[cgwalters-bot]

Bot pull requests on branches inside cgwalters-forge repositories (agentic-job#144, agentic-job#2107) log not a pull request from the bot's fork, left to its author, and cgwalters-forge/bootc and cgwalters-forge/composefs-rs aren't followed, so their staged work sits idle.

This sets pr.headOwners to ["cgwalters-bot", "cgwalters-forge"] and adds those two forks to follow. It affects only the bot's own pull requests, and per docs/pass.md only the operator's review counts for merge on those heads; the review job's approval still counts only from the bot's fork. fix.toml and config.test.cjs don't change: midstream-fix.toml already admits both forks and bot/**, and the test that a followed repository is in a fix bounds file passes as is.

bootc-dev/bootc and composefs/composefs-rs are deliberately left out. That scope stays in #1050, which this does not change; that pull request will need a rebase on this one.

just test-config: 20 of 20 pass, with agentic-job on PATH so the policy tests ran too.

Known edge: a head shared with an upstream pull request

cgwalters-forge/bootc#55's branch bot/pin-ubi9-podman is also the head of upstream bootc-dev/bootc#2606, so a fix or rebase round there would change the upstream pull request. It is the only open fork pull request sharing a head with an open upstream one. The pass has no per-repository or per-branch exclusion; its one per-pull-request hold is the needs-human label (decide skips a labelled pull request before anything else), so #55 now carries that label. It stays until a person takes it off.

Separately, cgwalters-forge/composefs-rs#30's base is bot/capi-ostree-revdep, the head of upstream composefs/composefs-rs#408. A round on #30 pushes only its own head, and the pass merges only into the default branch, so only a person merging #30 by hand would move the upstream one.

What the first passes do

From a preview of this config (no --apply, 447 requests, an agent-board build slightly behind the pin):

• All 8 of --max-dispatch go to fix rounds for a few passes, so new issue plans wait behind them: agentic-job#144, agentic-job#2107, and lib: Route status output through the progress API, deny (e)println! bootc#1, bootc: Add finalize-staged hold unit to fix /boot automount reboot hang (plan-44 flake) #2, composefs-rs: Refine roadmap and draft next milestones #5, bootc composefs: multiple ESPs and XBOOTLDR support #10, bootc composefs: implement bootc edit #11, rhel-bootc-examples: sealed-host CI fails on every fork PR #16. About 15 more fork fix or continuation rounds are queued behind those.
• 13 fork drafts get needs-human: a draft with no checkpoint: bootc#9, composefs-rs: upgrade test from a pinned release cfsctl (#324) #13, bootupd CI: composefs e2e boot broken by bootc composefs.digest= karg vs 1.16 initramfs #34, ostree ci-bootc: intermittent exit 139 (segfault) at start of podman build RUN steps #39, bcvk CI: retry quay.io pulls in pull-test-images and prefetch fedora-coreos:stable #44, bcvk: serialize to_base_disk tests; keep virtiofsd log + guest dmesg on to-disk failure #45, Recurring: surface reactions (esp. -1) on cgwalters-bot comments and PRs #48, clearly link https://github.com/users/cgwalters-bot/projects/1 from our profile README.md #49, Devspace agent runs step 4: real inference (praxis broker or Anthropic OIDC) behind a local spend-capped proxy #63 and composefs-rs#13, composefs-rs: design a stable varlink API v1 #14, infra: staged-images manifest must not publish when an arch build fails #40, bcvk: serialize to_base_disk tests; keep virtiofsd log + guest dmesg on to-disk failure #45.
• Ready fork pull requests wait with no approving review of the head yet, which only the operator moves. tracker#968 also moves to that wait with no action taken, and cgwalters-forge.github.io#1 is skipped because auto-merge is on.

