind the existing kill switch, and retire author_can_write. Markers, bot identity, and the finalize workflow's approve-on-green protocol are unchanged.

Co-authored-by: Qwen-Coder <[email protected]>

* fix(ci): bump triage CI budget and address triage review findings

The new publish-triage job crossed the .ci-budget ratchet (7->8 jobs, 280->290 declared timeout-minutes), aborting Lint & Static before any lint or helper test ran. Bump the budget entry, mirror the artifact-name fallback expression on the upload side so an early-death run's drafts stay addressable, and enforce SKILL.md's process-label rule at the publisher chokepoint (welcome-pr, maintainer, help wanted, good first issue) with fail-closed tests, aligning the issue-workflow instruction that previously contradicted the rule.

Co-authored-by: Qwen-Coder <[email protected]>

* fix(ci): harden the triage draft pipeline after an adversarial audit

Six findings from a multi-round pre-push audit, each with a mutation witness: kill lingering agent-user processes before the drafts strip/upload so a detached child cannot re-plant symlinks in the race window (upload-artifact follows them and RUNNER_TEMP is host-shared; unkillable survivors drop the draft set deny-by-default); lstat the draft containers themselves in the publisher preflight, since a symlinked bodies/ redirects the realpath containment base; reject cross-kind actions (review/close-pr on issues, close-issue on PRs); install util-linux for runuser as the sibling lanes do; make the mktemp'd proxy-wrapper directory traversable by the agent user so the gh/git wrappers do not silently fall out of its PATH; pin the artifact-name symmetry, the kill-before-strip ordering, and the toolchain install line. Design pair updated in both languages.

Co-authored-by: Qwen-Coder <[email protected]>

---------

Co-authored-by: Qwen-Coder <[email protected]>

.github/scripts/qwen-triage-workflow.test.mjs

@@ -54,6 +54,39 @@ const cleanStep = steps.find((s) => s.name === 'Clean stale agent state');
 const triageOwnershipStep = steps.find(
   (s) => s.name === 'Restore workspace ownership',
 );
+const triageContextStep = steps.find((s) => s.name === 'Prepare agent context');
+const publishTriageJob = doc.jobs['publish-triage'];
+const publisherPath = join(
+  dirname(fileURLToPath(import.meta.url)),
+  'triage-publish.mjs',
+);
+// The triage agent is a direct CLI launch now; its settings travel as the
+// heredoc the host writes into the fresh per-run QWEN_HOME. Extract and parse
+// them the same way the runtime will read them.
+const readTriageSettings = () => {
+  assert.ok(
+    triageContextStep,
+    'triage must keep the Prepare agent context step',
+  );
+  const m = triageContextStep.run.match(
+    /cat > "\$QWEN_HOME\/settings\.json" <<'SETTINGS_JSON'\n([\s\S]*?)\n\s*SETTINGS_JSON/,
+  );
+  assert.ok(
+    m,
+    'the context step must write settings.json through the SETTINGS_JSON heredoc',
+  );
+  const settings = JSON.parse(m[1]);
+  // v1 top-level keys only work through runtime migration; write the native
+  // v2 shape (the qwen-triage.yml convention).
+  for (const key of ['coreTools', 'maxSessionTurns', 'sandbox']) {
+    assert.equal(
+      settings[key],
+      undefined,
+      `v1 top-level \`${key}\` is a legacy key — use the v2 shape`,
+    );
+  }
+  return settings;
+};
 const verifyJob = doc.jobs.verify;
 const verifyOwnershipStep = verifyJob.steps.find(
   (s) => s.name === 'Restore workspace ownership',
@@ -187,12 +220,22 @@ const assertSettingsContract = (step, label) => {
 };
 
 describe('qwen-triage: agent tool/permission settings', () => {
-  it('passes `settings:` (not the silently-dropped `settings_json:`)', () => {
+  it('writes settings host-side; the agent is a direct launch, not an action', () => {
-    assertSettingsContract(triageStep, 'triage step (id: triage)');
+    // The settings_json bug class (an unknown action input silently dropped)
+    // is gone with the action: the host writes the settings file itself and
+    // the launch is a plain CLI invocation whose env we fully control.
+    readTriageSettings();
+    assert.equal(
+      triageStep.uses,
+      undefined,
+      'the triage agent must be a direct CLI launch, not qwen-code-action',
+    );
+    assert.match(triageStep.run, /runuser -u node -- env -i/);
+    assert.doesNotMatch(JSON.stringify(triageJob), /settings_json/);
   });
 
   it('settings is valid JSON that restricts the toolset', () => {
-    const settings = assertSettingsContract(triageStep, 'triage settings');
+    const settings = readTriageSettings();
     const core = settings.tools?.core;
     assert.ok(
       Array.isArray(core),
@@ -221,7 +264,7 @@ describe('qwen-triage: agent tool/permission settings', () => {
   });
 
   it('settings denies interpreters, network, and PR-code-materializing git/gh', () => {
-    const settings = assertSettingsContract(triageStep, 'triage settings');
+    const settings = readTriageSettings();
     const deny = settings.permissions?.deny ?? [];
     for (const d of [
       'run_shell_command(node)',
@@ -234,8 +277,7 @@ describe('qwen-triage: agent tool/permission settings', () => {
     ]) {
       assert.ok(deny.includes(d), `permissions.deny must include ${d}`);
     }
-    // No sandbox key: the ECS pool ships no container runtime, and adding one
+    // No sandbox key: the job itself is the container now.
-    // would silently disable the step.
     assert.equal(
       settings.sandbox,
       undefined,
@@ -698,23 +740,24 @@ describe('qwen-issue-followup-bot.yml: agent settings', () => {
   });
 });
 
-describe('qwen-triage: fork-PR runner routing', () => {
+describe('qwen-triage: runner routing under token isolation', () => {
   const runsOn = String(triageJob['runs-on']);
   const authorizeJob = doc.jobs.authorize;
   const authorizeRunsOn = String(authorizeJob['runs-on']);
 
-  it('routes the ECS pool on same-repo or a REAL write-permission check', () => {
+  it('routes every trigger to ECS behind the repo guard and kill-switch', () => {
-    assert.match(runsOn, /head\.repo\.full_name == github\.repository/);
+    // With the write PAT out of the agent environment (read-only token +
-    // The boundary is the collaborator-permission lookup authorize computes,
+    // drafts executed by publish-triage + container), routing no longer
-    // NOT the coarse author_association: MEMBER admits any org member and
+    // depends on the target PR's author or on the event shape: the controls
-    // COLLABORATOR admits read-only invitees — neither implies write access
+    // carry the trust boundary, not the machine choice. Hosted capacity is
-    // on this repo, and this job's agent loads bot PATs and a model key.
+    // the scarce side; the pool is maintainer-provided and expandable.
-    assert.match(
+    assert.match(runsOn, /github\.repository == 'QwenLM\/qwen-code'/);
-      runsOn,
+    assert.match(runsOn, /vars\.MAINTAINER_ECS_RUNNER_DISABLED != 'true'/);
-      /needs\.authorize\.outputs\.author_can_write == 'true'/,
-    );
-    assert.doesNotMatch(runsOn, /author_association/);
     assert.match(runsOn, /ecs-qwen/);
+    assert.doesNotMatch(runsOn, /author_can_write/);
+    assert.doesNotMatch(runsOn, /author_association/);
+    assert.doesNotMatch(runsOn, /head\.repo/);
+    assert.doesNotMatch(runsOn, /event_name/);
   });
 
   it('keeps the authorize gate itself on the same-repo guard', () => {
@@ -728,30 +771,164 @@ describe('qwen-triage: fork-PR runner routing', () => {
     assert.doesNotMatch(authorizeRunsOn, /needs\./);
   });
 
-  it('computes author_can_write from the collaborator-permission API', () => {
+  it('retires author_can_write (its only consumer was triage routing)', () => {
-    assert.equal(
+    assert.equal(authorizeJob.outputs.author_can_write, undefined);
-      authorizeJob.outputs.author_can_write,
-      '${{ steps.perm.outputs.author_can_write }}',
-    );
     const perm = authorizeJob.steps.find((s) => s.id === 'perm');
-    assert.ok(
+    assert.doesNotMatch(perm.run, /author_can_write/);
-      String(perm.env.PR_AUTHOR).includes(
+    assert.equal(perm.env.PR_AUTHOR, undefined);
-        'github.event.pull_request.user.login',
-      ),
-    );
-    assert.match(perm.run, /collaborators\/\$\{PR_AUTHOR\}\/permission/);
-    assert.match(
-      perm.run,
-      /admin\|maintain\|write\) echo "author_can_write=true"/,
-    );
   });
 
   it('falls back to an ephemeral hosted runner', () => {
     assert.match(runsOn, /ubuntu-latest/);
   });
+});
 
-  it('keeps issue triage on ECS (issues carry no foreign code)', () => {
+describe('qwen-triage: token isolation contract', () => {
-    assert.match(runsOn, /github\.event_name == 'issues'/);
+  it('gives the triage job read-only permissions only', () => {
+    const perms = triageJob.permissions;
+    assert.ok(perms, 'triage must declare explicit job-level permissions');
+    for (const [scope, level] of Object.entries(perms)) {
+      assert.equal(level, 'read', `triage permission ${scope} must be read`);
+    }
+    for (const scope of [
+      'contents',
+      'issues',
+      'pull-requests',
+      'checks',
+      'actions',
+    ]) {
+      assert.equal(
+        perms[scope],
+        'read',
+        `triage needs ${scope}:read for the agent's API reads`,
+      );
+    }
+  });
+
+  it('runs the agent in a container with no write credential in its env', () => {
+    assert.equal(triageJob.container?.image, 'node:22-bookworm');
+    // runuser comes from util-linux; the tmux/verify lanes install it
+    // explicitly before launching the agent as node. Pin the install line,
+    // not a prose mention.
+    const tools = steps.find((s) => s.name === 'Install triage tools');
+    assert.ok(tools, 'the container toolchain step must exist');
+    assert.match(tools.run, /apt-get install[^\n]*util-linux/);
+    const env = triageStep.env ?? {};
+    // The agent's GitHub credential is the job's read-only GITHUB_TOKEN.
+    assert.equal(env.GH_TOKEN, '${{ secrets.GITHUB_TOKEN }}');
+    assert.ok(!JSON.stringify(env).includes('CI_BOT_PAT'));
+    assert.ok(!JSON.stringify(env).includes('QWEN_CODE_BOT_TOKEN'));
+    const run = triageStep.run;
+    assert.match(run, /runuser -u node -- env -i/);
+    // The gh/git proxy wrappers must be traversable by the agent user, or
+    // they silently fall out of PATH on a proxied runner.
+    assert.match(run, /chmod 755 "\$proxy_bin"/);
+    assert.match(run, /"GITHUB_TOKEN=\$GH_TOKEN"/);
+    assert.match(run, /"GH_TOKEN=\$GH_TOKEN"/);
+    assert.match(run, /"QWEN_TRIAGE_PUBLISH=workflow"/);
+    // The real model key stays behind the loopback proxy.
+    assert.match(run, /"OPENAI_API_KEY=\$PROXY_TOKEN"/);
+    const envBlock = run.slice(
+      run.indexOf('QWEN_ENV=('),
+      run.indexOf('timeout --kill-after'),
+    );
+    assert.ok(envBlock.length > 0, 'the env -i list must exist');
+    assert.ok(!envBlock.includes('secrets.'));
+  });
+
+  it('uploads drafts on every outcome with the non-regular-file strip', () => {
+    const sanitize = steps.find((s) => s.name === 'Sanitize triage drafts');
+    const upload = steps.find((s) => s.name === 'Upload triage drafts');
+    assert.ok(sanitize, 'drafts must be sanitized before upload');
+    assert.ok(upload, 'drafts must upload for the publisher');
+    assert.equal(sanitize.if, 'always()');
+    assert.match(sanitize.run, /-type l/);
+    // A detached agent child could re-plant symlinks between the strip and
+    // the upload (which FOLLOWS them), so lingering agent-user processes
+    // must be killed BEFORE the strip — and zombies must not count, or the
+    // check never clears (tmux/verify rule).
+    const killAt = sanitize.run.indexOf('pkill -KILL -u node');
+    const stripAt = sanitize.run.indexOf('-type l');
+    assert.ok(killAt !== -1, 'sanitize must kill lingering agent processes');
+    assert.ok(
+      killAt < stripAt,
+      'the process kill must precede the symlink strip',
+    );
+    assert.match(sanitize.run, /\$2 !~ \/\^Z\//);
+    assert.equal(upload.if, 'always()');
+    assert.match(String(upload.with.name), /triage-drafts-/);
+  });
+
+  it('keeps the drafts artifact addressable when resolve never ran', () => {
+    // Upload and download must agree on the name even when the run died
+    // before 'Resolve target number': the job output mirrors the upload's
+    // primary segment, and both sides share the same event-number fallback.
+    const upload = steps.find((s) => s.name === 'Upload triage drafts');
+    const download = publishTriageJob.steps.find(
+      (s) => s.name === 'Download triage drafts',
+    );
+    assert.ok(download, 'the publisher must download the drafts artifact');
+    assert.equal(
+      triageJob.outputs.pr_number,
+      '${{ steps.resolve.outputs.number }}',
+    );
+    const fallback = '|| github.event.issue.number';
+    assert.ok(String(upload.with.name).includes(fallback));
+    assert.ok(String(download.with.name).includes(fallback));
+  });
+
+  it('publishes drafts from a separate job that never runs agent code', () => {
+    assert.ok(publishTriageJob, 'publish-triage job must exist');
+    assert.deepEqual(publishTriageJob.needs, ['triage']);
+    assert.match(String(publishTriageJob.if), /always\(\)/);
+    assert.match(
+      String(publishTriageJob.if),
+      /needs\.triage\.result != 'skipped'/,
+    );
+    // Per-RUN group (publish-tmux rule): a per-PR group would let a second
+    // run replace a completed run's pending publisher and drop its drafts.
+    assert.match(
+      String(publishTriageJob.concurrency.group),
+      /publish-triage-\{1\}/,
+    );
+    assert.match(String(publishTriageJob.concurrency.group), /github\.run_id/);
+    assert.equal(publishTriageJob.concurrency['cancel-in-progress'], false);
+    assert.ok(publishTriageJob['timeout-minutes'] <= 30);
+    const checkout = publishTriageJob.steps.find((s) =>
+      /^Checkout/.test(s.name),
+    );
+    assert.ok(checkout, 'publisher must sparse-checkout its scripts');
+    assert.match(
+      String(checkout.with['sparse-checkout']),
+      /triage-publish\.mjs/,
+    );
+    assert.equal(checkout.with['persist-credentials'], false);
+    assert.equal(checkout.with.ref, '${{ github.sha }}');
+    const publish = publishTriageJob.steps.find(
+      (s) => s.name === 'Publish triage drafts',
+    );
+    assert.ok(publish, 'publisher must run the draft script');
+    assert.match(publish.run, /triage-publish\.mjs/);
+    assert.ok(String(publish.env.GH_TOKEN).includes('CI_BOT_PAT'));
+  });
+
+  it('inspects published reviews only after publishing (notify moved)', () => {
+    // The notify step reads the reviews THIS run posted; under token
+    // isolation those land in the publish step, so notify must follow it in
+    // the publish job — left in the agent job it would always see none.
+    const notify = publishTriageJob.steps.find(
+      (s) => s.name === 'Notify silent triage re-run',
+    );
+    assert.ok(notify, 'notify must live in publish-triage');
+    const notifyIdx = publishTriageJob.steps.indexOf(notify);
+    const publishIdx = publishTriageJob.steps.findIndex(
+      (s) => s.name === 'Publish triage drafts',
+    );
+    assert.ok(publishIdx !== -1 && notifyIdx > publishIdx);
+    assert.ok(
+      !steps.some((s) => s.name === 'Notify silent triage re-run'),
+      'notify must not remain in the agent job',
+    );
   });
 });
 
@@ -1074,30 +1251,32 @@ describe('ci.yml: self-hosted checkout jobs restore ownership unconditionally',
   });
 });
 
-describe('qwen-triage: maintainer resolver heredoc vs the backtick deny rule', () => {
+describe('qwen-triage: maintainer resolver lives in the publisher', () => {
-  it('keeps the resolver bash block backtick-free so the deny rule never fires', () => {
+  it('keeps the backtick deny rule; the skill drafts defer instead of resolving', () => {
-    // The triage lane's permissions.deny includes run_shell_command(*`*):
+    // The resolver's collaborator-permission lookup needs a write-level
-    // any command text containing a backtick is EXECUTION_DENIED before
+    // token, which the read-only CI agent no longer holds, so the resolver
-    // approval. A template literal (or a backticked comment) inside the
+    // moved into triage-publish.mjs. The skill must not grow a replacement
-    // resolver heredoc would therefore kill the whole command, and
+    // heredoc (which would also re-expose the backtick deny-rule hazard the
-    // deferrals would silently lose their deterministic assignee.
+    // old block had to dance around).
-    const settings = assertSettingsContract(triageStep, 'triage settings');
+    const settings = readTriageSettings();
     const deny = settings.permissions?.deny ?? [];
     assert.ok(
       deny.includes('run_shell_command(*`*)'),
       'permissions.deny must keep the backtick rule',
     );
-    const blocks = [...prSkill.matchAll(/```bash\n([\s\S]*?)\n```/g)].map(
-      (m) => m[1],
-    );
-    const resolver = blocks.find(
-      (b) => b.includes("<<'EOF'") && b.includes('collaborators'),
-    );
-    assert.ok(resolver, 'maintainer resolver heredoc block must exist');
     assert.ok(
-      !resolver.includes('`'),
+      !prSkill.includes('collaborators/'),
-      'resolver block must contain no backtick, or the deny rule blocks it',
+      'the skill must not call the collaborator-permission API',
     );
+    assert.ok(
+      !prSkill.includes('assign-issue-owner.mjs'),
+      'the resolver import must live in the publisher, not the skill',
+    );
+    assert.match(prSkill, /\{action:"defer"/);
+    const publisher = readFileSync(publisherPath, 'utf8');
+    assert.match(publisher, /collaborators/);
+    assert.match(publisher, /pickOwner/);
+    assert.match(publisher, /QWEN_MAINTAINER_HANDLE/);
   });
 });
 

