Fix/followup creator app token

.github/agents/registry.yml

@@ -21,7 +21,7 @@ model_profile_trial_contract:
   artifact_schema: workflows.model-profile-trial-result/v2
   identity_authority: workflows-read-only-trial-artifact/v2
   collector_identity_authority: github-actions-api/workflows-read-only-trial-artifact/v2
-  runner_ref: stranske/Workflows/.github/workflows/reusable-model-profile-trial.yml@822e323eefba3edb640e0bd9c922caec6fffee65
+  runner_ref: iamkayleb/Workflows/.github/workflows/reusable-model-profile-trial.yml@e85edadb246e41d172a0c79fad147752d1df9ea9
   cli_version: 0.144.1
   runtime_fallback_allowed: false
   auxiliary_evaluator_allowed: false
@@ -52,7 +52,7 @@ execution_profiles:
     model: gpt-5.6-sol
     fallback_model: gpt-5.5
     runner: reusable-model-profile-trial
-    runner_ref: stranske/Workflows/.github/workflows/reusable-model-profile-trial.yml@822e323eefba3edb640e0bd9c922caec6fffee65
+    runner_ref: iamkayleb/Workflows/.github/workflows/reusable-model-profile-trial.yml@e85edadb246e41d172a0c79fad147752d1df9ea9
     capacity_pool: codex-standard
     safety: read-only
     lifecycle: trial
@@ -63,7 +63,7 @@ execution_profiles:
     model: gpt-5.6-terra
     fallback_model: gpt-5.5
     runner: reusable-model-profile-trial
-    runner_ref: stranske/Workflows/.github/workflows/reusable-model-profile-trial.yml@822e323eefba3edb640e0bd9c922caec6fffee65
+    runner_ref: iamkayleb/Workflows/.github/workflows/reusable-model-profile-trial.yml@e85edadb246e41d172a0c79fad147752d1df9ea9
     capacity_pool: codex-standard
     safety: read-only
     lifecycle: trial
@@ -74,7 +74,7 @@ execution_profiles:
     model: gpt-5.6-luna
     fallback_model: gpt-5.5
     runner: reusable-model-profile-trial
-    runner_ref: stranske/Workflows/.github/workflows/reusable-model-profile-trial.yml@822e323eefba3edb640e0bd9c922caec6fffee65
+    runner_ref: iamkayleb/Workflows/.github/workflows/reusable-model-profile-trial.yml@e85edadb246e41d172a0c79fad147752d1df9ea9
     capacity_pool: codex-standard
     safety: read-only
     lifecycle: trial
@@ -137,7 +137,7 @@ agents:
     branch_prefix: cursor/issue-
     capacity:
       window: daily
-      limit: 1  # TODO: confirm owner-supplied public plan limit
+      limit: 10  # SET THIS to your actual Cursor plan quota
     ui_mentions_allowed: false
     # Reuses stranske-automation-bot for branch pushes/attribution until a
     # dedicated stranske-cursor-bot service account is provisioned.
@@ -152,7 +152,7 @@ agents:
     capabilities:
       pr_keepalive: true
       pr_autofix: true          # wired into agents-autofix-loop.yml (autofix-cursor job)
-      belt: false              # belt routing deferred to a later phase
+      belt: true               # dispatched by agents-81 run-cursor
       verifier_checkbox: false  # verification stays on the existing judge (config/llm_slots.json)
 
   gemini:

.github/sync-manifest.yml

@@ -35,6 +35,7 @@ workflows:
     sync_mode: create_only  # Don't overwrite existing consumer Gate files; fresh repos can still receive this file, so follow #2158 before first seeding.
     overwrite_repos:
       - stranske/Template
+      - iamkayleb/bukay
     skip_repos:
       - repo: stranske/Manager-Database
         reason: "Maintains a fully custom Gate workflow; never overwrite (replaces the hard-coded custom_gate_repos list in maint-68)."
@@ -73,6 +74,9 @@ workflows:
   - source: .github/workflows/agents-72-codex-belt-worker.yml
     description: "Codex belt worker - executes agent on issues with full prompt and context"
 
+  - source: .github/workflows/health-codex-auth-check.yml
+    description: "Twice-daily CODEX_AUTH_JSON expiry check - opens an auth-expiring issue before the token lapses"
+
   - source: .github/workflows/agents-72-codex-belt-worker-dispatch.yml
     description: "Codex belt worker dispatch wrapper - allows workflow_dispatch for the worker"
 