Rounds that will fail at apply

• agentic-job has no .github/agentic-job/accept-owner-branches, and apply pushes to a head outside the bot's fork only where the head repository's default branch has that file. So the fix rounds for agentic-job#144 and #2107 are expected to fail at apply and stop at needs-human. The same goes for any future in-repository head in tracker, actions or agent-board, which lack the file too; both forks have it. Adding it is the operator's call, because it lets an agent's commits run with that repository's workflow secrets, and this pull request doesn't change it.
• agentic-job#2107's head per-forge-bounds-sections is outside fix.toml's branch globs as well. poll.yml doesn't pass --fix-bounds, so the pass still starts the round rather than skipping it.
• [rescue] bootc: pre-merge backup of the composefs core series (#2248) bootc#50, bcvk: nextest: serialize the test_to_base_disk_* tests #51 and bootc: Propagate a refused reboot as an error (prep for bootc#1047) #52 (rescue/* heads on base forge) are outside both the branches and the bases of midstream-fix.toml, so their conflict fixes will be refused.

Generated-by: https://github.com/cgwalters/#llms

[github-actions]

VERDICT: APPROVE: widens the pass to the forge's in-repository bot heads; merges there still need the operator's approval at the head

Reviewed head: 8ebcb73 (merge-base 447ba9a with main). The diff only changes .github/pass.json: it adds cgwalters-forge/bootc and cgwalters-forge/composefs-rs to follow, and adds pr.headOwners: ["cgwalters-bot", "cgwalters-forge"].

Worst case and what limits it. The pass runs agent-board 7c4339d with CGWALTERS_BOT_PAT. With this change, is_harness (agent-board crates/board-forge/src/poll.rs:2100) treats every bot-authored pull request with its head in any cgwalters-forge repository as the bot's own. That covers in-repository branches of tracker, agentic-job, agent-board and actions, not only the two midstream forks. At worst the pass starts fix or rebase rounds on those heads and merges them. Four things bound this:

• Merge: the review job's approval still counts only through from_fork (poll.rs:1507-1509). A headOwners head merges only on the operator's APPROVED review at the current head, so a branch's own workflows cannot approve it.
• Author: only pull requests authored by cgwalters-bot qualify (poll.rs:2102). Third-party pull requests in the newly followed forks are still skipped. dependabot[bot] pull requests there also need the operator's review, because job_counts needs from_fork.
• Push targets: pushes still go through dispatch and apply. Apply pushes outside the bot's fork only where the head repository's default branch has accept-owner-branches. The pass makes no direct branch updates; I found no update-branch call.
• Midstream forks: fixes there use midstream-fix.toml, which has no [unprotected_files], so .github and AGENTS.md stay refused even though both forks accept pushes.

The pull request's description matches the pinned code (docs/pass.md:725, pass.md:2398). It touches no CODEOWNERS file and no merge policy file.

Follow-ups

1. important: .github/pass.json:66: headOwners is global, not per repository. Naming cgwalters-forge also takes in bot heads inside tracker, agentic-job, agent-board and actions. None of those has accept-owner-branches, so every fix or rebase round there is a full agent run whose push is certain to be refused. The same goes for agentic-job#2107, whose head per-forge-bounds-sections is outside fix.toml's globs and is not pre-filtered because poll.yml passes no --fix-bounds, and for bootc#50/#51/#52 (rescue/* heads on base forge). By the description's own preview, these rounds hold --max-dispatch 8 slots for several passes and spend budget before stopping at needs-human. Either pass --fix-bounds in .github/workflows/poll.yml so out-of-bounds heads are skipped before dispatch, or label these pull requests needs-human up front as was done for bootc#55.
2. important: .github/pass.json:15-16, with :66: the only guard against a fork round rewriting a head that an open upstream pull request shares is the manual needs-human label. I confirmed it is on cgwalters-forge/bootc#55. Nothing stops a future staged pull request from sharing a head with a new upstream one, and once that label is off, a fix round there changes the upstream pull request (still bounded by midstream-fix.toml). Add a pass-side check or a documented rule that a promoted branch is never also a fork pull request's head.
3. nit: .github/agentic-job/config.test.cjs:205-228: no test ties headOwners to its precondition. A test should check that every followed repository whose owner is in headOwners is either in a fix bounds file or listed as having accept-owner-branches (or known not to have it), so the next repository added under cgwalters-forge does not silently start rounds that are certain to fail.

Generated by review for #1075 at 8ebcb73