Sync site copy, worker queues, and ADR pointers

.env.example

@@ -5,7 +5,7 @@
 # Default for Docker Compose in this repo is 7224; override locally if needed (`nub src/index.ts`)
 PORT=7224
 # web: /health + /ready + /webhooks (enqueue only).
-# worker: ack, ci-refresh, review, ask, description, triage, verification, retention.
+# worker: ack, ci-refresh, review, ask, description, triage, verification, retention, code-index-build.
 # Local dev needs both terminals; Compose runs pr-agent-web and pr-agent-worker.
 ROLE=web
 

README.md

@@ -75,11 +75,11 @@ docker compose up -d
 
 That starts three services from [docker-compose.yml](docker-compose.yml):
 
-| Service           | Role          | What it does                                                                                   |
-| ----------------- | ------------- | ---------------------------------------------------------------------------------------------- |
-| `postgres`        | database      | Durable webhook dedupe, work items, pg-boss jobs                                               |
-| `pr-agent-web`    | `ROLE=web`    | `POST /webhooks`, `GET /health`, `GET /ready` on port `7224`                                   |
-| `pr-agent-worker` | `ROLE=worker` | Consumes ack, review, ask, description, triage, verification, CI-refresh, and retention queues |
+| Service           | Role          | What it does                                                                                                     |
+| ----------------- | ------------- | ---------------------------------------------------------------------------------------------------------------- |
+| `postgres`        | database      | Durable webhook dedupe, work items, pg-boss jobs                                                                 |
+| `pr-agent-web`    | `ROLE=web`    | `POST /webhooks`, `GET /health`, `GET /ready` on port `7224`                                                     |
+| `pr-agent-worker` | `ROLE=worker` | Consumes ack, review, ask, description, triage, verification, CI-refresh, retention, and code-index-build queues |
 
 Migrations run automatically when each process opens its Postgres pool. You do not run them by hand.
 

docs/adr/0003-structured-review-output.md

@@ -15,9 +15,9 @@ The review agent previously instructed the model to submit a GitHub pull request
 
 ## Decision
 
-1. **`ReviewPayload`** (Valibot) is the validated summary contract for a review run. Incremental inline batches use `publish_thread`; the summary publisher consumes `ReviewPayload` via `submitReview` / `publish_summary` ([ADR 0020](0020-orchestrated-review.md), [ADR 0027](0027-replace-zod-with-valibot.md)).
+1. **`ReviewPayload`** (Valibot) is the validated summary contract for a review run. Incremental inline batches use `publish_thread`; the summary publisher consumes `ReviewPayload` via `publish_summary` ([ADR 0020](0020-orchestrated-review.md), [ADR 0027](0027-replace-zod-with-valibot.md)).
 2. **Server-side renderers** (`reviewRender.ts`) produce inline thread bodies (P0–P3, with `Prompt to fix` accordion), the **review pointer body** (per-specialist Files-tab pull request review header: NOTE linking to the **review progress comment** plus a specialist tagline; no Fix All accordion), and the **review summary comment** (sentinel `## PR Agent Review`, overview alert plus a unified table: size, finding rows keyed by severity, tests, security, and follow-ups; aggregate **agent fix prompt** accordion below the table; hidden **stale review metadata** HTML comment). Finding rows for inline-posted severities list title, location, and a footnote only; **detail text appears in the summary table only for summary-only placements**. P3 is inline-eligible so `/triage` can fix it; review check runs still fail only for P0–P2 (see [ADR 0021](0021-p3-inline-triage.md)).
-3. **Publish** ([`publish/publishReview.ts`](../../src/review/publish/publishReview.ts) + [`github/reviewPublish.ts`](../../src/github/reviewPublish.ts)) calls Octokit directly; `createPullRequestReview` / `addPullRequestComment` are **filtered out** of the review agent tool list.
+3. **Publish** ([`publish/publishFindingBatch.ts`](../../src/review/publish/publishFindingBatch.ts), [`publish/publishSummaryOnly.ts`](../../src/review/publish/publishSummaryOnly.ts), and [`github/reviewPublish.ts`](../../src/github/reviewPublish.ts)) calls Octokit directly; `createPullRequestReview` / `addPullRequestComment` are **filtered out** of the review agent tool list.
 4. **Phase 3:** summary comment upsert by sentinel; optional idempotent labels (`size:<XS-XXL>`, `Possible security concern`) behind config flags.
 5. **Strict bugs only** — no suggestions/improvements framing; `fixPrompt` is for coding agents, not human refactor advice.
 

docs/adr/0006-durable-agent-work.md

@@ -16,7 +16,7 @@ Production failures during small bursts showed that webhook acknowledgement, Git
 
 2. **Postgres + pg-boss** — Use Postgres for app-owned workflow state and pg-boss for delivery, retries, heartbeat, expiration, and dead-letter retention. Per-PR mutual exclusion is the **PR actor lease** ([ADR 0030](0030-pr-actor-lease.md)); work queues use the `standard` policy.
 
