fix(sync): keep legacy orchestrator protected

[stranske]

Source: Issue #1836

Related to campaign issue #1836

Automated Status Summary

Scope

Sync/Dependabot Campaign Queue

Durable tracker — see docs/ops/DURABLE_TRACKING_ISSUES.md. The body below is regenerated each cycle by maint-82-sync-dependabot-campaign.yml; do not close as part of routine triage.

Remote discovery found more review-thread work than fits in a full GitHub issue body. The marker below retains the compact machine-readable queue for the local watcher.

Context for Agent

Related Issues/PRs

• stranske/Travel-Plan-Permission#1118
• stranske/Template#747
• stranske/trip-planner#1229
• stranske/Manager-Database#1070
• stranske/Portable-Alpha-Extension-Model#1822
• stranske/Trend_Model_Project#5331
• stranske/Collab-Admin#771
• stranske/learning-management-system#39
• stranske/Collab-Admin#745
• stranske/Trend_Model_Project#5309
• stranske/Portable-Alpha-Extension-Model#1800
• stranske/Manager-Database#1046
• stranske/Workflows#2126
• stranske/trip-planner#1206
• stranske/Inv-Man-Intake#436
• stranske/Pension-Data#443
• stranske/Workflows#2124
• stranske/Collab-Admin#740
• stranske/Portable-Alpha-Extension-Model#1796
• stranske/trip-planner#1202
• stranske/Ready#243
• stranske/Template#723
• stranske/Travel-Plan-Permission#1094
• stranske/Collab-Admin#730
• stranske/Trend_Model_Project#5295
• stranske/Workflows#210
• stranske/Manager-Database#1034
• stranske/trip-planner#1194
• stranske/Inv-Man-Intake#425
• stranske/Pension-Data#431
• stranske/Template#716
• stranske/Travel-Plan-Permission#1086
• stranske/Collab-Admin#723
• stranske/Trend_Model_Project#5278
• stranske/Portable-Alpha-Extension-Model#1779
• stranske/Manager-Database#1025
• stranske/trip-planner#1134
• stranske/Workflows#2081
• stranske/Inv-Man-Intake#409
• stranske/Pension-Data#416
• stranske/Counter_Risk#582
• stranske/Template#709
• stranske/Travel-Plan-Permission#1074
• stranske/Workflows#2080
• stranske/trip-planner#1112
• stranske/Inv-Man-Intake#391
• stranske/Pension-Data#404
• stranske/Counter_Risk#562
• stranske/Template#700
• stranske/Travel-Plan-Permission#1058
• stranske/Trend_Model_Project#5232
• stranske/Workflows#2050
• stranske/Portable-Alpha-Extension-Model#1749
• stranske/Manager-Database#972
• stranske/Ready#208
• stranske/Inv-Man-Intake#375
• stranske/Pension-Data#390
• stranske/Counter_Risk#548
• stranske/Workflows#2044
• stranske/Template#688
• stranske/Workflows#2040
• stranske/Collab-Admin#699
• stranske/Workflows#2033
• stranske/Trend_Model_Project#5228
• stranske/Portable-Alpha-Extension-Model#1745
• stranske/Workflows#2032
• stranske/Manager-Database#968
• stranske/Workflows#2030
• stranske/trip-planner#1094
• stranske/Ready#204
• stranske/Inv-Man-Intake#371
• stranske/Pension-Data#386
• stranske/Counter_Risk#544
• stranske/Template#684
• stranske/Travel-Plan-Permission#1038
• stranske/Collab-Admin#695
• stranske/Counter_Risk#540
• stranske/Template#680
• stranske/Inv-Man-Intake#363
• stranske/Pension-Data#376
• stranske/Collab-Admin#687
• stranske/Trend_Model_Project#5216
• stranske/Workflows#2013
• stranske/Portable-Alpha-Extension-Model#1733
• stranske/Manager-Database#956
• stranske/Workflows#2011
• stranske/trip-planner#1082
• stranske/Inv-Man-Intake#358
• stranske/Workflows#2009
• stranske/Template#672
• stranske/Collab-Admin#680
• stranske/Trend_Model_Project#5209
• stranske/Portable-Alpha-Extension-Model#1726
• stranske/Manager-Database#949
• stranske/Ready#185
• stranske/Inv-Man-Intake#351
• stranske/Workflows#1996
• stranske/Pension-Data#364
• stranske/Workflows#1995
• stranske/Counter_Risk#524
• stranske/Template#665
• stranske/Travel-Plan-Permission#1013
• stranske/Workflows#1994
• stranske/Collab-Admin#679
• stranske/Trend_Model_Project#5208
• stranske/Workflows#2162
• #1796
• #730
• #700
• #968
• #2030
• #672
• #1985
• #5208