.github/workflows/agents-71-codex-belt-dispatcher.yml

@@ -20,6 +20,13 @@ on:
         required: false
         default: false
         type: boolean
+      base_branch:
+        description: >-
+          Optional base branch for the agent branch. Overrides the issue's
+          `<!-- base-branch: X -->` marker and the repository default.
+        required: false
+        default: ''
+        type: string
       orchestrator_skill_pack:
         description: >-
           Optional reference-pack name override for exported Orchestrator skill context on
@@ -76,6 +83,13 @@ on:
         required: false
         default: false
         type: boolean
+      base_branch:
+        description: >-
+          Optional base branch for the agent branch. Overrides the issue's
+          `<!-- base-branch: X -->` marker and the repository default.
+        required: false
+        default: ''
+        type: string
       orchestrator_skill_pack:
         description: >-
           Optional reference-pack name override for exported Orchestrator skill context on
@@ -292,12 +306,42 @@ jobs:
             ]);
 
             const { data: repoInfo } = await withRetry((client) => client.rest.repos.get({ owner, repo }));
-            const base = repoInfo.default_branch;
-            if (!base) {
+            const defaultBranch = repoInfo.default_branch;
+            if (!defaultBranch) {
               core.setFailed('Repository default branch not available');
               return;
             }
 
+            // Base resolution mirrors reusable-agents-issue-bridge.yml: an
+            // explicit input wins, then the issue's `<!-- base-branch: X -->`
+            // marker, then the repository default. Without the marker every
+            // agent branch is cut from the default branch, which silently
+            // defeats any per-lane workflow (evaluation lanes, release trains,
+            // long-lived feature bases).
+            let base = String(process.env.INPUT_BASE_BRANCH || '').trim();
+            let baseSource = base ? 'input' : '';
+            if (!base) {
+              try {
+                const { data: issueData } = await withRetry((client) =>
+                  client.rest.issues.get({ owner, repo, issue_number: issueNumber }));
+                const marker = String(issueData.body || '')
+                  .match(/<!--\s*base-branch:\s*([^\s>]+)\s*-->/);
+                if (marker) { base = marker[1].trim(); baseSource = 'issue-marker'; }
+              } catch (error) {
+                core.warning(`Could not read issue body for a base-branch marker: ${error.message}`);
+              }
+            }
+            if (!base) { base = defaultBranch; baseSource = 'default'; }
+            if (base !== defaultBranch) {
+              try {
+                await withRetry((client) => client.rest.repos.getBranch({ owner, repo, branch: base }));
+              } catch (error) {
+                core.warning(`Base branch '${base}' not found; falling back to '${defaultBranch}'.`);
+                base = defaultBranch; baseSource = 'default-fallback';
+              }
+            }
+            core.info(`Base branch: ${base} (source: ${baseSource})`);
+
             let branchPrefix = 'codex/issue-';
             try {
               const { getAgentConfig } = require('./.github/scripts/agent_registry.js');

.github/workflows/agents-auto-pilot.yml

@@ -1,6 +1,14 @@
 # See docs/ci/AGENTS_POLICY.md for guardrails and override process.
 name: Agents Auto-Pilot
 
+# Correlating a run to its issue needs the issue number in the run title;
+# without it `gh run list` shows only the workflow name and no per-issue
+# history can be reconstructed.
+run-name: >-
+  Agents Auto-Pilot
+  #${{ github.event.issue.number || github.event.pull_request.number ||
+       inputs.issue_number }}
+
 # End-to-end automation: Issue → Format → Optimize → Apply → Agent → Keepalive → Merge
 # Triggered by:
 # 1. agents:auto-pilot label (initial trigger)
@@ -2880,12 +2888,53 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo
             }));
-            const baseBranch = repoInfo.default_branch;
-            if (!baseBranch) {
+            const defaultBranch = repoInfo.default_branch;
+            if (!defaultBranch) {
               core.setFailed('Repository default branch not available');
               return;
             }
 
+            // Resolve the pull request base the same way the issue bridge and the
+            // belt dispatcher do: the issue's `<!-- base-branch: X -->` marker
+            // wins over the repository default. Auto-pilot opens the pull request
+            // itself, so without this the marker is honoured when the branch is
+            // cut and then ignored when the PR is opened — the PR lands on the
+            // default branch and any per-lane workflow silently collapses.
+            let baseBranch = defaultBranch;
+            let baseSource = 'default';
+            try {
+              const { data: baseIssue } = await withRetry((client) =>
+                client.rest.issues.get({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issueNumber,
+                }));
+              const marker = String(baseIssue.body || '')
+                .match(/<!--\s*base-branch:\s*([^\s>]+)\s*-->/);
+              if (marker) {
+                const candidate = marker[1].trim();
+                if (candidate && candidate !== defaultBranch) {
+                  try {
+                    await withRetry((client) => client.rest.repos.getBranch({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      branch: candidate,
+                    }));
+                    baseBranch = candidate;
+                    baseSource = 'issue-marker';
+                  } catch (branchError) {
+                    core.warning(
+                      `Base branch '${candidate}' from the issue marker was not found; ` +
+                      `falling back to '${defaultBranch}'.`);
+                    baseSource = 'default-fallback';
+                  }
+                }
+              }
+            } catch (markerError) {
+              core.warning(`Could not read issue #${issueNumber} for a base-branch marker: ${markerError.message}`);
+            }
+            core.info(`Base branch: ${baseBranch} (source: ${baseSource})`);
+
             // If a PR already exists for this branch, stop create-pr loop
             try {
               const headRef = `${context.repo.owner}:${branchName}`;
@@ -3754,12 +3803,53 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo
             }));
-            const baseBranch = repoInfo.default_branch;
-            if (!baseBranch) {
+            const defaultBranch = repoInfo.default_branch;
+            if (!defaultBranch) {
               core.setFailed('Repository default branch not available');
               return;
             }
 