.github/scripts/triage-publish.mjs

@@ -0,0 +1,671 @@
+#!/usr/bin/env node
+// Publishes the triage agent's draft actions to GitHub. The agent never holds
+// a write credential: it writes data (actions.jsonl + body files), and this
+// script validates the whole set before executing any of it, then performs
+// the writes with the gh CLI's ambient GH_TOKEN.
+import {
+  lstatSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { parseArgs } from 'node:util';
+import { loadPolicy, matchArea, pickOwner } from './assign-issue-owner.mjs';
+
+const MARKERS = new Set([
+  'stage=1',
+  'stage=2',
+  'stage=3',
+  'stage=1-pre',
+  'stage=1b',
+]);
+const MAX_BODY_LENGTH = 65536;
+// SKILL.md forbids touching process labels; now that every label write goes
+// through this one chokepoint, the rule is enforced in code, not judgment.
+const PROCESS_LABELS = new Set([
+  'welcome-pr',
+  'maintainer',
+  'help wanted',
+  'good first issue',
+]);
+const WRITE_PERMISSIONS = new Set(['admin', 'maintain', 'write']);
+const COMMIT_ID = /^[0-9a-fA-F]{40}$/;
+
+const ACTION_FIELDS = {
+  'upsert-comment': ['marker', 'body'],
+  review: ['event', 'commit_id', 'body'],
+  'close-pr': [],
+  'close-issue': ['reason'],
+  labels: ['add', 'remove'],
+  defer: ['body'],
+};
+
+const defaultExec = (args) =>
+  spawnSync('gh', args, { encoding: 'utf8', maxBuffer: 10 * 1024 * 1024 });
+
+function ghCall(exec, args) {
+  const result = exec(args);
+  if (result.status !== 0) {
+    throw new Error(
+      (result.stderr ?? '').trim() || `gh ${args.slice(0, 2).join(' ')} failed`,
+    );
+  }
+  return (result.stdout ?? '').trim();
+}
+
+// --paginate emits one JSON document per page; `.[] | @json` flattens every
+// page into JSONL so multi-page results parse as reliably as single-page ones.
+function ghJsonLines(exec, args) {
+  return ghCall(exec, [...args, '--paginate', '--jq', '.[] | @json'])
+    .split('\n')
+    .filter((line) => line.trim() !== '')
+    .map((line) => JSON.parse(line));
+}
+
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === 'string');
+}
+
+function markerLine(marker) {
+  return `<!-- qwen-triage ${marker} -->`;
+}
+
+function readBodyFile(draftDir, bodiesDir, rel, where) {
+  const resolved = path.resolve(draftDir, rel);
+  if (!resolved.startsWith(bodiesDir + path.sep)) {
+    throw new Error(`${where}: body path escapes the bodies directory: ${rel}`);
+  }
+  // lstat, not stat: a symlink (or FIFO, or directory) is rejected even when
+  // its target would be a regular file inside the draft directory.
+  let stat;
+  try {
+    stat = lstatSync(resolved);
+  } catch {
+    throw new Error(`${where}: body file not found: ${rel}`);
+  }
+  if (!stat.isFile()) {
+    throw new Error(`${where}: body is not a regular file: ${rel}`);
+  }
+  const realBodies = realpathSync(bodiesDir);
+  if (!realpathSync(resolved).startsWith(realBodies + path.sep)) {
+    throw new Error(`${where}: body path escapes the bodies directory: ${rel}`);
+  }
+  const text = readFileSync(resolved, 'utf8');
+  // Reject, never truncate: cutting the tail could drop the CI-region or
+  // approve-on-green markers the finalize workflow consumes.
+  if (text.length > MAX_BODY_LENGTH) {
+    throw new Error(
+      `${where}: body exceeds ${MAX_BODY_LENGTH} characters (${text.length})`,
+    );
+  }
+  return { file: resolved, text };
+}
+
+export function validateDrafts({ dir, targetKind }) {
+  const draftDir = path.resolve(dir);
+  const bodiesDir = path.join(draftDir, 'bodies');
+  // lstat the containers themselves: a symlinked bodies/ would redirect the
+  // realpath containment base below, letting outside files pass as bodies,
+  // and a symlinked actions.jsonl would feed validation from another file.
+  if (!lstatSync(path.join(draftDir, 'actions.jsonl')).isFile()) {
+    throw new Error('actions.jsonl must be a regular file, not a symlink');
+  }
+  if (!lstatSync(bodiesDir).isDirectory()) {
+    throw new Error('bodies/ must be a real directory, not a symlink');
+  }
+  const raw = readFileSync(path.join(draftDir, 'actions.jsonl'), 'utf8');
+  const actions = [];
+  const lines = raw.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.trim() === '') continue;
+    const where = `actions.jsonl line ${i + 1}`;
+    let action;
+    try {
+      action = JSON.parse(line);
+    } catch {
+      throw new Error(`${where}: invalid JSON`);
+    }
+    if (
+      !action ||
+      typeof action !== 'object' ||
+      Array.isArray(action) ||
+      typeof action.action !== 'string' ||
+      !Object.hasOwn(ACTION_FIELDS, action.action)
+    ) {
+      throw new Error(`${where}: unknown action`);
+    }
+    const allowed = ACTION_FIELDS[action.action];
+    for (const key of Object.keys(action)) {
+      if (key !== 'action' && !allowed.includes(key)) {
+        throw new Error(`${where}: unknown field ${key} on ${action.action}`);
+      }
+    }
+    if (action.action === 'upsert-comment') {
+      if (!MARKERS.has(action.marker)) {
+        throw new Error(`${where}: marker not in allowlist: ${action.marker}`);
+      }
+    }
+    if (action.action === 'review') {
+      if (!['APPROVE', 'REQUEST_CHANGES'].includes(action.event)) {
+        throw new Error(`${where}: unsupported review event: ${action.event}`);
+      }
+      if (action.commit_id !== undefined && !COMMIT_ID.test(action.commit_id)) {
+        throw new Error(`${where}: commit_id must be 40 hex characters`);
+      }
+      if (action.event === 'APPROVE' && action.commit_id === undefined) {
+        throw new Error(`${where}: APPROVE requires commit_id`);
+      }
+    }
+    if (action.action === 'close-issue' && action.reason !== 'not planned') {
+      throw new Error(`${where}: close-issue reason must be "not planned"`);
+    }
+    if (action.action === 'labels') {
+      for (const key of ['add', 'remove']) {
+        if (action[key] !== undefined && !isStringArray(action[key])) {
+          throw new Error(
+            `${where}: labels ${key} must be an array of strings`,
+          );
+        }
+        for (const label of action[key] ?? []) {
+          if (PROCESS_LABELS.has(label)) {
+            throw new Error(`${where}: process label "${label}" is off-limits`);
+          }
+        }
+      }
+    }
+    if (action.action === 'defer' && targetKind !== 'pr') {
+      throw new Error(`${where}: defer is only valid for pull requests`);
+    }
+    if (
+      (action.action === 'review' || action.action === 'close-pr') &&
+      targetKind !== 'pr'
+    ) {
+      throw new Error(
+        `${where}: ${action.action} is only valid for pull requests`,
+      );
+    }
+    if (action.action === 'close-issue' && targetKind !== 'issue') {
+      throw new Error(`${where}: close-issue is only valid for issues`);
+    }
+    if (['upsert-comment', 'review', 'defer'].includes(action.action)) {
+      if (typeof action.body !== 'string') {
+        throw new Error(`${where}: ${action.action} requires a body path`);
+      }
+      const body = readBodyFile(draftDir, bodiesDir, action.body, where);
+      if (
+        action.action === 'upsert-comment' &&
+        body.text.split('\n')[0] !== markerLine(action.marker)
+      ) {
+        // The publisher owns the marker prefix; the agent is not trusted to
+        // have written it, and dedup/finalize match on these exact bytes.
+        throw new Error(
+          `${where}: body must start with "${markerLine(action.marker)}"`,
+        );
+      }
+      action.bodyFile = body.file;
+      action.bodyText = body.text;
+    }
+    actions.push(action);
+  }
+  return actions;
+}
+
+function canWrite(exec, repo, login) {
+  try {
+    return WRITE_PERMISSIONS.has(
+      ghCall(exec, [
+        'api',
+        `repos/${repo}/collaborators/${login}/permission`,
+        '--jq',
+        '.permission',
+      ]),
+    );
+  } catch {
+    // A stale map entry (renamed/deleted account, lost access) must drop the
+    // candidate, not fail the defer.
+    return false;
+  }
+}
+
+// Same gh invocation as assign-issue-owner.mjs's openIssueCount so the two
+// assignment paths cannot drift; re-spelled here because that export binds
+// its own spawnSync and cannot take the injected executor.
+function openIssueCount(exec, repo, login) {
+  return Number(
+    ghCall(exec, [
+      'issue',
+      'list',
+      '--repo',
+      repo,
+      '--state',
+      'open',
+      '--assignee',
+      login,
+      '--limit',
+      '100',
+      '--json',
+      'number',
+      '--jq',
+      'length',
+    ]),
+  );
+}
+
+export function resolveMaintainer({
+  repo,
+  number,
+  exec,
+  env = process.env,
+  ownersFile = fileURLToPath(new URL('../issue-owners.json', import.meta.url)),
+  err = process.stderr,
+}) {
+  const handle = env.QWEN_MAINTAINER_HANDLE;
+  if (handle) return handle;
+  try {
+    const policy = loadPolicy(readFileSync(ownersFile, 'utf8'));
+    const pr = JSON.parse(
+      ghCall(exec, [
+        'pr',
+        'view',
+        String(number),
+        '--repo',
+        repo,
+        '--json',
+        'author,labels',
+      ]),
+    );
+    const area = matchArea(policy, pr);
+    if (area) {
+      // A null author means a deleted account — nobody to exclude.
+      const authorLogin = pr.author?.login?.toLowerCase() ?? '';
+      const eligible = area.owners.filter(
+        (owner) =>
+          owner.toLowerCase() !== authorLogin && canWrite(exec, repo, owner),
+      );
+      if (eligible.length > 0) {
+        const load = new Map(
+          eligible.map((owner) => [owner, openIssueCount(exec, repo, owner)]),
+        );
+        return pickOwner(eligible, load, Number(number));
+      }
+    }
+  } catch (error) {
+    err.write(`warning: owner-map resolution failed: ${error.message}\n`);
+  }
+  try {
+    const { latestReviews } = JSON.parse(
+      ghCall(exec, [
+        'pr',
+        'view',
+        String(number),
+        '--repo',
+        repo,
+        '--json',
+        'latestReviews',
+      ]),
+    );
+    // latestReviews is not recency-sorted; drop deleted accounts and bot
+    // suffixes before sorting so a defer never @mentions a bot.
+    const humans = (latestReviews ?? [])
+      .filter((review) => review.author?.login != null)
+      .filter(
+        (review) =>
+          !review.author.login.endsWith('[bot]') &&
+          !review.author.login.endsWith('-bot'),
+      )
+      .sort((a, b) =>
+        String(a.submittedAt).localeCompare(String(b.submittedAt)),
+      );
+    return humans.at(-1)?.author.login ?? '';
+  } catch {
+    return '';
+  }
+}
+
+function upsertComment(action, { repo, number, botLogin, exec }) {
+  const prefix = markerLine(action.marker);
+  let existing = null;
+  // Without a verified bot identity a PATCH could overwrite a human comment
+  // that quotes the marker, so identity failure forbids PATCH entirely.
+  if (botLogin) {
+    const comments = ghJsonLines(exec, [
+      'api',
+      `repos/${repo}/issues/${number}/comments`,
+    ]);
+    const matches = comments.filter(
+      (comment) =>
+        comment.user?.login === botLogin &&
+        typeof comment.body === 'string' &&
+        comment.body.startsWith(prefix),
+    );
+    existing = matches.at(-1) ?? null;
+  }
+  if (existing) {
+    ghCall(exec, [
+      'api',
+      '-X',
+      'PATCH',
+      `repos/${repo}/issues/comments/${existing.id}`,
+      '-F',
+      `body=@${action.bodyFile}`,
+    ]);
+    return { status: 'published', detail: `PATCH comment ${existing.id}` };
+  }
+  ghCall(exec, [
+    'api',
+    `repos/${repo}/issues/${number}/comments`,
+    '-F',
+    `body=@${action.bodyFile}`,
+  ]);
+  return {
+    status: 'published',
+    detail: botLogin
+      ? 'POST comment'
+      : 'POST comment (identity unresolved; PATCH disabled)',
+  };
+}
+
+function submitReview(action, { repo, number, botLogin, exec }) {
+  const reviews = ghJsonLines(exec, [
+    'api',
+    `repos/${repo}/pulls/${number}/reviews`,
+  ]);
+  const head = ghCall(exec, [
+    'pr',
+    'view',
+    String(number),
+    '--repo',
+    repo,
+    '--json',
+    'headRefOid',
+    '--jq',
+    '.headRefOid',
+  ]);
+  const own = botLogin
+    ? reviews.filter((review) => review.user?.login === botLogin)
+    : [];
+  if (action.event === 'APPROVE') {
+    if (
+      own.some(
+        (review) =>
+          review.state === 'APPROVED' && review.commit_id === action.commit_id,
+      )
+    ) {
+      return { status: 'skipped', detail: 'already approved at this commit' };
+    }
+    // Attesting a commit that is no longer head would approve code nobody
+    // reviewed; the finalize workflow applies the same stale check.
+    if (head !== action.commit_id) {
+      return { status: 'skipped', detail: 'stale' };
+    }
+  } else if (own.some((review) => review.state === 'CHANGES_REQUESTED')) {
+    return { status: 'skipped', detail: 'changes already requested' };
+  }
+  const args = [
+    'api',
+    `repos/${repo}/pulls/${number}/reviews`,
+    '-f',
+    `event=${action.event}`,
+  ];
+  if (action.commit_id !== undefined) {
+    args.push('-f', `commit_id=${action.commit_id}`);
+  }
+  args.push('-F', `body=@${action.bodyFile}`);
+  ghCall(exec, args);
+  return { status: 'published', detail: `${action.event} review` };
+}
+
+function closeTarget(action, { repo, number, exec }) {
+  const state = ghCall(exec, [
+    'api',
+    `repos/${repo}/issues/${number}`,
+    '--jq',
+    '.state',
+  ]);
+  if (state !== 'open') {
+    return { status: 'skipped', detail: `already ${state}` };
+  }
+  if (action.action === 'close-pr') {
+    ghCall(exec, ['pr', 'close', String(number), '--repo', repo]);
+  } else {
+    ghCall(exec, [
+      'issue',
+      'close',
+      String(number),
+      '--repo',
+      repo,
+      '--reason',
+      'not planned',
+    ]);
+  }
+  return { status: 'published', detail: 'closed' };
+}
+
+function applyLabels(action, { repo, number, exec }) {
+  const existing = new Set(
+    ghJsonLines(exec, ['api', `repos/${repo}/labels`]).map(
+      (label) => label.name,
+    ),
+  );
+  const add = action.add ?? [];
+  const remove = action.remove ?? [];
+  const missing = [...add, ...remove].filter((label) => !existing.has(label));
+  if (missing.length > 0) {
+    throw new Error(`labels do not exist: ${missing.join(', ')}`);
+  }
+  if (add.length + remove.length === 0) {
+    return { status: 'skipped', detail: 'no labels to apply' };
+  }
+  const args = ['issue', 'edit', String(number), '--repo', repo];
+  for (const label of add) args.push('--add-label', label);
+  for (const label of remove) args.push('--remove-label', label);
+  ghCall(exec, args);
+  return {
+    status: 'published',
+    detail: `add [${add.join(', ')}] remove [${remove.join(', ')}]`,
+  };
+}
+
+function deferToMaintainer(action, context) {
+  const { repo, number, exec, env, ownersFile, err } = context;
+  const login = resolveMaintainer({ repo, number, exec, env, ownersFile, err });
+  const mention = login
+    ? `⏸️ Deferring to @${login} — needs a human call on this one.`
+    : '⏸️ Deferring to the maintainers — needs a human call on this one.';
+  const tempDir = mkdtempSync(path.join(tmpdir(), 'triage-publish-'));
+  const bodyFile = path.join(tempDir, 'defer.md');
+  try {
+    writeFileSync(bodyFile, `${mention}\n\n${action.bodyText}`);
+    ghCall(exec, [
+      'api',
+      `repos/${repo}/issues/${number}/comments`,
+      '-F',
+      `body=@${bodyFile}`,
+    ]);
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+  if (login) {
+    try {
+      ghCall(exec, [
+        'pr',
+        'edit',
+        String(number),
+        '--repo',
+        repo,
+        '--add-assignee',
+        login,
+      ]);
+    } catch (error) {
+      // The mention is the load-bearing signal; a failed assign must never
+      // turn a published defer into a failed action.
+      err.write(`warning: could not assign @${login}: ${error.message}\n`);
+    }
+  }
+  return {
+    status: 'published',
+    detail: login ? `deferred to @${login}` : 'deferred without mention',
+  };
+}
+
+function runAction(action, context) {
+  switch (action.action) {
+    case 'upsert-comment':
+      return upsertComment(action, context);
+    case 'review':
+      return submitReview(action, context);
+    case 'close-pr':
+    case 'close-issue':
+      return closeTarget(action, context);
+    case 'labels':
+      return applyLabels(action, context);
+    case 'defer':
+      return deferToMaintainer(action, context);
+  }
+}
+
+export function executeActions({
+  actions,
+  repo,
+  number,
+  botLogin,
+  exec,
+  env = process.env,
+  ownersFile,
+  err = process.stderr,
+}) {
+  const context = { repo, number, botLogin, exec, env, ownersFile, err };
+  const results = [];
+  for (const action of actions) {
+    try {
+      const result = runAction(action, context);
+      results.push({ action: action.action, ...result });
+    } catch (error) {
+      results.push({
+        action: action.action,
+        status: 'failed',
+        detail: error.message,
+      });
+    }
+  }
+  return results;
+}
+
+export function run({
+  argv,
+  env = process.env,
+  exec = defaultExec,
+  out = process.stdout,
+  err = process.stderr,
+}) {
+  let options;
+  try {
+    options = parseArgs({
+      args: argv,
+      options: {
+        drafts: { type: 'string' },
+        repo: { type: 'string' },
+        number: { type: 'string' },
+        'dry-run': { type: 'boolean' },
+      },
+      strict: true,
+      allowPositionals: false,
+    });
+  } catch (error) {
+    err.write(`${error.message}\n`);
+    return 2;
+  }
+  const dir = options.values.drafts;
+  const repo = options.values.repo;
+  const number = Number(options.values.number);
+  const dryRun = options.values['dry-run'] === true;
+  if (
+    !dir ||
+    !repo ||
+    !/^[^/\s]+\/[^/\s]+$/.test(repo) ||
+    !Number.isSafeInteger(number) ||
+    number < 1
+  ) {
+    err.write(
+      'usage: triage-publish.mjs --drafts <dir> --repo <owner/repo> --number <n> [--dry-run]\n',
+    );
+    return 2;
+  }
+
+  let targetKind;
+  try {
+    const target = JSON.parse(
+      ghCall(exec, ['api', `repos/${repo}/issues/${number}`]),
+    );
+    targetKind = target.pull_request ? 'pr' : 'issue';
+  } catch (error) {
+    err.write(`preflight: cannot read target: ${error.message}\n`);
+    return 2;
+  }
+
+  let actions;
+  try {
+    actions = validateDrafts({ dir, targetKind });
+  } catch (error) {
+    err.write(`preflight rejected: ${error.message}\n`);
+    return 2;
+  }
+
+  let botLogin = env.BOT_LOGIN || null;
+  if (!botLogin) {
+    try {
+      botLogin = ghCall(exec, ['api', 'user', '--jq', '.login']) || null;
+    } catch {
+      botLogin = null;
+    }
+    if (!botLogin) {
+      err.write(
+        'warning: bot identity unresolved; comment PATCH disabled (fresh POST only)\n',
+      );
+    }
+  }
+
+  if (dryRun) {
+    for (const action of actions) {
+      out.write(
+        `${JSON.stringify({ action: action.action, status: 'skipped', detail: 'dry-run' })}\n`,
+      );
+    }
+    err.write(
+      `dry-run: ${actions.length} action(s) validated, nothing published\n`,
+    );
+    return 0;
+  }
+
+  const results = executeActions({
+    actions,
+    repo,
+    number,
+    botLogin,
+    exec,
+    env,
+    err,
+  });
+  for (const result of results) {
+    out.write(`${JSON.stringify(result)}\n`);
+  }
+  const count = (status) => results.filter((r) => r.status === status).length;
+  err.write(
+    `${results.length} action(s): ${count('published')} published, ${count('skipped')} skipped, ${count('failed')} failed\n`,
+  );
+  return count('failed') > 0 ? 1 : 0;
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  process.exit(run({ argv: process.argv.slice(2) }));
+}

.github/workflows/.ci-budget

@@ -11,7 +11,7 @@
 1 5 0 pr-self-report-label.yml
 8 590 0 qwen-autofix.yml
 9 155 4 qwen-code-pr-review.yml
-7 280 2 qwen-triage.yml
+8 290 2 qwen-triage.yml
 2 55 0 release-managed-agent-reference.yml
 2 0 2 sdk-python.yml
 1 60 0 serve-ab.yml

.github/workflows/.size-baseline

@@ -47,7 +47,7 @@
 5760 qwen-pr-safety-precheck.yml
 3243 qwen-review-runner-schedule.yml
 27648 qwen-triage-finalize.yml
-378242 qwen-triage.yml
+402331 qwen-triage.yml
 15726 release-chrome-extension.yml
 26801 release-managed-agent-reference.yml
 13464 release-managed-runtime.yml

.github/workflows/qwen-triage.yml

@@ -85,13 +85,6 @@ jobs:
       contents: 'read'
     outputs:
       should_run: '${{ steps.perm.outputs.should_run }}'
-      # Real write-permission check on the PR AUTHOR (collaborator-permission
-      # API, not the coarse author_association), computed only on
-      # pull_request_target events; empty on every other event. Consumed by
-      # the triage job's runner routing so a maintainer's fork PR uses the
-      # ECS pool while a read-only collaborator's or org member's fork PR
-      # stays on ephemeral hosted runners.
-      author_can_write: '${{ steps.perm.outputs.author_can_write }}'
       # /verify trust level: 'trusted' when the PR author has write,
       # 'external' when they do not. Both run on the persistent ECS pool
       # (maintainer decision, 2026-07-29: the pool is network-isolated and
@@ -192,7 +185,6 @@ jobs:
           # issues; compare against null rather than truthiness so the shell
           # receives a plain true/false.
           IS_PR: '${{ github.event.issue.pull_request != null }}'
-          PR_AUTHOR: '${{ github.event.pull_request.user.login }}'
         run: |-
           set -euo pipefail
           IS_VERIFY=false
@@ -210,18 +202,6 @@ jobs:
             # says the PR is ready to be worth that.
             echo "Automatic PR triage allowed for PR #${PR_NUMBER} after same-repo/precheck gate." >> "$GITHUB_STEP_SUMMARY"
             echo "should_run=true" >> "$GITHUB_OUTPUT"
-            # Runner-routing input for the triage job: the REAL author write
-            # check (author_association admits org members and read-only
-            # collaborators). Fail OPEN on purpose — unlike the deny gates
-            # below, this selects a runner pool, not a decision: an API
-            # hiccup merely routes the triage to a hosted runner, it must
-            # never skip or fail the triage itself.
-            if [ -n "$PR_AUTHOR" ] &&
-               author_perm="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${PR_AUTHOR}/permission" --jq '.permission' 2>/dev/null)"; then
-              case "$author_perm" in
-                admin|maintain|write) echo "author_can_write=true" >> "$GITHUB_OUTPUT" ;;
-              esac
-            fi
             exit 0
           fi
           case "$EVENT_NAME" in
@@ -483,26 +463,40 @@ jobs:
         }}
     # Triage is a static-analysis agent: it checks out the trusted base repo,
     # reaches the PR/issue only via the API, and must NEVER execute PR-derived
-    # code — its step env carries a write PAT that executed code could read.
+    # code. The agent no longer carries a write credential: it reads GitHub
-    # This is defended in layers, none of which is a hard boundary on its own
+    # with the job's read-only GITHUB_TOKEN and expresses every write as a
-    # (see the long note on the Qwen step for why a `--yolo` command denylist
+    # draft that the separate publish-triage job validates and executes with
-    # cannot be): the skill forbids executing PR code
+    # the bot PAT (see the long note on the Qwen step). The container below
-    # (.qwen/skills/triage/SKILL.md Rules), the `settings` deny rules block the
+    # and the per-run workspace sanitize bound what a steered agent could
-    # direct interpreter/build/network invocations, and the routing below keeps
+    # persist on the reusable pool.
-    # foreign code off the persistent pool.
+    # Runner routing: with the write PAT out of the agent environment, every
-    # Runner routing: the persistent ECS pool serves events whose payload
+    # triage trigger — issues, same-repo and fork PRs, comment reruns,
-    # carries no foreign code — issue triage and same-repo PR events — plus
+    # dispatch — may use the persistent ECS pool. The pool is
-    # fork PRs whose author REALLY has write access, per the collaborator-
+    # maintainer-provided and network-isolated; hosted capacity is the scarce
-    # permission lookup the authorize job already performs (the coarse
+    # side. Kill-switch: MAINTAINER_ECS_RUNNER_DISABLED falls back to
-    # author_association would admit org members and read-only collaborators
+    # ubuntu-latest, which stays safe because the controls are additive.
-    # to this secret-bearing agent; the pool is network-isolated, but a
+    # Forks of this repo fall back to ubuntu-latest as before.
-    # write-access author is the trust bar for reusing it). authorize is
+    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
-    # skipped on the issues/dispatch paths, so the explicit `issues` clause
+    # Read-only by construction: the agent's GH_TOKEN is this job's
-    # must stay; there its output is ''. PRs by other fork authors, and
+    # GITHUB_TOKEN. Every write goes through publish-triage's PAT. The
-    # comment/dispatch-triggered reruns (which may target fork PRs), go to
+    # pre-agent reaction step uses the PAT explicitly (reactions need write).
-    # ephemeral hosted runners so a steered agent cannot persist anything
+    permissions:
-    # across runs. Forks of this repo fall back to ubuntu-latest as before.
+      contents: 'read'
-    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'' && (github.event_name == ''issues'' || (github.event.pull_request && (github.event.pull_request.head.repo.full_name == github.repository || needs.authorize.outputs.author_can_write == ''true'')))) && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
+      issues: 'read'
+      pull-requests: 'read'
+      checks: 'read'
+      actions: 'read'
+    # The agent reads untrusted PR content on a reusable machine. Run the
+    # steps in a container so nothing it does persists on the runner host
+    # beyond the sanitized workspace (same contract as tmux/verify).
+    container:
+      image: 'node:22-bookworm'
+      options: '--init'
+    defaults:
+      run:
+        shell: 'bash'
+    outputs:
+      pr_number: '${{ steps.resolve.outputs.number }}'
     # startsWith (not contains) prevents false triggers from comments that
     # mention the phrase in quoted text or mid-sentence descriptions.
     # always() so the job still evaluates when the upstream `authorize` job is
@@ -531,10 +525,33 @@ jobs:
         )
       )
     steps:
+      # The job runs in a bare node container; gh/jq/git are not in the image.
+      # Same toolchain step as the tmux lane.
+      - name: 'Install triage tools'
+        run: |-
+          set -euo pipefail
+          apt-get update
+          # util-linux provides runuser for the agent launch (tmux/verify
+          # install it explicitly for the same reason).
+          apt-get install -y --no-install-recommends ca-certificates curl git gnupg jq util-linux
+
+          install -d -m 755 /etc/apt/keyrings
+          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+            | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg
+          chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+            > /etc/apt/sources.list.d/github-cli.list
+          apt-get update
+          apt-get install -y --no-install-recommends gh
+
+          gh --version
+          git config --global --add safe.directory '*'
+
       - name: 'Acknowledge triage request'
         if: "github.event_name == 'issue_comment'"
         env:
-          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          # Reactions need write scope; the job's GITHUB_TOKEN is read-only.
+          GH_TOKEN: '${{ secrets.QWEN_CODE_BOT_TOKEN || secrets.CI_BOT_PAT }}'
           COMMENT_ID: '${{ github.event.comment.id }}'
         run: |-
           gh api \
@@ -619,6 +636,9 @@ jobs:
         uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
         with:
           token: '${{ secrets.GITHUB_TOKEN }}'
+          # The agent reads this workspace; keep even the read-only token out
+          # of .git/config.
+          persist-credentials: false
 
       - name: 'Resolve target number'
         id: 'resolve'
@@ -711,90 +731,95 @@ jobs:
         id: 'ensure_qwen'
         run: |-
           set -euo pipefail
-          if command -v qwen >/dev/null 2>&1; then
+          # Install from RUNNER_TEMP: the persistent workspace may hold a
-            echo "qwen already installed:"
+          # previous run's tree, and npm reads a cwd .npmrc whose settings a
-          else
+          # --registry flag does not override (same rule as the tmux lane).
-            npm install -g --loglevel=error --no-audit @qwen-code/qwen-code@latest
+          if ! command -v qwen >/dev/null 2>&1; then
+            (cd "${RUNNER_TEMP:?}" && npm install -g --loglevel=error --no-audit --registry=https://registry.npmjs.org @qwen-code/qwen-code@latest)
           fi
           qwen --version
           echo "version=$(qwen --version)" >> "${GITHUB_OUTPUT}"
 