-3. **Web/worker split** — `ROLE=web` serves `/health`, `/ready`, and `/webhooks`. `ROLE=worker` runs acknowledgement, CI-refresh, review, ask, description, triage, verification, and retention workers from the same image.
+3. **Web/worker split** — `ROLE=web` serves `/health`, `/ready`, and `/webhooks`. `ROLE=worker` runs acknowledgement, CI-refresh, review, ask, description, triage, verification, retention, and code-index-build workers from the same image.
 
 4. **No PR-surface I/O on webhook fibers** — GitHub reactions, progress comments, ask replies, inline reviews, labels, and failure notices run in worker jobs. Webhook fibers verify, parse, dedupe, commit, enqueue, and return.
 

docs/adr/0022-remove-merge-verdict.md

@@ -12,7 +12,7 @@ The review summary once included a model-authored **Merge verdict** row (score /
 
 1. **Remove the field.** Drop `mergeVerdict` from `ReviewPayload`, prompt contracts, public-output redaction, and payload validation clamps.
 2. **Remove the row.** The summary renderer no longer emits a Merge verdict table row or mechanical fallbacks.
-3. **Keep other gates.** Effort, findings, relevant tests, security, CI, and follow-ups remain the overview surface.
+3. **Keep other gates.** Review size (`size` / `size:<TOKEN>`), findings, relevant tests, security, CI, and follow-ups remain the overview surface.
 
 ## Consequences
 

docs/adr/0025-prompt-cache-stability.md

@@ -50,7 +50,7 @@ prompt-caching framework and no deferred-tool subsystem for this change.
 - Orchestrator and specialist tool JSON must stay byte-stable across phases and
   personas (persona differences live in system prompts only). Shared code-index
   description/schema and specialist tools are registered once at session create.
-- Wrong-phase `brief` / `publish_thread` / `publish_summary` calls return
+- Wrong-phase `submit_specialist_brief` / `publish_thread` / `publish_summary` calls return
   structured executor errors; the registered tool list does not change mid-session.
   Mid-session `setActiveTools` / `transitionTools` APIs are gone.
 - Auto-compaction stays off for orchestrator, specialist, and CI summary; ask,

docs/adr/0028-validate-then-repair-tool-inputs.md

@@ -4,6 +4,10 @@
 
 Accepted.
 
+Amended: the live summary tool is `publish_summary` in
+[`publishSummaryTool.ts`](../../src/review/orchestrator/publishSummaryTool.ts).
+`submitReview` and `submitReviewTool.ts` are gone.
+
 ## Context
 
 Models emit structurally invalid tool arguments in a handful of predictable ways: a JSON array serialized as a string, a single object where the schema wants an array, a bare string where an array of strings is wanted, or `null` for an optional field. Before this change every parse site handled failures on its own: workspace tools threw a raw `ValiError` dump at the model, structured-output tools each formatted their own issue list, and `submitReview` ran its domain coercions unconditionally before every parse — mutating payloads that were already valid and logging `review_payload_coerced` for submissions the coercion never touched.
@@ -23,7 +27,7 @@ The four failure shapes above are mechanical and deterministic. Fixing them per
 - Helper: [`src/agent/tools/parseToolInput.ts`](../../src/agent/tools/parseToolInput.ts)
 - Executor seams: [`defineWorkspaceTool.ts`](../../src/agent/tools/defineWorkspaceTool.ts), [`context7Tools.ts`](../../src/agent/tools/context7Tools.ts)
 - Metrics variant: [`reviewRunMetrics.ts`](../../src/review/run/reviewRunMetrics.ts) (`tool_input_repaired`)
-- Validate-then-repair reorder: [`submitReviewTool.ts`](../../src/review/publish/submitReviewTool.ts); deleted domain rule in [`reviewSchema.ts`](../../src/review/reviewSchema.ts)
+- Summary publish parse: [`publishSummaryTool.ts`](../../src/review/orchestrator/publishSummaryTool.ts). `coerceReviewPayloadInput` remains in [`reviewSchema.ts`](../../src/review/reviewSchema.ts) but has no production caller on the `publish_summary` path.
 
 ## Consequences