feat(oblt-aw,docs-aw): event-scoped orchestrators reduce check noise

.cursor/rules/protected-oblt-aw-workflow.mdc

@@ -1,14 +1,14 @@
 ---
-description: Client workflows — `.github/remote-workflow-template/obs/`
+description: Client workflow templates live under remote-workflow-template only
 alwaysApply: true
 ---
 
 # Client workflows — `.github/remote-workflow-template/obs/`
 
-**Do not** add per-workflow `trigger-oblt-aw-*.yml` client entrypoints.
+**Do not** add a monolithic `.github/workflows/oblt-aw.yml` entrypoint (removed).
 
-**Where to change consumer entrypoints:** [`.github/remote-workflow-template/obs/.github/workflows/trigger-oblt-aw.yml`](.github/remote-workflow-template/obs/.github/workflows/trigger-oblt-aw.yml) and [`.github/remote-workflow-template/obs/.github/workflows/oblt-aw.yml`](.github/remote-workflow-template/obs/.github/workflows/oblt-aw.yml) only. Distribution installs that tree into target repositories.
+**Where to change consumer entrypoints:** [`.github/remote-workflow-template/obs/.github/workflows/trigger-oblt-aw-*.yml`](.github/remote-workflow-template/obs/.github/workflows/) only. Distribution installs that tree into target repositories.
 
-**Control-plane reusables** live under `.github/workflows/oblt-aw-*.yml` (ingress: `oblt-aw-ingress.yml`; shared prelude: `aw-prelude.yml`). **Do not** edit consumer copies under target repos from this repository except via distribution.
+**Control-plane reusables** live under `.github/workflows/oblt-aw-*.yml` and `.github/workflows/docs-aw-*.yml` (shared prelude: `aw-prelude.yml`). **Do not** edit consumer copies under target repos from this repository except via distribution.
 
 **Docs:** [docs/workflows/oblt-aw-client-template.md](docs/workflows/oblt-aw-client-template.md), [CONTRIBUTING.md](CONTRIBUTING.md).

.github/remote-workflow-template/docs/.github/workflows/trigger-docs-aw-issue-comment.yml

@@ -0,0 +1,24 @@
+name: Docs Agentic Workflow — Issue Comment
+
+# Distributed to repositories in config/docs/active-repositories.json.
+
+on:
+  issue_comment:
+    types: [edited]
+
+permissions:
+  contents: read
+  issues: read
+
+jobs:
+  run-aw:
+    permissions:
+      actions: read
+      checks: read
+      contents: read
+      discussions: write
+      issues: write
+      pull-requests: write
+    uses: elastic/oblt-aw/.github/workflows/docs-aw-event-issue-comment.yml@main # ratchet:exclude
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/remote-workflow-template/docs/.github/workflows/trigger-docs-aw-issues.yml

@@ -0,0 +1,29 @@
+name: Docs Agentic Workflow — Issues
+
+# Distributed to repositories in config/docs/active-repositories.json.
+
+on:
+  issues:
+    types: [opened]
+  workflow_dispatch:
+    inputs:
+      issue_number:
+        description: Issue number for Docs AI issue menu (manual refresh).
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  issues: read
+
+jobs:
+  run-aw:
+    permissions:
+      actions: read
+      contents: read
+      discussions: write
+      issues: write
+      pull-requests: write
+    uses: elastic/oblt-aw/.github/workflows/docs-aw-event-issues.yml@main # ratchet:exclude
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/remote-workflow-template/docs/.github/workflows/trigger-docs-aw-pull-request.yml

@@ -0,0 +1,20 @@
+name: Docs Agentic Workflow — AI PR Menu (collect)
+
+# Distributed to repositories in config/docs/active-repositories.json.
+# Fork-safe `pull_request` leg of the split-workflow pattern (see trigger-docs-aw-workflow-run.yml).
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+
+permissions:
+  contents: read
+  issues: read
+
+jobs:
+  run-aw:
+    permissions:
+      actions: write
+      contents: read
+      issues: read
+    uses: elastic/oblt-aw/.github/workflows/docs-aw-event-pull-request.yml@main # ratchet:exclude

.github/remote-workflow-template/docs/.github/workflows/trigger-docs-aw-workflow-run.yml

@@ -0,0 +1,30 @@
+name: Docs Agentic Workflow — AI PR Menu
+
+# Distributed to repositories in config/docs/active-repositories.json.
+
+on:
+  workflow_run:
+    workflows: ["Docs Agentic Workflow — AI PR Menu (collect)"]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      pull_request_number:
+        description: Pull request number for Docs PR AI menu (manual refresh).
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  issues: read
+
+jobs:
+  run-aw:
+    permissions:
+      actions: read
+      checks: read
+      contents: read
+      issues: write
+      pull-requests: write
+    uses: elastic/oblt-aw/.github/workflows/docs-aw-event-workflow-run.yml@main # ratchet:exclude
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/remote-workflow-template/obs/.github/workflows/trigger-oblt-aw-issue-comment.yml

@@ -0,0 +1,20 @@
+name: Observability Agentic Workflow — Issue Comment
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+
+jobs:
+  run-aw:
+    permissions:
+      actions: read
+      contents: write
+      discussions: write
+      issues: write
+      pull-requests: write
+    uses: elastic/oblt-aw/.github/workflows/oblt-aw-event-issue-comment.yml@main # ratchet:exclude
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/remote-workflow-template/obs/.github/workflows/trigger-oblt-aw-issues.yml

@@ -0,0 +1,22 @@
+name: Observability Agentic Workflow — Issues
+
+on:
+  issues:
+    types: [opened, labeled]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  run-aw:
+    permissions:
+      actions: read
+      contents: write
+      discussions: write
+      id-token: write
+      issues: write
+      pull-requests: write
+    uses: elastic/oblt-aw/.github/workflows/oblt-aw-event-issues.yml@main # ratchet:exclude
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}