[WIP] Fix repository drift report issues

.github/workflows/repository-reconciliation.yml

@@ -28,6 +28,9 @@ jobs:
             const now = Date.now();
             const staleAfterMs = 14 * 24 * 60 * 60 * 1000;
             const closingPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+#(\d+)/gi;
+            const isDependencyAutomationPR = pr =>
+              pr.user?.login === "dependabot[bot]" &&
+              /^build\(deps(?:-[^)]+)?\):/i.test(pr.title || "");
 
             const pulls = await github.paginate(github.rest.pulls.list, {
               owner, repo, state: "open", per_page: 100
@@ -73,7 +76,10 @@ jobs:
               // Restrict to validated issue references only.
               const validUnique = [...new Set(issues)].filter(n => validIssues.has(n));
               // Drafts mirror the governance workflow's deferred-enforcement rule and are excluded.
-              if (validUnique.length !== 1 && !pr.draft) untracked.push(pr);
+              // Dependabot dependency bumps are automation-managed and excluded from this drift gate.
+              if (validUnique.length !== 1 && !pr.draft && !isDependencyAutomationPR(pr)) {
+                untracked.push(pr);
+              }
               for (const issue of validUnique) {
                 const existing = issueToPulls.get(issue) || [];
                 existing.push(pr.number);

tests/unit/test_repository_reconciliation_workflow.py

@@ -102,3 +102,10 @@ def test_reconciliation_workflow_report_is_idempotent() -> None:
     # Should update the existing issue if found, otherwise create a new one.
     assert "issues.update" in script
     assert "issues.create" in script
+
+
+def test_reconciliation_workflow_excludes_dependabot_from_untracked() -> None:
+    """Dependabot dependency PRs should not be counted as canonical-issue drift."""
+    script = _get_script(_load_workflow())
+    assert "dependabot[bot]" in script
+    assert "isDependencyAutomationPR" in script