fix(dispatch): address review — checkout .fullsend repo and prioritize secrets

- Checkout config.yaml from job.workflow_repository (not enrolled repo).
- Pass secrets: inherit into prioritize workflow_call job.
- Update architecture.md and retro-analysis skill for dispatch.yml flow.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ifireball

docs/architecture.md

@@ -512,14 +512,13 @@ GitHub event ──► SHIM WORKFLOW (fullsend.yml in enrolled repo)
                  ╔═══════════════════════════════════════════════════════════════╗
                  ║ DISPATCH WORKFLOW (.fullsend repo, dispatch.yml)              ║
                  ║                                                               ║
-                 ║ Mints OIDC token → Cloud Function (token mint) → scoped      ║
-                 ║ GitHub App installation token per agent role.                  ║
-                 ║ Dispatches per-role agent workflows (code.yml, triage.yml).   ║
+                 ║ Routes to stage; synchronous workflow_call to upstream      ║
+                 ║ reusable-{stage}.yml (or prioritize.yml in .fullsend).        ║
                  ╚═══════════════════════════════════════════════════════════════╝
                        │
                        ▼
                  ╔═══════════════════════════════════════════════════════════════╗
-                 ║ AGENT WORKFLOW (.fullsend repo, e.g. code.yml)               ║
+                 ║ AGENT WORKFLOW (fullsend-ai/fullsend reusable-*.yml)          ║
                  ║                                                               ║
                  ║ Validates source repo is enrolled in config.yaml.             ║
                  ║ Uses scoped GitHub App tokens:                                ║
@@ -601,7 +600,7 @@ GitHub event ──► SHIM WORKFLOW (fullsend.yml in enrolled repo)
 
 | Abstract layer | MVP technology | ADR |
 |---|---|---|
-| Dispatcher | Shim workflow (`fullsend.yml`) in enrolled repo → `workflow_call` to `.fullsend/dispatch.yml` → OIDC mint → per-role agent workflows (thin callers → upstream reusable workflows) | [ADR 0008](ADRs/0008-workflow-dispatch-for-cross-repo-dispatch.md), [ADR 0031](ADRs/0031-reusable-workflows-for-action-installed-distribution.md) |
+| Dispatcher | Shim workflow (`fullsend.yml`) in enrolled repo → `workflow_call` to `.fullsend/dispatch.yml` → synchronous `workflow_call` to upstream reusable workflows | [ADR 0008](ADRs/0008-workflow-dispatch-for-cross-repo-dispatch.md), [ADR 0031](ADRs/0031-reusable-workflows-for-action-installed-distribution.md), [ADR 0041](ADRs/0041-synchronous-workflow-call-event-dispatch.md) |
 | Agent runner | GitHub Actions job → `fullsend run` CLI (via `fullsend-ai/fullsend@v0` composite action) | |
 | Harness store | YAML files in `.fullsend/harness/` (e.g. `code.yaml`, `triage.yaml`) | |
 | Sandbox | OpenShell with per-agent L7 network policies (endpoint + binary restrictions) | |

internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml

@@ -32,6 +32,7 @@ jobs:
       - name: Checkout config repository
         uses: actions/checkout@v6
         with:
+          repository: ${{ job.workflow_repository }}
           persist-credentials: false
           sparse-checkout: config.yaml
           sparse-checkout-cone-mode: false
@@ -374,6 +375,7 @@ jobs:
     needs: route
     if: needs.route.outputs.stage == 'prioritize'
     uses: ./.github/workflows/prioritize.yml
+    secrets: inherit
     with:
       event_type: ${{ github.event_name }}
       source_repo: ${{ github.repository }}

internal/scaffold/fullsend-repo/skills/retro-analysis/SKILL.md

@@ -29,35 +29,21 @@ gh run list --repo "$REPO_FULL_NAME" --workflow=fullsend.yaml \
   -q '.[] | select(.event == "issue_comment" or .event == "issues")'
 ```
 
-2. Find the corresponding agent runs in the dispatch repo:
+2. Find the corresponding dispatch runs in the config repo (triage/code/review/fix/retro run as jobs inside `dispatch.yml`):
 
 ```bash
-gh run list --repo "$DISPATCH_REPO" --workflow=triage.yml --limit 10 \
-  --json databaseId,status,conclusion,createdAt
-```
-
-3. If the issue reached `ready-to-code`, find code dispatches:
-
-```bash
-gh run list --repo "$DISPATCH_REPO" --workflow=code.yml --limit 10 \
+gh run list --repo "$DISPATCH_REPO" --workflow=dispatch.yml --limit 10 \
   --json databaseId,status,conclusion,createdAt
 ```
 
 ### From a PR
 
 1. The PR branch follows `agent/{issue}-{slug}`. Extract the issue number to trace the full history.
 
-2. Find review dispatches:
-
-```bash
-gh run list --repo "$DISPATCH_REPO" --workflow=review.yml --limit 10 \
-  --json databaseId,status,conclusion,createdAt
-```
-
-3. Find fix dispatches (if review requested changes):
+2. Find dispatch runs for this PR (review/fix stages appear as jobs in the run):
 
 ```bash
-gh run list --repo "$DISPATCH_REPO" --workflow=fix.yml --limit 10 \
+gh run list --repo "$DISPATCH_REPO" --workflow=dispatch.yml --limit 10 \
   --json databaseId,status,conclusion,createdAt
 ```
 

internal/scaffold/scaffold_test.go

@@ -231,6 +231,8 @@ func TestDispatchWorkflowContent(t *testing.T) {
 	assert.Contains(t, s, "install_mode: per-org")
 	assert.Contains(t, s, "permissions: {}")
 	assert.Contains(t, s, "sparse-checkout: config.yaml")
+	assert.Contains(t, s, "repository: ${{ job.workflow_repository }}")
+	assert.Contains(t, s, "secrets: inherit")
 	assert.Contains(t, s, "set -euo pipefail")
 	assert.Contains(t, s, "Invalid stage name")
 	assert.Contains(t, s, `^[a-z][a-z0-9_-]*$`)