+            // Resolve the pull request base the same way the issue bridge and the
+            // belt dispatcher do: the issue's `<!-- base-branch: X -->` marker
+            // wins over the repository default. Auto-pilot opens the pull request
+            // itself, so without this the marker is honoured when the branch is
+            // cut and then ignored when the PR is opened — the PR lands on the
+            // default branch and any per-lane workflow silently collapses.
+            let baseBranch = defaultBranch;
+            let baseSource = 'default';
+            try {
+              const { data: baseIssue } = await withRetry((client) =>
+                client.rest.issues.get({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issueNumber,
+                }));
+              const marker = String(baseIssue.body || '')
+                .match(/<!--\s*base-branch:\s*([^\s>]+)\s*-->/);
+              if (marker) {
+                const candidate = marker[1].trim();
+                if (candidate && candidate !== defaultBranch) {
+                  try {
+                    await withRetry((client) => client.rest.repos.getBranch({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      branch: candidate,
+                    }));
+                    baseBranch = candidate;
+                    baseSource = 'issue-marker';
+                  } catch (branchError) {
+                    core.warning(
+                      `Base branch '${candidate}' from the issue marker was not found; ` +
+                      `falling back to '${defaultBranch}'.`);
+                    baseSource = 'default-fallback';
+                  }
+                }
+              }
+            } catch (markerError) {
+              core.warning(`Could not read issue #${issueNumber} for a base-branch marker: ${markerError.message}`);
+            }
+            core.info(`Base branch: ${baseBranch} (source: ${baseSource})`);
+
             const scriptsPath = process.env.WORKFLOWS_SCRIPTS_PATH || process.env.GITHUB_WORKSPACE;
             const { redispatchForceStep } = require(
               `${scriptsPath}/.github/scripts/auto_pilot_transitions.js`

.github/workflows/agents-issue-optimizer.yml

@@ -5,7 +5,13 @@ name: Agents Issue Optimizer
 # nothing and reported 0 for an issue it was re-running every minute. Pin the issue
 # number into the run name so both trigger types are correlatable.
 run-name: >-
-  Agents Issue Optimizer #${{ github.event.issue.number || github.event.inputs.issue_number }}
+  Agents Issue Optimizer
+  ${{ (github.event_name == 'workflow_dispatch' ||
+       github.event.label.name == 'agents:format' ||
+       github.event.label.name == 'agents:optimize' ||
+       github.event.label.name == 'agents:apply-suggestions')
+      && '[work]' || '[noop]' }}
+  #${{ github.event.issue.number || github.event.inputs.issue_number }}
 
 on:
   issues:
@@ -210,6 +216,14 @@ jobs:
 
           # `gh run list` defaults to 20 runs, which a tight loop exhausts inside the
           # window; ask for enough history to actually see the recursion.
+          #
+          # Count only runs that could do work. This workflow triggers on EVERY
+          # `labeled` event, but only agents:format / agents:optimize /
+          # agents:apply-suggestions (and workflow_dispatch) reach the optimizer;
+          # every other label spawns a run that exits at the trigger check. Those
+          # no-ops used to count here, so applying three labels to a new issue
+          # burned the whole budget before any real work started and the guard
+          # tripped on legitimate bulk seeding. run-name marks them [noop].
           # shellcheck disable=SC2016
           count=$(gh run list \
             --workflow=agents-issue-optimizer.yml \
@@ -218,7 +232,8 @@ jobs:
             | jq --arg cutoff "$one_hour_ago" \
               --arg issue "#$ISSUE_NUMBER" \
               '[.[] | select(.createdAt > $cutoff
-              and (.displayTitle | endswith($issue)))
+              and (.displayTitle | endswith($issue))
+              and (.displayTitle | contains("[noop]") | not))
               ] | length')
 
           echo "Optimizer runs for issue #$ISSUE_NUMBER in last hour: $count"

.github/workflows/agents-model-profile-trial.yml

@@ -49,7 +49,7 @@ permissions:
 
 jobs:
   trial:
-    uses: stranske/Workflows/.github/workflows/reusable-model-profile-trial.yml@822e323eefba3edb640e0bd9c922caec6fffee65
+    uses: iamkayleb/Workflows/.github/workflows/reusable-model-profile-trial.yml@e85edadb246e41d172a0c79fad147752d1df9ea9
     permissions:
       contents: read
     with:
@@ -61,6 +61,6 @@ jobs:
       packet_hash: ${{ inputs.packet_hash }}
       launch_ordinal: ${{ fromJSON(inputs.launch_ordinal) }}
       expected_source_sha: ${{ inputs.expected_source_sha }}
-      runner_sha: 822e323eefba3edb640e0bd9c922caec6fffee65
+      runner_sha: e85edadb246e41d172a0c79fad147752d1df9ea9
     secrets:
       CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}