chore: update fullsend shim workflow

[fullsend-ai-fullsend]

This PR updates the fullsend shim workflow to match the current template in the .fullsend config repo.

The shim content has drifted from the template — this brings it back in sync.

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 6:48 AM UTC · Completed 6:48 AM UTC
Commit: 9bd7234 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:01 PM UTC · Completed 6:08 PM UTC
Commit: fa3e775 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under .github/, which is a protected path requiring human approval. The PR has no linked issue justifying the change to governance/infrastructure files. While the change is a comment-only addition (managed-file headers and a YAML document separator) from the fullsend template sync bot, protected-path changes always require explicit human review regardless of scope.
  Remediation: Link an issue documenting the template sync policy and why this protected-path change is authorized, or obtain explicit human approval on this PR.

Previous run

Review

Findings

High

• [protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under .github/, which is a protected path requiring human approval. The PR has no linked issue justifying the change to governance/infrastructure files. While the change is a comment-only addition from the fullsend template sync bot, protected-path changes always require explicit human review regardless of scope.
  Remediation: Link an issue documenting the template sync policy and why this protected-path change is authorized, or obtain explicit human approval on this PR.

Info

• [authorization-inference] .github/workflows/fullsend.yaml — This PR was authored by fullsend-ai-fullsend[bot], an automated bot performing template synchronization. The change is mechanical (adding 4 lines of management comments and a YAML document marker) with no linked issue. Authorization is inferred from the mechanical nature of the change and the bot's identity.

• [documentation-pattern] .github/workflows/fullsend.yaml:1 — The managed-file header pattern (management comment + upstream URL + document marker + managed-below marker) is new to this repository. No other workflow or config files use this convention.

Previous run (2)

Review

Findings

High

• [protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under .github/, which is a protected path requiring human approval. The PR has no linked issue justifying the change to governance/infrastructure files. While the change is a trivial 2-line addition (YAML document marker and management comment) from an automated bot, protected-path changes always require explicit human review regardless of scope.
  Remediation: Link an issue documenting the template sync policy and why this protected-path change is authorized, or obtain explicit human approval on this PR.

Low

• [edge-case] .github/workflows/fullsend.yaml:3 — The # lint-workflow-size: max-lines=280 directive moves from line 1 to line 3 due to the new --- marker and comment. If the linting tool that processes this directive is position-sensitive, the check could silently stop being enforced.

• [scope-verification] .github/workflows/fullsend.yaml — The PR is labeled as a chore but adds a "do not edit" management comment suggesting automated template management, which may be a structural/process change rather than simple maintenance.

Info

• [formatting-consistency] .github/workflows/fullsend.yaml:1 — The YAML document start marker --- is not used anywhere else in the repository's YAML files. This may be intentional as part of template sync with the upstream .fullsend config repo.

• [documentation-pattern] .github/workflows/fullsend.yaml:2 — The "fullsend managed below - do not edit" comment pattern is new to this repository. No other configuration or workflow files use this convention. See also: [architectural-coherence] finding at this location — the managed convention is not documented in project architecture docs.

• [authorization-inference] .github/workflows/fullsend.yaml — This PR was authored by fullsend-ai-fullsend[bot], suggesting automated template synchronization. The bot's authority and scope are not documented in this repository.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[low] edge-case

The lint-workflow-size: max-lines=280 directive moves from line 1 to line 3 due to the new --- marker and comment. If the linting tool is position-sensitive, the check could silently stop being enforced.

[fullsend-ai-review]

[info] formatting-consistency

The YAML document start marker --- is not used anywhere else in the repository YAML files. This may be intentional as part of template sync.

[fullsend-ai-review]

[info] documentation-pattern

The fullsend managed below - do not edit comment pattern is new to this repository. No other configuration or workflow files use this convention.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:18 PM UTC · Completed 4:27 PM UTC
Commit: 8cff4c7 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[info] documentation-pattern

The managed-file header pattern (management comment + upstream URL + document marker + managed-below marker) is new to this repository. No other workflow or config files use this convention.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:03 PM UTC · Completed 5:12 PM UTC
Commit: 9dc8e9c · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 6:58 PM UTC · Completed 7:08 PM UTC
Commit: 7a854fe · View workflow run →

[fullsend-ai-retro]

PR #29 in fullsend-ai/experiments was a 5-line mechanical template sync from fullsend-ai-fullsend[bot] updating the shim workflow file. It took 27 days to merge because the review agent blocked 3 times with a high-severity protected-path finding, even though the file declares itself managed by fullsend. The bot force-pushed 10 times, triggering 3 redundant review runs with identical findings. A human overrode the CHANGES_REQUESTED to merge. The retro itself is low-value dispatch on a scaffolding PR with no meaningful agent workflow to analyze.

Proposals filed

• Review agent should downgrade protected-path for platform bot managed-file updates (in fullsend-ai/fullsend)
• Evidence for #3090: retro dispatched on bot scaffolding PR in experiments repo (in fullsend-ai/fullsend)
• Evidence for #1287 and #1355: 3 redundant reviews on rebase-only force pushes (in fullsend-ai/fullsend)