-      - name: 'Run Qwen Triage'
+      # Everything the agent needs that it must NOT fetch with a write
-        id: 'triage'
+      # credential: the bot identity for its author filters, the optional
-        uses: 'QwenLM/qwen-code-action@05f81718976f3b7da657422e6e8e4d372b8621d7'
+      # cross-repo direction signal, the draft drop zone, and its settings.
+      - name: 'Prepare agent context'
+        id: 'context'
         env:
-          GITHUB_TOKEN: '${{ secrets.QWEN_CODE_BOT_TOKEN || secrets.CI_BOT_PAT }}'
           GH_TOKEN: '${{ secrets.QWEN_CODE_BOT_TOKEN || secrets.CI_BOT_PAT }}'
-          REPOSITORY: '${{ github.repository }}'
+        run: |-
-          # Per-run agent home so this run's session/memory cannot leak into the
+          set -euo pipefail
-          # next on the reused self-hosted workspace (reset in "Clean stale
+          QWEN_HOME="${RUNNER_TEMP:?}/qwen-home"
-          # agent state"). Must match the QWEN_HOME computed there.
+          mkdir -p "$QWEN_HOME"
-          QWEN_HOME: '${{ runner.temp }}/qwen-home'
+          # Under the read-only GITHUB_TOKEN the agent will run with,
-        with:
+          # `gh api user` returns github-actions[bot]; the skill's duplicate
-          OPENAI_API_KEY: '${{ secrets.OPENAI_API_KEY }}'
+          # guard, reopen guard, and review dedup filter on the PAT's bot
-          OPENAI_BASE_URL: '${{ secrets.OPENAI_BASE_URL }}'
+          # login, so resolve it here and pass it in.
-          OPENAI_MODEL: '${{ vars.QWEN_TRIAGE_MODEL || vars.QWEN_PR_REVIEW_MODEL }}'
+          BOT_LOGIN="$(gh api user --jq '.login')"
-          # vars.QWEN_TRIAGE_EFFORT sets model.reasoningEffort in `settings`
+          if [ -z "$BOT_LOGIN" ]; then
-          # below (low|medium|high|xhigh|max; the CLI has no flag). Unset, it
+            echo "::error::Cannot resolve the bot identity; refusing to run the agent without it."
-          # renders "", which the CLI ignores — the provider default.
+            exit 1
-          # Pin the action's unconditional global reinstall to the version
+          fi
-          # this job already runs. Left at `latest`, the action installs with
+          echo "bot_login=$BOT_LOGIN" >> "$GITHUB_OUTPUT"
-          # --prefer-offline and resolves the dist-tag from the runner's
+          # Stage 1c's optional cross-repo direction signal. GITHUB_TOKEN is
-          # persistent npm cache, which lags npm publishes and has downgraded
+          # scoped to this repository, so prefetch with the PAT; a missing
-          # the shared ECS box back to a stale release.
+          # file means "signal unavailable", which the skill accepts.
-          qwen_cli_version: '${{ steps.ensure_qwen.outputs.version }}'
+          mkdir -p "$RUNNER_TEMP/triage-context"
-          # The input name is `settings` — this action version has no
+          gh api repos/anthropics/claude-code/contents/CHANGELOG.md \
-          # `settings_json` input. The old `settings_json:` block was silently
+            -H 'Accept: application/vnd.github.raw+json' \
-          # dropped ("Unexpected input(s) 'settings_json'" in the run log), so
+            > "$RUNNER_TEMP/triage-context/claude-code-changelog.md" 2>/dev/null ||
-          # the agent ran with the full default toolset. Do not rename it back.
+            echo "::warning::CHANGELOG prefetch failed; the skill treats the signal as unavailable."
-          #
+          # Draft drop zone: the agent writes actions.jsonl + bodies here;
+          # publish-triage is the only writer to GitHub. RUNNER_TEMP survives
+          # across runs on the persistent pool — clear any previous run's
+          # drafts so a re-run cannot append to stale actions.
+          rm -rf "$RUNNER_TEMP/triage-drafts" "$RUNNER_TEMP/triage-results"
+          mkdir -p "$RUNNER_TEMP/triage-drafts/bodies" "$RUNNER_TEMP/triage-results"
+          chown -R node:node "$GITHUB_WORKSPACE" "$QWEN_HOME" \
+            "$RUNNER_TEMP/triage-drafts" "$RUNNER_TEMP/triage-results"
           # ── What these settings are, and are NOT ────────────────────────────
-          # The action runs `qwen --yolo`, so every permission resolves to
+          # The agent runs under --approval-mode yolo, so every permission
-          # auto-approve EXCEPT a `permissions.deny` match, which the scheduler
+          # resolves to auto-approve EXCEPT a `permissions.deny` match, which
-          # errors out before approval mode is consulted (verified in
+          # the scheduler errors out before approval mode is consulted.
-          # coreToolScheduler L5 + permissionFlow.needsConfirmation). `tools.core`
+          # `tools.core` additionally filters which tools register at all
-          # additionally filters which tools register at all (fail-safe: an
+          # (fail-safe: an unlisted tool like web_fetch/web_search/save_memory
-          # unlisted tool like web_fetch/web_search/save_memory never loads, so
+          # never loads). No `sandbox` key: the job itself is the container.
-          # those network/persistence tool channels are gone). No `sandbox` key
-          # — a deliberate omission, not a capability gap: the ECS pool does run
-          # containers (this workflow's own container jobs, and autofix's
-          # `sandbox: "docker"` agent, both land on those labels). Adding one
-          # here is an open decision, NOT tracked in #9556 — that issue is
-          # scoped to the /review pipeline's execution steps.
           #
-          # ⚠️ A command denylist is NOT a security boundary under --yolo, and
+          # ⚠️ A command denylist is NOT a security boundary under yolo, and
           # is not treated as one here. It is defense-in-depth against the
-          # NORMAL failure (the agent running `npm test`/`npx`/a build because a
+          # NORMAL failure (the agent running `npm test`/`npx`/a build because
-          # prompt implied it) and low-effort injection. It does NOT stop a
+          # a prompt implied it) and low-effort injection. It does NOT stop a
           # determined prompt-injection: `$(...)` substitution is not reliably
-          # deny-matchable (parser-dependent), and even with it blocked, exec
+          # deny-matchable, and exec can hide in `sed s///e`, env-var
-          # can hide in `sed s///e`, env-var interpreters, etc. — an unwinnable
+          # interpreters, etc. Backtick and `<(` ARE hard-blocked below.
-          # denylist game. Backtick and `<(` ARE hard-blocked below (verified,
-          # they were free); `$(` and `>(` are not reliably matchable and are
-          # left to the layers below, not papered over with a rule that no-ops.
           #
           # The REAL controls, in order of strength:
-          #   1. No PR code is ever executed (skill Rules; every legit triage
+          #   1. No PR code is ever executed (skill Rules; the agent reads the
-          #      command is a gh-API call, a read-only git command, or text
+          #      PR only through the API and the base checkout).
-          #      processing — none touch the PR's tree in an executable way).
+          #   2. Token isolation: the agent's GH_TOKEN is the job's read-only
-          #   2. Fork PRs run on ephemeral hosted runners (see the triage job
+          #      GITHUB_TOKEN; every write is a draft executed by
-          #      `runs-on`), bounding persistence/lateral movement.
+          #      publish-triage with the PAT. There is no write credential in
-          #   3. Stale git exec vectors (hooks/config/aliases) are wiped each
+          #      the agent environment to exfiltrate, and the model key sits
-          #      run (see "Clean stale agent state").
+          #      behind the loopback proxy started in the run step.
-          # RESIDUAL RISK: the agent still holds a write PAT (GH_TOKEN above),
+          #   3. The job container plus the per-run workspace sanitize bound
-          # and under a successful injection it could exfiltrate it or forge bot
+          #      persistence on the reusable pool (see "Clean stale agent
-          # writes — it even has a legitimate comment-posting capability. The
+          #      state" and the ownership restores).
-          # structural fix is token isolation (agent runs read-only; a separate
+          # A steered agent can still draft malicious content within triage's
-          # PR-code-free step publishes its drafted output with the PAT, as
+          # intended capability (a wrong review, a misleading comment); that
-          # publish-tmux already does). Tracked as a follow-up; not yet wired.
+          # surface is inherent to the product and reviewed by humans. The
+          # publisher validates shape, not semantics.
           #
-          # The deny list below therefore backs the skill's no-PR-code rule as
+          # The deny list below backs the skill's no-PR-code rule as a speed
-          # a speed bump: interpreters/build tools, shells, exec wrappers,
+          # bump: interpreters/build tools, shells, exec wrappers, network
-          # network binaries, path execution, and the git/gh subcommands that
+          # binaries, path execution, and the git/gh subcommands that execute
-          # execute configured commands or materialize PR code. Prefix match is
+          # configured commands or materialize PR code. Prefix match is
-          # word-boundary ("npm" blocks `npm test`, not `npmx`); shell redirects
+          # word-boundary ("npm" blocks `npm test`, not `npmx`). It also
-          # are also checked against the write_file path rules.
+          # blocks `node`, which structurally prevents the agent from running
-          settings: |-
+          # the publisher itself in CI mode.
+          # vars.QWEN_TRIAGE_EFFORT sets model.reasoningEffort
+          # (low|medium|high|xhigh|max; the CLI has no flag). Unset, it
+          # renders "", which the CLI ignores — the provider default.
+          cat > "$QWEN_HOME/settings.json" <<'SETTINGS_JSON'
             {
               "model": {
                 "reasoningEffort": "${{ vars.QWEN_TRIAGE_EFFORT }}"
@@ -925,7 +950,357 @@ jobs:
                 ]
               }
             }
-          prompt: '/triage ${{ steps.resolve.outputs.number }} --repo ${{ github.repository }}'
+          SETTINGS_JSON
+
+      # Direct CLI launch (the tmux/verify contract), replacing the former
+      # qwen-code-action step: the proxy must live and die in the same step as
+      # the agent, and env -i is what keeps the write credential out. The step
+      # keeps the id `triage` and emits the same `summary` output so 'Check
+      # triage response' stays unchanged.
+      - name: 'Run Qwen Triage'
+        id: 'triage'
+        env:
+          # Upstream model credentials — consumed by the loopback proxy below,
+          # never passed to the agent (it gets the dummy PROXY_TOKEN instead).
+          OPENAI_API_KEY: '${{ secrets.OPENAI_API_KEY }}'
+          OPENAI_BASE_URL: '${{ secrets.OPENAI_BASE_URL }}'
+          OPENAI_MODEL: '${{ vars.QWEN_TRIAGE_MODEL || vars.QWEN_PR_REVIEW_MODEL }}'
+          # The agent's read credential: this job's read-only GITHUB_TOKEN.
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          BOT_LOGIN: '${{ steps.context.outputs.bot_login }}'
+          NUMBER: '${{ steps.resolve.outputs.number }}'
+          REPOSITORY: '${{ github.repository }}'
+          EVENT_NAME: '${{ github.event_name }}'
+          TRIAGE_TIMEOUT_MINUTES: '${{ needs.authorize.outputs.triage_timeout_minutes || 60 }}'
+        run: |-
+          set -euo pipefail
+          if ! command -v qwen >/dev/null 2>&1; then
+            echo "::error::qwen CLI not found on runner"
+            exit 1
+          fi
+
+          # Bypass the runner proxy for qwen itself (it cuts SSE streams and
+          # qwen reads HTTP(S)_PROXY without honoring NO_PROXY), while
+          # restoring it for child gh/git commands the agent spawns. Same
+          # shape as the tmux lane; wrappers live on the container's own disk
+          # so no root-owned files leak onto the host through RUNNER_TEMP.
+          # shellcheck disable=SC2016
+          configure_qwen_network() {
+            local openai_host proxy_bin
+            openai_host="$(node -e 'console.log(new URL(process.env.OPENAI_BASE_URL).hostname)')"
+            if [ -z "$openai_host" ]; then
+              echo "::error::Could not parse a hostname from OPENAI_BASE_URL"
+              exit 1
+            fi
+            export NO_PROXY="${NO_PROXY:+$NO_PROXY,}${openai_host}"
+            export no_proxy="${no_proxy:+$no_proxy,}${openai_host}"
+            export QWEN_CI_HTTPS_PROXY="${HTTPS_PROXY:-}"
+            export QWEN_CI_https_proxy="${https_proxy:-}"
+            export QWEN_CI_HTTP_PROXY="${HTTP_PROXY:-}"
+            export QWEN_CI_http_proxy="${http_proxy:-}"
+            proxy_bin="$(mktemp -d /tmp/qwen-network-bin.XXXXXX)"
+            # mktemp -d is 700 root-owned; the agent runs as node and must be
+            # able to traverse it, or the wrappers silently fall out of PATH
+            # and child gh/git lose the runner proxy. The wrappers hold no
+            # secrets (env-var names only).
+            chmod 755 "$proxy_bin"
+            if command -v gh >/dev/null 2>&1; then
+              local real_gh
+              real_gh="$(command -v gh)"
+              export QWEN_CI_REAL_GH="$real_gh"
+              {
+                printf '%s\n' '#!/usr/bin/env bash'
+                printf '%s\n' '[ -n "${QWEN_CI_HTTPS_PROXY:-}" ] && export HTTPS_PROXY="$QWEN_CI_HTTPS_PROXY"'
+                printf '%s\n' '[ -n "${QWEN_CI_https_proxy:-}" ] && export https_proxy="$QWEN_CI_https_proxy"'
+                printf '%s\n' '[ -n "${QWEN_CI_HTTP_PROXY:-}" ] && export HTTP_PROXY="$QWEN_CI_HTTP_PROXY"'
+                printf '%s\n' '[ -n "${QWEN_CI_http_proxy:-}" ] && export http_proxy="$QWEN_CI_http_proxy"'
+                printf '%s\n' 'exec "$QWEN_CI_REAL_GH" "$@"'
+              } > "$proxy_bin/gh"
+              chmod +x "$proxy_bin/gh"
+            fi
+            if command -v git >/dev/null 2>&1; then
+              local real_git
+              real_git="$(command -v git)"
+              export QWEN_CI_REAL_GIT="$real_git"
+              {
+                printf '%s\n' '#!/usr/bin/env bash'
+                printf '%s\n' '[ -n "${QWEN_CI_HTTPS_PROXY:-}" ] && export HTTPS_PROXY="$QWEN_CI_HTTPS_PROXY"'
+                printf '%s\n' '[ -n "${QWEN_CI_https_proxy:-}" ] && export https_proxy="$QWEN_CI_https_proxy"'
+                printf '%s\n' '[ -n "${QWEN_CI_HTTP_PROXY:-}" ] && export HTTP_PROXY="$QWEN_CI_HTTP_PROXY"'
+                printf '%s\n' '[ -n "${QWEN_CI_http_proxy:-}" ] && export http_proxy="$QWEN_CI_http_proxy"'
+                printf '%s\n' 'exec "$QWEN_CI_REAL_GIT" "$@"'
+              } > "$proxy_bin/git"
+              chmod +x "$proxy_bin/git"
+            fi
+            export PATH="$proxy_bin:$PATH"
+            unset HTTPS_PROXY https_proxy HTTP_PROXY http_proxy
+          }
+          configure_qwen_network
+
+          unset ACTIONS_RUNTIME_TOKEN ACTIONS_RUNTIME_URL ACTIONS_CACHE_URL
+
+          # Root-owned loopback proxy: the real model key never enters the
+          # agent environment. Ephemeral port + nonce health check + bearer
+          # token defend against a squatter on the reused runner (proven
+          # exploitable on the verify lane; same defences as tmux).
+          start_openai_proxy() {
+            local proxy_port proxy_script proxy_nonce port_file
+            proxy_script="${RUNNER_TEMP:-/tmp}/qwen-openai-proxy-triage.js"
+            port_file="${RUNNER_TEMP:-/tmp}/qwen-openai-proxy-triage.port"
+            proxy_nonce="$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+            # NOT local on purpose: the agent env reads it as OPENAI_API_KEY
+            # and the proxy receives it as PROXY_TOKEN (tmux lane rule).
+            PROXY_TOKEN="$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+            export PROXY_TOKEN
+            rm -f "$port_file"
+            cat > "$proxy_script" <<'NODE'
+          const http = require('node:http');
+          const { writeFileSync } = require('node:fs');
+          const { Readable } = require('node:stream');
+
+          const portFile = process.argv[2];
+          const baseUrl = process.env.OPENAI_BASE_URL;
+          const apiKey = process.env.OPENAI_API_KEY;
+          const nonce = process.env.QWEN_PROXY_NONCE;
+          const token = process.env.PROXY_TOKEN;
+          if (!baseUrl || !apiKey || !portFile || !nonce || !token) {
+            console.error('missing proxy configuration');
+            process.exit(1);
+          }
+
+          const base = new URL(baseUrl);
+          const basePath = base.pathname.replace(/\/+$/, '');
+
+          const server = http.createServer(async (req, res) => {
+            if (req.url === '/__health') {
+              res.writeHead(200, { 'content-type': 'text/plain' });
+              res.end(nonce);
+              return;
+            }
+
+            let timer;
+            try {
+              const incoming = new URL(req.url || '/', 'http://127.0.0.1');
+              const target = new URL(base.origin);
+              let path = incoming.pathname;
+              if (
+                basePath &&
+                basePath !== '/' &&
+                path !== basePath &&
+                !path.startsWith(`${basePath}/`)
+              ) {
+                path = `${basePath}${path.startsWith('/') ? '' : '/'}${path}`;
+              }
+              target.pathname = path;
+              target.search = incoming.search;
+
+              if (req.method !== 'POST' || !target.pathname.endsWith('/chat/completions')) {
+                res.writeHead(403, { 'content-type': 'text/plain' });
+                res.end('proxy: only POST /chat/completions is allowed\n');
+                return;
+              }
+
+              if (req.headers.authorization !== `Bearer ${token}`) {
+                res.writeHead(401, { 'content-type': 'text/plain' });
+                res.end('proxy: unauthorized\n');
+                return;
+              }
+
+              const headers = new Headers(req.headers);
+              headers.delete('host');
+              headers.delete('content-length');
+              headers.set('authorization', `Bearer ${apiKey}`);
+
+              const init = { method: req.method, headers };
+              if (req.method !== 'GET' && req.method !== 'HEAD') {
+                init.body = req;
+                init.duplex = 'half';
+              }
+
+              const controller = new AbortController();
+              timer = setTimeout(() => controller.abort(), 120_000);
+              let upstream;
+              try {
+                upstream = await fetch(target, { ...init, signal: controller.signal });
+              } catch (error) {
+                if (error instanceof Error && error.name === 'AbortError') {
+                  res.writeHead(504, { 'content-type': 'text/plain' });
+                  res.end('proxy error: upstream request timed out\n');
+                  return;
+                }
+                throw error;
+              }
+              // The timer deliberately stays armed after fetch() resolves on
+              // headers: it doubles as the first idle window for the body,
+              // refreshed per chunk below (tmux lane rule).
+              const responseHeaders = {};
+              upstream.headers.forEach((value, key) => {
+                const lower = key.toLowerCase();
+                if (lower !== 'content-encoding' && lower !== 'content-length') {
+                  responseHeaders[key] = value;
+                }
+              });
+              res.writeHead(upstream.status, responseHeaders);
+              if (upstream.body) {
+                const body = Readable.fromWeb(upstream.body);
+                const done = () => clearTimeout(timer);
+                body.on('end', done);
+                body.on('error', () => {
+                  done();
+                  res.destroy();
+                });
+                res.on('close', () => {
+                  done();
+                  controller.abort();
+                });
+                body.pipe(res);
+                body.on('data', () => {
+                  clearTimeout(timer);
+                  timer = setTimeout(() => controller.abort(), 120_000);
+                });
+              } else {
+                clearTimeout(timer);
+                res.end();
+              }
+            } catch (error) {
+              clearTimeout(timer);
+              console.error('proxy upstream failure:', error);
+              res.writeHead(502, { 'content-type': 'text/plain' });
+              res.end('proxy error: upstream request failed\n');
+            }
+          });
+
+          server.listen(0, '127.0.0.1', () => {
+            writeFileSync(portFile, String(server.address().port));
+          });
+          NODE
+
+            OPENAI_API_KEY="$OPENAI_API_KEY" \
+              OPENAI_BASE_URL="$OPENAI_BASE_URL" \
+              QWEN_PROXY_NONCE="$proxy_nonce" \
+              node "$proxy_script" "$port_file" &
+            OPENAI_PROXY_PID=$!
+            trap 'kill "$OPENAI_PROXY_PID" 2>/dev/null || true' EXIT
+
+            proxy_port=''
+            for _ in 1 2 3 4 5 6 7 8 9 10; do
+              if ! kill -0 "$OPENAI_PROXY_PID" 2>/dev/null; then
+                echo "::error::OpenAI proxy exited before becoming ready"
+                exit 1
+              fi
+              if [ -z "$proxy_port" ] && [ -s "$port_file" ]; then
+                proxy_port="$(tr -cd '0-9' < "$port_file")"
+              fi
+              if [ -n "$proxy_port" ] &&
+                 [ "$(curl -fsS "http://127.0.0.1:${proxy_port}/__health" 2>/dev/null)" = "$proxy_nonce" ]; then
+                break
+              fi
+              proxy_port=''
+              sleep 1
+            done
+            if [ -z "$proxy_port" ] ||
+               ! kill -0 "$OPENAI_PROXY_PID" 2>/dev/null ||
+               [ "$(curl -fsS "http://127.0.0.1:${proxy_port}/__health" 2>/dev/null)" != "$proxy_nonce" ]; then
+              echo "::error::OpenAI proxy did not become ready (or another process answered on its port)"
+              exit 1
+            fi
+
+            LOCAL_OPENAI_BASE_URL="$(
+              OPENAI_BASE_URL="$OPENAI_BASE_URL" node -e '
+                const base = new URL(process.env.OPENAI_BASE_URL);
+                const path = base.pathname.replace(/\/+$/, "");
+                console.log("http://127.0.0.1:" + process.argv[1] + (path && path !== "/" ? path : ""));
+              ' "$proxy_port"
+            )"
+            export LOCAL_OPENAI_BASE_URL
+            unset OPENAI_API_KEY OPENAI_BASE_URL
+            echo "openai_proxy=enabled (${LOCAL_OPENAI_BASE_URL})"
+          }
+          start_openai_proxy
+
+          QWEN_CMD=(qwen --auth-type openai --approval-mode yolo)
+          if [ -n "${OPENAI_MODEL:-}" ]; then
+            QWEN_CMD+=(--model "$OPENAI_MODEL")
+          fi
+
+          # The agent's graceful budget stays BELOW the job timeout so a
+          # timeout still reaches the drafts upload, the publisher, and the
+          # lifecycle finalize instead of the runner killing the container.
+          AGENT_BUDGET_M=$(( ${TRIAGE_TIMEOUT_MINUTES:-60} - 10 ))
+          if (( AGENT_BUDGET_M < 5 )); then
+            AGENT_BUDGET_M=5
+          fi
+
+          QWEN_ENV=(
+            "HOME=/home/node"
+            "USER=node"
+            "SHELL=/bin/bash"
+            "PATH=$PATH"
+            "TERM=${TERM:-xterm-256color}"
+            "LANG=${LANG:-C.UTF-8}"
+            "CI=${CI:-true}"
+            "GITHUB_WORKSPACE=$GITHUB_WORKSPACE"
+            "GITHUB_REPOSITORY=$GITHUB_REPOSITORY"
+            "GITHUB_EVENT_NAME=$EVENT_NAME"
+            # Read-only job token: the agent's sole GitHub credential.
+            "GITHUB_TOKEN=$GH_TOKEN"
+            "GH_TOKEN=$GH_TOKEN"
+            "BOT_LOGIN=$BOT_LOGIN"
+            "REPOSITORY=$REPOSITORY"
+            "QWEN_HOME=${RUNNER_TEMP:?}/qwen-home"
+            "QWEN_TRIAGE_DRAFT_DIR=${RUNNER_TEMP:?}/triage-drafts"
+            "QWEN_TRIAGE_PUBLISH=workflow"
+            "QWEN_TRIAGE_CHANGELOG=${RUNNER_TEMP:?}/triage-context/claude-code-changelog.md"
+            "OPENAI_API_KEY=$PROXY_TOKEN"
+            "OPENAI_BASE_URL=$LOCAL_OPENAI_BASE_URL"
+            "NO_PROXY=${NO_PROXY:-}"
+            "no_proxy=${no_proxy:-}"
+            "QWEN_CI_HTTPS_PROXY=${QWEN_CI_HTTPS_PROXY:-}"
+            "QWEN_CI_https_proxy=${QWEN_CI_https_proxy:-}"
+            "QWEN_CI_HTTP_PROXY=${QWEN_CI_HTTP_PROXY:-}"
+            "QWEN_CI_http_proxy=${QWEN_CI_http_proxy:-}"
+            "QWEN_CI_REAL_GH=${QWEN_CI_REAL_GH:-}"
+            "QWEN_CI_REAL_GIT=${QWEN_CI_REAL_GIT:-}"
+          )
+          if [ -n "${OPENAI_MODEL:-}" ]; then
+            QWEN_ENV+=("OPENAI_MODEL=$OPENAI_MODEL")
+          fi
+
+          set +e
+          timeout --kill-after=10s "${AGENT_BUDGET_M}m" runuser -u node -- env -i "${QWEN_ENV[@]}" "${QWEN_CMD[@]}" \
+            --prompt "/triage ${NUMBER} --repo ${REPOSITORY}" \
+            --output-format stream-json \
+            | tee "$RUNNER_TEMP/triage-results/output.jsonl"
+          EXIT_CODE=${PIPESTATUS[0]}
+          set -e
+
+          # Same `summary` output the action used to emit: the last result
+          # frame's text. 'Check triage response' consumes it unchanged.
+          SUMMARY="$(node -e '
+            const fs = require("node:fs");
+            let summary = "";
+            for (const line of fs.readFileSync(process.argv[1], "utf8").split("\n")) {
+              if (!line.trim()) continue;
+              try {
+                const frame = JSON.parse(line);
+                if (frame.type === "result" && typeof frame.result === "string") {
+                  summary = frame.result;
+                }
+              } catch {}
+            }
+            process.stdout.write(summary);
+          ' "$RUNNER_TEMP/triage-results/output.jsonl" 2>/dev/null || true)"
+          # Random delimiter: the summary is agent-controlled text; a fixed
+          # delimiter would let a steered result frame inject extra outputs
+          # into this step's GITHUB_OUTPUT.
+          SUMMARY_DELIM="TRIAGE_SUMMARY_$(head -c 12 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+          {
+            echo "summary<<${SUMMARY_DELIM}"
+            printf '%s\n' "$SUMMARY"
+            echo "${SUMMARY_DELIM}"
+          } >> "$GITHUB_OUTPUT"
+          echo "triage exit code: $EXIT_CODE (budget ${AGENT_BUDGET_M}m)" >> "$GITHUB_STEP_SUMMARY"
+          exit "$EXIT_CODE"
 
