Review agent never dispatched for code-agent PRs due to broken label-based handoff

[fullsend-ai-retro]

What happened

PR #3868 (docs fix created by code agent from retro-filed issue #3861) was merged with only human review — no review agent ran. Investigation of 3 additional code-agent PRs (#3448, #3286, #3156) confirmed the same pattern: zero review agent activity on any of them.

The dispatch timeline for PR #3868:

1. PR opened by fullsend-ai-coder[bot] at 12:34:32 UTC (Jul 9)
2. ready-for-review label applied at 12:34:34 UTC
3. One fullsend dispatch run started at 12:34:36 UTC — the dispatch / dispatch job was cancelled
4. No further dispatch until human force-push 21 hours later
5. Post-force-push dispatches (runs 29085029733, 29085047789) both determined stage and then skipped all remaining steps
6. Human approved at 10:02:17 UTC (Jul 10), merged at 10:08:27 UTC — no automated review

The post-code.sh script (lines 535-544) explicitly acknowledges this gap in its comments: it applies the ready-for-review label because bot accounts fail is_event_actor_authorized on the pull_request_target.opened path. But the label-based fallback (issues.labeled → review dispatch) is not firing.

What could go better

The bot-to-bot handoff described in ADR 0054 ("Agent-to-agent handoffs use label-based triggers... label application requires write access — an implicit authorization gate") is not working for PR labels. The likely root cause is that adding a label to a PR via the Issues API (gh issue edit --add-label) fires pull_request.labeled (or pull_request_target.labeled) rather than issues.labeled, and the shim workflow only listens to issues: [opened, edited, labeled] — it does not listen to pull_request_target: [labeled].

The shim's pull_request_target event types are [opened, synchronize, ready_for_review, closed] — labeled is absent.

Confidence: high that the label-based dispatch path is broken for PR labels (4/4 code-agent PRs show zero review activity). Moderate confidence in the specific root cause (could also be token-related event suppression). The fix direction is the same regardless.

Impact: every code-agent PR skips automated review, relying entirely on human review. For PR #3868, the review agent could have validated the fixes and potentially caught the remaining sidebar inconsistencies (see related proposal). For PR #3448 (a code fix), the lack of automated review is a more significant quality gap.

Proposed change

Add labeled to the pull_request_target event types in both shim templates and add a routing case in the dispatch logic:

1. Shim templates (internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml and shim-workflow-call.yaml):
Add labeled to the pull_request_target.types array: [opened, synchronize, ready_for_review, labeled, closed]

2. Dispatch routing (internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml and .github/workflows/reusable-dispatch.yml) — add a labeled) case under the pull_request_target) block, after the opened|synchronize|ready_for_review) case:
When EVENT_ACTION is labeled and TRIGGERING_LABEL equals ready-for-review, set STAGE="review". No explicit auth check is needed because label application already requires write access.

3. Update ADR 0054 table (line ~117) to add pull_request_target.labeled as a gated path with implicit authorization via write-access requirement.

4. Update fullsend.yaml in the fullsend-ai/fullsend repo itself to include labeled in the pull_request_target.types array.

Validation criteria

1. Create a code-agent PR on fullsend-ai/fullsend (or a test repo) and verify the review agent dispatches within 5 minutes of PR creation
2. Check that the .fullsend repo shows a Review workflow run triggered by the labeled event
3. Verify the review agent posts a review comment on the PR
4. Confirm no duplicate dispatches (the pull_request_target.opened path should still skip for bot users, and only the labeled path triggers review)
5. Run the functional test suite to ensure no regressions in dispatch routing

---

Generated by retro agent from #3868

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 10:30 AM UTC · Completed 10:33 AM UTC
Commit: e8381e3 · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: High — every code-agent PR skips automated review (confirmed 4/4 PRs examined).

Root Cause: The shim workflow templates do not include labeled in their pull_request_target.types array. When post-code.sh applies the ready-for-review label to a PR, GitHub fires pull_request_target.labeled — but the shim only listens for [opened, synchronize, ready_for_review, closed], so the event is silently ignored. The issues.labeled path in the shim does not fire for PR labels.

Fix Scope (4 files + ADR update):

1. Shim templates (internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml and shim-workflow-call.yaml): Add labeled to pull_request_target.types
2. Dispatch routing (dispatch.yml and reusable-dispatch.yml): Add a labeled) case under pull_request_target) — when TRIGGERING_LABEL equals ready-for-review, set STAGE="review"
3. ADR 0054: Add pull_request_target.labeled to the gated path table
4. fullsend.yaml in this repo: Add labeled to pull_request_target.types

Related: Issue #3998 covers a complementary problem where the label is never applied (post-code.sh ordering). Both issues contribute to the review gap but have independent root causes and fixes.

Proposed Test:

1. Verify pull_request_target.labeled + ready-for-review label → STAGE=review
2. Verify pull_request_target.labeled + other labels → skip (no stage set)
3. Verify no duplicate dispatch (opened path still fails auth for bots)
4. Run functional dispatch routing test suite for regressions

---

Labels: This is a high-severity bug in the dispatch/shim layer affecting all code-agent PRs. No existing labels beyond ready-for-triage are present.

[fullsend-ai-coder]

🤖 Finished Code · ❌ Failure · Started 10:34 AM UTC · Completed 10:50 AM UTC
Commit: e8381e3 · View workflow run →