[aitrawog]

Summary

Installs the org's tag-on-merge caller. The predecessor did not land: #4 reached its 5th counting verdict and was
auto-closed, and main is unchanged. The file is taken verbatim from its corrected source in opencharly/plugin-box, which
carries all three fixes — the comment is attributed rather than asserting another repository's history, the readiness
probe's bounds are named env values, and the millisecond conversion is the named constant MS_PER_MINUTE. Digest
f20e026f62827704..., identical to every copy org-wide.

Supersedes

#4 — auto-closed at its 5th counting verdict (AI_REVIEW_AUTO_CLOSE_AFTER=5); that thread stays
closed and must not be reopened. This successor carries the corrected artefact from a fresh branch, and the rollout's shared
record is opencharly/.github#204.

How tested

Every value below is re-derived at this PR's own head.

$ git show --stat --oneline HEAD
608f077 feat(ci): install the tag-on-merge caller, successor to auto-closed #4
 .github/workflows/tag-on-merge.yml | 94 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)

$ git diff origin/main...HEAD --stat
.github/workflows/tag-on-merge.yml | 94 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)

$ sha256sum .github/workflows/tag-on-merge.yml
f20e026f6282770422863528763e9e6c427d9eca7c7f2e8db940ba45c144087a  .github/workflows/tag-on-merge.yml

Change-class gate: this repository declares no workflow gate of its own. The org declares the workflow linter/schema
gate workflow-checks in opencharly/.github, observed passing on opencharly/.github#207. Live-execution status,
stated explicitly: the caller's code path has not executed yet in this repo — it first runs on a merge or a validator
completion after this lands.

Rulebook compliance

• R1 — the predecessor's findings are discharged by the artefact installed here; the shared record is Rollout (operator-authorized): reconcile 423 per-repo tag-on-merge callers still on the mutable Node 20 action .github#204.
• R2 — one canonical caller; this repo carries its copy at the source digest.
• R3 — no unnamed magic numbers: the readiness window, poll interval and millisecond conversion are all named.
• R4 — product before prose; the file is taken from the corrected source rather than re-described.
• R5 — no legacy path, name or stale documentation is introduced. The origin history the comment cites is present but attributed — it reads measured where this caller originated, so those counts are reported as another repository's and are not asserted as this repository's own.
• R6 — worktree off fresh origin/main; no force-push, no bypass.
• R7 — the changed artefact is workflow config; the values above are captured from the commands shown, and the parser output is reproducible from the file.
• R8 — N/A — no live service boundary.
• R9/R10 — R9: N/A (no binary). R10: the org's workflow-checks gate is named above with its provenance.
• R0 — the owning skills were loaded before acting: /charly-internals:git-workflow and /charly-internals:repo-setup.
• PIL — N/A — no RDD spike, no ADE plan, no schema change.
• DISP — N/A — nothing is destroyed or rebuilt.
• QUAL — N/A — no Go source.
• COORD — the predecessor is superseded and its issue is updated; shared findings live on Rollout (operator-authorized): reconcile 423 per-repo tag-on-merge callers still on the mutable Node 20 action .github#204.
• Cutover — one file added; the caller's own fixes travel with it.
• ARCH — correct by placement: a CI caller belongs in .github/workflows/, and its source is owned by opencharly/plugin-box.

Filed issues

• Rollout (operator-authorized): reconcile 423 per-repo tag-on-merge callers still on the mutable Node 20 action .github#204 — the rollout's shared record for the caller and its copies.

Change classification

CI workflow configuration: adds the org's caller, taken verbatim from its corrected source (+94). No image, schema,
pin or runtime code.

Assisted-by: DeepSeek Harness ollama-cloud/deepseek-v4.1-flash (analysed on a live system)

[github-actions]

Review — PASS

Head SHA: 608f077d74c347ca4511a2f1502e2a5080b39d75 (branch: feat/tag-on-merge-caller-v3)

Security screen: PASS — additive CI caller; no secrets/egress, no guardrail weakening, @main/@v7 refs are org-internal and expected, no embedded directives.
Comment thread: empty (0 comments) — nothing to disposition.
Checklist: All applicable rules PASS or NA.

• A1/A2/A3: body accounts for the single added file, names its change-class gate (org workflow-checks, no local gate), is honest that the code path has not executed pre-merge, and does not inflate the tier (analysed on a live system is the correct ceiling for a change that has not run live).
• R1–R10: the three predecessor findings are verifiably present in the diff — attributed origin comment ("measured where this caller originated"), named env bounds (READINESS_WINDOW_MS/POLL_INTERVAL_MS), and named MS_PER_MINUTE; no forbidden framing; no legacy path; git-safety and disposable claims hold; filed issue opencharly/.github#204 listed.
• PIL/SDD/ADE, DISP, QUAL: NA — no candy, schema, Go, or destroy/rebuild.
• ARCH: placement CORRECT — a CI caller belongs in .github/workflows/, reusable owned by .github.
• COORD: successor names its predecessor (feat(ci): install the tag-on-merge caller (clean re-open of #3) #4).

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run