[Phase-2] Queue and governance hardening

[Copilot]

• Explore repo and understand current state
• Fix queue idempotency guard: check existingContract && hadInProgress before any label mutations; duplicate fires are no-ops
• No silent swallow: upgrade core.warning → core.error for critical label-transition and rollback failures
• Fix label-sync push trigger: add .github/ISSUE_TEMPLATE/agent_task.yml to push paths
• Normalize agent profile: fix single-quote tool array in release-assistant.agent.md
• Harden AGENTS.md queue warning: expand to a prominent blockquote warning block
• Normalize PR template: add risk-label and agent:ready gating items to Scope Guard checklist
• Add .coverage to .gitignore
• Fix idempotency guard: remove agent:ready in the guard path so re-applying the label to an already-in-progress issue with an existing contract is cleaned up without duplicate enqueue or comment side effects
• bash scripts/verify passes (exit 0)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Phase-2] Queue and Governance Hardening - WebCoder</issue_title>
<issue_description>## Objective
Implement hardening requirements after bootstrap merge.

Required Outputs

• Queue idempotency safeguards
• Transition rollback cleanup path
• No silent swallow on critical label transitions
• Template and agent profile normalization
• Verification wording aligned to bash scripts/verify

Activation

Add agent:ready only after pilot issue is complete.
</issue_description>

<agent_instructions>Phase-2 hardening only. Keep scope to queue idempotency guard, critical transition error handling (no blanket silent catches), rollback cleanup for partial label mutation, label-sync push trigger, agent profile least-privilege, AGENTS queue warning, and strict PR template normalization. Provide deterministic verify evidence.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@Prekzursil @copilot Queue follow-up: please continue this Phase-2 hardening task and open/update the implementation PR. Keep scope strict to queue idempotency, label-sync push trigger, profile least-privilege, AGENTS warning, and PR template normalization. Include deterministic verification evidence.

• Fixes [Phase-2] Queue and Governance Hardening - WebCoder #8

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[devloai]

Unable to trigger custom agent "Code Reviewer". You have run out of credits 😔
Please upgrade your plan or buy additional credits from the subscription page.

[codacy-production]

Codacy's Analysis Summary

0 new issue (≤ 0 issue)
0 new security issue

Review Pull Request in Codacy →

✨ AI Reviewer available: add the codacy-review label to get contextual insights without leaving GitHub.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b26a5c5503

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep removing agent:ready on already-queued issues

This new early return skips all label cleanup when an issue already has both an execution contract and agent:in-progress, so if someone re-applies agent:ready later (or a duplicate label event arrives with that label present), the workflow now leaves agent:ready attached indefinitely instead of clearing it as before. That breaks the queue state invariant (ready vs in-progress) and can cause issues to appear queueable again even though work is already in progress.

Useful? React with 👍 / 👎.

[Prekzursil]

@copilot Please address the unresolved queue-state thread on this PR: preserve agent:ready cleanup when the idempotency guard detects an already in-progress issue with existing execution contract. Required behavior: on re-applying agent:ready, remove agent:ready and keep agent:in-progress without duplicate enqueue/comment side effects. Keep scope limited to .github/workflows/agent-task-queue.yml and tests/docs if needed.

[Copilot]

@copilot Please address the unresolved queue-state thread on this PR: preserve agent:ready cleanup when the idempotency guard detects an already in-progress issue with existing execution contract. R...

Fixed in cf0b756. The idempotency guard now removes agent:ready before returning when it detects an already-in-progress issue with an existing execution contract. agent:in-progress is left untouched and no duplicate comment is posted. 404s (label already gone) are handled silently; any other removal error is surfaced via core.error and re-thrown.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud