feat: add pr iteration loop workflow

.github/aw/actions-lock.json

@@ -1,9 +1,14 @@
 {
   "entries": {
-    "github/gh-aw-actions/setup@v0.82.14": {
+    "github/gh-aw-actions/setup-cli@v0.88.7": {
+      "repo": "github/gh-aw-actions/setup-cli",
+      "version": "v0.88.7",
+      "sha": "5e508589e03a7757a7e05b26e834292f5445bfb6"
+    },
+    "github/gh-aw-actions/setup@v0.88.7": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.82.14",
-      "sha": "b6d1443e05b8716267fa19425b99aa4f12006b4a"
+      "version": "v0.88.7",
+      "sha": "5e508589e03a7757a7e05b26e834292f5445bfb6"
     }
   }
 }

.github/workflows/AUDIT.md

@@ -17,7 +17,7 @@ concrete reason, verified against the actual repository tree.
 | `ci.yml` | **FIX** | Added blocking `apps/web` type-check and ESLint steps before the build so CI fails fast on TypeScript or lint regressions. |
 | `codeql-analysis.yml` | **FIX** | Removed the OWASP `dependency-check` job — pinned to unstable `@main` and pointed at dead paths (`frontend/node_modules`, `src/mcp-bridge.py`); produced no usable SARIF. Switched the Node cache from the dead `frontend/node_modules` path to the npm download cache (`~/.npm`), which is correct for this npm-workspaces repo. CodeQL analysis itself retained. Dependency coverage already lives in `dependency-review.yml` + `security.yml`. |
 | `coverage.yml` | **FIX** | Added a top-level `name:` and the `workflow_dispatch` trigger the README already documented as available. |
-| `gh-aw-validation.yml` | **ADD** | Adds pinned gh-aw (`v0.82.14`) validation for EventRelay's custom markdown workflows. Enforces compile/validate plus actionlint, zizmor, and poutine checks, and verifies committed lock files. |
+| `gh-aw-validation.yml` | **ADD** | Adds pinned gh-aw (`v0.88.7`) validation for EventRelay's custom markdown workflows. Enforces compile/validate plus actionlint, zizmor, and poutine checks, and verifies committed lock files. |
 | `dependabot-auto-merge.yml` | KEEP | Comprehensive guards (same-repo, non-draft, SHA match, major excluded). |
 | `dependency-review.yml` | KEEP | PR dependency review with documented allow-lists. |
 | `deploy-cloud-run.yml` | KEEP | The real deployment path (GCP Cloud Run); manual dispatch. |

.github/workflows/README.md

@@ -10,8 +10,9 @@ workflow; this README is the index.
 |----------|------|---------|---------|
 | CI | `ci.yml` | push / PR to `main` | Type-check + lint `apps/web`, build the web app, lint Python (informational), run unit tests |
 | Coverage | `coverage.yml` | push / PR to `main`,`develop`; manual | Generate pytest coverage and upload lcov to Qlty |
-| gh-aw Validation | `gh-aw-validation.yml` | push / PR to `main` on gh-aw files; manual | Pin `gh aw` to `v0.82.14`, compile custom EventRelay `.md` workflows, and run validate + actionlint + zizmor + poutine checks |
+| gh-aw Validation | `gh-aw-validation.yml` | push / PR to `main` on gh-aw files; manual | Pin `gh aw` to `v0.88.7`, compile custom EventRelay `.md` workflows, and run validate + actionlint + zizmor + poutine checks |
 | Repo Assist | `repo-assist.md` / `.lock.yml` | manual (`workflow_dispatch`) | Read-only status reporter: checks `docs/AGENT_CAPABILITIES_CHECKLIST.md` and `docs/REPO_MAP.md` against the current tree and posts a single summary comment; never writes to branches, labels, or pull requests |
+| PR Iteration Loop | `pr-iteration-loop.md` / `.lock.yml` | issue opened; PR opened/ready; weekdays + weekly; push to `main` | Long-running verified loop that selects one failing/stale repository checkpoint, iterates on one canonical draft PR, records durable memory, and can publish a discussion digest with chart assets |
 | CodeQL Analysis | `codeql-analysis.yml` | push / PR to `main`; weekly (Mon 06:00 UTC) | Static security analysis for JavaScript/TypeScript and Python |
 | Security Scan | `security.yml` | push / PR to `main`; weekly (Sun 00:00 UTC) | npm audit, Python safety, bandit, Trivy image scan |
 | Dependency Review | `dependency-review.yml` | PR to `main`,`develop` | Review new dependencies for vulnerabilities and license policy |

