ci: add automatic Planfile GitHub synchronization

[tom-sapletta-com]

Adds the standard Planfile GitHub synchronization workflow.

The reusable workflow is pinned to semcod/planfile@v0.1.126 and runs hourly, on relevant Planfile changes, and on manual dispatch. It imports and exports managed GitHub Issues according to the repository Planfile configuration.

Generated from the shared Planfile rollout.

Ticket: ticket-001

[ifuri-validator-agent]

Validator approval after policy checks for exact head d32435a281c8b2509424d2d1a6b20a2d5af146f6.

Ticket: ticket-001
Correlation ID: nlp2cmd-pr-13-ticket-001-d32435a281
Model: zai/glm-5.3
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). Adds a new scheduled/dispatch/push-triggered GitHub Actions workflow that calls a reusable workflow from semcod/planfile pinned by commit SHA (e79d7950...) annotated as v0.1.126. Permissions are correctly scoped to contents:read and issues:write, with concurrency group to serialize runs. The ticket README matches the implementation (version, triggers, permission scope). SHA pinning of the third-party reusable workflow is a good supply-chain practice. Required checks test (3.11) and test (3.12) both PASS.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: satisfied; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: 495b2c11116bf3b14738844770ad990a2e1c11e3...d32435a281c8b2509424d2d1a6b20a2d5af146f6
Change digest: 04ed1392261de965dd1db00bb115812cb575caee3928410b9816dd0e63f8d025
Score: 48/100 (M), estimated 40 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":61,"base_sha":"495b2c11116bf3b14738844770ad990a2e1c11e3","binary_files":0,"categories":{"configuration":1,"docs":1},"change_digest":"04ed1392261de965dd1db00bb115812cb575caee3928410b9816dd0e63f8d025","comparison":"495b2c11116bf3b14738844770ad990a2e1c11e3...d32435a281c8b2509424d2d1a6b20a2d5af146f6","deletions":0,"file_count":2,"files":["github/workflows/planfile-github-sync.yml","project/ticket-001/README.md"],"head_sha":"d32435a281c8b2509424d2d1a6b20a2d5af146f6","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":4,"delivery":3,"scope":1,"uncertainty":3,"validation":1},"complexity":"M","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":40,"within_budget":false},"impact":{"components":["github","project","semcod"],"files":["github/workflows/planfile-github-sync.yml","project/ticket-001/README.md","semcod/planfile@v0.1.126"],"public_interfaces":[],"runtime_dependencies":0},"schema":"subactor.ticket-radar/v1","score":48,"split":{"parts":[{"estimated_minutes":10,"name":"Implement github","scope":["github"]},{"estimated_minutes":10,"name":"Implement project","scope":["project"]},{"estimated_minutes":10,"name":"Implement semcod","scope":["semcod"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-001"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-001: ci: add automatic Planfile GitHub synchronization</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,55 97,53 79,85 59,71 39,56" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">M · 40m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-001-5009
TICKET ticket-001
HEAD_SHA d32435a281c8b2509424d2d1a6b20a2d5af146f6
CORRELATION_ID nlp2cmd-pr-13-ticket-001-d32435a281
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test (3.12)=PASS","test (3.11)=PASS"]
INPUT required_checks = ["test (3.11)","test (3.12)"]
INPUT required_checks_source = "protected registry + GitHub applied rules (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"autogrammar/nlp2cmd","pull_request":13,"head_sha":"d32435a281c8b2509424d2d1a6b20a2d5af146f6","base_sha":"495b2c11116bf3b14738844770ad990a2e1c11e3","diff_sha256":"1903db0601706051dc81a65936ef860e492d3e2e87be3c3cfb7856199ff3ed96"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":true,"critical_paths":[".github/workflows/planfile-github-sync.yml"],"observed_paths":[".github/workflows/planfile-github-sync.yml","project/ticket-001/README.md"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"satisfied","reason":null,"review_sha256":"2e200ff6995c0daae79da7ca465058b29f47ac2818c2f4b9d994acc11a67195b","unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"495b2c11116bf3b14738844770ad990a2e1c11e3","head_sha":"d32435a281c8b2509424d2d1a6b20a2d5af146f6","change_digest":"04ed1392261de965dd1db00bb115812cb575caee3928410b9816dd0e63f8d025","score":48,"complexity":"M","estimated_minutes":40,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"

[ifuri-validator-agent]

Validator approval after policy checks for exact head d32435a281c8b2509424d2d1a6b20a2d5af146f6.

