feat(safe-outputs): split Azure DevOps PR tools with safe migration

.github/workflows/ado-script.yml

@@ -50,6 +50,22 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  executor-harness-windows:
+    name: Executor harness (Windows)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: scripts/ado-script/package-lock.json
+      - name: Install workspace dependencies
+        working-directory: scripts/ado-script
+        run: npm ci
+      - name: Exercise cross-platform process fixtures
+        working-directory: scripts/ado-script
+        run: npm test -- runner.test.ts execute-cli.test.ts ado-rest.test.ts
   ado-script:
     name: Build, Test & Drift-Check
     runs-on: ubuntu-latest

.github/workflows/pr-data-prefetch.yml

@@ -55,25 +55,53 @@ jobs:
           set -euo pipefail
           mkdir -p /tmp/gh-aw/agent
 
+          gh pr view "$PR_NUMBER" \
+            --repo "$TARGET_REPOSITORY" \
+            --json number,title,body,headRefName,headRefOid,baseRefOid,additions,deletions,changedFiles,files \
+            > /tmp/gh-aw/agent/pr-meta.json
+          HEAD_SHA=$(jq -er '.headRefOid' /tmp/gh-aw/agent/pr-meta.json)
+          BASE_SHA=$(jq -er '.baseRefOid' /tmp/gh-aw/agent/pr-meta.json)
+          if [ "$HEAD_SHA" != "$PR_HEAD_SHA" ]; then
+            echo "::error::PR head changed before prefetch; refusing to cache mismatched data."
+            exit 1
+          fi
+
           # Exclusions must stay in sync with
           # .github/workflows/shared/pr-diff-data-fetch.md — these are all
           # generated artefacts, and line-commenting on them is pure noise.
-          gh pr diff "$PR_NUMBER" --repo "$TARGET_REPOSITORY" \
+          if ! gh pr diff "$PR_NUMBER" --repo "$TARGET_REPOSITORY" \
               --exclude '**/*.lock.yml' \
               --exclude 'scripts/ado-script/*.js' \
               --exclude 'scripts/ado-script/test-bin/**' \
               --exclude '**/*.gen.ts' \
               --exclude '**/*.gen.json' \
               --exclude '**/dist/**' \
               --exclude 'Cargo.lock' \
+              > /tmp/gh-aw/agent/pr-diff.patch 2>/tmp/gh-aw/agent/pr-diff-error.txt; then
+            if ! grep -q 'diff exceeded the maximum number of lines' /tmp/gh-aw/agent/pr-diff-error.txt; then
+              cat /tmp/gh-aw/agent/pr-diff-error.txt >&2
+              exit 1
+            fi
+            [[ "$HEAD_SHA" =~ ^[a-fA-F0-9]{40}$ && "$BASE_SHA" =~ ^[a-fA-F0-9]{40}$ ]]
+            echo "::warning::PR exceeds GitHub's diff API limit; generating the full filtered diff from pinned Git objects."
+            OBJECTS=$(mktemp -d)
+            trap 'rm -rf -- "$OBJECTS"' EXIT
+            git init --bare --quiet "$OBJECTS"
+            AUTH=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)
+            GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0="http.${GITHUB_SERVER_URL}/.extraheader" \
+              GIT_CONFIG_VALUE_0="Authorization: Basic $AUTH" \
+              git --git-dir="$OBJECTS" -c credential.helper= -c http.followRedirects=false \
+              fetch --quiet --no-tags "${GITHUB_SERVER_URL}/${TARGET_REPOSITORY}.git" "$BASE_SHA" "$HEAD_SHA"
+            unset AUTH
+            git --git-dir="$OBJECTS" -c core.quotePath=false diff --no-ext-diff --no-textconv "$BASE_SHA...$HEAD_SHA" -- \
+              . ':(glob,exclude)**/*.lock.yml' ':(glob,exclude)scripts/ado-script/*.js' \
+              ':(glob,exclude)scripts/ado-script/test-bin/**' ':(glob,exclude)**/*.gen.ts' \
+              ':(glob,exclude)**/*.gen.json' ':(glob,exclude)**/dist/**' ':(exclude)Cargo.lock' \
               > /tmp/gh-aw/agent/pr-diff.patch
+          fi
+          rm -f /tmp/gh-aw/agent/pr-diff-error.txt
           LINES=$(wc -l < /tmp/gh-aw/agent/pr-diff.patch)
 
-          gh pr view "$PR_NUMBER" \
-            --repo "$TARGET_REPOSITORY" \
-            --json number,title,body,headRefName,headRefOid,additions,deletions,changedFiles,files \
-            > /tmp/gh-aw/agent/pr-meta.json
-
           gh api "repos/$TARGET_REPOSITORY/pulls/$PR_NUMBER/comments" \
             --paginate \
             --jq '.[] | {id, path, line: (.line // .original_line), body: .body[:200], user: .user.login}' \

.github/workflows/pr-sous-chef.md

@@ -269,7 +269,9 @@ a manual invocation is an acknowledgement, not a licence to clean up reviews.
    - the rest by most recent `updatedAt`.
    Break ties by lower PR number, so reruns behave deterministically.
 6. Use the `pr-processor` sub-agent for each PR, passing only the PR number and
-   its compact entry.
+   its compact entry. Do not specify a model or model alias when launching the
+   sub-agent. Omit the model parameter so it inherits the parent/runtime model
+   selection.
 7. If `pr-processor` returns non-JSON or errors, record
    `{pr_number: N, skip_reason: "sub_agent_error"}` in the report and move on.
    Do not retry.
@@ -368,7 +370,6 @@ recommendations visible; wrap verbose detail in
 ## agent: `pr-processor`
 ---
 description: Decides skip/nudge actions for a single pull request using a minimal number of API calls
-model: small
 ---
 You are given one PR number and its compact metadata. Decide what should happen
 to it, using as few tool calls as possible.