feat(ci): Mythos delta-pass auto-runner (single-actor, OAuth-token)

[avrabe]

Summary

Automates the Mythos discover protocol that mythos-gate.yml
currently enforces by label only. On every PR that touches a Tier-5
file, anthropics/claude-code-action (SHA-pinned) runs against each
touched file with scripts/mythos/discover.md as the prompt, emits
a structured JSON verdict (NO_FINDINGS or FINDING), and the
aggregate job posts a sticky <!-- mythos-auto-gate --> PR comment

• applies mythos-pass-done on all-pass.

📝 Opened as draft. Workflow needs the
CLAUDE_CODE_OAUTH_TOKEN repo secret before its first run will
succeed. See "Phase A" below.

Authorization stack — "only avrabe can trigger this"

Layer	What it does	What it blocks
1	if: github.actor == 'avrabe' && github.actor_id == '10056645'	All other actors; immune to username-reassignment because actor_id is permanent
2	Trigger = pull_request (not pull_request_target)	Fork PRs don't get secrets per GitHub default policy
3	claude-code-action pinned by commit SHA 51ea8ea7...	Tag-hijack of v1 doesn't change what we run
4	Explicit minimal permissions: (PR write, contents read)	Token-scope minimization
5	concurrency: cancel-in-progress per PR head	Rapid push cycles don't burn budget
6	Detect job path-shape-validates Tier-5 files	${{ matrix.file }} interpolation injection blocked even if a hostile filename slips through

Phase A — your one-time setup

# On your machine:
claude update            # ensure v1.0.44+
claude setup-token       # prints CLAUDE_CODE_OAUTH_TOKEN

Then in browser: Repo Settings → Secrets and variables → Actions → New repository secret

• Name: CLAUDE_CODE_OAUTH_TOKEN
• Value: token from above

Once added, mark this PR ready for review and the workflow will fire on the next push.

Files

• .github/workflows/mythos-auto.yml — workflow (detect → scan matrix → aggregate)
• AGENTS.md — new "Auto-runner" subsection under Mythos pipeline
• CHANGELOG.md — [Unreleased] / Added entry

How this fits with mythos-gate.yml

mythos-gate.yml (label-only check) stays as source of truth.
The auto-runner is one way the mythos-pass-done label gets
applied — not the only way. Contributors without OAuth access (or
non-avrabe actors) continue to use the documented honor-system flow:
run discover.md in a fresh Claude Code session, post findings/NO
FINDINGS comment, apply label manually.

Test plan

• Workflow YAML validates (actionlint if available)
• On a Tier-5-touching PR by avrabe: workflow runs, posts comment, applies/withholds label per verdict
• On a PR by anyone else: workflow's first job is skipped (job-level if: fails); no token leaked, no comment posted
• On a PR with no Tier-5 changes: detect job sets any=false, downstream jobs skip cleanly
• Hostile filename test: a path like meld-core/src/parser.rs;evil doesn't pass the path-shape filter and is logged as a warning

Cost / quota note

Token usage draws from the Max-plan subscription quota, shared with
interactive Claude Code use. A burst of Tier-5 PRs could starve
interactive sessions during the same window. Refresh-token gap
tracked at anthropics/claude-code-action#727.

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

⚠️ 15/19 verified — 4 missing regression tests

	count
Passed (≥1 test, all green)	15
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	4

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

• LS-CP-4
• LS-A-8
• LS-A-9
• LS-A-19

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}

[avrabe]

Admin-merge per #139 (smithy capacity)

9 checks green + 2 expected skips (Mythos pass, Aggregate findings + label — correctly skipped because this PR touches no Tier-5 source). The remaining 3 — Clippy, Coverage, fuzz_resolver_terminates — have been queued ~2h40m against the rust-cpu pool, which is 7/7 busy on org-wide work (the documented #139 §4 cross-org contention pattern).

This is the same admin-merge case as PR #161 yesterday. The workflow added here is single-actor-scoped (only avrabe can trigger it), and the new Detect Tier-5 changes job ran green proving the actor gate is wired correctly.

Admin-merge counter for #139 since last reset:

• PR feat(ci): LS-N verification gate (spar-pattern port) #161 — admin-merged (yesterday, counter reset)
• PR feat(ci): Mythos delta-pass auto-runner (single-actor, OAuth-token) #162 — admin-merged (this PR, +1 stuck)

Will track the reset back into #139 after merge.