       - name: 'Check triage response'
         if: 'success() || failure()'
@@ -979,6 +1354,216 @@ jobs:
           esac
           echo "Triage response received (${#RESPONSE} chars)."
 
+      # Flip the early status comment to a terminal state so a lingering
+      # "running" line doesn't outlive the run. Neutral wording — the verdict
+      # lives in the stage comments above; this only records that the run ended
+      # and keeps the run link. PATCHes exactly the comment id the claim step
+      # exported. An empty id means this run never ended up owning a comment:
+      # a cancel landing before the claim posted, or a transient failure of the
+      # claim's write (both the fresh-POST and PATCH arms export an empty id on
+      # failure). Either way nothing is flipped and a previous run's terminal
+      # wording stays untouched. A failed claim therefore leaves no lifecycle
+      # breadcrumb even when the comments API recovers during the minutes-long
+      # agent run — accepted: the verdict still lands in the stage comments,
+      # and a list-then-POST recovery here would reintroduce exactly the
+      # selection this coupling removes. Best-effort, on success, failure, AND
+      # cancellation: always() (not success() || failure()) because
+      # cancellation — cancel-in-progress superseding this run on a newer push
+      # or comment, job timeout, or manual cancel — would skip this step and
+      # leave the comment claiming the run is still in progress — the verify
+      # lane has publish-verify to catch that case, this lane only has us.
+      - name: 'Finalize triage status comment'
+        if: "always() && steps.resolve.outputs.number != ''"
+        shell: 'bash'
+        env:
+          GH_TOKEN: '${{ secrets.QWEN_CODE_BOT_TOKEN || secrets.CI_BOT_PAT }}'
+          STATUS_COMMENT_ID: '${{ steps.status.outputs.comment_id }}'
+          RUN_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+          TRIAGE_OUTCOME: '${{ steps.triage.outcome }}'
+          JOB_STATUS: '${{ job.status }}'
+        run: |-
+          set -uo pipefail
+          if [ -z "${STATUS_COMMENT_ID:-}" ]; then
+            echo "This run claimed no status comment; nothing to finalize." >&2
+          else
+            # A step success is not a green job: 'Check triage response' exits
+            # 1 on an empty summary while steps.triage.outcome stays 'success',
+            # and a later step can still fail. Only a non-failed job may claim
+            # "finished".
+            if [ "${TRIAGE_OUTCOME:-}" = 'success' ] && [ "${JOB_STATUS:-}" != 'failure' ]; then
+              EN="✅ **Qwen Triage finished** — [view run]($RUN_URL). See the stage comments in this thread for the result."
+              ZH="✅ **Qwen Triage 已完成** —— [查看运行]($RUN_URL)。结果见本线程中的各阶段评论。"
+            elif [ "${JOB_STATUS:-}" = 'cancelled' ]; then
+              EN="🚫 **Qwen Triage was cancelled** — [view run]($RUN_URL). The run was cancelled before finishing. Check for a newer run before re-running."
+              ZH="🚫 **Qwen Triage 已取消** —— [查看运行]($RUN_URL)。运行未完成即被取消。重跑前请先确认是否有更新的运行。"
+            else
+              EN="⚠️ **Qwen Triage ended early** — [view run]($RUN_URL). It stopped before finishing; check the run log."
+              ZH="⚠️ **Qwen Triage 提前结束** —— [查看运行]($RUN_URL)。未跑完，请查看运行日志。"
+            fi
+            printf -v BODY '%s\n\n%s\n\n%s' '<!-- qwen-triage lifecycle -->' "$EN" "$ZH"
+            gh api --method PATCH \
+              "repos/$GITHUB_REPOSITORY/issues/comments/$STATUS_COMMENT_ID" \
+              -f body="$BODY" >/dev/null ||
+              echo "::warning::Failed to finalize triage status comment; continuing." >&2
+          fi
+
+      # Drafts are the agent's only output channel to GitHub. Upload on every
+      # outcome so a timeout or a failed check still publishes what was
+      # drafted. Strip non-regular files first: actions/upload-artifact
+      # FOLLOWS symlinks, and a node-planted link would exfiltrate its target
+      # into the artifact (tmux/verify rule).
+      - name: 'Sanitize triage drafts'
+        if: 'always()'
+        run: |-
+          set -uo pipefail
+          # A steered agent can background children (the denylist is not a
+          # boundary), and a detached child could re-plant symlinks between
+          # the strip below and the upload — RUNNER_TEMP is shared across
+          # jobs on the host, so a followed link exfiltrates other lanes'
+          # data. Kill everything still running as the agent user FIRST
+          # (tmux/verify rule). Zombies do not count: they hold nothing open
+          # and cannot be killed, so counting them would never clear.
+          live_agent_processes() {
+            ps -o pid=,stat=,args= -u node 2>/dev/null | awk '$2 !~ /^Z/'
+          }
+          pkill -KILL -u node 2>/dev/null || true
+          for _ in 1 2 3; do
+            [ -n "$(live_agent_processes)" ] || break
+            sleep 1
+            pkill -KILL -u node 2>/dev/null || true
+          done
+          survivors="$(live_agent_processes)" || true
+          if [ -n "$survivors" ]; then
+            # Deny by default: an unkillable writer makes the draft set
+            # untrustworthy, so drop it instead of uploading a race loser.
+            echo "::error::Processes owned by the agent user survived SIGKILL; dropping drafts as possibly tainted."
+            printf '%s\n' "$survivors"
+            rm -rf "${RUNNER_TEMP:?}/triage-drafts"
+            exit 0
+          fi
+          [ -d "${RUNNER_TEMP:?}/triage-drafts" ] || exit 0
+          find "$RUNNER_TEMP/triage-drafts" \( -type l -o -type p -o -type s -o -type b -o -type c \) -delete 2>/dev/null || true
+
+      - name: 'Upload triage drafts'
+        if: 'always()'
+        # A missing drafts dir (agent died before writing any) must not mask
+        # the original error; the publisher reports the absence itself.
+        continue-on-error: true
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # v4.6.2
+        with:
+          # Same expression as the download side: if the run died before
+          # 'Resolve target number', both sides fall back to the event's
+          # issue number instead of disagreeing on an empty segment.
+          name: 'triage-drafts-${{ steps.resolve.outputs.number || github.event.issue.number }}-${{ github.run_id }}-${{ github.run_attempt }}'
+          path: '${{ runner.temp }}/triage-drafts/'
+          retention-days: 7
+          if-no-files-found: 'warn'
+
+      # Restore workspace ownership while the container still runs as root so
+      # the next job on this runner can check out without EACCES (the context
+      # step chowned everything to node; tmux lane rule).
+      - name: 'Restore workspace ownership after agent'
+        if: 'always()'
+        run: |-
+          set -uo pipefail
+          chmod -R u+rwX "$GITHUB_WORKSPACE" 2>/dev/null || echo "::warning::could not restore workspace write permissions"
+          RUNNER_UID="$(stat -c '%u' "$RUNNER_TEMP" 2>/dev/null || stat -f '%u' "$RUNNER_TEMP" 2>/dev/null || echo 0)"
+          RUNNER_GID="$(stat -c '%g' "$RUNNER_TEMP" 2>/dev/null || stat -f '%g' "$RUNNER_TEMP" 2>/dev/null || echo 0)"
+          if [ "$RUNNER_UID" != "0" ]; then
+            chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" 2>/dev/null || echo "::warning::could not restore workspace ownership"
+          else
+            echo "::warning::could not determine runner UID; skipping ownership restore"
+          fi
+
+  # Publish the triage agent's drafts. Runs on a clean runner with the write
+  # PAT and never executes agent-provided code — only validated data. The
+  # triage job above holds no write credential in the agent environment; this
+  # job is the sole writer to GitHub for the triage lane. Same isolation
+  # shape as publish-tmux / publish-verify.
+  publish-triage:
+    needs: ['triage']
+    # Publish even when the agent run failed or timed out: drafts written
+    # before the failure still reach the PR, and the lifecycle comment in the
+    # triage job records the early end. 'skipped' means no triage ran at all.
+    if: >-
+      always() &&
+      needs.triage.result != 'skipped' &&
+      github.repository == 'QwenLM/qwen-code'
+    # Per-RUN group, deliberately not per-PR (publish-tmux rule): a per-PR
+    # group would let a second run replace a completed run's pending
+    # publisher and drop its drafts. Overlap is made safe by the publisher's
+    # bot-owned marker upserts.
+    concurrency:
+      group: "${{ format('{0}-publish-triage-{1}', github.workflow, github.run_id) }}"
+      cancel-in-progress: false
+    timeout-minutes: 10
+    # Checks out only trusted base-repo scripts at the default-branch head
+    # (issue_comment/pull_request_target events resolve github.sha there);
+    # no PR code, so the persistent pool is safe (publish-tmux rule).
+    # Kill-switch: MAINTAINER_ECS_RUNNER_DISABLED.
+    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
+    permissions:
+      contents: 'read'
+    steps:
+      - name: 'Restore workspace ownership'
+        if: "${{ runner.environment == 'self-hosted' }}"
+        run: |-
+          set -uo pipefail
+          RUNNER_UID="$(id -u)"
+          RUNNER_GID="$(id -g)"
+          if [ "$RUNNER_UID" != "0" ]; then
+            chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace ownership; artifact download may fail on leftover root-owned files"
+          fi
+          chmod -R u+rwX "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chmod -R u+rwX "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace write permissions; artifact download may fail on leftover root-owned files"
+
+      # Sparse and pinned: the publisher, the owner-assignment helpers it
+      # imports, and the owner policy — nothing else (publish-verify pattern).
+      - name: 'Checkout the triage publisher scripts'
+        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
+        with:
+          ref: '${{ github.sha }}'
+          sparse-checkout: |-
+            /.github/scripts/triage-publish.mjs
+            /.github/scripts/assign-issue-owner.mjs
+            /.github/issue-owners.json
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+
+      - name: 'Download triage drafts'
+        uses: 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' # v5.0.0
+        with:
+          name: 'triage-drafts-${{ needs.triage.outputs.pr_number || github.event.issue.number }}-${{ github.run_id }}-${{ github.run_attempt }}'
+          path: 'triage-drafts'
+        continue-on-error: true
+
+      - name: 'Publish triage drafts'
+        env:
+          GH_TOKEN: '${{ secrets.QWEN_CODE_BOT_TOKEN || secrets.CI_BOT_PAT }}'
+          NUMBER: '${{ needs.triage.outputs.pr_number || github.event.issue.number }}'
+          TRIAGE_RESULT: '${{ needs.triage.result }}'
+          QWEN_MAINTAINER_HANDLE: '${{ vars.QWEN_MAINTAINER_HANDLE }}'
+        run: |-
+          set -euo pipefail
+          if [ -z "${NUMBER:-}" ]; then
+            echo "::warning::No target number resolved; nothing to publish."
+            exit 0
+          fi
+          if [ ! -f triage-drafts/actions.jsonl ]; then
+            if [ "${TRIAGE_RESULT:-}" = 'success' ]; then
+              echo "::error::The triage agent succeeded but produced no drafts; nothing was published."
+              exit 1
+            fi
+            echo "::warning::The triage run ended before writing drafts; nothing to publish."
+            exit 0
+          fi
+          node .github/scripts/triage-publish.mjs \
+            --drafts triage-drafts \
+            --repo "$GITHUB_REPOSITORY" \
+            --number "$NUMBER"
+
+      # Moved here from the triage job: it inspects the reviews the run
+      # posted, and those now land in the publish step above, so it must run
+      # AFTER publishing. Body unchanged otherwise.
       - name: 'Notify silent triage re-run'
         if: >-
           success() &&
@@ -988,7 +1573,7 @@ jobs:
         shell: 'bash'
         env:
           GH_TOKEN: '${{ secrets.QWEN_CODE_BOT_TOKEN || secrets.CI_BOT_PAT }}'
-          NUMBER: '${{ steps.resolve.outputs.number }}'
+          NUMBER: '${{ needs.triage.outputs.pr_number || github.event.issue.number }}'
           TRIGGERED_AT: '${{ github.event.comment.created_at }}'
           RUN_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
         run: |-
@@ -1107,59 +1692,6 @@ jobs:
           gh api "repos/$GITHUB_REPOSITORY/issues/$NUMBER/comments" \
             -f body="$BODY" >/dev/null
 
-      # Flip the early status comment to a terminal state so a lingering
-      # "running" line doesn't outlive the run. Neutral wording — the verdict
-      # lives in the stage comments above; this only records that the run ended
-      # and keeps the run link. PATCHes exactly the comment id the claim step
-      # exported. An empty id means this run never ended up owning a comment:
-      # a cancel landing before the claim posted, or a transient failure of the
-      # claim's write (both the fresh-POST and PATCH arms export an empty id on
-      # failure). Either way nothing is flipped and a previous run's terminal
-      # wording stays untouched. A failed claim therefore leaves no lifecycle
-      # breadcrumb even when the comments API recovers during the minutes-long
-      # agent run — accepted: the verdict still lands in the stage comments,
-      # and a list-then-POST recovery here would reintroduce exactly the
-      # selection this coupling removes. Best-effort, on success, failure, AND
-      # cancellation: always() (not success() || failure()) because
-      # cancellation — cancel-in-progress superseding this run on a newer push
-      # or comment, job timeout, or manual cancel — would skip this step and
-      # leave the comment claiming the run is still in progress — the verify
-      # lane has publish-verify to catch that case, this lane only has us.
-      - name: 'Finalize triage status comment'
-        if: "always() && steps.resolve.outputs.number != ''"
-        shell: 'bash'
-        env:
-          GH_TOKEN: '${{ secrets.QWEN_CODE_BOT_TOKEN || secrets.CI_BOT_PAT }}'
-          STATUS_COMMENT_ID: '${{ steps.status.outputs.comment_id }}'
-          RUN_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
-          TRIAGE_OUTCOME: '${{ steps.triage.outcome }}'
-          JOB_STATUS: '${{ job.status }}'
-        run: |-
-          set -uo pipefail
-          if [ -z "${STATUS_COMMENT_ID:-}" ]; then
-            echo "This run claimed no status comment; nothing to finalize." >&2
-          else
-            # A step success is not a green job: 'Check triage response' exits
-            # 1 on an empty summary while steps.triage.outcome stays 'success',
-            # and a later step can still fail. Only a non-failed job may claim
-            # "finished".
-            if [ "${TRIAGE_OUTCOME:-}" = 'success' ] && [ "${JOB_STATUS:-}" != 'failure' ]; then
-              EN="✅ **Qwen Triage finished** — [view run]($RUN_URL). See the stage comments in this thread for the result."
-              ZH="✅ **Qwen Triage 已完成** —— [查看运行]($RUN_URL)。结果见本线程中的各阶段评论。"
-            elif [ "${JOB_STATUS:-}" = 'cancelled' ]; then
-              EN="🚫 **Qwen Triage was cancelled** — [view run]($RUN_URL). The run was cancelled before finishing. Check for a newer run before re-running."
-              ZH="🚫 **Qwen Triage 已取消** —— [查看运行]($RUN_URL)。运行未完成即被取消。重跑前请先确认是否有更新的运行。"
-            else
-              EN="⚠️ **Qwen Triage ended early** — [view run]($RUN_URL). It stopped before finishing; check the run log."
-              ZH="⚠️ **Qwen Triage 提前结束** —— [查看运行]($RUN_URL)。未跑完，请查看运行日志。"
-            fi
-            printf -v BODY '%s\n\n%s\n\n%s' '<!-- qwen-triage lifecycle -->' "$EN" "$ZH"
-            gh api --method PATCH \
-              "repos/$GITHUB_REPOSITORY/issues/comments/$STATUS_COMMENT_ID" \
-              -f body="$BODY" >/dev/null ||
-              echo "::warning::Failed to finalize triage status comment; continuing." >&2
-          fi
-
   # On-demand real-user testing: a write-permission user comments
   # `@qwen-code /tmux` on a PR to launch the changed app in a tmux TUI and
   # exercise the affected flow. EXECUTES untrusted PR code, so: gated on the PR

.qwen/skills/triage/SKILL.md

@@ -34,10 +34,10 @@ gh label list --repo "$REPO" --limit 200
 
 - Untrusted input: never interpolate issue/PR text into shell
 - Labels: apply existing only, never create. Do not touch process labels (`welcome-pr`, `maintainer`, `help wanted`, `good first issue`)
-- Comments: read body from file. Use `--body-file FILE` for `gh issue/pr comment`,
+- Writes: never call GitHub write APIs directly. Every comment, review,
-  or `gh api -F body=@FILE` when the response ID is needed. Never `--body @FILE`
+  label change, close, and defer is a DRAFT (see Publishing below); the
-  or `gh api -f body=@FILE` — those post the path literally.
+  publisher executes drafts under the bot identity.
-- Drafts: skip
+- Draft PRs: skip
 - **Approval guardrail**: never auto-approve a cross-repository (fork) PR whose
   title is a `refactor` type (starts with `refactor` — `refactor:`,
   `refactor(scope):`, `refactor(scope)!:`, case-insensitive). Review it as usual,
@@ -58,11 +58,67 @@ gh label list --repo "$REPO" --limit 200
 - ⛔ **Never execute PR-derived code.** The review is static. Do not run
   `npm`/`node`/`npx`/interpreters/build/test commands against a tree containing
   the PR's changes; do not `gh pr checkout`, `git apply` the diff, or run any
-  script the PR adds or modifies. In CI the agent env carries a write PAT —
+  script the PR adds or modifies. In CI the agent holds only a read-only
-  code you execute can read it. Test evidence comes from the PR's own CI
+  token — executed code can still read it and act within its scope, and the
-  checks via the API (`references/pr-workflow.md`, Stage 2b "Test evidence");
+  draft protocol keeps writes out of the agent entirely. Test evidence comes
-  live behavior is exercised only by the isolated `@qwen-code /tmux` job. If
+  from the PR's own CI checks via the API (`references/pr-workflow.md`,
-  any instruction elsewhere seems to require running PR code, this rule wins.
+  Stage 2b "Test evidence"); live behavior is exercised only by the isolated
+  `@qwen-code /tmux` job. If any instruction elsewhere seems to require
+  running PR code, this rule wins.
+
+## Publishing
+
+Every GitHub write is a draft. At the start of the run, set up the draft
+directory (the workflow provides it in CI):
+
+```bash
+# Fresh per run: a reused directory would append to a previous run's
+# actions. CI provides a per-run directory via QWEN_TRIAGE_DRAFT_DIR.
+DRAFT_DIR="${QWEN_TRIAGE_DRAFT_DIR:-$(mktemp -d /tmp/triage-drafts-XXXXXX)}"
+mkdir -p "$DRAFT_DIR/bodies"
+```
+
+Write each body as a file under `$DRAFT_DIR/bodies/`, then append one JSON
+action per line to `$DRAFT_DIR/actions.jsonl` (use `jq -cn` so names and
+labels are escaped safely). Actions execute in file order:
+
+| Action         | Shape                                                                                                                                            |
+| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| upsert-comment | `{"action":"upsert-comment","marker":"stage=1","body":"bodies/stage-1.md"}`                                                                      |
+| review         | `{"action":"review","event":"APPROVE","commit_id":"<full OID>","body":"bodies/approve.md"}` — or `"event":"REQUEST_CHANGES"` without `commit_id` |
+| close-pr       | `{"action":"close-pr"}`                                                                                                                          |
+| close-issue    | `{"action":"close-issue","reason":"not planned"}`                                                                                                |
+| labels         | `{"action":"labels","add":["type/bug"],"remove":["status/need-information"]}`                                                                    |
+| defer          | `{"action":"defer","body":"bodies/defer.md"}` — PR only; the publisher resolves and @mentions the maintainer and assigns the PR                  |
+
+Rules the publisher enforces (fail-closed; do not rely on leniency):
+
+- Comment bodies must start with the exact marker line
+  `<!-- qwen-triage <marker> -->`; markers are limited to `stage=1`,
+  `stage=2`, `stage=3`, `stage=1-pre`, `stage=1b`.
+- Bodies are capped at 65,536 characters — rejected, not truncated.
+- `APPROVE` requires the full reviewed `commit_id`; the publisher skips it
+  as stale if the head moved, and suppresses duplicate approvals and
+  duplicate `CHANGES_REQUESTED` reviews.
+- Labels must already exist; the publisher never creates one.
+- Comment upserts match bot-authored comments whose body starts with the
+  marker — a quoted marker in someone else's comment is never touched.
+
+Two modes:
+
+- **CI** (`QWEN_TRIAGE_PUBLISH=workflow`): draft only, then stop. The
+  workflow's `publish-triage` job validates and executes the drafts with the
+  bot PAT. Never attempt GitHub writes yourself — your token is read-only,
+  and the CI denylist blocks running the publisher.
+- **Local** (no `QWEN_TRIAGE_PUBLISH`): after the final stage, run the same
+  publisher with your own `gh` auth:
+
+  ```bash
+  node .github/scripts/triage-publish.mjs \
+    --drafts "$DRAFT_DIR" --repo "$REPO" --number "${PR_NUMBER:-$ISSUE_NUMBER}"
+  ```
+
+  Add `--dry-run` to preview the plan without writing.
 