.github/workflows/gh-aw-validation.yml

@@ -8,13 +8,15 @@ on:
       - ".github/workflows/*.lock.yml"
       - ".github/workflows/gh-aw-validation.yml"
       - ".github/aw/actions-lock.json"
+      - ".poutine.yml"
   pull_request:
     branches: [main]
     paths:
       - ".github/workflows/*.md"
       - ".github/workflows/*.lock.yml"
       - ".github/workflows/gh-aw-validation.yml"
       - ".github/aw/actions-lock.json"
+      - ".poutine.yml"
   workflow_dispatch:
 
 permissions:
@@ -47,15 +49,15 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           gh extension remove aw || true
-          gh extension install github/gh-aw --pin v0.82.14
+          gh extension install github/gh-aw --pin v0.88.7
           ACTUAL_VERSION="$(gh aw version 2>&1 | awk '{print $NF}')"
-          if [ "$ACTUAL_VERSION" != "v0.82.14" ]; then
-            echo "Expected gh aw v0.82.14 but got $ACTUAL_VERSION"
+          if [ "$ACTUAL_VERSION" != "v0.88.7" ]; then
+            echo "Expected gh aw v0.88.7 but got $ACTUAL_VERSION"
             exit 1
           fi
-          PRERELEASE="$(gh api repos/github/gh-aw/releases/tags/v0.82.14 --jq '.prerelease')"
+          PRERELEASE="$(gh api repos/github/gh-aw/releases/tags/v0.88.7 --jq '.prerelease')"
           if [ "$PRERELEASE" != "false" ]; then
-            echo "v0.82.14 must remain a stable release"
+            echo "v0.88.7 must remain a stable release"
             exit 1
           fi
 
@@ -64,21 +66,27 @@ jobs:
           python - <<'PY'
           import json
           from pathlib import Path
-
+          
           data = json.loads(Path('.github/aw/actions-lock.json').read_text())
-          key = 'github/gh-aw-actions/setup@v0.82.14'
-          entry = data.get('entries', {}).get(key)
-          if not entry:
-              raise SystemExit(f'actions-lock.json missing required entry: {key}')
-          if entry.get('sha') != 'b6d1443e05b8716267fa19425b99aa4f12006b4a':
-              raise SystemExit('actions-lock.json has unexpected setup SHA for v0.82.14')
+          expected = {
+              'github/gh-aw-actions/setup-cli@v0.88.7': '5e508589e03a7757a7e05b26e834292f5445bfb6',
+              'github/gh-aw-actions/setup@v0.88.7': '5e508589e03a7757a7e05b26e834292f5445bfb6',
+          }
+          entries = data.get('entries', {})
+          for key, sha in expected.items():
+              entry = entries.get(key)
+              if not entry:
+                  raise SystemExit(f'actions-lock.json missing required entry: {key}')
+              if entry.get('sha') != sha:
+                  raise SystemExit(f'actions-lock.json has unexpected SHA for {key}')
           PY
 
       - name: Compile and validate workflows
         run: |
           gh aw compile \
             canonical-pr-remediator \
             focused-coverage-controller \
+            pr-iteration-loop \
             repo-assist \
             --validate \
             --approve
@@ -88,6 +96,7 @@ jobs:
           gh aw compile \
             canonical-pr-remediator \
             focused-coverage-controller \
+            pr-iteration-loop \
             repo-assist \
             --actionlint \
             --zizmor \
@@ -99,4 +108,5 @@ jobs:
           git diff --exit-code -- \
             .github/workflows/canonical-pr-remediator.lock.yml \
             .github/workflows/focused-coverage-controller.lock.yml \
+            .github/workflows/pr-iteration-loop.lock.yml \
             .github/workflows/repo-assist.lock.yml