chore: bump fullsend fleet to v0.43.0, add parasol repos, document auto-trigger config

.claude/skills/fullsend/SKILL.md

@@ -16,6 +16,8 @@ description: |
   a new Claude/Anthropic/Grok model, or check model enablement status.
   Also use when asked about local fullsend setup, RHDH GCP project config,
   or the custom sandbox image.
+  Also use when asked to audit the fleet, check which repos have fullsend
+  installed, compare managed vs. unmanaged repos, or run fleet-status.
 ---
 
 # /fullsend (RHDH)
@@ -95,6 +97,7 @@ To add a variable, create an env file and wire it via `host_files` in the harnes
 | `debug <#issue> [--repo]` | Run sandbox diagnostics (shortcut for `trigger debug`) |
 | `comment <#issue> <message> [--repo]` | Post a comment on an issue or PR |
 | `label <#issue> <add\|remove> <label> [--repo]` | Add or remove a label on an issue or PR |
+| `fleet-status` | Audit installed vs. managed repos across both orgs |
 | `onboard <org>/<repo>` | Add a new repo to the fullsend fleet (WIF, variables, secrets, scaffold) |
 | `upgrade [version]` | Upgrade CLI, bump `repos.yaml`, and converge target repos via PRs |
 | `custom-agents` | Guide for building custom standalone agents (scaffold, dispatch, security) |
@@ -118,6 +121,7 @@ Parse the first word after `/fullsend` as the subcommand.
 | `comment` | `references/comment.md` |
 | `label` | `references/label.md` |
 | `enable-model` | `references/enable-model.md` |
+| `fleet-status` | `references/fleet-status.md` |
 | `onboard` | `references/onboard.md` |
 | `upgrade` | `references/upgrade.md` |
 | `custom-agents` | `references/custom-agents.md` |
@@ -200,6 +204,27 @@ When a fullsend agent creates a new plugin package (e.g., `boost-common`), CI ty
 
 Running `yarn chores` from the workspace root does all of these in one pass.
 