Ticket: ticket-001
Correlation ID: nlp2cmd-pr-13-ticket-001
Model: zai/glm-5.3
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). Adds a new GitHub Actions workflow that calls the reusable planfile-sync workflow from semcod/planfile, pinned to an immutable commit SHA with a matching explicit planfile-version, running hourly, on dispatch, and on Planfile path changes. Permissions are scoped to contents:read and issues:write at both the workflow and job level, which matches the stated purpose. Required checks test (3.11) and test (3.12) both passed and align with the supplied required-checks list. The ticket README is untrusted metadata and was not used as evidence.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: satisfied; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: 495b2c11116bf3b14738844770ad990a2e1c11e3...d32435a281c8b2509424d2d1a6b20a2d5af146f6
Change digest: 04ed1392261de965dd1db00bb115812cb575caee3928410b9816dd0e63f8d025
Score: 48/100 (M), estimated 40 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":61,"base_sha":"495b2c11116bf3b14738844770ad990a2e1c11e3","binary_files":0,"categories":{"configuration":1,"docs":1},"change_digest":"04ed1392261de965dd1db00bb115812cb575caee3928410b9816dd0e63f8d025","comparison":"495b2c11116bf3b14738844770ad990a2e1c11e3...d32435a281c8b2509424d2d1a6b20a2d5af146f6","deletions":0,"file_count":2,"files":["github/workflows/planfile-github-sync.yml","project/ticket-001/README.md"],"head_sha":"d32435a281c8b2509424d2d1a6b20a2d5af146f6","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":4,"delivery":3,"scope":1,"uncertainty":3,"validation":1},"complexity":"M","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":40,"within_budget":false},"impact":{"components":["github","project","semcod"],"files":["github/workflows/planfile-github-sync.yml","project/ticket-001/README.md","semcod/planfile@v0.1.126"],"public_interfaces":[],"runtime_dependencies":0},"schema":"subactor.ticket-radar/v1","score":48,"split":{"parts":[{"estimated_minutes":10,"name":"Implement github","scope":["github"]},{"estimated_minutes":10,"name":"Implement project","scope":["project"]},{"estimated_minutes":10,"name":"Implement semcod","scope":["semcod"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-001"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-001: ci: add automatic Planfile GitHub synchronization</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,55 97,53 79,85 59,71 39,56" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">M · 40m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-001-1263
TICKET ticket-001
HEAD_SHA d32435a281c8b2509424d2d1a6b20a2d5af146f6
CORRELATION_ID nlp2cmd-pr-13-ticket-001
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test (3.12)=PASS","test (3.11)=PASS"]
INPUT required_checks = ["test (3.11)","test (3.12)"]
INPUT required_checks_source = "protected registry + GitHub applied rules (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"autogrammar/nlp2cmd","pull_request":13,"head_sha":"d32435a281c8b2509424d2d1a6b20a2d5af146f6","base_sha":"495b2c11116bf3b14738844770ad990a2e1c11e3","diff_sha256":"1903db0601706051dc81a65936ef860e492d3e2e87be3c3cfb7856199ff3ed96"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":true,"critical_paths":[".github/workflows/planfile-github-sync.yml"],"observed_paths":[".github/workflows/planfile-github-sync.yml","project/ticket-001/README.md"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"satisfied","reason":null,"review_sha256":"474cd7bc1c31dc3b337404733d44451cbc0a086b3097a96dca7c907ee1d5a62c","unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"495b2c11116bf3b14738844770ad990a2e1c11e3","head_sha":"d32435a281c8b2509424d2d1a6b20a2d5af146f6","change_digest":"04ed1392261de965dd1db00bb115812cb575caee3928410b9816dd0e63f8d025","score":48,"complexity":"M","estimated_minutes":40,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"