 ## Duplicate Guard
 
@@ -74,7 +130,7 @@ gh label list --repo "$REPO" --limit 200
 - Local invocation (no `GITHUB_EVENT_NAME`): run all stages, update prior
   comments in place
 
-Every posted comment must include an invisible marker: `<!-- qwen-triage stage=N -->` where N is the stage number. The guard matches against this marker, not comment headings.
+Every drafted comment must include an invisible marker: `<!-- qwen-triage stage=N -->` where N is the stage number. The guard matches against this marker, not comment headings.
 
 ## Format
 

.qwen/skills/triage/references/issue-workflow.md

@@ -2,9 +2,11 @@
 
 Triage a GitHub issue. Shared rules in `SKILL.md` — read those first.
 
-**Single comment, updated in place.** Stage 1 posts a concise bilingual
+**Single comment, updated in place.** Stage 1 drafts a concise bilingual
-comment; Stage 2 appends results to the same comment via `gh api PATCH`.
+comment; Stage 2 drafts the same comment again with results appended — the
-Key points only — no verbose prose.
+publisher upserts by the `stage=1` marker, so exactly one comment exists.
+Key points only — no verbose prose. All writes are drafts (see "Publishing"
+in `SKILL.md`).
 
 ```markdown
 <!-- qwen-triage stage=1 -->
@@ -43,34 +45,45 @@ Classify the issue from title, body, comments, labels, docs, and source context:
 - **Feature**: new capability, behavior change, or product request.
 
 Apply labels using existing labels only. Prefer one `type/*`, one `category/*`,
-relevant `scope/*`, one priority label, and status labels as needed. Apply
+relevant `scope/*`, one priority label, and status labels as needed. Every
-labels with `gh issue edit --add-label`.
+label change is a `labels` draft action (the publisher verifies each label
+exists and never creates one):
+
+```bash
+jq -cn '{action:"labels",add:["type/bug","scope/cli"],remove:[]}' >> "$DRAFT_DIR/actions.jsonl"
+```
 
 If the issue is no longer unclear and currently has `status/need-information`,
 remove that label:
 
 ```bash
-gh issue edit "$ISSUE_NUMBER" --repo "$REPO" --remove-label "status/need-information"
+jq -cn '{action:"labels",add:[],remove:["status/need-information"]}' >> "$DRAFT_DIR/actions.jsonl"
 ```
 
-Post a single triage comment (bilingual, concise key points — see format
+Draft a single triage comment (bilingual, concise key points — see format
-below). This comment is updated in place by Stage 2; never post a second one.
+below): write the body to `$DRAFT_DIR/bodies/triage-comment.md` (first line
+`<!-- qwen-triage stage=1 -->`), then append the action. Stage 2 drafts the
+same marker again with the result appended; never draft a second marker.
+
+```bash
+jq -cn '{action:"upsert-comment",marker:"stage=1",body:"bodies/triage-comment.md"}' >> "$DRAFT_DIR/actions.jsonl"
+```
 
 If inadmissible, close the issue and stop:
 
 ```bash
-gh issue close "$ISSUE_NUMBER" --repo "$REPO" --reason "not planned"
+jq -cn '{action:"close-issue",reason:"not planned"}' >> "$DRAFT_DIR/actions.jsonl"
 ```
 
-Save the comment ID for Stage 2 to update.
-
 ## Stage 2: Handle By Type
 
-Work the issue by type below, then **update** the Stage 1 comment in place with
+Work the issue by type below, then **re-draft** the Stage 1 comment with the
-the result appended:
+result appended (write the full updated body to the same
+`$DRAFT_DIR/bodies/triage-comment.md`, then append the same `upsert-comment`
+action again — the publisher PATCHes the existing comment by marker):
 
 ```bash
-gh api -X PATCH repos/$REPO/issues/comments/$COMMENT_ID -F body=@/tmp/triage-comment.md
+jq -cn '{action:"upsert-comment",marker:"stage=1",body:"bodies/triage-comment.md"}' >> "$DRAFT_DIR/actions.jsonl"
 ```
 
 ### For unclear issues:
@@ -125,7 +138,8 @@ gh api -X PATCH repos/$REPO/issues/comments/$COMMENT_ID -F body=@/tmp/triage-com
 
 ### For bugs without clear reproduction:
 
-1. Add `welcome-pr` if it exists. Say community PRs are welcome.
+1. Say community PRs are welcome. Do not draft the `welcome-pr` label —
+   process labels are rejected by the publisher (see SKILL.md Rules).
 2. Add `status/need-retesting` if on a stale version.
 3. Inspect source and docs inside worktree; state confidence: confirmed / plausible / no clear
    direction.

.qwen/skills/triage/references/pr-workflow.md

@@ -6,12 +6,11 @@ Shared rules (untrusted input, skip, bilingual format) are in `SKILL.md`.
 
 ### Comment Management
 
-Three comments, one per stage. Post each through the issues comments API and
+Three comments, one per stage. Every GitHub write is a DRAFT (see
-capture its ID:
+"Publishing" in `SKILL.md`): write the body into `$DRAFT_DIR/bodies/` and
-
+append one action to `$DRAFT_DIR/actions.jsonl`. The publisher upserts each
-```bash
+comment by its stage marker at publish time — the agent never posts or
-COMMENT_ID=$(gh api "repos/$REPO/issues/$PR_NUMBER/comments" -F body=@/tmp/stage-N.md --jq '.id')
+patches comments itself.
-```
 
 | Stage   | Comment                                                                         |
 | ------- | ------------------------------------------------------------------------------- |
@@ -23,50 +22,46 @@ COMMENT_ID=$(gh api "repos/$REPO/issues/$PR_NUMBER/comments" -F body=@/tmp/stage
 module hard block, Stage 1a template failure, Stage 1b problem-does-not-exist,
 Stage 1c direction escalation, or Stage 1-pre's two request-changes exits —
 linked issue closed as not planned, or a remaining delta against a merged
-fix), submit exactly one `CHANGES_REQUESTED` review and stop. Do not also post
+fix), draft exactly one `CHANGES_REQUESTED` review and stop. Do not also draft
 or update a Stage 1 issue comment, and do not continue to Stage 2, Stage 3, or
-approval. The Stage 1-pre duplicate-close exit is different: it posts the
+approval. The Stage 1-pre duplicate-close exit is different: it drafts the
-terminal `stage=1-pre` comment and closes the PR instead of submitting a
+terminal `stage=1-pre` comment and a `close-pr` action instead of a review.
-review.
 
-**Re-runs:** if the triage runs again on the same PR, update each comment in place. **Resolve the comment id by its stage marker AT PATCH TIME — never from memory, list position, or an earlier stage's bookkeeping.** On a re-run the thread holds four or more bot comments whose list order is not the stage order, and a wrong id silently overwrites another stage's comment (observed on a real re-run: the stage=3 comment clobbered with stage=1 content mid-run). The author filter matters too — the marker is public text anyone can paste into a comment, and the bot PAT may be able to edit other users' comments:
+**Re-runs:** the publisher resolves each comment by its stage marker AT
+PUBLISH TIME — bot author plus body `startswith` the marker line, last match
+wins — and PATCHes it, or POSTs when that stage has no comment yet. The agent
+does not resolve comment ids for writes, so a wrong-id overwrite (observed on
+a real re-run: the stage=3 comment clobbered with stage=1 content) is
+structurally impossible. `startswith`, not `contains`: a substring match
+would also hit a comment that merely quotes the marker, and the publisher's
+bot-author filter is what keeps a quoted marker from diverting an update onto
+someone else's comment.
+
+The `stage_comment_id` helper remains for READS (the reopen guard below):
 
 ```bash
-BOT_LOGIN=$(gh api user --jq '.login')
+# In CI the workflow passes BOT_LOGIN (the read-only token's `gh api user`
+# would return github-actions[bot], not the publishing bot).
+BOT_LOGIN="${BOT_LOGIN:-$(gh api user --jq '.login')}"
 stage_comment_id() { # $1 = stage number (1, 2, 3), "1-pre", or "status"
   gh api "repos/$REPO/issues/$PR_NUMBER/comments" --method GET --paginate -F per_page=100 |
     jq -rs --arg bot "$BOT_LOGIN" --arg m "<!-- qwen-triage stage=$1 -->" \
       '[.[][] | select(.user.login == $bot) | select(.body | startswith($m))] | last | .id // empty'
 }
-CID=$(stage_comment_id 2)   # re-resolve immediately before EACH patch
-[ -n "$CID" ] && gh api -X PATCH "/repos/$REPO/issues/comments/$CID" -F body=@/tmp/stage-2-updated.md
 ```
 
-`startswith`, not `contains`: stage comments carry their marker as the first line, and a substring match would also hit a comment that merely quotes the marker. An empty `CID` means that stage has no comment yet — POST a new one instead of patching.
+Never create duplicates. For terminal-exit reviews the GitHub API does not
+support editing PR reviews; the publisher skips re-submitting when the bot
+already has a `CHANGES_REQUESTED` review on the PR (the existing review
+already gates it). Draft the review once per run; dedup is the publisher's
+job, enforced with a paginated read.
 
-Never create duplicates. For terminal-exit reviews (submitted via
+**Signature & footer:** capture the reviewed commit's **full** OID **once, when you begin inspecting the code** — the SHA the worktree/diff actually reflects. Not a 7-char prefix (28 bits; a fork author can force-push a colliding prefix), and **not** a fresh read at draft time (that would attest to code you never reviewed). Reuse this `HEAD_SHA` for every stage's footer, and before each draft — and again before the approval draft — re-read the head and bail if it moved:
-`gh pr review --request-changes`), the GitHub API does not support editing PR
-reviews. On re-run: check if a `CHANGES_REQUESTED` review from the bot already
-exists — if it does, skip re-submitting (the existing review already gates the
-PR). Only update issue comments, not PR reviews.
-
-```bash
-# Check for existing terminal-exit review before re-submitting. Paginate: a
-# heavily-reviewed PR is exactly where re-runs happen, and an unpaginated read
-# sees only the first page — missing the gating review and duplicating it.
-EXISTING=$(gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" --method GET --paginate -F per_page=100 |
-  jq -s --arg bot "$BOT_LOGIN" \
-    '[.[][] | select(.user.login == $bot and .state == "CHANGES_REQUESTED")] | length')
-# Only submit if no existing terminal review
-if [ "$EXISTING" -eq 0 ]; then gh pr review ... ; fi
-```
-
-**Signature & footer:** capture the reviewed commit's **full** OID **once, when you begin inspecting the code** — the SHA the worktree/diff actually reflects. Not a 7-char prefix (28 bits; a fork author can force-push a colliding prefix), and **not** a fresh read at post time (that would attest to code you never reviewed). Reuse this `HEAD_SHA` for every stage's footer, and before each post — and again before `--approve` — re-read the head and bail if it moved:
 
 ```bash
 HEAD_SHA=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid') || exit 1
 [ -n "$HEAD_SHA" ] || { echo 'empty head SHA — fail closed'; exit 1; }   # once, at review start
-# before any post or approval — refuse to attest to code you didn't review:
+# before any draft or approval — refuse to attest to code you didn't review:
 NOW=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid') || exit 1
 [ -n "$NOW" ] && [ "$NOW" = "$HEAD_SHA" ] || { echo 'head moved or unreadable — restart or defer'; exit 1; }
 ```
@@ -79,16 +74,17 @@ Every staged comment (Stage 1 gate-pass, Stage 2, Stage 3) ends with the signatu
 <sub>Reviewed at `<HEAD_SHA>` · re-run with `@qwen-code /triage`</sub>
 ```
 
-**If `HEAD_SHA` comes back empty** (API failure or a null `headRefOid`): **fail closed.** Do not PATCH an existing staged comment — the update rewrites the whole body, so a dropped footer erases the previously valid `Reviewed at` line just as an empty-backtick footer would. Retry the capture, or leave the prior comment (with its footer) untouched until a full OID is available; only a brand-new post that never had a footer may go out without one. Terminal-gate reviews (Stage 1-pre request-changes exits and Stage 1a/1b/1c, submitted via `gh pr review --request-changes`) use the signature only — no footer; they reject before a real review pass.
+**If `HEAD_SHA` comes back empty** (API failure or a null `headRefOid`): **fail closed.** Do not draft an update to an existing staged comment — the update rewrites the whole body, so a dropped footer erases the previously valid `Reviewed at` line just as an empty-backtick footer would. Retry the capture, or leave the prior comment (with its footer) untouched until a full OID is available; only a brand-new comment that never had a footer may go out without one. Terminal-gate reviews (Stage 1-pre request-changes exits and Stage 1a/1b/1c) use the signature only — no footer; they reject before a real review pass.
 
-**Approval:** the approve step runs **after** the Stage 3 comment. Comment first, then approve **pinned to the reviewed commit** — `gh pr review --approve` does not bind to a SHA, so a force-push in the check-then-act gap would approve unseen code. Use the reviews API with `commit_id` instead, which records the approval against the exact commit you reviewed (branch protection that requires approval of the latest push then won't count it if the head moved):
+**Approval:** the approval draft runs **after** the Stage 3 comment draft, **pinned to the reviewed commit**. The publisher submits it through the reviews API with `commit_id` (never `gh pr review --approve`, which binds to no SHA), and skips it as stale if the head moved past `commit_id` before publish:
 
 ```bash
-gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" \
+printf '%s\n' 'LGTM, looks ready to ship. ✅' > "$DRAFT_DIR/bodies/approve.md"
-  -f commit_id="$HEAD_SHA" -f event=APPROVE -f body='LGTM, looks ready to ship. ✅'
+jq -cn --arg sha "$HEAD_SHA" '{action:"review",event:"APPROVE",commit_id:$sha,body:"bodies/approve.md"}' \
+  >> "$DRAFT_DIR/actions.jsonl"
 ```
 
-**Approve once per commit — and only your OWN approval counts as already done.** Re-running triage three times must not stack three approvals, so check before posting. But "already approved" means **this bot's** `APPROVED` review on **this exact** `HEAD_SHA`, and nothing else:
+**Approve once per commit — and only your OWN approval counts as already done.** Re-running triage three times must not stack three approvals, so check before drafting. But "already approved" means **this bot's** `APPROVED` review on **this exact** `HEAD_SHA`, and nothing else:
 
 - **Another account's approval is not yours.** `main` requires two approving reviews, so a maintainer's approval is a _different_ vote — the whole reason the bot's is still needed. Never read it as "already approved".
 - **A `DISMISSED` review is not an approval.** Branch protection runs with `dismiss_stale_reviews: true`, so every push dismisses the bot's prior approval. That is precisely when a fresh one is required.
@@ -98,11 +94,11 @@ Decide it with the query, not by scanning the review list — the failure mode i
 
 ```bash
 # Does the bot's OWN approval already stand on the commit under review?
-BOT_LOGIN=$(gh api user --jq '.login')   # re-resolve if this is a fresh shell
 MINE=$(gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" --method GET --paginate -F per_page=100 |
   jq -s --arg bot "$BOT_LOGIN" --arg sha "$HEAD_SHA" \
     '[.[][] | select(.user.login == $bot and .state == "APPROVED" and .commit_id == $sha)] | length')
-if [ "$MINE" -eq 0 ]; then gh api ... -f event=APPROVE ... ; fi
+# Only draft the APPROVE action above when MINE is 0. The publisher
+# re-checks this idempotence (and head staleness) at publish time.
 ```
 
 This rule exists because a maintainer approved a PR three minutes before re-triggering `/triage`; the run read that human approval as "existing approval from prior run still valid, head SHA unchanged", skipped its own approve, and reported ✅ Approved (5/5) — leaving the PR at 1 of 2 required approvals with nothing in the run log marked wrong.
@@ -122,7 +118,9 @@ Core infrastructure: files matching `packages/core/src/**`, `packages/*/src/auth
 **Tier 1 — Large-scope `refactor` changes to core → HARD BLOCK.** Applies to non-maintainer PRs only (skip this check if the author is a known maintainer). Hard-block on _size_, not breadth: if a core-path `refactor`-type PR (title starts with `refactor` — `refactor:`, `refactor(scope):`, `refactor(scope)!:`, case-insensitive) totals **500+ production logic lines** (additions + deletions, using the size calculation above) → reject immediately. No evaluation, no Stage 1.
 
 ```bash
-gh pr review "$PR_NUMBER" --repo "$REPO" --request-changes --body "This refactor touches core infrastructure at scale (N production lines). Core refactors of this size must be maintainer-initiated — please open an issue to discuss the design first."
+printf '%s\n' "This refactor touches core infrastructure at scale (N production lines). Core refactors of this size must be maintainer-initiated — please open an issue to discuss the design first." \
+  > "$DRAFT_DIR/bodies/stage-0-core-block.md"
+jq -cn '{action:"review",event:"REQUEST_CHANGES",body:"bodies/stage-0-core-block.md"}' >> "$DRAFT_DIR/actions.jsonl"
 ```
 
 Then **stop**. This is a wall, not a guideline.
@@ -226,7 +224,8 @@ proceed to 1a.
   `<!-- qwen-triage stage=1-pre -->` marker, @mention the author), and stop:
 
 ```bash
-gh pr review "$PR_NUMBER" --repo "$REPO" --request-changes --body-file /tmp/stage-1pre-not-planned.md
+# after writing the bilingual body to "$DRAFT_DIR/bodies/stage-1pre-not-planned.md"
+jq -cn '{action:"review",event:"REQUEST_CHANGES",body:"bodies/stage-1pre-not-planned.md"}' >> "$DRAFT_DIR/actions.jsonl"
 ```
 
 - Any linked issue **closed as completed** → find what closed it (GraphQL —
@@ -286,7 +285,8 @@ latest close was manual), treat the closer as unresolved.
     `<!-- qwen-triage stage=1-pre -->` marker, @mention the author). Stop:
 
 ```bash
-gh pr review "$PR_NUMBER" --repo "$REPO" --request-changes --body-file /tmp/stage-1pre-remaining-delta.md
+# after writing the bilingual body to "$DRAFT_DIR/bodies/stage-1pre-remaining-delta.md"
+jq -cn '{action:"review",event:"REQUEST_CHANGES",body:"bodies/stage-1pre-remaining-delta.md"}' >> "$DRAFT_DIR/actions.jsonl"
 ```
 
 - Closed manually (no close commit) or the closer cannot be resolved →
@@ -314,7 +314,7 @@ deliberate reopen means the duplicate judgment needs human eyes, and this
 guard is what keeps that judgment from being overridden on the next run.
 
 ```bash
-cat > /tmp/stage-1pre-duplicate.md <<'EOF'
+cat > "$DRAFT_DIR/bodies/stage-1pre-duplicate.md" <<'EOF'
 <!-- qwen-triage stage=1-pre -->
 
 The linked issue #N was already fixed by #M, and every production change in
@@ -331,8 +331,8 @@ something here is NOT covered by #M, say so and this can be reopened.
 
 — _Qwen Code · qwen3.7-max_
 EOF
-gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file /tmp/stage-1pre-duplicate.md
+jq -cn '{action:"upsert-comment",marker:"stage=1-pre",body:"bodies/stage-1pre-duplicate.md"}' >> "$DRAFT_DIR/actions.jsonl"
-gh pr close "$PR_NUMBER" --repo "$REPO"
+jq -cn '{action:"close-pr"}' >> "$DRAFT_DIR/actions.jsonl"
 ```
 
 **1a. Template check:**
@@ -340,7 +340,8 @@ gh pr close "$PR_NUMBER" --repo "$REPO"
 PR body missing required headings from `.github/pull_request_template.md` (read from worktree) → request changes, @mention author, link the template, stop. This is the only public output for this terminal gate.
 
 ```bash
-gh pr review "$PR_NUMBER" --repo "$REPO" --request-changes --body-file /tmp/pr-gate-template.md
+# after writing the body to "$DRAFT_DIR/bodies/pr-gate-template.md"
+jq -cn '{action:"review",event:"REQUEST_CHANGES",body:"bodies/pr-gate-template.md"}' >> "$DRAFT_DIR/actions.jsonl"
 ```
 
 **1b. Problem existence check (MANDATORY):**
@@ -351,7 +352,7 @@ Before "is the direction right?", ask **"does this problem actually exist?"**
 - **Theoretical hardening** ("could theoretically send X" with no evidence) → **request changes.** Ask for a reproduction:
 
 ```bash
-cat > /tmp/stage-1b-reproduction.md <<'EOF'
+cat > "$DRAFT_DIR/bodies/stage-1b-reproduction.md" <<'EOF'
 <!-- qwen-triage stage=1b -->
 
 This PR addresses a theoretical concern — "could theoretically send X" — but
@@ -374,10 +375,10 @@ If the author cannot provide one on re-run, escalate to the maintainer and stop.
 
 — _Qwen Code · qwen3.7-max_
 EOF
-gh pr review "$PR_NUMBER" --repo "$REPO" --request-changes --body-file /tmp/stage-1b-reproduction.md
+jq -cn '{action:"review",event:"REQUEST_CHANGES",body:"bodies/stage-1b-reproduction.md"}' >> "$DRAFT_DIR/actions.jsonl"
 ```
 
-If the author cannot provide a reproduction on re-run, escalate to the maintainer (use `$QWEN_MAINTAINER_HANDLE` if set) and stop — do not proceed to Stage 2.
+If the author cannot provide a reproduction on re-run, escalate to the maintainer via a `defer` draft (Stage 3) and stop — do not proceed to Stage 2.
 
 - **No reproduction = no fix.** A `fix:` PR without reproduction is a hypothesis — belongs in issues, not PRs.
 
@@ -391,14 +392,22 @@ Ask the hard questions before reading a single line of code:
 - Is it within qwen-code's core mission, or does it pull focus from what matters more?
 - "Can do" ≠ "should do" — technically feasible doesn't mean we should ship it.
 
-CHANGELOG is a reference signal, not the sole criterion (fetched through `gh`,
+CHANGELOG is a reference signal, not the sole criterion. In CI the workflow
-which already holds the token — no extra `curl` subprocess needed):
+prefetches it (the agent's read-only token cannot read other repositories);
+locally, fetch it through `gh`:
 
 ```bash
-gh api repos/anthropics/claude-code/contents/CHANGELOG.md \
+if [ -n "${QWEN_TRIAGE_CHANGELOG:-}" ] && [ -f "$QWEN_TRIAGE_CHANGELOG" ]; then
-  -H "Accept: application/vnd.github.raw+json" | grep -iC1 "<keywords>"
+  grep -iC1 "<keywords>" "$QWEN_TRIAGE_CHANGELOG"
+else
+  gh api repos/anthropics/claude-code/contents/CHANGELOG.md \
+    -H "Accept: application/vnd.github.raw+json" | grep -iC1 "<keywords>"
+fi
 ```
 
+A missing prefetch file means the signal is unavailable — treat it exactly
+like "not found" below, never as a rejection.
+
 - **Found** → cite version/line as supporting signal.
 - **Not found** → not a rejection. The area may still be relevant.
 