+### Auto-trigger configuration
+
+All auto-triggers are **disabled fleet-wide**. The shim only listens to
+`issue_comment` (for `/fs-*` commands) and `pull_request_target: [labeled, unlabeled]`
+(for intentional label-based triggers like `fullsend` → code, `priority/*` → prioritize).
+
+| Agent | Auto-trigger | Manual trigger |
+|-------|-------------|----------------|
+| triage | Disabled (was: issue opened/edited) | `/fs-triage` |
+| review | Disabled (was: PR opened/synced) | `/fs-review` |
+| fix | Disabled (was: review changes_requested) | `/fs-fix <instruction>` |
+| retro | Disabled (was: PR closed) | `/fs-retro` |
+| code | Label `fullsend` on issue | `/fs-code` |
+| prioritize | Label `priority/*` on issue | `/fs-prioritize` |
+
+To re-enable an auto-trigger, add the corresponding event back to the shim.
+See `/fullsend upgrade` step 6a for the full event-to-agent mapping.
+
+**This is a shim edit — `fullsend repos install` will overwrite it.** See
+`/fullsend upgrade` step 6a for the re-apply procedure.
+
 ### Downloading agent logs
 
 ```bash

.claude/skills/fullsend/references/fleet-status.md

@@ -0,0 +1,72 @@
+# fleet-status
+
+Audit all repos with fullsend installed across `redhat-developer` and
+`rhdh-parasol` orgs. Compare against the managed fleet in `repos.yaml`.
+
+## Usage
+
+```
+/fullsend fleet-status
+```
+
+## Concepts
+
+| Term | Meaning |
+|------|---------|
+| **Managed** | Listed in `repos.yaml` — version-pinned, converged via `fullsend repos install`, scaffold PRs on upgrade |
+| **Installed** | Has `.fullsend/config.yaml` — was set up via `fullsend admin install` or manual config, may or may not be actively used |
+| **Unmanaged** | Installed but not in `repos.yaml` — runs fullsend but is not version-converged by the fleet |
+
+`repos.yaml` is the source of truth for which repos we actively maintain.
+Unmanaged repos may still have working fullsend (WIF, secrets, workflows)
+but won't receive scaffold upgrades or shim customizations.
+
+## Procedure
+
+### 1. Scan both orgs for installed repos
+
+```bash
+ORGS="redhat-developer rhdh-parasol"
+for org in $ORGS; do
+  for repo in $(gh repo list "$org" --json name --jq '.[].name' --limit 300); do
+    if gh api "repos/$org/$repo/contents/.fullsend/config.yaml" --jq '.name' &>/dev/null; then
+      echo "$org/$repo"
+    fi
+  done
+done
+```
+
+### 2. Parse managed repos from manifest
+
+```bash
+grep '^\s*- name:' repos.yaml | sed 's/.*name:\s*//'
+```
+
+### 3. Report
+
+Show three columns:
+
+| Column | Meaning |
+|--------|---------|
+| Repo | `org/name` |
+| Managed | Yes if in `repos.yaml` |
+| Shim version | `reusable-dispatch.yml` SHA comment (e.g. `v0.43.0`) or `none` |
+
+Group by org. Highlight unmanaged repos — these are candidates for either
+adding to the manifest or removing fullsend from.
+
+### 4. Optional: check shim version on unmanaged repos
+
+For unmanaged repos that have a fullsend workflow, check what version
+they're running:
+
+```bash
+gh api "repos/$ORG/$REPO/contents/.github/workflows/fullsend.yaml" \
+  --jq '.content' | base64 -d | grep -o '# v[0-9.]*'
+```
+
+## When to run
+
+- Before and after a fleet-wide upgrade (`/fullsend upgrade`)
+- When onboarding a new repo (`/fullsend onboard`)
+- Periodically to catch repos that were installed outside the fleet workflow

.claude/skills/fullsend/references/upgrade.md

@@ -111,6 +111,43 @@ Close this issue if triage succeeds."
 
 Watch the run. If triage succeeds, close the issue.
 
+### 6a. Re-apply shim customizations
+
+`repos install` convergence currently only bumps `uses:` SHA pins in
+`.github/workflows/fullsend.yaml` — it does NOT regenerate the full shim
+from the template. This means shim customizations (event type edits,
+`if:` condition changes) survive `repos install`. However, template
+improvements (like the v0.43.0 `/fs-` comment filter) must be applied
+manually. A future fullsend version may change convergence behavior to
+do full template rewrites — do not rely on this.
+
+After the scaffold PR is created, check each repo for shim customizations
+that need re-applying. Current fleet customizations:
+
+| Repo | Customization | What to edit |
+|------|---------------|--------------|
+| All 9 managed repos | All auto-triggers disabled | Remove `issues` event, remove `closed` from `pull_request_target.types`, remove `pull_request_review` event. Keep only `issue_comment` and `pull_request_target: [labeled, unlabeled]` |
+| redhat-developer/rhdh-plugins | Above + workspace path filter | Additionally keep `paths:` (boost, scorecard, ai-integrations) on `pull_request_target` |
+
+To re-apply after a scaffold PR lands:
+
+```bash
+# In the scaffold PR branch, edit the shim:
+# pull_request_target.types: [closed, labeled, unlabeled]
+# (remove: opened, synchronize, ready_for_review)
