Agent-flows Phase 0: fail-loud metrics, real SRE trigger, AlitaBot docs, orphan cleanup

[Szer]

Summary

Phase 0 of the approved agent-flows redesign (.github/AGENT-FLOWS-REDESIGN.md, §4 "Phase 0 — stop the lying"). Four mechanical fixes:

1. scripts/gather-metrics.sh fails loud. Removed the || echo '{"data":{"result":[]}}' fallback that made an unreachable Prometheus/Loki/ArgoCD render as "zero restarts, zero errors, zero 5xx" — the same class of bug that blinded the product agent for 21 runs (Fix: product agent's DB queries silently time out over split-tunnel VPN #264). Every source is now probed up front with retry-then-exit 1 (matching gather-product-data.sh's style), and the report leads with a machine-readable {"sources":{"prometheus":"ok","loki":"ok","argocd":"ok"}} manifest line for a later automated gate to key off.
2. SRE agent rewired so it actually runs. sre.yml's issues: [labeled] trigger has fired 0/6 times in practice — the deploy-failure issue is created with secrets.GITHUB_TOKEN, and GitHub Actions never triggers workflows from default-token-authored events (anti-recursion). Replaced with _sre-agent.yml, a reusable workflow called directly from _bot-deploy.yml when the deploy or its verification fails, with bot identity (bot, argocd-app-name, container-name, docker-image, commit, run-url, optional issue-number) passed as workflow inputs instead of read from an issue body. Added sre-manual.yml (workflow_dispatch) as a hand-triggered entry point, since workflow_call workflows can't also declare workflow_dispatch. sre.md: bot identity now comes from the prompt; the 5xx-based health checks are replaced with Loki level="Error" rate (the /bot webhook always returns HTTP 200 to Telegram regardless of internal exceptions, so 5xx was structurally dead logic); added an if: always() step that re-enables ArgoCD auto-sync so a killed run can't leave it permanently off.
   • Also threaded AZURE_OPENAI_API_KEY/AZURE_OPENAI_BASE_URL through _bot-deploy.yml's own secrets: contract and its three callers (vahter-deploy.yml, coupon-deploy.yml, alita-deploy.yml) — required so secrets: inherit on the new sre: job actually has those secrets to inherit, since a reusable workflow only receives what its own caller explicitly passed it.
3. AlitaBot added to AGENTS.md. Repository structure, DB, its three workflows, command/feature summary, and corrected the opening line that described this as a two-bot repo.
4. Deleted the orphaned .github/prompts/review.md (invoked by no workflow; references MCP tools the codex-action runtime doesn't provide) and its one reference in project.md.

Full rationale: .github/AGENT-FLOWS-REDESIGN.md (§1, §3.5, §4 Phase 0, §9).

Scope note — if: failure() interpretation in _bot-deploy.yml

The new sre job uses needs: [deploy, verify-deploy, notify-failure], if: ${{ failure() && inputs.sre-enabled }} — same shape as the existing notify-failure job, so the SRE agent is guaranteed to run whenever deploy or verify-deploy fails (GitHub's failure() covers the whole transitive needs chain, so it stays true even though notify-failure itself typically succeeds). notify-failure is also a need so the new job can consume its outputs.issue-number (captured from gh issue create's output URL) and pass it through to _sre-agent.yml; if notify-failure didn't run or its output is empty, issue-number is simply blank and the prompt tells the agent to skip issue comment/close steps.

Deviations

• Neither shellcheck nor actionlint are installed in this environment — validated with bash -n (all touched scripts) and python3 -c "import yaml..." (all touched/created workflow YAML) instead, per the brief's documented fallback.
• The brief's "run locally with unreachable hosts (the *.internal endpoints will not resolve without VPN)" assumption didn't hold in this sandbox — it turns out to have live routes to the real *.internal infra (confirmed: prometheus.internal/argo.internal both actually resolve and respond here). Used a genuinely-nonexistent hostname (prometheus.bogus-host-that-does-not-exist.internal, confirmed via getent hosts → exit 2) to faithfully reproduce "unreachable" and prove the fail-loud path; also exercised a real-but-wrong-credential ArgoCD 401 as a second failure mode. Both produce curl's real diagnostic text and a non-zero exit with no report printed — see the PR description checks below / test-plan.
• src/CouponHubBot/docs/PROJECT-AGENT.md still documents the old sre.yml/issues: labeled mechanism — left untouched per "do not modify anything under src/"; flagging as a known follow-up for whoever picks up Phase 1.
• Not done, and out of scope per the brief: adding AlitaBot to the BotNotAvailable/ErrorLogsDetected Grafana alert rules (Phase 0 item 3 in the redesign doc) — that's Grafana provisioning config, not something editable in this repo, and wasn't one of the four listed changes.

Test plan

• bash -n on scripts/gather-metrics.sh — clean
• python3 -c "import yaml..." on every created/edited workflow YAML — clean
• Ran gather-metrics.sh against a genuinely-unreachable Prometheus host: exits 1, prints the real curl: (6) Could not resolve host: ... error, prints no report
• Ran gather-metrics.sh against a real ArgoCD endpoint with a bad token: exits 1, prints curl: (22) The requested URL returned error: 401, prints no report
• Not run: full success path (all three sources reachable + valid ArgoCD token) — no valid prod credentials in this environment
• Not run: an actual CI dispatch of the new _sre-agent.yml/sre-manual.yml — this PR is not merged, per instructions

🤖 Generated with Claude Code

https://claude.ai/code/session_01P41roCWN5Fec7m69sSaunU