From 25636af04f2663057f3f18fdaa1ef3a8d3bfe74b Mon Sep 17 00:00:00 2001
From: Jonathan Haas <15969068+haasonsaas@users.noreply.github.com>
Date: Wed, 15 Apr 2026 20:38:06 -0700
Subject: [PATCH 1/3] ci: dispatch sync notification to platform monorepo on
 push

---
 .github/workflows/notify-platform.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .github/workflows/notify-platform.yml

diff --git a/.github/workflows/notify-platform.yml b/.github/workflows/notify-platform.yml
new file mode 100644
index 0000000..c1ca488
--- /dev/null
+++ b/.github/workflows/notify-platform.yml
@@ -0,0 +1,24 @@
+name: Notify Platform Monorepo
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Dispatch sync to platform
+        env:
+          GH_TOKEN: ${{ secrets.ADMIN_CONTROL_PLANE_SYNC_TOKEN || secrets.GH_BOT_TOKEN || secrets.PAT || github.token }}
+        run: |
+          service="${GITHUB_REPOSITORY#*/}"
+          gh api repos/evalops/platform/dispatches \
+            -X POST \
+            -f event_type="upstream-service-push" \
+            -f "client_payload[service]=${service}" \
+            -f "client_payload[source_sha]=${GITHUB_SHA}" \
+            -f "client_payload[source_ref]=${GITHUB_REF_NAME}"

From c916332d3291425013be2b50495db6d3ec4abe00 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Thu, 16 Apr 2026 03:43:00 +0000
Subject: [PATCH 2/3] Fail early when platform dispatch token is missing

---
 .github/workflows/notify-platform.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/notify-platform.yml b/.github/workflows/notify-platform.yml
index c1ca488..01fd81a 100644
--- a/.github/workflows/notify-platform.yml
+++ b/.github/workflows/notify-platform.yml
@@ -13,8 +13,13 @@ jobs:
     steps:
       - name: Dispatch sync to platform
         env:
-          GH_TOKEN: ${{ secrets.ADMIN_CONTROL_PLANE_SYNC_TOKEN || secrets.GH_BOT_TOKEN || secrets.PAT || github.token }}
+          GH_TOKEN: ${{ secrets.ADMIN_CONTROL_PLANE_SYNC_TOKEN || secrets.GH_BOT_TOKEN || secrets.PAT }}
         run: |
+          if [ -z "${GH_TOKEN}" ]; then
+            echo "::error::Set ADMIN_CONTROL_PLANE_SYNC_TOKEN, GH_BOT_TOKEN, or PAT to dispatch to evalops/platform."
+            exit 1
+          fi
+
           service="${GITHUB_REPOSITORY#*/}"
           gh api repos/evalops/platform/dispatches \
             -X POST \

From 3977ae4b4c372ffd5fa14d09acca1363cf9fac08 Mon Sep 17 00:00:00 2001
From: Jonathan Haas <15969068+haasonsaas@users.noreply.github.com>
Date: Wed, 15 Apr 2026 20:45:49 -0700
Subject: [PATCH 3/3] fix: remove github.token fallback, add explicit token
 check

---
 .github/workflows/notify-platform.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/notify-platform.yml b/.github/workflows/notify-platform.yml
index 01fd81a..5f128db 100644
--- a/.github/workflows/notify-platform.yml
+++ b/.github/workflows/notify-platform.yml
@@ -9,17 +9,16 @@ permissions:
 
 jobs:
   dispatch:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Dispatch sync to platform
         env:
           GH_TOKEN: ${{ secrets.ADMIN_CONTROL_PLANE_SYNC_TOKEN || secrets.GH_BOT_TOKEN || secrets.PAT }}
         run: |
-          if [ -z "${GH_TOKEN}" ]; then
-            echo "::error::Set ADMIN_CONTROL_PLANE_SYNC_TOKEN, GH_BOT_TOKEN, or PAT to dispatch to evalops/platform."
+          if [[ -z "${GH_TOKEN}" ]]; then
+            echo "::error::No cross-repo token configured. Set ADMIN_CONTROL_PLANE_SYNC_TOKEN, GH_BOT_TOKEN, or PAT in repo secrets."
             exit 1
           fi
-
           service="${GITHUB_REPOSITORY#*/}"
           gh api repos/evalops/platform/dispatches \
             -X POST \