+```
+
+Update the header comment to flag the customization:
+```yaml
+# Based on fullsend scaffold; customized to disable review auto-trigger.
+```
+
+**Why no config-based approach:** Built-in agents (triage, code, review, fix,
+retro, prioritize) use hardcoded stage routing in the dispatch script. CEL
+triggers only work for custom agents. The `roles:` list controls whether an
+agent can run at all — there is no per-role auto-trigger toggle. The only
+existing per-PR opt-out is `fullsend-no-fix` (label-based, hardcoded).
+
 ## Known gotchas
 
 1. **Public mint.** Manifest `mint_url` must stay `https://mint.fullsend.sh`.
@@ -123,3 +160,7 @@ Watch the run. If triage succeeds, close the issue.
 4. **Workflow files need `workflows` token scope.** The fs-code agent cannot
    push `.github/workflows/` — that is why upgrades go through `repos install` PRs.
 5. **Do not `--direct`.** All scaffold and manifest changes land as PRs.
+6. **Shim customizations need monitoring.** See step 6a — current convergence
+   only bumps SHA pins (customizations survive), but this may change. Keep a
+   checklist of per-repo edits and verify after each upgrade. Also manually
+   apply upstream template improvements (e.g. new `if:` guards).

README.md

@@ -12,6 +12,44 @@ skill for the RHDH team's agent infrastructure.
 | **Deployment docs** | GCP setup, repo onboarding, sandbox networking, known issues |
 | **`/fullsend` skill** | RHDH-specific Claude Code skill for validating configs, debugging sandboxes, and building custom agents |
 
+## Fleet status
+
+**Fullsend version:** v0.43.0 | **Mint:** `mint.fullsend.sh` (public) | **GCP project:** `rhdh-sidekick-167988` | **WIF pool:** `fullsend-inference`
+
+### Managed repos (`repos.yaml`)
+
+| Repo | Shim customizations |
+|------|---------------------|
+| `redhat-developer/rhdh-agentic` | All auto-triggers off |
+| `redhat-developer/rhdh-cli` | All auto-triggers off |
+| `redhat-developer/rhdh-plugins` | All auto-triggers off, workspace `paths:` filter (boost, scorecard, ai-integrations) |
+| `redhat-developer/rhdh-plugin-export-overlays` | All auto-triggers off |
+| `rhdh-parasol/rhdh` | All auto-triggers off |
+| `rhdh-parasol/rhdh-agentic` | All auto-triggers off |
+| `rhdh-parasol/rhdh-operator` | All auto-triggers off |
+| `rhdh-parasol/rhdh-plugins` | All auto-triggers off |
+| `rhdh-parasol/rhdh-plugin-export-overlays` | All auto-triggers off |
+
+### Agents
+
+All event-based auto-triggers are disabled. Agents run on-demand via `/fs-*` commands or label-based triggers only.
+
+| Agent | Auto-trigger | Manual trigger |
+|-------|-------------|----------------|
+| Triage | **Disabled** | `/fs-triage` |
+| Review | **Disabled** | `/fs-review` |
+| Fix | **Disabled** | `/fs-fix <instruction>` |
+| Retro | **Disabled** | `/fs-retro` |
+| Code | Label `fullsend` on issue | `/fs-code` |
+| Prioritize | Label `priority/*` on issue | `/fs-prioritize` |
+
+### Unmanaged repos
+
+~49 additional repos across `redhat-developer` and `rhdh-parasol` have
+`.fullsend/config.yaml` from `fullsend admin install` but are **not** in
+`repos.yaml`. They run fullsend independently and don't receive fleet
+upgrades. Run `/fullsend fleet-status` to see the full list.
+
 ## Getting started
 
 New to fullsend? Start here:
@@ -36,10 +74,11 @@ surfaces all of this repo's knowledge interactively. Available commands:
 |---------|-------------|
 | `/fullsend validate` | Diff customized harness/env files against upstream scaffold |
 | `/fullsend debug <#issue>` | Run sandbox diagnostics |
-| `/fullsend comment <#issue> <msg>` | Post a comment on an issue or PR |
-| `/fullsend label <#issue> <add\|remove> <label>` | Manage issue labels |
+| `/fullsend fleet-status` | Audit installed vs. managed repos across both orgs |
+| `/fullsend onboard <org>/<repo>` | Add a new repo to the fleet (WIF, secrets, scaffold) |
 | `/fullsend upgrade [version]` | Upgrade CLI, scaffold files, and dispatch workflows |
 | `/fullsend custom-agents` | Guide for building custom standalone agents |
+| `/fullsend enable-model` | Enable a model in GCP Model Garden |
 | `/fullsend local-setup` | Local agent run setup for Mac |
 
 ## Image

repos.yaml

@@ -16,9 +16,14 @@ defaults:
     - https://raw.githubusercontent.com/fullsend-ai/agents/
 github:
   mint_url: https://mint.fullsend.sh
-  fullsend_ref: v0.41.0
+  fullsend_ref: v0.43.0
   repos:
     - name: redhat-developer/rhdh-agentic
     - name: redhat-developer/rhdh-cli
     - name: redhat-developer/rhdh-plugins
     - name: redhat-developer/rhdh-plugin-export-overlays
+    - name: rhdh-parasol/rhdh
+    - name: rhdh-parasol/rhdh-agentic
+    - name: rhdh-parasol/rhdh-operator
+    - name: rhdh-parasol/rhdh-plugins
+    - name: rhdh-parasol/rhdh-plugin-export-overlays