An issue becomes a pull request

security.yaml is AWML 0.3, as it was pushed. The registry draws, checks and fits it converted to AWML 0.8.

# An issue the maintainer labels build becomes a pull request, by who may see each part. The
# repository is public, so everything here sits in one scope: anyone may read the issues, the
# threads and the branches. What matters is who may act. Only people with write access can add a
# label, so the label is the decision. The repository's own token opens the pull request; only the
# maintainer's own account merges it, which is their yes. Answering new issues with options is left
# out: it reads the maintainer's private notes, so it stays an interactive session.
awml: "0.3"
title: A decision on an issue becomes a pull request
view: security
groups:
  - { id: public, label: "public: anyone who reads the repository", processing: any }
parts:
  - { id: comment, kind: trigger, label: "The build label is added to an issue", wait: PT1H }
  - { id: token, kind: connector, label: "The repository, through its own Actions token", in: public }
  - { id: who, kind: code, op: sort, label: "Sort by rule: is the label build?", in: public }
  - { id: repo, kind: context, label: "The spec, guide, code and AGENTS.md", in: public }
  - { id: build, kind: ai, op: do, label: "Write the change test first, on a branch", in: public }
  - { id: branch, kind: context, label: "The branch", in: public }
  - { id: gate, kind: code, op: check, label: "Run the tests, vet, the examples and wasm parity", in: public }
  - { id: open, kind: code, op: do, label: "Open a pull request that closes the issue", in: public }
  - { id: pr, kind: outside, label: "Open the pull request: Allow", in: public }
  - { id: account, kind: connector, label: "The repository, through the maintainer's account", in: public }
  - { id: merge, kind: person, op: do, label: "Review the pull request and merge it", in: public }
  - { id: main, kind: outside, label: "Merge into main: Ask", in: public }
  - { id: strangers, kind: comment, label: "Anyone can comment, so the thread the build step reads holds strangers' text, and that step can push. AWML can't mark this yet (awml #5)" }
  - { id: held, kind: comment, label: "Only people with write access can add a label, and GitHub holds that, not a prompt, so a stranger's comment starts nothing. Only branch protection keeps the build step off main (awml #22)" }
  - { id: verdict, kind: comment, label: "The check runs where the build step can't reach, and its verdict is in its own record (awml #13, #20)" }
lines:
  - { from: comment, to: who, kind: start, label: "the label" }
  - { from: who, to: build, kind: start, label: "[build]" }
  - { from: token, to: build, kind: data, label: "the issue's thread" }
  - { from: repo, to: build, kind: data }
  - { from: build, to: branch, kind: data }
  - { from: branch, to: gate, kind: data }
  - { from: gate, to: open, kind: start, label: "[all pass]" }
  - { from: branch, to: open, kind: data }
  - { from: open, to: pr, kind: data }
  - { from: pr, to: token, kind: data }
  - { from: account, to: merge, kind: data, label: "the pull request" }
  - { from: merge, to: main, kind: data }
  - { from: main, to: account, kind: data }
  - { from: strangers, to: build, kind: tie }
  - { from: held, to: comment, kind: tie }
  - { from: verdict, to: gate, kind: tie }

platform.yaml is AWML 0.3, as it was pushed. The registry draws, checks and fits it converted to AWML 0.8.

# The same workflow as the security view, by where each part runs. GitHub decides whether a label
# starts anything, before any runner exists. The agent works in one job, and the checks and the
# pull request run in a second job on a fresh runner, which shares none of the first's access, so
# the agent can't write the verdict the pull request relies on.
awml: "0.3"
title: A decision on an issue becomes a pull request
view: platform
groups:
  - { id: github, label: "GitHub: issues, branches, pull requests" }
  - { id: agentjob, label: "Actions job: Claude Code, claude-opus-5-5, on the maintainer's subscription", platform: actions-agent }
  - { id: codejob, label: "Actions job: checks and the pull request", platform: actions-code }
  - { id: browser, label: "The maintainer's browser" }
parts:
  - { id: comment, kind: trigger, label: "The build label is added to an issue", in: github }
  - { id: token, kind: connector, label: "The repository, through its own Actions token", in: github }
  - { id: who, kind: code, op: sort, label: "Sort by rule: is the label build?", in: github }
  - { id: repo, kind: context, label: "The spec, guide, code and AGENTS.md", in: github }
  - { id: build, kind: ai, op: do, label: "Write the change test first, on a branch", in: agentjob }
  - { id: branch, kind: context, label: "The branch", in: github }
  - { id: gate, kind: code, op: check, label: "Run the tests, vet, the examples and wasm parity", in: codejob }
  - { id: open, kind: code, op: do, label: "Open a pull request that closes the issue", in: codejob }
  - { id: pr, kind: outside, label: "Open the pull request: Allow", in: github }
  - { id: account, kind: connector, label: "The repository, through the maintainer's account", in: github }
  - { id: merge, kind: person, op: do, label: "Review the pull request and merge it", in: browser }
  - { id: main, kind: outside, label: "Merge into main: Ask", in: github }
  - { id: strangers, kind: comment, label: "Anyone can comment, so the thread the build step reads holds strangers' text, and that step can push. AWML can't mark this yet (awml #5)" }
  - { id: held, kind: comment, label: "Only people with write access can add a label, and GitHub holds that, not a prompt, so a stranger's comment starts nothing. Only branch protection keeps the build step off main (awml #22)" }
  - { id: verdict, kind: comment, label: "The check runs where the build step can't reach, and its verdict is in its own record (awml #13, #20)" }
lines:
  - { from: comment, to: who, kind: start, label: "the label" }
  - { from: who, to: build, kind: start, label: "[build]" }
  - { from: token, to: build, kind: data, label: "the issue's thread" }
  - { from: repo, to: build, kind: data }
  - { from: build, to: branch, kind: data }
  - { from: branch, to: gate, kind: data }
  - { from: gate, to: open, kind: start, label: "[all pass]" }
  - { from: branch, to: open, kind: data }
  - { from: open, to: pr, kind: data }
  - { from: pr, to: token, kind: data }
  - { from: account, to: merge, kind: data, label: "the pull request" }
  - { from: merge, to: main, kind: data }
  - { from: main, to: account, kind: data }
  - { from: strangers, to: build, kind: tie }
  - { from: held, to: comment, kind: tie }
  - { from: verdict, to: gate, kind: tie }