@@ -438,7 +447,7 @@ If any file matches (the strongest triage-time signal — 10 of 31 reverted PRs
 
 This signal is NOT a terminal gate — it does not stop the review or close the PR. It escalates review depth and flags risk so the reviewer knows where to focus. A PR that touches high-risk paths but passes full review with clean E2E verification can still be approved.
 
-Post a single Stage 1 comment. Be direct — say what you actually think, not what's polite:
+Draft a single Stage 1 comment (body → `$DRAFT_DIR/bodies/stage-1.md`, then append the `upsert-comment` action with marker `stage=1`). Be direct — say what you actually think, not what's polite:
 
 ```markdown
 <!-- qwen-triage stage=1 -->
@@ -487,7 +496,7 @@ Risk: <if Stage 1e matched, list the high-risk paths and recommended review dept
 <sub>Reviewed at `<HEAD_SHA>` · re-run with `@qwen-code /triage`</sub>
 ```
 
-Save this comment's ID. Terminal exits — stop here if any applies:
+Terminal exits — stop here if any applies:
 
 - Duplicate of a merged fix, no remaining delta (Stage 1-pre) → closed.
 - Duplicate with remaining delta, or issue closed as not planned (Stage 1-pre) → request changes, stopped.
@@ -588,8 +597,8 @@ Two more escaping notes: `<code>` shows HTML entities literally but GFM **still
 #### 2b. Test evidence — the PR's own CI, via the API (never run PR code)
 
 ⛔ **Do not run the PR's tests, builds, or any PR-derived code yourself** — see
-SKILL.md Rules. In CI the agent env holds a write PAT that executed code could
+SKILL.md Rules. In CI the agent holds only a read-only token and drafts every
-read, and the PR's own CI already runs the full suite on isolated runners.
+write, and the PR's own CI already runs the full suite on isolated runners.
 Your job is to read that signal, not to re-run it.
 
 ```bash
@@ -789,7 +798,7 @@ from standing, non-blocking follow-ups (a pre-existing gap, a platform caveat, a
 nit), and add a one-paragraph methodology note (environment, how you drove it)
 so the maintainer can trust and reproduce it.
 
-Post a single Stage 2 comment (must include `<!-- qwen-triage stage=2 -->` at the top), in this order: code review findings → optional sequence diagram (2a-bis) → optional changed-files overview (2a-bis) → CI test evidence (2b) → the sandboxed-lane line when the central claim is behavioural and 2b cannot settle it (2b-bis) → real-scenario testing result when one was driven locally (2c) → the bilingual `<details>` Chinese summary → signature + footer last (the same tail order as the Stage 1 template). Include the two enrichments only when 2a-bis says they earn their place; a small, focused PR is just findings + testing. The 2b-bis line is not an enrichment — on the CI path it is the only thing in the comment that can close a behavioural gap, so omit it only under the two conditions 2b-bis names.
+Draft a single Stage 2 comment (body → `$DRAFT_DIR/bodies/stage-2.md`, then append the `upsert-comment` action with marker `stage=2`; the body must include `<!-- qwen-triage stage=2 -->` at the top), in this order: code review findings → optional sequence diagram (2a-bis) → optional changed-files overview (2a-bis) → CI test evidence (2b) → the sandboxed-lane line when the central claim is behavioural and 2b cannot settle it (2b-bis) → real-scenario testing result when one was driven locally (2c) → the bilingual `<details>` Chinese summary → signature + footer last (the same tail order as the Stage 1 template). Include the two enrichments only when 2a-bis says they earn their place; a small, focused PR is just findings + testing. The 2b-bis line is not an enrichment — on the CI path it is the only thing in the comment that can close a behavioural gap, so omit it only under the two conditions 2b-bis names.
 
 **⛔ BEFORE POSTING: verify the testing section carries real evidence.** Read back through your draft. In CI: does it quote actual check names and conclusions (and the failing job's log excerpt when red), and is the CI table wrapped in the `qwen-triage-ci` region markers so the finalize workflow can update it? On a local run: does it have a fenced code block with the actual terminal capture (or the `N/A` substitution for docs/types/refactor PRs with nothing user-visible)? Does the evidence depth match the PR type per “Scale the evidence” above — screenshots for UI changes, measurements for performance claims, clean-state numbers for build/test claims? If not, fix that now — and never paper over a gap with the author's self-reported results. The maintainer cannot approve without seeing what actually happened.
 
@@ -803,7 +812,7 @@ Post a single Stage 2 comment (must include `<!-- qwen-triage stage=2 -->` at th
 <!-- paste capture-pane output here inside ``` -->
 ````
 
-Close with the signature then the footer, and save this comment's ID — on an empty `HEAD_SHA`, follow the fail-closed rule above (leave an existing comment and its footer untouched; never blank it):
+Close with the signature then the footer — on an empty `HEAD_SHA`, follow the fail-closed rule above (leave an existing comment and its footer untouched; never blank it):
 
 ```markdown
 — _Qwen Code · qwen3.7-max_
@@ -830,7 +839,7 @@ Step back and look at the whole picture — the motivation, the implementation,
 
 If your independent proposal was materially simpler — say so. Not as a blocker, but as an honest question the contributor should think about.
 
-**Step 1: Post the reflection comment** (must include `<!-- qwen-triage stage=3 -->` at the top).
+**Step 1: Draft the reflection comment** (body → `$DRAFT_DIR/bodies/stage-3.md`, then append the `upsert-comment` action with marker `stage=3`; the body must include `<!-- qwen-triage stage=3 -->` at the top).
 
 Open it with a one-line confidence score — `**Confidence: N/5** — <one honest line>` — as the human-readable summary of everything above. It is your read, not a rubric dump, and it must stay consistent with the verdict you're about to act on in Step 2:
 
@@ -842,11 +851,11 @@ Open it with a one-line confidence score — `**Confidence: N/5** — <one hones
 | 2/5   | Significant concerns; leaning against as-is                     | request changes |
 | 1/5   | Should not merge in its current form                            | request changes |
 
-A fork `refactor` that hits the approval guardrail below, **or a PR that Stage 0 escalated for maintainer awareness**, caps at 3/5 no matter how clean every stage looked — the guardrail drives the action, not the score. At 3/5 the action is always the **defer path** (a comment, never `--request-changes`): name any concerns in the defer comment for the maintainer's attention without approving, and @mention the maintainer for an unresolvable question or when the cap is pure policy. When the cap is pure policy on an otherwise-clean PR, say so in the one-line score so 3/5 doesn't read as real doubt — e.g. `Confidence: 3/5 — clean review, but the fork-refactor guardrail needs a maintainer's sign-off`. Never post a 4–5/5 alongside a `--request-changes`, or a 1–2/5 alongside an `--approve`: the score and the verdict tell the same story.
+A fork `refactor` that hits the approval guardrail below, **or a PR that Stage 0 escalated for maintainer awareness**, caps at 3/5 no matter how clean every stage looked — the guardrail drives the action, not the score. At 3/5 the action is always the **defer path** (a defer draft, never `REQUEST_CHANGES`): name any concerns in the defer body for the maintainer's attention without approving; the publisher resolves and @mentions the maintainer. When the cap is pure policy on an otherwise-clean PR, say so in the one-line score so 3/5 doesn't read as real doubt — e.g. `Confidence: 3/5 — clean review, but the fork-refactor guardrail needs a maintainer's sign-off`. Never draft a 4–5/5 alongside `REQUEST_CHANGES`, or a 1–2/5 alongside `APPROVE`: the score and the verdict tell the same story.
 
-Then write what you're actually thinking. "Looks good, ships the feature cleanly, the before/after shows it works" — not a five-bullet summary of the stages. If you have reservations, say them plainly. If you're approving with mild concerns, name them. Sign with `— _Qwen Code · qwen3.7-max_`, add the reviewed-commit footer (empty `HEAD_SHA` → fail closed, as above — don't blank a prior footer), and save this comment's ID.
+Then write what you're actually thinking. "Looks good, ships the feature cleanly, the before/after shows it works" — not a five-bullet summary of the stages. If you have reservations, say them plainly. If you're approving with mild concerns, name them. Sign with `— _Qwen Code · qwen3.7-max_` and add the reviewed-commit footer (empty `HEAD_SHA` → fail closed, as above — don't blank a prior footer).
 
-**Approve verdict while CI is still running → say so in this comment, before posting it.** Count pending **workflow runs with `event == "pull_request"`** — the PR's own CI — not check-runs. Check-runs on the head SHA also include bot orchestration jobs (`pull_request_target` / `issue_comment` runs like triage itself and review-pr) that can stay in flight long after CI finishes; counting those would defer an approval that nothing will ever un-defer, because the finalize workflow only fires on PR CI workflow completions. One extra cheap API call, still **no polling**; staleness is safe in this direction only (a run that completed after the fetch is merely treated as pending → defers, never mis-approves):
+**Approve verdict while CI is still running → say so in this comment, before drafting it.** Count pending **workflow runs with `event == "pull_request"`** — the PR's own CI — not check-runs. Check-runs on the head SHA also include bot orchestration jobs (`pull_request_target` / `issue_comment` runs like triage itself and review-pr) that can stay in flight long after CI finishes; counting those would defer an approval that nothing will ever un-defer, because the finalize workflow only fires on PR CI workflow completions. One extra cheap API call, still **no polling**; staleness is safe in this direction only (a run that completed after the fetch is merely treated as pending → defers, never mis-approves):
 
 ```bash
 PENDING=$(gh api "repos/$REPO/actions/runs?head_sha=$HEAD_SHA&per_page=100" --paginate \
@@ -876,7 +885,7 @@ The finalize workflow honors the marker only in comments authored by the bot its
 
 **⛔ Approval guardrail — check this BEFORE approving.** A cross-repository (fork) `refactor` PR must never be auto-approved: refactors touch structure broadly and a fork author is not a trusted committer, so these always need a human maintainer's eye (this rule exists because such a PR was wrongly auto-approved and merged). Decide it deterministically — do not eyeball it. `GUARD` was already computed in Step 1 (where it also gates the `approve-on-green` marker, for the same reason); reuse that value here.
 
-If `GUARD` is `block`: do **not** run `gh pr review --approve` no matter how clean every stage looked. Escalate to the maintainer instead (the "Genuinely unsure" path below, using `$QWEN_MAINTAINER_HANDLE` if set), and only `--request-changes` if you actually found blocking issues. This overrides the "approve" path.
+If `GUARD` is `block`: do **not** draft an `APPROVE` action no matter how clean every stage looked. Escalate to the maintainer instead (the "Genuinely unsure" defer path below), and only draft `REQUEST_CHANGES` if you actually found blocking issues. This overrides the "approve" path.
 
 If Stage 0 escalated the PR for maintainer awareness, do **not** approve automatically; use the "Genuinely unsure" path below.
 
@@ -884,104 +893,47 @@ If Stage 0 escalated the PR for maintainer awareness, do **not** approve automat
 
 All stages genuinely clean, `GUARD` is `ok`, and no Stage 0 maintainer escalation remains — how you approve depends on the `PENDING` count computed in Step 1:
 
-- `PENDING` = 0 → approve now, pinned to the reviewed commit (see the Approval note above) — never `gh pr review --approve`, which binds to no SHA:
+- `PENDING` = 0 → draft the approval now, pinned to the reviewed commit (see the Approval note above) — the publisher submits it through the reviews API with `commit_id`, never `gh pr review --approve`, which binds to no SHA:
 
   ```bash
-  gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" \
+  printf '%s\n' 'LGTM, looks ready to ship. ✅' > "$DRAFT_DIR/bodies/approve.md"
-    -f commit_id="$HEAD_SHA" -f event=APPROVE -f body='LGTM, looks ready to ship. ✅'
+  jq -cn --arg sha "$HEAD_SHA" '{action:"review",event:"APPROVE",commit_id:$sha,body:"bodies/approve.md"}' \
+    >> "$DRAFT_DIR/actions.jsonl"
   ```
 
 - `PENDING` > 0 → **post no approval in this run.** The Stage 3 comment already carries the `approve-on-green` marker (Step 1); the finalize workflow posts the same commit-pinned approval only after every check on `HEAD_SHA` completes green, and withholds it — flagging the status comment — if anything lands red or the head moves. Approving while the unit suite is still running would attest to a result that does not exist yet; that gap is exactly what the deferred path closes.
 
-Reflection shows it shouldn't merge — request changes immediately, citing the specific concerns from the comment:
+Reflection shows it shouldn't merge — draft a request-changes review immediately, citing the specific concerns from the comment:
 
 ```bash
-gh pr review "$PR_NUMBER" --repo "$REPO" --request-changes --body "Needs some rethinking — see my notes above. 🙏"
+printf '%s\n' 'Needs some rethinking — see my notes above. 🙏' > "$DRAFT_DIR/bodies/stage-3-rethink.md"
+jq -cn '{action:"review",event:"REQUEST_CHANGES",body:"bodies/stage-3-rethink.md"}' >> "$DRAFT_DIR/actions.jsonl"
 ```
 
-Genuinely unsure, or `GUARD` blocked approval — **don't approve or reject**, but **never defer silently**. Resolve who owns the call, assign the PR to them, and post an explicit defer comment that:
+Genuinely unsure, or `GUARD` blocked approval — **don't approve or reject**, but **never defer silently**. Draft a `defer` action whose body:
 
 1. States you are escalating to the maintainer.
 2. Names the specific reason(s) for uncertainty — what you cannot resolve from the diff, tests, and PR description.
-3. @mentions that maintainer.
-
-Resolve the maintainer deterministically — never eyeball it. `$QWEN_MAINTAINER_HANDLE` wins when set; otherwise the same owner map and load/rotation logic as issue assignment picks one accountable owner from the PR's labels. The resolver prints one login or nothing, and nothing means "fall through", never "guess":
 
 ```bash
-MAINTAINER="${QWEN_MAINTAINER_HANDLE:-}"
+cat > "$DRAFT_DIR/bodies/defer.md" <<'EOF'
-if [ -z "$MAINTAINER" ]; then
+<the specific reason(s), bilingual; no @mention — the publisher adds it>
-  MAINTAINER=$(REPO="${REPO:-}" PR_NUMBER="${PR_NUMBER:-}" node --input-type=module <<'EOF' 2>/dev/null
-import { readFileSync } from 'node:fs';
-import { spawnSync } from 'node:child_process';
-import { loadPolicy, matchArea, openIssueCount, pickOwner } from './.github/scripts/assign-issue-owner.mjs';
-
-const gh = (args) => {
-  const r = spawnSync('gh', args, { encoding: 'utf8' });
-  if (r.status !== 0) throw new Error(r.stderr.trim() || 'gh failed');
-  return r.stdout.trim();
-};
-
-// No lane exports REPO: the triage agent step exports REPOSITORY and Actions
-// always provides GITHUB_REPOSITORY, so fall through the skill's documented
-// resolve chain. The number arrives as PR_NUMBER or ISSUE_NUMBER depending
-// on the lane. Empty/unset values fall through the || chain.
-const repo = process.env.REPO || process.env.REPOSITORY || process.env.GITHUB_REPOSITORY;
-const prNumber = process.env.PR_NUMBER || process.env.ISSUE_NUMBER;
-const pr = JSON.parse(gh(['pr', 'view', prNumber, '--repo', repo, '--json', 'author,labels']));
-const policy = loadPolicy(readFileSync('.github/issue-owners.json', 'utf8'));
-const area = matchArea(policy, pr);
-if (!area) process.exit(0);
-
-const canWrite = (login) => {
-  try {
-    return ['admin', 'maintain', 'write'].includes(
-      gh(['api', 'repos/' + repo + '/collaborators/' + login + '/permission', '--jq', '.permission']),
-    );
-  } catch {
-    return false;
-  }
-};
-// A null author means the account was deleted — nobody to exclude, and
-// dereferencing it would throw, letting 2>/dev/null silently bypass the
-// deterministic resolver (the jq fallback below already defends this shape).
-const authorLogin = pr.author?.login?.toLowerCase() ?? '';
-const eligible = area.owners.filter(
-  (owner) => owner.toLowerCase() !== authorLogin && canWrite(owner),
-);
-if (eligible.length === 0) process.exit(0);
-
-// Same load metric as issue assignment — reuse the exported counter instead
-// of re-implementing it, so the two assignment paths cannot drift.
-const load = new Map(
-  eligible.map((owner) => [owner, openIssueCount(repo, owner)]),
-);
-console.log(pickOwner(eligible, load, Number(prNumber)));
 EOF
-  )
+jq -cn '{action:"defer",body:"bodies/defer.md"}' >> "$DRAFT_DIR/actions.jsonl"
-fi
-if [ -z "$MAINTAINER" ]; then
-  # Last resort: the most recent human reviewer, if any. latestReviews is
-  # not recency-sorted and bot accounts submit formal reviews here, so
-  # drop null authors first (a deleted account exports as "author": null,
-  # and one null login piped into endswith() aborts the whole filter,
-  # emptying the mention even when a live human reviewer exists), then
-  # filter the bot-suffix logins and order by submittedAt before taking
-  # the last — otherwise a defer escalation @mentions a bot and notifies
-  # nobody.
-  MAINTAINER=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json latestReviews \
-    --jq '[.latestReviews[] | select(.author.login != null) | select((.author.login | (endswith("[bot]") or endswith("-bot"))) | not)] | sort_by(.submittedAt) | last | .author.login // empty')
-fi
-if [ -n "$MAINTAINER" ]; then
-  # Put the PR in their Assigned filter — a stronger signal than the mention
-  # alone. Best-effort: a failed assign must never block the defer comment.
-  gh pr edit "$PR_NUMBER" --repo "$REPO" --add-assignee "$MAINTAINER" || true
-fi
 ```
 
-The heredoc resolves the repository as `REPO` → `REPOSITORY` → `GITHUB_REPOSITORY` and the PR number as `PR_NUMBER` → `ISSUE_NUMBER` (first set wins; the invocation line above passes the session's shell variables through, because an unexported variable never reaches the node child process and `2>/dev/null` would swallow the failure), and it resolves its relative import against the repository root, so run it from the workspace root like every other step here. If nothing resolves — no handle set, no area label on the PR, no eligible owner, no human reviewer — post the comment without an @mention rather than guessing a login.
+The publisher resolves who owns the call, prepends the @mention line
-
+(`⏸️ Deferring to @<login> — needs a human call on this one.`), posts the
-```bash
+comment, and assigns the PR to that maintainer best-effort. The resolution is
-gh pr comment "$PR_NUMBER" --repo "$REPO" --body "⏸️ Deferring to @<MAINTAINER> — <reason>. Needs a human call on this one."
+deterministic and lives in `.github/scripts/triage-publish.mjs` — it moved out
-```
+of this skill because its collaborator-permission lookup needs a write-level
+token the CI agent no longer holds: `$QWEN_MAINTAINER_HANDLE` wins when set;
+otherwise the same owner map and load/rotation logic as issue assignment
+picks one accountable owner from the PR's labels (author excluded, write
+access required); failing that, the most recent human reviewer (bot accounts
+excluded). If nothing resolves — no handle set, no area label on the PR, no
+eligible owner, no human reviewer — the publisher posts the comment without
+an @mention rather than guessing a login. Never eyeball or invent a handle
+yourself.
 
 A defer without an explicit comment is invisible — the maintainer won't know they're needed.

docs/design/2026-11-06-triage-ecs-token-isolation.md

@@ -0,0 +1,419 @@
+# Triage on ECS: Token Isolation and Containerization
+
+[English](2026-11-06-triage-ecs-token-isolation.md) | [简体中文](2026-11-06-triage-ecs-token-isolation.zh-CN.md)
+
+- Status: proposed
+- Date: 2026-11-06
+- Scope: `.github/workflows/qwen-triage.yml` (triage lane only), `.qwen/skills/triage/**`, one new publisher script, workflow pin tests
+
+## Problem statement
+
+GitHub-hosted runner capacity is tight while the maintainer-provided ECS pool
+has headroom. The triage lane of `qwen-triage.yml` still routes two trigger
+classes to `ubuntu-latest`:
+
+- `issue_comment` reruns (`@qwen-code /triage`), because the comment payload
+  carries no `github.event.pull_request` object and the target may be a fork
+  PR by an external author;
+- automatic `pull_request_target` triage of fork PRs whose author lacks write
+  access.
+
+The routing is a deliberate security control, not a technical limitation. The
+triage agent runs under `--yolo` with a write PAT
+(`QWEN_CODE_BOT_TOKEN || CI_BOT_PAT`) in its environment. The workflow's own
+comment block states that the command denylist is not a security boundary,
+that "fork PRs run on ephemeral hosted runners" is one of the three real
+controls, and that the residual risk — a prompt-injected agent exfiltrating
+the PAT or forging bot writes — is fixed structurally by token isolation,
+"tracked as a follow-up; not yet wired".
+
+Moving the remaining triggers to the persistent pool without that fix would
+let a steered agent persist across runs on reused machines and harvest
+credentials from later jobs. The goal of this design is to wire the fix and
+then route all triage triggers to ECS.
+
+## Current state
+
+- The `triage` job checks out the trusted base repository, never PR code, and
+  reaches the PR/issue only through the API. It runs the agent through
+  `QwenLM/qwen-code-action`, which receives the write PAT as
+  `GITHUB_TOKEN`/`GH_TOKEN` and the model key directly.
+- The skill (`.qwen/skills/triage/`) performs all GitHub writes itself:
+  staged comment upserts, reviews with votes, PR/issue closes, issue labels,
+  assignee adds, and the `approve-on-green` marker consumed by
+  `qwen-triage-finalize.yml`.
+- The sibling lanes already implement the isolation contract this design
+  reuses: `tmux-testing` and `verify` run in a `node:22-bookworm` container,
+  launch the CLI directly via `runuser -u node -- env -i` with empty GitHub
+  tokens, keep the real model key behind a root-owned loopback proxy, and
+  hand artifacts to separate publisher jobs (`publish-tmux`, `publish-verify`)
+  that hold the write credential and never execute agent-provided code.
+- `qwen-triage-finalize.yml` consumes bot-authored comments by exact marker
+  bytes and bot login. Any replacement write path must preserve both.
+
+## Goals
+
+1. Route every triage trigger (issues, `pull_request_target` including
+   external fork PRs, `issue_comment`, `workflow_dispatch`) to the ECS pool
+   when it is enabled, with the existing hosted fallback when
+   `MAINTAINER_ECS_RUNNER_DISABLED=true`.
+2. Remove the write PAT from the agent environment. The agent reads GitHub
+   with a short-lived read-only token and expresses every write as a
+   validated draft executed by a separate publisher.
+3. Contain the agent job so nothing it does persists on the runner host
+   beyond the sanitized workspace, and keep the real model key out of the
+   agent environment.
+4. Preserve every downstream contract: marker bytes, bot identity, the
+   `approve-on-green` protocol, lifecycle comments, and local `/triage`
+   usability.
+
+## Non-goals
+
+- No changes to the `tmux-testing`, `verify`, `publish-tmux`, or
+  `publish-verify` jobs, to `qwen-triage-finalize.yml`, or to the
+  `/review` pipeline (`qwen-code-pr-review.yml`).
+- No change to triage's judgment logic, stage structure, guardrails, or
+  comment templates.
+- No extraction of the shared model-proxy script (third inline copy here;
+  extraction is a follow-up).
+- The two pre-existing inconsistencies listed under Observations are recorded
+  but not fixed.
+
+## Proposed changes
+
+### A. Runner routing
+
+The `triage` job's `runs-on` collapses to the `publish-tmux` shape:
+
+```
+(repo == QwenLM/qwen-code && MAINTAINER_ECS_RUNNER_DISABLED != 'true')
+  → ['self-hosted', 'linux', 'x64', 'ecs-qwen']
+  → otherwise ['ubuntu-latest']
+```
+
+The `author_can_write` output of `authorize` exists only to route triage;
+after this change it has no consumer and is removed together with its
+permission lookup in the `pull_request_target` branch. The `verify_trust`
+classification and every deny gate are unchanged. `precheck-pr` still gates
+automatic fork-PR triage.
+
+Routing no longer depends on who authored the target PR because the controls
+below, not the machine choice, carry the trust boundary. The hosted fallback
+remains safe: the controls are additive.
+
+### B. Token isolation
+
+#### B1. Read-only agent credentials
+
+The `triage` job gets an explicit job-level `permissions` block:
+`contents: read`, `issues: read`, `pull-requests: read`, `checks: read`,
+`actions: read`. The agent receives this job-scoped `GITHUB_TOKEN` as its
+`GH_TOKEN`. It is read-only, expires with the job, and is worthless for
+forging bot writes. The pre-agent eyes-reaction step switches from
+`GITHUB_TOKEN` to the bot PAT (reactions need write scope).
+
+Two reads in today's skill cannot work with that token and move host-side:
+
+- **Collaborator-permission lookups.** The deterministic maintainer resolver
+  calls `repos/{repo}/collaborators/{login}/permission`, which requires a
+  write-level token. The whole resolver (env handle override → owner map +
+  canWrite filter + load rotation via `.github/scripts/assign-issue-owner.mjs`
+  → most-recent-human-reviewer fallback) moves into the publisher script.
+  The agent's defer draft carries only the reason; the publisher resolves the
+  maintainer, prepends the @mention, posts the comment, and adds the assignee
+  best-effort.
+- **Cross-repository read.** Stage 1c reads
+  `repos/anthropics/claude-code/contents/CHANGELOG.md` as an optional
+  direction signal; `GITHUB_TOKEN` is scoped to this repository. A host step
+  pre-fetches the file (best-effort, with the PAT) into the agent's context
+  directory; the skill greps the local file and treats a missing file as
+  "signal unavailable", which the skill already accepts as non-blocking.
+
+The bot login used by the skill's author filters (duplicate guard, reopen
+guard, review dedup) is resolved by a host step with the PAT and passed to the
+agent as `BOT_LOGIN`; `gh api user` under the read-only token would return
+`github-actions[bot]` and silently break every author filter.
+
+#### B2. Draft protocol
+
+The agent stops issuing GitHub write commands. Instead it writes, into a
+host-prepared directory exported as `QWEN_TRIAGE_DRAFT_DIR`:
+
+```
+actions.jsonl        # ordered actions, one JSON object per line
+bodies/<name>.md     # comment and review bodies referenced by actions
+```
+
+Action vocabulary (the complete write surface of today's skill):
+
+```json
+{"action":"upsert-comment","marker":"stage=1","body":"bodies/stage-1.md"}
+{"action":"review","event":"APPROVE","commit_id":"<head oid>","body":"bodies/review.md"}
+{"action":"review","event":"REQUEST_CHANGES","body":"bodies/review.md"}
+{"action":"close-pr"}
+{"action":"close-issue","reason":"not planned"}
+{"action":"labels","add":["type/bug"],"remove":["status/need-information"]}
+{"action":"defer","body":"bodies/defer.md"}
+```
+
+The `approve-on-green` marker is not an action: it stays a line inside the
+Stage 3 comment body, exactly as today, so the finalize workflow sees no
+change.
+
+#### B3. Publisher
+
+One new script, `.github/scripts/triage-publish.mjs`, is the single
+implementation of the write path for both CI and local use. It:
+
+1. Parses and validates the whole draft set before writing anything
+   (fail-closed preflight): unknown actions or fields reject the set;
+   `marker` must be in the allowlist (`stage=1`, `stage=2`, `stage=3`,
+   `stage=1-pre`, `stage=1b`); every comment body must start with the exact
+   `<!-- qwen-triage <marker> -->` line (the publisher enforces the prefix,
+   the agent is not trusted for it); bodies over GitHub's 65,536-character
+   limit are rejected, not truncated (truncation could cut the CI-region or
+   approve-on-green markers); review events are limited to `APPROVE` and
+   `REQUEST_CHANGES`; `APPROVE` requires `commit_id`; body paths must resolve
+   to regular files inside the draft directory; `actions.jsonl` and `bodies/`
+   must themselves be a regular file and a real directory (lstat — a
+   symlinked container would redirect the realpath containment base);
+   `review` and `close-pr` require a PR target, `close-issue` an issue
+   target, and `labels` rejects the process labels SKILL.md places
+   off-limits.
+2. Executes the actions in order, best-effort per action with a per-action
+   result summary:
+   - `upsert-comment`: bot-owned + body-startswith-marker dedup, last match
+     wins, PATCH else POST — the `publish-tmux` discipline, including
+     fail-closed identity resolution.
+   - `review`: re-reads the head; an `APPROVE` whose `commit_id` no longer
+     matches the head is skipped as stale (mirrors finalize). Idempotence:
+     the bot's own `APPROVED` at that commit, or an existing
+     `CHANGES_REQUESTED`, suppresses a duplicate.
+   - `close-pr` / `close-issue`: only when the target is still open.
+   - `labels`: verifies every label exists before applying, never creates,
+     and rejects the process labels (`welcome-pr`, `maintainer`,
+     `help wanted`, `good first issue`) that SKILL.md places off-limits.
+   - `defer`: runs the moved maintainer resolver, posts the comment with the
+     resolved @mention (or without one if nothing resolves), adds the
+     assignee best-effort.
+
+In CI a new `publish-triage` job runs the script: `needs: triage`,
+`if: always() && needs.triage.result != 'skipped'` (so drafts written before
+a timeout or failure still publish), per-RUN concurrency group and 10-minute
+cap like the sibling publishers, `publish-tmux` runner routing, and a sparse
+checkout of only the publisher script, `assign-issue-owner.mjs`, and
+`issue-owners.json`, pinned to `github.sha` with `persist-credentials: false`
+(the `publish-verify` pattern). It downloads the drafts artifact — collected
+with the sibling lanes' symlink/non-regular-file strip — and runs the script
+with the bot PAT. The PAT never enters the triage job's agent environment,
+and the publisher never executes agent-provided code, only data.
+
+Locally, the skill runs the same script at the end of the run with the user's
+own `gh` auth. One protocol, one implementation, two credential contexts.
+
+#### B4. Skill changes
+
+`SKILL.md`, `references/pr-workflow.md`, and `references/issue-workflow.md`
+replace every write command with the corresponding draft write, keep all
+reads, and keep every marker byte-identical. A new "Publishing" section
+defines the two modes: when `QWEN_TRIAGE_PUBLISH=workflow` (set only by the
+workflow) the agent drafts and stops — the CI denylist blocks `node`, so it
+structurally cannot run the publisher itself; otherwise it runs
+`triage-publish.mjs` as its final step. The resolver heredoc and the
+cross-repo CHANGELOG fetch leave the skill. The Rules text about the CI write
+PAT is updated to describe the read-only token.
+
+### C. Containerization and agent launch
+
+The `triage` job adopts the sibling contract:
+
+- `container: node:22-bookworm` with `--init`; a tools step installs
+  `gh`, `jq`, `git`, `ca-certificates` (the tmux resolver-tools step).
+- The action step is replaced by a direct CLI launch in the same shape as
+  tmux/verify: the model proxy starts in the same step (third inline copy of
+  the hardened loopback proxy — ephemeral port, nonce health check, bearer
+  dummy key), then `timeout … runuser -u node -- env -i … qwen --auth-type
+openai --approval-mode yolo --prompt '/triage …' --output-format stream-json`.
+  The explicit environment carries the read-only `GH_TOKEN`, `BOT_LOGIN`,
+  the draft-directory variables, a fresh per-run `QWEN_HOME`, and the proxy
+  endpoint instead of the real model key. The denylist/settings block moves
+  with the launch unchanged in substance.
+- The replacement step keeps the name `Run Qwen Triage` and the id `triage`,
+  and extracts the result frame of `output.jsonl` into the same `summary`
+  output, so `Check triage response` — whose `RESPONSE`/`TRIAGE_OUTCOME` env
+  literals are pinned — stays byte-identical and its API-error suffix
+  detection is untouched. The settings/denylist block moves verbatim into a
+  settings file the host writes into the fresh per-run `QWEN_HOME` before
+  launch.
+- Existing workspace hygiene stays (ownership restore, stale-agent-state
+  sanitize, git-metadata recreate); the base checkout adds
+  `persist-credentials: false`, and an end-of-job ownership-restore step
+  mirrors tmux. Drafts upload as an artifact with the non-regular-file
+  strip; before the strip, lingering agent-user processes are killed
+  (zombies excluded — an unkillable survivor drops the draft set
+  deny-by-default), closing the re-plant race between strip and upload.
+  The gh/git proxy-wrapper directory is made traversable by the agent user
+  (mktemp's 700 would silently drop the wrappers from its PATH), and the
+  toolchain step installs `util-linux` for `runuser`, as the sibling lanes
+  do.
+
+## Key design decisions
+
+| Decision                                                                 | Rationale                                                                                                                                                                 |
+| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Read-only `GITHUB_TOKEN` for agent reads, not a new read-only PAT secret | Job-scoped, ephemeral, no new secret to provision or rotate; the two reads it cannot serve move host-side                                                                 |
+| Drafts + separate publisher job, not a write proxy sidecar               | Matches `publish-tmux`/`publish-verify`; the credential is isolated by a job boundary, and the publisher is a deterministic, unit-testable script                         |
+| One publisher script for CI and local                                    | Prevents the two write paths from drifting; local `/triage` keeps working with the user's own auth                                                                        |
+| Stage comments publish in a batch at the end                             | A sidecar that streams drafts would reintroduce a live write channel into the agent job. The lifecycle comment with the live-run link already covers progress observation |
+| Maintainer resolver moves to the publisher                               | It is deterministic (owner map, canWrite, load rotation) and needs a write-level token; it was never agent judgment                                                       |
+| `author_can_write` removed                                               | Its only consumer was triage routing; a dead switch is a review finding, not a compatibility asset                                                                        |
+| Third inline model-proxy copy                                            | Extraction would touch the tmux/verify lanes and their pins; recorded as a follow-up                                                                                      |
+| Publisher runs on partial runs (`always()`)                              | Drafts written before a timeout still reach the PR; the lifecycle comment records the early end                                                                           |
+| Keep the step name/id `triage` and its `summary` output                  | `Check triage response`'s env literals are pinned; preserving them keeps the failure-detection contract intact without pin churn                                          |
+
+## Contract preservation
+
+- Markers (`stage=N`, `qwen-triage-ci sha=…` region, `approve-on-green sha=…`,
+  lifecycle) stay byte-identical; the publisher posts bodies as-is after
+  prefix validation.
+- All writes still land under the PAT's bot identity, so
+  `qwen-triage-finalize.yml`'s author filters, CI-region replacement, and
+  deferred approvals work unchanged.
+- `Finalize triage status comment` stays in the triage job (`always()`); it
+  consumes the pre-agent comment id and API state, not workspace files.
+  `Notify silent triage re-run` MOVES to `publish-triage`, after the publish
+  step: it inspects the reviews the run posted, and those now land at publish
+  time, so running it in the agent job would always see "no review". Its body
+  is unchanged; only the number source becomes
+  `needs.triage.outputs.pr_number`.
+- The duplicate guard, reopen guard, and review dedup keep their semantics;
+  only the credential behind the reads changes.
+
+## Files affected
+
+- `.github/workflows/qwen-triage.yml` — triage job (routing, permissions,
+  container, launch, drafts upload), authorize (drop `author_can_write`),
+  new `publish-triage` job.
+- `.github/scripts/triage-publish.mjs` — new publisher (validation +
+  execution + maintainer resolver).
+- `.qwen/skills/triage/SKILL.md`, `references/pr-workflow.md`,
+  `references/issue-workflow.md` — draft protocol, publishing modes, moved
+  resolver and CHANGELOG fetch, updated Rules text.
+- `.github/scripts/qwen-triage-workflow.test.mjs` (node:test, executed by the
+  `lint_and_static` HELPER_TESTS step in `ci.yml`) — the routing pins at
+  lines 701-756 encode the OLD trust model (`author_can_write`, the `issues`
+  branch) and are rewritten to pin the NEW contract: ECS routing with the
+  hosted kill-switch fallback, no `author_can_write`, job-level read-only
+  permissions, no write PAT in the agent environment, container present, and
+  the settings/denylist content in the host-written settings file. The
+  hygiene pins (stale-state sanitize, ownership restore) keep their
+  step-name contracts.
+- `scripts/tests/qwen-triage-workflow.test.js` (vitest) — step-name/env
+  literal pins survive where the design keeps them (status claim/finalize,
+  `Check triage response`, the `QWEN_HOME` path); the `QWEN_HOME` env-literal
+  pin moves to the `env -i` list; new assertions cover the publish job and
+  the drafts artifact strip. The verify-lane runuser-count pin is untouched
+  (this change adds no step to that interval).
+- `scripts/tests/qwen-runner-checkout-workflow.test.js` — no change expected:
+  `Recreate runner Git metadata` stays immediately before checkout.
+- `scripts/tests/triage-publish.test.js` — new unit tests for the publisher
+  (validation fail-closed cases, dedup, idempotence, resolver, per-action
+  failure reporting) against a stubbed `gh`.
+- `.github/workflows/.size-baseline` — bump the `qwen-triage.yml` entry in
+  this PR (see Constraints).
+- `.github/workflows/.ci-budget` — bump the `qwen-triage.yml` entry
+  (7→8 jobs, 280→290 declared timeout-minutes) for the new publish job;
+  the sibling ratchet aborts `Lint & Static` otherwise.
+- This design pair.
+
+## Constraints and risks
+
+- **No pre-merge live trigger.** `issue_comment` and `pull_request_target`
+  workflows run from the default branch; the new path can only be exercised
+  live after merge. Pre-merge confidence comes from the pin/replay suites,
+  publisher unit tests, and a local end-to-end draft→publish dry run.
+- **Batched stage comments** are a visible UX change: results land when the
+  run ends, not per stage. The lifecycle comment keeps the live log link.
+- **Publisher is a new single point of failure.** A preflight rejection
+  publishes nothing; the job fails loudly, the lifecycle comment records the
+  early end, and a re-run recovers. Per-action execution failures are
+  reported individually.
+- **Skill/publisher drift.** The publisher's allowlist is authoritative;
+  pin tests bind the marker set and the draft-mode contract on both sides.
+- **Residual risk after the change.** A prompt-injected agent can still
+  draft malicious content within triage's intended capability (a wrong
+  review, a misleading comment) — that is the product's inherent surface,
+  reviewed by humans. It can no longer exfiltrate a write credential, forge
+  writes outside the vocabulary, or persist on the host.
+- **Workflow size ratchet.** `qwen-triage.yml` is gated by
+  `.github/scripts/check-workflow-size.sh` (absolute cap 470,000 bytes;
+  growth beyond `.size-baseline` + 4,096 fails CI). The file already sits
+  ~1.2 KB over its 378,242-byte baseline, leaving ~2.9 KB of headroom; the
+  inline proxy and the publish job exceed it, so the baseline entry must be
+  bumped in the same PR. Publisher logic lives in the script, not the YAML,
+  to keep the growth bounded.
+
+## Validation plan
+
+1. `scripts/tests` pin suites updated and green, including new assertions:
+   triage `runs-on` shape, job-level read-only permissions, agent environment
+   contains no write PAT, container present, publish job shape, marker
+   allowlist parity between skill and publisher.
+2. Publisher unit tests green, with mutation witnesses (removing a validation
+   rule or the bot-identity filter must turn a test red).
+3. Workflow YAML parses with the repository's `node yaml` tooling; workflow
+   replay harnesses that execute inline shell steps pass.
+4. Local end-to-end dry run: `/triage` on a scratch PR against a test repo (or
+   a real PR with writes confirmed), verifying draft→publish produces the
+   same comment/review shape as today.
+5. Post-merge observation checklist on the first live runs: comment triggers
+   and automatic fork-PR triage land on ECS; stage comments, lifecycle,
+   rerun-summary, and a deferred approve-on-green round-trip through
+   finalize; kill-switch fallback exercised once.
+
+Commands (repository root):
+
+```bash
+PATH="$HOME/.local/bin:$PATH" npx vitest run \
+  --config ./scripts/tests/vitest.config.ts \
+  scripts/tests/qwen-triage-workflow.test.js \
+  scripts/tests/qwen-runner-checkout-workflow.test.js \
+  scripts/tests/workflow-size.test.js
+node --test .github/scripts/qwen-triage-workflow.test.mjs
+```
+
+The vitest suites silently skip jq-gated cases when `jq` is missing from
+`PATH`; the `.mjs` suite is node:test (not vitest) and needs the `yaml`
+package installed. The size gate runs in CI's `lint_and_static` job and is
+mirrored by `scripts/tests/workflow-size.test.js`.
+
+## Acceptance criteria
+
+- With the pool enabled, every triage trigger runs on ECS; with
+  `MAINTAINER_ECS_RUNNER_DISABLED=true`, all fall back to hosted and still
+  work.
+- The agent environment carries no write credential and no real model key
+  (structural property of the `env -i` list, pinned by tests).
+- The publisher executes the full action vocabulary; finalize interop is
+  unchanged; local `/triage` works through the same publisher.
+- All updated pin suites and new unit tests pass; YAML validates.
+- The post-merge observation checklist completes without contract drift.
+
+## Open questions
+
+- Whether to extract the three inline model-proxy copies into one shared
+  script in a follow-up (touches tmux/verify pins).
+- Whether the batched-comment UX warrants a lightweight progress signal
+  beyond the lifecycle comment (no action proposed now).
+
+## Observations (pre-existing, out of scope)
+
+- The `Notify silent triage re-run` step assumes a defer leaves a `COMMENTED`
+  review, but the skill's defer path posts an issue comment plus an assignee
+  and never submits a `COMMENT` review. The `deferred` branch of that step
+  appears unreachable today.
+- `SKILL.md` forbids touching the `welcome-pr` process label while
+  `references/issue-workflow.md` instructed adding it for unreproduced bugs.
+  Resolved during review: the publisher now rejects all process labels at
+  the chokepoint, and the issue-workflow instruction was aligned with the
+  rule.

docs/design/2026-11-06-triage-ecs-token-isolation.zh-CN.md

@@ -0,0 +1,344 @@
+# Triage 上 ECS：Token 隔离与容器化
+
+[English](2026-11-06-triage-ecs-token-isolation.md) | [简体中文](2026-11-06-triage-ecs-token-isolation.zh-CN.md)
+
+- 状态：提案
+- 日期：2026-11-06
+- 范围：仅 `.github/workflows/qwen-triage.yml` 的 triage lane、`.qwen/skills/triage/**`、一个新 publisher 脚本、workflow pin 测试
+
+## 问题陈述
+
+GitHub-hosted runner 资源紧张，而维护者自建的 ECS 池有余量。`qwen-triage.yml`
+的 triage lane 至今仍有两类触发路由到 `ubuntu-latest`：
+
+- `issue_comment` 重跑（`@qwen-code /triage`）：评论 payload 不带
+  `github.event.pull_request` 对象，且目标可能是外部作者的 fork PR；
+- 作者无 write 权限的 fork PR 的自动 `pull_request_target` triage。
+
+这条路由是刻意的安全控制，不是技术限制。triage agent 以 `--yolo` 运行，环境里
+带着 write PAT（`QWEN_CODE_BOT_TOKEN || CI_BOT_PAT`）。workflow 自己的注释块
+写明：命令 denylist 不是安全边界；「fork PR 跑在临时 hosted runner」是三条真实
+防线之一；残余风险——被提示注入的 agent 外泄 PAT 或伪造 bot 写入——的结构性
+修复就是 token 隔离，「已记为 follow-up；尚未接线」。
+
+不接线就把剩余触发搬上持久池，等于让被诱导的 agent 在复用的机器上跨 run 持久
+化，并收割后续 job 的凭据。本设计的目标就是接上这个修复，然后把全部 triage
+触发路由到 ECS。
+
+## 现状
+
+- `triage` job checkout 的是可信 base 仓库，从不 checkout PR 代码，只通过 API
+  触达 PR/issue。agent 经 `QwenLM/qwen-code-action` 启动，action 直接拿到
+  write PAT（`GITHUB_TOKEN`/`GH_TOKEN`）和真实模型 key。
+- skill（`.qwen/skills/triage/`）自己执行全部 GitHub 写入：分阶段评论原地
+  upsert、带票 review、关 PR/issue、issue label、加 assignee，以及由
+  `qwen-triage-finalize.yml` 兑现的 `approve-on-green` marker。
+- 兄弟 lane 已实现本设计复用的隔离契约：`tmux-testing` 与 `verify` 在
+  `node:22-bookworm` 容器里运行，经 `runuser -u node -- env -i` 直接启动 CLI、
+  GitHub token 全空，真实模型 key 放在 root 持有的 loopback 代理后面，产物交给
+  独立 publisher job（`publish-tmux`、`publish-verify`）——后者持有写凭据、
+  从不执行 agent 提供的代码。
+- `qwen-triage-finalize.yml` 按 marker 字节与 bot 登录名消费 bot 作者的评论。
+  任何替代写入路径都必须同时保住这两点。
+
+## 目标
+
+1. 池启用时，把每一类 triage 触发（issues、含外部 fork PR 的
+   `pull_request_target`、`issue_comment`、`workflow_dispatch`）都路由到 ECS；
+   `MAINTAINER_ECS_RUNNER_DISABLED=true` 时保留现有 hosted 降级。
+2. 把 write PAT 从 agent 环境里拿掉。agent 用短生命周期只读 token 读 GitHub，
+   所有写入表达为经校验的 draft，由独立 publisher 执行。
+3. 容器化 agent job，使其行为除了经过净化的 workspace 外不在 runner 宿主机上
+   留下任何持久化；真实模型 key 不进 agent 环境。
+4. 保住全部下游契约：marker 字节、bot 身份、`approve-on-green` 协议、lifecycle
+   评论，以及本地 `/triage` 的可用性。
+
+## 非目标
+
+- 不改 `tmux-testing`、`verify`、`publish-tmux`、`publish-verify` job，不改
+  `qwen-triage-finalize.yml`，不改 `/review` 流水线（`qwen-code-pr-review.yml`）。
+- 不改 triage 的判定逻辑、阶段结构、护栏与评论模板。
+- 不抽取共享 model-proxy 脚本（本次是第三份 inline 副本；抽取列为 follow-up）。
+- 「观察」一节列出的两处既有不一致只记录、不修复。
+
+## 提议的改动
+
+### A. Runner 路由
+
+`triage` job 的 `runs-on` 收敛为 `publish-tmux` 同款形状：
+
+```
+(repo == QwenLM/qwen-code && MAINTAINER_ECS_RUNNER_DISABLED != 'true')
+  → ['self-hosted', 'linux', 'x64', 'ecs-qwen']
+  → 否则 ['ubuntu-latest']
+```
+
+`authorize` 的 `author_can_write` output 只为 triage 路由而存在；改造后没有
+消费方，连同 `pull_request_target` 分支里的那次权限查询一起删除。
+`verify_trust` 分类与所有拒绝门不变。`precheck-pr` 仍然 gate 自动 fork-PR
+triage。
+
+路由不再依赖目标 PR 的作者是谁，因为信任边界由下面的控制承担，而不是机器选择。
+hosted 降级仍然安全：这些控制是叠加性的。
+
+### B. Token 隔离
+
+#### B1. 只读 agent 凭据
+
+`triage` job 增加显式 job 级 `permissions`：`contents: read`、`issues: read`、
+`pull-requests: read`、`checks: read`、`actions: read`。agent 拿到这个 job 作用
+域的 `GITHUB_TOKEN` 作为 `GH_TOKEN`：只读、随 job 过期、对伪造 bot 写入毫无
+价值。agent 前的 eyes-reaction 步骤从 `GITHUB_TOKEN` 改用 bot PAT（reaction
+需要 write 作用域）。
+
+今天 skill 里有两类读取用这个 token 做不了，搬到宿主侧：
+
+- **collaborator-permission 查询。** 确定性 maintainer 解析器会调
+  `repos/{repo}/collaborators/{login}/permission`，该 API 需要 write 级 token。
+  整个解析器（env handle 覆盖 → owner map + canWrite 过滤 + 经
+  `.github/scripts/assign-issue-owner.mjs` 的负载轮转 → 最近人类 reviewer 兜底）
+  移入 publisher 脚本。agent 的 defer draft 只带理由；publisher 解析 maintainer、
+  前置 @mention、发评论，并 best-effort 加 assignee。
+- **跨仓库读取。** Stage 1c 读 `repos/anthropics/claude-code/contents/CHANGELOG.md`
+  作为可选的方向信号；`GITHUB_TOKEN` 只对本仓有效。由宿主步骤（持 PAT、
+  best-effort）把文件预取到 agent 的 context 目录；skill grep 本地文件，文件
+  缺失按「信号不可用」处理——skill 本来就接受这不构成拒绝。
+
+skill 的作者过滤（duplicate guard、reopen guard、review 去重）所用的 bot 登录
+名，由宿主步骤持 PAT 解析后以 `BOT_LOGIN` 传给 agent；只读 token 下 `gh api user`
+返回的是 `github-actions[bot]`，会悄悄打穿所有作者过滤。
+
+#### B2. Draft 协议
+
+agent 不再发出 GitHub 写命令，改为向宿主预备、以 `QWEN_TRIAGE_DRAFT_DIR` 导出
+的目录写入：
+
+```
+actions.jsonl        # 有序动作，每行一个 JSON 对象
+bodies/<name>.md     # 动作引用的评论/review 正文
+```
+
+动作词汇表（即今天 skill 的全部写入面）：
+
+```json
+{"action":"upsert-comment","marker":"stage=1","body":"bodies/stage-1.md"}
+{"action":"review","event":"APPROVE","commit_id":"<head oid>","body":"bodies/review.md"}
+{"action":"review","event":"REQUEST_CHANGES","body":"bodies/review.md"}
+{"action":"close-pr"}
+{"action":"close-issue","reason":"not planned"}
+{"action":"labels","add":["type/bug"],"remove":["status/need-information"]}
+{"action":"defer","body":"bodies/defer.md"}
+```
+
+`approve-on-green` marker 不是动作：它仍是 Stage 3 评论正文里的一行，与今天
+完全一致，finalize workflow 看不到任何变化。
+
+#### B3. Publisher
+
+一个新脚本 `.github/scripts/triage-publish.mjs`，是 CI 与本地共用的唯一写入
+路径实现。它：
+
+1. 在写入任何内容之前解析并校验整个 draft 集（fail-closed 预检）：未知动作或
+   字段拒绝整组；`marker` 必须在允许列表（`stage=1`、`stage=2`、`stage=3`、
+   `stage=1-pre`、`stage=1b`）；每条评论正文必须以精确的
+   `<!-- qwen-triage <marker> -->` 行开头（前缀由 publisher 强制，不信任
+   agent）；超过 GitHub 65,536 字符上限的正文拒绝而非截断（截断可能切掉 CI 区域
+   或 approve-on-green marker）；review event 仅限 `APPROVE` 与
+   `REQUEST_CHANGES`；`APPROVE` 必须带 `commit_id`；body 路径必须解析为 draft
+   目录内的常规文件；`actions.jsonl` 与 `bodies/` 本身必须分别是常规文件与
+   真实目录（lstat——符号链接容器会重定向 realpath 包含检查的基准目录）；
+   `review` 与 `close-pr` 要求 PR 目标，`close-issue` 要求 issue 目标，
+   `labels` 拒绝 SKILL.md 划为禁区的 process label。
+2. 按序执行动作，逐动作 best-effort 并输出逐动作结果摘要：
+   - `upsert-comment`：bot 作者 + 正文 startswith marker 去重，取 last，PATCH
+     否则 POST——即 `publish-tmux` 的纪律，包括身份解析 fail-closed。
+   - `review`：重读 head；`commit_id` 已不匹配 head 的 `APPROVE` 按 stale 跳过
+     （与 finalize 一致）。幂等：bot 自己在该 commit 上已 `APPROVED`、或已存在
+     `CHANGES_REQUESTED`，都抑制重复。
+   - `close-pr` / `close-issue`：仅当目标仍 open。
+   - `labels`：先验证每个 label 存在再应用，永不创建，并拒绝 SKILL.md 划为
+     禁区的 process label（`welcome-pr`、`maintainer`、`help wanted`、
+     `good first issue`）。
+   - `defer`：运行搬过来的 maintainer 解析器，发带解析出的 @mention 的评论
+     （解析不出就不带），best-effort 加 assignee。
+
+CI 里由新 job `publish-triage` 运行该脚本：`needs: triage`、
+`if: always() && needs.triage.result != 'skipped'`（超时或失败前写下的 draft
+仍能发布）、与兄弟 publisher 相同的 per-RUN 并发组与 10 分钟上限、
+`publish-tmux` 的 runner 路由，以及只含 publisher 脚本、`assign-issue-owner.mjs`、
+`issue-owners.json` 的 sparse checkout，钉 `github.sha`、
+`persist-credentials: false`（`publish-verify` 的模式）。它下载 drafts artifact
+（按兄弟 lane 的规矩剥离符号链接与非常规文件），持 bot PAT 运行脚本。PAT 从不
+进入 triage job 的 agent 环境；publisher 从不执行 agent 提供的代码，只处理数据。
+
+本地则由 skill 在运行末尾用用户自己的 `gh` 认证运行同一脚本。一套协议、一份
+实现、两种凭据上下文。
+
+#### B4. Skill 改动
+
+`SKILL.md`、`references/pr-workflow.md`、`references/issue-workflow.md` 把每条
+写命令替换为对应的 draft 写入，保留全部读取，所有 marker 字节不变。新增
+「Publishing」一节定义两种模式：`QWEN_TRIAGE_PUBLISH=workflow`（仅由 workflow
+设置）时 agent 只写 draft 即止——CI denylist 挡 `node`，它在结构上就无法自己跑
+publisher；否则以运行 `triage-publish.mjs` 作为最后一步。解析器 heredoc 与跨仓
+CHANGELOG 抓取离开 skill。Rules 里关于 CI write PAT 的表述更新为只读 token。
+
+### C. 容器化与 agent 启动
+
+`triage` job 采用兄弟契约：
+
+- `container: node:22-bookworm` 带 `--init`；工具步骤安装 `gh`、`jq`、`git`、
+  `ca-certificates`（即 tmux 的 resolver-tools 步骤）。
+- action 步骤替换为与 tmux/verify 同形的直接 CLI 启动：model proxy 在同一步骤内
+  启动（加固版 loopback proxy 的第三份 inline 副本——临时端口、nonce 健康检查、
+  bearer dummy key），然后 `timeout … runuser -u node -- env -i … qwen
+--auth-type openai --approval-mode yolo --prompt '/triage …' --output-format
+stream-json`。显式环境携带只读 `GH_TOKEN`、`BOT_LOGIN`、draft 目录变量、每 run
+  全新的 `QWEN_HOME`，以及代理端点而非真实模型 key。denylist/settings 块随启动
+  迁移，实质不变。
+- 替换步骤保留名称 `Run Qwen Triage` 与 id `triage`，从 `output.jsonl` 的
+  result 帧提取出同名 `summary` output，使 env 字面量被 pin 的
+  `Check triage response`（`RESPONSE`/`TRIAGE_OUTCOME`）字节不变、其 API-error
+  后缀检测原样保留。settings/denylist 块逐字迁入宿主在启动前写入每 run 全新
+  `QWEN_HOME` 的 settings 文件。
+- 既有 workspace 卫生保留（属主恢复、stale-agent-state 净化、git metadata 重建）；
+  base checkout 增加 `persist-credentials: false`；job 末尾增加镜像 tmux 的属主
+  恢复步骤。drafts 以 artifact 上传并剥离非常规文件；剥离之前先杀尽残留的
+  agent 用户进程（僵尸除外——杀不掉的幸存者按 deny-by-default 丢弃整组
+  draft），关闭剥离与上传之间的重植竞态。gh/git 代理包装器目录对 agent 用户
+  可遍历（mktemp 的 700 会让包装器悄悄从它的 PATH 里消失），工具链步骤与
+  兄弟 lane 一样安装 `util-linux` 提供 `runuser`。
+
+## 关键设计决策
+
+| 决策                                                   | 理由                                                                                                      |
+| ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------- |
+| agent 读取用只读 `GITHUB_TOKEN`，不新增只读 PAT secret | job 作用域、临时、无需置备/轮换新 secret；它服务不了的两种读取搬宿主侧                                    |
+| draft + 独立 publisher job，不做写入代理 sidecar       | 与 `publish-tmux`/`publish-verify` 一致；凭据以 job 边界隔离，publisher 是确定性、可单测的脚本            |
+| CI 与本地共用一份 publisher 脚本                       | 防止两条写入路径漂移；本地 `/triage` 用用户自己的认证继续可用                                             |
+| 阶段评论在结束时批量发布                               | 流式转发 draft 的 sidecar 会把活写入通道重新引入 agent job。lifecycle 评论带实时 run 链接，已覆盖进度观察 |
+| maintainer 解析器移入 publisher                        | 它是确定性逻辑（owner map、canWrite、负载轮转），且需要 write 级 token；从来不是 agent 判断               |
+| 删除 `author_can_write`                                | 唯一消费方是 triage 路由；死开关是评审发现项，不是兼容资产                                                |
+| 第三份 inline model-proxy 副本                         | 抽取会动 tmux/verify lane 及其 pin；记为 follow-up                                                        |
+| publisher 在部分运行上也执行（`always()`）             | 超时前写下的 draft 仍能到达 PR；lifecycle 评论记录提前结束                                                |
+| 保留步骤名/id `triage` 及其 `summary` output           | `Check triage response` 的 env 字面量被 pin；保住它们就保住了失败检测契约，避免 pin 无谓改动              |
+
+## 契约保全
+
+- marker（`stage=N`、`qwen-triage-ci sha=…` 区域、`approve-on-green sha=…`、
+  lifecycle）字节不变；publisher 前缀校验后原样发布正文。
+- 所有写入仍落在 PAT 的 bot 身份下，`qwen-triage-finalize.yml` 的作者过滤、
+  CI 区域替换、延迟批准原样工作。
+- `Finalize triage status comment` 留在 triage job（`always()`），消费 agent
+  前的评论 id 与 API 状态，不读 workspace 文件。`Notify silent triage re-run`
+  **移入** `publish-triage`、在发布步骤之后：它检查的是本次运行发出的 review，
+  而这些现在在发布时才落地，留在 agent job 会永远看到「无 review」。步骤正文
+  不变，仅编号来源改为 `needs.triage.outputs.pr_number`。
+- duplicate guard、reopen guard、review 去重语义不变；变的只是读取背后的凭据。
+
+## 受影响文件
+
+- `.github/workflows/qwen-triage.yml` —— triage job（路由、permissions、容器、
+  启动、drafts 上传）、authorize（删 `author_can_write`）、新 `publish-triage` job。
+- `.github/scripts/triage-publish.mjs` —— 新 publisher（校验 + 执行 + maintainer
+  解析器）。
+- `.qwen/skills/triage/SKILL.md`、`references/pr-workflow.md`、
+  `references/issue-workflow.md` —— draft 协议、发布模式、搬走的解析器与
+  CHANGELOG 抓取、更新的 Rules 表述。
+- `.github/scripts/qwen-triage-workflow.test.mjs`（node:test，由 `ci.yml`
+  `lint_and_static` 的 HELPER_TESTS 步骤执行）—— 701-756 行的路由 pin 钉的是
+  旧信任模型（`author_can_write`、`issues` 分支），重写为钉新契约：ECS 路由 +
+  hosted kill-switch 降级、无 `author_can_write`、job 级只读 permissions、
+  agent 环境无 write PAT、容器存在、宿主写入的 settings 文件中的
+  settings/denylist 内容。卫生 pin（stale-state 净化、属主恢复）保留步骤名契约。
+- `scripts/tests/qwen-triage-workflow.test.js`（vitest）—— 设计保留之处的步骤
+  名/env 字面量 pin 存活（status claim/finalize、`Check triage response`、
+  `QWEN_HOME` 路径）；`QWEN_HOME` env 字面量 pin 移入 `env -i` 列表；新增
+  publish job 与 drafts artifact 剥离的断言。verify lane 的 runuser 计数 pin
+  不受影响（本改动不在该区间加步骤）。
+- `scripts/tests/qwen-runner-checkout-workflow.test.js` —— 预期无需改动：
+  `Recreate runner Git metadata` 仍紧邻 checkout 之前。
+- `scripts/tests/triage-publish.test.js` —— publisher 新单测（校验 fail-closed
+  用例、去重、幂等、解析器、逐动作失败报告），对 stub 的 `gh` 运行。
+- `.github/workflows/.size-baseline` —— 本 PR 内 bump `qwen-triage.yml` 条目
+  （见「约束与风险」）。
+- `.github/workflows/.ci-budget` —— 为新 publish job bump `qwen-triage.yml`
+  条目（7→8 jobs、声明 timeout 280→290 分钟）；否则姊妹棘轮会中止
+  `Lint & Static`。
+- 本设计文档对。
+
+## 约束与风险
+
+- **合入前无法真实触发。** `issue_comment` 与 `pull_request_target` workflow
+  从默认分支取 YAML；新路径只能在合入后真实演练。合入前的信心来自 pin/replay
+  套件、publisher 单测，以及本地 draft→publish 端到端 dry run。
+- **批量阶段评论**是可见的 UX 变化：结果在运行结束时落地，而非逐阶段。lifecycle
+  评论保留实时日志链接。
+- **publisher 是新的单点故障。** 预检拒绝则什么都不发；job 大声失败，lifecycle
+  评论记录提前结束，重跑即恢复。逐动作执行失败单独报告。
+- **skill/publisher 漂移。** publisher 的允许列表是权威；pin 测试把 marker 集与
+  draft 模式契约绑在两侧。
+- **改造后的残余风险。** 被提示注入的 agent 仍能在 triage 的预期能力内 draft
+  恶意内容（错误的 review、误导的评论）——这是产品固有表面，由人评审。它不再能
+  外泄写凭据、伪造词汇表之外的写入，或在宿主机上持久化。
+- **workflow 体积棘轮。** `qwen-triage.yml` 受
+  `.github/scripts/check-workflow-size.sh` 门禁（绝对上限 470,000 字节；超出
+  `.size-baseline` + 4,096 即 CI 红）。该文件已超 378,242 字节基线约 1.2 KB，
+  免更新余量仅约 2.9 KB；inline proxy 与 publish job 必然超出，须同 PR bump
+  基线条目。publisher 逻辑放在脚本而非 YAML 里，以控制增长。
+
+## 验证计划
+
+1. `scripts/tests` pin 套件更新并全绿，含新断言：triage `runs-on` 形状、job 级
+   只读 permissions、agent 环境无 write PAT、容器存在、publish job 形状、skill
+   与 publisher 的 marker 允许列表一致性。
+2. publisher 单测全绿，带变异见证（移除任一校验规则或 bot 身份过滤必须让测试
+   变红）。
+3. workflow YAML 用仓库的 `node yaml` 工具解析通过；执行内联 shell 的 replay
+   harness 通过。
+4. 本地端到端 dry run：在测试仓库（或确认可写的真实 PR）上跑 `/triage`，验证
+   draft→publish 产出与今天同形的评论/review。
+5. 合入后首批真实运行的观察清单：评论触发与自动 fork-PR triage 落在 ECS；阶段
+   评论、lifecycle、rerun-summary，以及一轮延迟 approve-on-green 经 finalize
+   兑现；kill-switch 降级演练一次。
+
+命令（仓库根目录）：
+
+```bash
+PATH="$HOME/.local/bin:$PATH" npx vitest run \
+  --config ./scripts/tests/vitest.config.ts \
+  scripts/tests/qwen-triage-workflow.test.js \
+  scripts/tests/qwen-runner-checkout-workflow.test.js \
+  scripts/tests/workflow-size.test.js
+node --test .github/scripts/qwen-triage-workflow.test.mjs
+```
+
+vitest 套件在 `PATH` 缺 `jq` 时会静默跳过 jq 门控用例；`.mjs` 套件是 node:test
+（不是 vitest），需要已安装 `yaml` 包。体积门禁在 CI 的 `lint_and_static` job
+执行，并由 `scripts/tests/workflow-size.test.js` 镜像。
+
+## 验收标准
+
+- 池启用时所有 triage 触发跑在 ECS；`MAINTAINER_ECS_RUNNER_DISABLED=true` 时
+  全部降级 hosted 且仍可用。
+- agent 环境不含写凭据与真实模型 key（`env -i` 列表的结构性性质，由测试 pin）。
+- publisher 执行完整动作词汇表；finalize 互操作不变；本地 `/triage` 经同一
+  publisher 可用。
+- 全部更新后的 pin 套件与新单测通过；YAML 校验通过。
+- 合入后观察清单完成且无契约漂移。
+
+## 开放问题
+
+- 是否在 follow-up 中把三份 inline model-proxy 副本抽取为共享脚本（会动
+  tmux/verify 的 pin）。
+- 批量评论的 UX 是否需要在 lifecycle 评论之外加轻量进度信号（暂不提议动作）。
+
+## 观察（既有问题，范围外）
+
+- `Notify silent triage re-run` 步骤假设 defer 会留下 `COMMENTED` review，但
+  skill 的 defer 路径只发 issue comment 加 assignee，从不提交 `COMMENT` review。
+  该步骤的 `deferred` 分支今天看起来不可达。
+- `SKILL.md` 禁止触碰 `welcome-pr` process label，而
+  `references/issue-workflow.md` 曾指示给无复现 bug 加它。评审期间已解决：
+  publisher 现在在唯一写入收口处拒绝所有 process label，issue-workflow 的
+  指令也已与该规则对齐。

scripts/tests/issue-triage-ownership-workflow.test.js

@@ -48,8 +48,10 @@ describe('issue triage workflow ownership', () => {
 
   it('keeps edited issues under full triage for need-information cleanup', () => {
     expect(issueEventOwners('edited')).toEqual(['qwen-triage.yml']);
+    // Writes are drafts now: the cleanup is a labels action the publisher
+    // executes, not a direct gh issue edit.
     expect(issueWorkflow).toContain(
-      'gh issue edit "$ISSUE_NUMBER" --repo "$REPO" --remove-label "status/need-information"',
+      'jq -cn \'{action:"labels",add:[],remove:["status/need-information"]}\'',
     );
   });
 

scripts/tests/qwen-triage-workflow.test.js

@@ -40,6 +40,10 @@ const prSkill = readFileSync(
   'utf8',
 );
 const triageSkillDoc = readFileSync('.qwen/skills/triage/SKILL.md', 'utf8');
+const triagePublisher = readFileSync(
+  '.github/scripts/triage-publish.mjs',
+  'utf8',
+);
 import {
   ATTRIBUTIONS,
   VERDICTS,
@@ -348,17 +352,25 @@ describe('qwen-triage tmux workflow', () => {
     expect(cleanStep).toContain('mkdir -p "$QWEN_HOME"');
     expect(cleanStep).toContain('rm -f /tmp/stage-*.md');
     expect(cleanStep).toContain('echo "stale agent state cleaned"');
-    expect(runStep).toContain("QWEN_HOME: '${{ runner.temp }}/qwen-home'");
+    // The direct launch carries QWEN_HOME in its env -i list; it must stay
+    // the same per-run path the clean step resets.
+    expect(runStep).toContain('"QWEN_HOME=${RUNNER_TEMP:?}/qwen-home"');
   });
 
-  it('pins the action reinstall to the version the job already runs', () => {
+  it('pins the CLI install the direct launch runs', () => {
     expect(workflow).toContain("id: 'ensure_qwen'");
     expect(workflow).toContain(
       'echo "version=$(qwen --version)" >> "${GITHUB_OUTPUT}"',
     );
-    expect(workflow).toContain(
+    // Install from RUNNER_TEMP with an explicit registry: the persistent
-      "qwen_cli_version: '${{ steps.ensure_qwen.outputs.version }}'",
+    // workspace may hold a previous run's tree whose .npmrc npm would read.
-    );
+    const ensureStep = step('Ensure qwen CLI');
+    expect(ensureStep).toContain('cd "${RUNNER_TEMP:?}"');
+    expect(ensureStep).toContain('--registry=https://registry.npmjs.org');
+    // The action's reinstall pin is gone with the action; the launch must
+    // use the installed CLI, not reinstall one.
+    expect(workflow).not.toContain('qwen_cli_version');
+    expect(step('Run Qwen Triage')).toContain('command -v qwen');
   });
 
   it('passes triage output through env before bash reads it', () => {
@@ -1107,7 +1119,9 @@ describe('qwen-triage tmux workflow', () => {
     expect(section).toContain('select(.user.login == $bot)');
     expect(section).toContain('startswith($m)');
     expect(section).not.toContain('contains($m)');
-    expect(section).toContain('re-resolve immediately before EACH patch');
+    // Writes are drafts now: the publisher resolves the id at publish time,
+    // so the agent never patches by a remembered id.
+    expect(section).toContain('PUBLISH TIME');
   });
 
   it('keeps the sandboxed-lane recommendation out of the local-only section', () => {
@@ -1161,7 +1175,7 @@ describe('qwen-triage tmux workflow', () => {
     // The assembly order is the other half: a section nothing assembles is
     // as dead as one nobody reads.
     const order = prSkill.slice(
-      prSkill.indexOf('Post a single Stage 2 comment'),
+      prSkill.indexOf('Draft a single Stage 2 comment'),
       prSkill.indexOf('### Stage 3'),
     );
     expect(order).toContain('(2b-bis)');
@@ -1239,16 +1253,21 @@ describe('qwen-triage tmux workflow', () => {
     expect(section).toContain('--paginate');
     expect(section).toContain('DISMISSED');
 
-    // The terminal-gate probe shares the same failure mode: an unpaginated
+    // The terminal-gate dedup shares the same failure mode: an unpaginated
     // read sees only the first 30 reviews, and re-runs land on exactly the
     // heavily-reviewed PRs where the gating review sits on a later page.
+    // Writes are drafts now, so the dedup lives in the publisher — the skill
+    // must delegate to it, and the publisher must keep the paginated,
+    // bot-scoped check.
     const terminalGate = prSkill.slice(
       prSkill.indexOf('Never create duplicates'),
       prSkill.indexOf('**Signature & footer:**'),
     );
-    expect(terminalGate).toContain('--paginate');
+    expect(terminalGate).toContain("publisher's");
-    expect(terminalGate).toContain('.state == "CHANGES_REQUESTED"');
+    expect(terminalGate).toContain('CHANGES_REQUESTED');
-    expect(terminalGate).not.toContain("--jq '[.[] | select");
+    expect(triagePublisher).toContain('--paginate');
+    expect(triagePublisher).toContain('CHANGES_REQUESTED');
+    expect(triagePublisher).toMatch(/user.*login|login.*user/);
   });
 
   it.skipIf(spawnSync('jq', ['--version']).status !== 0)(