Tasks

• Updated: 2026-05-25T07:55:55.157Z
• Current sync hash: f344ec227f07
• Repos checked: 12/12
• Open sync PRs: 36
• Open Dependabot PRs: 0
• Active review threads queued: 27
• Items needing local Codex: 8
• Actionable local Codex items: 8
• Claimable local Codex items: 8
• Source-fixed candidates: 0
• Superseded sync candidates: 9
• Source sync states: current=9, superseded=9
• Finished local results without published source changes: 1
• Claimed local Codex items: 0
• Next claim lease expires: -

Acceptance criteria

• Acceptance criteria section missing from source issue.

Head SHA: 56669d6
Latest Runs: ✅ success — Gate
Required: gate: ✅ success

Workflow / Job	Result	Logs
Auto-label Dependabot PRs	⏭️ skipped	View run
Copilot code review	✅ success	View run
Gate	✅ success	View run
Health 40 Sweep	❔ startup failure	View run
Health 44 Gate Branch Protection	❔ in progress	View run
Health 45 Agents Guard	✅ success	View run
Health 50 Security Scan	✅ success	View run
Health 72 Template Sync	✅ success	View run
Maint 52 Validate Workflows	✅ success	View run
PR 11 - Minimal invariant CI	✅ success	View run
Selftest CI	✅ success	View run
Validate Sync Manifest	✅ success	View run

[Copilot]

Pull request overview

This PR tightens the agents-guard removal allowlist so the legacy unnumbered orchestrator workflow (.github/workflows/agents-orchestrator.yml) remains protected (removal is blocked), while still allowlisting cleanup of the numbered legacy orchestrator (agents-70-orchestrator.yml) for template-sync bootstrap scenarios. It also adds regression coverage in both the Node and Python test suites to prevent this policy from drifting again.

Changes:

• Remove .github/workflows/agents-orchestrator.yml from the consumer-only removal allowlist in agents-guard.
• Keep .github/workflows/agents-70-orchestrator.yml allowlisted for consumer repos (but still blocked in stranske/Workflows).
• Add JS + Python regression tests asserting unnumbered orchestrator deletions are blocked and the numbered orchestrator remains allowlisted for consumer repos.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
tests/workflows/test_agents_guard.py	Updates deletion-blocking fixtures to a non-allowlisted workflow and adds a Python regression test that deletion of agents-orchestrator.yml is blocked in consumer repos.
templates/consumer-repo/.github/scripts/agents-guard.js	Removes agents-orchestrator.yml from the consumer-only removal allowlist (template copy).
.github/scripts/agents-guard.js	Removes agents-orchestrator.yml from the consumer-only removal allowlist (source-of-truth copy).
.github/scripts/__tests__/agents-guard.test.js	Adjusts allowlist coverage and adds a JS regression test that agents-orchestrator.yml removals are blocked in consumer repos.

[stranske-keepalive]

Automated Status Summary

Head SHA: acafe86
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 1

Coverage Trend

Metric	Value
Current	93.12%
Baseline	85.00%
Delta	+8.12%
Minimum	70.00%
Status	✅ Pass

Top Coverage Hotspots (lowest coverage)

File	Coverage	Missing
src/cli_parser.py	81.8%	4
src/percentile_calculator.py	95.0%	1
src/aggregator.py	95.0%	2
src/__init__.py	100.0%	0
src/ndjson_parser.py	100.0%	0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[stranske]

Closing as superseded by #2163. The later source-fix pass and the current campaign tracker settled on retiring/removing the legacy consumer agents-orchestrator.yml template rather than protecting it from sync removal. #2163 has passing checks and carries that source-of-truth update.