Bump idna from 3.10 to 3.15

.apm/instructions/agentic-workflows.instructions.md

@@ -0,0 +1,16 @@
+---
+description: "Agentic workflow recompilation: always recompile after changing workflow files"
+---
+
+# Agentic Workflows
+
+After modifying any `.md` workflow file under `.github/workflows/`, always
+recompile both agentic workflows and APM integration files before committing:
+
+```bash
+gh aw compile
+apm compile
+```
+
+Commit the regenerated `.lock.yml` and integration files together with your
+changes. The CI `APM Self-Check` job will fail if generated files are stale.

.github/ISSUE_TEMPLATE/autoloop-program.md

@@ -0,0 +1,49 @@
+---
+name: Autoloop Program
+about: Create a new Autoloop optimization program
+title: ''
+labels: autoloop-program
+---
+
+<!-- AUTOLOOP:ISSUE-PROGRAM -->
+<!-- This issue defines an Autoloop program. The format is identical to program.md files. -->
+<!-- Autoloop will discover this issue by its label and run iterations automatically. -->
+<!-- After each run, a status comment will be posted/updated with links and results. -->
+
+---
+schedule: every 6h
+# target-metric: 0.95  ← uncomment and set to make this a goal-oriented program that stops when reached
+---
+
+# Program Name
+
+## Goal
+
+<!-- Describe what you want to optimize. Be specific about what 'better' means. -->
+<!-- Choose one of the following program types: -->
+<!-- • Goal-oriented: Has a finish line. Set target-metric above and describe the target here. -->
+<!--   Example: "Increase test coverage to at least 95%." -->
+<!-- • Open-ended: Runs forever, always seeking improvement. Leave target-metric commented out. -->
+<!--   Example: "Continuously improve algorithm performance." -->
+
+REPLACE THIS with your optimization goal.
+
+## Target
+
+<!-- List files Autoloop may modify. Everything else is off-limits. -->
+
+Only modify these files:
+- `REPLACE_WITH_FILE` -- (describe what this file does)
+
+Do NOT modify:
+- (list files that must not be touched)
+
+## Evaluation
+
+<!-- Provide a command and the metric to extract. -->
+
+```bash
+REPLACE_WITH_YOUR_EVALUATION_COMMAND
+```
+
+The metric is `REPLACE_WITH_METRIC_NAME`. **Lower/Higher is better.** (pick one)

.github/aw/actions-lock.json

@@ -30,15 +30,10 @@
       "version": "v7",
       "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     },
-    "github/gh-aw-actions/setup-cli@v0.71.5": {
-      "repo": "github/gh-aw-actions/setup-cli",
-      "version": "v0.71.5",
-      "sha": "b8068426813005612b960b5ab0b8bd2c27142323"
-    },
-    "github/gh-aw-actions/setup@v0.71.5": {
+    "github/gh-aw-actions/setup@v0.74.2": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.71.5",
-      "sha": "b8068426813005612b960b5ab0b8bd2c27142323"
+      "version": "v0.74.2",
+      "sha": "23453ecc01928d28ee1e773e403b216b29e89a5b"
     },
     "github/gh-aw/actions/setup@v0.50.6": {
       "repo": "github/gh-aw/actions/setup",

.github/copilot-instructions.md

@@ -1,7 +1,22 @@
 <!-- Generated by APM CLI from .apm/ primitives -->
-<!-- Build ID: 791e09362ff0 -->
+<!-- Build ID: cdb5b8cab974 -->
 <!-- APM Version: 0.12.4 -->
 
+<!-- Source: .apm/instructions/agentic-workflows.instructions.md -->
+# Agentic Workflows
+
+After modifying any `.md` workflow file under `.github/workflows/`, always
+recompile both agentic workflows and APM integration files before committing:
+
+```bash
+gh aw compile
+apm compile
+```
+
+Commit the regenerated `.lock.yml` and integration files together with your
+changes. The CI `APM Self-Check` job will fail if generated files are stale.
+<!-- End source: .apm/instructions/agentic-workflows.instructions.md -->
+
 <!-- Source: .apm/instructions/linting.instructions.md -->
 # Linting (canonical contract)
 

.github/instructions/agentic-workflows.instructions.md

@@ -0,0 +1,16 @@
+---
+description: "Agentic workflow recompilation: always recompile after changing workflow files"
+---
+
+# Agentic Workflows
+
+After modifying any `.md` workflow file under `.github/workflows/`, always
+recompile both agentic workflows and APM integration files before committing:
+
+```bash
+gh aw compile
+apm compile
+```
+
+Commit the regenerated `.lock.yml` and integration files together with your
+changes. The CI `APM Self-Check` job will fail if generated files are stale.

.github/mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "github-agentic-workflows": {
+      "command": "gh",
+      "args": [
+        "aw",
+        "mcp-server"
+      ]
+    }
+  }
+}

.github/workflows/agentics-maintenance.yml

@@ -12,7 +12,7 @@
 # \  /\  / (_) | | | | ( | | | | (_) \ V  V /\__ \
 #  \/  \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
 #
-# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.71.5). DO NOT EDIT.
+# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.74.1). DO NOT EDIT.
 #
 # To regenerate this workflow, run:
 #   gh aw compile
@@ -55,6 +55,7 @@ on:
           - 'clean_cache_memories'
           - 'update_pull_request_branches'
           - 'validate'
+          - 'forecast'
       run_url:
         description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
         required: false
@@ -63,7 +64,7 @@ on:
   workflow_call:
     inputs:
       operation:
-        description: 'Optional maintenance operation to run (disable, enable, update, upgrade, safe_outputs, create_labels, activity_report, close_agentic_workflows_issues, clean_cache_memories, update_pull_request_branches, validate)'
+        description: 'Optional maintenance operation to run (disable, enable, update, upgrade, safe_outputs, create_labels, activity_report, close_agentic_workflows_issues, clean_cache_memories, update_pull_request_branches, validate, forecast)'
         required: false
         type: string
         default: ''
@@ -92,7 +93,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -130,7 +131,7 @@ jobs:
       actions: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -144,7 +145,7 @@ jobs:
             await main();
 
   run_operation:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation != '' && inputs.operation != 'safe_outputs' && inputs.operation != 'create_labels' && inputs.operation != 'activity_report' && inputs.operation != 'close_agentic_workflows_issues' && inputs.operation != 'clean_cache_memories' && inputs.operation != 'update_pull_request_branches' && inputs.operation != 'validate' && (!(github.event.repository.fork)) }}
+    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation != '' && inputs.operation != 'safe_outputs' && inputs.operation != 'create_labels' && inputs.operation != 'activity_report' && inputs.operation != 'close_agentic_workflows_issues' && inputs.operation != 'clean_cache_memories' && inputs.operation != 'update_pull_request_branches' && inputs.operation != 'validate' && inputs.operation != 'forecast' && (!(github.event.repository.fork)) }}
     runs-on: ubuntu-slim
     permissions:
       actions: write
@@ -159,7 +160,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -174,9 +175,9 @@ jobs:
             await main();
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup-cli@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
-          version: v0.71.5
+          version: v0.74.1
 
       - name: Run operation
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -204,7 +205,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -250,7 +251,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -294,7 +295,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -309,9 +310,9 @@ jobs:
             await main();
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup-cli@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
-          version: v0.71.5
+          version: v0.74.1
 
       - name: Create missing labels
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -340,7 +341,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -355,9 +356,9 @@ jobs:
             await main();
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup-cli@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
-          version: v0.71.5
+          version: v0.74.1
 
       - name: Restore activity report logs cache
         id: activity_report_logs_cache
@@ -430,14 +431,89 @@ jobs:
             });
             core.info('Created issue #' + createdIssue.data.number + ': ' + createdIssue.data.html_url);
 
+  forecast_report:
+    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'forecast' && (!(github.event.repository.fork)) }}
+    runs-on: ubuntu-slim
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+
+      - name: Check admin/maintainer permissions
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
+            await main();
+
+      - name: Install gh-aw
+        uses: github/gh-aw-actions/setup-cli@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
+        with:
+          version: v0.74.1
+
+      - name: Restore forecast report logs cache
+        id: forecast_report_logs_cache
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: .github/aw/logs
+          key: ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-
+            ${{ runner.os }}-forecast-report-logs-
+
+      - name: Generate forecast report
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_AW_CMD_PREFIX: gh aw
+        run: |
+          mkdir -p ./.cache/gh-aw/forecast
+          ${GH_AW_CMD_PREFIX} logs --repo "${{ github.repository }}" --start-date -30d --count 1500 > /dev/null
+          if ! compgen -G ".github/aw/logs/run-*/run_summary.json" > /dev/null; then
+            echo "::error::Missing run summary cache in .github/aw/logs after gh aw logs warm-up; cannot run forecast."
+            exit 1
+          fi
+          ${GH_AW_CMD_PREFIX} forecast --repo "${{ github.repository }}" --json 2> >(grep -Fv "forecast is an experimental command and may change without notice" >&2) > ./.cache/gh-aw/forecast/report.json
+
+      - name: Save forecast report logs cache
+        if: ${{ always() }}
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: .github/aw/logs
+          key: ${{ steps.forecast_report_logs_cache.outputs.cache-primary-key }}
+
+      - name: Generate forecast issue
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/create_forecast_issue.cjs');
+            await main();
+
   close_agentic_workflows_issues:
     if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'close_agentic_workflows_issues' && (!(github.event.repository.fork)) }}
     runs-on: ubuntu-slim
     permissions:
       issues: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -474,7 +550,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -489,9 +565,9 @@ jobs:
             await main();
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+        uses: github/gh-aw-actions/setup-cli@b07cf98ac5874e8f51c34ba52099d8a6fac2ef93 # v0.74.1
         with:
-          version: v0.71.5
+          version: v0.74.1
 
       - name: Validate workflows and file issue on findings
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0