[purp]

Summary

Add the runtime foundation for automatic labeling of accepted issues and PRs: a bounded managed classifier adapter and deterministic invocation selection that reuse the standalone /label-issue contract. This draft installs no automatic labeling workflow and performs no label writes.

Related Issue

Closes #5406. Starts Part 3 of #5276; this PR does not close the overall tracker.

Based on main after #5260 and #5355 merged; no temporary tracking branch is required.

Integration order: #5260 supplies accepted-work policy and opening-time PR acceptance labeling; #5355 supplies the standalone skill and migration helpers; #5151 supplies label/routing preparation before observed manual migration; automatic acceptance-triggered labeling follows those observed runs.

Changes

• Add a version-pinned CMA session adapter with request preview, configurable budget/deadline, completion validation, bounded event pagination, and failure recovery. The classifier receives prepared evidence and trusted instructions with tools/MCP disabled and no supplied GitHub credentials.
• Select explicit issue/PR acceptance events and authorized human PR-comment/manual invocations with force support. Opening/reopening alone does not dispatch classification.
• Leave acceptance, evidence expansion, semantic validation, coordinated writes, checkpoints, and local ambiguity reporting in the shared skill/helper boundary.
• Register 30 offline tests in mise/branch CI and protect the runtime files with CODEOWNERS.

Before activation: connect #5355's actual interfaces, provision and verify the CMA configuration, coordinate execution per item across entry points, and observe end-to-end runs. Hook #5260's successful acceptance-label write explicitly, including drafts and independently of subsequent reviewer-routing failure: a GITHUB_TOKEN label write does not trigger another workflow. Recheck current acceptance rather than trusting a historical label.

Release Notes

Testing

• Rebased onto main after feat(skills): extract issue and PR labeling #5355 merged; all three runtime commits preserved. The combined label-related offline suite passes 244 tests; the main-relative diff has no whitespace errors.
• 30 offline Python tests pass using uv run --no-project --python /usr/bin/python3 --offline python -m unittest discover -s tasks/scripts -p '*label*test.py'.
• Python syntax, TOML task registration, and complete staged git diff --check pass.
• Scope and documentation review; remove the unused serialization wrapper and stale ambiguity-comment guidance.
• Ruff/formatting and the mise wrapper: tools were unavailable and downloads were blocked. Markdownlint and Actionlint were not run.
• Live CMA smoke test and end-to-end labeling: pending configuration and shared-helper integration. No live sessions, label mutations, or automatic dispatch were performed.
• Unit tests added/updated.
• E2E tests added/updated (not applicable to the offline foundation).

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Internal integration documentation updated.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[purp]

Migration experiment: runtime follow-up

Observed Sonnet/Haiku comparison should inform this adapter and #5411's integration:

• Retain a pinned Sonnet baseline for observed validation; Haiku's lower cost does not justify switching defaults. Of eight eligible cases, Sonnet produced seven helper previews and one malformed-JSON failure; Haiku produced four previews and four held outputs. These are contract outcomes, not measured classification accuracy.
• Exercise the malformed Sonnet Policy DNS keeps the host's first nameserver from supervisor start, so all sandbox lookups fail after the host's DNS changes (e.g. VPN connect) #5197 response through the real completion/parser boundary. Preserve raw output and execution references, fail closed, and do not silently repair responses or retry uncertain session creation. Assess provider-supported structured output against the actual shared schema rather than weakening validation.
• Review the configured budget against representative inputs: Sonnet's CLI list-price estimates reached $0.2669 per run (refactor(sdk)!: unify wait_ready and make it succeed only on Ready #5226), with test(e2e): verify Kubernetes trace export against Jaeger #5517 at $0.2568. These are not CMA billing measurements; verify the live CMA budget before assuming the current 25-cent default accommodates these cases.

This was fixed-evidence, tool-free Claude CLI testing, not validation of CMA execution. No label writes occurred. #5413 owns reproducible quality/cost/latency evaluation.