From 1a40bb5d2d951618c3913cebefde29bc008463ae Mon Sep 17 00:00:00 2001
From: Pablo Rodriguez <contact@promontory.studio>
Date: Mon, 21 Sep 2026 11:36:25 +0000
Subject: [PATCH] Guard the automated pull requests here with the shared host,
 not a copy

The content is the experts' and the frozen reasoning prompts are nobody's to rewrite,
so the agent is kept out of it entirely; what it may touch is manifests and workflow
pins. A failed push to main now files an issue instead of going unread.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/autopilot.json   |  6 ++++++
 .github/workflows/ci.yml | 24 ++++++++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 .github/autopilot.json

diff --git a/.github/autopilot.json b/.github/autopilot.json
new file mode 100644
index 0000000..1a1bbc1
--- /dev/null
+++ b/.github/autopilot.json
@@ -0,0 +1,6 @@
+{
+  "agentAuthor": "plover-autopilot[bot]",
+  "botAuthor": "dependabot[bot]",
+  "maxLines": 400,
+  "forbidden": ["**/finding-dag/**/*.md"]
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ac572d1..77a7004 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,6 +29,19 @@ jobs:
             fi
           done
 
+  autopilot-guard:
+    # The rules are in .github/autopilot.json. Which pull requests it applies to is an input, not a
+    # job-level `if:`: a required check that reports SKIPPED blocks the merge forever.
+    if: github.event_name == 'pull_request'
+    uses: promontory-studio/pedalion/.github/workflows/guard.yml@e4e338d845be827465c177aefed794a2566af1cb
+    with:
+      base-ref: ${{ github.base_ref }}
+      head-sha: ${{ github.event.pull_request.head.sha }}
+      authors: plover-autopilot[bot],pedalion[bot],dependabot[bot]
+      pr-author: ${{ github.event.pull_request.user.login }}
+      # No manifest here: the content is markdown, validated by a shell script.
+      install: ""
+
   release:
     needs: test
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -71,3 +84,14 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh release create "v${{ steps.bump.outputs.version }}" --generate-notes
+
+  notify-failure:
+    needs: [test, release]
+    if: always() && github.event_name == 'push' && contains(needs.*.result, 'failure')
+    permissions:
+      issues: write
+    uses: promontory-studio/pedalion/.github/workflows/notify-failure.yml@e4e338d845be827465c177aefed794a2566af1cb
+    with:
+      title: CI failed on main
+      context: A push to main did not validate or release, so the published version no longer matches main.
+      assignee: pablo-tech