From d0a0989a2164eb2c27305b2e73f3686ddaacaa2a Mon Sep 17 00:00:00 2001
From: dan-claude-bot <danielarturomt@gmail.com>
Date: Wed, 22 Jul 2026 15:52:42 +0000
Subject: [PATCH] =?UTF-8?q?ci:=20interim=20labels-bootstrap=20dispatch=20?=
 =?UTF-8?q?=E2=80=94=20the=20taxonomy=20as=20a=20job,=20not=20a=20paste?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Label definitions need write; the agents team is triage on purpose, and
the Actions GITHUB_TOKEN is how the family converges label taxonomies
without granting any agent identity write (box/rig/cast labels.yml
precedent). Deletable the day #10 lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/labels-bootstrap.yml | 61 ++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 .github/workflows/labels-bootstrap.yml

diff --git a/.github/workflows/labels-bootstrap.yml b/.github/workflows/labels-bootstrap.yml
new file mode 100644
index 0000000..12005d4
--- /dev/null
+++ b/.github/workflows/labels-bootstrap.yml
@@ -0,0 +1,61 @@
+name: labels-bootstrap
+# INTERIM — delete when #10 (the reusable labels workflow) lands: its
+# bootstrap dispatch carries this same table and replaces this file.
+#
+# Why a job at all (the family's pattern — box/rig/cast labels.yml): label
+# DEFINITIONS (create/edit) need write, and the agents team is deliberately
+# triage-only — "only humans merge" as permission model, not doctrine. The
+# Actions GITHUB_TOKEN is the repo's own token, so this workflow converges
+# the taxonomy without granting any agent identity write. Run it from the
+# Actions tab (workflow_dispatch needs write — the maintainer's click).
+#
+# The table is LABELS.md made executable; --force makes every row an
+# upsert, so re-runs converge names, colors AND descriptions idempotently.
+on:
+  workflow_dispatch:
+
+permissions:
+  issues: write
+
+jobs:
+  bootstrap:
+    runs-on: ubuntu-latest
+    steps:
+      - name: converge the label taxonomy (LABELS.md)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          while IFS='|' read -r name color desc; do
+            [ -n "$name" ] || continue
+            gh label create "$name" -R "$GITHUB_REPOSITORY" --color "$color" --description "$desc" --force
+          done <<'EOF'
+          state:building|FBCA04|PR is a draft — the builder is still building
+          state:bots-reviewing|1D76DB|Waiting on the reviewer panel to finish the round
+          state:addressing|D93F0B|Round complete without full approval — builder owes the single reply + fixes
+          state:needs-human|8250DF|Zero blockers, panel approved the current head — a human could merge now
+          blocker:conflict|B60205|Does not merge — the builder owes a rebase
+          blocker:ci-red|B60205|A check is failing — the builder owes a fix (not a rebase)
+          blocker:unrequested|E99695|Somebody still owes a verdict and nobody was asked
+          blocker:drill-pending|B60205|A release PR whose version has no drills/X.Y.Z.md record — correct but unevidenced
+          stale|B60205|No activity for 48h — sweep-managed, never hand-applied
+          blocked|6A737D|Waiting on another issue or PR to land first
+          release|0E8A16|Release flow, versioning, packaging work
+          merge-next|0E8A16|Head of the merge queue — merge this one next
+          needs-triage|FBCA04|Did not come through triage — owes normalization or conversion to a discussion
+          ready|0E8A16|Triaged, spec complete, unblocked — a builder can start now and succeed
+          claimed|1D76DB|A builder owns it: assignee set, draft PR expected shortly
+          epic|5319E7|Organizes other issues via a dependency-ordered task list — builders never pick it
+          scope:release-flow|C5DEF5|The reusable release workflow, decide, the doors
+          scope:guards|C5DEF5|changelog-armed / changelog-monotonic / drill-recorded
+          scope:labels|C5DEF5|The labels workflow, reconciler, the taxonomy
+          scope:docs|C5DEF5|README doctrine, CONSUMERS.md, the role files
+          EOF
+      - name: default labels that are not part of the taxonomy are deleted
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # delete is not an upsert: already-gone exits non-zero — swallow it
+          # so re-runs converge instead of erroring after first success.
+          for L in duplicate invalid question wontfix "help wanted" "good first issue"; do
+            gh label delete "$L" -R "$GITHUB_REPOSITORY" --yes 2>/dev/null || true
+          done